browserup / browserup-proxy

BrowserUp Proxy is a free utility to watch, test, and manipulate web application network traffic and performance.
https://browserup.com
Apache License 2.0
164 stars 41 forks source link

savePrivateKeyAsPemFile, passwordForPrivateKey cannot be null even though java docs say it can be #304

Open mirosyn opened 4 years ago

mirosyn commented 4 years ago

Describe the bug Method's RootCertificateGenerator.savePrivateKeyAsPemFile(File file, String passwordForPrivateKey) java docs says that passwordForPrivateKey can be null, but if password is set to null method BouncyCastleSecurityProviderTool .encodePrivateKeyAsPem will throw IllegalArgumentException("You must specify a password when serializing a private key");

Method's java docs:

/**
     * Saves the private key as PEM-encoded data to a file, using the specified password to encrypt the private key and
     * the {@link #DEFAULT_PEM_ENCRYPTION_ALGORITHM}. If the password is null, the private key will be stored unencrypted.
     * In general, private keys should not be stored unencrypted.
     *
     * @param file                  file to save the private key to
     * @param passwordForPrivateKey password to protect the private key
     */
    public void savePrivateKeyAsPemFile(File file, String passwordForPrivateKey) { ... }

To Reproduce Steps to reproduce the behavior: To reproduce this you can create a unit test similar to this:

    RootCertificateGenerator rootCertificateGenerator = RootCertificateGenerator.builder().build();

    rootCertificateGenerator.saveRootCertificateAsPemFile(new File(TEMP_FILE_PATH_CERT));
    rootCertificateGenerator.savePrivateKeyAsPemFile(new File(TEMP_FILE_PATH_PRIVATE), null);

Expected behavior Saving the private key without the password should be possible, i.e passwordForPrivateKey should be allowed to be null.

Please complete the following information:

Additional context Add any other context about the problem here.