TLS TrustStore shouldn't include private key

[wojtask9]

Environment Details

• Helidon Version: 4.x
• Helidon SE
• JDK version: 21.x
• OS: Linux

---

Problem Description

Currently in Helidon is trying to add privateKey to trustStore (see https://github.com/helidon-io/helidon/blob/main/common/key-util/src/main/java/io/helidon/common/pki/KeysBuilderDecorator.java#L96). This is not neccessary. TrustStore should only contains certificates.

It works if trustStore and keyStore are in the same file *.p12.

This can be done with keytool but using pure OpenSSL (starting from 3.3.x) *.p12 generated cannot be both keyStore and trusStore (see openssl/openssl#22215 and https://docs.openssl.org/master/man1/openssl-pkcs12/#pkcs12-output-export-options for option -jdkTrust)

Helidon MTls examples supports both single/multiple keystore/truststore *.p12 files (https://github.com/helidon-io/helidon-examples/blob/helidon-4.x/examples/webserver/mutual-tls/automatic-store-generator.sh#L73)

But with with multiple truststore/keystore we can see exception in logs using different files for keyStore and trustStore

2025.02.03 14:59:11 FINE io.helidon.common.pki.Keys Thread[#1,main,5,main]: Failed to read private key from default alias
io.helidon.common.pki.PkiException: Key stored under alias 1 is not a private key, but: null
	at io.helidon.common.pki@4.1.6/io.helidon.common.pki.PkiUtil.loadPrivateKey(PkiUtil.java:62)
	at io.helidon.common.pki@4.1.6/io.helidon.common.pki.KeysBuilderDecorator.updateFromKeystore(KeysBuilderDecorator.java:99)
	at io.helidon.common.pki@4.1.6/io.helidon.common.pki.KeysBuilderDecorator.lambda$decorate$0(KeysBuilderDecorator.java:37)
	at java.base/java.util.Optional.ifPresent(Optional.java:178)
	at io.helidon.common.pki@4.1.6/io.helidon.common.pki.KeysBuilderDecorator.decorate(KeysBuilderDecorator.java:37)
	at io.helidon.common.pki@4.1.6/io.helidon.common.pki.Keys$BuilderBase.preBuildPrototype(Keys.java:517)
	at io.helidon.common.pki@4.1.6/io.helidon.common.pki.Keys$Builder.buildPrototype(Keys.java:707)
	at io.helidon.common.pki@4.1.6/io.helidon.common.pki.Keys.create(Keys.java:73)
	at io.helidon.config@4.1.6/io.helidon.config.ConfigValues.lambda$create$4(ConfigValues.java:168)
	at io.helidon.config@4.1.6/io.helidon.config.ConfigValues$GenericConfigValueImpl.asOptional(ConfigValues.java:255)
	at io.helidon.common.mapper@4.1.6/io.helidon.common.mapper.OptionalValue.ifPresent(OptionalValue.java:188)
	at io.helidon.common.tls@4.1.6/io.helidon.common.tls.TlsConfig$BuilderBase.config(TlsConfig.java:277)
	at io.helidon.common.tls@4.1.6/io.helidon.common.tls.TlsConfig.create(TlsConfig.java:77)
	at io.helidon.config@4.1.6/io.helidon.config.ConfigValues.lambda$create$4(ConfigValues.java:168)
	at io.helidon.config@4.1.6/io.helidon.config.ConfigValues$GenericConfigValueImpl.asOptional(ConfigValues.java:255)
	at io.helidon.common.mapper@4.1.6/io.helidon.common.mapper.OptionalValue.ifPresent(OptionalValue.java:188)
	at io.helidon.webserver@4.1.6/io.helidon.webserver.ListenerConfig$BuilderBase.config(ListenerConfig.java:303)
	at io.helidon.webserver@4.1.6/io.helidon.webserver.WebServerConfig$BuilderBase.config(WebServerConfig.java:189)
	at io.helidon.webserver.testing.junit5@4.1.6/io.helidon.webserver.testing.junit5.HelidonServerJunitExtension.beforeAll(HelidonServerJunitExtension.java:86)
	at org.junit.jupiter.engine@5.11.4/org.junit.jupiter.engine.descriptor.ClassBasedTestDescriptor.lambda$invokeBeforeAllCallbacks$13(ClassBasedTestDescriptor.java:396)
	at org.junit.platform.engine@1.11.4/org.junit.platform.engine.support.hierarchical.ThrowableCollector.execute(ThrowableCollector.java:73)
	at org.junit.jupiter.engine@5.11.4/org.junit.jupiter.engine.descriptor.ClassBasedTestDescriptor.invokeBeforeAllCallbacks(ClassBasedTestDescriptor.java:396)
	at org.junit.jupiter.engine@5.11.4/org.junit.jupiter.engine.descriptor.ClassBasedTestDescriptor.before(ClassBasedTestDescriptor.java:212)
	at org.junit.jupiter.engine@5.11.4/org.junit.jupiter.engine.descriptor.ClassBasedTestDescriptor.before(ClassBasedTestDescriptor.java:85)
	at org.junit.platform.engine@1.11.4/org.junit.platform.engine.support.hierarchical.NodeTestTask.lambda$executeRecursively$6(NodeTestTask.java:153)
	at org.junit.platform.engine@1.11.4/org.junit.platform.engine.support.hierarchical.ThrowableCollector.execute(ThrowableCollector.java:73)
	at org.junit.platform.engine@1.11.4/org.junit.platform.engine.support.hierarchical.NodeTestTask.lambda$executeRecursively$8(NodeTestTask.java:146)
