fix(auth): present the full certificate chain for mTLS

google-auth-library-java/oauth2_http/java/com/google/auth/mtls/MtlsKeyStoreUtils.java

@@ -0,0 +1,151 @@
+/*
+ * Copyright 2026 Google LLC
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google LLC nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+package com.google.auth.mtls;
+
+import com.google.api.client.util.PemReader;
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+import java.nio.charset.StandardCharsets;
+import java.security.GeneralSecurityException;
+import java.security.KeyFactory;
+import java.security.KeyStore;
+import java.security.PrivateKey;
+import java.security.cert.CertificateException;
+import java.security.cert.CertificateFactory;
+import java.security.cert.X509Certificate;
+import java.security.spec.PKCS8EncodedKeySpec;
+import java.util.ArrayList;
+import java.util.List;
+import org.jspecify.annotations.NullMarked;
+import org.jspecify.annotations.Nullable;
+
+/**
+ * Builds the mTLS {@link KeyStore} from PEM-encoded certificates and a private key.
+ *
+ * <p>This replaces {@code com.google.api.client.util.SecurityUtils#createMtlsKeyStore}, which keeps
+ * only the first certificate. Here the key entry holds every certificate in the input, so the
+ * intermediate certificates are presented too. Some peers (for example, another workload that
+ * trusts only a root CA) need them to verify the client certificate.
+ *
+ * <p>Everything else matches the upstream method: key store type (JKS), alias, empty password,
+ * accepted key format (PKCS#8 {@code PRIVATE KEY}), which private key is chosen, and error
+ * messages. Any input that the upstream method accepted is still accepted, even though more of it
+ * is now used: once a certificate and a private key have been found (the point where the upstream
+ * method stopped reading), a malformed or unreadable later section ends the input instead of
+ * failing, and an extra certificate that cannot be parsed is left out of the chain. Unlike the
+ * upstream method, the input is decoded as UTF-8 rather than the platform default charset, and it
+ * is read to the end.
+ */
+@NullMarked
+final class MtlsKeyStoreUtils {
+
+  private MtlsKeyStoreUtils() {}
+
+  /**
+   * Creates a key store holding one private key entry.
+   *
+   * @param certAndKey PEM input containing one or more {@code CERTIFICATE} sections and a PKCS#8
+   *     {@code PRIVATE KEY} section, in any order. The first certificate must be the one that
+   *     matches the private key (the leaf); the remaining certificates are kept in input order as
+   *     the rest of the chain. If there are several private keys, the one used is the same as
+   *     upstream: the last one before the first certificate, or else the first one after it. The
+   *     stream is read to the end and is not closed.
+   * @throws IllegalArgumentException if the input has no certificate or no private key, or if a PEM
+   *     section before that point is malformed
+   * @throws GeneralSecurityException if the first certificate or the private key cannot be parsed,
+   *     or the key store cannot be created
+   * @throws IOException if the input cannot be read before a certificate and a private key are
+   *     found
+   */
+  static KeyStore createMtlsKeyStore(InputStream certAndKey)
+      throws GeneralSecurityException, IOException {
+    List<byte[]> certificates = new ArrayList<>();
+    byte @Nullable [] privateKey = null;
+    PemReader reader = new PemReader(new InputStreamReader(certAndKey, StandardCharsets.UTF_8));
+    while (true) {
+      PemReader.Section section;
+      try {
+        section = reader.readNextSection();
+      } catch (IllegalArgumentException | IOException e) {
+        if (!certificates.isEmpty() && privateKey != null) {
+          // Malformed or unreadable trailing content after a usable certificate and key: stop
+          // here, as the upstream method (which stopped reading at this point) would have.
+          break;
+        }
+        throw e;
+      }
+      if (section == null) {
+        break;
+      }
+      if ("CERTIFICATE".equals(section.getTitle())) {
+        certificates.add(section.getBase64DecodedBytes());
+      } else if ("PRIVATE KEY".equals(section.getTitle())
+          && (privateKey == null || certificates.isEmpty())) {
+        // Same choice as upstream: a later key replaces an earlier one until the first certificate
+        // has been seen.
+        privateKey = section.getBase64DecodedBytes();
+      }
+    }
+    if (certificates.isEmpty()) {
+      throw new IllegalArgumentException("certificate is missing from certAndKey string");
+    }
+    if (privateKey == null) {
+      throw new IllegalArgumentException("private key is missing from certAndKey string");
+    }
+
+    CertificateFactory certFactory = CertificateFactory.getInstance("X.509");
+    List<X509Certificate> chain = new ArrayList<>(certificates.size());
+    chain.add(parseCertificate(certFactory, certificates.get(0)));
+    for (int i = 1; i < certificates.size(); i++) {
+      try {
+        chain.add(parseCertificate(certFactory, certificates.get(i)));
+      } catch (CertificateException | RuntimeException e) {
+        // The upstream method never parsed extra certificates; leave this one out rather than
+        // fail.
+      }
+    }
+    PrivateKey key =
+        KeyFactory.getInstance(chain.get(0).getPublicKey().getAlgorithm())
+            .generatePrivate(new PKCS8EncodedKeySpec(privateKey));
+
+    KeyStore keyStore = KeyStore.getInstance("JKS");
+    keyStore.load(null);
+    keyStore.setKeyEntry("alias", key, new char[] {}, chain.toArray(new X509Certificate[0]));
+    return keyStore;
+  }
+
+  private static X509Certificate parseCertificate(CertificateFactory certFactory, byte[] der)
+      throws CertificateException {
+    return (X509Certificate) certFactory.generateCertificate(new ByteArrayInputStream(der));
+  }
+}

