mirrors
/
gitblit
mirror of https://github.com/gitblit/gitblit.git
Watch 1
Star 0
Fork 0
Code Issues 0 Releases 43 Wiki Activity
Browse Source

Make keystore script independent of JDK using BouncyCastle.

tags/v0.5.0
James Moger 13 years ago
parent
c19ae5c6d4
commit
a9299738a9
3 changed files with 142 additions and 61 deletions
Split View Show Diff Stats
  1. 1
    1
      distrib/makekeystore.cmd
  2. 1
    60
      src/com/gitblit/GitBlitServer.java
  3. 140
    0
      src/com/gitblit/MakeCertificate.java

+ 1
- 1
distrib/makekeystore.cmd View File

@@ -1,2 +1,2 @@
@del keystore
@keytool -keystore keystore -alias localhost -genkey -keyalg RSA -dname "CN=localhost, OU=Git:Blit, O=Git:Blit, L=Some Town, ST=Some State, C=US"
@java -cp gitblit.jar;"%CD%\ext\*" com.gitblit.MakeCertificate --alias localhost --subject "CN=localhost, OU=Git:Blit, O=Git:Blit, L=Some Town, ST=Some State, C=US"

+ 1
- 60
src/com/gitblit/GitBlitServer.java View File

@@ -2,40 +2,23 @@ package com.gitblit;
import java.io.BufferedReader;
import java.io.File;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.InputStreamReader;
import java.io.OutputStream;
import java.math.BigInteger;
import java.net.InetAddress;
import java.net.ServerSocket;
import java.net.Socket;
import java.net.URL;
import java.net.UnknownHostException;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.KeyStore;
import java.security.ProtectionDomain;
import java.security.SecureRandom;
import java.security.Security;
import java.security.cert.X509Certificate;
import java.text.MessageFormat;
import java.util.ArrayList;
import java.util.Date;
import java.util.List;
import org.apache.log4j.ConsoleAppender;
import org.apache.log4j.PatternLayout;
import org.apache.wicket.protocol.http.ContextParamWebApplicationFactory;
import org.apache.wicket.protocol.http.WicketFilter;
import org.bouncycastle.asn1.x500.X500NameBuilder;
import org.bouncycastle.asn1.x500.style.BCStyle;
import org.bouncycastle.cert.X509v3CertificateBuilder;
import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;
import org.bouncycastle.cert.jcajce.JcaX509v3CertificateBuilder;
import org.bouncycastle.operator.ContentSigner;
import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
import org.eclipse.jetty.http.security.Constraint;
import org.eclipse.jetty.security.ConstraintMapping;
import org.eclipse.jetty.security.ConstraintSecurityHandler;
@@ -170,7 +153,7 @@ public class GitBlitServer {
File keystore = new File("keystore");
if (!keystore.exists()) {
logger.info("Generating self-signed SSL certificate");
generateSelfSignedCertificate("localhost", keystore, params.storePassword);
MakeCertificate.generateSelfSignedCertificate("localhost", keystore, params.storePassword);
}
if (keystore.exists()) {
Connector secureConnector = createSSLConnector(keystore, params.storePassword, params.useNIO, params.securePort);
@@ -336,48 +319,6 @@ public class GitBlitServer {
return connector;
}
private static void generateSelfSignedCertificate(String hostname, File keystore, String keystorePassword) {
try {
Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());
final String BC = org.bouncycastle.jce.provider.BouncyCastleProvider.PROVIDER_NAME;
KeyPairGenerator kpGen = KeyPairGenerator.getInstance("RSA", "BC");
kpGen.initialize(1024, new SecureRandom());
KeyPair pair = kpGen.generateKeyPair();
// Generate self-signed certificate
X500NameBuilder builder = new X500NameBuilder(BCStyle.INSTANCE);
builder.addRDN(BCStyle.OU, Constants.NAME);
builder.addRDN(BCStyle.O, Constants.NAME);
builder.addRDN(BCStyle.CN, hostname);
Date notBefore = new Date(System.currentTimeMillis() - 1*24*60*60*1000l);
Date notAfter = new Date(System.currentTimeMillis() + 10*365*24*60*60*1000l);
BigInteger serial = BigInteger.valueOf(System.currentTimeMillis());
X509v3CertificateBuilder certGen = new JcaX509v3CertificateBuilder(builder.build(), serial, notBefore, notAfter, builder.build(), pair.getPublic());
ContentSigner sigGen = new JcaContentSignerBuilder("SHA256WithRSAEncryption").setProvider(BC).build(pair.getPrivate());
X509Certificate cert = new JcaX509CertificateConverter().setProvider(BC).getCertificate(certGen.build(sigGen));
cert.checkValidity(new Date());
cert.verify(cert.getPublicKey());
// Save to keystore
KeyStore store = KeyStore.getInstance("JKS");
if (keystore.exists()) {
FileInputStream fis = new FileInputStream(keystore);
store.load(fis, keystorePassword.toCharArray());
} else {
store.load(null);
}
store.setKeyEntry(hostname, pair.getPrivate(), keystorePassword.toCharArray(), new java.security.cert.Certificate[] { cert });
store.store(new FileOutputStream(keystore), keystorePassword.toCharArray());
} catch (Throwable t) {
t.printStackTrace();
throw new RuntimeException("Failed to generate self-signed certificate!", t);
}
}
/**
* Recursively delete a folder and its contents.
*

