Replaced openssl with Java security to add key/cert into keystore

[ppatierno]

This PR is going to replace the usage of OpenSSL tooling for adding a key/cert pair to the keystore with Java security framework.
While running tests I compared what we get by using openssl and what we get with Java.
I was able to tune the algorithm being used to encrypt the private key when it's stored, in order to have AES-128-CBC with 2048 iterations (which are the parameters with current openssl tooling vs the default Java which uses AES-256-CBC and 10000 iterations instead).

PKCS7 Data
Shrouded Keybag: PBES2, PBKDF2, AES-128-CBC, Iteration 2048, PRF hmacWithSHA256
Bag Attributes
    friendlyName: ca
    localKeyID: 54 69 6D 65 20 31 37 34 31 30 38 38 31 39 35 36 32 39 
Key Attributes: <No Attributes>

The only difference is about the HMAC used for the keystore integrity.
The openssl tool uses 2048 iterations and salt length 8 bytes.

MAC: sha256, Iteration 2048
MAC length: 32, salt length: 8

Java defaults to use 10000 iterations and salt length 10 bytes.

MAC: sha256, Iteration 10000
MAC length: 32, salt length: 20

I couldn't find any way to tune them both. Java doesn't expose anything to do so. It's only possible to tune the iterations but by setting a global Java properties like this:

System.setProperty("keystore.pkcs12.macIterationCount", "2048");

Tbh I am not keen to have such addition because it would be a global setting on the JVM.
So compared to openssl with have more secure HMAC which should not be a problem (the opposite I would say).

[ppatierno]

I am opening this PR to discuss it because we are not going to have exactly the same result as described.

[see-quick]

Just curious...Shouldn't this method be moved to the CertManager class instead of being in OpenSslCertManager as it does not use any OpenSSL invocation method?

[ppatierno]

That's a good point, however there are other methods not using openssl anymore already (i.e. addCertToTrustStore, deleteFromTrustStore, ...). At some point we could think about renaming it to not be strictly tight to OpenSsl.

[ppatierno]

/azp run regression

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).