google-auth-library-java/oauth2_http/java/com/google/auth/mtls/SecureConnectProvider.java

@@ -32,7 +32,6 @@
 
 import com.google.api.client.json.JsonParser;
 import com.google.api.client.json.gson.GsonFactory;
-import com.google.api.client.util.SecurityUtils;
 import com.google.api.core.InternalApi;
 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.collect.ImmutableList;
@@ -148,7 +147,7 @@ static KeyStore getKeyStore(InputStream metadata, ProcessProvider processProvide
     }
 
     // Create mTLS key store with the input certificates from shell command.
-    return SecurityUtils.createMtlsKeyStore(process.getInputStream());
+    return MtlsKeyStoreUtils.createMtlsKeyStore(process.getInputStream());
   }
 
   @VisibleForTesting

google-auth-library-java/oauth2_http/java/com/google/auth/mtls/X509Provider.java

@@ -30,7 +30,6 @@
 
 package com.google.auth.mtls;
 
-import com.google.api.client.util.SecurityUtils;
 import com.google.api.core.InternalApi;
 import com.google.auth.oauth2.EnvironmentProvider;
 import com.google.auth.oauth2.PropertyProvider;
@@ -143,7 +142,8 @@ public X509Provider() {
    *       which contains both the certificate chain and the private key.
    * </ul>
    *
-   * @return a KeyStore containing the X.509 certificate specified by the certificate configuration.
+   * @return a KeyStore containing the X.509 certificate chain and private key from the certificate
+   *     source above.
    * @throws CertificateSourceUnavailableException if the certificate source is unavailable (ex.
    *     missing configuration file)
    * @throws IOException if a general I/O error occurs while creating the KeyStore
@@ -169,7 +169,7 @@ public KeyStore getKeyStore() throws CertificateSourceUnavailableException, IOEx
             MtlsUtils.getGkeCredentialBundlePath(envProvider, propProvider);
         if (gkeCredentialBundlePath != null) {
           try (InputStream bundleStream = new FileInputStream(new File(gkeCredentialBundlePath))) {
-            return SecurityUtils.createMtlsKeyStore(bundleStream);
+            return MtlsKeyStoreUtils.createMtlsKeyStore(bundleStream);
           } catch (FileNotFoundException e) {
             // The bundle was removed (e.g. mid-rotation) after the availability check.
             throw new CertificateSourceUnavailableException(
@@ -201,7 +201,7 @@ public KeyStore getKeyStore() throws CertificateSourceUnavailableException, IOEx
             new SequenceInputStream(certStream, privateKeyStream)) {
 
       // Build a key store using the combined stream.
-      return SecurityUtils.createMtlsKeyStore(certAndPrivateKeyStream);
+      return MtlsKeyStoreUtils.createMtlsKeyStore(certAndPrivateKeyStream);
     } catch (CertificateSourceUnavailableException e) {
       // Throw the CertificateSourceUnavailableException without wrapping.
       throw e;