Parse byte array of otherName SANs to string of ASN1 object and OID (o…

…pensearch-project#1369) Signed-off-by: Jake Smith <jakemgsmith@gmail.com>
lbreinig · Sep 9, 2021 · 23ba524 · 23ba524
1 parent 50bf385
commit 23ba524
Show file tree

Hide file tree

Showing 15 changed files with 342 additions and 359 deletions.
diff --git a/src/main/java/org/opensearch/security/ssl/DefaultSecurityKeyStore.java b/src/main/java/org/opensearch/security/ssl/DefaultSecurityKeyStore.java
@@ -25,6 +25,8 @@
 import io.netty.handler.ssl.SslContextBuilder;
 import io.netty.handler.ssl.SslProvider;
 
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.LinkOption;
@@ -39,6 +41,7 @@
 import java.security.cert.X509Certificate;
 import java.util.ArrayList;
 import java.util.Arrays;
+import java.util.Collection;
 import java.util.Collections;
 import java.util.Date;
 import java.util.HashSet;
@@ -66,6 +69,13 @@
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
 
+import org.bouncycastle.asn1.ASN1InputStream;
+import org.bouncycastle.asn1.ASN1ObjectIdentifier;
+import org.bouncycastle.asn1.ASN1Primitive;
+import org.bouncycastle.asn1.ASN1Sequence;
+import org.bouncycastle.asn1.ASN1String;
+import org.bouncycastle.asn1.ASN1TaggedObject;
+
 import org.opensearch.OpenSearchException;
 import org.opensearch.OpenSearchSecurityException;
 import org.opensearch.SpecialPermission;
@@ -572,12 +582,7 @@ private boolean hasValidDNs(final X509Certificate[] currentX509Certs, final X509
         final Function<? super X509Certificate, String> formatDNString = cert -> {
             final String issuerDn = cert !=null && cert.getIssuerX500Principal() != null ? cert.getIssuerX500Principal().getName() : "";
             final String subjectDn = cert !=null && cert.getSubjectX500Principal() != null ? cert.getSubjectX500Principal().getName() : "";
-            String san = "";
-            try {
-                san = cert !=null && cert.getSubjectAlternativeNames() != null ? cert.getSubjectAlternativeNames().toString() : "";
-            } catch (CertificateParsingException e) {
-                log.error("Issue parsing SubjectAlternativeName:", e);
-            }
+            final String san = getSubjectAlternativeNames(cert);
             return String.format("%s/%s/%s", issuerDn, subjectDn, san);
         };
 
@@ -949,4 +954,64 @@ private static void checkPath(String keystoreFilePath, String fileNameLogOnly) {
                 + fileNameLogOnly);
         }
     }
+
+    @Override
+    public String getSubjectAlternativeNames(X509Certificate cert) {
+        String san = "";
+        try {
+            Collection<List<?>> altNames = cert !=null && cert.getSubjectAlternativeNames() != null ? cert.getSubjectAlternativeNames() : null;
+            if (altNames != null) {
+                Collection<List<?>> sans = new ArrayList<>();
+                for (List<?> altName : altNames) {
+                    Integer type = (Integer) altName.get(0);
+                    // otherName requires parsing to string
+                    if (type == 0) {
+                        List<?> otherName = getOtherName(altName);
+                        if (otherName != null) {
+                            sans.add(Arrays.asList(type, otherName));
+                        }
+                    } else {
+                        sans.add(altName);
+                    }
+                }
+                san = sans.toString();
+            }
+        } catch (CertificateParsingException e) {
+            log.error("Issue parsing SubjectAlternativeName:", e);
+        }
+
+        return san;
+    }
+
+    private List<String> getOtherName(List<?> altName) {
+        ASN1Primitive oct =  null;
+        try {
+            byte[] altNameBytes = (byte[]) altName.get(1);
+            oct = (new ASN1InputStream(new ByteArrayInputStream(altNameBytes)).readObject());
+        } catch (IOException e) {
+            throw new RuntimeException("Could not read ASN1InputStream", e);
+        }
+        if (oct instanceof ASN1TaggedObject) {
+            oct = ((ASN1TaggedObject) oct).getObject();
+        }
+        ASN1Sequence seq = ASN1Sequence.getInstance(oct);
+
+        // Get object identifier from first in sequence
+        ASN1ObjectIdentifier asnOID = (ASN1ObjectIdentifier) seq.getObjectAt(0);
+        String oid = asnOID.getId();
+
+        // Get value of object from second element
+        final ASN1TaggedObject obj = (ASN1TaggedObject) seq.getObjectAt(1);
+        // Could be tagged twice due to bug in java cert.getSubjectAltName
+        ASN1Primitive prim = obj.getObject();
+        if (prim instanceof ASN1TaggedObject) {
+            prim = ASN1TaggedObject.getInstance(((ASN1TaggedObject) prim)).getObject();
+        }
+
+        if (prim instanceof ASN1String) {
+            return Collections.unmodifiableList(Arrays.asList(oid, ((ASN1String) prim).getString()));
+        }
+
+        return null;
+    }
 }
diff --git a/src/main/java/org/opensearch/security/ssl/ExternalSecurityKeyStore.java b/src/main/java/org/opensearch/security/ssl/ExternalSecurityKeyStore.java
@@ -127,6 +127,12 @@ public X509Certificate[] getHttpCerts() {
         return null;
     }
 
