195

I am trying to connect to an SSL server which requires me to authenticate myself. In order to use SSL over Apache MINA I need a suitable JKS file. However, I have only been given a .PEM file.

How would I go about creating a JKS file from a PEM file?

1

14 Answers 14

297

First, convert your certificate in a DER format :

openssl x509 -outform der -in certificate.pem -out certificate.der

And after, import it in the keystore :

keytool -import -alias your-alias -keystore cacerts -file certificate.der
7
  • 21
    Does not work if the .pem file contains more than one certificate.
    – MarioVilas
    Feb 24, 2014 at 15:31
  • 16
    I've got a single certificate .pem and this doesn't work. 1795:error:0906D06C:PEM routines:PEM_read_bio:no start line:/usr/src/secure/lib/libcrypto/../../../crypto/openssl/crypto/pem/pem_lib.c:648:Expecting: TRUSTED CERTIFICATE Apr 16, 2014 at 17:25
  • 8
    I found the solution. Pre-pend the root and intermediate certificates to the .pem, then convert. Dec 15, 2014 at 12:25
  • 2
    @Anthony this command only tells how to import a PEM into JKS. May be a good idea to add a command for exporting JKS from store. Mar 22, 2016 at 3:54
  • 3
    If I have multiple certificates on the .pem, how do I import to a Java keystore?
    – Erick
    Jan 21, 2017 at 0:16
91

If you only want to import a certificate in PEM format into a keystore, keytool will do the job:

keytool -import -alias *alias* -keystore cacerts -file *cert.pem*
4
  • 20
    If I go like this I get an error: keytool error: java.lang.Exception: Input not an X.509 certificate
    – frandevel
    Jan 19, 2012 at 8:42
  • 2
    @frandevel, this error can be caused by the PEM input file having a header above the --- BEGIN delimiter or having multiple PEMs in one file or both. Either remove all extraneous data and feed in each PEM in one at a time or use my tool, as detailed in my answer. Apr 15, 2013 at 14:39
  • 4
    Same problem and the .PEM file is clean, with all appropriate headers. Apr 16, 2014 at 17:19
  • it works. First I converted my .cer to .pem with this serverfault.com/a/254630 and then , import directly following this answer
    – JRichardsz
    Jun 27, 2022 at 22:26
31

If you need an easy way to load PEM files in Java without having to deal with external tools (opensll, keytool), here is my code I use in production :

import java.io.BufferedReader;
import java.io.ByteArrayInputStream;
import java.io.File;
import java.io.FileReader;
import java.io.IOException;
import java.security.KeyFactory;
import java.security.KeyStore;
import java.security.KeyStoreException;
import java.security.NoSuchAlgorithmException;
import java.security.PrivateKey;
import java.security.cert.CertificateException;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;
import java.security.interfaces.RSAPrivateKey;
import java.security.spec.InvalidKeySpecException;
import java.security.spec.PKCS8EncodedKeySpec;
import java.util.ArrayList;
import java.util.List;

import javax.net.ssl.KeyManager;
import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLServerSocketFactory;
import javax.xml.bind.DatatypeConverter;

public class PEMImporter {

    public static SSLServerSocketFactory createSSLFactory(File privateKeyPem, File certificatePem, String password) throws Exception {
        final SSLContext context = SSLContext.getInstance("TLS");
        final KeyStore keystore = createKeyStore(privateKeyPem, certificatePem, password);
        final KeyManagerFactory kmf = KeyManagerFactory.getInstance("SunX509");
        kmf.init(keystore, password.toCharArray());
        final KeyManager[] km = kmf.getKeyManagers();
        context.init(km, null, null);
        return context.getServerSocketFactory();
    }

    /**
     * Create a KeyStore from standard PEM files
     * 
     * @param privateKeyPem the private key PEM file
     * @param certificatePem the certificate(s) PEM file
     * @param the password to set to protect the private key
     */
    public static KeyStore createKeyStore(File privateKeyPem, File certificatePem, final String password)
            throws Exception, KeyStoreException, IOException, NoSuchAlgorithmException, CertificateException {
        final X509Certificate[] cert = createCertificates(certificatePem);
        final KeyStore keystore = KeyStore.getInstance("JKS");
        keystore.load(null);
        // Import private key
        final PrivateKey key = createPrivateKey(privateKeyPem);
        keystore.setKeyEntry(privateKeyPem.getName(), key, password.toCharArray(), cert);
        return keystore;
    }

