Refresh filesystem certificates when loading the Key Vault JCA keystore (#50872)

Co-authored-by: Rohit Singhal <singhalrohit@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: 3 people

sdk/keyvault/azure-security-keyvault-jca/CHANGELOG.md

@@ -8,6 +8,8 @@
 
 ### Bugs Fixed
 
+- Reload filesystem certificates from the configured custom and well-known directories when a keystore is constructed or loaded, without sharing mutable filesystem certificate state between keystores.
+
 ### Other Changes
 
 ## 2.13.0 (2026-10-13)

sdk/keyvault/azure-security-keyvault-jca/README.md

@@ -556,11 +556,20 @@ You can load the certificate in the file system as a trusted certificate by conf
 
 | Certificate Type       | Description                                 | Usage                                                                                     |
 |------------------------|---------------------------------------------|-------------------------------------------------------------------------------------------|
-| Well-Known Certificate | The file path to the well-known certificate | `System.setProperty("azure.cert-path.well-known", "<well-known-certificate-file-path>")]` |
-| Custom Certificate     | The file path to the custom certificate     | `System.setProperty("azure.cert-path.custom", "<custom-certificate-file-path>")`          |
+| Well-Known Certificate | The directory containing well-known certificates | `System.setProperty("azure.cert-path.well-known", "<well-known-certificate-directory>")` |
+| Custom Certificate     | The directory containing custom certificates     | `System.setProperty("azure.cert-path.custom", "<custom-certificate-directory>")`         |
 
 Note: These properties support certificate files only (e.g., `.cer`, `.pem`, `.der`, `.crt`). Private keys are not supported.
 
+Each keystore loads its own snapshot of these directories when it is constructed and whenever either `KeyStore.load(...)`
+overload is called. Added, replaced, and removed certificate files are reflected after the next load. Calling
+`load(null, null)` or `load((KeyStore.LoadStoreParameter) null)` retains the keystore's configured paths, including paths
+previously supplied through `KeyVaultLoadStoreParameter`; it does not reread system properties.
+
+After changing certificate files, reload the keystore and rebuild the trust managers and `SSLContext` that use it.
+Existing trust managers, TLS connections, and TLS sessions are not automatically refreshed. Directory changes are not
+watched, and the Key Vault certificate refresh interval does not reload these filesystem sources.
+
 ### Key-Less certificates
 You can set the private key as [non-exportable] to ensure the security of the key.
 
@@ -915,4 +924,3 @@ This project has adopted the [Microsoft Open Source Code of Conduct][microsoft_c
 [jca_reference_guide]: https://docs.oracle.com/javase/8/docs/technotes/guides/security/crypto/CryptoSpec.html
 [microsoft_code_of_conduct]: https://opensource.microsoft.com/codeofconduct/
 [non-exportable]: https://learn.microsoft.com/azure/key-vault/certificates/about-certificates#exportable-or-non-exportable-key
-

sdk/keyvault/azure-security-keyvault-jca/src/main/java/com/azure/security/keyvault/jca/KeyVaultKeyStore.java

@@ -24,9 +24,7 @@
 import java.util.Collections;
 import java.util.Date;
 import java.util.Enumeration;
-import java.util.HashMap;
 import java.util.List;
-import java.util.Map;
 import java.util.logging.Logger;
 
 import static java.util.logging.Level.FINE;
@@ -61,16 +59,6 @@ public final class KeyVaultKeyStore extends KeyStoreSpi {
      */
     private final JreCertificates jreCertificates;
 
-    /**
-     * Store well Know certificates loaded from specific path.
-     */
-    private SpecificPathCertificates wellKnowCertificates;
-
-    /**
-     * Store custom certificates loaded from specific path.
-     */
-    private SpecificPathCertificates customCertificates;
-
     /**
      * Store certificates loaded from KeyVault.
      */
@@ -84,7 +72,7 @@ public final class KeyVaultKeyStore extends KeyStoreSpi {
     /**
      * Stores all the certificates.
      */
-    private List<AzureCertificates> allCertificates;
+    private volatile List<AzureCertificates> allCertificates;
 
     /**
      * Stores the creation date.
@@ -142,12 +130,19 @@ private void updateKeyStoreConfiguration(KeyVaultLoadStoreParameter parameter) {
         certPathWellKnown = parameter.getCertPathWellKnown();
         certPathCustom = parameter.getCertPathCustom();
 
-        wellKnowCertificates = SpecificPathCertificates.getSpecificPathCertificates(certPathWellKnown);
+        loadCertificatesFromSpecificPaths();
+    }
+
+    private void loadCertificatesFromSpecificPaths() {
+        SpecificPathCertificates wellKnowCertificates
+            = SpecificPathCertificates.getSpecificPathCertificates(certPathWellKnown);
         LOGGER.log(FINE, String.format("Loaded well known certificates: %s.", wellKnowCertificates.getAliases()));
 