+    @Override
+    public String getSubjectAlternativeNames(X509Certificate cert) {
+        // NO-OP: since this class uses externalSslContext there is no cert
+        return null;
+    }
+
     public static void registerExternalSslContext(String id, SSLContext externalSsslContext) {
         contextMap.put(Objects.requireNonNull(id), Objects.requireNonNull(externalSsslContext));
     }

diff --git a/src/main/java/org/opensearch/security/ssl/SecurityKeyStore.java b/src/main/java/org/opensearch/security/ssl/SecurityKeyStore.java
@@ -32,6 +32,7 @@ public interface SecurityKeyStore {
     public String getHTTPProviderName();
     public String getTransportServerProviderName();
     public String getTransportClientProviderName();
+    public String getSubjectAlternativeNames(X509Certificate cert); 
 
     public void initHttpSSLConfig();
     public void initTransportSSLConfig();

diff --git a/src/main/java/org/opensearch/security/ssl/rest/SecuritySSLCertsInfoAction.java b/src/main/java/org/opensearch/security/ssl/rest/SecuritySSLCertsInfoAction.java
@@ -168,12 +168,7 @@ private List<Map<String, String>> generateCertDetailList(final X509Certificate[]
                         final String issuerDn = cert != null && cert.getIssuerX500Principal() != null ? cert.getIssuerX500Principal().getName(): "";
                         final String subjectDn = cert != null && cert.getSubjectX500Principal() != null ? cert.getSubjectX500Principal().getName(): "";
 
-                        String san = "";
-                        try {
-                            san = cert !=null && cert.getSubjectAlternativeNames() != null ? cert.getSubjectAlternativeNames().toString() : "";
-                        } catch (CertificateParsingException e) {
-                            log.error("Issue parsing SubjectAlternativeName:", e);
-                        }
+                        final String san = odsks.getSubjectAlternativeNames(cert);
 
                         final String notBefore = cert != null && cert.getNotBefore() != null ? cert.getNotBefore().toInstant().toString(): "";
                         final String notAfter = cert != null && cert.getNotAfter() != null ? cert.getNotAfter().toInstant().toString(): "";

diff --git a/src/test/java/org/opensearch/security/ssl/SecuritySSLReloadCertsActionTests.java b/src/test/java/org/opensearch/security/ssl/SecuritySSLReloadCertsActionTests.java
@@ -48,18 +48,18 @@ public class SecuritySSLReloadCertsActionTests extends SingleClusterTest {
         ImmutableMap.of(
         "issuer_dn", "CN=Example Com Inc. Signing CA,OU=Example Com Inc. Signing CA,O=Example Com Inc.,DC=example,DC=com",
         "subject_dn", "CN=node-1.example.com,OU=SSL,O=Test,L=Test,C=DE",
-            "san", "[[2, node-1.example.com], [2, localhost], [7, 127.0.0.1], [8, 1.2.3.4.5.5]]",
-        "not_before", "2020-02-17T16:19:25Z",
-        "not_after", "2022-02-16T16:19:25Z"
+            "san", "[[8, 1.2.3.4.5.5], [0, [2.5.4.3, node-1.example.com]], [2, node-1.example.com], [2, localhost], [7, 127.0.0.1]]",
+        "not_before", "2021-04-12T00:07:08Z",
+        "not_after", "2023-04-12T00:07:08Z"
         ));
 
     private final List<Map<String, String>> NEW_NODE_CERT_DETAILS = ImmutableList.of(
         ImmutableMap.of(
             "issuer_dn", "CN=Example Com Inc. Signing CA,OU=Example Com Inc. Signing CA,O=Example Com Inc.,DC=example,DC=com",
             "subject_dn", "CN=node-1.example.com,OU=SSL,O=Test,L=Test,C=DE",
-            "san", "[[2, node-1.example.com], [2, localhost], [7, 127.0.0.1], [8, 1.2.3.4.5.5]]",
-            "not_before", "2020-02-18T14:11:28Z",
-            "not_after", "2022-02-17T14:11:28Z"
+            "san", "[[8, 1.2.3.4.5.5], [0, [2.5.4.3, node-1.example.com]], [2, node-1.example.com], [2, localhost], [7, 127.0.0.1]]",
+            "not_before", "2021-04-12T00:09:00Z",
+            "not_after", "2023-04-12T00:09:00Z"
         )
     );
 

