问spring-boot-starter data-mongodb-从application.yml设置keystore密码以供使用X509连接

EN

@Configuration
@RequiredArgsConstructor
public class MongoX509CredentialClientSettingsBuilderCustomizer implements MongoClientSettingsBuilderCustomizer {

    private static final String MONGO_KEY_ENTRY_ALIAS = "mongo-client-key";

    private static final JcaX509CertificateConverter X509_CERTIFICATE_CONVERTER = new JcaX509CertificateConverter();

    private static final JcaPEMKeyConverter PEM_KEY_CONVERTER = new JcaPEMKeyConverter();

    private final MongoX509Properties properties;

    /**
     * Only customizes the {@link SslSettings} for use with X.509 Certificate
     * Authentication
     */
    @Override
    public void customize(Builder clientSettingsBuilder) {
        // @formatter:off
        clientSettingsBuilder
            .applyToSslSettings(builder -> builder
                    .applySettings(SslSettings
                            .builder()
                            .context(sslContext())
                            .enabled(true)
                            .build()))
            .credential(MongoCredential.createMongoX509Credential());
        // @formatter:on
    }

    /**
     * Creates an {@link SSLContext} that can connect to any endpoint exposing a
     * valid well known CA by the JRE. And uses a dynamic array of
     * {@link KeyManager} that contains the {@link X509Certificate} and
     * {@link PrivateKey} configured for use with a MongoDB instance.
     * 
     * @return
     */
    @SneakyThrows
    public SSLContext sslContext() {
        SSLContext sslContext = SSLContext.getInstance(properties.getTlsVersion());
        sslContext.init(keyManagers(x509Certificate(), privateKey()), trustManagers(), null);
        return sslContext;
    }

    /**
     * Creates an array of {@link TrustManager} containing the default set of
     * trusted certificate authorities. This is required to make a TLS connection to
     * the MongoDB instance. If MongoDB is Atlas then the CA is Let's Encrypt and
     * should already be trusted so copy that over to the SSLContext that we are
     * creating.
     * 
     * @return an array of {@link TrustManager} initialized with the default trust
     *         managers.
     */
    @SneakyThrows
    private TrustManager[] trustManagers() {
        TrustManagerFactory defaultTrustManagerFactory = TrustManagerFactory
                .getInstance(TrustManagerFactory.getDefaultAlgorithm());
        // Using null here init the trustManagerFactory with the default trust store.
        defaultTrustManagerFactory.init((KeyStore) null);

        // only need the default trust managers if the CA for mongo is already in the
        // default trust store for the JVM (e.g. via bosh managed trust store or via the
        return defaultTrustManagerFactory.getTrustManagers();
    }

    /**
     * Creates an array of {@link KeyManager} containing the certificate and
     * privateKey provided in a in memory only {@link KeyStore} with alias
     * {@link #MONGO_KEY_ENTRY_ALIAS} used for x509 authentication. This is a dymaic
     * key manager containing the private key and certificate in the store for use
     * by the {@link SSLContext} that this class creates.
     * 
     * @param certificate
     * @param privateKey
     * @return an array of {@link KeyManager} initialized with the in memory
     *         {@link KeyStore}.
     */
    @SneakyThrows
    private KeyManager[] keyManagers(X509Certificate certificate, PrivateKey privateKey) {
        KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
        keyStore.load(null); // You don't need the KeyStore instance to come from a file.
        keyStore.setKeyEntry(MONGO_KEY_ENTRY_ALIAS, privateKey, "".toCharArray(), new Certificate[] { certificate });

        KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
        keyManagerFactory.init(keyStore, "".toCharArray());
        return keyManagerFactory.getKeyManagers();
    }

    /**
     * Parses the PEM Encoded <b> mongo.x509.private-key </b> property to a
     * {@link PrivateKey}.
     * 
     * @return
     */
    @SneakyThrows
    private PrivateKey privateKey() {
        try (PEMParser parser = new PEMParser(new StringReader(properties.getPrivateKey()))) {
            return PEM_KEY_CONVERTER.getPrivateKey(PrivateKeyInfo.class.cast(parser.readObject()));
        }
    }

    /**
     * Parses the PEM Encoded <b>mongo.x509.certificate</b> property to
     * {@link X509Certificate}.
     * 
     * @return
     */
    @SneakyThrows
    private X509Certificate x509Certificate() {
        try (PEMParser parser = new PEMParser(new StringReader(properties.getCertificate()))) {
            return X509_CERTIFICATE_CONVERTER.getCertificate(X509CertificateHolder.class.cast(parser.readObject()));
        }
    }

}

<!-- Bouncy Castle for parsing PEM encoded private key and certificate -->
<dependency>
    <groupId>org.bouncycastle</groupId>
    <artifactId>bcpkix-jdk15on</artifactId>
    <version>1.65</version>
</dependency>