Java tutorial
/* * #%L * Wisdom-Framework * %% * Copyright (C) 2013 - 2014 Wisdom Framework * %% * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. * #L% */ package org.wisdom.framework.vertx.ssl; import org.apache.commons.io.IOUtils; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import sun.security.x509.*; import javax.net.ssl.KeyManagerFactory; import java.io.*; import java.math.BigInteger; import java.security.*; import java.security.cert.CertificateException; import java.security.cert.X509Certificate; import java.util.Date; import java.util.regex.Matcher; import java.util.regex.Pattern; /** * Generate a Fake Key Store. * Do not use this in production! */ public final class FakeKeyStore { public static final String KEYSTORE_PATH = "conf/fake.keystore"; public static final String DN_NAME = "CN=localhost, OU=Testing, O=Mavericks, L=Moon Base 1, ST=Cyberspace, " + "C=CY"; private static final String SHA1WITHRSA = "SHA1withRSA"; private static final Logger LOGGER = LoggerFactory.getLogger("wisdom-vertx-engine"); private FakeKeyStore() { //Unused } public static File generateFakeKey(File root) { try { KeyStore keyStore = KeyStore.getInstance("JKS"); File keyStoreFile = new File(root, KEYSTORE_PATH); if (!keyStoreFile.exists()) { generateAndStoreKeyStore(keyStore, keyStoreFile); } else { loadKeyStore(keyStore, keyStoreFile); } return keyStoreFile; } catch (Exception e) { LOGGER.error("Cannot generate or read the fake key store", e); return null; } } private static void loadKeyStore(KeyStore keyStore, File keyStoreFile) throws IOException, NoSuchAlgorithmException, CertificateException { InputStream is = null; try { is = new FileInputStream(keyStoreFile); keyStore.load(is, "".toCharArray()); } finally { IOUtils.closeQuietly(is); } } private static void generateAndStoreKeyStore(KeyStore keyStore, File keyStoreFile) throws Exception { FileOutputStream out = null; try { LOGGER.info("Generating HTTPS key pair in " + keyStoreFile.getAbsolutePath() + " - this may take some" + " time. If nothing happens, try moving the mouse/typing on the keyboard to generate some entropy."); // Generate the key pair KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA"); keyPairGenerator.initialize(1024); KeyPair keyPair = keyPairGenerator.generateKeyPair(); // Generate a self signed certificate X509Certificate cert = createSelfSignedCertificate(keyPair); // Create the key store, first set the store pass keyStore.load(null, "".toCharArray()); keyStore.setKeyEntry("wisdom-generated", keyPair.getPrivate(), "".toCharArray(), new X509Certificate[] { cert }); keyStoreFile.getParentFile().mkdirs(); out = new FileOutputStream(keyStoreFile); keyStore.store(out, "".toCharArray()); LOGGER.info("Key Store generated in " + keyStoreFile.getAbsoluteFile()); } finally { IOUtils.closeQuietly(out); } } @SuppressWarnings("restriction") private static X509Certificate createSelfSignedCertificate(KeyPair keyPair) throws Exception { X509CertInfo certInfo = new X509CertInfo(); // Serial number and version certInfo.set(X509CertInfo.SERIAL_NUMBER, new CertificateSerialNumber(new BigInteger(64, new SecureRandom()))); certInfo.set(X509CertInfo.VERSION, new CertificateVersion(CertificateVersion.V3)); // Validity Date validFrom = new Date(); Date validTo = new Date(validFrom.getTime() + 50L * 365L * 24L * 60L * 60L * 1000L); CertificateValidity validity = new CertificateValidity(validFrom, validTo); certInfo.set(X509CertInfo.VALIDITY, validity); // Subject & Issuer X500Name owner = new X500Name(DN_NAME); boolean justName = isJavaAtLeast(1.8); if (justName) { certInfo.set(X509CertInfo.SUBJECT, owner); certInfo.set(X509CertInfo.ISSUER, owner); } else { certInfo.set(X509CertInfo.SUBJECT, new CertificateSubjectName(owner)); certInfo.set(X509CertInfo.ISSUER, new CertificateIssuerName(owner)); } // Key and algorithm certInfo.set(X509CertInfo.KEY, new CertificateX509Key(keyPair.getPublic())); AlgorithmId algorithm = new AlgorithmId(AlgorithmId.sha1WithRSAEncryption_oid); certInfo.set(X509CertInfo.ALGORITHM_ID, new CertificateAlgorithmId(algorithm)); // Create a new certificate and sign it X509CertImpl cert = new X509CertImpl(certInfo); cert.sign(keyPair.getPrivate(), SHA1WITHRSA); // Since the SHA1withRSA provider may have a different algorithm ID to what we think it should be, // we need to reset the algorithm ID, and resign the certificate AlgorithmId actualAlgorithm = (AlgorithmId) cert.get(X509CertImpl.SIG_ALG); certInfo.set(CertificateAlgorithmId.NAME + "." + CertificateAlgorithmId.ALGORITHM, actualAlgorithm); X509CertImpl newCert = new X509CertImpl(certInfo); newCert.sign(keyPair.getPrivate(), SHA1WITHRSA); return newCert; } public static final Pattern JAVA_VERSION = Pattern.compile("([0-9]*.[0-9]*)(.*)?"); /** * Checks whether the current JAva runtime has a version equal or higher then the given one. As Java version are * not double (because they can use more digits such as 1.8.0), this method extracts the two first digits and * transforms it as a double. * @param version the version * @return {@literal true} if the current Java runtime is at least the specified one, * {@literal false} if not or if the current version cannot be retrieve or is the retrieved version cannot be * parsed as a double. */ public static boolean isJavaAtLeast(double version) { String javaVersion = System.getProperty("java.version"); if (javaVersion == null) { return false; } // if the retrieved version is one three digits, remove the last one. Matcher matcher = JAVA_VERSION.matcher(javaVersion); if (matcher.matches()) { javaVersion = matcher.group(1); } try { double v = Double.parseDouble(javaVersion); return v >= version; } catch (NumberFormatException e) { //NOSONAR if it's not a number, just return false return false; } } }