diff --git a/src/test/resources/ssl/reload/kirk-keystore.jks b/src/test/resources/ssl/reload/kirk-keystore.jks
diff --git a/src/test/resources/ssl/reload/node-new.crt.pem b/src/test/resources/ssl/reload/node-new.crt.pem
@@ -1,88 +1,56 @@
-Bag Attributes
-    friendlyName: node-1
-    localKeyID: 54 69 6D 65 20 31 35 38 32 30 33 35 30 39 33 32 31 37
-subject=/C=DE/L=Test/O=Test/OU=SSL/CN=node-1.example.com
-issuer=/DC=com/DC=example/O=Example Com Inc./OU=Example Com Inc. Signing CA/CN=Example Com Inc. Signing CA
 -----BEGIN CERTIFICATE-----
-MIIEgjCCA2qgAwIBAgIBDTANBgkqhkiG9w0BAQsFADCBlTETMBEGCgmSJomT8ixk
-ARkWA2NvbTEXMBUGCgmSJomT8ixkARkWB2V4YW1wbGUxGTAXBgNVBAoMEEV4YW1w
-bGUgQ29tIEluYy4xJDAiBgNVBAsMG0V4YW1wbGUgQ29tIEluYy4gU2lnbmluZyBD
-QTEkMCIGA1UEAwwbRXhhbXBsZSBDb20gSW5jLiBTaWduaW5nIENBMB4XDTIwMDIx
-ODE0MTEyOFoXDTIyMDIxNzE0MTEyOFowVjELMAkGA1UEBhMCREUxDTALBgNVBAcT
-BFRlc3QxDTALBgNVBAoTBFRlc3QxDDAKBgNVBAsTA1NTTDEbMBkGA1UEAxMSbm9k
-ZS0xLmV4YW1wbGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
-mRp5YfJzesj0XWc/mMMnB5R5eOW6BTUSASF91Sqi6k1ojcqyno9KzA+ET6Ir7+YQ
-xFtozdg3nJt4Ui96YOpGLamYLv86YRt9KaxJt6XRCs24iqawadiahPIQz2JNS8ov
-BXZz6f/n86cxk4t0Hk2IEzN0r2Y1nj+WZOOu2R+6RQAGgPK0CsmakNDiVyDv7Dj1
-Nc3E0st0AhtNbpS8lF10Ui8+UaT6aZH+K8B+0wcTte303Z48v37rSoQiFxarWpuF
-O1nULO/mbaK7URrQx4e0zgH3fAJcQcB8vbvDEms16nBfCDdcPajBsYRQOMnYhDNN
-rE4nZyGeJSbICwLT/KH7fQIDAQABo4IBGTCCARUwDgYDVR0PAQH/BAQDAgWgMAkG
-A1UdEwQCMAAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMB0GA1UdDgQW
-BBRFHYHy4qJsnRzcJFstw5YiGK/z3jAfBgNVHSMEGDAWgBSZLwYV91hrMtmbl+N4
-EBcBgyBlsTBiBgNVHR8EWzBZMFegVaBThlFodHRwczovL3Jhdy5naXRodWJ1c2Vy
-Y29udGVudC5jb20vZmxvcmFndW5uY29tL3VuaXR0ZXN0LWFzc2V0cy9tYXN0ZXIv
-cmV2b2tlZC5jcmwwNQYDVR0RBC4wLIISbm9kZS0xLmV4YW1wbGUuY29tgglsb2Nh
-bGhvc3SHBH8AAAGIBSoDBAUFMA0GCSqGSIb3DQEBCwUAA4IBAQAF/ztDiApHLcMv
-JbSXd4Gx+KN0aUD6grvUuk28exwElRgyfxPecUy+mRZQykrIlO89ZFgWRV6KHP/+
-/5b/VYLHwKm0tPEF/uAcNa6QWC3cYv/QXYziL7FrMyQzI84ip9nUa7A9cILLj1HV
-YLR55dXHHgUSrHi+CLaiUl0SiEZMonw4KCTRJZYc91r6GUB6+5n4jjhkMjBNVIT6
-ht+5J4mhslhr4p6LSieWEVBJPCbf/B6xUhCl00/6W4K275gwEegUR3CLeuuQ+w1V
-U9l3GmFZKKVmVhIWVyQ0eiPddEbgcspJSzuktE+xwHfc3Gha5fM4X6y/grpigvBw
