Key Points

1. Java supports full security management - stores, certificates, keys in different key stores

References

This file contains the object definitions for the certs and other
# information "built into" NSS.

Key Concepts

Certificate and PKI concepts

https://support.code42.com/Administrator/6/Configuring/Install_a_CA-signed_SSL_certificate_for_HTTPS_console_access

These instructions use the following terms:

• Key: A unique string of characters that seeds a mathematical algorithm for encryption and decryption. Keys come in pairs. A public key encrypts data to be decrypted with the corresponding private key.
• Certificate: A file that contains a public key and identifies who owns that key and its corresponding private key. In a signed certificate, a trusted certificate authority (CA) affirms that a public key does indeed belong to the owner named in the certificate. A certificate chain links a public key to a widely trusted root certificate.
• Keystore: A file that holds a combination of keys and certificates.
• PKCS, PFX: A binary format for key, certificate, and keystore files. Typical file names are *.pkcs, *.p12, *.p7b, *.pfx
• Java keystore: The binary format for keystores used by Code42 servers. Typical file names are .keystore and *.jks
• PEM: An ASCII text format for keys and certificates. Typical file extensions are *.pem, *.key, *.csr, *.cert. The binary counterpart is DER-format file. An X.509 certificate may or may not be in PEM format.

To identify a PEM file, read it with a console or text editor. If you see ASCII text, it's a PEM file.

Java Keytool Management

https://support.code42.com/Administrator/6/Configuring/Install_a_CA-signed_SSL_certificate_for_HTTPS_console_access

keytool -genkeypair -alias <your.domain.com> -storetype jks -keystore <your.domain.com>.jks -validity 366 -keyalg RSA -keysize 4096

What is your first and last name? <your.domain.com>
What is the name of your organizational unit? yourunit
What is the name of your organization? yourorg
What is the name of your City or Locality? yourcity
What is the name of your State or Province? yourstate
What is the two-letter country code for this unit? US

keytool -certreq -alias <your.domain.com> -file <your.domain.com>.csr 
        -keystore <your.domain.com>.jks -ext san=dns:<your.domain.com> 

keytool -importcert -alias <your.domain.com> -file <CAreply.pkcs> -keystore <your.domain.com>.jks -trustcacerts

keytool -importcert -alias root -file <root.cert.pem> -keystore <your.domain.com>.jks -trustcacerts
keytool -importcert -alias intermediate -file <intermediate.cert.pem> -keystore <your.domain.com>.jks -trustcacerts
keytool -importcert -alias intermediat2 -file <intermediat2.cert.pem> -keystore <your.domain.com>.jks -trustcacerts
keytool -importcert -alias <your.domain.com> -file <server.cert.pem> -keystore <your.domain.com>.jks -trustcacerts

openssl pkcs12 -export -in <server.cert.pem> -inkey <private.key.pem> -certfile <intermediate.cert.pem> -name "<your.domain.com>" -out <your.domain.com>.p12

keytool -importkeystore -srckeystore <your.domain.com.p12> -srcstoretype PKCS12 -destkeystore <your.domain.com>.jks -deststoretype jks

Certificate Use Cases

Client and Server SSL encryption of messages using PKI concept

1. Client and server each have their own private key and matching public key
2. Client and server exchange public keys as certificates
3. For each message sent, the source system encrypts the message with the private key
4. For each message received, the receiver uses the public key to decrypt the message

Server setup for PKI certificates approved by a CA

1. Typically a server is setup by a Certificate Authority administrator in a very secure environment.
2. The CA is often an intermediate CA with a trust chain back to a root CA ( Verisign, Thawte or other root CA )
3. Certificate files will often use a user, domain name or server name depending on planned usage
4. Private keys are generated and usually well protected in a secure key store.
5. A CSR ( Certificate Signing Request ) is generated for root CA authentication ( vs self signed certs )
6. the server CA reviews and approves the CSR providing a complete trust chain to a root CA
7. The public key is generated from the private key as a certificate PEM file normally.
8. If needed, a PKCS12 file can be generated from the private key as a format to send the certificate to the client

