test: Cover weak EC and unsupported-algorithm paths in PemSslContext

Reorders the strength check before the signature check so a sub-spec
EC key fails fast on bit count (192 < 256) instead of tripping the
matching-signature probe. Adds P-192 EC and DSA fixtures, plus tests
covering the weak EC throw, the "Unsupported TLS private key
algorithm" branch (DSA key with RSA cert), and the "Unsupported TLS
public key algorithm" branch (DSA cert with RSA key). Simplifies the
algorithm switch in verifyKeyMatchesCert now that decodePrivateKey
guarantees RSA or EC keys.

Lifts PemSslContext line coverage from ~77% to 86%. Remaining
uncovered lines are defensive GeneralSecurityException / IOException
catches around JDK crypto APIs that do not throw for valid inputs.

Author: thced

src/main/java/com/retailsvc/http/internal/PemSslContext.java

@@ -123,8 +123,8 @@ private static PrivateKey decodePrivateKey(String pem, Path source) {
   }
 
   private static SSLContext buildSslContext(Certificate[] chain, PrivateKey key) {
-    verifyKeyMatchesCert(key, chain[0]);
     requireMinimumStrength(chain[0]);
+    verifyKeyMatchesCert(key, chain[0]);
     try {
       KeyStore ks = KeyStore.getInstance("PKCS12");
       ks.load(null, null);
@@ -171,14 +171,8 @@ private static void requireMinimumStrength(Certificate cert) {
   }
 
   private static void verifyKeyMatchesCert(PrivateKey key, Certificate cert) {
-    String algorithm =
-        switch (key.getAlgorithm()) {
-          case "RSA" -> "SHA256withRSA";
-          case "EC" -> "SHA256withECDSA";
-          default ->
-              throw new IllegalStateException(
-                  "Unsupported TLS private key algorithm: " + key.getAlgorithm());
-        };
+    // decodePrivateKey only returns RSA or EC keys, so this switch is total without a default.
+    String algorithm = "RSA".equals(key.getAlgorithm()) ? "SHA256withRSA" : "SHA256withECDSA";
     byte[] signature;
     try {
       Signature signer = Signature.getInstance(algorithm);

src/test/java/com/retailsvc/http/internal/PemSslContextTest.java

@@ -19,6 +19,10 @@ class PemSslContextTest {
   private static final Path MISSING = Path.of("src/test/resources/tls/does-not-exist.pem");
   private static final Path WEAK_RSA_CERT = Path.of("src/test/resources/tls/weak-rsa-cert.pem");
   private static final Path WEAK_RSA_KEY = Path.of("src/test/resources/tls/weak-rsa-key.pem");
+  private static final Path WEAK_EC_CERT = Path.of("src/test/resources/tls/weak-ec-cert.pem");
+  private static final Path WEAK_EC_KEY = Path.of("src/test/resources/tls/weak-ec-key.pem");
+  private static final Path DSA_CERT = Path.of("src/test/resources/tls/dsa-cert.pem");
+  private static final Path DSA_KEY = Path.of("src/test/resources/tls/dsa-key.pem");
 
   @Test
   void loadsRsaPemPair() {
@@ -101,4 +105,26 @@ void rejectsWeakRsaKey() {
         .hasMessageContaining("TLS RSA key below minimum strength")
         .hasMessageContaining("1024 bits");
   }
+
+  @Test
+  void rejectsWeakEcKey() {
+    assertThatThrownBy(() -> PemSslContext.load(WEAK_EC_CERT, WEAK_EC_KEY))
+        .isInstanceOf(IllegalStateException.class)
+        .hasMessageContaining("TLS EC key below minimum strength")
+        .hasMessageContaining("192 bits");
+  }
+
+  @Test
+  void rejectsUnsupportedKeyAlgorithm() {
+    assertThatThrownBy(() -> PemSslContext.load(RSA_CERT, DSA_KEY))
+        .isInstanceOf(IllegalStateException.class)
+        .hasMessageContaining("Unsupported TLS private key algorithm");
+  }
+
+  @Test
+  void rejectsUnsupportedCertAlgorithm() {
+    assertThatThrownBy(() -> PemSslContext.load(DSA_CERT, RSA_KEY))
+        .isInstanceOf(IllegalStateException.class)
+        .hasMessageContaining("Unsupported TLS public key algorithm");
+  }
 }