    private static PrivateKey createPrivateKey(File privateKeyPem) throws Exception {
        final BufferedReader r = new BufferedReader(new FileReader(privateKeyPem));
        String s = r.readLine();
        if (s == null || !s.contains("BEGIN PRIVATE KEY")) {
            r.close();
            throw new IllegalArgumentException("No PRIVATE KEY found");
        }
        final StringBuilder b = new StringBuilder();
        s = "";
        while (s != null) {
            if (s.contains("END PRIVATE KEY")) {
                break;
            }
            b.append(s);
            s = r.readLine();
        }
        r.close();
        final String hexString = b.toString();
        final byte[] bytes = DatatypeConverter.parseBase64Binary(hexString);
        return generatePrivateKeyFromDER(bytes);
    }

    private static X509Certificate[] createCertificates(File certificatePem) throws Exception {
        final List<X509Certificate> result = new ArrayList<X509Certificate>();
        final BufferedReader r = new BufferedReader(new FileReader(certificatePem));
        String s = r.readLine();
        if (s == null || !s.contains("BEGIN CERTIFICATE")) {
            r.close();
            throw new IllegalArgumentException("No CERTIFICATE found");
        }
        StringBuilder b = new StringBuilder();
        while (s != null) {
            if (s.contains("END CERTIFICATE")) {
                String hexString = b.toString();
                final byte[] bytes = DatatypeConverter.parseBase64Binary(hexString);
                X509Certificate cert = generateCertificateFromDER(bytes);
                result.add(cert);
                b = new StringBuilder();
            } else {
                if (!s.startsWith("----")) {
                    b.append(s);
                }
            }
            s = r.readLine();
        }
        r.close();

        return result.toArray(new X509Certificate[result.size()]);
    }

    private static RSAPrivateKey generatePrivateKeyFromDER(byte[] keyBytes) throws InvalidKeySpecException, NoSuchAlgorithmException {
        final PKCS8EncodedKeySpec spec = new PKCS8EncodedKeySpec(keyBytes);
        final KeyFactory factory = KeyFactory.getInstance("RSA");
        return (RSAPrivateKey) factory.generatePrivate(spec);
    }

    private static X509Certificate generateCertificateFromDER(byte[] certBytes) throws CertificateException {
        final CertificateFactory factory = CertificateFactory.getInstance("X.509");
        return (X509Certificate) factory.generateCertificate(new ByteArrayInputStream(certBytes));
    }

}

Have fun.

5
  • 1
    The question was about "SSL over Apache MINA" which is simplier to configure with the provided "SSLServerSocketFactory from PEMs function", see mina.apache.org/mina-project/userguide/ch11-ssl-filter/… .
    – BluEOS
    Jan 9, 2018 at 20:43
  • I tried above methodology to load PEM files (cert.pem and key.pem) but got the error message when trying to connect. Connecteion Ex:javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    – ugendrang
    Aug 5, 2020 at 6:21
  • "unable to find valid certification path to requested target" occurs often when using a selfsigned certificate, or when an intermediate certificate is missing...
    – BluEOS
    Aug 6, 2020 at 10:18
  • 2
    This worked flawlessly for me. My use case was to generate a .jks file, so instead of creating a socketFactory, I just did keyStore.store(stream, password). Dec 14, 2020 at 4:33
  • Awesome, thank you! There are some changes that do need to be made when using Java 11 or on Android; I've added an answer here with those details. Nov 7, 2022 at 15:29
20

I've developed https://github.com/alastairmccormack/keyutil which imports PEM certificates straight into a Java keystore. Its primary purpose is to import a multi-part PEM Operating System certificate bundles such as ca-bundle.crt. These often includes headers which keytool cannot handle.

2
  • 6
    Not a bad toy project, but keytool already does all this for you (and more). (By the way, you should close your FileOutputStream, and close your I/O streams in finally, if an exception happens.)
    – Bruno
    Jul 26, 2012 at 13:11
  • 8
    Hi Bruno, thanks for tips. The real use case is to import all entries of /etc/pki/tls/certs/ca-bundle.crt (RHEL/CentOS) in one go. AFAIK, keytool will only import the first entry. I've seen a number of people do this differently but it usually involves invoking keytool multiple times for each cert. Ubuntu has an update script which does exactly this, except that Ubuntu stores its certs in a directory. I'll be adding support for directories in the near future. Thanks again for reviewing the code. Jul 27, 2012 at 13:23
16

In my case I had a pem file which contained two certificates and an encrypted private key to be used in mutual SSL authentication. So my pem file looked like this:

-----BEGIN CERTIFICATE-----

...

