在Java中，仅用PEM文件创建SSLContext的最简单方法是什么? [英] In Java, what is the simplest way to create an SSLContext with just a PEM file?

问题描述

我使用LetsEncrypt的CertBot免费生成PEM文件.在其他语言中，仅使用几行代码和PEM/密钥文件即可轻松启动HTTPS服务器.到目前为止，我在Java中找到的解决方案过于复杂，我正在寻找更简单的方法.

I used LetsEncrypt's CertBot to generate PEM files for free. In other languages it is easy to start an HTTPS server using just a couple lines of code and the PEM/key files. The solutions I have found so far in java are overly complex and I'm looking for something simpler.

1. 我不想使用Java的命令行"keytool".我只想将我的PEM/密钥文件拖放到eclipse中，并使用SSLContext以编程方式启动HTTPS服务器.
2. 我不想包含像BouncyCastle这样的大型外部库.有关使用BouncyCastle的假定解决方案，请参见以下链接:是否有更好/更简便的方法?

   Is there a better/easier way to do this?

   推荐答案

   我目前使用的完整解决方案:

   My full solution that I currently use:

   1. 在服务器上使用certbot生成证书.我使用命令"certbot certonly -d myawesomedomain.com"
   2. 我使用以下代码将该certbot证书转换为Java SSLContext:

      package bowser;
      
      import static com.google.common.base.Preconditions.checkState;
      import static ox.util.Utils.propagate;
      
      import java.io.File;
      import java.security.KeyStore;
      
      import javax.net.ssl.KeyManagerFactory;
      import javax.net.ssl.SSLContext;
      import javax.net.ssl.TrustManagerFactory;
      
      import com.google.common.base.Splitter;
      
      import ox.IO;
      import ox.Log;
      
      public class SSLUtils {
      
        public static SSLContext createContext(String domain) {
          String pass = "spamspam";
      
          File dir = new File("/etc/letsencrypt/live/" + domain);
          if (!dir.exists()) {
            Log.warn("Could not find letsencrypt dir: " + dir);
            return null;
          }
      
          File keystoreFile = new File(dir, "keystore.jks");
          File pemFile = new File(dir, "fullchain.pem");
      
          boolean generateKeystore = false;
      
          if (keystoreFile.exists()) {
            if (keystoreFile.lastModified() < pemFile.lastModified()) {
              Log.info("SSUtils: It looks like a new PEM file was created. Regenerating the keystore.");
              keystoreFile.delete();
              generateKeystore = true;
            }
          } else {
            generateKeystore = true;
          }
      
          if (generateKeystore) {
            Splitter splitter = Splitter.on(' ');
            try {
              String command = "openssl pkcs12 -export -out keystore.pkcs12 -in fullchain.pem -inkey privkey.pem -passout pass:"
                  + pass;
              Log.debug(command);
              Process process = new ProcessBuilder(splitter.splitToList(command))
                  .directory(dir).inheritIO().start();
              checkState(process.waitFor() == 0);
      
              command = "keytool -importkeystore -srckeystore keystore.pkcs12 -srcstoretype PKCS12 -destkeystore keystore.jks -srcstorepass "
                  + pass + " -deststorepass " + pass;
              Log.debug(command);
              process = new ProcessBuilder(splitter.splitToList(command))
                  .directory(dir).inheritIO().start();
              checkState(process.waitFor() == 0);
      
              new File(dir, "keystore.pkcs12").delete();// cleanup
            } catch (Exception e) {
              throw propagate(e);
            }
          }
      
          try {
            KeyStore keystore = KeyStore.getInstance(KeyStore.getDefaultType());
            keystore.load(IO.from(keystoreFile).asStream(), pass.toCharArray());
      
            KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
            keyManagerFactory.init(keystore, pass.toCharArray());
      
            SSLContext ret = SSLContext.getInstance("TLSv1.2");
            TrustManagerFactory factory = TrustManagerFactory.getInstance(
                TrustManagerFactory.getDefaultAlgorithm());
            factory.init(keystore);
            ret.init(keyManagerFactory.getKeyManagers(), factory.getTrustManagers(), null);
      
            return ret;
          } catch (Exception e) {
            throw propagate(e);
          }
        }
      
      }
      
      

      这篇关于在Java中，仅用PEM文件创建SSLContext的最简单方法是什么?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！