Examples with Certificates org.neo4j.bolt.security.ssl.Certificates used on opensource projects

Example 1 with Certificates

use of org.neo4j.bolt.security.ssl.Certificates in project neo4j by neo4j.

the class CertificatesIT method setUp.

@BeforeClass
public static void setUp() throws IOException, GeneralSecurityException, OperatorCreationException {
    certFactory = new Certificates();
    keyFile = File.createTempFile("key", "pem");
    certFile = File.createTempFile("key", "pem");
    keyFile.deleteOnExit();
    certFile.deleteOnExit();
    // make sure files are not there
    keyFile.delete();
    certFile.delete();
    certFactory.createSelfSignedCertificate(certFile, keyFile, "my.domain");
}

Example 2 with Certificates

use of org.neo4j.bolt.security.ssl.Certificates in project neo4j by neo4j.

the class BoltKernelExtension method createKeyStore.

private KeyStoreInformation createKeyStore(Configuration config, Log log, AdvertisedSocketAddress address) throws GeneralSecurityException, IOException, OperatorCreationException {
    File privateKeyPath = config.get(Settings.tls_key_file).getAbsoluteFile();
    File certificatePath = config.get(Settings.tls_certificate_file).getAbsoluteFile();
    if (!certificatePath.exists() && !privateKeyPath.exists()) {
        log.info("No SSL certificate found, generating a self-signed certificate..");
        Certificates certFactory = new Certificates();
        certFactory.createSelfSignedCertificate(certificatePath, privateKeyPath, address.getHostname());
    }
    if (!certificatePath.exists()) {
        throw new IllegalStateException(format("TLS private key found, but missing certificate at '%s'. Cannot start server without " + "certificate.", certificatePath));
    }
    if (!privateKeyPath.exists()) {
        throw new IllegalStateException(format("TLS certificate found, but missing key at '%s'. Cannot start server without key.", privateKeyPath));
    }
    return new KeyStoreFactory().createKeyStore(privateKeyPath, certificatePath);
}

Example 3 with Certificates

use of org.neo4j.bolt.security.ssl.Certificates in project neo4j by neo4j.

the class SelfSignedCertificatesIT method createSelfSignedCertificateWithCorrectPermissions.

@Test
public void createSelfSignedCertificateWithCorrectPermissions() throws Exception {
    assumeTrue(!SystemUtils.IS_OS_WINDOWS);
    Certificates certificates = new Certificates();
    certificates.createSelfSignedCertificate(testDirectory.file("certificate"), testDirectory.file("privateKey"), "localhost");
    PosixFileAttributes certificateAttributes = Files.getFileAttributeView(testDirectory.file("certificate").toPath(), PosixFileAttributeView.class).readAttributes();
    assertTrue(certificateAttributes.permissions().contains(PosixFilePermission.OWNER_READ));
    assertTrue(certificateAttributes.permissions().contains(PosixFilePermission.OWNER_WRITE));
    assertFalse(certificateAttributes.permissions().contains(PosixFilePermission.OWNER_EXECUTE));
    assertFalse(certificateAttributes.permissions().contains(PosixFilePermission.GROUP_READ));
    assertFalse(certificateAttributes.permissions().contains(PosixFilePermission.GROUP_WRITE));
    assertFalse(certificateAttributes.permissions().contains(PosixFilePermission.GROUP_EXECUTE));
    assertFalse(certificateAttributes.permissions().contains(PosixFilePermission.OTHERS_READ));
    assertFalse(certificateAttributes.permissions().contains(PosixFilePermission.OTHERS_WRITE));
    assertFalse(certificateAttributes.permissions().contains(PosixFilePermission.OTHERS_EXECUTE));
    PosixFileAttributes privateKey = Files.getFileAttributeView(testDirectory.file("privateKey").toPath(), PosixFileAttributeView.class).readAttributes();
    assertTrue(privateKey.permissions().contains(PosixFilePermission.OWNER_READ));
    assertTrue(privateKey.permissions().contains(PosixFilePermission.OWNER_WRITE));
    assertFalse(privateKey.permissions().contains(PosixFilePermission.OWNER_EXECUTE));
    assertFalse(privateKey.permissions().contains(PosixFilePermission.GROUP_READ));
    assertFalse(privateKey.permissions().contains(PosixFilePermission.GROUP_WRITE));
    assertFalse(privateKey.permissions().contains(PosixFilePermission.GROUP_EXECUTE));
    assertFalse(privateKey.permissions().contains(PosixFilePermission.OTHERS_READ));
    assertFalse(privateKey.permissions().contains(PosixFilePermission.OTHERS_WRITE));
    assertFalse(privateKey.permissions().contains(PosixFilePermission.OTHERS_EXECUTE));
}

Example 4 with Certificates

use of org.neo4j.bolt.security.ssl.Certificates in project neo4j by neo4j.

the class AbstractNeoServer method createKeyStore.

protected Optional<KeyStoreInformation> createKeyStore() {
    if (httpsIsEnabled()) {
        File privateKeyPath = config.get(ServerSettings.tls_key_file).getAbsoluteFile();
        File certificatePath = config.get(ServerSettings.tls_certificate_file).getAbsoluteFile();
        try {
            // If neither file is specified
            if (!certificatePath.exists() && !privateKeyPath.exists()) {
                //noinspection deprecation
                log.info("No SSL certificate found, generating a self-signed certificate..");
                Certificates certFactory = new Certificates();
                certFactory.createSelfSignedCertificate(certificatePath, privateKeyPath, httpListenAddress.getHostname());
            }
            // Make sure both files were there, or were generated
            if (!certificatePath.exists()) {
                throw new ServerStartupException(String.format("TLS private key found, but missing certificate at '%s'. Cannot start server " + "without certificate.", certificatePath));
            }
            if (!privateKeyPath.exists()) {
                throw new ServerStartupException(String.format("TLS certificate found, but missing key at '%s'. Cannot start server without key.", privateKeyPath));
            }
            return Optional.of(new KeyStoreFactory().createKeyStore(privateKeyPath, certificatePath));
        } catch (GeneralSecurityException e) {
            throw new ServerStartupException("TLS certificate error occurred, unable to start server: " + e.getMessage(), e);
        } catch (IOException | OperatorCreationException e) {
            throw new ServerStartupException("IO problem while loading or creating TLS certificates: " + e.getMessage(), e);
        }
    } else {
        return Optional.empty();
    }
}