	at org.junit.platform.engine@1.11.4/org.junit.platform.engine.support.hierarchical.Node.around(Node.java:137)
	at org.junit.platform.engine@1.11.4/org.junit.platform.engine.support.hierarchical.NodeTestTask.lambda$executeRecursively$9(NodeTestTask.java:144)
	at org.junit.platform.engine@1.11.4/org.junit.platform.engine.support.hierarchical.ThrowableCollector.execute(ThrowableCollector.java:73)
	at org.junit.platform.engine@1.11.4/org.junit.platform.engine.support.hierarchical.NodeTestTask.executeRecursively(NodeTestTask.java:143)
	at org.junit.platform.engine@1.11.4/org.junit.platform.engine.support.hierarchical.NodeTestTask.execute(NodeTestTask.java:100)
	at java.base/java.util.ArrayList.forEach(ArrayList.java:1596)
	at org.junit.platform.engine@1.11.4/org.junit.platform.engine.support.hierarchical.SameThreadHierarchicalTestExecutorService.invokeAll(SameThreadHierarchicalTestExecutorService.java:41)
	at org.junit.platform.engine@1.11.4/org.junit.platform.engine.support.hierarchical.NodeTestTask.lambda$executeRecursively$6(NodeTestTask.java:160)
	at org.junit.platform.engine@1.11.4/org.junit.platform.engine.support.hierarchical.ThrowableCollector.execute(ThrowableCollector.java:73)
	at org.junit.platform.engine@1.11.4/org.junit.platform.engine.support.hierarchical.NodeTestTask.lambda$executeRecursively$8(NodeTestTask.java:146)
	at org.junit.platform.engine@1.11.4/org.junit.platform.engine.support.hierarchical.Node.around(Node.java:137)
	at org.junit.platform.engine@1.11.4/org.junit.platform.engine.support.hierarchical.NodeTestTask.lambda$executeRecursively$9(NodeTestTask.java:144)
	at org.junit.platform.engine@1.11.4/org.junit.platform.engine.support.hierarchical.ThrowableCollector.execute(ThrowableCollector.java:73)
	at org.junit.platform.engine@1.11.4/org.junit.platform.engine.support.hierarchical.NodeTestTask.executeRecursively(NodeTestTask.java:143)
	at org.junit.platform.engine@1.11.4/org.junit.platform.engine.support.hierarchical.NodeTestTask.execute(NodeTestTask.java:100)
	at org.junit.platform.engine@1.11.4/org.junit.platform.engine.support.hierarchical.SameThreadHierarchicalTestExecutorService.submit(SameThreadHierarchicalTestExecutorService.java:35)
	at org.junit.platform.engine@1.11.4/org.junit.platform.engine.support.hierarchical.HierarchicalTestExecutor.execute(HierarchicalTestExecutor.java:57)
	at org.junit.platform.engine@1.11.4/org.junit.platform.engine.support.hierarchical.HierarchicalTestEngine.execute(HierarchicalTestEngine.java:54)
	at org.junit.platform.launcher@1.11.4/org.junit.platform.launcher.core.EngineExecutionOrchestrator.execute(EngineExecutionOrchestrator.java:198)
	at org.junit.platform.launcher@1.11.4/org.junit.platform.launcher.core.EngineExecutionOrchestrator.execute(EngineExecutionOrchestrator.java:169)
	at org.junit.platform.launcher@1.11.4/org.junit.platform.launcher.core.EngineExecutionOrchestrator.execute(EngineExecutionOrchestrator.java:93)
	at org.junit.platform.launcher@1.11.4/org.junit.platform.launcher.core.EngineExecutionOrchestrator.lambda$execute$0(EngineExecutionOrchestrator.java:58)
	at org.junit.platform.launcher@1.11.4/org.junit.platform.launcher.core.EngineExecutionOrchestrator.withInterceptedStreams(EngineExecutionOrchestrator.java:141)
	at org.junit.platform.launcher@1.11.4/org.junit.platform.launcher.core.EngineExecutionOrchestrator.execute(EngineExecutionOrchestrator.java:57)
	at org.junit.platform.launcher@1.11.4/org.junit.platform.launcher.core.DefaultLauncher.execute(DefaultLauncher.java:103)
	at org.junit.platform.launcher@1.11.4/org.junit.platform.launcher.core.DefaultLauncher.execute(DefaultLauncher.java:85)
	at org.junit.platform.launcher@1.11.4/org.junit.platform.launcher.core.DelegatingLauncher.execute(DelegatingLauncher.java:47)
	at org.junit.platform.launcher@1.11.4/org.junit.platform.launcher.core.SessionPerRequestLauncher.execute(SessionPerRequestLauncher.java:63)
	at com.intellij.junit5.JUnit5IdeaTestRunner.startRunnerWithArgs(JUnit5IdeaTestRunner.java:57)
	at com.intellij.rt.junit.IdeaTestRunner$Repeater$1.execute(IdeaTestRunner.java:38)
	at com.intellij.rt.execution.junit.TestsRepeater.repeat(TestsRepeater.java:11)
	at com.intellij.rt.junit.IdeaTestRunner$Repeater.startRunnerWithArgs(IdeaTestRunner.java:35)
	at com.intellij.rt.junit.JUnitStarter.prepareStreamsAndStart(JUnitStarter.java:232)
	at com.intellij.rt.junit.JUnitStarter.main(JUnitStarter.java:55)

Steps to reproduce

Run mtls example with logger changed to

.level=ALL

fix #9722

But not sure about certChain