test: Cover PemSslContext error paths

Author: thced

docs/superpowers/plans/2026-05-21-https-support.md

@@ -414,7 +414,7 @@ SKIP=commitlint git commit -m "feat: Support EC private keys in PemSslContext"
 
 The error messages are already produced by Task 2/3's implementation. This task just asserts them.
 
-- [ ] **Step 1: Add the failing missing-file test**
+- [x] **Step 1: Add the failing missing-file test**
 
 Append to `PemSslContextTest`:
 
@@ -467,7 +467,7 @@ Add the import at the top of the file:
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
 ```
 
-- [ ] **Step 2: Run, confirm all five pass**
+- [x] **Step 2: Run, confirm all five pass**
 
 ```bash
 mvn test -Dtest=PemSslContextTest
@@ -477,7 +477,7 @@ Expected: 7 tests pass (2 happy + 5 negative).
 
 If the mismatched-key test fails because the key parsed cleanly but the cert→key binding wasn't detected, that's a real bug in `buildSslContext` — `KeyManagerFactory.init` is what surfaces the mismatch, and it does. Verify by reading the actual message: it should contain "do not match" via the chained cause. If `KeyManagerFactory` accepts the pair, the test will fail; do NOT relax the assertion — debug instead.
 
-- [ ] **Step 3: Commit**
+- [x] **Step 3: Commit**
 
 ```bash
 git add src/test/java/com/retailsvc/http/internal/PemSslContextTest.java

src/main/java/com/retailsvc/http/internal/PemSslContext.java

@@ -8,6 +8,7 @@
 import java.security.KeyFactory;
 import java.security.KeyStore;
 import java.security.PrivateKey;
+import java.security.Signature;
 import java.security.cert.Certificate;
 import java.security.cert.CertificateFactory;
 import java.security.spec.InvalidKeySpecException;
@@ -79,6 +80,7 @@ private static PrivateKey readPrivateKey(Path path) {
   }
 
   private static SSLContext buildSslContext(Certificate[] chain, PrivateKey key) {
+    verifyKeyMatchesCert(key, chain[0]);
     try {
       KeyStore ks = KeyStore.getInstance("PKCS12");
       ks.load(null, null);
@@ -92,4 +94,35 @@ private static SSLContext buildSslContext(Certificate[] chain, PrivateKey key) {
       throw new IllegalStateException("TLS certificate and private key do not match", e);
     }
   }
+
+  private static void verifyKeyMatchesCert(PrivateKey key, Certificate cert) {
+    String algorithm =
+        switch (key.getAlgorithm()) {
+          case "RSA" -> "SHA256withRSA";
+          case "EC" -> "SHA256withECDSA";
+          default ->
+              throw new IllegalStateException(
+                  "Unsupported TLS private key algorithm: " + key.getAlgorithm());
+        };
+    byte[] probe = {1, 2, 3, 4, 5, 6, 7, 8};
+    byte[] signature;
+    try {
+      Signature signer = Signature.getInstance(algorithm);
+      signer.initSign(key);
+      signer.update(probe);
+      signature = signer.sign();
+    } catch (GeneralSecurityException e) {
+      throw new IllegalStateException("TLS certificate and private key do not match", e);
+    }
+    try {
+      Signature verifier = Signature.getInstance(algorithm);
+      verifier.initVerify(cert.getPublicKey());
+      verifier.update(probe);
+      if (!verifier.verify(signature)) {
+        throw new IllegalStateException("TLS certificate and private key do not match");
+      }
+    } catch (GeneralSecurityException e) {
+      throw new IllegalStateException("TLS certificate and private key do not match", e);
+    }
+  }
 }

src/test/java/com/retailsvc/http/internal/PemSslContextTest.java

@@ -1,6 +1,7 @@
 package com.retailsvc.http.internal;
 
 import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
 
 import java.nio.file.Path;
 import javax.net.ssl.SSLContext;
@@ -12,6 +13,9 @@ class PemSslContextTest {
   private static final Path RSA_KEY = Path.of("src/test/resources/tls/rsa-key.pem");
   private static final Path EC_CERT = Path.of("src/test/resources/tls/ec-cert.pem");
   private static final Path EC_KEY = Path.of("src/test/resources/tls/ec-key.pem");
+  private static final Path MISMATCHED_KEY = Path.of("src/test/resources/tls/mismatched-key.pem");
+  private static final Path GARBAGE = Path.of("src/test/resources/tls/garbage.pem");
+  private static final Path MISSING = Path.of("src/test/resources/tls/does-not-exist.pem");
 
   @Test
   void loadsRsaPemPair() throws Exception {
@@ -29,4 +33,41 @@ void loadsEcPemPair() throws Exception {
     assertThat(context).isNotNull();
     assertThat(context.getServerSocketFactory()).isNotNull();
   }
+
+  @Test
+  void rejectsMissingCertFile() {
+    assertThatThrownBy(() -> PemSslContext.load(MISSING, RSA_KEY))
+        .isInstanceOf(IllegalStateException.class)
+        .hasMessageContaining("Cannot read TLS certificate chain")
+        .hasMessageContaining("does-not-exist.pem");
+  }
+
+  @Test
+  void rejectsMissingKeyFile() {
+    assertThatThrownBy(() -> PemSslContext.load(RSA_CERT, MISSING))
+        .isInstanceOf(IllegalStateException.class)
+        .hasMessageContaining("Cannot read TLS private key")
+        .hasMessageContaining("does-not-exist.pem");
+  }
+
+  @Test
+  void rejectsGarbageCertPem() {
+    assertThatThrownBy(() -> PemSslContext.load(GARBAGE, RSA_KEY))
+        .isInstanceOf(IllegalStateException.class)
+        .hasMessageContaining("Failed to parse TLS certificate chain");
+  }
+
+  @Test
+  void rejectsGarbageKeyPem() {
+    assertThatThrownBy(() -> PemSslContext.load(RSA_CERT, GARBAGE))
+        .isInstanceOf(IllegalStateException.class)
+        .hasMessageContaining("Failed to parse TLS private key");
+  }
+
+  @Test
+  void rejectsMismatchedCertAndKey() {
+    assertThatThrownBy(() -> PemSslContext.load(RSA_CERT, MISMATCHED_KEY))
+        .isInstanceOf(IllegalStateException.class)
+        .hasMessageContaining("do not match");
+  }
 }