Package org.microproxy.tls

Class CertificateBuilder

java.lang.Object
org.microproxy.tls.CertificateBuilder
public final class CertificateBuilder extends Object
Builds and signs X.509 v3 certificates with nothing but the JDK, which has no public certificate-generation API. Supports what a TLS-intercepting proxy needs: CA certificates and server certificates with subject alternative names, signed with ECDSA or RSA (SHA-256).

  • Constructor Details

    • CertificateBuilder

      public CertificateBuilder()
      Starts a self-signed server certificate with the default subject and validity.

  • Method Details

    • subject

      public CertificateBuilder subject(String commonName, String organization)
      Sets the certificate subject.
      Parameters:
      commonName - the certificate subject common name
      organization - the subject organization
      Returns:
      this builder

    • issuer

      public CertificateBuilder issuer(X509Certificate issuer)
      The issuing CA certificate; leave unset for a self-signed certificate.
      Parameters:
      issuer - the issuing CA certificate
      Returns:
      this builder

    • publicKey

      public CertificateBuilder publicKey(PublicKey publicKey)
      Sets the public key certified by this certificate.
      Parameters:
      publicKey - the public key to certify
      Returns:
      this builder

    • validity

      public CertificateBuilder validity(Instant notBefore, Instant notAfter)
      Sets the certificate validity interval.
      Parameters:
      notBefore - the start of the validity interval
      notAfter - the end of the validity interval
      Returns:
      this builder

    • certificateAuthority

      public CertificateBuilder certificateAuthority(boolean ca)
      Sets whether the certificate may issue other certificates.
      Parameters:
      ca - whether the certificate may sign other certificates
      Returns:
      this builder

    • addSubjectAltName

      public CertificateBuilder addSubjectAltName(String nameOrIp)
      Adds a DNS name or IP literal to the subject alternative names.
      Parameters:
      nameOrIp - the DNS name or IP literal to add
      Returns:
      this builder

    • sign

      public X509Certificate sign(PrivateKey signingKey) throws GeneralSecurityException
      Signs the certificate with signingKey (the issuer's key, or the subject's own).
      Parameters:
      signingKey - the private key used to sign the certificate
      Returns:
      the signed certificate
      Throws:
      GeneralSecurityException - if the certificate cannot be signed