Webadmin api pem

docs/modules/servers/partials/configure/webadmin.adoc

@@ -122,11 +122,17 @@ routes - query parameters included - it is allowed to call.
 | https.enable
 | Use https (default: false)
 
+| https.certificates
+| Specify the path to the PEM certificates file (e.g. Let's Encrypt fullchain.pem). Optional alternative to `https.keystore`.
+
+| https.privateKey
+| Specify the path to the PEM private key file (e.g. Let's Encrypt privkey.pem). Required when `https.certificates` is used.
+
 | https.keystore
 | Specify a keystore file for https (default: null)
 
 | https.password
-| Specify the keystore password (default: null)
+| Specify the keystore password or private key password (default: null)
 
 | https.trust.keystore
 | Specify a truststore file for https (default: null)

server/apps/distributed-app/docker-configuration/webadmin.properties

@@ -27,7 +27,10 @@ host=0.0.0.0
 # Defaults to false
 https.enabled=false
 
-# Compulsory when enabling HTTPS
+# When enabling HTTPS, configure either PEM certificate and key, or a keystore
+#https.certificates=/path/to/fullchain.pem
+#https.privateKey=/path/to/privkey.pem
+# Or with keystore:
 #https.keystore=/path/to/keystore
 #https.password=password
 

server/apps/distributed-app/sample-configuration/webadmin.properties

@@ -28,7 +28,10 @@ host=localhost
 # Defaults to false
 https.enabled=false
 
-# Compulsory when enabling HTTPS
+# When enabling HTTPS, configure either PEM certificate and key, or a keystore
+#https.certificates=/path/to/fullchain.pem
+#https.privateKey=/path/to/privkey.pem
+# Or with keystore:
 #https.keystore=/path/to/keystore
 #https.password=password
 

server/apps/distributed-pop3-app/docker-configuration/webadmin.properties

@@ -27,7 +27,10 @@ host=0.0.0.0
 # Defaults to false
 https.enabled=false
 
-# Compulsory when enabling HTTPS
+# When enabling HTTPS, configure either PEM certificate and key, or a keystore
+#https.certificates=/path/to/fullchain.pem
+#https.privateKey=/path/to/privkey.pem
+# Or with keystore:
 #https.keystore=/path/to/keystore
 #https.password=password
 

server/apps/distributed-pop3-app/sample-configuration/webadmin.properties

@@ -28,7 +28,10 @@ host=localhost
 # Defaults to false
 https.enabled=false
 
-# Compulsory when enabling HTTPS
+# When enabling HTTPS, configure either PEM certificate and key, or a keystore
+#https.certificates=/path/to/fullchain.pem
+#https.privateKey=/path/to/privkey.pem
+# Or with keystore:
 #https.keystore=/path/to/keystore
 #https.password=password
 

server/apps/jpa-app/docker-configuration/webadmin.properties

@@ -27,7 +27,10 @@ host=0.0.0.0
 # Defaults to false
 https.enabled=false
 
-# Compulsory when enabling HTTPS
+# When enabling HTTPS, configure either PEM certificate and key, or a keystore
+#https.certificates=/path/to/fullchain.pem
+#https.privateKey=/path/to/privkey.pem
+# Or with keystore:
 #https.keystore=/path/to/keystore
 #https.password=password
 

server/apps/jpa-app/sample-configuration/webadmin.properties

@@ -28,7 +28,10 @@ host=localhost
 # Defaults to false
 https.enabled=false
 
-# Compulsory when enabling HTTPS
+# When enabling HTTPS, configure either PEM certificate and key, or a keystore
+#https.certificates=/path/to/fullchain.pem
+#https.privateKey=/path/to/privkey.pem
+# Or with keystore:
 #https.keystore=/path/to/keystore
 #https.password=password
 

server/apps/jpa-smtp-app/docker-configuration/webadmin.properties

@@ -27,7 +27,10 @@ host=0.0.0.0
 # Defaults to false
 https.enabled=false
 
-# Compulsory when enabling HTTPS
+# When enabling HTTPS, configure either PEM certificate and key, or a keystore
+#https.certificates=/path/to/fullchain.pem
+#https.privateKey=/path/to/privkey.pem
+# Or with keystore:
 #https.keystore=/path/to/keystore
 #https.password=password
 

