Support for HSM-based Keystores and Truststores

vertx-core/src/main/java/io/vertx/core/net/KeyStoreOptionsBase.java

@@ -55,6 +55,7 @@ protected KeyStoreOptionsBase() {
    */
   protected KeyStoreOptionsBase(KeyStoreOptionsBase other) {
     super();
+    this.provider = other.provider;
     this.type = other.type;
     this.password = other.password;
     this.path = other.path;

vertx-core/src/main/java/io/vertx/core/net/impl/KeyStoreHelper.java

@@ -112,6 +112,10 @@ public KeyStoreHelper(KeyStore ks, String password, String aliasPassword) throws
             // It's a private key
             continue;
           }
+          if (key.getFormat() == null) {
+            // Hardware security module key, not extractable
+            continue;
+          }
           X509KeyManager mgr = new X509KeyManager() {
             @Override
             public String[] getClientAliases(String s, Principal[] principals) {
@@ -254,10 +258,14 @@ public static KeyStore loadKeyStore(String type, String provider, String passwor
       if (!ks.containsAlias(alias)) {
         throw new IllegalArgumentException("alias does not exist in the keystore: " + alias);
       }
-      List<String> ksAliases = Collections.list(ks.aliases());
-      for (String ksAlias : ksAliases) {
-        if (!alias.equals(ksAlias)) {
-          ks.deleteEntry(ksAlias);
+      // HSM keys are not extractable to memory. Deleting an entry from the HSM-KeyStore removes the actual entry from the store
+      // This PKCS11 check prevents it
+      if (!type.equalsIgnoreCase("PKCS11")) {
+        List<String> ksAliases = Collections.list(ks.aliases());
+        for (String ksAlias : ksAliases) {
+          if (!alias.equals(ksAlias)) {
+            ks.deleteEntry(ksAlias);
+          }
         }
       }
     }

vertx-core/src/test/java/io/vertx/tests/security/KeyStoreTest.java

@@ -460,6 +460,26 @@ private void testTrustStore(KeyStoreHelper helper) throws Exception {
     TrustManager[] keyManagers = helper.getTrustMgrs((VertxInternal) vertx);
     assertTrue(keyManagers.length > 0);
   }
+  @Test
+  public void testCopyKeyStoreOptions() {
+    KeyStoreOptions options = new KeyStoreOptions();
+    options.setPassword("secret");
+    options.setPath("/path/to/keystore.p12");
+    options.setValue(Buffer.buffer("dummy"));
+    options.setType("PKCS11");
+    options.setProvider("SunPKCS11-hsm");
+    options.setAlias("server-key");
+    options.setAliasPassword("key-secret");
+    KeyStoreOptions copy = new KeyStoreOptions(options);
+    assertEquals("secret", copy.getPassword());
+    assertEquals("/path/to/keystore.p12", copy.getPath());
+    assertEquals(Buffer.buffer("dummy"), copy.getValue());
+    assertEquals("PKCS11", copy.getType());
+    assertEquals("SunPKCS11-hsm", copy.getProvider());
+    assertEquals("server-key", copy.getAlias());
+    assertEquals("key-secret", copy.getAliasPassword());
+  }
+
 
   /*
   @Test