Introduce support for key password (not store password!) in KeyStoreOptions

[famod]

Describe the feature

There is io.vertx.core.net.KeyStoreOptions.setPassword(String) for the store and .setAlias(String) to select a specific key from the store, but there is nothing to set the password for a specific key.

#3452 seems closely related.

Use cases

In "enterprisy setups"™, more often than not you have multipe key pairs in a single key store and each of it is protected by an individual password. In such cases, just having a keystore password is not sufficient.
FWIW: Spring and WildFly both have something like key-password in config.

Btw, something like .setKeyPassword(String) would make sense to me.
In that context, maybe .setAlias(String) should be renamed to .setKeyAlias(String) to make things clearer.
See also this discussion over at Quarkus: quarkusio/quarkus#17884 (comment)

[famod]

/cc @mickroll @sberyozkin @cescoffier

[vietj]

setAliasPassword makes sense to me

[pmlopes]

In vertx-auth we also have this:

https://github.com/vert-x3/vertx-auth/blob/master/vertx-auth-common/src/main/java/io/vertx/ext/auth/KeyStoreOptions.java#L112

perhaps we should align the naming conventions to avoid confusion with the API.

[vietj]

does it do the same ? in this case, when the alias is selected then only one entry is used and it makes sense to have a single password instead of a map in your case

…

On Wed, Jun 16, 2021 at 10:30 AM Paulo Lopes ***@***.***> wrote: In vertx-auth we also have this: https://github.com/vert-x3/vertx-auth/blob/master/vertx-auth-common/src/main/java/io/vertx/ext/auth/KeyStoreOptions.java#L112 perhaps we should align the naming conventions to avoid confusion with the API. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#3970 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AABXDCTGA7MX62JHXTATAULTTBOJLANCNFSM46X73FNA> .

[pmlopes]

@vietj yes. in auth setting a single password it then unlocks the keystore and keys with the same password, when specific passwords are added for an alias then it unlocks the store with the top level password and the key with the password from the map falling back to the file password when missing.

[famod]

FWIW: while integrating this feature via quarkusio/quarkus#18387 I realized that the name aliasPassword can be a bit misleading because you don't have to set an alias in all cases.
E.g. imagine a keystore with a single key that has another password than the store. In that case you don't need alias but you do need aliasPassword.