Fix keystore for APM-server communication (#2362)

* use keystore when provided

* update changelog

* issue a warning+log error in debug

Author: SylvainJuge

CHANGELOG.asciidoc

@@ -33,6 +33,7 @@ endif::[]
 [float]
 ===== Bug fixes
 * Gracefully handle JDBC drivers which don't support `Connection#getCatalog` - {pull}2340[#2340]
+* Fix using JVM keystore options for communication with APM Server - {pull}2362[#2362]
 
 [[release-notes-1.x]]
 === Java Agent version 1.x

apm-agent-core/src/main/java/co/elastic/apm/agent/report/ssl/SslUtils.java

@@ -23,12 +23,17 @@
 
 import javax.annotation.Nullable;
 import javax.net.ssl.HostnameVerifier;
+import javax.net.ssl.KeyManager;
+import javax.net.ssl.KeyManagerFactory;
 import javax.net.ssl.SSLContext;
 import javax.net.ssl.SSLSession;
 import javax.net.ssl.SSLSocketFactory;
 import javax.net.ssl.TrustManager;
 import javax.net.ssl.X509TrustManager;
-import java.security.KeyManagementException;
+import java.io.FileInputStream;
+import java.io.IOException;
+import java.security.GeneralSecurityException;
+import java.security.KeyStore;
 import java.security.NoSuchAlgorithmException;
 import java.security.cert.X509Certificate;
 import java.util.Objects;
@@ -108,19 +113,28 @@ public static SSLSocketFactory getSSLSocketFactory(boolean validateCertificates)
     }
 
     @Nullable
-    private static SSLSocketFactory createSocketFactory(TrustManager[] trustAllCerts) throws NoSuchAlgorithmException, KeyManagementException {
+    private static SSLSocketFactory createSocketFactory(@Nullable TrustManager[] trustManagers) throws IOException, GeneralSecurityException {
         SSLContext sslContext;
         try {
             sslContext = SSLContext.getInstance("SSL");
         } catch (NoSuchAlgorithmException e) {
             logger.info("SSL is not supported, trying to use TLS instead.");
             sslContext = SSLContext.getInstance("TLS");
         }
-        sslContext.init(null, trustAllCerts, new java.security.SecureRandom());
+
+        KeyManager[] keyManagers = null;
+        try {
+            keyManagers = getKeyManagers();
+        } catch (IOException | GeneralSecurityException e) {
+            logger.warn("unable to setup key managers, keystore options will be ignored");
+            logger.debug("key manager creation error stack trace: ", e);
+        }
+
+        sslContext.init(keyManagers, trustManagers, new java.security.SecureRandom());
         return sslContext.getSocketFactory();
     }
 
-    public static SSLSocketFactory createTrustAllSocketFactory() throws NoSuchAlgorithmException, KeyManagementException {
+    public static SSLSocketFactory createTrustAllSocketFactory() throws GeneralSecurityException, IOException {
         return Objects.requireNonNull(createSocketFactory(new TrustManager[]{X_509_TRUST_ALL}));
     }
 
@@ -132,4 +146,39 @@ public static X509TrustManager getTrustAllManager() {
         return X_509_TRUST_ALL;
     }
 
+    @Nullable
+    public static KeyManager[] getKeyManagers() throws IOException, GeneralSecurityException {
+        // re-implements parts of sun.security.ssl.SSLContextImpl.DefaultManagersHolder.getKeyManagers
+        // as there is no simple way to reuse existing implementation
+
+        String keyStore = System.getProperty("javax.net.ssl.keyStore");
+        String keyStorePassword = System.getProperty("javax.net.ssl.keyStorePassword");
+        String keyStoreType = System.getProperty("javax.net.ssl.keyStoreType");
+        String keyStoreProvider = System.getProperty("javax.net.ssl.keyStoreProvider");
+
+        if (keyStore == null) {
+            return null;
+        }
+        logger.debug("using keystore {}", keyStore);
+
+        char[] pwd = keyStorePassword != null ? keyStorePassword.toCharArray() : null;
+
+        KeyStore ks = null;
+        try (FileInputStream input = new FileInputStream(keyStore)) {
+            if (keyStoreType != null) {
+                ks = keyStoreProvider == null ?
+                    KeyStore.getInstance(keyStoreType) :
+                    KeyStore.getInstance(keyStoreType, keyStoreProvider);
+                ks.load(input, pwd);
+            }
+        }
+
+        KeyManagerFactory kmf = KeyManagerFactory.getInstance(
+            KeyManagerFactory.getDefaultAlgorithm());
+
+        kmf.init(ks, pwd);
+
+        return kmf.getKeyManagers();
+    }
+
 }