Scala KeyStore类代码示例

//设置package包名称以及导入依赖的类
import java.security.KeyStore
import javax.net.ssl.{KeyManagerFactory, SSLContext, TrustManagerFactory}

import com.twitter.finagle.Http
import com.twitter.util.Await
import io.circe.generic.auto._
import io.finch._
import io.finch.circe._


object WebserverApp extends App {

  def getSSLContext: SSLContext = {
    // Create and initialize the SSLContext with key material
    val passphrase = "sample".toCharArray()
    val trustPassphrase = "sample".toCharArray()
    // First initialize the key and trust material
    val ksKeys = KeyStore.getInstance("JKS")
    val keystoreResource = this.getClass.getClassLoader.getResourceAsStream("sample-keystore.jks")
    ksKeys.load(keystoreResource, passphrase)
    val ksTrust = KeyStore.getInstance("JKS")
    val trustStoreResource = this.getClass.getClassLoader.getResourceAsStream("sample-keystore.jks")
    ksTrust.load(trustStoreResource, trustPassphrase)
    // KeyManagers decide which key material to us
    val kmf = KeyManagerFactory.getInstance("SunX509")
    kmf.init(ksKeys, passphrase)
    // TrustManagers decide whether to allow connections
    val tmf = TrustManagerFactory.getInstance("SunX509")
    tmf.init(ksTrust)
    val sslContext = SSLContext.getInstance("TLS")
    sslContext.init(kmf.getKeyManagers, tmf.getTrustManagers, null)
    sslContext
  }


  def sample: Endpoint[String] =
    get("sample") {
      Ok("Was it a TLS connection?... probably not")
    }

  val routes = sample

  val server = Http.server
    .withTransport.tls(getSSLContext)
    .serve(s":38082", routes.handle {
      case e: Exception =>
        InternalServerError(e)
    }.toService)

  println("Server running on :38082")
  Await.result(server)

} 

//设置package包名称以及导入依赖的类
package org.packtpublishing.security

import java.security.{SecureRandom, KeyStore}
import javax.net.ssl.{KeyManagerFactory, SSLContext, TrustManagerFactory}
import spray.io.ServerSSLEngineProvider
import resource._

trait SslSupport {
  val random = SecureRandom.getInstance("SHA1PRNG")
  
  val keyStoreLocation = "/spray-book-catalog.jks"
  val keyStorePassword = "passw0rd"

  implicit def sslContext: SSLContext = {    
    val keyStore = KeyStore.getInstance("jks")
    
    for (jks <- managed(getClass.getResourceAsStream(keyStoreLocation))) {
      keyStore.load(jks, keyStorePassword.toCharArray)
    }
    
    val keyManagerFactory = KeyManagerFactory.getInstance("SunX509")
    keyManagerFactory.init(keyStore, keyStorePassword.toCharArray)
    
    val trustManagerFactory = TrustManagerFactory.getInstance("SunX509")
    trustManagerFactory.init(keyStore)
    
    val context = SSLContext.getInstance("TLS")
    context.init(keyManagerFactory.getKeyManagers, trustManagerFactory.getTrustManagers, random)
    context
  }
   
  implicit def sslEngineProvider: ServerSSLEngineProvider = {
    ServerSSLEngineProvider { engine =>
      engine.setEnabledProtocols(Array("TLSv1", "TLSv1.1", "TLSv1.2"))
      engine
    }
  }
} 

//设置package包名称以及导入依赖的类
package com.zhranklin.homepage

import java.io.InputStream
import java.security.{KeyStore, SecureRandom}
import javax.net.ssl._

import akka.http.scaladsl._
import akka.util.Timeout
import com.typesafe.config.ConfigFactory

import scala.concurrent.duration._
import scala.io.{Source, StdIn}

object Boot extends App with MyRouteService {

  import ActorImplicits._

  implicit val timeout = Timeout(5.seconds)

  val conf = ConfigFactory.load().getConfig("settings.server")
  val host = conf.getString("host")
  val httpBindingFuture = Http().bindAndHandle(myRoute, host, conf.getInt("http_port"))
  val httpsBindingFuture =
    Http().bindAndHandle(myRoute, host, conf.getInt("https_port"), SSLConfig.https)
  println(s"Server online at http://$host:8080/\nPress RETURN to stop...")
  if (System.getProperty("dev") != null) {
    StdIn.readLine() // let it run until user presses return
    Seq(httpBindingFuture, httpsBindingFuture).foreach { _
      .flatMap(_.unbind())
      .onComplete(_ ? system.terminate())
    }
  }
}

object SSLConfig {
  val https: HttpsConnectionContext = {

    val password: Array[Char] = Source.fromInputStream(getClass.getClassLoader.getResourceAsStream("password")).toArray.filter(_ != '\n')

    val ks: KeyStore = KeyStore.getInstance("jks")
    val keystore: InputStream = getClass.getClassLoader.getResourceAsStream("zhranklin.com.jks")

    require(keystore != null, "Keystore required!")
    ks.load(keystore, password)

    val keyManagerFactory: KeyManagerFactory = KeyManagerFactory.getInstance("SunX509")
    keyManagerFactory.init(ks, password)

    val tmf: TrustManagerFactory = TrustManagerFactory.getInstance("SunX509")
    tmf.init(ks)

    val sslContext: SSLContext = SSLContext.getInstance("TLS")
    sslContext.init(keyManagerFactory.getKeyManagers, tmf.getTrustManagers, new SecureRandom)
    ConnectionContext.https(sslContext)
  }