-        customCertificates = SpecificPathCertificates.getSpecificPathCertificates(certPathCustom);
+        SpecificPathCertificates customCertificates
+            = SpecificPathCertificates.getSpecificPathCertificates(certPathCustom);
         LOGGER.log(FINE, String.format("Loaded custom certificates: %s.", customCertificates.getAliases()));
 
+        // Publish both filesystem snapshots together without modifying sources retained by other keystores.
         allCertificates = Arrays.asList(jreCertificates, wellKnowCertificates, customCertificates, keyVaultCertificates,
             classpathCertificates);
     }
@@ -386,7 +381,9 @@ public boolean engineIsKeyEntry(String alias) {
 
     /**
      * Loads the keystore using the given {@code KeyStore.LoadStoreParameter}.
-        * A {@link KeyVaultLoadStoreParameter} replaces the complete configuration captured by the constructor.
+     * A {@link KeyVaultLoadStoreParameter} replaces the complete configuration captured by the constructor.
+     * Reloads certificates from the configured filesystem paths. Existing trust managers and SSL contexts
+     * must be rebuilt to use the updated certificates.
      *
      * @param param the {@code KeyStore.LoadStoreParameter}
      *          that specifies how to load the keystore,
@@ -399,38 +396,39 @@ public void engineLoad(KeyStore.LoadStoreParameter param) {
 
             keyVaultCertificates.updateKeyVaultClient(parameter);
             updateKeyStoreConfiguration(parameter);
+        } else {
+            loadCertificatesFromSpecificPaths();
         }
 
         classpathCertificates.loadCertificatesFromClasspath();
     }
 
     /**
      * Loads the keystore from the given input stream.
+     * Reloads certificates from the configured filesystem paths without changing the configuration.
+     * Existing trust managers and SSL contexts must be rebuilt to use the updated certificates.
      *
      * @param stream the input stream from which the keystore is loaded,or {@code null}
      * @param password the password
      */
     @Override
     public void engineLoad(InputStream stream, char[] password) {
+        loadCertificatesFromSpecificPaths();
         classpathCertificates.loadCertificatesFromClasspath();
     }
 
     private List<String> getAllAliases() {
-        List<String> allAliases = new ArrayList<>(jreCertificates.getAliases());
-        Map<String, List<String>> aliasLists = new HashMap<>();
-
-        aliasLists.put("well known certificates", wellKnowCertificates.getAliases());
-        aliasLists.put("custom certificates", customCertificates.getAliases());
-        aliasLists.put("key vault certificates", keyVaultCertificates.getAliases());
-        aliasLists.put("class path certificates", classpathCertificates.getAliases());
-
-        aliasLists.forEach((certificatesType, certificates) -> certificates.forEach(alias -> {
-            if (allAliases.contains(alias)) {
-                LOGGER.log(FINE, String.format("The certificate %s under %s already exists", alias, certificatesType));
-            } else {
-                allAliases.add(alias);
+        List<String> allAliases = new ArrayList<>();
+        for (AzureCertificates certificatesSource : allCertificates) {
+            for (String alias : certificatesSource.getAliases()) {
+                if (allAliases.contains(alias)) {
+                    LOGGER.log(FINE, "The certificate {0} under {1} already exists",
+                        new Object[] { alias, certificatesSource.getClass().getSimpleName() });
+                } else {
+                    allAliases.add(alias);
+                }
             }
-        }));
+        }
 
         return allAliases;
     }

sdk/keyvault/azure-security-keyvault-jca/src/main/java/com/azure/security/keyvault/jca/implementation/certificates/SpecificPathCertificates.java

@@ -31,8 +31,6 @@
  */
 public final class SpecificPathCertificates implements AzureCertificates {
 
-    private static final Map<String, SpecificPathCertificates> CACHE = new HashMap<>();
-
     /**
      * Stores the logger.
      */
@@ -211,17 +209,12 @@ private List<File> getFiles() {
     }
 
     /**
-     * Get File System certificates by path
+     * Load a new snapshot of file system certificates from the given path.
      *
-     * @param path certificate path, which works only in first time
-     * @return file certificate
+     * @param path certificate directory path
+     * @return independently loaded file system certificates
      */
-    public static synchronized SpecificPathCertificates getSpecificPathCertificates(String path) {
-        SpecificPathCertificates result = CACHE.getOrDefault(path, null);
-        if (result == null) {
-            result = new SpecificPathCertificates(path);
-            CACHE.put(path, result);
-        }
-        return result;
+    public static SpecificPathCertificates getSpecificPathCertificates(String path) {
+        return new SpecificPathCertificates(path);
     }
 }