fix: don't delegate client alias choosing for ssl bundles

core/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/ssl/JksSslBundleProperties.java

@@ -40,6 +40,11 @@ public class JksSslBundleProperties extends SslBundleProperties {
 	 */
 	private final Store truststore = new Store();
 
+	/**
+	 * Key properties.
+	 */
+	private final JksKey key = new JksKey();
+
 	public Store getKeystore() {
 		return this.keystore;
 	}
@@ -48,6 +53,11 @@ public Store getTruststore() {
 		return this.truststore;
 	}
 
+	@Override
+	public JksKey getKey() {
+		return this.key;
+	}
+
 	/**
 	 * Store properties.
 	 */
@@ -107,4 +117,53 @@ public void setPassword(@Nullable String password) {
 
 	}
 
+	public static class JksKey extends Key {
+		/**
+		 * The alias that identifies the server key in the key store.
+		 */
+		private @Nullable String serverAlias;
+
+		/**
+		 * The alias that identifies the client key in the key store.
+		 */
+		private @Nullable String clientAlias;
+
+		public @Nullable String getServerAlias() {
+			return this.serverAlias;
+		}
+
+		public void setServerAlias(@Nullable String serverAlias) {
+			this.serverAlias = serverAlias;
+		}
+
+		public @Nullable String getClientAlias() {
+			return this.clientAlias;
+		}
+
+		public void setClientAlias(@Nullable String clientAlias) {
+			this.clientAlias = clientAlias;
+		}
+
+		/**
+		 * Alias that identifies the key in the key store. Deprecated in favor of {@link #getServerAlias()}
+		 * @return the server key alias
+		 * @deprecated since 4.1.0 for removal in 4.3.0 in favor of {@link #getServerAlias()}
+		 */
+		@Override
+		@Deprecated(since = "4.1.0", forRemoval = true)
+		public @Nullable String getAlias() {
+			return super.getAlias();
+		}
+
+		/**
+		 * Alias that identifies the key in the key store. Deprecated in favor of {@link #setServerAlias(String)}
+		 * @param alias the server key alias to set
+		 * @deprecated since 4.1.0 for removal in 4.3.0 in favor of {@link #setServerAlias(String)}
+		 */
+		@Override
+		@Deprecated(since = "4.1.0", forRemoval = true)
+		public void setAlias(@Nullable String alias) {
+			super.setAlias(alias);
+		}
+	}
 }

core/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/ssl/PropertiesSslBundle.java

@@ -22,6 +22,7 @@
 
 import org.jspecify.annotations.Nullable;
 
+import org.springframework.boot.autoconfigure.ssl.JksSslBundleProperties.JksKey;
 import org.springframework.boot.autoconfigure.ssl.SslBundleProperties.Key;
 import org.springframework.boot.io.ApplicationResourceLoader;
 import org.springframework.boot.ssl.SslBundle;
@@ -67,7 +68,15 @@ private PropertiesSslBundle(SslStoreBundle stores, SslBundleProperties propertie
 	}
 
 	private static SslBundleKey asSslKeyReference(@Nullable Key key) {
-		return (key != null) ? SslBundleKey.of(key.getPassword(), key.getAlias()) : SslBundleKey.NONE;
+		if (key == null) {
+			return SslBundleKey.NONE;
+		}
+
+		if (key instanceof JksKey jksKey) {
+			return SslBundleKey.of(jksKey.getPassword(), jksKey.getServerAlias(), jksKey.getClientAlias());
+		}
+
+		return SslBundleKey.of(key.getPassword(), key.getAlias());
 	}
 
 	private static SslOptions asSslOptions(SslBundleProperties.@Nullable Options options) {

core/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/ssl/PropertiesSslBundleTests.java

@@ -86,7 +86,8 @@ void pemPropertiesAreMappedToSslBundle() throws Exception {
 	@Test
 	void jksPropertiesAreMappedToSslBundle() {
 		JksSslBundleProperties properties = new JksSslBundleProperties();
-		properties.getKey().setAlias("alias");
+		properties.getKey().setServerAlias("server-alias");
+		properties.getKey().setClientAlias("client-alias");
 		properties.getKey().setPassword("secret");
 		properties.getOptions().setCiphers(Set.of("cipher1", "cipher2", "cipher3"));
 		properties.getOptions().setEnabledProtocols(Set.of("protocol1", "protocol2"));
@@ -99,7 +100,9 @@ void jksPropertiesAreMappedToSslBundle() {
 		properties.getTruststore().setType("PKCS12");
 		properties.getTruststore().setLocation("classpath:org/springframework/boot/autoconfigure/ssl/keystore.pkcs12");
 		SslBundle sslBundle = PropertiesSslBundle.get(properties);
-		assertThat(sslBundle.getKey().getAlias()).isEqualTo("alias");
+		assertThat(sslBundle.getKey().getAlias()).isEqualTo("server-alias");
+		assertThat(sslBundle.getKey().getServerAlias()).isEqualTo("server-alias");
+		assertThat(sslBundle.getKey().getClientAlias()).isEqualTo("client-alias");
 		assertThat(sslBundle.getKey().getPassword()).isEqualTo("secret");
 		assertThat(sslBundle.getOptions().getCiphers()).containsExactlyInAnyOrder("cipher1", "cipher2", "cipher3");
 		assertThat(sslBundle.getOptions().getEnabledProtocols()).containsExactlyInAnyOrder("protocol1", "protocol2");

core/spring-boot/src/main/java/org/springframework/boot/ssl/AliasKeyManagerFactory.java