Client setup for PKI certificates

Key management and distribution concepts

private keys can have a pass phrase to protect access

better use an encrypted wrapper with a password for key distribution via sftp or secure email

Document signing with the Private key

Use Java JCA to sign documents

java-security-sign-documents-JCA-baeldung.com-Digital Signatures in Java.pdf

In this tutorial, we're going to learn about the Digital Signature mechanism and how we can implement it using the Java Cryptography Architecture (JCA). We'll explore the KeyPair, MessageDigest, Cipher, KeyStore, Certificate, and Signature JCA APIs.

We'll start by understanding what is Digital Signature, how to generate a key pair, and how to certify the public key from a certificate authority (CA). After that, we'll see how to implement Digital Signature using the low-level and high-level JCA APIs.

Digital Signature

Digital Signature is a technique for ensuring:

• Integrity: the message hasn't been altered in transit
• Authenticity: the author of the message is really who they claim to be
• Non-repudiation: the author of the message can't later deny that they were the source

Send message with digital signature

Technically speaking, a digital signature is the encrypted hash (digest, checksum) of a message. That means we generate a hash from a message and encrypt it with a private key according to a chosen algorithm.

The message, the encrypted hash, the corresponding public key, and the algorithm are all then sent. This is classified as a message with its digital signature.

Digital Certificate and Public Key

A certificate is a document that associates an identity to a given public key.  Certificates are signed by a third-party entity called a Certificate Authority (CA).

We know that if the hash we decrypt with the published public key matches the actual hash, then the message is signed. However, how do we know that the public key really came from the right entity? This is solved by the use of digital certificates.

A Digital Certificate contains a public key and is itself signed by another entity. A chain of trust.

The most top-level entity is self-signed, which means that his public key is signed by his own private key.

Load a private key from a keystore

Using the KeyStore API, and the previous Keystore file, sender_keystore.p12, we can get a PrivateKey object:

KeyStore keyStore = KeyStore.getInstance("PKCS12");
keyStore.load(new FileInputStream("sender_keystore.p12"), "changeit");
PrivateKey privateKey =
(PrivateKey) keyStore.getKey("senderKeyPair", "changeit");

If CA needs to sign the certificate first

if we're going to work with a CA-signed certificate, then we need to create a certificate signing request (CSR). We do this with the certreq command:

keytool -certreq -alias senderKeyPair -storetype PKCS12 \
-keystore sender_keystore.p12 -file -rfc \
-storepass changeit > sender_certificate.csr

The CSR file, sender_certificate.csr, is then sent to a Certificate Authority for the purpose of signing. When this is done, we'll receive a signed public key wrapped in an X.509 certificate, either in binary (DER) or text (PEM) format. Here, we've used the rfc option for a PEM format.

Create personal certificate for shared SSL

use a personal name or identity or a proxy name

Setup a Web Server with SSL

Java Keystore Types

https://www.pixelstech.net/article/1408345768-Different-types-of-keystore-in-Java----Overview

Certificate administration options

Java keytool

https://docs.oracle.com/javase/9/tools/keytool.htm#JSWOR-GUID-5990A2E4-78E3-47B7-AE75-6D1826259549

Openssl command line on any platform

Free CA admin tools including Fabric

Task - Add SSL cert into Java keystore jks and cacerts file from download

https://better-coding.com/how-to-add-ssl-certificate-into-java-cacerts-file-and-jks-keystore/

This simple guide shows how to download a certificate and how to add it into Java trust store.

1. Downloading certificate

You can download the certificate in a few ways. Using openssl tool or using browser

1.1. Download SSL certificate using openssl

1.2 Downloading SSL certificate using browser

You can download the certificate using Chrome by going to certificate details and then clicking “Copy to file” button.

