How to do SSL connection using .pfx
key file and password in java (HTTPClient)
If you are going to use HTTPClient to extract the java understanding
TrustStore, KeyStore are very impotent.
KeyStore: Is
nothing but private key (.pfx and
its password) information that client is used to connect remote machine. Used by client.
Truststore :
Which contains trusted certificates chain. Used
by server.
Why we need these certificates while connecting from HTTP client/java?
In client server communication first client send “hello”
request. Server would replay to this with “hello” response. The response also
contains the certificate usually “singed by CA” and ask the client something
say do you trust this certificate? Then client
(java) looks for this certificate in the truststore
(certificate chain) whether this certificate can be trusted or not? If this
certificate in trust store, client send “true” to Server. Once client trust the certificate, server
allows accessing to server method. If server
method access restricted it looks for private key and its password.
This is all happens in fraction of mile seconds and this is
called a HAND-SHAKE. If anything goes wrong in handshake we get handshake
exception.
Connecting to server using httpclient is all about
configuring the right sslcontext.
Below is the abstract
java class you can use this directly by extending to your own class. This class
would create write client for you.
If you don’t have “truststore” and just need to trust all certificates
blindly use below method to create client.
getHttpClientWithoutTrustKey()
If you created trust store than use below method to get client
DefaultHttpClient getHttpClient()
In both methods it is important to understand how I am
creating keystore,truststore, and SSLContext.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
| package com.my.downloaders;
import java.io.File;
import java.io.FileInputStream;
import java.io.FileNotFoundException;
import java.security.KeyManagementException;
import java.security.KeyStore;
import java.security.KeyStoreException;
import java.security.NoSuchAlgorithmException;
import java.security.NoSuchProviderException;
import java.security.SecureRandom;
import java.security.UnrecoverableKeyException;
import java.security.cert.X509Certificate;
import java.util.logging.Level;
import java.util.logging.Logger;
import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.SSLContext;
import javax.net.ssl.TrustManager;
import javax.net.ssl.X509TrustManager;
import org.apache.http.conn.scheme.Scheme;
import org.apache.http.conn.ssl.SSLSocketFactory;
import org.apache.http.impl.client.DefaultHttpClient;
import org.springframework.util.Assert;
/*
* keytool -keystore <trustore name> -import -alias <alias name >-file certificate.cer -trustcacerts
*/
public abstract class AbstractHTTPSWithPrivateKeyDownloader {
private static Logger logger = Logger.getLogger(AbstractHTTPSWithPrivateKeyDownloader.class.getName());
public String trustStoreKey;//="truststore location";
public String trustStorePass;//="trustostore";
public String keyStoreKey;//=”absolute path to .pfx file”;
public String keyStorePassowrd;//="";
public String privatePassWord;//="it is same as keyStorePassowrd ";
public void afterPropertiesSet() throws Exception {
Assert.notNull(keyStorePassowrd, "keyStorePassowrd property cannot be NULL.");
Assert.notNull(keyStoreKey, "keyStore property cannot be NULL.");
}
public abstract void doExecute() throws Exception;
public void setTrustStoreKey(String trustStoreKey) {
this.trustStoreKey = trustStoreKey;
}
public void setTrustStorePass(String trustStorePass) {
this.trustStorePass = trustStorePass;
}
public void setKeyStoreKey(String keyStoreKey) {
this.keyStoreKey = keyStoreKey;
}
public void setKeyStorePassowrd(String keyStorePassowrd) {
this.keyStorePassowrd = keyStorePassowrd;
this.privatePassWord=keyStorePassowrd;
}
protected DefaultHttpClient getHttpClient() throws Exception{
try
{
KeyStore trustStore = getTrustoStore(new File(trustStoreKey),
trustStorePass);
KeyStore keyStore = getKeyStore(new File(keyStoreKey), keyStorePassowrd);
SSLSocketFactory socketFactory = getSSLSocketFactory(
privatePassWord, trustStore, keyStore);
Scheme sch = new Scheme("https", 443, socketFactory);
DefaultHttpClient httpclient = new DefaultHttpClient();
httpclient.getConnectionManager().getSchemeRegistry().register(sch);
return httpclient;
}