-9C8NNko3
+MIIE5DCCA8ygAwIBAgIGAXjDaPfJMA0GCSqGSIb3DQEBCwUAMIGVMRMwEQYKCZIm
+iZPyLGQBGRYDY29tMRcwFQYKCZImiZPyLGQBGRYHZXhhbXBsZTEZMBcGA1UECgwQ
+RXhhbXBsZSBDb20gSW5jLjEkMCIGA1UECwwbRXhhbXBsZSBDb20gSW5jLiBTaWdu
+aW5nIENBMSQwIgYDVQQDDBtFeGFtcGxlIENvbSBJbmMuIFNpZ25pbmcgQ0EwHhcN
+MjEwNDEyMDAwOTAwWhcNMjMwNDEyMDAwOTAwWjBWMQswCQYDVQQGEwJERTENMAsG
+A1UEBwwEVGVzdDENMAsGA1UECgwEVGVzdDEMMAoGA1UECwwDU1NMMRswGQYDVQQD
+DBJub2RlLTEuZXhhbXBsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
+AoIBAQC+PKQOneEPtQIt4G8yeqrAhFGXUkFDID5bnAb7mk5ALX5B8bWYQa7hER6x
+QpP+a7CdPLDm+PLTGkGPT0S7HpcOYli3qtED0zkk8yaCL8ztk3oyLuV97u8x4A+r
+OXoO2nmrG9ck8/XZN0ktu8Q87l0EaSMsCwuRJ+A/vFeKIEijzfjhBPjn7smYUpN0
+LprrM+o//OHPsQEXsRHOpjIM7KC8a+luRxAlrxotHO0lWEA05pNHya5fqkhdYQ1M
+gR0cb8zTxBB+DAfmHCgzw4rf4kSd11LJbk5CITeSd98xV28TanaDli8BHfDbk3TM
+iASv3LJyq5UX/1yD1CG41UH6vpoRAgMBAAGjggF2MIIBcjCBvAYDVR0jBIG0MIGx
+gBTS02Hh6adcYFVpsHSBAGZYMvoGRKGBlaSBkjCBjzETMBEGCgmSJomT8ixkARkW
+A2NvbTEXMBUGCgmSJomT8ixkARkWB2V4YW1wbGUxGTAXBgNVBAoMEEV4YW1wbGUg
+Q29tIEluYy4xITAfBgNVBAsMGEV4YW1wbGUgQ29tIEluYy4gUm9vdCBDQTEhMB8G
+A1UEAwwYRXhhbXBsZSBDb20gSW5jLiBSb290IENBggECMB0GA1UdDgQWBBRQWhAY
+IPA14V/TdxjMqcvwbdG/UTAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQEAwIF4DAg
+BgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwUgYDVR0RBEswSYgFKgME
+BQWgGwYDVQQDoBQMEm5vZGUtMS5leGFtcGxlLmNvbYISbm9kZS0xLmV4YW1wbGUu
+Y29tgglsb2NhbGhvc3SHBH8AAAEwDQYJKoZIhvcNAQELBQADggEBAJVsT7kQ5JYS
+dfZfo7Oq6DJfNPPPSUiGNuN8epcEF7jvEYbvZzaxAYZFqGOh7k8jG2/ISjYm6IW/
+8g8sOraYfjY1+An+UFq1Z9ykemYVyzySpHMKn8PqtIdcBzaX0fA8hO6Q0Gsm6V9G
+/KpN3696rAUHhgGFSE01fVcq2B5Keuk/RDFLhfGAcDT4XO4ZyT5ouHZzVuXatkgx
+OJQCsxtyvEajvXDMFQYddubBZwptM+uoFOe1G3cLYc39tRk+O/RTAcfAWN0VyBfD
+/etGwf7991oIOCaNtCzHgGiOr5fjGJ+AvUU1plSVsoArxpHiRBxMG/Fvyb/uN9g+
+o1yGUF5oYqA=
 -----END CERTIFICATE-----
-Bag Attributes
-    friendlyName: CN=Example Com Inc. Signing CA,OU=Example Com Inc. Signing CA,O=Example Com Inc.,DC=example,DC=com
-subject=/DC=com/DC=example/O=Example Com Inc./OU=Example Com Inc. Signing CA/CN=Example Com Inc. Signing CA