@@ -34,6 +34,8 @@
 import javax.net.ssl.SSLEngine;
 import javax.net.ssl.X509ExtendedKeyManager;
 
+import org.jspecify.annotations.Nullable;
+
 /**
  * {@link KeyManagerFactory} that allows a configurable key alias to be used. Due to the
  * fact that the actual calls to retrieve the key by alias are done at request time the
@@ -45,8 +47,8 @@
  */
 final class AliasKeyManagerFactory extends KeyManagerFactory {
 
-	AliasKeyManagerFactory(KeyManagerFactory delegate, String alias, String algorithm) {
-		super(new AliasKeyManagerFactorySpi(delegate, alias), delegate.getProvider(), algorithm);
+	AliasKeyManagerFactory(KeyManagerFactory delegate, @Nullable String serverAlias, @Nullable String clientAlias, String algorithm) {
+		super(new AliasKeyManagerFactorySpi(delegate, serverAlias, clientAlias), delegate.getProvider(), algorithm);
 	}
 
 	/**
@@ -56,11 +58,14 @@ private static final class AliasKeyManagerFactorySpi extends KeyManagerFactorySp
 
 		private final KeyManagerFactory delegate;
 
-		private final String alias;
+		private final @Nullable String serverAlias;
+
+		private final @Nullable String clientAlias;
 
-		private AliasKeyManagerFactorySpi(KeyManagerFactory delegate, String alias) {
+		private AliasKeyManagerFactorySpi(KeyManagerFactory delegate, @Nullable String serverAlias, @Nullable String clientAlias) {
 			this.delegate = delegate;
-			this.alias = alias;
+			this.serverAlias = serverAlias;
+			this.clientAlias = clientAlias;
 		}
 
 		@Override
@@ -85,7 +90,7 @@ protected KeyManager[] engineGetKeyManagers() {
 		}
 
 		private AliasKeyManagerFactory.AliasX509ExtendedKeyManager wrap(X509ExtendedKeyManager keyManager) {
-			return new AliasX509ExtendedKeyManager(keyManager, this.alias);
+			return new AliasX509ExtendedKeyManager(keyManager, this.serverAlias, this.clientAlias);
 		}
 
 	}
@@ -97,30 +102,49 @@ static final class AliasX509ExtendedKeyManager extends X509ExtendedKeyManager {
 
 		private final X509ExtendedKeyManager delegate;
 
-		private final String alias;
+		private final @Nullable String serverAlias;
 
-		private AliasX509ExtendedKeyManager(X509ExtendedKeyManager keyManager, String alias) {
+		private final @Nullable String clientAlias;
+
+		private AliasX509ExtendedKeyManager(X509ExtendedKeyManager keyManager, @Nullable String serverAlias, @Nullable String clientAlias) {
 			this.delegate = keyManager;
-			this.alias = alias;
+			this.serverAlias = serverAlias;
+			this.clientAlias = clientAlias;
 		}
 
 		@Override
 		public String chooseEngineClientAlias(String[] strings, Principal[] principals, SSLEngine sslEngine) {
+			if (this.clientAlias != null) {
+				return this.clientAlias;
+			}
+
 			return this.delegate.chooseEngineClientAlias(strings, principals, sslEngine);
 		}
 
 		@Override
 		public String chooseEngineServerAlias(String s, Principal[] principals, SSLEngine sslEngine) {
-			return this.alias;
+			if (this.serverAlias != null) {
+				return this.serverAlias;
+			}
+
+			return this.delegate.chooseEngineServerAlias(s, principals, sslEngine);
 		}
 
 		@Override
 		public String chooseClientAlias(String[] keyType, Principal[] issuers, Socket socket) {
+			if (this.clientAlias != null) {
+				return this.clientAlias;
+			}
+
 			return this.delegate.chooseClientAlias(keyType, issuers, socket);
 		}
 
 		@Override
 		public String chooseServerAlias(String keyType, Principal[] issuers, Socket socket) {
+			if (this.serverAlias != null) {
+				return this.serverAlias;
+			}
+
 			return this.delegate.chooseServerAlias(keyType, issuers, socket);
 		}
 

core/spring-boot/src/main/java/org/springframework/boot/ssl/DefaultSslManagerBundle.java

