我使用了Let's Encrypt的CertBot免费生成PEM文件。在其他语言中，只需几行代码和PEM/密钥文件即可轻松启动HTTPS服务器。到目前为止我找到的Java解决方案过于复杂，我正在寻找更简单的东西。
是否有更好/更简单的方法来实现这一点？
private SSLContext createSslContext() throws Exception {
URL url = getClass().getResource("/a.pem");
InputStream in = url.openStream();
String pem = new String(in.readAllBytes(), StandardCharsets.UTF_8);
Pattern parse = Pattern.compile("(?m)(?s)^---*BEGIN ([^-]+)---*$([^-]+)^---*END[^-]+-+$");
Matcher m = parse.matcher(pem);
CertificateFactory certFactory = CertificateFactory.getInstance("X.509");
Decoder decoder = Base64.getMimeDecoder();
List<Certificate> certList = new ArrayList<>(); // java.security.cert.Certificate
PrivateKey privateKey = null;
int start = 0;
while (m.find(start)) {
String type = m.group(1);
String base64Data = m.group(2);
byte[] data = decoder.decode(base64Data);
start += m.group(0).length();
type = type.toUpperCase();
if (type.contains("CERTIFICATE")) {
Certificate cert = certFactory.generateCertificate(new ByteArrayInputStream(data));
certList.add(cert);
} else if (type.contains("RSA PRIVATE KEY")) {
// TODO: load and parse PKCS1 data structure to get the RSA private key
privateKey = ...
} else {
System.err.println("Unsupported type: " + type);
}
}
if (privateKey == null)
throw new RuntimeException("RSA private key not found in PEM file");
char[] keyStorePassword = new char[0];
KeyStore keyStore = KeyStore.getInstance("JKS");
keyStore.load(null, null);
int count = 0;
for (Certificate cert : certList) {
keyStore.setCertificateEntry("cert" + count, cert);
count++;
}
Certificate[] chain = certList.toArray(new Certificate[certList.size()]);
keyStore.setKeyEntry("key", privateKey, keyStorePassword, chain);
TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
tmf.init(keyStore);
KeyManagerFactory kmf = KeyManagerFactory.getInstance("RSA");
kmf.init(keyStore, keyStorePassword);
SSLContext sslContext = SSLContext.getInstance("TLS");
sslContext.init(kmf.getKeyManagers(), tmf.getTrustManagers(), new SecureRandom());
return sslContext;
}
CertificateFactory 已经可以读取 PEM 格式的证书（以及 DER 格式）。但是，包含该证书的 trustedCertEntry 对于 SSL/TLS 服务器来说是无用的；服务器需要在 privateKeyEntry 中同时包含证书、证书链和私钥。你链接的第二个问题涵盖了这一点，但仅适用于纯 Java，如果私钥文件是 PKCS8 格式且未加密，则可以使用，而不是 PKCS1/传统格式或加密格式，这需要使用 BC。你是说 certbot 总是生成未加密的 PKCS8 格式，或者至少在此问题的未指定情况下是这样吗？ - dave_thompson_085虽然已经提供了一个答案，但我想提供一个需要更少代码的替代方案。请参阅下面的示例设置：
import nl.altindag.ssl.SSLFactory;
import nl.altindag.ssl.util.PemUtils;
import javax.net.ssl.SSLContext;
import javax.net.ssl.X509ExtendedKeyManager;
import javax.net.ssl.X509ExtendedTrustManager;
public class App {
public static void main(String[] args) {
X509ExtendedKeyManager keyManager = PemUtils.loadIdentityMaterial("certificate-chain.pem", "private-key.pem", "private-key-password".toCharArray());
X509ExtendedTrustManager trustManager = PemUtils.loadTrustMaterial("some-trusted-certificate.pem");
SSLFactory sslFactory = SSLFactory.builder()
.withIdentityMaterial(keyManager)
.withTrustMaterial(trustManager)
.build();
SSLContext sslContext = sslFactory.getSslContext();
}
}
若要使用上述设置，您可以使用这个库：
<dependency>
<groupId>io.github.hakky54</groupId>
<artifactId>sslcontext-kickstart-for-pem</artifactId>
<version>8.0.0</version>
</dependency>
artifactId中的连字符。我在您的GitHub上注意到您显然已经更改了名称（更改为sslcontext-kickstart），但是Maven仍然拒绝导入它。我不是任何这些Java工具的专家，请温柔点。 - Tom StambaughSyntax error on token "-", . expectedJava(1610612940)。我还看到导入行前面有一个红色波浪线，上面写着The import io cannot be resolvedJava(268435846)。 - Tom Stambaughimport nl.altindag.ssl.util.PemUtils;。我的服务器现在运行得很好！ - Tom Stambaugh我目前使用的完整解决方案：
package bowser;
import static com.google.common.base.Preconditions.checkState;
