ProxyCA { public byte[] createChildKeyStore(ApplicationId appId, String ksPassword) throws Exception { Date from = new Date(); Date to = from; KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA"); keyGen.initialize(2048); KeyPair keyPair = keyGen.genKeyPair(); String issuer = caCert.getSubjectX500Principal().getName(); String subject = "CN=" + appId; X509Certificate cert = createCert(false, issuer, subject, from, to, keyPair.getPublic(), caKeyPair.getPrivate()); if (LOG.isTraceEnabled()) { LOG.trace("Certificate for {}: \n{}", appId, cert); } KeyStore keyStore = createChildKeyStore(ksPassword, "server", keyPair.getPrivate(), cert); return keyStoreToBytes(keyStore, ksPassword); } ProxyCA(); void init(); void init(X509Certificate caCert, PrivateKey caPrivateKey); byte[] createChildKeyStore(ApplicationId appId, String ksPassword); byte[] getChildTrustStore(String password); String generateKeyStorePassword(); SSLContext createSSLContext(ApplicationId appId); HostnameVerifier getHostnameVerifier(); @VisibleForTesting X509Certificate getCaCert(); @VisibleForTesting KeyPair getCaKeyPair();  }
@Test public void testCreateChildKeyStore() throws Exception { ProxyCA proxyCA = new ProxyCA(); proxyCA.init(); ApplicationId appId = ApplicationId.newInstance(System.currentTimeMillis(), 1); byte[] keystoreBytes = proxyCA.createChildKeyStore(appId, "password"); KeyStore keyStore = KeyStoreTestUtil.bytesToKeyStore(keystoreBytes, "password"); Assert.assertEquals(1, keyStore.size()); Certificate[] certChain = keyStore.getCertificateChain("server"); Assert.assertEquals(2, certChain.length); X509Certificate caCert = (X509Certificate) certChain[1]; X509Certificate cert = (X509Certificate) certChain[0]; Assert.assertEquals(caCert.getSubjectX500Principal().toString(), cert.getIssuerDN().toString()); Assert.assertEquals(new X500Principal("CN=" + appId), cert.getSubjectX500Principal()); Assert.assertFalse("Found multiple fields in X500 Principal, when there " + "should have only been one: " + cert.getSubjectX500Principal(), cert.getSubjectX500Principal().toString().contains(",")); Assert.assertEquals("SHA512withRSA", cert.getSigAlgName()); Assert.assertEquals(cert.getNotBefore(), cert.getNotAfter()); Assert.assertTrue("Expected certificate to be expired but was not: " + cert.getNotAfter(), cert.getNotAfter().before(new Date())); Assert.assertEquals(new X500Principal("CN=" + appId).toString(), cert.getSubjectDN().toString()); Key privateKey = keyStore.getKey("server", "password".toCharArray()); Assert.assertEquals("RSA", privateKey.getAlgorithm()); Assert.assertEquals(-1, cert.getBasicConstraints()); PublicKey caPublicKey = caCert.getPublicKey(); cert.verify(caPublicKey); checkCACert(caCert); Assert.assertEquals(proxyCA.getCaCert(), caCert); caCert.verify(caPublicKey); PrivateKey caPrivateKey = proxyCA.getX509KeyManager().getPrivateKey(null); checkPrivatePublicKeys(caPrivateKey, caPublicKey); Assert.assertEquals(proxyCA.getCaKeyPair().getPublic(), caPublicKey); Assert.assertEquals(proxyCA.getCaKeyPair().getPrivate(), caPrivateKey); }