@@ -45,13 +45,21 @@ class DefaultSslManagerBundle implements SslManagerBundle {
 	public KeyManagerFactory getKeyManagerFactory() {
 		try {
 			KeyStore store = this.storeBundle.getKeyStore();
-			this.key.assertContainsAlias(store);
-			String alias = this.key.getAlias();
+			String serverAlias = this.key.getServerAlias();
+			String clientAlias = this.key.getClientAlias();
+
+			this.key.assertContainsAliases(store);
+
 			String algorithm = KeyManagerFactory.getDefaultAlgorithm();
+
 			KeyManagerFactory factory = getKeyManagerFactoryInstance(algorithm);
-			factory = (alias != null) ? new AliasKeyManagerFactory(factory, alias, algorithm) : factory;
+			factory = (serverAlias != null || clientAlias != null) ?
+					new AliasKeyManagerFactory(factory, serverAlias, clientAlias, algorithm) :
+					factory;
+
 			String password = this.key.getPassword();
 			password = (password != null) ? password : this.storeBundle.getKeyStorePassword();
+
 			factory.init(store, (password != null) ? password.toCharArray() : null);
 			return factory;
 		}

core/spring-boot/src/main/java/org/springframework/boot/ssl/SslBundleKey.java

@@ -51,13 +51,34 @@ public interface SslBundleKey {
 	 */
 	@Nullable String getAlias();
 
+	/**
+	 * Return the alias of the server key or {@code null} if the server key has no alias.
+	 * @return the server key alias
+	 * @since 4.1.0
+	 */
+	default @Nullable String getServerAlias() {
+		return this.getAlias();
+	}
+
+	/**
+	 * Return the alias of the client key or {@code null} if the client key has no alias.
+	 * @return the client key alias
+	 * @since 4.1.0
+	 */
+	default @Nullable String getClientAlias() {
+		return null;
+	}
+
 	/**
 	 * Assert that the alias is contained in the given keystore.
 	 * @param keyStore the keystore to check
+	 * @deprecated since 4.1.0 for removal in 4.3.0 in favor of {@link #assertContainsAliases(KeyStore)}
 	 */
+	@Deprecated(since = "4.1.0", forRemoval = true)
 	default void assertContainsAlias(@Nullable KeyStore keyStore) {
 		String alias = getAlias();
-		if (StringUtils.hasLength(alias) && keyStore != null) {
+
+		if (keyStore != null && StringUtils.hasLength(alias)) {
 			try {
 				Assert.state(keyStore.containsAlias(alias),
 						() -> String.format("Keystore does not contain alias '%s'", alias));
@@ -69,6 +90,37 @@ default void assertContainsAlias(@Nullable KeyStore keyStore) {
 		}
 	}
 
+	default void assertContainsAliases(@Nullable KeyStore keyStore) {
+		String serverAlias = getServerAlias();
+		String clientAlias = getClientAlias();
+
+		if (keyStore == null) {
+			return;
+		}
+
+		try {
+			if (StringUtils.hasLength(serverAlias)) {
+				Assert.state(keyStore.containsAlias(serverAlias),
+						() -> String.format("Keystore does not contain server alias '%s'", serverAlias));
+			}
+		}
+		catch (KeyStoreException ex) {
+			throw new IllegalStateException(
+					String.format("Could not determine if keystore contains server alias '%s'", serverAlias), ex);
+		}
+
+		try {
+			if (StringUtils.hasLength(clientAlias)) {
+				Assert.state(keyStore.containsAlias(clientAlias),
+						() -> String.format("Keystore does not contain client alias '%s'", clientAlias));
+			}
+		}
+		catch (KeyStoreException ex) {
+			throw new IllegalStateException(
+					String.format("Could not determine if keystore contains client alias '%s'", clientAlias), ex);
+		}
+	}
+
 	/**
 	 * Factory method to create a new {@link SslBundleKey} instance.
 	 * @param password the password used to access the key
@@ -108,4 +160,46 @@ public String toString() {
 		};
 	}
 
+	/**
+	 * Factory method to create a new {@link SslBundleKey} instance.
+	 * @param password the password used to access the key
+	 * @param serverAlias the alias of the server key
+	 * @param clientAlias the alias of the client key
+	 * @return a new {@link SslBundleKey} instance
+	 * @since 4.1.0
+	 */
+	static SslBundleKey of(@Nullable String password, @Nullable String serverAlias, @Nullable String clientAlias) {
+		return new SslBundleKey() {
+
+			@Override
+			public @Nullable String getPassword() {
+				return password;
+			}
+
+			@Override
+			public @Nullable String getAlias() {
+				return serverAlias;
+			}
+
+			@Override
+			public @Nullable String getServerAlias() {
+				return serverAlias;
+			}
+
+			@Override
+			public @Nullable String getClientAlias() {
+				return clientAlias;
+			}
+
+			@Override
+			public String toString() {
+				ToStringCreator creator = new ToStringCreator(this);
+				creator.append("serverAlias", serverAlias);
+				creator.append("clientAlias", clientAlias);
+				creator.append("password", (password != null) ? "******" : null);
+				return creator.toString();
+			}
+
+		};
+	}
 }