1

I have a question about configuring SSL in jetty server.

I know we can use keystore and truststore to enable SSL in jetty server. But i have a pfx file. Can i use it directly instead of converting it into keystore and truststore jks files.

Reference code:

http://www.programcreek.com/java-api-examples/index.php?api=org.eclipse.jetty.util.ssl.SslContextFactory

http://git.eclipse.org/c/jetty/org.eclipse.jetty.project.git/tree/examples/embedded/src/main/java/org/eclipse/jetty/embedded/LikeJettyXml.java

1 Answer 1

1

PFX files are in fact PKCS12 key stores. So if you have an option to set the keystore type (I am not sure where in Jetty) you could use them directly.

See: http://wiki.eclipse.org/Jetty/Howto/Configure_SSL#Configuring_Jetty

you have to add the keyStoreType and trustStoreType set to PKCS12. I've used it inside the Karaf container that way (for some older version).

In the code you've linked I see no option for keystoreType (lite/embedded?), then you're bound to JKS store type and you have to convert the keystores

5
  • When i use pkcs12 with pfx file, i get caused by: java.security.invalidkeyexception: illegal key size exception. Do you know how to solve this?
    – Kumar
    Jun 2, 2017 at 8:37
  • @Kumar if the keys are having length of 2048bit and more you need to have the JCE Unlimited Strength Policy installed
    – gusto2
    Jun 2, 2017 at 8:54
  • Yes, it is installed by default in JDK 1.7. Isn't it?
    – Kumar
    Jun 2, 2017 at 9:00
  • @Kumar I've read OpenJDK 1.7+ should contain the Unlimited Strength JCE policy , but this exception really means unsupported key length
    – gusto2
    Jun 2, 2017 at 9:03
  • @Kumar javax.crypto.Cipher.getMaxAllowedKeyLength(String transformation) should asnwer what's the limit. Please note only certain distributions of OpenJDK are including Unlimited JCE.
    – gusto2
    Jun 2, 2017 at 9:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.