java证书加密_Java支持让我们加密证书吗？

[更新2016-06-08：根据

https://bugs.openjdk.java.net/browse/JDK-8154757 IdenTrust CA将包括在Oracle Java 8u101。]

[更新时间2016-08-05：Java 8u101已经发布，确实包括IdenTrust CA：release notes]

Does Java support Let’s Encrypt certificates?

是。 Let’s Encrypt证书只是一个常规的公钥证书。 Java支持它。

Does Java trust Let’s Encrypt certificates out of the box?

否/它取决于JVM。 Oracle JDK / JRE的信任库高达8u66既不包含Let’s Encrypt CA也不包含交叉签名的IdenTrust CA。新URL(“https://letsencrypt.org/”).openConnection()。connect();例如导致javax.net.ssl.SSLHandshakeException：sun.security.validator.ValidatorException。

但是，您可以提供自己的验证器/定义包含所需根CA的自定义密钥库，或将该证书导入JVM信任库。

下面是一些示例代码，说明如何在运行时将证书添加到默认信任库。你只需要添加证书(从firefox作为.der导出并放在classpath中)

import java.io.BufferedInputStream;

import java.io.IOException;

import java.io.InputStream;

import java.net.URL;

import java.net.URLConnection;

import java.nio.file.Files;

import java.nio.file.Path;

import java.nio.file.Paths;

import java.security.KeyStore;

import java.security.cert.Certificate;

import java.security.cert.CertificateFactory;

import java.security.cert.PKIXParameters;

import java.security.cert.TrustAnchor;

import java.security.cert.X509Certificate;

import javax.net.ssl.SSLContext;

import javax.net.ssl.SSLHandshakeException;

import javax.net.ssl.TrustManagerFactory;

public class SSLExample {

// BEGIN ------- ADDME

static {

try {

KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());

Path ksPath = Paths.get(System.getProperty("java.home"),

"lib", "security", "cacerts");

keyStore.load(Files.newInputStream(ksPath),

"changeit".toCharArray());

CertificateFactory cf = CertificateFactory.getInstance("X.509");

try (InputStream caInput = new BufferedInputStream(

// this files is shipped with the application

SSLExample.class.getResourceAsStream("DSTRootCAX3.der"))) {

Certificate crt = cf.generateCertificate(caInput);

System.out.println("Added Cert for " + ((X509Certificate) crt)

.getSubjectDN());

keyStore.setCertificateEntry("DSTRootCAX3", crt);

}

if (false) { // enable to see

System.out.println("Truststore now trusting: ");

PKIXParameters params = new PKIXParameters(keyStore);

params.getTrustAnchors().stream()

.map(TrustAnchor::getTrustedCert)

.map(X509Certificate::getSubjectDN)

.forEach(System.out::println);

System.out.println();

}

TrustManagerFactory tmf = TrustManagerFactory

.getInstance(TrustManagerFactory.getDefaultAlgorithm());

tmf.init(keyStore);

SSLContext sslContext = SSLContext.getInstance("TLS");

sslContext.init(null, tmf.getTrustManagers(), null);

SSLContext.setDefault(sslContext);

} catch (Exception e) {

throw new RuntimeException(e);

}

}

// END ---------- ADDME

public static void main(String[] args) throws IOException {

// signed by default trusted CAs.

testUrl(new URL("https://google.com"));

testUrl(new URL("https://www.thawte.com"));

// signed by letsencrypt

testUrl(new URL("https://helloworld.letsencrypt.org"));

// signed by LE's cross-sign CA

testUrl(new URL("https://letsencrypt.org"));

// expired

testUrl(new URL("https://tv.eurosport.com/"));

// self-signed

testUrl(new URL("https://www.pcwebshop.co.uk/"));

}

static void testUrl(URL url) throws IOException {

URLConnection connection = url.openConnection();

try {

connection.connect();

System.out.println("Headers of " + url + " => "

+ connection.getHeaderFields());

} catch (SSLHandshakeException e) {

System.out.println("Untrusted: " + url);

}

}

}