+ 140
- 0
src/com/gitblit/MakeCertificate.java View File

@@ -0,0 +1,140 @@
package com.gitblit;
import java.io.File;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.math.BigInteger;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.KeyStore;
import java.security.SecureRandom;
import java.security.Security;
import java.security.cert.X509Certificate;
import java.util.Date;
import javax.security.auth.x500.X500Principal;
import org.bouncycastle.asn1.x500.X500NameBuilder;
import org.bouncycastle.asn1.x500.style.BCStyle;
import org.bouncycastle.cert.X509v3CertificateBuilder;
import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;
import org.bouncycastle.cert.jcajce.JcaX509v3CertificateBuilder;
import org.bouncycastle.operator.ContentSigner;
import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
import com.beust.jcommander.JCommander;
import com.beust.jcommander.Parameter;
import com.beust.jcommander.ParameterException;
import com.beust.jcommander.Parameters;
public class MakeCertificate {
private final static FileSettings fileSettings = new FileSettings();
public static void main(String... args) {
Params params = new Params();
JCommander jc = new JCommander(params);
try {
jc.parse(args);
} catch (ParameterException t) {
jc.usage();
}
File keystore = new File("keystore");
generateSelfSignedCertificate(params.alias, keystore, params.storePassword, params.subject);
}
public static void generateSelfSignedCertificate(String hostname, File keystore, String keystorePassword) {
try {
Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());
final String BC = org.bouncycastle.jce.provider.BouncyCastleProvider.PROVIDER_NAME;
KeyPairGenerator kpGen = KeyPairGenerator.getInstance("RSA", "BC");
kpGen.initialize(1024, new SecureRandom());
KeyPair pair = kpGen.generateKeyPair();
// Generate self-signed certificate
X500NameBuilder builder = new X500NameBuilder(BCStyle.INSTANCE);
builder.addRDN(BCStyle.OU, Constants.NAME);
builder.addRDN(BCStyle.O, Constants.NAME);
builder.addRDN(BCStyle.CN, hostname);
Date notBefore = new Date(System.currentTimeMillis() - 1*24*60*60*1000l);
Date notAfter = new Date(System.currentTimeMillis() + 10*365*24*60*60*1000l);
BigInteger serial = BigInteger.valueOf(System.currentTimeMillis());
X509v3CertificateBuilder certGen = new JcaX509v3CertificateBuilder(builder.build(), serial, notBefore, notAfter, builder.build(), pair.getPublic());
ContentSigner sigGen = new JcaContentSignerBuilder("SHA256WithRSAEncryption").setProvider(BC).build(pair.getPrivate());
X509Certificate cert = new JcaX509CertificateConverter().setProvider(BC).getCertificate(certGen.build(sigGen));
cert.checkValidity(new Date());
cert.verify(cert.getPublicKey());
// Save to keystore
KeyStore store = KeyStore.getInstance("JKS");
if (keystore.exists()) {
FileInputStream fis = new FileInputStream(keystore);
store.load(fis, keystorePassword.toCharArray());
} else {
store.load(null);
}
store.setKeyEntry(hostname, pair.getPrivate(), keystorePassword.toCharArray(), new java.security.cert.Certificate[] { cert });
store.store(new FileOutputStream(keystore), keystorePassword.toCharArray());
} catch (Throwable t) {
t.printStackTrace();
throw new RuntimeException("Failed to generate self-signed certificate!", t);
}
}
public static void generateSelfSignedCertificate(String hostname, File keystore, String keystorePassword, String info) {
try {
Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());
final String BC = org.bouncycastle.jce.provider.BouncyCastleProvider.PROVIDER_NAME;
KeyPairGenerator kpGen = KeyPairGenerator.getInstance("RSA", "BC");
kpGen.initialize(1024, new SecureRandom());
KeyPair pair = kpGen.generateKeyPair();
// Generate self-signed certificate
X500Principal principal = new X500Principal(info);
Date notBefore = new Date(System.currentTimeMillis() - 1*24*60*60*1000l);
Date notAfter = new Date(System.currentTimeMillis() + 10*365*24*60*60*1000l);
BigInteger serial = BigInteger.valueOf(System.currentTimeMillis());
X509v3CertificateBuilder certGen = new JcaX509v3CertificateBuilder(principal, serial, notBefore, notAfter, principal, pair.getPublic());
ContentSigner sigGen = new JcaContentSignerBuilder("SHA256WithRSAEncryption").setProvider(BC).build(pair.getPrivate());
X509Certificate cert = new JcaX509CertificateConverter().setProvider(BC).getCertificate(certGen.build(sigGen));
cert.checkValidity(new Date());
cert.verify(cert.getPublicKey());
// Save to keystore
KeyStore store = KeyStore.getInstance("JKS");
if (keystore.exists()) {
FileInputStream fis = new FileInputStream(keystore);
store.load(fis, keystorePassword.toCharArray());
} else {
store.load(null);
}
store.setKeyEntry(hostname, pair.getPrivate(), keystorePassword.toCharArray(), new java.security.cert.Certificate[] { cert });
store.store(new FileOutputStream(keystore), keystorePassword.toCharArray());
} catch (Throwable t) {
t.printStackTrace();
throw new RuntimeException("Failed to generate self-signed certificate!", t);
}
}
@Parameters(separators = " ")
private static class Params {
@Parameter(names = { "--alias" }, description = "Server alias", required = true)
public String alias = null;
@Parameter(names = { "--subject" }, description = "Certificate subject", required = true)
public String subject = null;
@Parameter(names = "--storePassword", description = "Password for SSL (https) keystore.")
public String storePassword = fileSettings.getString(Keys.server.storePassword, "");
}
}

Write Preview
Loading…
Cancel
Save