-issuer=/DC=com/DC=example/O=Example Com Inc./OU=Example Com Inc. Root CA/CN=Example Com Inc. Root CA
 -----BEGIN CERTIFICATE-----
-MIIEBzCCAu+gAwIBAgIBAjANBgkqhkiG9w0BAQsFADCBjzETMBEGCgmSJomT8ixk
+MIIEqTCCA5GgAwIBAgIBAjANBgkqhkiG9w0BAQsFADCBjzETMBEGCgmSJomT8ixk
 ARkWA2NvbTEXMBUGCgmSJomT8ixkARkWB2V4YW1wbGUxGTAXBgNVBAoMEEV4YW1w
 bGUgQ29tIEluYy4xITAfBgNVBAsMGEV4YW1wbGUgQ29tIEluYy4gUm9vdCBDQTEh
-MB8GA1UEAwwYRXhhbXBsZSBDb20gSW5jLiBSb290IENBMB4XDTIwMDIxNzE2MTkx
-NloXDTMwMDIxNjE2MTkxNlowgZUxEzARBgoJkiaJk/IsZAEZFgNjb20xFzAVBgoJ
+MB8GA1UEAwwYRXhhbXBsZSBDb20gSW5jLiBSb290IENBMB4XDTIxMDQxMjAwMDUx
+M1oXDTMxMDQxMDAwMDUxM1owgZUxEzARBgoJkiaJk/IsZAEZFgNjb20xFzAVBgoJ
 kiaJk/IsZAEZFgdleGFtcGxlMRkwFwYDVQQKDBBFeGFtcGxlIENvbSBJbmMuMSQw
 IgYDVQQLDBtFeGFtcGxlIENvbSBJbmMuIFNpZ25pbmcgQ0ExJDAiBgNVBAMMG0V4
 YW1wbGUgQ29tIEluYy4gU2lnbmluZyBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEP
-ADCCAQoCggEBAKysgDiVedG/2qsMMGtbOV3mkfA1JuunLiO/bNMF41ukjIQoIl11
-3MKAhkSpuOcDAFXsFc94Ih80MWVn9xUN4Hviv42j2zOJNmbSfhH73GfUD7npC/9J
-QdBaWKQmIWBYbbbJb/B/brmleymeEhckKB/xrqeefG6nMWsiY4CBiyMv5UfbKBi8
-5hcWSxy+e6gSQnKeIimYufaWZJuiJ3BfANhpidjHDBlkXog8eb/79Yg7UAWcqJV4
-cpgQK48SV/DEPbnFAfGBTQSsLMdgkESrbfQz2jXPws4b9AvnNp3B+sseKW09iMFm
-848W64ywKxdsQMTC4NgmO28flb+mFwvcRCkCAwEAAaNmMGQwDgYDVR0PAQH/BAQD
-AgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFJkvBhX3WGsy2ZuX43gQ
-FwGDIGWxMB8GA1UdIwQYMBaAFHFUgwb+I9oQZhURLekxk/ZxEdwhMA0GCSqGSIb3
-DQEBCwUAA4IBAQCHZNLLExdn7pWFCg6TRPUmEj8i7vkWKoojRZsiA4QtM5flaaxT
-ysj1+Kv53+YsWugBJyAiPQzI91TQpa11SPSV1rQM2ovhnML9ErjrlKF5avKTkFFp
-G/lbTuHzS43dcXemrvKPUWTFqqFubyhDP0dOcfzX2cHu1g/6U03TgoyTGX2M5Gtm
-nj1FVu/yEdKUJpDStJ8jnbTMx2gH8BnQwB51dYAjwhazjBDTC1Vl4ixKicKvfVym
-w2+Ja004DRjPoiq5pk5HGKfGR7j6igmX/AH/10RxvMhdx7LNFIrRbi/jrFr5xvxE
-f2YF9cpqI0hhws6Gz1/Lb9eCk9Lve5kqsf4D
------END CERTIFICATE-----
-Bag Attributes
-    friendlyName: CN=Example Com Inc. Root CA,OU=Example Com Inc. Root CA,O=Example Com Inc.,DC=example,DC=com
-subject=/DC=com/DC=example/O=Example Com Inc./OU=Example Com Inc. Root CA/CN=Example Com Inc. Root CA
-issuer=/DC=com/DC=example/O=Example Com Inc./OU=Example Com Inc. Root CA/CN=Example Com Inc. Root CA