-----END CERTIFICATE-----

-----BEGIN RSA PRIVATE KEY-----

Proc-Type: 4,ENCRYPTED

DEK-Info: DES-EDE3-CBC,C8BF220FC76AA5F9

...

-----END RSA PRIVATE KEY-----

-----BEGIN CERTIFICATE-----

...

-----END CERTIFICATE-----

Here is what I did

Split the file into three separate files, so that each one contains just one entry, starting with ---BEGIN.. and ending with ---END.. lines. Lets assume we now have three files: cert1.pem, cert2.pem, and pkey.pem.

Convert pkey.pem into DER format using openssl and the following syntax:

openssl pkcs8 -topk8 -nocrypt -in pkey.pem -inform PEM -out pkey.der -outform DER

Note, that if the private key is encrypted you need to supply a password( obtain it from the supplier of the original pem file ) to convert to DER format, openssl will ask you for the password like this: "enter a passphrase for pkey.pem: ".

If conversion is successful, you will get a new file called pkey.der.

Create a new java keystore and import the private key and the certificates:

String keypass = "password";  // this is a new password, you need to come up with to protect your java key store file
String defaultalias = "importkey";
KeyStore ks = KeyStore.getInstance("JKS", "SUN");

// this section does not make much sense to me, 
// but I will leave it intact as this is how it was in the original example I found on internet:   
ks.load( null, keypass.toCharArray());
ks.store( new FileOutputStream ( "mykeystore"  ), keypass.toCharArray());
ks.load( new FileInputStream ( "mykeystore" ),    keypass.toCharArray());
// end of section..


// read the key file from disk and create a PrivateKey

FileInputStream fis = new FileInputStream("pkey.der");
DataInputStream dis = new DataInputStream(fis);
byte[] bytes = new byte[dis.available()];
dis.readFully(bytes);
ByteArrayInputStream bais = new ByteArrayInputStream(bytes);

byte[] key = new byte[bais.available()];
KeyFactory kf = KeyFactory.getInstance("RSA");
bais.read(key, 0, bais.available());
bais.close();

PKCS8EncodedKeySpec keysp = new PKCS8EncodedKeySpec ( key );
PrivateKey ff = kf.generatePrivate (keysp);


// read the certificates from the files and load them into the key store:

Collection  col_crt1 = CertificateFactory.getInstance("X509").generateCertificates(new FileInputStream("cert1.pem"));
Collection  col_crt2 = CertificateFactory.getInstance("X509").generateCertificates(new FileInputStream("cert2.pem"));

Certificate crt1 = (Certificate) col_crt1.iterator().next();
Certificate crt2 = (Certificate) col_crt2.iterator().next();
Certificate[] chain = new Certificate[] { crt1, crt2 };

String alias1 = ((X509Certificate) crt1).getSubjectX500Principal().getName();
String alias2 = ((X509Certificate) crt2).getSubjectX500Principal().getName();

ks.setCertificateEntry(alias1, crt1);
ks.setCertificateEntry(alias2, crt2);

// store the private key
ks.setKeyEntry(defaultalias, ff, keypass.toCharArray(), chain );

// save the key store to a file         
ks.store(new FileOutputStream ( "mykeystore" ),keypass.toCharArray());

(optional) Verify the content of your new key store:

$ keytool -list -keystore mykeystore -storepass password

Keystore type: JKS Keystore provider: SUN

Your keystore contains 3 entries:

  • cn=...,ou=...,o=.., Sep 2, 2014, trustedCertEntry, Certificate fingerprint (SHA1): 2C:B8: ...

  • importkey, Sep 2, 2014, PrivateKeyEntry, Certificate fingerprint (SHA1): 9C:B0: ...

  • cn=...,o=...., Sep 2, 2014, trustedCertEntry, Certificate fingerprint (SHA1): 83:63: ...