catch(Exception e)
{
logger.log(Level.WARNING, e.getMessage(), e);
return getHttpClientWithoutTrustKey();
}
}
protected DefaultHttpClient getHttpClientWithoutTrustKey() throws Exception{
KeyStore keyStore = getKeyStore(new File(keyStoreKey), keyStorePassowrd);
KeyManagerFactory kmfactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
kmfactory.init(keyStore, keyStorePassowrd.toCharArray());
SSLContext sslContext = SSLContext.getInstance("SSL");
// set up a TrustManager that trusts everything
sslContext.init(kmfactory.getKeyManagers(), new TrustManager[] { new X509TrustManager() {
public X509Certificate[] getAcceptedIssuers() {
logger.info("getAcceptedIssuers =============");
return null;
}
public void checkClientTrusted(X509Certificate[] certs,
String authType) {
logger.info("checkClientTrusted =============");
}
public void checkServerTrusted(X509Certificate[] certs,
String authType) {
logger.info("checkServerTrusted =============");
}
} }, new SecureRandom());
SSLSocketFactory socketFactory = new SSLSocketFactory(sslContext);
Scheme sch = new Scheme("https", 443, socketFactory);
DefaultHttpClient httpclient = new DefaultHttpClient();
httpclient.getConnectionManager().getSchemeRegistry().register(sch);
return httpclient;
}
protected SSLSocketFactory getSSLSocketFactory(
String privateKeyPassword, KeyStore trustStore, KeyStore keyStore)
throws NoSuchAlgorithmException, KeyManagementException,
KeyStoreException {
SSLSocketFactory socketFactory = null;
try {
socketFactory = new SSLSocketFactory(keyStore, privateKeyPassword,
trustStore);
} catch (UnrecoverableKeyException ke) {
logger.severe("Failed to create SSLSocketFactory, possible wrong password on client private key");
}
return socketFactory;
}
protected static KeyStore getTrustoStore(File truststoreFile,
String truststorePassword) throws Exception {
KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
FileInputStream trustStream = new FileInputStream(truststoreFile);
try {
logger.info("Loading server truststore from file "
+ truststoreFile.getPath());
trustStore.load(trustStream, truststorePassword.toCharArray());
logger.info("Truststore certificate count: "
+ trustStore.size());
} catch (Exception ex) {
logger.severe("Failed to load truststore: " + ex.toString());
throw ex;
} finally {
try {
trustStream.close();
} catch (Exception ignore) {
}
}
return trustStore;
}
protected static KeyStore getKeyStore(File keystoreFile,
String keystorePassword) throws KeyStoreException,
NoSuchProviderException, FileNotFoundException {
KeyStore keyStore = KeyStore.getInstance("PKCS12", "SunJSSE");
FileInputStream keyStream = new FileInputStream(keystoreFile);
try {
logger.info("Loading client keystore from file "
+ keystoreFile.getPath());
keyStore.load(keyStream, keystorePassword.toCharArray());
logger.info("Keystore certificate count: " + keyStore.size());
} catch (Exception e) {
System.err.println("Failed to load keystore: " + e.toString());
logger.log(Level.SEVERE, e.getMessage(), e);
} finally {
try {
keyStream.close();
} catch (Exception e) {
logger.log(Level.WARNING, e.getMessage(), e);
}
}
return keyStore;
}
}
|
How to use the above class?
Create a URI and override the doExcecute() method.
public class CliendDownloader extends
AbstractHTTPSWithPrivateKeyDownloader implements Tasklet,
InitializingBean {
static {
System.setProperty("sun.security.ssl.allowUnsafeRenegotiation","true");
}
private static Logger logger = Logger.getLogger(CliendDownloader.class.getName());
public String url;
public void setUrl(String url) {
this.url = url;
}
public void doExecute() throws Exception {
URI
targetURI = new URI(url.trim());
String
protocol = targetURI.getScheme();
if (!"https".equals(protocol)) {
logger.severe("URI does not
begin with expected protocol name");
return;
}
logger.info("URI to fetch
is "
+ targetURI.toString());
DefaultHttpClient
httpclient =null;
try {
if(trustStoreKey!=null && trustStorePass!=null)
{
httpclient
= getHttpClient();
}
else
{
httpclient
= getHttpClientWithoutTrustKey();
}
HttpGet
httpget = new HttpGet(targetURI);
HttpResponse
response = null;
try {
response
= httpclient.execute(httpget);
-----------
-------
}
}
How to create trust store?
If you would like to have trustore
Import the certificate from IE browser download in .cer format and run
the below command.
keytool -keystore <trustore
name> -import -alias <alias name > -file certificate.cer -trustcacerts