} 

//设置package包名称以及导入依赖的类
package korolev.blazeServer

import java.net.InetAddress
import java.security.KeyStore
import javax.net.ssl.{KeyManagerFactory, SSLContext}

import org.http4s.blaze.util.BogusKeystore

import scala.concurrent.ExecutionContextExecutorService


case class BlazeServerConfig(
  port: Int = 8080,
  host: String = InetAddress.getLoopbackAddress.getHostAddress,
  sslContext: Option[SSLContext] = None,
  bufferSize: Int = 8 * 1024,
  maxRequestBodySize: Int = 8 * 1024 * 1024,
  maxRequestHeaderSize: Int = 10 * 1024,
  doNotBlockCurrentThread: Boolean = false
)(
  // Trampoline
  implicit val executionContext: ExecutionContextExecutorService
)

object BlazeServerConfig {

  def bogusSslContext: SSLContext = {
    val ksStream = BogusKeystore.asInputStream()
    assert(ksStream != null)
    val ks = KeyStore.getInstance("JKS")
    ks.load(ksStream, BogusKeystore.getKeyStorePassword)
    val kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm)
    kmf.init(ks, BogusKeystore.getCertificatePassword)
    val context = SSLContext.getInstance("SSL")
    context.init(kmf.getKeyManagers, null, null)
    context
  }
} 

//设置package包名称以及导入依赖的类
package jp.pigumer

import java.io.{OutputStream, Reader}
import java.security.cert.X509Certificate
import java.security.{KeyStore, PrivateKey}

import org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter
import org.bouncycastle.openssl.{PEMKeyPair, PEMParser}

object Pkcs12Convertor {

  def parsePrivateKey(reader: Reader): PrivateKey = {
    val pemParser = new PEMParser(reader)
    val pemKeyPair = pemParser.readObject().asInstanceOf[PEMKeyPair]
    new JcaPEMKeyConverter().getKeyPair(pemKeyPair).getPrivate
  }

  def parseCertificate(reader: Reader): X509Certificate = {
    val pemParser = new PEMParser(reader)
    val certificate = pemParser.readObject()
    null
  }

  def write(os: OutputStream, privateKey: PrivateKey, password: Array[Char], certificate: X509Certificate): Unit = {
    val keyStore = KeyStore.getInstance("pkcs12")
    keyStore.load(null, password)

    keyStore.setKeyEntry("1", privateKey, password, Seq(certificate).toArray)
    keyStore.store(os, password)
  }

} 

//设置package包名称以及导入依赖的类
package rere.driver.connection

import java.io.ByteArrayInputStream
import java.security.KeyStore
import java.security.cert.{CertificateFactory, X509Certificate}
import javax.net.ssl.{SSLContext, TrustManagerFactory}

import rere.driver.TLSProtocolVersion

sealed trait SSLContextProvider {
  def getSSLContext: SSLContext
}

class PreparedSSLContextProvider(context: SSLContext) extends SSLContextProvider {
  override def getSSLContext: SSLContext = context
}

class FromCertificateFileProvider(bytes: Array[Byte], protocolVersion: TLSProtocolVersion) extends SSLContextProvider {
  override def getSSLContext: SSLContext = {
    val certificateFactory = CertificateFactory.getInstance("X.509")
    val certificate = certificateFactory.generateCertificate(new ByteArrayInputStream(bytes)).asInstanceOf[X509Certificate]

    val trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm)
    val keyStore = KeyStore.getInstance(KeyStore.getDefaultType)
    keyStore.load(null)
    keyStore.setCertificateEntry("rootCa", certificate)
    trustManagerFactory.init(keyStore)

    val context = SSLContext.getInstance(protocolVersion.canonicalName)
    context.init(null, trustManagerFactory.getTrustManagers, null)
    context
  }
} 

//设置package包名称以及导入依赖的类
package com.biosimilarity.evaluator.spray.client

import java.io.InputStream
import java.security.cert.{Certificate, CertificateFactory}
import java.security.{KeyStore, SecureRandom}
import javax.net.ssl.{SSLContext, SSLParameters, TrustManagerFactory}

import com.biosimilarity.evaluator.util._
import spray.io.{ClientSSLEngineProvider, SSLContextProvider}

object ClientSSLConfiguration {

  private def loadX509Certificate(resourceName: String): Certificate = {
    val certResource: InputStream = resourceStream(resourceName)
    try {
      CertificateFactory.getInstance("X.509").generateCertificate(certResource)
    } finally {
      certResource.close()
    }
  }

  private def clientSSLContext: SSLContext = {
    val keystore: KeyStore                       = KeyStore.getInstance(KeyStore.getDefaultType)
    val trustManagerFactory: TrustManagerFactory = TrustManagerFactory.getInstance("SunX509")
    val context: SSLContext                      = SSLContext.getInstance("TLS")
    val params: SSLParameters                    = new SSLParameters
    keystore.load(null, null)
    keystore.setCertificateEntry("ca", loadX509Certificate("gloseval.pem"))
    trustManagerFactory.init(keystore)
    context.init(null, trustManagerFactory.getTrustManagers, new SecureRandom)
    params.setEndpointIdentificationAlgorithm("https")
    context
  }

  def clientSSLEngineProvider: ClientSSLEngineProvider = ClientSSLEngineProvider(identity)(SSLContextProvider.forContext(clientSSLContext))
} 

