There are broadly speaking 2 types of keystore:
- file-based: requiring a file, password and configurable keystore type
- PKCS#11: no file, password and keystore type "PKCS#11".
However, it appears that some PKCS#11 providers use alternative keystore types (see OPENAM-14783), so we should allow the keystore type to be configurable.
In addition, HSMs that don't implement the PKCS#11 interface fall into one of the two categories above, except that they obviously use a custom keystore type identifier like "CloudHSM". Therefore, allowing the keystore type to be configurable for PKCS#11 key/trust managers will allow us to support some non-PKCS#11 HSMs. With that in mind, we may want to consider renaming the PKCS#11 providers to "HsmXxxManagerProvider" instead.
Suggested fix:
- add a new "key-store-type" configuration option to both the PKCS11 key and trust manager providers. The configuration options can be copied over from their file-based counterparts
- consider renaming PKCS#11 key/trust manager providers to HSM key/trust manager providers. This will require an upgrade task.
- is backported by
-
OPENDJ-7084 Backport OPENDJ-7073: PKCS#11 key and trust manager providers should allow custom keystore types
-
- QA Backlog
-
- relates to
-
OPENAM-14783 PKCS11 KeyStore does not work on IBM JVM
-
- Resolved
-