Package io.netty.handler.ssl.util
Class SelfSignedCertificate
java.lang.Object
io.netty.handler.ssl.util.SelfSignedCertificate
Generates a temporary self-signed certificate for testing purposes.
NOTE: Never use the certificate and private key generated by this class in production. It is purely for testing purposes, and thus it is very insecure. It even uses an insecure pseudo-random generator for faster generation internally.
An X.509 certificate file and a EC/RSA private key file are generated in a system's temporary directory using
File.createTempFile(String, String)
, and they are deleted when the JVM exits using
File.deleteOnExit()
.
At first, this method tries to use OpenJDK's X.509 implementation (the sun.security.x509
package).
If it fails, it tries to use Bouncy Castle as a fallback.
-
Field Summary
FieldsModifier and TypeFieldDescriptionprivate final X509Certificate
private final File
private static final int
FIPS 140-2 encryption requires the RSA key length to be 2048 bits or greater.private static final Date
The maximum possible value in X.509 specification: 9999-12-31 23:59:59private static final Date
Current time minus 1 year, just in case software clock goes back due to time synchronizationprivate final PrivateKey
private static final InternalLogger
private final File
-
Constructor Summary
ConstructorsConstructorDescriptionCreates a new instance.SelfSignedCertificate
(String fqdn) Creates a new instance.SelfSignedCertificate
(String fqdn, String algorithm, int bits) Creates a new instance.SelfSignedCertificate
(String fqdn, SecureRandom random, int bits) Creates a new instance.SelfSignedCertificate
(String fqdn, SecureRandom random, int bits, Date notBefore, Date notAfter) Creates a new instance.SelfSignedCertificate
(String fqdn, SecureRandom random, int bits, Date notBefore, Date notAfter, String algorithm) Creates a new instance.SelfSignedCertificate
(String fqdn, SecureRandom random, String algorithm, int bits) Creates a new instance.SelfSignedCertificate
(String fqdn, Date notBefore, Date notAfter) Creates a new instance.SelfSignedCertificate
(String fqdn, Date notBefore, Date notAfter, String algorithm, int bits) Creates a new instance.SelfSignedCertificate
(Date notBefore, Date notAfter) Creates a new instance.SelfSignedCertificate
(Date notBefore, Date notAfter, String algorithm, int bits) Creates a new instance. -
Method Summary
Modifier and TypeMethodDescriptioncert()
Returns the generated X.509 certificate.Returns the generated X.509 certificate file in PEM format.void
delete()
Deletes the generated X.509 certificate file and EC/RSA private key file.private static boolean
key()
Returns the generated EC/RSA private key.(package private) static String[]
newSelfSignedCertificate
(String fqdn, PrivateKey key, X509Certificate cert) Returns the generated EC/RSA private key file in PEM format.private static void
safeClose
(File keyFile, OutputStream keyOut) private static void
safeDelete
(File certFile)
-
Field Details
-
logger
-
DEFAULT_NOT_BEFORE
Current time minus 1 year, just in case software clock goes back due to time synchronization -
DEFAULT_NOT_AFTER
The maximum possible value in X.509 specification: 9999-12-31 23:59:59 -
DEFAULT_KEY_LENGTH_BITS
private static final int DEFAULT_KEY_LENGTH_BITSFIPS 140-2 encryption requires the RSA key length to be 2048 bits or greater. Let's use that as a sane default but allow the default to be set dynamically for those that need more stringent security requirements. -
certificate
-
privateKey
-
cert
-
key
-
-
Constructor Details
-
SelfSignedCertificate
Creates a new instance.Algorithm: RSA
- Throws:
CertificateException
-
SelfSignedCertificate
Creates a new instance.Algorithm: RSA
- Parameters:
notBefore
- Certificate is not valid before this timenotAfter
- Certificate is not valid after this time- Throws:
CertificateException
-
SelfSignedCertificate
public SelfSignedCertificate(Date notBefore, Date notAfter, String algorithm, int bits) throws CertificateException Creates a new instance.- Parameters:
notBefore
- Certificate is not valid before this timenotAfter
- Certificate is not valid after this timealgorithm
- Key pair algorithmbits
- the number of bits of the generated private key- Throws:
CertificateException
-
SelfSignedCertificate
Creates a new instance.Algorithm: RSA
- Parameters:
fqdn
- a fully qualified domain name- Throws:
CertificateException
-
SelfSignedCertificate
Creates a new instance.- Parameters:
fqdn
- a fully qualified domain namealgorithm
- Key pair algorithmbits
- the number of bits of the generated private key- Throws:
CertificateException
-
SelfSignedCertificate
public SelfSignedCertificate(String fqdn, Date notBefore, Date notAfter) throws CertificateException Creates a new instance.Algorithm: RSA
- Parameters:
fqdn
- a fully qualified domain namenotBefore
- Certificate is not valid before this timenotAfter
- Certificate is not valid after this time- Throws:
CertificateException
-
SelfSignedCertificate
public SelfSignedCertificate(String fqdn, Date notBefore, Date notAfter, String algorithm, int bits) throws CertificateException Creates a new instance.- Parameters:
fqdn
- a fully qualified domain namenotBefore
- Certificate is not valid before this timenotAfter
- Certificate is not valid after this timealgorithm
- Key pair algorithmbits
- the number of bits of the generated private key- Throws:
CertificateException
-
SelfSignedCertificate
public SelfSignedCertificate(String fqdn, SecureRandom random, int bits) throws CertificateException Creates a new instance.Algorithm: RSA
- Parameters:
fqdn
- a fully qualified domain namerandom
- theSecureRandom
to usebits
- the number of bits of the generated private key- Throws:
CertificateException
-
SelfSignedCertificate
public SelfSignedCertificate(String fqdn, SecureRandom random, String algorithm, int bits) throws CertificateException Creates a new instance.- Parameters:
fqdn
- a fully qualified domain namerandom
- theSecureRandom
to usealgorithm
- Key pair algorithmbits
- the number of bits of the generated private key- Throws:
CertificateException
-
SelfSignedCertificate
public SelfSignedCertificate(String fqdn, SecureRandom random, int bits, Date notBefore, Date notAfter) throws CertificateException Creates a new instance.Algorithm: RSA
- Parameters:
fqdn
- a fully qualified domain namerandom
- theSecureRandom
to usebits
- the number of bits of the generated private keynotBefore
- Certificate is not valid before this timenotAfter
- Certificate is not valid after this time- Throws:
CertificateException
-
SelfSignedCertificate
public SelfSignedCertificate(String fqdn, SecureRandom random, int bits, Date notBefore, Date notAfter, String algorithm) throws CertificateException Creates a new instance.- Parameters:
fqdn
- a fully qualified domain namerandom
- theSecureRandom
to usebits
- the number of bits of the generated private keynotBefore
- Certificate is not valid before this timenotAfter
- Certificate is not valid after this timealgorithm
- Key pair algorithm- Throws:
CertificateException
-
-
Method Details
-
certificate
Returns the generated X.509 certificate file in PEM format. -
privateKey
Returns the generated EC/RSA private key file in PEM format. -
cert
Returns the generated X.509 certificate. -
key
Returns the generated EC/RSA private key. -
delete
public void delete()Deletes the generated X.509 certificate file and EC/RSA private key file. -
newSelfSignedCertificate
static String[] newSelfSignedCertificate(String fqdn, PrivateKey key, X509Certificate cert) throws IOException, CertificateEncodingException -
safeDelete
-
safeClose
-
isBouncyCastleAvailable
private static boolean isBouncyCastleAvailable()
-