Added server setting to specify keystore alias for ssl certificate (issue 98)

diff --git a/distrib/gitblit.properties b/distrib/gitblit.properties
index e3d72211fa033138174c4da9a5bad430998cf3c7..ce269d2c14e433841634459f8c5ecec397824d51 100644 (file)
--- a/distrib/gitblit.properties
+++ b/distrib/gitblit.properties
@@ -1155,6 +1155,13 @@ server.httpsBindInterface = localhost
 # RESTART REQUIRED\r
 server.ajpBindInterface = localhost\r
 \r
+# Alias of certificate to use for https/SSL serving.  If blank the first\r
+# certificate found in the keystore will be used. \r
+#\r
+# SINCE 1.2.0\r
+# RESTART REQUIRED\r
+server.certificateAlias = localhost\r
+\r
 # Password for SSL keystore.\r
 # Keystore password and certificate password must match.\r
 # This is provided for convenience, its probably more secure to set this value\r

diff --git a/docs/04_releases.mkd b/docs/04_releases.mkd
index 52bd51e70f74dc33db41db8510a3fb0f84cbf632..ef8a14466220a98168a007b503f6e96911c115a6 100644 (file)
--- a/docs/04_releases.mkd
+++ b/docs/04_releases.mkd
@@ -73,6 +73,7 @@ This is extreme and should be considered carefully since it affects every https
 \r
 #### changes\r
 \r
+- Added server setting to specify keystore alias for ssl certificate (issue 98)\r
 - Added optional global and per-repository activity page commit contribution throttle to help tame *really* active repositories (issue 173)\r
 - Added support for symlinks in tree page and commit page (issue 171)\r
 - All access restricted servlets (e.g. DownloadZip, RSS, etc) will try to authenticate using X509 certificates, container principals, cookies, and BASIC headers, in that order.\r

diff --git a/src/com/gitblit/GitBlitServer.java b/src/com/gitblit/GitBlitServer.java
index d98f891639ff49339987ac92f09bce939683313a..5eaa4c90464f3bf9fbcc787d2dfec7df737d8b70 100644 (file)
--- a/src/com/gitblit/GitBlitServer.java
+++ b/src/com/gitblit/GitBlitServer.java
@@ -242,7 +242,7 @@ public class GitBlitServer {
                        });\r
 \r
                        if (serverKeyStore.exists()) {                  \r
-                               Connector secureConnector = createSSLConnector(serverKeyStore, serverTrustStore, params.storePassword,\r
+                               Connector secureConnector = createSSLConnector(params.alias, serverKeyStore, serverTrustStore, params.storePassword,\r
                                                caRevocationList, params.useNIO, params.securePort, params.requireClientCertificates);\r
                                String bindInterface = settings.getString(Keys.server.httpsBindInterface, null);\r
                                if (!StringUtils.isEmpty(bindInterface)) {\r
@@ -413,6 +413,7 @@ public class GitBlitServer {
         * SSL renegotiation will be enabled if the JVM is 1.6.0_22 or later.\r
         * oracle.com/technetwork/java/javase/documentation/tlsreadme2-176330.html\r
         * \r
+        * @param certAlias\r
         * @param keyStore\r
         * @param clientTrustStore\r
         * @param storePassword\r
@@ -422,7 +423,7 @@ public class GitBlitServer {
         * @param requireClientCertificates\r
         * @return an https connector\r
         */\r
-       private static Connector createSSLConnector(File keyStore, File clientTrustStore,\r
+       private static Connector createSSLConnector(String certAlias, File keyStore, File clientTrustStore,\r
                        String storePassword, File caRevocationList, boolean useNIO, int port, \r
                        boolean requireClientCertificates) {\r
                SslContextFactory sslContext = new SslContextFactory(SslContextFactory.DEFAULT_KEYSTORE_PATH);\r
@@ -466,6 +467,10 @@ public class GitBlitServer {
                sslContext.setTrustStore(clientTrustStore.getAbsolutePath());\r
                sslContext.setTrustStorePassword(storePassword);\r
                sslContext.setCrlPath(caRevocationList.getAbsolutePath());\r
+               if (!StringUtils.isEmpty(certAlias)) {\r
+                       logger.info("   certificate alias = " + certAlias);\r
+                       sslContext.setCertAlias(certAlias);\r
+               }\r
                connector.setPort(port);\r
                connector.setMaxIdleTime(30000);\r
                return connector;\r
@@ -596,6 +601,9 @@ public class GitBlitServer {
                @Parameter(names = "--ajpPort", description = "AJP port to serve.  (port <= 0 will disable this connector)")\r
                public Integer ajpPort = FILESETTINGS.getInteger(Keys.server.ajpPort, 0);\r
 \r
+               @Parameter(names = "--alias", description = "Alias of SSL certificate in keystore for serving https.")\r
+               public String alias = FILESETTINGS.getString(Keys.server.certificateAlias, "");\r
+\r
                @Parameter(names = "--storePassword", description = "Password for SSL (https) keystore.")\r
                public String storePassword = FILESETTINGS.getString(Keys.server.storePassword, "");\r
 \r