src/test/resources/tls/dsa-cert.pem

@@ -0,0 +1,26 @@
+-----BEGIN CERTIFICATE-----
+MIIEazCCBBmgAwIBAgIUNDFdkKEWyHLwpeKHQvzzAgY78UMwCwYJYIZIAWUDBAMC
+MBgxFjAUBgNVBAMMDWRzYS1sb2NhbGhvc3QwIBcNMjYwNTIxMTE1ODA1WhgPMjEy
+NjA0MjcxMTU4MDVaMBgxFjAUBgNVBAMMDWRzYS1sb2NhbGhvc3QwggNCMIICNQYH
+KoZIzjgEATCCAigCggEBAMc/wejLRCRVLn8zzCO0kIqkRhDtRu+PqQNbV+l+Muom
+K8dJ6m6ZLdcla7nLYa8cDTA8GurBDFGXv6PFPHlFV8+xJVC9jK9p4hcZZ1aS1ykN
+GKV3ha3pVFYVeGRzx2UAlQHR0/bw7LnnwNHAhQ7u1OqRdWKTx4PNiG60j99nb2Sh
+Sa+3Im90c2Yt+4PIuQQw5for7wY5iQRfNmlRi7i7F8aeO2rBVIVdainW42IEBC0W
+ldSqkx7IyF7Ym/+7HdRowMJ1yh36Zj67p5pkwuxs6h4GiucddYO3i2EomWygA/Xm
+PhzBuHMKUdI9aH5j0P6dtrXN8TiwJupFCiPzMGsK49sCHQDdN2HZKEIr1JmcnnIo
+8hbgufDqqOMAOhGiKAkVAoIBABGihRZdRmOtvWpgdF/ttaaM0Ds+gffpdQn3zXHe
+su8iRQFQqXbF4R31VKiqVmz36HHRLH55CJZc4SXKpW+5loDEfZYtECrwQggvwoYj
+f5Ko7Gd/p/iKnTVn+bnsehdqI9csWrjkiqWxDdpq8LYcH2uUQLbJWCuEiMWhEptv
+VroCEpMfp66XyGYH+hB5zhklH+/lOnUpoZyiMmBh56brpqP1J+Z5GZTlBFhXhUAl
+gnqVS6fCDpZu1mijZNyWZO0kIoLnWTd6eMYGE9AUynpqvtwX0eGze4KjQkAY24mj
+M8p2loUH5DeigD4h5aog4oUKfvYoegB9n4S5o+ukpYY6BzUDggEFAAKCAQAFfX4V
+q3ei1HhAGaJ/LBp3cwmEvZLuGcfyZCYS8QwIdmAHHut3O2cK7sQ0vQ68kSW6MLCU
+rw1P9U9FlyKkgUKI7d1mb+Up8vk7n4qnEU7gaiLge+39SjqPuUyqKuVTJs/ZWxMS
+UrMTVwx2hnMO3miTBzZ4hHDGYnKce/VEcR0X/CffZ7NZb93JpD0aVS+BKH4XK/ZR
+R1mY/Y3Iah3psbPDmyFs84Y4K4E4gS2wkl1nvhvfAJRDvGEF6T40HCaDnX53OY7H
+qIo4pJdtxvsbk1fEJvZuoOPhwy/5pr83wR9O0in8+twJxzKFciAgdV+1eNf/7imd
+p3k27MUkmZowblK9o1MwUTAdBgNVHQ4EFgQUcKihfiAes+nytWG9lBkNVv56gwgw
+HwYDVR0jBBgwFoAUcKihfiAes+nytWG9lBkNVv56gwgwDwYDVR0TAQH/BAUwAwEB
+/zALBglghkgBZQMEAwIDPwAwPAIcbiFkWhn84KIKUR//o0nAGwNMrqZ54KxaW7eR
+ZQIcDqkzw8eeGq9U1ClhWYN27vb5gT53OSc/Q6isRg==
+-----END CERTIFICATE-----

