feat: honor JSSE trust store in CRT HTTP clients

[zoewangg]

Motivation and Context

The Apache, Netty, and URL connection HTTP clients trust the trust store configured by the standard javax.net.ssl.trustStore* system properties, because they use the JDK's TLS implementation. The AWS CRT HTTP clients use native TLS and always trust the OS trust store, so applications that rely on javax.net.ssl.trustStore for a custom CA can fail TLS handshakes after moving to the CRT clients.

awslabs/aws-crt-java#1017 adds TlsContextOptions.overrideDefaultTrustStoreFromJavaSystemProperties(), which loads the configured Java keystore and uses its certificates in place of the OS trust store. This change exposes it through an opt-in builder option.

Modifications

• New builder method useTrustStoreSystemProperties(Boolean) on AwsCrtHttpClient.Builder and AwsCrtAsyncHttpClient.Builder. Unset, null, or false keeps today's behavior (OS trust store).
• When true, the client calls the CRT method above while building its TlsContextOptions. The properties are read once, at build(). The same trust store is used for the TLS connection to an HTTPS proxy. When TRUST_ALL_CERTIFICATES is enabled, the trust store is not read.
• If javax.net.ssl.trustStore is unset or empty, the OS trust store is used.
• If the trust store cannot be used, build() throws IllegalStateException with the CRT exception as the cause, instead of falling back to another trust store. This covers a missing file, wrong password, corrupt file, unavailable type or provider, NONE, a store with no certificates or more than 1024 certificates, and a native TLS context failure.
• Bumps awscrt.version to 0.49.0, the first release with Add a way to init context from jks awslabs/aws-crt-java#1017.
• Test-only: BouncyCastle (bcpkix-jdk18on, bcprov-jdk18on) versions are now root-pom properties, used by aws-crt-client tests to generate certificates at test time and by the existing http-client-tests and protocol-tests declarations.

Testing

• New CrtTrustStoreSystemPropertiesTestSuite, run for both the sync and async clients (20 cases each). The tests perform real TLS handshakes against a local HTTPS server whose self-signed certificate is not in the OS trust store, and cover:
  • option on vs. off/unset;
  • trusted-certificate entries, key entries, and the trustStoreType property;
  • an unrelated store;
  • unset and empty property;
  • each build() failure mode;
  • trust-all;
  • property changes after build();
  • no event-loop group leaks when build() fails.
• Against aws-crt 0.49.0 from Maven Central:
  • aws-crt-client: BUILD SUCCESS, 376 tests, 0 failures, with the default macOS TLS backend.
  • The two trust store test classes also pass on the s2n backend, which is the Linux default (forced on macOS with AWS_CRT_USE_NON_FIPS_TLS_13=1): 40 tests, 0 failures.
  • crt-core (23 tests), s3 (1860 tests), and s3-transfer-manager (527 tests): all pass with 0 failures. Their Reactive Streams TCK suites have only the skips that are expected for optional rules.
• On s2n, a rejected certificate is reported only after s2n's 10-30s blinding delay. The handshake-failure tests therefore use a 2s connection acquisition timeout and accept either SSLHandshakeException or the acquisition-timeout error.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)

Checklist

• I have read the CONTRIBUTING document
• Local run of mvn install succeeds
• My code follows the code style of this project
• My change requires a change to the Javadoc documentation
• I have updated the Javadoc documentation accordingly
• I have added tests to cover my changes
• All new and existing tests passed
• I have added a changelog entry. Adding a new entry must be accomplished by running the scripts/new-change script and following the instructions. Commit the new file created by the script in .changes/next-release with your changes.
• My change is to implement 1.11 parity feature and I have updated LaunchChangelog

License

• I confirm that this pull request can be released under the Apache 2 license