//设置package包名称以及导入依赖的类
package com.biosimilarity.evaluator.spray

import java.io.InputStream
import java.security.{KeyStore, SecureRandom}
import javax.net.ssl.{KeyManagerFactory, SSLContext, TrustManagerFactory}

import com.biosimilarity.evaluator.distribution.EvalConfigWrapper
import com.biosimilarity.evaluator.util._
import spray.io.{SSLContextProvider, ServerSSLEngineProvider}

object SSLConfiguration extends Serializable {

  private def sslContext: SSLContext = {
    val keystoreResource: InputStream = resourceStream("keystore.jks")
    try {
      val storepass: String                        = EvalConfigWrapper.readString("storepass")
      val keypass: String                          = EvalConfigWrapper.readString("keypass")
      val keyStore: KeyStore                       = KeyStore.getInstance("jks")
      val keyManagerFactory: KeyManagerFactory     = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm)
      val trustManagerFactory: TrustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm)
      val context: SSLContext                      = SSLContext.getInstance("TLS")
      keyStore.load(keystoreResource, storepass.toCharArray)
      keyManagerFactory.init(keyStore, keypass.toCharArray)
      trustManagerFactory.init(keyStore)
      context.init(keyManagerFactory.getKeyManagers, trustManagerFactory.getTrustManagers, new SecureRandom)
      context
    } finally {
      keystoreResource.close()
    }
  }

  def sslEngineProvider: ServerSSLEngineProvider = ServerSSLEngineProvider(identity)(SSLContextProvider.forContext(sslContext))
} 

//设置package包名称以及导入依赖的类
package org.hyperscala.util

import java.io.File
import java.nio.file.Files
import java.security.KeyStore
import javax.net.ssl.{KeyManagerFactory, SSLContext, TrustManagerFactory}

object SSLUtil {
  def createSSLContext(keyStoreFile: File, password: String): SSLContext = {
    val passwordChars = password.toCharArray

    val keyStore = KeyStore.getInstance("JKS")
    assert(keyStoreFile.exists(), s"No keystore file was found at the location: ${keyStoreFile.getAbsolutePath}")
    val keyStoreInput = Files.newInputStream(keyStoreFile.toPath)
    keyStore.load(keyStoreInput, passwordChars)

    val keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm)
    keyManagerFactory.init(keyStore, passwordChars)
    val keyManagers = keyManagerFactory.getKeyManagers

    val trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm)
    trustManagerFactory.init(keyStore)
    val trustManagers = trustManagerFactory.getTrustManagers

    val sslContext = SSLContext.getInstance("TLS")
    sslContext.init(keyManagers, trustManagers, null)
    sslContext
  }
} 

//设置package包名称以及导入依赖的类
package com.twitter.util.security

import com.twitter.logging.Logger
import com.twitter.util.{Return, Throw, Try}
import com.twitter.util.security.Pkcs8KeyManagerFactory._
import java.io.File
import java.security.{KeyFactory, KeyStore, PrivateKey}
import java.security.cert.X509Certificate
import java.security.spec.PKCS8EncodedKeySpec
import java.util.UUID
import javax.net.ssl.{KeyManager, KeyManagerFactory}


  def getKeyManagers(): Try[Array[KeyManager]] = {
    val tryCert: Try[X509Certificate] = new X509CertificateFile(certFile).readX509Certificate()
    val tryKeySpec: Try[PKCS8EncodedKeySpec] = new Pkcs8EncodedKeySpecFile(keyFile).readPkcs8EncodedKeySpec()
    val tryPrivateKey: Try[PrivateKey] = tryKeySpec.map(keySpecToPrivateKey)

    val tryCertKey: Try[(X509Certificate, PrivateKey)] = join(tryCert, tryPrivateKey)
    val tryKeyStore: Try[KeyStore] = tryCertKey.map((createKeyStore _).tupled)
    tryKeyStore.map(keyStoreToKeyManagers).onFailure(logException)
  }

}

private object Pkcs8KeyManagerFactory {
  private val log = Logger.get("com.twitter.util.security")

  private def join[A, B](tryA: Try[A], tryB: Try[B]): Try[(A, B)] = {
    (tryA, tryB) match {
      case (Return(aValue), Return(bValue)) => Return((aValue, bValue))
      case (Throw(_), _) => tryA.asInstanceOf[Try[(A, B)]]
      case (_, Throw(_)) => tryB.asInstanceOf[Try[(A, B)]]
    }
  }
}