------BEGIN CERTIFICATE-----
-MIID/jCCAuagAwIBAgIBATANBgkqhkiG9w0BAQsFADCBjzETMBEGCgmSJomT8ixk
-ARkWA2NvbTEXMBUGCgmSJomT8ixkARkWB2V4YW1wbGUxGTAXBgNVBAoMEEV4YW1w
-bGUgQ29tIEluYy4xITAfBgNVBAsMGEV4YW1wbGUgQ29tIEluYy4gUm9vdCBDQTEh
-MB8GA1UEAwwYRXhhbXBsZSBDb20gSW5jLiBSb290IENBMB4XDTIwMDIxNzE2MTkx
-NloXDTMwMDIxNjE2MTkxNlowgY8xEzARBgoJkiaJk/IsZAEZFgNjb20xFzAVBgoJ
-kiaJk/IsZAEZFgdleGFtcGxlMRkwFwYDVQQKDBBFeGFtcGxlIENvbSBJbmMuMSEw
-HwYDVQQLDBhFeGFtcGxlIENvbSBJbmMuIFJvb3QgQ0ExITAfBgNVBAMMGEV4YW1w
-bGUgQ29tIEluYy4gUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
-ggEBAPum2jjujLRNoeqh4hQTUCUhdG3maOUJNjNJOzd284Cv1A6dJICotspw4Ddr
-ls7GjrWaMmsWmFq0y0qz9YCQlcUxxgSEDZDdj2n5JKMI8LAERq5dwBoNaRcJ3zm+
-Kosv3qhGwspZqviJq2gBHi71+p5VT6esbLBnBcOTUGoJPzVZ/cEleBtJ/scuw7nl
-bq1v2LQELD5h7wRh6HvWpWa98F3A5dHMPj/8E8LlWbSM6ojWVf/nsusK4yORUaTJ
-bY3aTe6mxq5S0pnGtWh3dRkm+NUdzdaEYdnYcvgAvqF9T7/Ns4OLsRpjnuTA/Xoc
-Ni5tcM9ylPIxJqbkvWgLUtdZiCsCAwEAAaNjMGEwDgYDVR0PAQH/BAQDAgEGMA8G
-A1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFHFUgwb+I9oQZhURLekxk/ZxEdwhMB8G
-A1UdIwQYMBaAFHFUgwb+I9oQZhURLekxk/ZxEdwhMA0GCSqGSIb3DQEBCwUAA4IB
-AQAWWt992NJ10ddp2M1J3geb3xYCJF2t2VQzqBO58hHeJxLiqEmuM0VUFssvQJ9n
-9i+3PIrMq0mcH068WaIINzkoiqaoBtzllCHkPpkrQPbpxD0UQyUcMFh2iydVbI6Z
-eRZUmCeqALAmKcmQbAZyx8W56P1ukhAGhHXf2yTL69Dd1tzqSaA/j+lPuumHWHwH
-5Q8Tnp8y/adn1tqv/2pEjpG0L3lXz13C3QB0OId/OUgLeh0Op6QNda9RX3cG3Cl4
-AtVft1pnOzhalB8v4iSeN6qmoqCf+YJd1R24AitIiG8+e147FEkbzPq0kJj0j3PN
-SEPDSy6hmI2NJhwedsdbSJtg
------END CERTIFICATE-----
+ADCCAQoCggEBAJjVJ9Ipq0uCE7EE0RRBadkrIm7J8OGa2xeFCEpsw+hqQbmftrm0
+V5XFpRKznv7r9JxFQn4uUM/Tqxt/mZ9Qql6IGWiNeK4e0Hfh+Lc/VD+w+mDqxo52
+zv0afYyyM/1NiOyKV7hO0Akwj25zAfnqs2FbsZzVXtRpgOnfOdfKpUL6fKAxwjex
++0nOOaS5D+unS64sh0mTMVD32iag+tg6aiiW914Jmrkd4yDV3uoXh/FKafRRWHSq
+pwO7Xilb+fLRMiQ1N09mTE8Um12G7mVdBaZpbluwtv2tiS52n8zzpKYbohS2m1ir
+lJMASh6qEKzHUlzmERhq4Ib7V+p0E+gPadMCAwEAAaOCAQYwggECMBIGA1UdEwEB
+/wQIMAYBAf8CAQAwgbwGA1UdIwSBtDCBsYAUrs3v6ngKiRF/4eiBW+3eCSjTVo+h
+gZWkgZIwgY8xEzARBgoJkiaJk/IsZAEZFgNjb20xFzAVBgoJkiaJk/IsZAEZFgdl
+eGFtcGxlMRkwFwYDVQQKDBBFeGFtcGxlIENvbSBJbmMuMSEwHwYDVQQLDBhFeGFt
