SSLCertService: Fix account id requirement by using caller account id as fallback

server/src/main/java/org/apache/cloudstack/network/ssl/CertServiceImpl.java

@@ -199,16 +199,12 @@ public List<SslCertResponse> listSslCerts(final ListSslCertsCmd listSslCertCmd)
         final Account caller = ctx.getCallingAccount();
 
         final Long certId = listSslCertCmd.getCertId();
-        final Long accountId = listSslCertCmd.getAccountId();
+        final Long accountId = listSslCertCmd.getAccountId() != null ? listSslCertCmd.getAccountId() : caller.getAccountId();
         final Long lbRuleId = listSslCertCmd.getLbId();
         final Long projectId = listSslCertCmd.getProjectId();
 
         final List<SslCertResponse> certResponseList = new ArrayList<SslCertResponse>();
 
-        if (certId == null && accountId == null && lbRuleId == null && projectId == null) {
-            throw new InvalidParameterValueException("Invalid parameters either certificate ID or Account ID or Loadbalancer ID or Project ID required");
-        }
-
         List<LoadBalancerCertMapVO> certLbMap = null;
         SslCertVO certVO = null;
 
@@ -241,7 +237,7 @@ public List<SslCertResponse> listSslCerts(final ListSslCertsCmd listSslCertCmd)
             lbCertMapRule = _lbCertDao.findByLbRuleId(lbRuleId);
 
             if (lbCertMapRule == null) {
-                logger.debug("No certificate bound to loadbalancer id: " + lbRuleId);
+                logger.debug("No certificate bound to loadbalancer id: {}", lbRuleId);
                 return certResponseList;
             }
 
@@ -273,7 +269,7 @@ public List<SslCertResponse> listSslCerts(final ListSslCertsCmd listSslCertCmd)
             return certResponseList;
         }
 
-        //reached here look by accountId
+        // Reached here: list by explicit accountId or the caller account if accountId was not provided.
         final List<SslCertVO> certVOList = _sslCertDao.listByAccountId(accountId);
         if (certVOList == null || certVOList.isEmpty()) {
             return certResponseList;
@@ -374,7 +370,7 @@ private void validateKeys(final PublicKey pubKey, final PrivateKey privKey) {
         }
 
         // No encryption for DSA
-        if (pubKey.getAlgorithm() != "RSA") {
+        if (!pubKey.getAlgorithm().equals("RSA")) {
             return;
         }
 
@@ -492,7 +488,12 @@ public Certificate parseCertificate(final String cert) {
         } catch (final CertificateException | IOException e) {
             throw new InvalidParameterValueException("Invalid Certificate format. Expected X509 certificate. Failed due to " + e.getMessage());
         } finally {
-            IOUtils.closeQuietly(certPem);
+            // Try to close quietly
+            try {
+                IOUtils.close(certPem);
+            } catch (IOException e) {
+                logger.debug("Failed to close pem reader", e);
+            }
         }
     }
 

server/src/test/java/org/apache/cloudstack/network/ssl/CertServiceTest.java

@@ -32,6 +32,7 @@
 import com.cloud.utils.db.EntityManager;
 import com.cloud.utils.db.TransactionLegacy;
 import org.apache.cloudstack.api.command.user.loadbalancer.DeleteSslCertCmd;
+import org.apache.cloudstack.api.command.user.loadbalancer.ListSslCertsCmd;
 import org.apache.cloudstack.api.command.user.loadbalancer.UploadSslCertCmd;
 import org.apache.cloudstack.context.CallContext;
 import org.bouncycastle.openssl.PKCS8Generator;
@@ -819,6 +820,25 @@ public void runDeleteSslCertInvalidId() throws NoSuchFieldException, IllegalAcce
 
     }
 
+    @Test
+    public void runListSslCertsUsesCallerAccountWhenNoFilters() {
+        final long callerAccountId = 42L;
+        final CertServiceImpl certService = new CertServiceImpl();
+
+        certService._sslCertDao = Mockito.mock(SslCertDao.class);
+        when(certService._sslCertDao.listByAccountId(anyLong())).thenReturn(new ArrayList<>());
+
+        final AccountVO callerAccount = new AccountVO("testaccount", 1, "networkdomain", Account.Type.NORMAL, UUID.randomUUID().toString());
+        callerAccount.setId(callerAccountId);
+        final UserVO user = new UserVO(1, "testuser", "password", "firstname", "lastName", "email", "timezone", UUID.randomUUID().toString(), User.Source.UNKNOWN);
+        CallContext.unregister();
+        CallContext.register(user, callerAccount);
+
+        certService.listSslCerts(new ListSslCertsCmdExtn());
+
+        Mockito.verify(certService._sslCertDao).listByAccountId(callerAccountId);
+    }
+
     public class UploadSslCertCmdExtn extends UploadSslCertCmd {
         @Override
         public long getEntityOwnerId() {
@@ -833,6 +853,13 @@ public long getEntityOwnerId() {
         }
     }
 
+    public class ListSslCertsCmdExtn extends ListSslCertsCmd {
+        @Override
+        public long getEntityOwnerId() {
+            return 1;
+        }
+    }
+
     private String generateEncryptedPrivateKey(String password) throws NoSuchAlgorithmException, OperatorCreationException, IOException {
         // Generate RSA key pair
         KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA");