diff --git a/cloudplatform/connectivity-apache-httpclient5/src/test/java/com/sap/cloud/sdk/cloudplatform/connectivity/ClientCertificateAuthenticationLocalTest.java b/cloudplatform/connectivity-apache-httpclient5/src/test/java/com/sap/cloud/sdk/cloudplatform/connectivity/ClientCertificateAuthenticationLocalTest.java
index 868875770..d6a15226b 100644
--- a/cloudplatform/connectivity-apache-httpclient5/src/test/java/com/sap/cloud/sdk/cloudplatform/connectivity/ClientCertificateAuthenticationLocalTest.java
+++ b/cloudplatform/connectivity-apache-httpclient5/src/test/java/com/sap/cloud/sdk/cloudplatform/connectivity/ClientCertificateAuthenticationLocalTest.java
@@ -37,9 +37,14 @@
class ClientCertificateAuthenticationLocalTest
{
- private static final String CCA_PASSWORD = "cca-password";
- private static final String JKS_PATH =
- "src/test/resources/" + ClientCertificateAuthenticationLocalTest.class.getSimpleName() + "/client-cert.pkcs12";
+ private static final String JKS_PREFIX =
+ "src/test/resources/" + ClientCertificateAuthenticationLocalTest.class.getSimpleName();
+ private static final String SERVER_TRUST_STORE = JKS_PREFIX + "/certs/truststore.jks";
+ private static final String SERVER_TRUST_STORE_PASS = "changeit";
+ private static final String SERVER_KEY_STORE = JKS_PREFIX + "/certs/server.jks";
+ private static final String SERVER_KEY_STORE_PASS = "changeit";
+ private static final String CLIENT_KEY_STORE = JKS_PREFIX + "/certs/client1.p12";
+ private static final String CLIENT_KEY_STORE_PASS = "changeit";
@RegisterExtension
static final WireMockExtension server =
@@ -71,7 +76,7 @@ void testClientCorrectlyConfigured()
.authenticationType(AuthenticationType.CLIENT_CERTIFICATE_AUTHENTICATION)
.proxyType(ProxyType.INTERNET)
.keyStore(getClientKeyStore())
- .keyStorePassword(CCA_PASSWORD)
+ .keyStorePassword(CLIENT_KEY_STORE_PASS)
.trustAllCertificates()
.build());
@@ -82,7 +87,7 @@ void testClientCorrectlyConfigured()
assertThat(context.getUserToken()).isNotNull();
assertThat(context.getUserToken()).isInstanceOf(X500Principal.class);
- assertThat(((X500Principal) context.getUserToken()).getName()).contains("CN=localhost");
+ assertThat(((X500Principal) context.getUserToken()).getName()).contains("CN=client1");
// assert keystore methods have been used
Mockito.verify(destination).getKeyStorePassword();
@@ -122,8 +127,11 @@ private static WireMockConfiguration buildWireMockConfiguration()
.httpDisabled(true)
.dynamicHttpsPort()
.needClientAuth(true)
- .trustStorePath(JKS_PATH)
- .trustStorePassword(CCA_PASSWORD)
+ .keystorePath(SERVER_KEY_STORE)
+ .keystorePassword(SERVER_KEY_STORE_PASS)
+ .keyManagerPassword(SERVER_KEY_STORE_PASS)
+ .trustStorePath(SERVER_TRUST_STORE)
+ .trustStorePassword(SERVER_TRUST_STORE_PASS)
.trustStoreType("JKS");
}
@@ -134,7 +142,7 @@ private static KeyStore getClientKeyStore()
NoSuchAlgorithmException
{
final KeyStore keyStore = KeyStore.getInstance("PKCS12");
- keyStore.load(new FileInputStream(JKS_PATH), CCA_PASSWORD.toCharArray());
+ keyStore.load(new FileInputStream(CLIENT_KEY_STORE), CLIENT_KEY_STORE_PASS.toCharArray());
return keyStore;
}
}
diff --git a/cloudplatform/connectivity-apache-httpclient5/src/test/resources/ClientCertificateAuthenticationLocalTest/README.md b/cloudplatform/connectivity-apache-httpclient5/src/test/resources/ClientCertificateAuthenticationLocalTest/README.md
index 093d0bcf2..be94a58a2 100644
--- a/cloudplatform/connectivity-apache-httpclient5/src/test/resources/ClientCertificateAuthenticationLocalTest/README.md
+++ b/cloudplatform/connectivity-apache-httpclient5/src/test/resources/ClientCertificateAuthenticationLocalTest/README.md
@@ -5,18 +5,112 @@ The credential files are generated from command line. This process can be automa
## CREATE CLIENT CREDENTIALS
-* Generate key pair
- ```bash
- openssl req -x509 -newkey rsa:2048 -utf8 -days 3650 -nodes -config client-cert.conf -keyout client-cert.key -out client-cert.crt
+* Client keystore
```
+ docker run --rm -v $(pwd)/certs:/certs eclipse-temurin:17-jre \
+ keytool -genkeypair \
+ -alias client1 \
+ -keyalg RSA \
+ -keysize 2048 \
+ -validity 3650 \
+ -storetype JKS \
+ -keystore /certs/client1.jks \
+ -storepass changeit \
+ -keypass changeit \
+ -dname "CN=client1"
+ ```
+
+ (Windows)
-* Generate _PKCS#12_ keystore
- ```bash
- openssl pkcs12 -export -inkey client-cert.key -in client-cert.crt -out client-cert.p12 -password "pass:cca-password"
+ ```
+ docker run --rm -v ${pwd}/certs:/certs eclipse-temurin:17-jre keytool -genkeypair -alias client1 -keyalg RSA -keysize 2048 -validity 3650 -storetype JKS -keystore /certs/client1.jks -storepass changeit -keypass changeit -dname "CN=client1"
```
-* Transform to JKS
+ (Windows)
+
+ ```
+ docker run --rm -v ${pwd}/certs:/certs eclipse-temurin:17-jre keytool -exportcert -alias client1 -keystore /certs/client1.jks -storepass changeit -file /certs/client1.cer
+ ```
- ```bash
- keytool -importkeystore -deststorepass "cca-password" -destkeypass "cca-password" -srckeystore client-cert.p12 -srcstorepass "cca-password" -deststoretype pkcs12 -destkeystore client-cert.pkcs12
+ (Windows)
+
+ ```
+ docker run --rm -v ${pwd}/certs:/certs eclipse-temurin:17-jre keytool -importkeystore -srckeystore /certs/client1.jks -srcstoretype JKS -srcstorepass changeit -destkeystore /certs/client1.p12 -deststoretype PKCS12 -deststorepass changeit -destkeypass changeit
+ ```
+
+ (Windows)
+
+ ```
+ docker run --rm -v ${pwd}/certs:/certs eclipse-temurin:17-jre keytool -genkeypair -alias wiremock-server -keyalg RSA -keysize 2048 -validity 3650 -storetype JKS -keystore /certs/server.jks -storepass changeit -keypass changeit -dname "CN=localhost" -ext SAN=dns:localhost,ip:127.0.0.1
+ ```
+
+ (Windows)
+
+ ```
+ docker run --rm -v ${pwd}/certs:/certs eclipse-temurin:17-jre keytool -importcert -alias client1 -file /certs/client1.cer -keystore /certs/truststore.jks -storepass changeit -noprompt
+ ```
+
+