[java-shib-shared] branch main updated: JSSH-67 - Better cert gen defaults when using other key types

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-shib-shared.

View the commit online:
https://codeberg.org/Shibboleth/java-shib-shared/commit/702064adb97a61ad36c61a47bf95017e0a466ae7

The following commit(s) were added to refs/heads/main by this push:
     new 702064ad JSSH-67 - Better cert gen defaults when using other key types
702064ad is described below

commit 702064adb97a61ad36c61a47bf95017e0a466ae7
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Feb 19 12:40:04 2026 -0500

    JSSH-67 - Better cert gen defaults when using other key types
    
    https://shibboleth.atlassian.net/browse/JSSH-67
    
    Deferred init of certAlg if not setdefaulted to ECDSA if EC key type.
---
 .../impl/SelfSignedCertificateGenerator.java       | 23 +++++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

diff --git a/shib-security/src/main/java/net/shibboleth/shared/security/impl/SelfSignedCertificateGenerator.java b/shib-security/src/main/java/net/shibboleth/shared/security/impl/SelfSignedCertificateGenerator.java
index 58bdd350..cf07b066 100644
--- a/shib-security/src/main/java/net/shibboleth/shared/security/impl/SelfSignedCertificateGenerator.java
+++ b/shib-security/src/main/java/net/shibboleth/shared/security/impl/SelfSignedCertificateGenerator.java
@@ -375,6 +375,23 @@ public class SelfSignedCertificateGenerator {
             jc.usage();
             return;
         }
+        
+        // Default in "proper" cert algorithm.
+        if (generator.args.certAlg == null) {
+            // Adjust as needed for any other key types with obvious certAlg defaults.
+            switch (generator.args.keyType) {
+                case "RSA":
+                    generator.args.certAlg = "SHA256withRSA";
+                    break;
+                    
+                case "EC":
+                    generator.args.certAlg = "SHA256withECDSA";
+                    break;
+                    
+                default:
+                    generator.args.certAlg = "SHA256withRSA";
+            }
+        }
 
         generator.generate();
     }
@@ -398,7 +415,7 @@ public class SelfSignedCertificateGenerator {
     }
 
     /** Manages command line parsing for application and the bean properties used by the generator. */
-    private static class CommandLineArgs {
+    private static final class CommandLineArgs {
 
         /** Display command usage. */
         @Nonnull @NotEmpty public static final String HELP = "--help";
@@ -456,8 +473,8 @@ public class SelfSignedCertificateGenerator {
         @Positive private int certificateLifetime = 20;
 
         /** Certificate algorithm. */
-        @Parameter(names = CERT_ALG, description = "Certificate algorithm (default: SHA256withRSA)")
-        @Nonnull @NotEmpty private String certAlg = "SHA256withRSA";
+        @Parameter(names = CERT_ALG, description = "Certificate algorithm (default: SHA256withRSA or SHA256withECDSA)")
+        @Nullable @NotEmpty private String certAlg;
 
         /** Hostname. */
         @Parameter(names = HOSTNAME, required = true, description = "Hostname for certificate subject")

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.