server/apps/jpa-smtp-app/sample-configuration/webadmin.properties

@@ -28,7 +28,10 @@ host=localhost
 # Defaults to false
 https.enabled=false
 
-# Compulsory when enabling HTTPS
+# When enabling HTTPS, configure either PEM certificate and key, or a keystore
+#https.certificates=/path/to/fullchain.pem
+#https.privateKey=/path/to/privkey.pem
+# Or with keystore:
 #https.keystore=/path/to/keystore
 #https.password=password
 

server/apps/memory-app/docker-configuration/webadmin.properties

@@ -27,7 +27,10 @@ host=0.0.0.0
 # Defaults to false
 https.enabled=false
 
-# Compulsory when enabling HTTPS
+# When enabling HTTPS, configure either PEM certificate and key, or a keystore
+#https.certificates=/path/to/fullchain.pem
+#https.privateKey=/path/to/privkey.pem
+# Or with keystore:
 #https.keystore=/path/to/keystore
 #https.password=password
 

server/apps/memory-app/sample-configuration/webadmin.properties

@@ -28,7 +28,10 @@ host=localhost
 # Defaults to false
 https.enabled=false
 
-# Compulsory when enabling HTTPS
+# When enabling HTTPS, configure either PEM certificate and key, or a keystore
+#https.certificates=/path/to/fullchain.pem
+#https.privateKey=/path/to/privkey.pem
+# Or with keystore:
 #https.keystore=/path/to/keystore
 #https.password=password
 

server/apps/postgres-app/docker-configuration/webadmin.properties

@@ -27,7 +27,10 @@ host=0.0.0.0
 # Defaults to false
 https.enabled=false
 
-# Compulsory when enabling HTTPS
+# When enabling HTTPS, configure either PEM certificate and key, or a keystore
+#https.certificates=/path/to/fullchain.pem
+#https.privateKey=/path/to/privkey.pem
+# Or with keystore:
 #https.keystore=/path/to/keystore
 #https.password=password
 

server/apps/postgres-app/sample-configuration/webadmin.properties

@@ -28,7 +28,10 @@ host=localhost
 # Defaults to false
 https.enabled=false
 
-# Compulsory when enabling HTTPS
+# When enabling HTTPS, configure either PEM certificate and key, or a keystore
+#https.certificates=/path/to/fullchain.pem
+#https.privateKey=/path/to/privkey.pem
+# Or with keystore:
 #https.keystore=/path/to/keystore
 #https.password=password
 

server/apps/scaling-pulsar-smtp/sample-configuration/webadmin.properties

@@ -28,7 +28,10 @@ host=0.0.0.0
 # Defaults to false
 https.enabled=false
 
-# Compulsory when enabling HTTPS
+# When enabling HTTPS, configure either PEM certificate and key, or a keystore
+#https.certificates=/path/to/fullchain.pem
+#https.privateKey=/path/to/privkey.pem
+# Or with keystore:
 #https.keystore=/path/to/keystore
 #https.password=password
 

server/container/guice/protocols/webadmin/src/main/java/org/apache/james/modules/server/WebAdminServerModule.java

@@ -264,14 +264,28 @@ JwtTokenVerifier.Factory providesJwtTokenVerifier(WebAdminConfiguration webAdmin
             .orElseGet(jmapTokenVerifier::get);
     }
 
-    private Optional<TlsConfiguration> readHttpsConfiguration(Configuration configurationFile) {
+    @VisibleForTesting
+    Optional<TlsConfiguration> readHttpsConfiguration(Configuration configurationFile) {
         boolean enabled = configurationFile.getBoolean("https.enabled", DEFAULT_HTTPS_DISABLED);
         if (enabled) {
+            String certificates = configurationFile.getString("https.certificates", null);
+            String privateKey = configurationFile.getString("https.privateKey", null);
+            String trustKeystore = configurationFile.getString("https.trust.keystore", DEFAULT_NO_TRUST_KEYSTORE);
+            String trustPassword = configurationFile.getString("https.trust.password", DEFAULT_NO_TRUST_PASSWORD);
+            if (certificates != null && privateKey != null) {
+                return Optional.of(TlsConfiguration.builder()
+                    .pem(certificates,
+                        privateKey,
+                        configurationFile.getString("https.password", DEFAULT_NO_PASSWORD),
+                        trustKeystore,
+                        trustPassword)
+                    .build());
+            }
             return Optional.of(TlsConfiguration.builder()
                 .raw(configurationFile.getString("https.keystore", DEFAULT_NO_KEYSTORE),
                     configurationFile.getString("https.password", DEFAULT_NO_PASSWORD),
-                    configurationFile.getString("https.trust.keystore", DEFAULT_NO_TRUST_KEYSTORE),
-                    configurationFile.getString("https.trust.password", DEFAULT_NO_TRUST_PASSWORD))
+                    trustKeystore,
+                    trustPassword)
                 .build());
         }
         return Optional.empty();

server/container/guice/protocols/webadmin/src/test/java/org/apache/james/modules/server/WebAdminServerModuleTest.java

