Support end to end TLS: Load cert from file system.

[chenrujun]

Currently, cert are all loaded from key-vault, we need support load cert from file system(A configurable path).

Refs: #21566

[chenrujun]

Here are the steps we need to do:

1. Download latest azure-security-keyvault-jca jar file into docker image.
2. Modify startup command. For example: java --classpath /etc/certs/azure-security-keyvault-jca.jar -jar app.jar.
3. Put the public cert of Azure service to well-known path: /etc/certs/well-known/.

Here is more information about cert path:

1. well-known path.
   1.1. Default value: /etc/certs/well-known/.
   1.2. Configuration property: azure.cert-path.well-known.
2. custom path
   2.1. Default value: /etc/certs/custom/.
   2.2. Configuration property: azure.cert-path.custom

Refs: https://github.com/Azure/azure-sdk-for-java/tree/master/sdk/keyvault/azure-security-keyvault-jca

[chenrujun]

@gavinfish FYI.

[chenrujun]

@gavinfish

FYI:
When we specify -jar then the -cp parameter will be ignored.
https://stackoverflow.com/questions/18413014/run-a-jar-file-from-the-command-line-and-specify-classpath

[gavinfish]

@chenrujun Here are some questions for you:

1. If customer's app has already depended on azure-security-keyvault-jca to use certificates in Azure Key Vault. Will there be any conflicts when we use the startup command with jca again?
2. If No.1 is fine, then the app will trust both Key Vault certificates and local certificates, right?
3. Is there any difference for well-known path and customer path except the source of the certificates?

[chenrujun]

@gavinfish

If customer's app has already depended on azure-security-keyvault-jca to use certificates in Azure Key Vault. Will there be any conflicts when we use the startup command with jca again?

I didn't test that. I guess there is no problem. You can have a try.

---

If No.1 is fine, then the app will trust both Key Vault certificates and local certificates, right?

Yes.

---

Is there any difference for well-known path and customer path except the source of the certificates?

1. To keep well-known certs safe, It's better to avoid letting customer touch well-known path.
2. Customer can add his own cert in etc/azure-certs/custom/.

[gavinfish]

@chenrujun
Talked with Asir, two suggestions from him:

1. For the certificate path, do not contain key word azure since it is not only for azure services, any other services can be candidates.
2. For Configuration property, do not contain key word keyvault since this feature is not related with key vault directly.

[chenrujun]

Hi, @gavinfish , I updated #21611 (comment) please take a look.

[chenrujun]

Hi, @gavinfish , @lzc-1997-abel , I updated the #21611 (comment), please take a look.