feat: Add PemSslContext for loading PEM cert + RSA key

Author: thced

docs/superpowers/plans/2026-05-21-https-support.md

@@ -166,7 +166,7 @@ SKIP=commitlint git commit -m "test: Add TLS PEM fixtures for HTTPS support"
 - Create: `src/main/java/com/retailsvc/http/internal/PemSslContext.java`
 - Create: `src/test/java/com/retailsvc/http/internal/PemSslContextTest.java`
 
-- [ ] **Step 1: Write the failing RSA happy-path test**
+- [x] **Step 1: Write the failing RSA happy-path test**
 
 Write `src/test/java/com/retailsvc/http/internal/PemSslContextTest.java`:
 
@@ -195,15 +195,15 @@ class PemSslContextTest {
 }
 ```
 
-- [ ] **Step 2: Run the test, confirm it fails**
+- [x] **Step 2: Run the test, confirm it fails**
 
 ```bash
 mvn test -Dtest=PemSslContextTest
 ```
 
 Expected: compilation failure — `PemSslContext` does not exist.
 
-- [ ] **Step 3: Create the minimal `PemSslContext`**
+- [x] **Step 3: Create the minimal `PemSslContext`**
 
 Write `src/main/java/com/retailsvc/http/internal/PemSslContext.java`:
 
@@ -298,15 +298,15 @@ public final class PemSslContext {
 }
 ```
 
-- [ ] **Step 4: Run the test, confirm it passes**
+- [x] **Step 4: Run the test, confirm it passes**
 
 ```bash
 mvn test -Dtest=PemSslContextTest
 ```
 
 Expected: 1 test passes.
 
-- [ ] **Step 5: Commit**
+- [x] **Step 5: Commit**
 
 ```bash
 git add src/main/java/com/retailsvc/http/internal/PemSslContext.java \

src/main/java/com/retailsvc/http/internal/PemSslContext.java

@@ -0,0 +1,89 @@
+package com.retailsvc.http.internal;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.security.GeneralSecurityException;
+import java.security.KeyFactory;
+import java.security.KeyStore;
+import java.security.PrivateKey;
+import java.security.cert.Certificate;
+import java.security.cert.CertificateFactory;
+import java.security.spec.InvalidKeySpecException;
+import java.security.spec.PKCS8EncodedKeySpec;
+import java.util.Base64;
+import java.util.Collection;
+import javax.net.ssl.KeyManagerFactory;
+import javax.net.ssl.SSLContext;
+
+/** Loads a {@link SSLContext} from a PEM certificate chain and PEM PKCS#8 private key. */
+public final class PemSslContext {
+
+  private PemSslContext() {}
+
+  public static SSLContext load(Path certChainPem, Path privateKeyPem) {
+    Certificate[] chain = readCertificateChain(certChainPem);
+    PrivateKey key = readPrivateKey(privateKeyPem);
+    return buildSslContext(chain, key);
+  }
+
+  private static Certificate[] readCertificateChain(Path path) {
+    byte[] bytes;
+    try {
+      bytes = Files.readAllBytes(path);
+    } catch (IOException e) {
+      throw new IllegalStateException("Cannot read TLS certificate chain: " + path, e);
+    }
+    try {
+      CertificateFactory factory = CertificateFactory.getInstance("X.509");
+      Collection<? extends Certificate> certs =
+          factory.generateCertificates(new ByteArrayInputStream(bytes));
+      return certs.toArray(new Certificate[0]);
+    } catch (GeneralSecurityException e) {
+      throw new IllegalStateException("Failed to parse TLS certificate chain from " + path, e);
+    }
+  }
+
+  private static PrivateKey readPrivateKey(Path path) {
+    String pem;
+    try {
+      pem = Files.readString(path);
+    } catch (IOException e) {
+      throw new IllegalStateException("Cannot read TLS private key: " + path, e);
+    }
+    byte[] der;
+    try {
+      String base64 =
+          pem.replace("-----BEGIN PRIVATE KEY-----", "")
+              .replace("-----END PRIVATE KEY-----", "")
+              .replaceAll("\\s+", "");
+      der = Base64.getDecoder().decode(base64);
+    } catch (IllegalArgumentException e) {
+      throw new IllegalStateException("Failed to parse TLS private key from " + path, e);
+    }
+    PKCS8EncodedKeySpec spec = new PKCS8EncodedKeySpec(der);
+    try {
+      return KeyFactory.getInstance("RSA").generatePrivate(spec);
+    } catch (InvalidKeySpecException rsaFail) {
+      throw new IllegalStateException("Failed to parse TLS private key from " + path, rsaFail);
+    } catch (GeneralSecurityException e) {
+      throw new IllegalStateException("Failed to parse TLS private key from " + path, e);
+    }
+  }
+
+  private static SSLContext buildSslContext(Certificate[] chain, PrivateKey key) {
+    try {
+      KeyStore ks = KeyStore.getInstance("PKCS12");
+      ks.load(null, null);
+      ks.setKeyEntry("server", key, new char[0], chain);
+      KeyManagerFactory kmf = KeyManagerFactory.getInstance("SunX509");
+      kmf.init(ks, new char[0]);
+      SSLContext ctx = SSLContext.getInstance("TLS");
+      ctx.init(kmf.getKeyManagers(), null, null);
+      return ctx;
+    } catch (GeneralSecurityException | IOException e) {
+      throw new IllegalStateException("TLS certificate and private key do not match", e);
+    }
+  }
+}

src/test/java/com/retailsvc/http/internal/PemSslContextTest.java

@@ -0,0 +1,22 @@
+package com.retailsvc.http.internal;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import java.nio.file.Path;
+import javax.net.ssl.SSLContext;
+import org.junit.jupiter.api.Test;
+
+class PemSslContextTest {
+
+  private static final Path RSA_CERT = Path.of("src/test/resources/tls/rsa-cert.pem");
+  private static final Path RSA_KEY = Path.of("src/test/resources/tls/rsa-key.pem");
+
+  @Test
+  void loadsRsaPemPair() throws Exception {
+    SSLContext context = PemSslContext.load(RSA_CERT, RSA_KEY);
+
+    assertThat(context).isNotNull();
+    assertThat(context.getProtocol()).isEqualTo("TLS");
+    assertThat(context.getServerSocketFactory()).isNotNull();
+  }
+}