Generating SSL KeyStores

Integration Tests

Our embedded container tests use KeyStores containing self-signed certificates to test various aspects of the container’s SSL support. The KeyStores can be created using the following steps.

Delete the old .jks KeyStore:

rm spring-boot-project/spring-boot/src/test/resources/test.jks

Create a new .jks KeyStore with spring-boot and test-alias entries:

keytool -genkeypair -storepass secret -keypass password -keystore spring-boot-project/spring-boot/src/test/resources/test.jks -storetype JKS -dname "CN=localhost, OU=Spring, O=VMware, L=Palo Alto, ST=California, C=US" -validity 36500 -alias spring-boot -keyalg RSA -ext "SAN=DNS:localhost,IP:::1,IP:127.0.0.1" keytool -genkeypair -storepass secret -keypass password -keystore spring-boot-project/spring-boot/src/test/resources/test.jks -storetype JKS -dname "CN=localhost, OU=Spring, O=VMware, L=Palo Alto, ST=California, C=US" -validity 36500 -alias test-alias -keyalg RSA -ext "SAN=DNS:localhost,IP:::1,IP:127.0.0.1"

Delete the old .p12 KeyStore:

rm spring-boot-project/spring-boot/src/test/resources/test.p12

Create a new .p12 KeyStore from the .jks KeyStore:

keytool -importkeystore -srckeystore spring-boot-project/spring-boot/src/test/resources/test.jks -destkeystore spring-boot-project/spring-boot/src/test/resources/test.p12 -deststoretype pkcs12 -srcstorepass secret -deststorepass secret -destkeypass secret

Tip	Use `password` when prompted for the passwords for the `spring-boot` and `test-alias` entries.

Create a trusted cert entry (required by Tomcat) in the two new KeyStores:

keytool -keystore spring-boot-project/spring-boot/src/test/resources/test.jks -storepass secret -alias spring-boot -exportcert > exported keytool -keystore spring-boot-project/spring-boot/src/test/resources/test.jks -storepass secret -importcert -file exported -alias spring-boot-cert -noprompt keytool -keystore spring-boot-project/spring-boot/src/test/resources/test.p12 -storepass secret -importcert -file exported -alias spring-boot-cert -noprompt keytool -keystore spring-boot-project/spring-boot/src/test/resources/test.jks -storepass secret -alias test-alias -exportcert > exported keytool -keystore spring-boot-project/spring-boot/src/test/resources/test.jks -storepass secret -importcert -file exported -alias test-alias-cert -noprompt keytool -keystore spring-boot-project/spring-boot/src/test/resources/test.p12 -storepass secret -importcert -file exported -alias test-alias-cert -noprompt rm exported

Export the key and the certificate to PEM files:

rm spring-boot-project/spring-boot/src/test/resources/test-cert.pem keytool -exportcert -alias test-alias -keystore spring-boot-project/spring-boot/src/test/resources/test.jks -rfc -file spring-boot-project/spring-boot/src/test/resources/test-cert.pem rm spring-boot-project/spring-boot/src/test/resources/test-key.pem keytool -importkeystore -srckeystore spring-boot-project/spring-boot/src/test/resources/test.jks -destkeystore exported -deststoretype PKCS12 -srcalias test-alias openssl pkcs12 -in exported -out spring-boot-project/spring-boot/src/test/resources/test-key.pem -nodes rm exported

Tip	Use `secret` when prompted for the keystore passwords or the import password and `password` when prompted for the key password of the `test-alias` entry.

List the test-alias entry to find the serial number used to create SerialNumberValidatingTrustSelfSignedStrategy in the tests:

keytool -list -keystore spring-boot-project/spring-boot/src/test/resources/test.jks -v -storepass secret -alias test-alias

Alias name: test-alias Creation date: 19-Aug-2021 Entry type: PrivateKeyEntry Certificate chain length: 1 Certificate[1]: Owner: CN=127.0.0.1, OU=Spring, O=VMware, L=Palo Alto, ST=California, C=US Issuer: CN=127.0.0.1, OU=Spring, O=VMware, L=Palo Alto, ST=California, C=US Serial number: 18d36252 Valid from: Thu Aug 19 13:40:16 BST 2021 until: Sun Aug 17 13:40:16 BST 2031 Certificate fingerprints: SHA1: CD:1D:C0:EC:6A:EB:01:18:EF:47:9A:6D:5D:28:CF:67:EB:02:AD:E9 SHA256: 44:E8:4A:15:D0:8B:12:5B:51:6A:66:2D:19:82:3C:59:F8:F3:8B:0F:8C:35:60:79:31:FA:FE:86:BB:B6:81:76 Signature algorithm name: SHA256withRSA Subject Public Key Algorithm: 2048-bit RSA key Version: 3 Extensions: #1: ObjectId: 2.5.29.17 Criticality=false SubjectAlternativeName [ IPAddress: 0:0:0:0:0:0:0:1 ] #2: ObjectId: 2.5.29.14 Criticality=false SubjectKeyIdentifier [ KeyIdentifier [ 0000: E1 56 CE 8F CB 7B 42 C3 FD 45 D6 1F 5C 6D DB 2B .V....B..E..\m.+ 0010: DE E1 17 82 .... ] ]

In this case, the serial number is 18d36252.

Smoke Tests

Some smoke tests verify SSL connectivity between a server and client, mostly using two-way (mutual) TLS authentication.

If the tests contain test-*.crt and test-*.key files in /src/test/resources/ssl, the certificates and keys can be created using the following shell script:

#!/bin/bash generate_cert() { local name=$1 local cn="$2" local opts="$3" local keyfile=${name}.key local certfile=${name}.crt [ -f $keyfile ] || openssl genrsa -out $keyfile 2048 openssl req \ -new -sha256 \ -subj "/O=Spring Boot Test/CN=$cn" \ -addext "subjectAltName=DNS:example.com,DNS:localhost,DNS:127.0.0.1" \ -key $keyfile | \ openssl x509 \ -req -sha256 \ -CA test-ca.crt \ -CAkey test-ca.key \ -CAserial test-ca.txt \ -CAcreateserial \ -days 3650 \ $opts \ -out $certfile } [ -f test-ca.key ] || openssl genrsa -out test-ca.key 4096 openssl req \ -x509 -new -nodes -sha256 \ -key test-ca.key \ -days 3650 \ -subj '/O=Spring Boot Test/CN=Certificate Authority' \ -addext "subjectAltName=DNS:example.com,DNS:localhost,DNS:127.0.0.1" \ -out test-ca.crt cat > openssl.cnf <<_END_ subjectAltName = @alt_names [alt_names] DNS.1 = example.com DNS.2 = localhost [ server_cert ] keyUsage = digitalSignature, keyEncipherment nsCertType = server [ client_cert ] keyUsage = digitalSignature, keyEncipherment nsCertType = client _END_ generate_cert test-server "localhost" "-extfile openssl.cnf -extensions server_cert" generate_cert test-client "localhost" "-extfile openssl.cnf -extensions client_cert" rm openssl.cnf rm test-ca.txt

If the tests contain test-*.p12 files in /src/test/resources/ssl, the keystores can be created by first running the script above and then converting the certificates and keys to the PKCS12 format with these commands:

openssl pkcs12 -export -legacy -out test-client.p12 -in test-client.crt -inkey test-client.key openssl pkcs12 -export -legacy -out test-server.p12 -in test-server.crt -inkey test-server.key openssl pkcs12 -export -legacy -out test-ca.p12 -in test-ca.crt -inkey test-ca.key

Use password when prompted by openssl for the export password.