KAFKA-20440: PEM certificate support should not depend on PKCS12

[daguimu]

Problem

DefaultSslEngineFactory.PemStore hardcodes "PKCS12" when creating the in-memory KeyStore that backs PEM-formatted key and trust material:

• clients/src/main/java/org/apache/kafka/common/security/ssl/DefaultSslEngineFactory.java:463 (createKeyStoreFromPem)
• clients/src/main/java/org/apache/kafka/common/security/ssl/DefaultSslEngineFactory.java:476 (createTrustStoreFromPem)

In JVMs where the PKCS12 keystore type is disabled (for example Chainguard FIPS container images that use BouncyCastle and disable PKCS12), this prevents PEM-format certificates from being used at all even though the in-memory keystore itself does not depend on PKCS12 specifically.

Root Cause

KeyStore.getInstance("PKCS12") is a hard-coded literal. There is no reason to pin the in-memory store type — the rest of the code only relies on the KeyStore API and works with any default keystore type the JVM provides.

Fix

Replace the two hard-coded "PKCS12" literals with KeyStore.getDefaultType(). On a default JVM the security property keystore.type is pkcs12 (since JDK 9), so existing users see no behavioural change. On a JVM where the operator has selected a different default type, PEM material now uses that type instead of failing.

Tests Added

Change point	Test
createKeyStoreFromPem no longer hard-codes PKCS12	testPemKeyStoreUsesDefaultKeyStoreType() — asserts the keystore returned by factory.keystore() reports KeyStore.getDefaultType() as its type
createTrustStoreFromPem no longer hard-codes PKCS12	testPemTrustStoreUsesDefaultKeyStoreType() — asserts the truststore returned by factory.truststore() reports KeyStore.getDefaultType() as its type
Existing PEM key/trust store behaviour preserved	Existing testPemTrustStoreConfig*, testPemKeyStoreConfig*, testPemKeyStoreFile* tests continue to load aliases, certificates and private keys

Impact

• PEM certificate users on default JVMs: no behavioural change (default type is still PKCS12).
• PEM certificate users on JVMs that disable PKCS12 (e.g. FIPS containers): PEM now works using the configured default keystore type.
• Other keystore types (SslConfigs.SSL_KEYSTORE_TYPE_CONFIG ≠ PEM): unaffected — this code path only handles PEM_TYPE.

[github-actions]

A label of 'needs-attention' was automatically added to this PR in order to raise the
attention of the committers. Once this issue has been triaged, the triage label
should be removed to prevent this automation from happening again.