public final class KeyStoreUtil extends Object
Modifier and Type | Field and Description |
---|---|
static String |
DEFAULT_KEYSTORE_PASSWORD |
Constructor and Description |
---|
KeyStoreUtil() |
Modifier and Type | Method and Description |
---|---|
static boolean |
addCert(File file,
String alias,
KeyStore ks)
Load an X509 Cert from a file and add it to the
trusted set of certificates in the key store
This does NOT check for revocation.
|
static boolean |
addCert(File file,
String alias,
KeyStore ks,
CertStore cs)
Load an X509 Cert from a file and add it to the
trusted set of certificates in the key store
This DOES check for revocation, IF cs is non-null.
|
static int |
addCerts(File dir,
KeyStore ks)
Load all X509 Certs from a directory and add them to the
trusted set of certificates in the key store
This DOES check for revocation.
|
static int |
countCerts(KeyStore ks)
Count all X509 Certs in a key store
|
static boolean |
createKeys(File ks,
String alias,
String cname,
Set<String> altNames,
String ou,
String keyPW)
Create a keypair and store it in the keystore at ks, creating it if necessary.
|
static boolean |
createKeys(File ks,
String ksPW,
String alias,
String cname,
Set<String> altNames,
String ou,
int validDays,
String keyAlg,
int keySize,
String keyPW)
Create a keypair and store it in the keystore at ks, creating it if necessary.
|
static boolean |
createKeys(File ks,
String alias,
String cname,
String ou,
String keyPW)
Create a keypair and store it in the keystore at ks, creating it if necessary.
|
static boolean |
createKeys(File ks,
String ksPW,
String alias,
String cname,
String ou,
int validDays,
String keyAlg,
int keySize,
String keyPW)
Create a keypair and store it in the keystore at ks, creating it if necessary.
|
static Object[] |
createKeysAndCRL(File ks,
String ksPW,
String alias,
String cname,
Set<String> altNames,
String ou,
int validDays,
SigType type,
String keyPW)
New way - Native Java, does not call out to keytool.
|
static Object[] |
createKeysAndCRL(File ks,
String ksPW,
String alias,
String cname,
Set<String> altNames,
String ou,
int validDays,
String keyAlg,
int keySize,
String keyPW)
New way - Native Java, does not call out to keytool.
|
static Object[] |
createKeysAndCRL(File ks,
String ksPW,
String alias,
String cname,
String ou,
int validDays,
SigType type,
String keyPW)
New way - Native Java, does not call out to keytool.
|
static Object[] |
createKeysAndCRL(File ks,
String ksPW,
String alias,
String cname,
String ou,
int validDays,
String keyAlg,
int keySize,
String keyPW)
New way - Native Java, does not call out to keytool.
|
static KeyStore |
createKeyStore(File ksFile,
String password)
Create a new KeyStore object, and load it from ksFile if it is
non-null and it exists.
|
static boolean |
exportCert(File ks,
String ksPW,
String alias,
File certFile)
Pull the cert back OUT of the keystore and save it in Base64-encoded X.509 format
so the clients can get to it.
|
static void |
exportPrivateKey(File ks,
String ksPW,
String alias,
String keyPW,
OutputStream out)
Export the private key and certificate chain (if any) out of a keystore.
|
static Certificate |
getCert(File ks,
String ksPW,
String alias)
Get a cert out of a keystore
|
static PrivateKey |
getPrivateKey(File ks,
String ksPW,
String alias,
String keyPW)
Get a private key out of a keystore
|
static String |
importPrivateKey(File ks,
String ksPW,
String alias,
String keyPW,
InputStream in)
Import the private key and certificate chain to a keystore.
|
static KeyStore |
loadSystemKeyStore()
Loads certs from location of javax.net.ssl.keyStore property,
else from $JAVA_HOME/lib/security/jssecacerts,
else from $JAVA_HOME/lib/security/cacerts.
|
static boolean |
logCertExpiration(File f,
String ksPW,
long expiresWithin)
Validate expiration for all private key certs in a key store.
|
static boolean |
logCertExpiration(KeyStore ks,
String location,
long expiresWithin)
Validate expiration for all private key certs in a key store.
