Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
This commit introduces two new CLI commands to enhance TLS management: - Generate and install a Quarkus Development CA. - Create certificates, either signed with the generated CA or unsigned.
- Loading branch information
1 parent
542f553
commit 59d4145
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,86 @@ | ||
| <?xml version="1.0"?> | ||
| <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd"> | ||
| <modelVersion>4.0.0</modelVersion> | ||
| <parent> | ||
| <groupId>io.quarkus</groupId> | ||
| <artifactId>quarkus-tls-registry-parent</artifactId> | ||
| <version>999-SNAPSHOT</version> | ||
| </parent> | ||
|
|
||
| <artifactId>quarkus-tls-registry-cli</artifactId> | ||
| <name>Quarkus - TLS Registry - CLI</name> | ||
|
|
||
| <properties> | ||
| <main.class>io.quarkus.tls.cli.TlsCommand</main.class> | ||
| </properties> | ||
|
|
||
| <dependencies> | ||
| <dependency> | ||
| <groupId>info.picocli</groupId> | ||
| <artifactId>picocli</artifactId> | ||
| </dependency> | ||
|
|
||
| <dependency> | ||
| <groupId>me.escoffier.certs</groupId> | ||
| <artifactId>certificate-generator</artifactId> | ||
| </dependency> | ||
|
|
||
| <dependency> | ||
| <groupId>org.junit.jupiter</groupId> | ||
| <artifactId>junit-jupiter-engine</artifactId> | ||
| <scope>test</scope> | ||
| </dependency> | ||
| </dependencies> | ||
| <build> | ||
| <plugins> | ||
| <plugin> | ||
| <groupId>org.apache.maven.plugins</groupId> | ||
| <artifactId>maven-compiler-plugin</artifactId> | ||
| <configuration> | ||
| <compilerArgs> | ||
| <arg>-parameters</arg> | ||
| </compilerArgs> | ||
| </configuration> | ||
| </plugin> | ||
| <plugin> | ||
| <groupId>org.apache.maven.plugins</groupId> | ||
| <artifactId>maven-surefire-plugin</artifactId> | ||
| <configuration> | ||
| <systemPropertyVariables> | ||
| <java.util.logging.manager>org.jboss.logmanager.LogManager</java.util.logging.manager> | ||
| <maven.home>${maven.home}</maven.home> | ||
| </systemPropertyVariables> | ||
| </configuration> | ||
| </plugin> | ||
| <plugin> | ||
| <groupId>org.apache.maven.plugins</groupId> | ||
| <artifactId>maven-assembly-plugin</artifactId> | ||
|
|
||
| <configuration> | ||
| <descriptorRefs> | ||
| <descriptorRef>jar-with-dependencies</descriptorRef> | ||
| </descriptorRefs> | ||
| <finalName>${project.artifactId}-${project.version}</finalName> | ||
| <appendAssemblyId>false</appendAssemblyId> | ||
| <archive> | ||
| <manifest> | ||
| <addClasspath>true</addClasspath> | ||
| <mainClass>${main.class}</mainClass> | ||
| </manifest> | ||
| </archive> | ||
| </configuration> | ||
|
|
||
| <executions> | ||
| <execution> | ||
| <id>make-assembly</id> | ||
| <phase>package</phase> | ||
| <goals> | ||
| <goal>single</goal> | ||
| </goals> | ||
| </execution> | ||
| </executions> | ||
|
|
||
| </plugin> | ||
| </plugins> | ||
| </build> | ||
| </project> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,16 @@ | ||
| package io.quarkus.tls.cli; | ||
|
|
||
| import java.io.File; | ||
|
|
||
| public interface Constants { | ||
|
|
||
| String CA_FILE_NAME = "quarkus-dev-root-ca.pem"; | ||
| String PK_FILE_NAME = "quarkus-dev-root-key.pem"; | ||
| String KEYSTORE_FILE_NAME = "quarkus-dev-keystore.p12"; | ||
|
|
||
| File BASE_DIR = new File(System.getenv("HOME"), ".quarkus"); | ||
|
|
||
| File CA_FILE = new File(BASE_DIR, CA_FILE_NAME); | ||
| File PK_FILE = new File(BASE_DIR, PK_FILE_NAME); | ||
| File KEYSTORE_FILE = new File(BASE_DIR, KEYSTORE_FILE_NAME); | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,98 @@ | ||
| package io.quarkus.tls.cli; | ||
|
|
||
| import static io.quarkus.tls.cli.Constants.CA_FILE; | ||
| import static io.quarkus.tls.cli.Constants.KEYSTORE_FILE; | ||
