java ssl ssl-certificate keystore sslcontext

How to create SSLContext from either of PEM/PKCS7/DER and private key?

I need to create a SSLContext for a Cloudflare Origin Certificate.

A certificate and private key are provided. The certificate is provided in the following formats:

PEM
PKCS#7
DER

The private key is provided in a single format, whose name is not specified. Here is an example:

In Java 11, how do I create a KeyManager[] that I can then use to create a SSLContext in the following way?

KeyManager[] keyManagers = ...
SSLContext sslContext = SSLContext.getInstance("TLS");
sslContext.init(keyManagers, null, null);

Solution

Convert the PEM certificate and private key to PKCS12:

openssl pkcs12 -export -out localhost.p12 -inkey localhost.key -in localhost.crt

Then, to create the SSLContext:

char[] password = ...

KeyStore keyStore = KeyStore.getInstance("PKCS12");
try (InputStream stream = ...) {
    keyStore.load(stream, password);
}

KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
keyManagerFactory.init(keyStore, password);

TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
trustManagerFactory.init(keyStore);

SSLContext sslContext = SSLContext.getInstance("TLS");
sslContext.init(keyManagerFactory.getKeyManagers(), trustManagerFactory.getTrustManagers(), null);

To generate a self-signed certificate for local development, use:

openssl req -x509 -out localhost.crt -keyout localhost.key -newkey rsa:2048 -days 360 -nodes -sha256 -subj '/CN=localhost' -extensions EXT -config <( printf "[dn]\nCN=localhost\n[req]\ndistinguished_name = dn\n[EXT]\nsubjectAltName=DNS:localhost\nkeyUsage=digitalSignature\nextendedKeyUsage=serverAuth")