From 70d9a179cdd8d975b44e1815c249e20d9f91097f Mon Sep 17 00:00:00 2001
From: Valery Kharseko <vharseko@3a-systems.ru>
Date: Wed, 16 Sep 2026 08:10:15 +0000
Subject: [PATCH] [#912] Provision the ads-truststore from an existing key store at setup time (#984)
---
opendj-server-legacy/src/main/java/org/opends/server/tools/InstallDS.java | 22 ++++++++++++++++++++--
1 files changed, 20 insertions(+), 2 deletions(-)
diff --git a/opendj-server-legacy/src/main/java/org/opends/server/tools/InstallDS.java b/opendj-server-legacy/src/main/java/org/opends/server/tools/InstallDS.java
index ee1de64..b652428 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/tools/InstallDS.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/tools/InstallDS.java
@@ -855,9 +855,20 @@
final SecurityOptions securityOptions = SecurityOptions.createOptionsForCertificatType(
certType, pathToCertificat, pwd, enableSSL, enableStartTLS, sslPort, certNicknames);
+ securityOptions.setReplicationUsesKeyStore(argParser.useKeyStoreForReplicationArg.isPresent());
+ securityOptions.setReplicationCaCertFiles(getReplicationCaCertFiles());
uData.setSecurityOptions(securityOptions);
}
+ private List<File> getReplicationCaCertFiles() {
+ final List<File> caCertFiles = new ArrayList<>();
+ for (String path : argParser.replicationCaCertFileArg.getValues())
+ {
+ caCertFiles.add(new File(path));
+ }
+ return caCertFiles;
+ }
+
private List<String> getCertNickNames() {
List<String> certNicknames = argParser.certNicknameArg.getValues();
if ((certNicknames == null) || (certNicknames.size() == 0)) {
@@ -1747,6 +1758,8 @@
throw new IllegalStateException("Unexpected cert type: "+ certType);
}
}
+ securityOptions.setReplicationUsesKeyStore(argParser.useKeyStoreForReplicationArg.isPresent());
+ securityOptions.setReplicationCaCertFiles(getReplicationCaCertFiles());
return securityOptions;
}
@@ -1934,11 +1947,16 @@
}
for (String certNickname : certNicknames)
{
- // Check if the certificate alias is in the list.
+ // Check if the certificate alias is in the list. JKS, JCEKS and PKCS#12 key
+ // stores fold aliases to lower case, a BCFKS key store looks them up exactly:
+ // a nickname which differs in case from the alias would pass here and fail
+ // once the certificate is read from the key store.
boolean found = false;
for (int i = 0; i < aliases.length && !found; i++)
{
- found = aliases[i].equalsIgnoreCase(certNickname);
+ found = type == SecurityOptions.CertificateType.BCFKS
+ ? aliases[i].equals(certNickname)
+ : aliases[i].equalsIgnoreCase(certNickname);
}
if (!found)
{
--
Gitblit v1.10.0