feat: Support EC private keys in PemSslContext

Author: thced

docs/superpowers/plans/2026-05-21-https-support.md

@@ -323,7 +323,7 @@ SKIP=commitlint git commit -m "feat: Add PemSslContext for loading PEM cert + RS
 - Modify: `src/main/java/com/retailsvc/http/internal/PemSslContext.java`
 - Modify: `src/test/java/com/retailsvc/http/internal/PemSslContextTest.java`
 
-- [ ] **Step 1: Add the failing EC test**
+- [x] **Step 1: Add the failing EC test**
 
 Append to `PemSslContextTest`:
 
@@ -340,15 +340,15 @@ Append to `PemSslContextTest`:
   }
 ```
 
-- [ ] **Step 2: Run, confirm it fails**
+- [x] **Step 2: Run, confirm it fails**
 
 ```bash
 mvn test -Dtest=PemSslContextTest#loadsEcPemPair
 ```
 
 Expected: FAIL — `InvalidKeySpecException` wrapped in `IllegalStateException` from RSA `KeyFactory` rejecting EC bytes.
 
-- [ ] **Step 3: Extend `readPrivateKey` with EC fallback**
+- [x] **Step 3: Extend `readPrivateKey` with EC fallback**
 
 In `PemSslContext.java`, replace the entire `readPrivateKey` method with:
 
@@ -388,15 +388,15 @@ In `PemSslContext.java`, replace the entire `readPrivateKey` method with:
   }
 ```
 
-- [ ] **Step 4: Run both happy-path tests**
+- [x] **Step 4: Run both happy-path tests**
 
 ```bash
 mvn test -Dtest=PemSslContextTest
 ```
 
 Expected: 2 tests pass.
 
-- [ ] **Step 5: Commit**
+- [x] **Step 5: Commit**
 
 ```bash
 git add src/main/java/com/retailsvc/http/internal/PemSslContext.java \

src/main/java/com/retailsvc/http/internal/PemSslContext.java

@@ -66,7 +66,13 @@ private static PrivateKey readPrivateKey(Path path) {
     try {
       return KeyFactory.getInstance("RSA").generatePrivate(spec);
     } catch (InvalidKeySpecException rsaFail) {
-      throw new IllegalStateException("Failed to parse TLS private key from " + path, rsaFail);
+      try {
+        return KeyFactory.getInstance("EC").generatePrivate(spec);
+      } catch (InvalidKeySpecException ecFail) {
+        throw new IllegalStateException("Unsupported TLS private key algorithm in " + path, ecFail);
+      } catch (GeneralSecurityException e) {
+        throw new IllegalStateException("Failed to parse TLS private key from " + path, e);
+      }
     } catch (GeneralSecurityException e) {
       throw new IllegalStateException("Failed to parse TLS private key from " + path, e);
     }

src/test/java/com/retailsvc/http/internal/PemSslContextTest.java

@@ -10,6 +10,8 @@ class PemSslContextTest {
 
   private static final Path RSA_CERT = Path.of("src/test/resources/tls/rsa-cert.pem");
   private static final Path RSA_KEY = Path.of("src/test/resources/tls/rsa-key.pem");
+  private static final Path EC_CERT = Path.of("src/test/resources/tls/ec-cert.pem");
+  private static final Path EC_KEY = Path.of("src/test/resources/tls/ec-key.pem");
 
   @Test
   void loadsRsaPemPair() throws Exception {
@@ -19,4 +21,12 @@ void loadsRsaPemPair() throws Exception {
     assertThat(context.getProtocol()).isEqualTo("TLS");
     assertThat(context.getServerSocketFactory()).isNotNull();
   }
+
+  @Test
+  void loadsEcPemPair() throws Exception {
+    SSLContext context = PemSslContext.load(EC_CERT, EC_KEY);
+
+    assertThat(context).isNotNull();
+    assertThat(context.getServerSocketFactory()).isNotNull();
+  }
 }