|
static void |
main(String[] args)
Usage: KeyStoreUtil (loads from system keystore)
KeyStoreUtil foo.ks (loads from system keystore, and from foo.ks keystore if exists, else creates empty)
KeyStoreUtil certDir (loads from system keystore and all certs in certDir if exists)
KeyStoreUtil import file.ks file.key alias keypw (imports private key from file to keystore)
KeyStoreUtil export file.ks alias keypw (exports private key from keystore)
KeyStoreUtil keygen file.ks alias keypw (create keypair in keystore)
KeyStoreUtil keygen2 file.ks alias keypw (create keypair using I2PProvider)
|
static String |
randomString()
48 char b32 string (30 bytes of entropy)
|
static X509Certificate |
renewPrivateKeyCertificate(File ks,
String ksPW,
String alias,
String keyPW,
int validDays)
Renew the the private key certificate in a keystore.
|
static void |
storePrivateKey(File ks,
String ksPW,
String alias,
String keyPW,
PrivateKey pk,
List<X509Certificate> certs)
Import the private key and certificate chain to a keystore.
|
public static final String DEFAULT_KEYSTORE_PASSWORD
public static KeyStore createKeyStore(File ksFile, String password) throws GeneralSecurityException, IOException
ksFile
- may be nullpassword
- may be nullGeneralSecurityException
IOException
public static KeyStore loadSystemKeyStore()
public static int countCerts(KeyStore ks)
public static boolean logCertExpiration(File f, String ksPW, long expiresWithin)
f
- keystore fileksPW
- keystore passwordexpiresWithin
- ms if cert expires within this long, we will log a warning, e.g. 180*24*60*60*1000Lpublic static boolean logCertExpiration(KeyStore ks, String location, long expiresWithin)
location
- the path or other identifying info, for logging onlyexpiresWithin
- ms if cert expires within this long, we will log a warning, e.g. 180*24*60*60*1000Lpublic static int addCerts(File dir, KeyStore ks)
public static boolean addCert(File file, String alias, KeyStore ks)
public static boolean addCert(File file, String alias, KeyStore ks, CertStore cs)
cs
- may be null; if non-null, check for revocationpublic static String randomString()
public static boolean createKeys(File ks, String alias, String cname, String ou, String keyPW)
ks
- path to the keystorealias
- the name of the keycname
- e.g. localhost. Must be a hostname or email address. IP addresses will not be correctly encoded.ou
- e.g. consolekeyPW
- the key password, must be at least 6 characterspublic static boolean createKeys(File ks, String alias, String cname, Set<String> altNames, String ou, String keyPW)
ks
- path to the keystorealias
- the name of the keycname
- e.g. localhost. Must be a hostname or email address. IP addresses will not be correctly encoded.altNames
- the Subject Alternative Names. May be null. May contain hostnames and/or IP addresses.
cname, localhost, 127.0.0.1, and ::1 will be automatically added.ou
- e.g. consolekeyPW
- the key password, must be at least 6 characterspublic static boolean createKeys(File ks, String ksPW, String alias, String cname, String ou, int validDays, String keyAlg, int keySize, String keyPW)
ks
- path to the keystoreksPW
- the keystore passwordalias
- the name of the keycname
- e.g. localhost. Must be a hostname or email address. IP addresses will not be correctly encoded.ou
- e.g. consolevalidDays
- e.g. 3652 (10 years)keyAlg
- e.g. DSA , RSA, ECkeySize
- e.g. 1024keyPW
- the key password, must be at least 6 characterspublic static boolean createKeys(File ks, String ksPW, String alias, String cname, Set<String> altNames, String ou, int validDays, String keyAlg, int keySize, String keyPW)
ks
- path to the keystoreksPW
- the keystore passwordalias
- the name of the keycname
- e.g. localhost. Must be a hostname or email address. IP addresses will not be correctly encoded.altNames
- the Subject Alternative Names. May be null. May contain hostnames and/or IP addresses.
cname, localhost, 127.0.0.1, and ::1 will be automatically added.ou
- e.g. consolevalidDays
- e.g. 3652 (10 years)keyAlg
- e.g. DSA , RSA, ECkeySize
- e.g. 1024keyPW
- the key password, must be at least 6 characterspublic static Object[] createKeysAndCRL(File ks, String ksPW, String alias, String cname, String ou, int validDays, String keyAlg, int keySize, String keyPW) throws GeneralSecurityException, IOException
ks
- path to the keystoreksPW
- the keystore passwordalias
- the name of the keycname
- e.g. localhost. Must be a hostname or email address. IP addresses will not be correctly encoded.ou
- e.g. consolevalidDays
- e.g. 3652 (10 years)keyAlg
- e.g. DSA , RSA, ECkeySize
- e.g. 1024keyPW
- the key password, must be at least 6 charactersGeneralSecurityException
IOException
public static Object[] createKeysAndCRL(File ks, String ksPW, String alias, String cname, Set<String> altNames, String ou, int validDays, String keyAlg, int keySize, String keyPW) throws GeneralSecurityException, IOException
ks
- path to the keystoreksPW
- the keystore passwordalias
- the name of the keycname
- e.g. localhost. Must be a hostname or email address. IP addresses will not be correctly encoded.altNames
- the Subject Alternative Names. May be null. May contain hostnames and/or IP addresses.
