TLS problem (javax.crypto.BadPaddingException) with quarkus-rest-client-reactive

[heiko-jakob]

Hi,
I have a working sample for a mutual TLS rest-client with quarkus-rest-client. But switching from quarkus-rest-client to quarkus-rest-client-reactive results in problems loading the TLS keys with a javax.crypto.BadPaddingException.
Is this really a bug or am i doing something wrong ?

I've created the keys with keytool:

$ keytool -genkeypair -keyalg RSA -keysize 8192 -validity 3650 -storepass password -dname "CN=testserver" -alias testserver -ext "SAN:c=DNS:localhost,IP:127.0.0.1,IP:::1" -keystore testserver.keystore
$ keytool -genkeypair -keyalg RSA -keysize 8192 -validity 3650 -storepass password -dname "CN=testclient" -alias testclient -ext "SAN:c=DNS:localhost,IP:127.0.0.1,IP:::1" -keystore testclient.keystore

I've built a example to reproduce the bug https://github.com/heiko-jakob/reactivetlsbug
You can clone it with:

$ git clone https://github.com/heiko-jakob/reactivetlsbug
$ cd reactivetlsbug

To check out and testing the working non-reactive version
$ git checkout works && ./gradlew test

To reproduce the bug, check out and test the non working reactive version to demonstrate the bug
$ git checkout bug && ./gradlew test

The only difference between reactive and non-reactive version is the build.gradle

testImplementation("io.quarkus:quarkus-rest-client-reactive")
//testImplementation("io.quarkus:quarkus-rest-client")

The stack tracke shows issues reading the key files:

Caused by: io.vertx.core.VertxException: java.security.UnrecoverableKeyException: Get Key failed: Given final block not properly padded. Such issues can arise if a bad key is used during decryption.
    at io.vertx.core.net.impl.SSLHelper.getContext(SSLHelper.java:467)
    at io.vertx.core.net.impl.SSLHelper.getContext(SSLHelper.java:456)
    at io.vertx.core.net.impl.SSLHelper.validate(SSLHelper.java:494)
    at io.vertx.core.net.impl.NetClientImpl.<init>(NetClientImpl.java:94)
    at io.vertx.core.http.impl.HttpClientImpl.<init>(HttpClientImpl.java:168)
    at io.vertx.core.impl.VertxImpl.createHttpClient(VertxImpl.java:331)
...
Caused by: java.security.UnrecoverableKeyException: Get Key failed: Given final block not properly padded. Such issues can arise if a bad key is used during decryption.
    at java.base/sun.security.pkcs12.PKCS12KeyStore.engineGetKey(PKCS12KeyStore.java:450)
    at java.base/sun.security.util.KeyStoreDelegator.engineGetKey(KeyStoreDelegator.java:91)
    at java.base/java.security.KeyStore.getKey(KeyStore.java:1050)
    at io.vertx.core.net.impl.KeyStoreHelper.<init>(KeyStoreHelper.java:88)
...
Caused by: javax.crypto.BadPaddingException: Given final block not properly padded. Such issues can arise if a bad key is used during decryption.
    at java.base/com.sun.crypto.provider.CipherCore.unpad(CipherCore.java:859)
    at java.base/com.sun.crypto.provider.CipherCore.fillOutputBuffer(CipherCore.java:939)
    at java.base/com.sun.crypto.provider.CipherCore.doFinal(CipherCore.java:735)
    at java.base/com.sun.crypto.provider.PBES2Core.engineDoFinal(PBES2Core.java:325)
    at java.base/javax.crypto.Cipher.doFinal(Cipher.java:2205)
    at java.base/sun.security.pkcs12.PKCS12KeyStore.lambda$engineGetKey$0(PKCS12KeyStore.java:371)
    at java.base/sun.security.pkcs12.PKCS12KeyStore$RetryWithZero.run(PKCS12KeyStore.java:264)
    at java.base/sun.security.pkcs12.PKCS12KeyStore.engineGetKey(PKCS12KeyStore.java:361)
    ... 118 more

[quarkus-bot[bot]]

/cc @michalszynkiewicz