Inline SecureRandomHelper calls in SelfSignedCertificateGenerator

Remove the private static field and parameter threading — just call
SecureRandomHelper.getSecureRandom() directly at each usage site.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: 2 people

core/camel-main/src/main/java/org/apache/camel/main/SelfSignedCertificateGenerator.java

@@ -23,7 +23,6 @@
 import java.security.KeyStore;
 import java.security.PrivateKey;
 import java.security.PublicKey;
-import java.security.SecureRandom;
 import java.security.Signature;
 import java.security.cert.CertificateFactory;
 import java.security.cert.X509Certificate;
@@ -42,8 +41,6 @@
  */
 final class SelfSignedCertificateGenerator {
 
-    private static final SecureRandom RANDOM = SecureRandomHelper.getSecureRandom();
-
     private SelfSignedCertificateGenerator() {
     }
 
@@ -80,17 +77,17 @@ static KeyStore generateKeyStore(String password, String keyType) throws Excepti
         KeyPairGenerator keyGen;
         if ("EC".equals(type)) {
             keyGen = KeyPairGenerator.getInstance("EC");
-            keyGen.initialize(new ECGenParameterSpec("secp256r1"), RANDOM);
+            keyGen.initialize(new ECGenParameterSpec("secp256r1"), SecureRandomHelper.getSecureRandom());
         } else if ("RSA".equals(type)) {
             keyGen = KeyPairGenerator.getInstance("RSA");
-            keyGen.initialize(2048, RANDOM);
+            keyGen.initialize(2048, SecureRandomHelper.getSecureRandom());
         } else {
             throw new IllegalArgumentException(
                     "Unsupported self-signed certificate key type: " + keyType + " (supported: EC, RSA)");
         }
         KeyPair keyPair = keyGen.generateKeyPair();
 
-        X509Certificate cert = generateCertificate(keyPair, type, RANDOM);
+        X509Certificate cert = generateCertificate(keyPair, type);
 
         KeyStore ks = KeyStore.getInstance("PKCS12");
         ks.load(null, password.toCharArray());
@@ -100,7 +97,7 @@ static KeyStore generateKeyStore(String password, String keyType) throws Excepti
         return ks;
     }
 
-    private static X509Certificate generateCertificate(KeyPair keyPair, String keyType, SecureRandom random)
+    private static X509Certificate generateCertificate(KeyPair keyPair, String keyType)
             throws Exception {
         PublicKey publicKey = keyPair.getPublic();
         PrivateKey privateKey = keyPair.getPrivate();
@@ -109,16 +106,15 @@ private static X509Certificate generateCertificate(KeyPair keyPair, String keyTy
         ZonedDateTime expiry = now.plusDays(365);
 
         // Build self-signed X.509 certificate using DER encoding
-        byte[] encoded = buildSelfSignedCertificateDer(publicKey, privateKey, keyType, now, expiry, random);
+        byte[] encoded = buildSelfSignedCertificateDer(publicKey, privateKey, keyType, now, expiry);
 
         CertificateFactory cf = CertificateFactory.getInstance("X.509");
         return (X509Certificate) cf.generateCertificate(new ByteArrayInputStream(encoded));
     }
 
     private static byte[] buildSelfSignedCertificateDer(
             PublicKey publicKey, PrivateKey privateKey, String keyType,
-            ZonedDateTime notBefore, ZonedDateTime notAfter,
-            SecureRandom random)
+            ZonedDateTime notBefore, ZonedDateTime notAfter)
             throws Exception {
 
         boolean ec = "EC".equals(keyType);
@@ -130,7 +126,7 @@ private static byte[] buildSelfSignedCertificateDer(
 
         // TBS Certificate
         byte[] tbsCertificate
-                = buildTbsCertificate(publicKey, issuerDn, signatureAlgorithm, notBefore, notAfter, random);
+                = buildTbsCertificate(publicKey, issuerDn, signatureAlgorithm, notBefore, notAfter);
 
         // Sign the TBS certificate
         Signature sig = Signature.getInstance(signatureAlgorithmName);
@@ -146,15 +142,14 @@ private static byte[] buildSelfSignedCertificateDer(
 
     private static byte[] buildTbsCertificate(
             PublicKey publicKey, byte[] dn, byte[] signatureAlgorithm,
-            ZonedDateTime notBefore, ZonedDateTime notAfter,
-            SecureRandom random) {
+            ZonedDateTime notBefore, ZonedDateTime notAfter) {
 
         // Version: v3 (2)
         byte[] version = wrapExplicitTag(0, wrapInteger(new byte[] { 2 }));
 
         // Serial number
         byte[] serialBytes = new byte[16];
-        random.nextBytes(serialBytes);
+        SecureRandomHelper.getSecureRandom().nextBytes(serialBytes);
         serialBytes[0] &= 0x7F; // ensure positive
         byte[] serial = wrapInteger(serialBytes);