org.newsclub.net.unix.demo.ssl.SSLDemoPrerequisites

public class SSLDemoPrerequisites extends Object

SSL-over-UNIX sockets demo.

Prerequisites:

Create server public/private key pair, valid for ~10 years, Store it as a PKCS12 file named "juxserver.p12":
keytool -genkeypair -alias juxserver -keyalg RSA -keysize 2048 -storetype PKCS12 -validity 3650 -ext san=dns:localhost.junixsocket -dname "CN=First and Last, OU=Organizational Unit, O=Organization, L=City, ST=State, C=XX" -keystore juxserver.p12 -storepass serverpass
Omit -dname "CN=..." to interactively specify the distinguished name for the certificate.
You may verify the contents of this p12 file via keytool -list -v -keystore juxserver.p12 -storepass serverpass; omit the -storepass... parameters to specify the password interactively for additional security.
Export the server's public key as a X.509 certificate:
keytool -exportcert -alias juxserver -keystore juxserver.p12 -storepass serverpass -file juxserver.pem
You may verify the contents of the certificate file via keytool -printcert -file juxserver.pem
Import the server's X.509 certificate into the client truststore:
keytool -importcert -alias juxserver -keystore juxclient.truststore -storepass clienttrustpass -file juxserver.pem -noprompt
Omit -noprompt to interactively verify the imported certificate.

You may verify the contents of this truststore via keytool -list -v -keystore juxclient.truststore -storepass clienttrustpass; omit the -storepass... parameters to specify the password interactively for additional security.

If you want client authentication as well, perform these additional steps:

Create client public/private key pair, valid for ~10 years, Store it as a PKCS12 file named "juxclient.p12":
keytool -genkeypair -alias juxclient -keyalg RSA -keysize 2048 -storetype PKCS12 -validity 3650 -ext san=dns:localhost.junixsocket -dname "CN=First and Last, OU=Organizational Unit, O=Organization, L=City, ST=State, C=XX" -keystore juxclient.p12 -storepass clientpass
Omit -dname "CN=..." to interactively specify the distinguished name for the certificate.
You may verify the contents of this p12 file via keytool -list -v -keystore juxclient.p12 -storepass clientpass; omit the -storepass... parameters to specify the password interactively for additional security.
Export the client's public key as a X.509 certificate:
keytool -exportcert -alias juxclient -keystore juxclient.p12 -storepass clientpass -file juxclient.pem
You may verify the contents of the certificate file via keytool -printcert -file juxclient.pem
Import the client's X.509 certificate into the servers truststore:
keytool -importcert -alias juxclient -keystore juxserver.truststore -storepass servertrustpass -file juxclient.pem -noprompt
Omit -noprompt to interactively verify the imported certificate.

You may verify the contents of this truststore via keytool -list -v -keystore juxserver.truststore -storepass servertrustpass; omit the -storepass... parameters to specify the password interactively for additional security.

Author:

Christian Kohlschütter

See Also:

Class SSLDemoPrerequisites

Constructor Summary