(optional) Test your certificates and private key from your new key store against your SSL server: ( You may want to enable debugging as an VM option: -Djavax.net.debug=all )

        char[] passw = "password".toCharArray();
        KeyStore ks = KeyStore.getInstance("JKS", "SUN");
        ks.load(new FileInputStream ( "mykeystore" ), passw );

        KeyManagerFactory kmf = KeyManagerFactory.getInstance("SunX509");
        kmf.init(ks, passw);

        TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        tmf.init(ks);
        TrustManager[] tm = tmf.getTrustManagers();

        SSLContext sclx = SSLContext.getInstance("TLS");
        sclx.init( kmf.getKeyManagers(), tm, null);

        SSLSocketFactory factory = sclx.getSocketFactory();
        SSLSocket socket = (SSLSocket) factory.createSocket( "192.168.1.111", 443 );
        socket.startHandshake();

        //if no exceptions are thrown in the startHandshake method, then everything is fine..

Finally register your certificates with HttpsURLConnection if plan to use it:

        char[] passw = "password".toCharArray();
        KeyStore ks = KeyStore.getInstance("JKS", "SUN");
        ks.load(new FileInputStream ( "mykeystore" ), passw );

        KeyManagerFactory kmf = KeyManagerFactory.getInstance("SunX509");
        kmf.init(ks, passw);

        TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        tmf.init(ks);
        TrustManager[] tm = tmf.getTrustManagers();

        SSLContext sclx = SSLContext.getInstance("TLS");
        sclx.init( kmf.getKeyManagers(), tm, null);

        HostnameVerifier hv = new HostnameVerifier()
        {
            public boolean verify(String urlHostName, SSLSession session)
            {
                if (!urlHostName.equalsIgnoreCase(session.getPeerHost()))
                {
                    System.out.println("Warning: URL host '" + urlHostName + "' is different to SSLSession host '" + session.getPeerHost() + "'.");
                }
                return true;
            }
        };

        HttpsURLConnection.setDefaultSSLSocketFactory( sclx.getSocketFactory() );
        HttpsURLConnection.setDefaultHostnameVerifier(hv);
1
  • Your hostname verifier is wrong, session.getPeerHost() doesn't return the name in the certificate, but the name you connected with (i.e. the urlHostName here), so that's always going to be true. You're always returning true anyway.
    – Bruno
    Sep 3, 2014 at 20:37
12

I used Keystore Explorer

  1. Open JKS with a private key
  2. Examine signed PEM from CA
  3. Import key
  4. Save JKS
1
  • 3
    Keystore Explorer is awesome and very versatile. Saves one time from spending a few mindless minutes on the terminal. May 26, 2019 at 3:56
9

I'm always forgetting how to do this because it's something that I just do once in a while, this is one possible solution, and it just works:

  1. Go to your favourite browser and download the main certificate from the secured website.
  2. Execute the two following lines of code:

    $ openssl x509 -outform der -in GlobalSignRootCA.crt -out GlobalSignRootCA.der
    $ keytool -import -alias GlobalSignRootCA -keystore GlobalSignRootCA.jks -file GlobalSignRootCA.der
    
  3. If executing in Java SE environment add the following options:

    $ java -Djavax.net.ssl.trustStore=GlobalSignRootCA.jks -Djavax.net.ssl.trustStorePassword=trustStorePassword -jar MyJar.jar
    
  4. Or add the following to the java code:

    System.setProperty("javax.net.ssl.trustStore", "GlobalSignRootCA.jks");
    System.setProperty("javax.net.ssl.trustStorePassword","trustStorePassword");
    

The other option for step 2 is to just using the keytool command. Bellow is an example with a chain of certificates:

$ keytool -import -file org.eu.crt -alias orgcrt -keystore globalsignrs.jks
$ keytool -import -file GlobalSignOrganizationValidationCA-SHA256-G2.crt -alias globalsignorgvalca -keystore globalsignrs.jks
$ keytool -import -file GlobalSignRootCA.crt -alias globalsignrootca -keystore globalsignrs.jks
0
5

There is also a GUI tool that allows visual JKS creation and certificates importing.

http://portecle.sourceforge.net/

Portecle is a user friendly GUI application for creating, managing and examining keystores, keys, certificates, certificate requests, certificate revocation lists and more.

1
  • 2
    key store explorer is the modern version of portecle. there is no difference between their menus and functionalities at all.
    – Setmax
    Jul 23, 2020 at 13:47
3

I got it from internet. It works pretty good for pem files that contains multiple entries.

