SSL bundles to support the windows certificate store. about spring-boot

[scottfrederick]

Is this on the road map already ?

This is not something that is on the roadmap as an enhancement in Spring Boot itself.

Is it feasible ? (someone will know a lot more about any issues in this space than i do)
Would the current interface support it ?
If it's not on the roadmap, is there a mechanism to get spring to load this from extenal code. Pardon my ignorance, but at first glance these bundles aren't beans, so i'm not sure what other mechanism might be available to wire them in.

The SSL bundles feature was designed with this type of extension in mind. The mechanism for loading bundles from an external source is the SslBundleRegistrar. When a bean of this type is contributed to the application context, it can create named bundles and add them to the list of bundles that are available for use by the application.

The SslPropertiesSslBundleRegistrar class is an example of this that reads the spring.ssl.bundle properties and creates bundles from the provided properties. You could use that as a model, create your own properties class, implement your own registrar that reads the properties and loads the content from the Windows store, and contribute the registrar as a bean.

All this can be done outside of Spring Boot, which gives you the ability to iterate on it separate from Boot's release cycle (and without having to build Spring Boot itself).

[alister995199]

Hi @scottfrederick ,

Thank you for the reply and the tips ! That seems pretty manageable - I'll give it a shot - though i'm nervous about the need for elevation for private key access etc and other "gotcha's". So i'm not assuming it will be possible.

I'll raise a stack overflow related to this, to garner any input, but also to possibly self post an implementation - since it's the de rigueur place to look for code solutions. I'll link that here today - after which feel free to close this issue.

Edit: https://stackoverflow.com/questions/78111646/spring-ssl-bundle-for-certificate-material-from-windows-certificate-stores-ser