1 /*

  2

  3  * Copyright 2006 Sun Microsystems, Inc. All Rights Reserved.

  4

  5  *

  6

  7  * Redistribution and use in source and binary forms, with or without

  8

  9  * modification, are permitted provided that the following conditions

 10

 11  * are met:

 12

 13  *

 14

 15  *  - Redistributions of source code must retain the above copyright

 16

 17  *   notice, this list of conditions and the following disclaimer.

 18

 19  *

 20

 21  *  - Redistributions in binary form must reproduce the above copyright

 22

 23  *   notice, this list of conditions and the following disclaimer in the

 24

 25  *   documentation and/or other materials provided with the distribution.

 26

 27  *

 28

 29  *  - Neither the name of Sun Microsystems nor the names of its

 30

 31  *   contributors may be used to endorse or promote products derived

 32

 33  *   from this software without specific prior written permission.

 34

 35  *

 36

 37  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS

 38

 39  * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,

 40

 41  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

 42

 43  * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR

 44

 45  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,

 46

 47  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,

 48

 49  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR

 50

 51  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF

 52

 53  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING

 54

 55  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS

 56

 57  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

 58

 59  */

 60

 61 /**

 62

 63  * http://blogs.sun.com/andreas/resource/InstallCert.java

 64

 65  * Use:

 66

 67  * java InstallCert hostname

 68

 69  * Example:

 70

 71  *% java InstallCert ecc.fedora.redhat.com

 72

 73  */

 74

 75 import javax.net.ssl.*;

 76

 77 import java.io.*;

 78

 79 import java.security.KeyStore;

 80

 81 import java.security.MessageDigest;

 82

 83 import java.security.cert.CertificateException;

 84

 85 import java.security.cert.X509Certificate;

 86

 87 /**

 88

 89  * Class used to add the server's certificate to the KeyStore

 90

 91  * with your trusted certificates.

 92

 93  */

 94

 95 public class InstallCert {

 96

 97     public static void main(String[] args) throws Exception {

 98

 99         String host;

100

101         int port;

102

103         char[] passphrase;

104

105         if ((args.length == 1) || (args.length == 2)) {

106

107             String[] c = args[0].split(":");

108

109             host = c[0];

110

111             port = (c.length == 1) ? 443 : Integer.parseint(c[1]);

112

113             String p = (args.length == 1) ? "changeit" : args[1];

114

115             passphrase = p.toCharArray();

116

117         } else {

118

119             System.out.println("Usage: java InstallCert <host>[:port] [passphrase]");

120

121             return;

122

123         }

124

125         File file = new File("jssecacerts");

126

127         if (file.isFile() == false) {

128

129             char SEP = File.separatorchar;

130

131             File dir = new File(System.getProperty("java.home") + SEP

132

133                       + "lib" + SEP + "security");

134

135             file = new File(dir, "jssecacerts");

136

137             if (file.isFile() == false) {

138

139                 file = new File(dir, "cacerts");

140

141             }

142

143         }

144

145         System.out.println("Loading KeyStore " + file + "...");

146

147         InputStream in = new FileInputStream(file);

148

149         KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());

150

151         ks.load(in, passphrase);

152

153         in.close();

154

155         SSLContext context = SSLContext.getInstance("TLS");

156

157         TrustManagerFactory tmf =

158

159                 TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());

160

161         tmf.init(ks);

162

163         X509TrustManager defaultTrustManager = (X509TrustManager) tmf.getTrustManagers()[0];

164

165         SavingTrustManager tm = new SavingTrustManager(defaultTrustManager);

166

167         context.init(null, new TrustManager[]{

168

169             tm

170

171         }

172

173         , null);

174

175         SSLSocketFactory factory = context.getSocketFactory();

176

177         System.out.println("Opening connection to " + host + ":" + port + "...");

178

179         SSLSocket socket = (SSLSocket) factory.createSocket(host, port);

180

181         socket.setSoTimeout(10000);