#!/bin/bash
pemToJks()
{
        # number of certs in the PEM file
        pemCerts=$1
        certPass=$2
        newCert=$(basename "$pemCerts")
        newCert="${newCert%%.*}"
        newCert="${newCert}"".JKS"
        ##echo $newCert $pemCerts $certPass
        CERTS=$(grep 'END CERTIFICATE' $pemCerts| wc -l)
        echo $CERTS
        # For every cert in the PEM file, extract it and import into the JKS keystore
        # awk command: step 1, if line is in the desired cert, print the line
        #              step 2, increment counter when last line of cert is found
        for N in $(seq 0 $(($CERTS - 1))); do
          ALIAS="${pemCerts%.*}-$N"
          cat $pemCerts |
                awk "n==$N { print }; /END CERTIFICATE/ { n++ }" |
                $KEYTOOLCMD -noprompt -import -trustcacerts \
                                -alias $ALIAS -keystore $newCert -storepass $certPass
        done
}
pemToJks <pem to import> <pass for new jks>
1
  • Thanks for the script. One has to assign the KEYTOOLCMD (i.e.: export KEYTOOLCMD=$(which keytool); echo $KEYTOOLCMD. Also, you can check the resultant keystore using this command: keytool --list --keystore <yourfile.JKS>. Note that the script creates the file using a capital JKS as the extension. Mar 21, 2022 at 16:47
3

OpenJDK keytool handles PEM certificates natively now (and has been for a few releases but I'm not sure since when).

keytool recommends against specifying the cacerts file path like any other keystore but using -cacerts option instead.

So the command line which works with OpenJDK 18 (and probably many earlier versions) is:

keytool -cacerts -import -alias <alias> -file <path_to_cert.pem>
2

Although this question is pretty old and it has already a-lot answers, I think it is worth to provide an alternative. Using native java classes makes it very verbose to just use pem files and almost forces you wanting to convert the pem files into p12 or jks files as using p12 or jks files are much easier. I want to give anyone who wants an alternative for the already provided answers.

GitHub - SSLContext Kickstart

var keyManager = PemUtils.loadIdentityMaterial("certificate-chain.pem", "private-key.pem");
var trustManager = PemUtils.loadTrustMaterial("some-trusted-certificate.pem");

var sslFactory = SSLFactory.builder()
          .withIdentityMaterial(keyManager)
          .withTrustMaterial(trustManager)
          .build();

var sslContext = sslFactory.getSslContext();

I need to provide some disclaimer here, I am the library maintainer

1

If you want to do this on Android, there are a few minor tweaks that can be added to the PEMImporter class from this great answer. To summarize those:

  • First I used Android Studio to translate into Kotlin (this is not necessary, I just prefer it). The original class contained all static methods, so this resulted in a named object instead.

  • javax.xml.bind.DatatypeConverter was removed from the java core in version 11. Although you can still import it (in gradle: implementation("javax.xml.bind:jaxb-api:2.4.0-b180830.0359"), this does not work on Android and it is simpler to use java.util.Base64 for the tasks it performed (namely, translating base64 to bytes). The output is identical (although you need to trim line endings in the raw PEM data).

  • Replace SunX509 and JKS with PKIX. It is only necessary in the first case, and in the second case probably inconsequential; I do not think it has any significance if you are populating a KeyStore with already initialized PrivateKey etc. objects as is done here. I in fact used getDefaultAlgorithm() in place of "JKS" in createKeyStore, and although that default is currently "jks", the key store worked fine in a KeyManagerFactory created with PKIX as the algorithm.

I should also note that I am not using the createSSLFactory method and am instead using the output of createKeyStore() to initialize a KeyManagerFactory and extract KeyManagers used to initialize anSSLContext:

val context = SSLContext.getInstance(contextProtocol)
val password = String(...)
val ks : KeyStore = try {
            PEMImporter.createKeyStore(
                File(keyPath),
                File(certPath),
                password
            )
        } catch (ex : Throwable) { ... }

val kmf = KeyManagerFactory.getInstance("PKIX")
        try { kmf.init(ks, password.toCharArray()) }

It probably doesn't matter much what the password is here since the PEMImporter works with already unencrypted key data -- unless you want to write a PrivateKey back to a file (I presume getEncoded() is a step in that direction but I've never had need to do this). It just has to match in the two uses above.

I also added a catch for RSA PRIVATE KEYS, which, as it turns out, are not the same as PEM keys with no "RSA" in the first line; a subtlety I was previously unaware of. The former are PKCS #1, the latter PKCS #8; you should be able to use whatever tool you normally use to deal with these (eg., when creating keys with certtool, use --pkcs8). Note that doesn't mean PKCS #8 keys aren't potentially RSA based, it's just about the protocol used to store and extract the key data.