src/test/resources/tls/dsa-key.pem

@@ -0,0 +1,15 @@
+-----BEGIN PRIVATE KEY-----
+MIICXgIBADCCAjYGByqGSM44BAEwggIpAoIBAQDfxy8WtSqub6Lx8wZNtZ9r/EEl
+jxOxns9qjtvkjew5SFuQtMwr8y6dTMPf+qumUse1okmxsPU0c3Iof3yGByYe1jUx
+AJVEtL0TYdDTvwA+ttNwPnQndFzKAc2MFBxMOTjZIiuhKvBmo6SDgLvflcQbyVdT
+g0tCkcui+hBel/M/CnWZEy6/fOY6u7chMv+R1dAFRo1y64VAyTV9+4WU2oIrU26Z
+soM/TDJWJxEnNck15dzOXY1O4w0FDi0hTkR9j2Xrumc6R9uvnVsRmuP5TzfHqI7E
+eWpSiaNYLOevkIcXHmg+pi0H/8XFdddgT007Sd0Bu6D8rhkAKczedu4Bg75HAh0A
+xcvFdwdZZefPAdsfQ13PWJwvVvMBZrJs/FFFEQKCAQEAm/S5T8+WCM9hv8OHayEQ
+oqJfa0LkCZMXT4lPqa/NiKDQEGmjtcvc06T1Nmnboq4AqUrlswKojpvu5vdXDk3g
+Zf2qzUOZspLEpXlHDJ9XwCNnrb9UBUK4yVXbDeFqsdBPa09CW/5f901bAyz/l7/i
+fJYyOwsL6ZQWKWJQbhWweqeoCCVBkPpTQyc4J869K4LHyghA+sXC1/BQMS2EfJVH
+IcLkWmyHuPKGOo914bnamg5ofeFHTgUUGWIAr81uw41AEiKrYyT0dkO5o7K7Q0iW
+xj7wAiYuFCQkD3QUGTa3LBoBMgEJQGITIgz1RaJy6EP+ANZmah0CSrqeD0tl86hT
+YgQfAh0AmIlpe0R/PsdbBmDDKMgnfJM1qnj3hLj0VL0HjA==
+-----END PRIVATE KEY-----

src/test/resources/tls/weak-ec-cert.pem

@@ -0,0 +1,10 @@
+-----BEGIN CERTIFICATE-----
+MIIBbjCCASWgAwIBAgIUMdzHTBEjEXAMlBO0J6da9KtC1KowCgYIKoZIzj0EAwIw
+HDEaMBgGA1UEAwwRd2Vhay1lYy1sb2NhbGhvc3QwIBcNMjYwNTIxMTE0NjI1WhgP
+MjEyNjA0MjcxMTQ2MjVaMBwxGjAYBgNVBAMMEXdlYWstZWMtbG9jYWxob3N0MEkw
+EwYHKoZIzj0CAQYIKoZIzj0DAQEDMgAEcOYb3OnogqFQUG3Ua6xhiJ2iIftE+xin
+TNBUPGbprqaz4fwp/IiyaCxOD1/V6f9Uo1MwUTAdBgNVHQ4EFgQUnI1V6NkJRrt7
+Nj+DebVnQPcDYF4wHwYDVR0jBBgwFoAUnI1V6NkJRrt7Nj+DebVnQPcDYF4wDwYD
+VR0TAQH/BAUwAwEB/zAKBggqhkjOPQQDAgM3ADA0Ahhbie15KevgEt4nY1SILbxJ
+mbt78OGM5GcCGEKBaKXGDzY6Q/GkcAuT1mvBiKDMAzGYQA==
+-----END CERTIFICATE-----

src/test/resources/tls/weak-ec-key.pem

@@ -0,0 +1,5 @@
+-----BEGIN PRIVATE KEY-----
+MG8CAQAwEwYHKoZIzj0CAQYIKoZIzj0DAQEEVTBTAgEBBBj236RAh4V7+Ncz7Qtn
+94smhfxZXP13By+hNAMyAARw5hvc6eiCoVBQbdRrrGGInaIh+0T7GKdM0FQ8Zumu
+prPh/Cn8iLJoLE4PX9Xp/1Q=
+-----END PRIVATE KEY-----