182

183         try {

184

185             System.out.println("Starting SSL handshake...");

186

187             socket.startHandshake();

188

189             socket.close();

190

191             System.out.println();

192

193             System.out.println("No errors, certificate is already trusted");

194

195         }

196

197         catch (SSLException e) {

198

199             System.out.println();

200

201             e.printStackTrace(System.out);

202

203         }

204

205         X509Certificate[] chain = tm.chain;

206

207         if (chain == null) {

208

209             System.out.println("Could not obtain server certificate chain");

210

211             return;

212

213         }

214

215         BufferedReader reader =

216

217                 new BufferedReader(new InputStreamReader(System.in));

218

219         System.out.println();

220

221         System.out.println("Server sent " + chain.length + " certificate(s):");

222

223         System.out.println();

224

225         MessageDigest sha1 = MessageDigest.getInstance("SHA1");

226

227         MessageDigest md5 = MessageDigest.getInstance("MD5");

228

229         for (int i = 0; i < chain.length; i++) {

230

231             X509Certificate cert = chain[i];

232

233             System.out.println

234

235                       (" " + (i + 1) + " Subject " + cert.getSubjectDN());

236

237             System.out.println("  Issuer " + cert.getIssuerDN());

238

239             sha1.update(cert.getEncoded());

240

241             System.out.println("  sha1  " + toHexString(sha1.digest()));

242

243             md5.update(cert.getEncoded());

244

245             System.out.println("  md5   " + toHexString(md5.digest()));

246

247             System.out.println();

248

249         }

250

251         System.out.println("Enter certificate to add to trusted keystore or 'q' to quit: [1]");

252

253         String line = reader.readLine().trim();

254

255         int k;

256

257         try {

258

259             k = (line.length() == 0) ? 0 : Integer.parseint(line) - 1;

260

261         }

262

263         catch (NumberFormatException e) {

264

265             System.out.println("KeyStore not changed");

266

267             return;

268

269         }

270

271         X509Certificate cert = chain[k];

272

273         String alias = host + "-" + (k + 1);

274

275         ks.setCertificateEntry(alias, cert);

276

277         OutputStream out = new FileOutputStream("jssecacerts");

278

279         ks.store(out, passphrase);

280

281         out.close();

282

283         System.out.println();

284

285         System.out.println(cert);

286

287         System.out.println();

288

289         System.out.println

290

291                 ("Added certificate to keystore 'jssecacerts' using alias '"

292

293                     + alias + "'");

294

295     }

296

297     private static final char[] HEXDIGITS = "0123456789abcdef".toCharArray();

298

299     private static String toHexString(byte[] bytes) {

300

301         StringBuilder sb = new StringBuilder(bytes.length * 3);

302

303         for (int b : bytes) {

304

305             b &= 0xff;

306

307             sb.append(HEXDIGITS[b >> 4]);

308

309             sb.append(HEXDIGITS[b & 15]);

310

311             sb.append(' ');

312

313         }

314

315         return sb.toString();

316

317     }

318

319     private static class SavingTrustManager implements X509TrustManager {

320

321         private final X509TrustManager tm;

322

323         private X509Certificate[] chain;

324

325         SavingTrustManager(X509TrustManager tm) {

326

327             this.tm = tm;

328

329         }

330

331         public X509Certificate[] getAcceptedIssuers() {

332

333             throw new UnsupportedOperationException();

334

335         }

336

337         public void checkClientTrusted(X509Certificate[] chain, String authType)

338

339                 throws CertificateException {

340

341             throw new UnsupportedOperationException();

342

343         }

344

345         public void checkServerTrusted(X509Certificate[] chain, String authType)

346

347                 throws CertificateException {

348

349             this.chain = chain;

350

351             tm.checkServerTrusted(chain, authType);

352

353         }

354

355     }

356

357 }