Here's my Android version of PEMImporter in Kotlin:

import java.io.*
import java.security.*
import java.security.cert.CertificateException
import java.security.cert.CertificateFactory
import java.security.cert.X509Certificate
import java.security.interfaces.RSAPrivateKey
import java.security.spec.InvalidKeySpecException
import java.security.spec.PKCS8EncodedKeySpec
import java.util.*
import javax.net.ssl.KeyManagerFactory
import javax.net.ssl.SSLContext
import javax.net.ssl.SSLServerSocketFactory

object PEMImporter {

    @Throws(Exception::class)
    fun createSSLFactory(
        privateKeyPem: File,
        certificatePem: File?,
        password: String
    ): SSLServerSocketFactory {
        val context = SSLContext.getInstance("TLS")
        val keystore = createKeyStore(privateKeyPem, certificatePem, password)
        val kmf = KeyManagerFactory.getInstance("PKIX")
        kmf.init(keystore, password.toCharArray())
        val km = kmf.keyManagers
        context.init(km, null, null)
        return context.serverSocketFactory
    }

    /**
     * Create a KeyStore from standard PEM files
     *
     * @param privateKeyPem the private key PEM file
     * @param certificatePem the certificate(s) PEM file
     * @param password the password to set to protect the private key
     */
    @Throws(
        Exception::class,
        KeyStoreException::class,
        IOException::class,
        NoSuchAlgorithmException::class,
        CertificateException::class
    )
    fun createKeyStore(privateKeyPem: File, certificatePem: File?, password: String): KeyStore {
        val cert = createCertificates(certificatePem)
        val keystore = KeyStore.getInstance(KeyStore.getDefaultType())
        keystore.load(null)
        // Import private key
        val key = createPrivateKey(privateKeyPem)
        keystore.setKeyEntry(privateKeyPem.name, key, password.toCharArray(), cert)
        return keystore
    }

    @Throws(Exception::class)
    private fun createPrivateKey(privateKeyPem: File): PrivateKey {
        val r = BufferedReader(FileReader(privateKeyPem))
        var s = r.readLine()
        if (s.contains("BEGIN RSA PRIVATE KEY")) {
            r.close()
            throw IllegalArgumentException(privateKeyPem.name +
                " is a PKCS #1 key, not a PKCS #8.")
        }
        if (s == null || (!s.contains("BEGIN PRIVATE KEY"))) {
            r.close()
            throw IllegalArgumentException("Bad private key header (${privateKeyPem.name}): $s")
        }
        val b = StringBuilder()
        s = ""
        while (s != null) {
            if (s.contains("END PRIVATE KEY")) {
                break
            }
            b.append(s.trimEnd())
            s = r.readLine()
        }
        r.close()
        val hexString = b.toString()
        // Base64 is in java.util.
        val bytes = Base64.getDecoder().decode(hexString)
        return generatePrivateKeyFromDER(bytes)
    }

    @Throws(Exception::class)
    private fun createCertificates(certificatePem: File?): Array<X509Certificate> {
        val result = mutableListOf<X509Certificate>()
        val r = BufferedReader(FileReader(certificatePem))
        var s = r.readLine()
        if (s == null || !s.contains("BEGIN CERTIFICATE")) {
            r.close()
            throw IllegalArgumentException("No CERTIFICATE found")
        }
        var b = StringBuilder()
        while (s != null) {
            if (s.contains("END CERTIFICATE")) {
                val hexString = b.toString()
                val bytes = Base64.getDecoder().decode(hexString.trimEnd())
                val cert = generateCertificateFromDER(bytes)
                result.add(cert)
                b = StringBuilder()
            } else {
                if (!s.startsWith("----")) {
                    b.append(s)
                }
            }
            s = r.readLine()
        }
        r.close()
        return result.toTypedArray()
    }

    @Throws(InvalidKeySpecException::class, NoSuchAlgorithmException::class)
    private fun generatePrivateKeyFromDER(keyBytes: ByteArray): RSAPrivateKey {
        val spec = PKCS8EncodedKeySpec(keyBytes)
        val factory = KeyFactory.getInstance("RSA")
        return factory.generatePrivate(spec) as RSAPrivateKey
    }

