Certificados SSL y Java Keystores

Certificados SSL y Java Keystores

Este post sirve para generar CSR, revisar certificados, convertir formatos, gestionar keystores Java y validar firmas de JAR.

Crear clave y CSR con OpenSSL

openssl genrsa -out app.example.local.key 4096
openssl req -new -sha256 -key app.example.local.key -out app.example.local.csr

Certificado autofirmado con SAN

openssl req -x509 -nodes -newkey rsa:4096 \
  -keyout app.example.local.key \
  -out app.example.local.crt \
  -days 365 \
  -subj "/CN=app.example.local" \
  -addext "subjectAltName=DNS:app.example.local,DNS:alias.example.local"

Ver contenido de certificado

openssl x509 -in app.example.local.crt -noout -text
openssl x509 -in app.example.local.crt -noout -dates
openssl x509 -in app.example.local.crt -noout -issuer -subject

Comprobar certificado remoto

openssl s_client -connect app.example.local:443 -servername app.example.local </dev/null

Convertir PEM a PKCS12

openssl pkcs12 -export \
  -in app.example.local.crt \
  -inkey app.example.local.key \
  -out app.example.local.p12 \
  -name app

Importar en JKS

keytool -importkeystore \
  -srckeystore app.example.local.p12 \
  -srcstoretype PKCS12 \
  -destkeystore app.jks \
  -deststoretype JKS

Listar JKS

keytool -list -v -keystore app.jks

Importar CA en truststore

keytool -importcert \
  -alias ca-example \
  -file ca-example.crt \
  -keystore truststore.jks

Firmar JAR

jarsigner -keystore app.jks aplicacion.jar app
jarsigner -verify -verbose -certs aplicacion.jar

Renovacion de certificado

openssl x509 -in app.example.local.crt -noout -dates
keytool -list -v -keystore app.jks | grep -E 'Alias name|Valid from'
systemctl reload httpd