Implement truststore manager on server to validate peer X509 certificates - spring-boot

Question

I have a 2 way SSL implementation between multiple clients and servers running on spring-boot. On the server's truststore, I am adding the domain certs for client as we have clients with similar intermediate and root certs and only want to authenticate clients which have their domain certs present in our truststore or return an exception( I am aware that SSL implementation is for authentication and this should be taken care in authorization part but this is a requirement :( ). I want to customize the truststore implementation to check for presence of domain cert and not the whole chain if client sends only the domain cert while still making sure all other validations take place as-is via the default truststore implementation.
In order to do this I have implemented my custom TrustManager and offloaded the part of other validation to the default implementation of TrustStoreManager.
char [] password = new String("abcde").toCharArray();
String keyFilename = "some-path/server-truststore.jks";
static Map<String,String> map = new HashMap<>();
KeyStore trustStore= null;
try {
trustStore = KeyStore.getInstance("JKS");
} catch (KeyStoreException e) {
e.printStackTrace();
}
try {
trustStore.load(new FileInputStream(keyFilename), password);
} catch (IOException e) {
e.printStackTrace();
} catch (CertificateException e) {
e.printStackTrace();
}
try {
Enumeration<String> trustStoreEnum= trustStore.aliases();
while(trustStoreEnum.hasMoreElements()){
String nextElement= trustStoreEnum.nextElement();
X509Certificate certificate = (X509Certificate)trustStore.getCertificate(nextElement);
String key=certificate.getSubjectDN().getName().trim();
map.put(key,certificate.getSerialNumber().toString());
}
} catch (KeyStoreException e) {
e.printStackTrace();
}
TrustManagerFactory tmf = TrustManagerFactory
.getInstance(TrustManagerFactory.getDefaultAlgorithm());
try {
tmf.init(trustStore);
} catch (KeyStoreException e) {
e.printStackTrace();
}
X509TrustManager x509Tm = null;
for(TrustManager tm :tmf.getTrustManagers()){
logger.info(tm.toString());
x509Tm = (X509TrustManager) tm;
break;
}
//Truststrore Manager implementation
final X509TrustManager finalTm = x509Tm;
TrustManager[] x509ExtendedTrustManager = new TrustManager[] {
new X509TrustManager() {
#Override
public java.security.cert.X509Certificate[] getAcceptedIssuers() {
return finalTm.getAcceptedIssuers();
}
#Override
public void checkClientTrusted(
java.security.cert.X509Certificate[] certs, String authType) throws CertificateException {
logger.info("client blah");
finalTm.checkClientTrusted(certs,authType);
for(X509Certificate x509Certificate: certs){
String certName=x509Certificate.getSubjectDN().getName().trim();
if(!(map.containsKey(certName) && map.get(certName).equals(x509Certificate.getSerialNumber().toString())))
throw new CertificateException("Certificate not present in truststore");
}
}
#Override
public void checkServerTrusted(
java.security.cert.X509Certificate[] certs, String authType) throws CertificateException {
logger.info("server blah");
finalTm.checkServerTrusted(certs, authType);
}
}
};
The problem is that this implementation is never called even though I set it in my SSLContext on the server and instead the default truststore manager implementation is used.
try {
SSLContext sc = SSLContext.getInstance("TLS");
char [] password2 =
new String("changeit").toCharArray();
String keyFilename2 = "/<some-path>/server-keystore.jks";
KeyStore ks = KeyStore.getInstance("JKS");
ks.load(new FileInputStream(keyFilename2), password2);
KeyManagerFactory kmf = KeyManagerFactory.getInstance("NewSunX509");
kmf.init(ks, "changeit".toCharArray());
KeyManager[] kms = kmf.getKeyManagers();
sc.init(kms, x509ExtendedTrustManager, new java.security.SecureRandom());
HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());
SSLContext.setDefault(sc);
} catch (GeneralSecurityException e) {
logger.error(e.getMessage());
} catch (FileNotFoundException e) {
e.printStackTrace();
} catch (IOException e) {
e.printStackTrace();
}
logger.info("SSL context set");
}
I am not sure if it is because we cannot set a SSLContext on a port that has already been initialized. I would like to know if there is a better way to do this or can we initalize SSLContext on the same port?
Thanks in advance!