@@ -26,6 +26,7 @@
 import org.apache.commons.configuration2.Configuration;
 import org.apache.commons.configuration2.PropertiesConfiguration;
 import org.apache.james.utils.PropertiesProvider;
+import org.apache.james.webadmin.TlsConfiguration;
 import org.junit.jupiter.api.Nested;
 import org.junit.jupiter.api.Test;
 
@@ -143,4 +144,64 @@ private PropertiesConfiguration configuration(String key, Object value) {
             return configuration;
         }
     }
+
+    @Nested
+    class HttpsConfigurationTest {
+        @Test
+        void shouldReturnEmptyWhenHttpsDisabled() {
+            PropertiesConfiguration configuration = new PropertiesConfiguration();
+            configuration.addProperty("https.enabled", false);
+
+            assertThat(new WebAdminServerModule().readHttpsConfiguration(configuration))
+                .isEmpty();
+        }
+
+        @Test
+        void shouldReadKeystoreConfiguration() {
+            PropertiesConfiguration configuration = new PropertiesConfiguration();
+            configuration.addProperty("https.enabled", true);
+            configuration.addProperty("https.keystore", "conf/keystore.jks");
+            configuration.addProperty("https.password", "secret");
+
+            Optional<TlsConfiguration> tlsConfiguration = new WebAdminServerModule().readHttpsConfiguration(configuration);
+
+            assertThat(tlsConfiguration).isPresent();
+            assertThat(tlsConfiguration.get().isPem()).isFalse();
+            assertThat(tlsConfiguration.get().getKeystoreFilePath()).isEqualTo("conf/keystore.jks");
+            assertThat(tlsConfiguration.get().getKeystorePassword()).isEqualTo("secret");
+        }
+
+        @Test
+        void shouldReadPemConfiguration() {
+            PropertiesConfiguration configuration = new PropertiesConfiguration();
+            configuration.addProperty("https.enabled", true);
+            configuration.addProperty("https.certificates", "conf/fullchain.pem");
+            configuration.addProperty("https.privateKey", "conf/privkey.pem");
+            configuration.addProperty("https.password", "keySecret");
+
+            Optional<TlsConfiguration> tlsConfiguration = new WebAdminServerModule().readHttpsConfiguration(configuration);
+
+            assertThat(tlsConfiguration).isPresent();
+            assertThat(tlsConfiguration.get().isPem()).isTrue();
+            assertThat(tlsConfiguration.get().getCertificatesFilePath()).isEqualTo("conf/fullchain.pem");
+            assertThat(tlsConfiguration.get().getPrivateKeyFilePath()).isEqualTo("conf/privkey.pem");
+            assertThat(tlsConfiguration.get().getPrivateKeyPassword()).isEqualTo("keySecret");
+        }
+
+        @Test
+        void shouldReadPemConfigurationWithoutPassword() {
+            PropertiesConfiguration configuration = new PropertiesConfiguration();
+            configuration.addProperty("https.enabled", true);
+            configuration.addProperty("https.certificates", "conf/fullchain.pem");
+            configuration.addProperty("https.privateKey", "conf/privkey.pem");
+
+            Optional<TlsConfiguration> tlsConfiguration = new WebAdminServerModule().readHttpsConfiguration(configuration);
+
+            assertThat(tlsConfiguration).isPresent();
+            assertThat(tlsConfiguration.get().isPem()).isTrue();
+            assertThat(tlsConfiguration.get().getCertificatesFilePath()).isEqualTo("conf/fullchain.pem");
+            assertThat(tlsConfiguration.get().getPrivateKeyFilePath()).isEqualTo("conf/privkey.pem");
+            assertThat(tlsConfiguration.get().getPrivateKeyPassword()).isNull();
+        }
+    }
 }

server/protocols/webadmin/webadmin-core/pom.xml

@@ -107,6 +107,10 @@
             <artifactId>json-path</artifactId>
             <scope>test</scope>
         </dependency>
+        <dependency>
+            <groupId>io.github.hakky54</groupId>
+            <artifactId>ayza-for-pem</artifactId>
+        </dependency>
         <dependency>
             <groupId>io.rest-assured</groupId>
             <artifactId>rest-assured</artifactId>