Top Description Fields Constructors Methods
io.netty.handler.ssl.util

public final Class SelfSignedCertificate

extends Object
Class Inheritance
Imports
io.netty.buffer.ByteBuf, .Unpooled, io.netty.handler.codec.base64.Base64, io.netty.util.CharsetUtil, io.netty.util.internal.PlatformDependent, .SystemPropertyUtil, .ThrowableUtil, io.netty.util.internal.logging.InternalLogger, .InternalLoggerFactory, java.io.File, .FileInputStream, .FileOutputStream, .IOException, .OutputStream, java.security.KeyPair, .KeyPairGenerator, .NoSuchAlgorithmException, .PrivateKey, .SecureRandom, java.security.cert.CertificateEncodingException, .CertificateException, .CertificateFactory, .X509Certificate, java.util.Date
Generates a temporary self-signed certificate for testing purposes.

Note

Never use the certificate and private key generated by this class in production. It is purely for testing purposes, and thus it is very insecure. It even uses an insecure pseudo-random generator for faster generation internally.

An X.509 certificate file and a EC/RSA private key file are generated in a system's temporary directory using java.io.File#createTempFile(String, String), and they are deleted when the JVM exits using java.io.File#deleteOnExit().

At first, this method tries to use OpenJDK's X.509 implementation (the sun.security.x509 package). If it fails, it tries to use Bouncy Castle as a fallback.

Field Summary

Modifier and TypeField and Description
private final X509Certificate
cert

private final File
certificate

private static final int
DEFAULT_KEY_LENGTH_BITS

FIPS 140-2 encryption requires the RSA key length to be 2048 bits or greater.

private static final Date
DEFAULT_NOT_AFTER

The maximum possible value in X.509 specification: 9999-12-31 23:59:59

private static final Date
DEFAULT_NOT_BEFORE

Current time minus 1 year, just in case software clock goes back due to time synchronization

private final PrivateKey
key

private static final InternalLogger
logger

private final File
privateKey

Constructor Summary

AccessConstructor and Description
public
SelfSignedCertificate()

Creates a new instance.

public
SelfSignedCertificate(Date
Certificate is not valid before this time
notBefore, Date
Certificate is not valid after this time
notAfter)

Creates a new instance.

public
SelfSignedCertificate(Date
Certificate is not valid before this time
notBefore, Date
Certificate is not valid after this time
notAfter, String
Key pair algorithm
algorithm, int
the number of bits of the generated private key
bits)

Creates a new instance.

public
SelfSignedCertificate(String
a fully qualified domain name
fqdn)

Creates a new instance.

public
SelfSignedCertificate(String
a fully qualified domain name
fqdn, String
Key pair algorithm
algorithm, int
the number of bits of the generated private key
bits)

Creates a new instance.

public
SelfSignedCertificate(String
a fully qualified domain name
fqdn, Date
Certificate is not valid before this time
notBefore, Date
Certificate is not valid after this time
notAfter)

Creates a new instance.

public
SelfSignedCertificate(String
a fully qualified domain name
fqdn, Date
Certificate is not valid before this time
notBefore, Date
Certificate is not valid after this time
notAfter, String
Key pair algorithm
algorithm, int
the number of bits of the generated private key
bits)

Creates a new instance.

public
SelfSignedCertificate(String
a fully qualified domain name
fqdn, SecureRandom
the SecureRandom to use
random, int
the number of bits of the generated private key
bits)

Creates a new instance.

public
SelfSignedCertificate(String
a fully qualified domain name
fqdn, SecureRandom
the SecureRandom to use
random, String
Key pair algorithm
algorithm, int
the number of bits of the generated private key
bits)

Creates a new instance.

public
SelfSignedCertificate(String
a fully qualified domain name
fqdn, SecureRandom
the SecureRandom to use
random, int
the number of bits of the generated private key
bits, Date
Certificate is not valid before this time
notBefore, Date
Certificate is not valid after this time
notAfter)

Creates a new instance.

public
SelfSignedCertificate(String
a fully qualified domain name
fqdn, SecureRandom
the SecureRandom to use
random, int
the number of bits of the generated private key
bits, Date
Certificate is not valid before this time
notBefore, Date
Certificate is not valid after this time
notAfter, String
Key pair algorithm
algorithm)

Creates a new instance.

Method Summary

Modifier and TypeMethod and Description
public X509Certificate
cert()

Returns the generated X.509 certificate.

public File
certificate()

Returns the generated X.509 certificate file in PEM format.

public void
delete()

Deletes the generated X.509 certificate file and EC/RSA private key file.

private static boolean
isBouncyCastleAvailable()

public PrivateKey
key()

Returns the generated EC/RSA private key.

pack-priv static String[]
newSelfSignedCertificate(String fqdn, PrivateKey key, X509Certificate cert)

public File
privateKey()

Returns the generated EC/RSA private key file in PEM format.

private static void
safeClose(File keyFile, OutputStream keyOut)

private static void
safeDelete(File certFile)

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

certback to summary
private final X509Certificate cert
certificateback to summary
private final File certificate
DEFAULT_KEY_LENGTH_BITSback to summary
private static final int DEFAULT_KEY_LENGTH_BITS

FIPS 140-2 encryption requires the RSA key length to be 2048 bits or greater. Let's use that as a sane default but allow the default to be set dynamically for those that need more stringent security requirements.