2.1 Importing certificate into cacert

Go to the JAVA_HOME\bin directory and run:

2.2 Importing certificate into jks keystore

Openssl certficate adminisration

Use Linux default openssl if possible

includes default trust store for certificates

Openssl on Windows

install a valid Openssl binary from

Compile Openssl for Windows or get a binary package

only if needed ( usually on Windows if a binary not available )

add a trust store

Use or Create a Trust Store

either use system trust store or get Mozilla trust store

Windows Certificates Trust Store via mmc

Mozilla Root Certificate trust store text file

https://hg.mozilla.org/mozilla-central/raw-file/tip/security/nss/lib/ckfw/builtins/certdata.txt

Download & Install Windows Openssl binary

https://slproweb.com/products/Win32OpenSSL.html

For Windows, create openssl_start.bat

sets up openssl environment in Windows

openssl_start.bat.txt

WARNING: can't open config file: /usr/local/ssl/openssl.cnf

This can be solved as following:

1. Close OpenSSL.
2. Open a Command Prompt (CMD) as Administrator
3. Run the following command: SET OPENSSL_CONF=<<my openssl bin path>>\openssl.cnf

Create Keystore, Admin key, User key & cert

use pkcs12 keystore

all key types and portable to any language

Generate a private key for the admin

if using a protected passfile, store in protected zip w option name + dddd

D:\dsfw\files\keyhome>

openssl genrsa -aes256 -passout file:passfile.txt -out jemason1.key 2048

Generating RSA private key, 2048 bit long modulus

..............+++++

.........................................................................................................+++++

e is 65537 (0x010001)

The password file ideally is in UTF-8 encoding for openssl

type or cat the key file to see the encrypted text for the private key generated

type jemason1-pub.pem | more

-----BEGIN PUBLIC KEY-----
.... << more >> ...
-----END PUBLIC KEY-----

create the public key from the private key file

openssl rsa -in jemason1.key -out jemason1-pub.key -pubout

key files output:

jemason1-pub.key jemason1.key passfile.txt

OpenSSL on Linux

error - unknown option on openssl command - can't copy dashes

Search Results
Web results

openssl keeps giving me "unknown option" errors - Server Fault
https://serverfault.com › questions › openssl-keeps-giving-me-unknown-o...
2 answers
Aug 13, 2011 - Delete all of your dashes and re-type them on the command line. when you wish to copy and paste! the - in the out so use arrows to get there and remove - and then type - and press enter, the - near the out is the only - you need to delete and type then it works :D.

CSR - Certificate Signing Request

http://pdfviewer.softgateon.net/?state=%7B%22ids%22:%5B%2211xXUkWZp59faRNh_jjCvXjM1XvQ7R4e9%22%5D,%22action%22:%22open%22,%22userId%22:%22106992337469837643773%22%7D

Get details from the site admin for OU, Cname, email, challenge password  etc first

 openssl req -new -key fd.key -out fd.cs

Create a pkcs12 file store for certificates

PKCS 12. In cryptography, PKCS #12 defines an archive file format for storing many cryptography objects as a single file. It is commonly used to bundle a private key with its X.509 certificate or to bundle all the members of a chain of trust. ... The filename extension for PKCS #12 files is .p12 or .pfx .

The PKCS#12 or PFX format is a binary format for storing the server certificate, intermediate certificates, and the private key in one encryptable file. PFX files usually have extensions such as .pfx and .p12. PFX files are typically used on Windows machines to import and export certificates and private keys

https://www.openssl.org/docs/man1.1.1/man1/openssl-pkcs12.html

For PKCS#12 file parsing only -in and -out need to be used for PKCS#12 file creation -export and -name are also used.

