fix(MacOS): Combine KeychainStore with default certificate store

Author: AChep

common/src/jvmMain/kotlin/com/artemchep/keyguard/crypto/ssl/TrustManager.kt

@@ -0,0 +1,87 @@
+package com.artemchep.keyguard.crypto.ssl
+
+import com.artemchep.keyguard.platform.CurrentPlatform
+import okhttp3.OkHttpClient
+import okhttp3.internal.platform.Platform
+import java.security.KeyStore
+import java.security.cert.CertificateException
+import java.security.cert.X509Certificate
+import javax.net.ssl.TrustManagerFactory
+import javax.net.ssl.X509TrustManager
+
+fun OkHttpClient.Builder.installPlatformTrustManager() =
+    when (CurrentPlatform) {
+        is com.artemchep.keyguard.platform.Platform.Desktop.MacOS -> installMacOsTrustManager()
+        else -> this
+    }
+
+fun OkHttpClient.Builder.installMacOsTrustManager() = installHybridTrustManager {
+    getMacOsTrustManager()
+}
+
+private inline fun OkHttpClient.Builder.installHybridTrustManager(
+    fallback: () -> X509TrustManager = { getDefaultTrustManager() },
+    primary: () -> X509TrustManager,
+): OkHttpClient.Builder {
+    val primaryTm = runCatching {
+        primary()
+    }.getOrElse { e ->
+        // Could not get the platform specific
+        // trust manager.
+        e.printStackTrace()
+        return this
+    }
+    val fallbackTm = fallback()
+
+    // Combine with a new trust manager and set it
+    // as the OkHTTPs socket factory.
+    val hybridTm = HybridTrustManager(primaryTm, fallbackTm)
+    val hybridSslSocketFactory = Platform.get().newSslSocketFactory(hybridTm)
+    return sslSocketFactory(
+        sslSocketFactory = hybridSslSocketFactory,
+        trustManager = hybridTm,
+    )
+}
+
+private fun getDefaultTrustManager() = Platform.get().platformTrustManager()
+
+private fun getMacOsTrustManager() = run {
+    val appleFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm())
+    val appleKeyStore = KeyStore.getInstance("KeychainStore")
+    appleKeyStore.load(null, null)
+    appleFactory.init(appleKeyStore)
+    val appleTm = appleFactory.trustManagers
+        .first { it is X509TrustManager } as X509TrustManager
+    appleTm
+}
+
+/**
+ * A TrustManager that delegates to a primary manager, and falls back
+ * to a secondary manager if the primary fails validation.
+ */
+private class HybridTrustManager(
+    private val primary: X509TrustManager,
+    private val secondary: X509TrustManager,
+) : X509TrustManager {
+    override fun checkServerTrusted(chain: Array<out X509Certificate>?, authType: String?) {
+        try {
+            primary.checkServerTrusted(chain, authType)
+        } catch (_: CertificateException) {
+            secondary.checkServerTrusted(chain, authType)
+        }
+    }
+
+    override fun checkClientTrusted(chain: Array<out X509Certificate>?, authType: String?) {
+        try {
+            primary.checkClientTrusted(chain, authType)
+        } catch (_: CertificateException) {
+            secondary.checkClientTrusted(chain, authType)
+        }
+    }
+
+    override fun getAcceptedIssuers(): Array<X509Certificate> {
+        // Combine the list of trusted CAs from both sources so the server
+        // knows we accept certificates from either.
+        return primary.acceptedIssuers + secondary.acceptedIssuers
+    }
+}

common/src/jvmMain/kotlin/com/artemchep/keyguard/di/GlobalModuleJvm.kt

@@ -416,6 +416,7 @@ import com.artemchep.keyguard.crypto.CipherEncryptorImpl
 import com.artemchep.keyguard.crypto.CryptoGeneratorJvm
 import com.artemchep.keyguard.crypto.FileEncryptorImpl
 import com.artemchep.keyguard.crypto.KeyPairGeneratorJvm
+import com.artemchep.keyguard.crypto.ssl.installPlatformTrustManager
 import com.artemchep.keyguard.platform.CurrentPlatform
 import com.artemchep.keyguard.platform.util.isRelease
 import com.artemchep.keyguard.provider.bitwarden.api.BitwardenPersona
@@ -1575,6 +1576,7 @@ fun globalModuleJvm() = DI.Module(
     bindSingleton<OkHttpClient> {
         OkHttpClient
             .Builder()
+            .installPlatformTrustManager()
             .apply {
                 if (!isRelease) {
                     val logRepository: LogRepository = instance()

desktopApp/build.gradle.kts

@@ -102,13 +102,14 @@ compose.desktop {
                 "-Dapple.awt.application.appearance=system",
             )
 
-            // Support system Keychain as thrust store:
+            // Support system Keychain as trust store:
             // https://github.com/AChep/keyguard-app/issues/1227
             val platformJvmArgs = when {
                 Os.isFamily(Os.FAMILY_MAC) -> {
+                    // We resort to runtime trust manager:
+                    // - KeychainStore      is empty.
+                    // - KeychainStore-ROOT does not exist.
                     arrayOf(
-                        "-Djavax.net.ssl.trustStore=/dev/null",
-                        "-Djavax.net.ssl.trustStoreType=KeychainStore",
                     )
                 }
                 Os.isFamily(Os.FAMILY_WINDOWS) -> {