How to have multiple SSL certificates for Java server
I have an internal HTTP server written in Java; the full source code is at my disposal. The HTTP server can be configured with any number of websites, each with a separate listening socket, which is created with the following command:
skt=SSLServerSocketFactory.getDefault().createServerSocket(prt,bcklog,adr);
Using the standard keystore created by Java keytools, I can't for the life of me figure out how to get the different certificates associated with the different listening sockets so that each configured website has its own certificate.
I'm in a pinch right now, so would appreciate some code samples that illustrate examples. However, I'd be happy with any good overview of how JSSE fits together anyway (I've searched Sun's JSSE doco until my brain hurts (literally, though probably caffeine withdrawal) caused).
edit
Isn't there an easy way to associate the server certificate in the keystore with the listening socket using an alias? so that:
- The client has a keystore to manage all certificates, and
- No need to fiddle with multiple keystores etc.
I got the impression (earlier this afternoon) that I could write a simple KeyManager that just chooseServerAlias(...)returns non-null, which is the name of the alias I want - does anyone have any ideas for this reasoning?
untie
The solution I used, built on slyvarking 's answer , was to create an ephemeral keystore and populate that ephemeral keystore with the required keys/certs pulled from a single external keystore. Anyone interested can use the following code (svrctfals is my "Server Certificate Alias" value):
SSLServerSocketFactory ssf; // server socket factory
SSLServerSocket skt; // server socket
// LOAD EXTERNAL KEY STORE
KeyStore mstkst;
try {
String kstfil=GlobalSettings.getString("javax.net.ssl.keyStore" ,System.getProperty("javax.net.ssl.keyStore" ,""));
String ksttyp=GlobalSettings.getString("javax.net.ssl.keyStoreType" ,System.getProperty("javax.net.ssl.keyStoreType" ,"jks"));
char[] kstpwd=GlobalSettings.getString("javax.net.ssl.keyStorePassword",System.getProperty("javax.net.ssl.keyStorePassword","")).toCharArray();
mstkst=KeyStore.getInstance(ksttyp);
mstkst.load(new FileInputStream(kstfil),kstpwd);
}
catch(java.security.GeneralSecurityException thr) {
throw new IOException("Cannot load keystore ("+thr+")");
}
// CREATE EPHEMERAL KEYSTORE FOR THIS SOCKET USING DESIRED CERTIFICATE
try {
SSLContext ctx=SSLContext.getInstance("TLS");
KeyManagerFactory kmf=KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
KeyStore sktkst;
char[] blkpwd=new char[0];
sktkst=KeyStore.getInstance("jks");
sktkst.load(null,blkpwd);
sktkst.setKeyEntry(svrctfals,mstkst.getKey(svrctfals,blkpwd),blkpwd,mstkst.getCertificateChain(svrctfals));
kmf.init(sktkst,blkpwd);
ctx.init(kmf.getKeyManagers(),null,null);
ssf=ctx.getServerSocketFactory();
}
catch(java.security.GeneralSecurityException thr) {
throw new IOException("Cannot create secure socket ("+thr+")");
}
// CREATE AND INITIALIZE SERVER SOCKET
skt=(SSLServerSocket)ssf.createServerSocket(prt,bcklog,adr);
...
return skt;
The easiest way is to use a single certificate for all domains. Put all other site names into SAN (Subject Alternative Name).
If you want to use one certificate per domain name, you can write your own key manager and use an alias to identify the domain so that a single keystore can be used. In our system, we agree that the keystore alias is always equal to the CN in the certificate. So we can do something like this,
SSLContext sctx1 = SSLContext.getInstance("SSLv3");
sctx1.init(new X509KeyManager[] {
new MyKeyManager("/config/master.jks","changeme".toCharArray(),"site1.example.com")
},null, null);
SSLServerSocketFactory ssf = (SSLServerSocketFactory) sctx1.getServerSocketFactory();
ServerSocket ss1 = ssf.createServerSocket(1234);
...
SSLContext sctx2 = SSLContext.getInstance("SSLv3");
sctx2.init(new X509KeyManager[] {
new MyKeyManager("/config/master.jks","changeme".toCharArray(),"site2.example.com")
},null, null);
ssf = (SSLServerSocketFactory) sctx2.getServerSocketFactory();
ServerSocket ss2 = ssf.createServerSocket(5678);
...
public static class MyKeyManager implements X509KeyManager {
private KeyStore keyStore;
private String alias;
private char[] password;
MyKeyManager(String keyStoreFile, char[] password, String alias)
throws IOException, GeneralSecurityException
{
this.alias = alias;
this.password = password;
InputStream stream = new FileInputStream(keyStoreFile);
keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
keyStore.load(stream, password);
}
public PrivateKey getPrivateKey(String alias) {
try {
return (PrivateKey) keyStore.getKey(alias, password);
} catch (Exception e) {
return null;
}
}
public X509Certificate[] getCertificateChain(String alias) {
try {
java.security.cert.Certificate[] certs = keyStore.getCertificateChain(alias);
if (certs == null || certs.length == 0)
return null;
X509Certificate[] x509 = new X509Certificate[certs.length];
for (int i = 0; i < certs.length; i++)
x509[i] = (X509Certificate)certs[i];
return x509;
} catch (Exception e) {
return null;
}
}
public String chooseServerAlias(String keyType, Principal[] issuers,
Socket socket) {
return alias;
}
public String[] getClientAliases(String parm1, Principal[] parm2) {
throw new UnsupportedOperationException("Method getClientAliases() not yet implemented.");
}
public String chooseClientAlias(String keyTypes[], Principal[] issuers, Socket socket) {
throw new UnsupportedOperationException("Method chooseClientAlias() not yet implemented.");
}
public String[] getServerAliases(String parm1, Principal[] parm2) {
return new String[] { alias };
}
public String chooseServerAlias(String parm1, Principal[] parm2) {
return alias;
}
}