DEFAULT_NOT_AFTERback to summary
private static final Date DEFAULT_NOT_AFTER

The maximum possible value in X.509 specification: 9999-12-31 23:59:59

DEFAULT_NOT_BEFOREback to summary
private static final Date DEFAULT_NOT_BEFORE

Current time minus 1 year, just in case software clock goes back due to time synchronization

keyback to summary
private final PrivateKey key
loggerback to summary
private static final InternalLogger logger
privateKeyback to summary
private final File privateKey

Constructor Detail

SelfSignedCertificateback to summary
public SelfSignedCertificate() throws CertificateException

Creates a new instance.

Algorithm: RSA

SelfSignedCertificateback to summary
public SelfSignedCertificate(Date notBefore, Date notAfter) throws CertificateException

Creates a new instance.

Algorithm: RSA

Parameters
notBefore:Date

Certificate is not valid before this time

notAfter:Date

Certificate is not valid after this time

SelfSignedCertificateback to summary
public SelfSignedCertificate(Date notBefore, Date notAfter, String algorithm, int bits) throws CertificateException

Creates a new instance.

Parameters
notBefore:Date

Certificate is not valid before this time

notAfter:Date

Certificate is not valid after this time

algorithm:String

Key pair algorithm

bits:int

the number of bits of the generated private key

SelfSignedCertificateback to summary
public SelfSignedCertificate(String fqdn) throws CertificateException

Creates a new instance.

Algorithm: RSA

Parameters
fqdn:String

a fully qualified domain name

SelfSignedCertificateback to summary
public SelfSignedCertificate(String fqdn, String algorithm, int bits) throws CertificateException

Creates a new instance.

Parameters
fqdn:String

a fully qualified domain name

algorithm:String

Key pair algorithm

bits:int

the number of bits of the generated private key

SelfSignedCertificateback to summary
public SelfSignedCertificate(String fqdn, Date notBefore, Date notAfter) throws CertificateException

Creates a new instance.

Algorithm: RSA

Parameters
fqdn:String

a fully qualified domain name

notBefore:Date

Certificate is not valid before this time

notAfter:Date

Certificate is not valid after this time

SelfSignedCertificateback to summary
public SelfSignedCertificate(String fqdn, Date notBefore, Date notAfter, String algorithm, int bits) throws CertificateException

Creates a new instance.

Parameters
fqdn:String

a fully qualified domain name

notBefore:Date

Certificate is not valid before this time

notAfter:Date

Certificate is not valid after this time

algorithm:String

Key pair algorithm

bits:int

the number of bits of the generated private key

SelfSignedCertificateback to summary
public SelfSignedCertificate(String fqdn, SecureRandom random, int bits) throws CertificateException

Creates a new instance.

Algorithm: RSA

Parameters
fqdn:String

a fully qualified domain name

random:SecureRandom

the SecureRandom to use

bits:int

the number of bits of the generated private key

SelfSignedCertificateback to summary
public SelfSignedCertificate(String fqdn, SecureRandom random, String algorithm, int bits) throws CertificateException

Creates a new instance.

Parameters
fqdn:String

a fully qualified domain name

random:SecureRandom

the SecureRandom to use

algorithm:String

Key pair algorithm

bits:int

the number of bits of the generated private key

SelfSignedCertificateback to summary
public SelfSignedCertificate(String fqdn, SecureRandom random, int bits, Date notBefore, Date notAfter) throws CertificateException

Creates a new instance.

Algorithm: RSA

Parameters
fqdn:String

a fully qualified domain name

random:SecureRandom

the SecureRandom to use

bits:int

the number of bits of the generated private key

notBefore:Date

Certificate is not valid before this time

notAfter:Date

Certificate is not valid after this time

SelfSignedCertificateback to summary
public SelfSignedCertificate(String fqdn, SecureRandom random, int bits, Date notBefore, Date notAfter, String algorithm) throws CertificateException

Creates a new instance.

Parameters
fqdn:String

a fully qualified domain name

random:SecureRandom

the SecureRandom to use

bits:int

the number of bits of the generated private key

notBefore:Date

Certificate is not valid before this time

notAfter:Date

Certificate is not valid after this time

algorithm:String

Key pair algorithm

Method Detail

certback to summary
public X509Certificate cert()

Returns the generated X.509 certificate.

certificateback to summary
public File certificate()

Returns the generated X.509 certificate file in PEM format.

deleteback to summary
public void delete()

Deletes the generated X.509 certificate file and EC/RSA private key file.

isBouncyCastleAvailableback to summary
private static boolean isBouncyCastleAvailable()
keyback to summary
public PrivateKey key()

Returns the generated EC/RSA private key.

newSelfSignedCertificateback to summary
pack-priv static String[] newSelfSignedCertificate(String fqdn, PrivateKey key, X509Certificate cert) throws IOException, CertificateEncodingException
privateKeyback to summary
public File privateKey()

Returns the generated EC/RSA private key file in PEM format.

safeCloseback to summary
private static void safeClose(File keyFile, OutputStream keyOut)
safeDeleteback to summary
private static void safeDelete(File certFile)