Class CertificateManager

java.lang.Object
ecmwf.common.security.CertificateManager
public final class CertificateManager extends Object
The Class CertificateManager.

  • Field Details

    • ALIAS

      public static final String ALIAS
      Alias used for the single entry stored in every managed keystore.
      See Also:

  • Method Details

    • ensureSelfSigned

      public static void ensureSelfSigned(String keystorePath, String keystorePassword, String hostname) throws Exception
      Ensures a self-signed certificate exists at keystorePath. If the file is absent or empty the method generates a new RSA-2048 / SHA-256 self-signed certificate and stores it as a PKCS#12 keystore at that path. The method is idempotent; it does nothing when a certificate is already present.
      Parameters:
      keystorePath - path where the PKCS#12 keystore should be created
      keystorePassword - password to protect the keystore and private key
      hostname - the CN / SAN hostname to embed in the certificate
      Throws:
      Exception - if generation or writing fails

    • generateSelfSigned

      public static void generateSelfSigned(String keystorePath, String keystorePassword, String hostname) throws Exception
      Generates a new RSA-2048 / SHA-256 self-signed certificate and stores it as a PKCS#12 keystore at keystorePath, overwriting any existing file.
      Parameters:
      keystorePath - destination path for the PKCS#12 keystore
      keystorePassword - password to protect the keystore and private key
      hostname - CN and DNS SAN entry for the certificate
      Throws:
      Exception - if generation or writing fails

    • getCertificateInfo

      public static CertificateManager.CertificateInfo getCertificateInfo(String keystorePath, String keystorePassword, String keystoreType) throws Exception
      Reads the certificate stored under ALIAS in the keystore at keystorePath and returns a CertificateManager.CertificateInfo snapshot.
      Parameters:
      keystorePath - path to the PKCS#12 (or JKS) keystore
      keystorePassword - password for the keystore
      keystoreType - "PKCS12" or "JKS"
      Returns:
      certificate metadata, or null if the file does not exist
      Throws:
      Exception - on any I/O or crypto error

    • isSelfSigned

      public static boolean isSelfSigned(X509Certificate cert)
      Returns true when the certificate is self-signed, i.e. when its issuer DN equals its subject DN.
      Parameters:
      cert - the X.509 certificate to inspect
      Returns:
      true if self-signed

    • generateCsr

      public static String generateCsr(String keystorePath, String keystorePassword) throws Exception
      Generates a PKCS#10 Certificate Signing Request (CSR) for the private key stored in the keystore at keystorePath and returns it as a PEM string.
      Parameters:
      keystorePath - path to the PKCS#12 keystore containing the private key
      keystorePassword - password for the keystore
      Returns:
      PEM-encoded CSR
      Throws:
      Exception - on any I/O or crypto error

    • generateCsr

      public static String generateCsr(String keystorePath, String keystorePassword, String hostname) throws Exception
      Generates a PKCS#10 Certificate Signing Request (CSR). If hostname is provided it is used as the CN; otherwise the subject of the existing certificate is reused.
      Parameters:
      keystorePath - path to the PKCS#12 keystore containing the private key
      keystorePassword - password for the keystore
      hostname - optional CN to embed; null to reuse the existing certificate subject
      Returns:
      PEM-encoded CSR
      Throws:
      Exception - on any I/O or crypto error

    • importCertificate

      public static void importCertificate(String targetKeystorePath, String targetPassword, byte[] inputBytes, String inputPassword) throws Exception
      Imports a certificate (and optional private key) from raw bytes into the keystore at targetKeystorePath, replacing any existing entry. The input can be in PEM, PKCS#12, or JKS format; the method auto-detects the format.
      Parameters:
      targetKeystorePath - path where the updated PKCS#12 keystore should be written
      targetPassword - password for the target keystore
      inputBytes - raw bytes of the certificate/keystore to import
      inputPassword - password for the input file (may be null for plain PEM)
      Throws:
      Exception - if the format is unsupported or import fails

    • exportPublicCertPem

      public static String exportPublicCertPem(String keystorePath, String keystorePassword, String keystoreType) throws Exception
      Exports the public certificate from the keystore at keystorePath as a PEM-encoded string.
      Parameters:
      keystorePath - path to the PKCS#12 (or JKS) keystore
      keystorePassword - password for the keystore
      keystoreType - "PKCS12" or "JKS"
      Returns:
      PEM-encoded certificate
      Throws:
      Exception - on any I/O or crypto error