[java-shib-shared] branch main updated: JSSH-69 Installer crashes when generating LLSS certs

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-shib-shared.

View the commit online:
https://codeberg.org/Shibboleth/java-shib-shared/commit/59ed00dd4c328693b748d2a2b4858fcc31e6aa18

The following commit(s) were added to refs/heads/main by this push:
     new 59ed00dd JSSH-69 Installer crashes when generating LLSS certs
59ed00dd is described below

commit 59ed00dd4c328693b748d2a2b4858fcc31e6aa18
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Wed Mar 25 16:31:40 2026 +0000

    JSSH-69 Installer crashes when generating LLSS certs
    
    https://shibboleth.atlassian.net/browse/JSSH-69
    
    Move defaulting of cert alg into #generate()
---
 .../impl/SelfSignedCertificateGenerator.java       | 35 +++++++-------
 .../impl/SelfSignedCertificateGeneratorTest.java   | 53 ++++++++++++++++++++++
 2 files changed, 71 insertions(+), 17 deletions(-)

diff --git a/shib-security/src/main/java/net/shibboleth/shared/security/impl/SelfSignedCertificateGenerator.java b/shib-security/src/main/java/net/shibboleth/shared/security/impl/SelfSignedCertificateGenerator.java
index cf07b066..649aa5c3 100644
--- a/shib-security/src/main/java/net/shibboleth/shared/security/impl/SelfSignedCertificateGenerator.java
+++ b/shib-security/src/main/java/net/shibboleth/shared/security/impl/SelfSignedCertificateGenerator.java
@@ -195,6 +195,24 @@ public class SelfSignedCertificateGenerator {
      * @throws Exception if an error occurs
      */
     public void generate() throws Exception {
+
+        // Default in "proper" cert algorithm.
+        if (args.certAlg == null) {
+            // Adjust as needed for any other key types with obvious certAlg defaults.
+            switch (args.keyType) {
+                case "RSA":
+                    args.certAlg = "SHA256withRSA";
+                    break;
+
+                case "EC":
+                    args.certAlg = "SHA256withECDSA";
+                    break;
+
+                default:
+                    args.certAlg = "SHA256withRSA";
+            }
+        }
+
         validate();
         
         // Check all the files to prevent overwrite.
@@ -376,23 +394,6 @@ public class SelfSignedCertificateGenerator {
             return;
         }
         
-        // Default in "proper" cert algorithm.
-        if (generator.args.certAlg == null) {
-            // Adjust as needed for any other key types with obvious certAlg defaults.
-            switch (generator.args.keyType) {
-                case "RSA":
-                    generator.args.certAlg = "SHA256withRSA";
-                    break;
-                    
-                case "EC":
-                    generator.args.certAlg = "SHA256withECDSA";
-                    break;
-                    
-                default:
-                    generator.args.certAlg = "SHA256withRSA";
-            }
-        }
-
         generator.generate();
     }
     
diff --git a/shib-security/src/test/java/net/shibboleth/shared/security/impl/SelfSignedCertificateGeneratorTest.java b/shib-security/src/test/java/net/shibboleth/shared/security/impl/SelfSignedCertificateGeneratorTest.java
new file mode 100644
index 00000000..f09ab8cc
--- /dev/null
+++ b/shib-security/src/test/java/net/shibboleth/shared/security/impl/SelfSignedCertificateGeneratorTest.java
@@ -0,0 +1,53 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package net.shibboleth.shared.security.impl;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+import org.testng.annotations.Test;
+
+import net.shibboleth.shared.collection.CollectionSupport;
+
+/** Unit test for {@link SelfSignedCertificateGenerator} */
+public class SelfSignedCertificateGeneratorTest {
+
+    /**
+     * Regression test JSSH-69
+     * @throws Exception 
+     */
+    @Test public void testJssh69() throws Exception {
+        final SelfSignedCertificateGenerator generator = new SelfSignedCertificateGenerator();
+        final Path dir = Files.createTempDirectory("SelfSignedCertificateGeneratorTest");
+        final Path crt = dir.resolve("crt");
+        final Path key = dir.resolve("key");
+        
+        try {
+            generator.setCertificateFile(crt.toFile());
+            generator.setPrivateKeyFile(key.toFile());
+            generator.setKeySize(3072);
+            generator.setHostName("example.org");
+            generator.setURISubjectAltNames(CollectionSupport.singletonList("example.org"));
+            generator.generate();
+        } finally {
+            Files.deleteIfExists(key);
+            Files.deleteIfExists(crt);
+            Files.deleteIfExists(dir);
+        }
+
+    }
+
+}
\ No newline at end of file

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.