+cGxlIENvbSBJbmMuIFJvb3QgQ0ExITAfBgNVBAMMGEV4YW1wbGUgQ29tIEluYy4g
+Um9vdCBDQYIBATAdBgNVHQ4EFgQU0tNh4emnXGBVabB0gQBmWDL6BkQwDgYDVR0P
+AQH/BAQDAgGGMA0GCSqGSIb3DQEBCwUAA4IBAQAmRbuLhYdGYjdndROJilIQ4DUD
+HYYijortmkq6ZNQiB7I2teBZjra2xcKp0qaOkG9nJCzhHvGTw/URjWAxFZ5n5hhx
+iBTJZTGY6bk2SWfJxdd3Zld6ybsoaQTO/ZnfuTE0SgxWx1e5q/mRBKvRwF02bJu3
+YNlJMJVuIDxurrUK2CXrgG/BOCYMyiHNmn1Spsh+x+6B9u28CE0M52+HtNJwyQw6
+qPMSNiovXRkqk7E40e7ZY3MS85Pr4L0Us048SswPEpf/+IjV/zTcDP22pQfcjMOX
+DZpdAOGgvqhL9t7M1lcxJrI0cIcBNWOPVa3zsCDU7CXF+riL0Va6TvoChVtT
+-----END CERTIFICATE-----
diff --git a/src/test/resources/ssl/reload/node-new.key.pem b/src/test/resources/ssl/reload/node-new.key.pem
@@ -1,32 +1,28 @@
-Bag Attributes
-    friendlyName: node-1
-    localKeyID: 54 69 6D 65 20 31 35 38 32 30 33 35 30 39 33 32 31 37
-Key Attributes: <No Attributes>
 -----BEGIN PRIVATE KEY-----
-MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCZGnlh8nN6yPRd
-Zz+YwycHlHl45boFNRIBIX3VKqLqTWiNyrKej0rMD4RPoivv5hDEW2jN2Decm3hS
-L3pg6kYtqZgu/zphG30prEm3pdEKzbiKprBp2JqE8hDPYk1Lyi8FdnPp/+fzpzGT
-i3QeTYgTM3SvZjWeP5Zk467ZH7pFAAaA8rQKyZqQ0OJXIO/sOPU1zcTSy3QCG01u
-lLyUXXRSLz5RpPppkf4rwH7TBxO17fTdnjy/futKhCIXFqtam4U7WdQs7+ZtortR
-GtDHh7TOAfd8AlxBwHy9u8MSazXqcF8IN1w9qMGxhFA4ydiEM02sTidnIZ4lJsgL
-AtP8oft9AgMBAAECggEALtNWBIrunsMPWfHWFZa6PSs/66X3Oth8ZTQlFCkyIo8C
-RzuTXcNdkQO9580luv2Waze52hsjBxbVue0jdLiyNg0EqnsNE94gbbpv4WcphDBf
-HKjWk8jXmYmfco4SLffsYbNUyGCoRHECTKn+HbaAw76dFXghNgEksj6gn2+AvNFH
-Sbi89/PxmpmYfR+hBBK9HNeAQSvPGnacLzTdj2YaTzDMBLbZAJh6/LrgFA+9RSmH
-R8oxH0xCWdwVmZoo54HU9lTuDgRQHaPJSGPcBLXE3Y8tJ4G9mEiggftD9bJ5I4Mg
-qQTHM5A6PASNf+HaAFYCe6HETj++xYy9MvP65S7dgQKBgQDdzc669nczlqud5lDB
-+cDBLf9BULhmM7Nf+orMqHoJCeq3o8d/dpbBEzkxVP5ABienFWlGwZz0C6aSxXQp
-Hkf7U+6ueKznEf0hpPrwZus39GhAHBuFgdKmRFb6uCPL9lx7MKubYWJb3/TUikiv
-qPDRWnRMbTkyDcZW8bCgh6XK9QKBgQCwtS8GTWAF07zoMVxjPD5BN2maB3aew42y
-1SSYWpl5NnMTtnZdEevq7nWqyrgkfuYtRgRQWL/4szZBPEiC7flc8d4J0uJQABlg
-6WpBO3Kgd3XrmlwsS60mmOrp9LyfrBeD2LPatNe4EQbbAW2RqQpa/VlR21tbN0L6
-7+zR0E6paQKBgH1nB9PC10AulpbuiYgyKZ3O4LtP5QG7h1XjdCgjtON5XOA40+kn
-5jIBKVvP3vPZxv97ZosfmhqMn7/prTQ2L6JUIOU5yx/VltU3zryuo5x+LZbZjWHd
