Fix SSL config for JDK PKCS setup (#4999)

Signed-off-by: Andrey Pleskach <[email protected]> (cherry picked from commit 48be2af) Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
opensearch-project · Jan 16, 2025 · 0a6e42f · 0a6e42f
1 parent 4af1d07
commit 0a6e42f
Showing 1 changed file with 7 additions and 2 deletions.
diff --git a/src/main/java/org/opensearch/security/ssl/config/SslCertificatesLoader.java b/src/main/java/org/opensearch/security/ssl/config/SslCertificatesLoader.java
@@ -63,6 +63,7 @@ public Tuple<TrustStoreConfiguration, KeyStoreConfiguration> loadConfiguration(f
         final var settings = environment.settings();
         final var sslConfigSettings = settings.getByPrefix(fullSslConfigSuffix);
         if (settings.hasValue(sslConfigSuffix + KEYSTORE_FILEPATH)) {
+            final var keyStorePassword = resolvePassword(sslConfigSuffix + KEYSTORE_PASSWORD, settings, DEFAULT_STORE_PASSWORD);
             return Tuple.tuple(
                 environment.settings().hasValue(sslConfigSuffix + TRUSTSTORE_FILEPATH)
                     ? buildJdkTrustStoreConfiguration(
@@ -74,8 +75,12 @@ public Tuple<TrustStoreConfiguration, KeyStoreConfiguration> loadConfiguration(f
                 buildJdkKeyStoreConfiguration(
                     sslConfigSettings,
                     environment,
-                    resolvePassword(sslConfigSuffix + KEYSTORE_PASSWORD, settings, DEFAULT_STORE_PASSWORD),
-                    resolvePassword(fullSslConfigSuffix + KEYSTORE_KEY_PASSWORD, settings, DEFAULT_STORE_PASSWORD)
+                    keyStorePassword,
+                    resolvePassword(
+                        fullSslConfigSuffix + KEYSTORE_KEY_PASSWORD,
+                        settings,
+                        keyStorePassword != null ? String.valueOf(keyStorePassword) : null
+                    )
                 )
             );
         } else {