Controlling order of keys in pkcs12 file

If none of the -clcerts, -cacerts or -nocerts options are present then all certificates will be output in the order they appear in the input PKCS#12 files. There is no guarantee that the first certificate present is the one corresponding to the private key. Certain software which requires a private key and certificate and assumes the first certificate in the file is the one corresponding to the private key: this may not always be the case. Using the -clcerts option will solve this problem by only outputting the certificate corresponding to the private key. If the CA certificates are required then they can be output to a separate file using the -nokeys -cacerts options to just output CA certificates.

creates a pkcs12 file from a public key

 openssl pkcs12 -export -in jemason1-pub.key -out jemason1.p12 -name "jmason Certificate"

jemfebapr

Tutorial - Create SSL certificates with OpenSSL

https://phoenixnap.com/kb/openssl-tutorial-ssl-certificates-private-keys-csrs

On Ubuntu

ssl folder  /usr/lib/ssl is a link to

/etc/ssl 

which contains   /certs openssl.cnf  /private

openssl.cnf has default values for a CSR otherwise they must be entered on CLI

openssl req –out certificatesigningrequest.csr -new -newkey rsa:2048 -nodes -keyout privatekey.key

create the new key  and csr request

openssl req –out jmason1.csr -new -newkey rsa:2048 -nodes -keyout jmason1.key

read the key

openssl req -in jmason1.csr -noout -text

Create a public key as a PEM file from private key

openssl rsa -in jmason1.key -outform PEM -pubout -out jmason1-pub.PEM

Create a PKCS12 format file that can be imported into a Windows keystore

Create self-signed certificate with openssl req

openssl-req, req - PKCS#10 certificate request and certificate generating utility

The req command primarily creates and processes certificate requests in PKCS#10 format. It can additionally create self signed certificates for use as root CAs for example.

openssl-x509, x509 - Certificate display and signing utility

https://www.openssl.org/docs/man1.1.1/

example 1 - create new self-signed root CA certificate, private and public key files and a password file

openssl req -x509 -sha256 -outform PEM -days 1000 -out jmason2-crt.pem -new -newkey rsa:2048 -nodes 
-keyout jmason2-key.pem -passin file:passfile.txt

Generating a RSA private key
...........................................................+++++
.....................................................................................+++++
writing new private key to 'jmason2-key.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [US]:US
State or Province Name (full name) [MA]:MA
Locality Name (eg, city) []:North Attleboro
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Paramount Software Solutions
Organizational Unit Name (eg, section) []:software
Common Name (e.g. server FQDN or YOUR name) []:Jim Mason
Email Address []:.

openssl req options

-outform DER|PEM

This specifies the output format, the options have the same meaning and default as the -inform option.

-in filename

This specifies the input filename to read a request from or standard input if this option is not specified. A request is only read if the creation options (-new and -newkey) are not specified.

-x509

This option outputs a self signed certificate instead of a certificate request. This is typically used to generate a test certificate or a self signed root CA. The extensions added to the certificate (if any) are specified in the configuration file. Unless specified using the set_serial option, a large random number will be used for the serial number.

If existing request is specified with the -in option, it is converted to the self signed certificate otherwise new request is created.

Openssl simple CA app to sign requests

https://www.openssl.org/docs/man1.1.0/man1/ca.html

openssl.org-ca.pdf

Potential Value Opportunities

Potential Challenges

Java app accesses web site with invalid certificate

https://www.infopackets.com/news/10023/how-fix-java-expired-or-not-yet-valid-certificate-error

whenever I try to access my work's website (which uses a Java applet), I receive an error message that says: 'Your security settings have blocked an application with an expired or not-yet-valid certificate from running.' I cannot proceed past that, and am therefore unable to access the website

Analysis steps

By clicking on the padlock with the (!) warning, the browser reported "Connection not secure"; I then clicked to view "More information" and then on the "View certificate" page, I could clearly see that the HTTPS certificate had in fact expired some time last year. This was the reason that the Java applet was reporting an error and would not proceed.

For Google Chrome try

Edit Settings > Privacy & Security > Web site exceptions > not secure connection = allow

How to Fix Java Expired or not-yet-valid Certificate Error.pdf

Candidate Solutions

Step-by-step guide for Example

sample code block

Recommended Next Steps

Related articles