    @Throws(CertificateException::class)
    private fun generateCertificateFromDER(certBytes: ByteArray): X509Certificate {
        val factory = CertificateFactory.getInstance("X.509")
        return factory.generateCertificate(ByteArrayInputStream(certBytes)) as X509Certificate
    }
}
0

If you have a pem file with multiple certificates you can use a script to extract them and add them one at a time something like:

    index=0
    while read -r line; do
        if [ "$line" = "-----BEGIN CERTIFICATE-----" ]; then
            echo "$line" > temp_cert.pem
        elif [ "$line" = "-----END CERTIFICATE-----" ]; then
            echo "$line" >> temp_cert.pem
            let "index++"
            keytool -importcert -alias "your-alias_$index" -keystore cacerts -file temp_cert.pem
            rm temp_cert.pem
        else
            echo "$line" >> temp_cert.pem
        fi
    done < multi_certs.pem
0

This is below the Scala code to build a store on the fly.

It can be used this way:

def getServerSocket(): ServerSocket =
    SSL
      .createSSLFactory(Path.of(sslPrivateKey), Path.of(sslCertificate))
      .createServerSocket(port)

I am testing with a certificate I got for a Google Domain via Let's Encrypt.

It works well, but do not forget to use the "fullchain.pem" for the certificates file, and the "privkey.pem" for the private key.

Thanks to everyone.


package cc.lemieux.web.protocol.ssl

import cc.lemieux.web.util.fail

import java.io.{ByteArrayInputStream, File}
import java.nio.charset.StandardCharsets
import java.nio.file.{Files, Path}
import java.security.cert.{CertificateFactory, X509Certificate}
import java.security.interfaces.RSAPrivateKey
import java.security.spec.PKCS8EncodedKeySpec
import java.security.{KeyFactory, KeyStore}
import java.util.Base64
import javax.net.ssl.{KeyManagerFactory, SSLContext, SSLServerSocketFactory}

object SSL:

  def createSSLFactory(privateKeyPemPath: Path, certificatePemPath: Path): SSLServerSocketFactory =
    try
      val privateKeyPem = privateKeyPemPath.toFile()
      val certificatePem = certificatePemPath.toFile()
      val password = ""
      val kmf = KeyManagerFactory.getInstance("SunX509")
      kmf.init(createKeyStore(privateKeyPem, certificatePem), password.toCharArray())
      val context = SSLContext.getInstance("TLS")
      context.init(kmf.getKeyManagers(), null, null)
      context.getServerSocketFactory()
    catch
      case e: Exception =>
        fail(
          s"Can't create SSL factory from private key '$privateKeyPemPath' and certificate '$certificatePemPath'.",
          e
        )

  private def loadTextFile(file: File, nature: String): Array[Array[Byte]] =
    try
      val begin = s"-----BEGIN $nature-----"
      val end = s"-----END $nature-----"
      val lines =
        Files.readString(file.toPath(), StandardCharsets.UTF_8).split('\n').toSeq.filter(_.nonEmpty).map(_.trim())
      if lines.length < 3 then fail("Mot at least 3 lines.")
      def chunk(seq: Seq[String]): Array[Array[Byte]] =
        if seq.isEmpty then Array.empty
        else
          val posBegin = seq.indexOf(begin)
          val posEnd = seq.indexOf(end)
          if posBegin == -1 || posEnd == -1 then fail("Missing header.")
          val chunkData = seq.slice(posBegin + 1, posEnd).mkString
          Base64.getDecoder().decode(chunkData) +: chunk(seq.drop(posEnd + 1))
      chunk(lines)
    catch case e: Exception => fail(s"Can't parse file '${file.getAbsolutePath()}'.", e)

  private def createKeyStore(privateKeyPem: File, certificatePem: File): KeyStore =
    val chunks = loadTextFile(certificatePem, "CERTIFICATE")
    val password = ""
    val certs = chunks.map { bytes =>
      CertificateFactory
        .getInstance("X.509")
        .generateCertificate(new ByteArrayInputStream(bytes))
    }
    val keystore = KeyStore.getInstance("JKS")
    keystore.load(null)
    val key =
      KeyFactory
        .getInstance("RSA")
        .generatePrivate(
          new PKCS8EncodedKeySpec(loadTextFile(privateKeyPem, "PRIVATE KEY").headOption.getOrElse(fail("No key.")))
        )
        .asInstanceOf[RSAPrivateKey]
    keystore.setKeyEntry(privateKeyPem.getName(), key, password.toCharArray(), certs)
    keystore

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.