cname, localhost, 127.0.0.1, and ::1 will be automatically added.ou
- e.g. consolevalidDays
- e.g. 3652 (10 years)keyAlg
- e.g. DSA , RSA, ECkeySize
- e.g. 1024keyPW
- the key password, must be at least 6 charactersGeneralSecurityException
IOException
public static Object[] createKeysAndCRL(File ks, String ksPW, String alias, String cname, String ou, int validDays, SigType type, String keyPW) throws GeneralSecurityException, IOException
ks
- path to the keystoreksPW
- the keystore passwordalias
- the name of the keycname
- e.g. localhost. Must be a hostname or email address. IP addresses will not be correctly encoded.ou
- e.g. consolevalidDays
- e.g. 3652 (10 years)keyPW
- the key password, must be at least 6 charactersGeneralSecurityException
IOException
public static Object[] createKeysAndCRL(File ks, String ksPW, String alias, String cname, Set<String> altNames, String ou, int validDays, SigType type, String keyPW) throws GeneralSecurityException, IOException
ks
- path to the keystoreksPW
- the keystore passwordalias
- the name of the keycname
- e.g. localhost. Must be a hostname or email address. IP addresses will not be correctly encoded.altNames
- the Subject Alternative Names. May be null. May contain hostnames and/or IP addresses.
cname, localhost, 127.0.0.1, and ::1 will be automatically added.ou
- e.g. consolevalidDays
- e.g. 3652 (10 years)keyPW
- the key password, must be at least 6 charactersGeneralSecurityException
IOException
public static PrivateKey getPrivateKey(File ks, String ksPW, String alias, String keyPW) throws GeneralSecurityException, IOException
ks
- path to the keystoreksPW
- the keystore password, may be nullalias
- the name of the keykeyPW
- the key password, must be at least 6 charactersGeneralSecurityException
IOException
public static void exportPrivateKey(File ks, String ksPW, String alias, String keyPW, OutputStream out) throws GeneralSecurityException, IOException
ks
- path to the keystoreksPW
- the keystore password, may be nullalias
- the name of the keykeyPW
- the key password, must be at least 6 charactersGeneralSecurityException
IOException
public static X509Certificate renewPrivateKeyCertificate(File ks, String ksPW, String alias, String keyPW, int validDays) throws GeneralSecurityException, IOException
ks
- path to the keystoreksPW
- the keystore password, may be nullalias
- the name of the key, or null to get the first one in keystorekeyPW
- the key password, must be at least 6 charactersvalidDays
- new cert to expire this many days from nowGeneralSecurityException
IOException
public static String importPrivateKey(File ks, String ksPW, String alias, String keyPW, InputStream in) throws GeneralSecurityException, IOException
ks
- path to the keystoreksPW
- the keystore password, may be nullalias
- the name of the key. If null, will be taken from the Subject CN
of the first certificate in the chain.keyPW
- the key password, must be at least 6 charactersGeneralSecurityException
IOException
public static void storePrivateKey(File ks, String ksPW, String alias, String keyPW, PrivateKey pk, List<X509Certificate> certs) throws GeneralSecurityException, IOException
ks
- path to the keystoreksPW
- the keystore password, may be nullalias
- the name of the key, non-null.keyPW
- the key password, must be at least 6 charactersGeneralSecurityException
IOException
public static Certificate getCert(File ks, String ksPW, String alias) throws GeneralSecurityException, IOException
ks
- path to the keystoreksPW
- the keystore password, may be nullalias
- the name of the keyGeneralSecurityException
IOException
public static boolean exportCert(File ks, String ksPW, String alias, File certFile)
ks
- path to the keystoreksPW
- the keystore password, may be nullalias
- the name of the keycertFile
- outputpublic static void main(String[] args)