Package org.microproxy.tls

Class CertificateAuthority

java.lang.Object
org.microproxy.tls.CertificateAuthority
public final class CertificateAuthority extends Object
A certificate authority that issues server certificates on the fly. Install its certificate (getCertificatePem()) in clients that should accept intercepted connections.

  • Constructor Details

    • CertificateAuthority

      public CertificateAuthority(PrivateKey privateKey, X509Certificate certificate)
      Uses an existing CA private key and certificate.
      Parameters:
      privateKey - the CA signing private key
      certificate - the CA certificate

  • Method Details

    • generate

      public static CertificateAuthority generate(String commonName)
      Generates a new CA with an EC P-256 key, valid for ten years.
      Parameters:
      commonName - the certificate subject common name
      Returns:
      the new certificate authority

    • load

      public static CertificateAuthority load(Path keyStore, char[] password) throws IOException
      Loads the first key entry of a PKCS#12 (or JKS) key store.
      Parameters:
      keyStore - the key-store file
      password - the key-store password
      Returns:
      the loaded certificate authority
      Throws:
      IOException - if the key store cannot be read or contains no usable CA key entry

    • loadOrCreate

      public static CertificateAuthority loadOrCreate(Path keyStore, char[] password, String commonName) throws IOException
      Loads the CA from keyStore, generating and saving a new one if it does not exist.
      Parameters:
      keyStore - the key-store file
      password - the key-store password
      commonName - the certificate subject common name
      Returns:
      the loaded or newly generated certificate authority
      Throws:
      IOException - if the CA key store cannot be loaded or saved

    • save

      public void save(Path keyStore, char[] password) throws IOException
      Saves key and certificate as PKCS#12.
      Parameters:
      keyStore - the key-store file
      password - the key-store password
      Throws:
      IOException - if the CA key store cannot be written

    • getCertificate

      public X509Certificate getCertificate()
      Returns the signing CA certificate.
      Returns:
      the signing CA certificate

    • getPrivateKey

      public PrivateKey getPrivateKey()
      Returns the CA private key.
      Returns:
      the CA private key

    • getCertificatePem

      public String getCertificatePem()
      Returns the CA certificate in PEM format.
      Returns:
      the CA certificate in PEM format

    • writeCertificatePem

      public void writeCertificatePem(Path file) throws IOException
      Writes the CA certificate in PEM format.
      Parameters:
      file - the destination PEM file
      Throws:
      IOException - if the certificate file cannot be written

    • issue

      public X509Certificate issue(PublicKey subjectKey, Collection<String> names)
      Issues a server certificate for names (DNS names or IP literals; the first is also the common name), valid for at most a year and never beyond the CA's own expiry.
      Parameters:
      subjectKey - the public key of the certificate subject
      names - the DNS names or IP literals to include in the certificate
      Returns:
      the signed server certificate

    • serverContext

      public SSLContext serverContext(String... names)
      A server-side SSLContext presenting a fresh certificate for names.
      Parameters:
      names - the DNS names or IP literals to include in the certificate
      Returns:
      a server-side SSLContext presenting a fresh certificate for names

    • clientContext

      public SSLContext clientContext()
      Returns a client-side SSLContext that trusts only this CA.
      Returns:
      a client-side SSLContext that trusts only this CA