java.lang.Object
net.i2p.i2pcontrol.security.KeyStoreProvider
public class KeyStoreProviderextends Object
Provider for managing I2PControl keystore operations. Handles loading and accessing SSL certificates for secure connections.

  • Field Details

    • DEFAULT_CERTIFICATE_ALGORITHM_STRING

      public static final String DEFAULT_CERTIFICATE_ALGORITHM_STRING
      Key algorithm used for a generated I2PControl certificate.
      See Also:

    • DEFAULT_CERTIFICATE_KEY_LENGTH

      public static final int DEFAULT_CERTIFICATE_KEY_LENGTH
      Key length in bits for a generated certificate key.
      See Also:

    • DEFAULT_CERTIFICATE_VALIDITY

      public static final int DEFAULT_CERTIFICATE_VALIDITY
      Lifetime in days of a generated certificate, ten years.
      See Also:

    • DEFAULT_CERTIFICATE_DOMAIN

      public static final String DEFAULT_CERTIFICATE_DOMAIN
      Subject domain a generated certificate is issued for.
      See Also:

    • DEFAULT_CERTIFICATE_ALIAS

      public static final String DEFAULT_CERTIFICATE_ALIAS
      Alias the generated certificate is stored under in the key store.
      See Also:

    • DEFAULT_KEYSTORE_NAME

      public static final String DEFAULT_KEYSTORE_NAME
      File name of the key store holding the I2PControl certificate.
      See Also:

    • DEFAULT_KEYSTORE_PASSWORD

      public static final String DEFAULT_KEYSTORE_PASSWORD
      Password protecting the I2PControl key store.
      See Also:

    • _log

      private static final Log _log
      Logger for this class.

    • DEFAULT_CERTIFICATE_PASSWORD

      private static String DEFAULT_CERTIFICATE_PASSWORD
      Password used for generated certificates, set once at startup.

    • _pluginDir

      private final String _pluginDir
      Directory plugins are installed in.

    • _keystore

      private KeyStore _keystore
      The keystore, opened on first use.

  • Constructor Details

    • KeyStoreProvider

      public KeyStoreProvider(String pluginDir)
      Bind this provider to the plugin directory that holds the shared keystore, without reading or creating anything yet.
      Parameters:
      pluginDir - path to the plugin directory for keystore storage

  • Method Details

    • getCertificatePassword

      public static String getCertificatePassword()
      Get the dynamically generated certificate password.
      Returns:
      the certificate password

    • initialize

      public void initialize()
      Create keystore if it does not exist

    • readCert

      public static X509Certificate readCert(KeyStore ks, String certAlias)
      Fetch the named certificate and verify it against its own public key, rejecting a certificate that does not check out.
      Parameters:
      ks - the keystore to read the certificate from
      certAlias - the keystore alias naming the certificate to read
      Returns:
      null on failure

    • getDefaultKeyStore

      public KeyStore getDefaultKeyStore()
      Load the keystore, creating it first if it does not exist yet. A keystore file that exists but cannot be read - wrong password, truncated or corrupt contents - is never replaced, since that would destroy any credentials it holds. That case, and any failure to create a missing file, is logged at WARN and reported as null. Nothing is cached in the failure case, so a later call retries the load.
      Returns:
      the keystore, or null if it could not be read or created

    • load

      private static KeyStore load(KeyStore ks, File keyStoreFile) throws IOException, GeneralSecurityException
      Load the keystore file into the given empty keystore.
      Parameters:
      ks - the empty keystore to load into
      keyStoreFile - the file to read, which must exist
      Returns:
      ks, loaded from keyStoreFile
      Throws:
      IOException - if the file cannot be read
      GeneralSecurityException - if the file is not a valid keystore for the default type

    • getKeyStoreLocation

      public String getKeyStoreLocation()
      Resolve the absolute path of the keystore file this provider reads and writes, named after DEFAULT_KEYSTORE_NAME inside the plugin directory.
      Returns:
      full path to the keystore file