-NXjVuIuGIo8FmeH4cX2nAJJLO8QS7ueJz6W9y3UOZ8D58sJjYWZRaxYlAoGAbpo5
-QLyVaZBKIRskNIi0fqVsV5hsSpsjyddW/HVYsmG+TYxbMY3SGE4BIFGaSF2VPKki
-chfasJObVeGhkTHabq6Ex6lTNbeaKupuMz4+VOnwyPLo1mDXk90KzDz/AwH4BfJR
-QIcIrpEZtWKDbjRb4u/IRFAEMme4aNBbbkfvtGECgYAS21WDzs+o8rEj0nl+Q8B9
-jTAo6WRhMilo7U0+anAHtgd272fMWzSpCMYLx2PJVieXSdVpSuDMQ2xMAaqlISCz
-UurJ1288vAm43Ky0u7AEHixs53ScoAgSevm2yTh5PznALJA0eVejS+Lo8Qm/v1dr
-bKP6XMy7uJxk4QLczo9A7Q==
------END PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC+PKQOneEPtQIt
+4G8yeqrAhFGXUkFDID5bnAb7mk5ALX5B8bWYQa7hER6xQpP+a7CdPLDm+PLTGkGP
+T0S7HpcOYli3qtED0zkk8yaCL8ztk3oyLuV97u8x4A+rOXoO2nmrG9ck8/XZN0kt
+u8Q87l0EaSMsCwuRJ+A/vFeKIEijzfjhBPjn7smYUpN0LprrM+o//OHPsQEXsRHO
+pjIM7KC8a+luRxAlrxotHO0lWEA05pNHya5fqkhdYQ1MgR0cb8zTxBB+DAfmHCgz
+w4rf4kSd11LJbk5CITeSd98xV28TanaDli8BHfDbk3TMiASv3LJyq5UX/1yD1CG4
+1UH6vpoRAgMBAAECggEAAacCsMrPxeRnWrEonhphKc9sawFQpk3dJMwP5ncSZ23N
+uzJnhqVJaNSOfPEsWmkijVcV3Ue7yjgf6igA25Q6MSqLBTtjWeJnjGndQ4O5RrYB
+eXadUTD2XGtLD4xuAjuFE4aoIX7J+6NGjDJlk7bpUWy9XLhS1yWuxbbz1rQNlXik
+a82FOoQiOxjMCBhgRO+zU1x3Cqz5Keb1UWekMUodXgVBx47P4ziYLV3+E0mkyz/D
+2uJWawnmn0nL3RdyQd6WBEvRT7o1FzZy45zCaMFn0C9NgzUqmSpvKpp4iQU54ptq
+nTQl7+O56QSrt95zEKS+7sjH3sX3rix/GagWj5Z57QKBgQD6SinskXjpd+VdrGAs
+TLxu3P2t524XeOsQV9t9kBlW9jQU0tRgEu81z9UGXFPqiERpFRlyoYlvxOJNgAIJ
+IOZzA5Vu66cQJZWZOapMmrzHdxO0SCgk3fUyyhe6W/3C7DPHJTFfoVJFY/ZhhZ5w
+ZclIupKTszeZj7t786MDCuteLQKBgQDCk7vkLywfqFcdxOy8gQYmBo/xLH+yP7dn
+RgQcvXIxF3K4eI3OwFj0Aly6Bmq4b1VUSqlaCqlDF80LLSh2qlIzFA0UOpRFBsaY
+19p/lZ3BsTlbCwf2picltRaqZw19AhbErRab3WrYqoHfp4aPMDCcL6AwBvmzX/K/
+j17lBvf99QKBgQCf8TTJUE0MJOoV6kmrBX6E+gPCVdosdcEBOKOyoZsPz1WI2RGO
+M4tZv+5Jmkal4V6WKD2S21eQbSiQjfS/EJ8zcF7V+xFPaDUpLYh+W4O3k4ir9FBy
+/sPqKOrw1Ehdf8O2xzW9/sEsRqzztQeCnAj8yP1SFXy6TPdqRk8tapTuIQKBgFYp
+j3FrRjG6nOEs29xZkjxyeXlFyEJJntCXm6iSZ6e/h2iS0dD1Mi7TgPZLcyS7AGE0
+MqwRvoRcXMsPMzThFUdTILuNeSzb5EO4iiQnP9WOwiRDzUH2r60t9Jx+x+VMcIKl
+VzasJO1PC/XbPGXZ5By1pky+OgKpgVg8h7wJivWlAoGBAJ4aOb2iXoNDSchKjXEA
+u4odkRpCu7+QLMR053ixLFr25zOOy92SU6F/A+PsYvl/YmjCXqv3CQ3HMUtEWN8N
+fQegX9wPz8zoaz20nk6blXHaa93xNHQhTVmgfGYDMLt3xXXy1Obkpd+DoSByJfXz
+soIMoVWCKJKYXtyXCDL736ld
+-----END PRIVATE KEY-----