import static ox.util.Utils.propagate;
import java.io.File;
import java.security.KeyStore;
import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.SSLContext;
import javax.net.ssl.TrustManagerFactory;
import com.google.common.base.Splitter;
import ox.IO;
import ox.Log;
public class SSLUtils {
public static SSLContext createContext(String domain) {
String pass = "spamspam";
File dir = new File("/etc/letsencrypt/live/" + domain);
if (!dir.exists()) {
Log.warn("Could not find letsencrypt dir: " + dir);
return null;
}
File keystoreFile = new File(dir, "keystore.jks");
File pemFile = new File(dir, "fullchain.pem");
boolean generateKeystore = false;
if (keystoreFile.exists()) {
if (keystoreFile.lastModified() < pemFile.lastModified()) {
Log.info("SSUtils: It looks like a new PEM file was created. Regenerating the keystore.");
keystoreFile.delete();
generateKeystore = true;
}
} else {
generateKeystore = true;
}
if (generateKeystore) {
Splitter splitter = Splitter.on(' ');
try {
String command = "openssl pkcs12 -export -out keystore.pkcs12 -in fullchain.pem -inkey privkey.pem -passout pass:"
+ pass;
Log.debug(command);
Process process = new ProcessBuilder(splitter.splitToList(command))
.directory(dir).inheritIO().start();
checkState(process.waitFor() == 0);
command = "keytool -importkeystore -srckeystore keystore.pkcs12 -srcstoretype PKCS12 -destkeystore keystore.jks -srcstorepass "
+ pass + " -deststorepass " + pass;
Log.debug(command);
process = new ProcessBuilder(splitter.splitToList(command))
.directory(dir).inheritIO().start();
checkState(process.waitFor() == 0);
new File(dir, "keystore.pkcs12").delete();// cleanup
} catch (Exception e) {
throw propagate(e);
}
}
try {
KeyStore keystore = KeyStore.getInstance(KeyStore.getDefaultType());
keystore.load(IO.from(keystoreFile).asStream(), pass.toCharArray());
KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
keyManagerFactory.init(keystore, pass.toCharArray());
SSLContext ret = SSLContext.getInstance("TLSv1.2");
TrustManagerFactory factory = TrustManagerFactory.getInstance(
TrustManagerFactory.getDefaultAlgorithm());
factory.init(keystore);
ret.init(keyManagerFactory.getKeyManagers(), factory.getTrustManagers(), null);
return ret;
} catch (Exception e) {
throw propagate(e);
}
}
}
您可以像这样执行以下操作以获取正确的SSLContext：
final String ca1 = "..load PEM file in string..";
final CertificateFactory cf = CertificateFactory.getInstance("X.509");
final Certificate cert1 = cf.generateCertificate(new ByteArrayInputStream(ca1.getBytes()));
final KeyStore keyStore = KeyStore.getInstance("JKS");
keyStore.load(null, null);
// Can add multiple truststore certificates here...
keyStore.setCertificateEntry("my-ca-1", cert1);
final SSLContext sslContext = SSLContexts.custom().setKeyStoreType(saToken)
.loadTrustMaterial(keyStore, null)
.build();
saToken是什么？ - Talos这只是一个临时解决方案，因为下面的代码允许您接受任何服务器，所以当您尝试这些解决方案时，应该深入检查您的代码。
这段代码根本不需要任何证书。
问题在于，如果情况需要，为什么您要避免这个过程？难道您不应该使用非安全服务器吗？
logger.info("Starting instance ");
TrustManager[] tm = new TrustManager[]{new X509TrustManager() {
public X509Certificate[] getAcceptedIssuers(){return new X509Certificate[]{};}
public void checkClientTrusted(X509Certificate[] chain, String authType) {logger.info(" checkClientTrusted");}
public void checkServerTrusted(X509Certificate[] chain, String authType) {logger.info(" checkServerTrusted");}
}};
SSLContext sslContext = SSLContext.getInstance("SSL");
sslContext.init(null, tm , new SecureRandom());
HttpsURLConnection.setDefaultSSLSocketFactory(sslContext.getSocketFactory());
-----BEGIN RSA PRIVATE KEY-----格式，则加载它非常复杂，因为它是PKCS＃1格式，而我所知道的是无法在纯Java中轻松读取。 - Robert