[#912] Provision the ads-truststore from an existing key store at setup tim...

Valery Kharseko

yesterday 70d9a179cdd8d975b44e1815c249e20d9f91097f

 opendj-server-legacy/src/main/java/org/opends/server/tools/InstallDSArgumentParser.java

@@ -13,6 +13,7 @@
 *
 * Copyright 2008-2010 Sun Microsystems, Inc.
 * Portions Copyright 2011-2016 ForgeRock AS.
 * Portions Copyright 2026 3A Systems, LLC.
 */
package org.opends.server.tools;

@@ -20,6 +21,7 @@
import static com.forgerock.opendj.cli.CliMessages.INFO_JMXPORT_PLACEHOLDER;
import static com.forgerock.opendj.cli.CliMessages.INFO_KEYSTORE_PWD_FILE_PLACEHOLDER;
import static com.forgerock.opendj.cli.CliMessages.INFO_NUM_ENTRIES_PLACEHOLDER;
import static com.forgerock.opendj.cli.CliMessages.INFO_PATH_PLACEHOLDER;
import static com.forgerock.opendj.cli.CliMessages.INFO_PORT_PLACEHOLDER;
import static com.forgerock.opendj.cli.CliMessages.INFO_ROOT_USER_PWD_FILE_PLACEHOLDER;
import static com.forgerock.opendj.cli.CommonArguments.*;
@@ -28,6 +30,7 @@

import static org.opends.messages.ToolMessages.*;

import java.io.File;
import java.util.Collection;
import java.util.HashSet;
import java.util.LinkedHashSet;
@@ -94,6 +97,8 @@
  StringArgument    directoryManagerDNArg;
  private StringArgument directoryManagerPwdStringArg;
  StringArgument    useJavaKeyStoreArg;
  BooleanArgument   useKeyStoreForReplicationArg;
  StringArgument    replicationCaCertFileArg;
  StringArgument    useJCEKSArg;
  StringArgument    usePkcs12Arg;
  private StringArgument keyStorePasswordArg;
@@ -396,6 +401,20 @@
                    .buildArgument();
    addDefaultArgument(certNicknameArg);

    useKeyStoreForReplicationArg =
            BooleanArgument.builder("useKeyStoreForReplication")
                    .description(INFO_INSTALLDS_DESCRIPTION_USE_KEYSTORE_FOR_REPLICATION.get())
                    .buildArgument();
    addArgument(useKeyStoreForReplicationArg);

    replicationCaCertFileArg =
            StringArgument.builder("replicationCaCertFile")
                    .description(INFO_INSTALLDS_DESCRIPTION_REPLICATION_CA_CERT_FILE.get())
                    .multiValued()
                    .valuePlaceholder(INFO_PATH_PLACEHOLDER.get())
                    .buildArgument();
    addArgument(replicationCaCertFileArg);

    connectTimeoutArg = connectTimeOutArgument();
    addArgument(connectTimeoutArg);

@@ -658,6 +677,52 @@
            enableStartTLSArg.getLongIdentifier()));
      }
    }

    checkReplicationCertificateArguments(errorMessages);
  }

  /**
   * Checks the arguments which provision the trust store used for server to server
   * communication.  The key pair presented on the replication port is copied out of an
   * existing key store, so there has to be one, and its private key has to be readable:
   * neither a certificate generated by the installer nor a key held in a PKCS#11 token
   * qualifies.
   * @param errorMessages the list of messages to which we add the error messages
   * describing the problems encountered during the execution of the checking.
   */
  private void checkReplicationCertificateArguments(Collection<LocalizableMessage> errorMessages)
  {
    if (useKeyStoreForReplicationArg.isPresent()
        && !useJavaKeyStoreArg.isPresent()
        && !useJCEKSArg.isPresent()
        && !usePkcs12Arg.isPresent()
        && !useBcfksArg.isPresent())
    {
      errorMessages.add(ERR_INSTALLDS_REPLICATION_KEYSTORE_REQUIRED.get(
          useKeyStoreForReplicationArg.getLongIdentifier(),
          useJavaKeyStoreArg.getLongIdentifier(),
          useJCEKSArg.getLongIdentifier(),
          usePkcs12Arg.getLongIdentifier(),
          useBcfksArg.getLongIdentifier()));
    }

    if (replicationCaCertFileArg.isPresent())
    {
      if (!useKeyStoreForReplicationArg.isPresent())
      {
        errorMessages.add(ERR_INSTALLDS_REPLICATION_CA_CERT_FILE_REQUIRES.get(
            replicationCaCertFileArg.getLongIdentifier(),
            useKeyStoreForReplicationArg.getLongIdentifier()));
      }
      for (String path : replicationCaCertFileArg.getValues())
      {
        final File certFile = new File(path);
        if (!certFile.exists() || !certFile.isFile())
        {
          errorMessages.add(ERR_INSTALLDS_REPLICATION_CA_CERT_FILE_INVALID.get(path));
        }
      }
    }
  }

  /**