Allow to configure TrustManagerFactory/KeyManagerFactory via SslBundles for embedded Tomcat

In Spring Boot 3.1 SslBundles were added as concept to configure and update Server keys programmatically.

In my project I'm using the embedded Tomcat server, and I need to use a custom TrustManager. SslManagerBundle allows to configure KeyManagerFactory and TrustManagerFactory. Therefore, I've tried to use it to supply my custom TrustManagerFactory.

Unfortunately, the embedded Tomcat doesn't use SslManagerBundle. (Tomcat's SSLHostConfig creates the instance itself).

Then I've tried to configure "org.apache.tomcat.util.net.SSLHostConfig#truststoreType" via the SSLHostConfig assigned to the connector. But this was also a dead end because "org.springframework.boot.tomcat.SslConnectorCustomizer#addSslHostConfig" creates a new SSLHostConfig and erases all custom changes.

Is there a way to configure a custom TrustManagerFactory for the embedded Tomcat?

It would be nice if "org.springframework.boot.ssl.SslOptions" had properties for TrustManager/KeyManager provider & algorithm. These values could be applied in "SslConnectorCustomizer#applySslBundle" to the newly created SSLHostConfig.

Start by reading SslOptions and SslConnectorCustomizer#applySslBundle and #addSslHostConfig, then compare them with Tomcat's SSLHostConfig behavior. Trace how SslManagerBundle's KeyManagerFactory and TrustManagerFactory are represented and applied. Done means embedded Tomcat can use the configured custom factories without custom SSLHostConfig changes being overwritten.