| import static io.quarkus.tls.cli.Constants.PK_FILE; | ||
| import static java.lang.System.Logger.Level.INFO; | ||
|
|
||
| import java.io.File; | ||
| import java.io.FileInputStream; | ||
| import java.io.IOException; | ||
| import java.security.KeyStore; | ||
| import java.security.KeyStoreException; | ||
| import java.security.NoSuchAlgorithmException; | ||
| import java.security.cert.Certificate; | ||
| import java.security.cert.CertificateException; | ||
| import java.security.cert.X509Certificate; | ||
| import java.util.concurrent.Callable; | ||
|
|
||
| import me.escoffier.certs.ca.CaGenerator; | ||
| import picocli.CommandLine; | ||
|
|
||
| @CommandLine.Command(name = "generate-quarkus-ca", mixinStandardHelpOptions = true, description = "Generate Quarkus Dev CA certificate and private key.") | ||
| public class GenerateCACommand implements Callable<Integer> { | ||
|
|
||
| @CommandLine.Option(names = { "-i", | ||
| "--install" }, description = "Install the generated CA into the system keychain.", defaultValue = "false") | ||
| boolean install; | ||
|
|
||
| @CommandLine.Option(names = { "-t", | ||
| "--truststore" }, description = "Generate a PKCS12 (`.p12`) truststore containing the generated CA.", defaultValue = "false") | ||
| boolean truststore; | ||
|
|
||
| @CommandLine.Option(names = { "-r", | ||
| "--renew" }, description = "Update certificate if already created.", defaultValue = "false") | ||
| boolean renew; | ||
|
|
||
| static System.Logger LOGGER = System.getLogger("generate-quarkus-ca"); | ||
|
|
||
| @Override | ||
| public Integer call() throws Exception { | ||
| LOGGER.log(INFO, "🔥 Generating Quarkus Dev CA certificate..."); | ||
| if (!Constants.BASE_DIR.exists()) { | ||
| Constants.BASE_DIR.mkdirs(); | ||
| } | ||
|
|
||
| if (CA_FILE.exists() && !renew) { | ||
| if (!hasExpired()) { | ||
| LOGGER.log(INFO, | ||
| "\uD83D\uDEAB Quarkus Dev CA certificate already exists and has not yet expired. Use --renew to update."); | ||
| return 0; | ||
| } | ||
| } | ||
|
|
||
| CaGenerator generator = new CaGenerator(CA_FILE, PK_FILE, KEYSTORE_FILE, "quarkus"); | ||
| generator | ||
| .generate("quarkus-dev-root-ca", "Quarkus", "Quarkus Dev", "home", "world", "Cloud"); | ||
| if (install) { | ||
| LOGGER.log(INFO, "🔥 Installing the CA certificate in the system truststore..."); | ||
| generator.installToSystem(); | ||
| } | ||
|
|
||
| if (truststore) { | ||
| LOGGER.log(INFO, "🔥 Generating p12 truststore..."); | ||
| File ts = new File("quarkus-ca-truststore.p12"); | ||
| generator.generateTrustStore(ts); | ||
| LOGGER.log(INFO, "🔥 Truststore generated successfully."); | ||
| } | ||
|
|
||
| LOGGER.log(INFO, "🔥 Quarkus Development CA generated and installed"); | ||
|
|
||
| return 0; | ||
| } | ||
|
|
||
| private boolean hasExpired() throws Exception { | ||
| var cert = getCertificateFromPKCS12(); | ||
| try { | ||
| cert.checkValidity(); | ||
| } catch (Exception e) { | ||
| LOGGER.log(INFO, "🔥 Certificate has expired. Renewing..."); | ||
| return true; | ||
| } | ||
| return false; | ||
| } | ||
|
|
||
| private static X509Certificate getCertificateFromPKCS12() | ||
| throws IOException, KeyStoreException, CertificateException, NoSuchAlgorithmException { | ||
| try (FileInputStream fis = new FileInputStream(KEYSTORE_FILE)) { | ||
| KeyStore keystore = KeyStore.getInstance("PKCS12"); | ||
| keystore.load(fis, "quarkus".toCharArray()); | ||
| Certificate cert = keystore.getCertificate(CaGenerator.KEYSTORE_CERT_ENTRY); | ||
| if (cert == null) { | ||
| throw new KeyStoreException("No certificate found with alias: " + CaGenerator.KEYSTORE_CERT_ENTRY); | ||
| } | ||
| return (X509Certificate) cert; | ||
| } | ||
| } | ||
|
|
||
| } |
Oops, something went wrong.