KeytoolSelfSignedCertGenerator Class — netty Architecture

Source Code

handler/src/main/java/io/netty/handler/ssl/util/KeytoolSelfSignedCertGenerator.java lines 42–142

final class KeytoolSelfSignedCertGenerator {
    private static final DateTimeFormatter DATE_FORMAT =
            DateTimeFormatter.ofPattern("yyyy/MM/dd HH:mm:ss", Locale.ROOT);
    private static final String ALIAS = "alias";
    private static final String PASSWORD = "insecurepassword";
    private static final Path KEYTOOL;
    private static final String KEY_STORE_TYPE;

    static {
        String home = System.getProperty("java.home");
        if (home == null) {
            KEYTOOL = null;
        } else {
            Path likely = Paths.get(home).resolve("bin").resolve("keytool");
            if (Files.exists(likely)) {
                KEYTOOL = likely;
            } else {
                KEYTOOL = null;
            }
        }
        // Java < 11 does not support encryption for PKCS#12: JDK-8220734
        // For 11+, we prefer PKCS#12 for FIPS compliance
        KEY_STORE_TYPE = PlatformDependent.javaVersion() >= 11 ? "PKCS12" : "JKS";
    }

    private KeytoolSelfSignedCertGenerator() {
    }

    static boolean isAvailable() {
        return KEYTOOL != null;
    }

    static void generate(SelfSignedCertificate.Builder builder) throws IOException, GeneralSecurityException {
        // Change all asterisk to 'x' for file name safety.
        String dirFqdn = builder.fqdn.replaceAll("[^\\w.-]", "x");

        Path directory = Files.createTempDirectory("keytool_" + dirFqdn);
        Path keyStore = directory.resolve("keystore.jks");
        try {
            Process process = new ProcessBuilder()
                    .command(
                            KEYTOOL.toAbsolutePath().toString(),
                            "-genkeypair",
                            "-keyalg", builder.algorithm,
                            "-keysize", String.valueOf(builder.bits),
                            "-startdate", DATE_FORMAT.format(
                                    builder.notBefore.toInstant().atZone(ZoneId.systemDefault())),
                            "-validity", String.valueOf(builder.notBefore.toInstant().until(
                                    builder.notAfter.toInstant(), ChronoUnit.DAYS)),
                            "-keystore", keyStore.toString(),
                            "-alias", ALIAS,
                            "-keypass", PASSWORD,
                            "-storepass", PASSWORD,
                            "-dname", "CN=" + builder.fqdn,
                            "-storetype", KEY_STORE_TYPE
                    )
                    .redirectErrorStream(true)
                    .start();
            try {
                if (!process.waitFor(60, TimeUnit.SECONDS)) {
                    process.destroyForcibly();
                    throw new IOException("keytool timeout");
                }
            } catch (InterruptedException e) {
                process.destroyForcibly();
                Thread.currentThread().interrupt();
                throw new InterruptedIOException();
            }

            if (process.exitValue() != 0) {
                ByteBuf buffer = Unpooled.buffer();
                try {
                    try (InputStream stream = process.getInputStream()) {
                        while (true) {
                            if (buffer.writeBytes(stream, 4096) == -1) {
                                break;
                            }
                        }
                    }
                    String log = buffer.toString(StandardCharsets.UTF_8);
                    throw new IOException("Keytool exited with status " + process.exitValue() + ": " + log);