Ron and Ella Wiki Page

Extremely Serious

Page 14 of 34

Module-Info Syntax

July 23, 2021 / / 0 Comments 
[open] module <MODULE_NAME> {
    [[requires [transitive] <MODULE_NAME>;]
    [exports <PACKAGE>[ to <MODULE_NAME_1>[,<MODULE_NAME_2>..,<MODULE_NAME_N>];]
    [opens <PACKAGE>;]
    [provides <SERVICE> with <SERVICE_IMPLEMENTATION_1>[,<SERVICE_IMPLEMENTATION_2>..,<SERVICE_IMPLEMENTATION_N>];]
    [uses <SERVICE>;]]
}
Identifier Description
module The module keyword that holds the module directives.
<MODULE_NAME> The module identier.
<PACKAGE> The package identifier.
requires The requires directive indicates that this module depends on another module. ^1
transitive The transitive directive indicates that the user of the current module will also requite another module that the current user will also have access into.
exports The exports directive indicates which public types of the module's package are accessible to other modules. ^1
opens The opens directive also indicates which public types of the module's package are accessible to other modules. The difference between that and exports is that opens is not for compile time, only during runtime, while exports is for both compile time and runtime. The opens directive can typically be used when you want to allow other modules to use reflection for the types in the specified packages, but not to use them during compile time. Let's make this more clear by means of an example. ^1
open This is like the opens directive but with this it opens the whole module.
to <MODULE_NAME_1>[, <MODULE_NAME_2>.., <MODULE_NAME_N>] This indicates to target just specific module(s).
provides...with The provides...with directive indicates that the module provides a service implementation.^1
uses The uses directive indicates that the module requires a service implementation.
<SERVICE> The interface or abstract class that will be implemented as a service.
<SERVICE_IMPLEMENTATION_1>[, <SERVICE_IMPLEMENTATION_2>.., <SERVICE_IMPLEMENTATION_N>] The implementation classes of the SERVICE_INTERFACE.

Java Text Blocks

June 21, 2021 / / 0 Comments

The text blocks is Java's way to simplify rendering of a string that spans multiple lines. A text block begins with three double-quote characters followed by a line terminator.^1

Example: 

String text = """
    The quick 
    brown fox 
    jumps over 
    the lazy dog""";

The above example is equivalent to:

String text = "The quick \n"
    + "brown fox \n" 
    + "jumps over \n"
    + "the lazy dog";

Notice who how simple the example against its equivalent.

Incidental and essential white space

The java text blocks differentiates the incidental white space from essential white space^1. Like the following example:

void writeHTML() {
    String html = """
········<html>
········    <body>
········        <p>Hello World.</p>
········    </body>
········</html>
········""";
    writeOutput(html);
}

The dots, preceding the tag represents the incidental white spaces while the space preceding the tag not including the dots, represents the essential white spaces.

Normally the left incidental white space can be controlled by the location of the ending delimiter of the text blocks.

Trailing white space on each line in a text block is also considered incidental and is stripped away by the Java compiler^1.

Removing the ending new line of each line

Using the backslash at the end of each line will remove the implicit \n character.

String text = """
    The quick \
    brown fox \
    jumps over \
    the lazy dog""";

If you output the preceding variable it will become a single line like the following:

The quick brown fox jumps over the lazy dog

Java as a Windows service with NSSM

May 5, 2021 / / 0 Comments

Pre-requisite

Installing a Java Service

  1. Register a java application as a windows service using the following syntax:

    nssm install <SERVICE_NAME> <JAVA_EXECUTABLE> <JAVA_ARGUMENTS>

    Example

    nssm install "JavaService" "${JAVA_HOME}\bin\java.exe" "-jar java-service.jar --spring.profiles.active=dev"

  2. Update the service with application directory using the following syntax:

    nssm set <SERVICE_NAME> AppDirectory <JAR_FILE_DIRECTORY>

    Example

    nssm set "JavaService" AppDirectory "C:\apps"

  3. Update the service with description using the following syntax:

    nssm set <SERVICE_NAME> Description <APP_DESCRIPTION>

    Example

    nssm set "JavaService" Description "A custom java service."

Displaying the NSSM details of the Java Service

Use the following syntax to display the details of the services:

nssm dump <SERVICE_NAME>

Example

nssm dump "JavaService"

Uninstalling a Java Service

Use the following syntax to remove a java service using nssm:

nssm remove <SERVICE_NAME> confirm

confirm parameter here specifies that we don't want to see the gui confirmation.

Example

nssm remove "JavaService" confirm

Private Signing a CSR

April 20, 2021 / / 0 Comments

Signing the CSR

  1. Download OpenSSL binaries from the following link if you are using windows:

    https://slproweb.com/products/Win32OpenSSL.html

  2. Create a v3.cnf file using the following template:

    authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName          = @alternate_names
nsComment           = "Self-signed Certificate"

[ alternate_names ]

DNS.1       = <DNS_1>
#DNS.2       = <DNS_2>
#DNS.3       = <DNS_3>
#DNS.4       = <DNS_4>

# Add these if you need them. But usually you don't want them or
#   need them in production. You may need them for development.
# DNS.5       = localhost
# DNS.6       = localhost.localdomain
# DNS.7       = 127.0.0.1

# IPv6 localhost
# DNS.8     = ::1

    Replace the following fields on the template:

    Field Name Description
    DNS_<INDEX> Identify the DNS names from the CSR.

    Example:

    authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName          = @alternate_names
nsComment           = "Self-signed Certificate"

[ alternate_names ]

DNS.1       = www.ronella.xyz
#DNS.2       = <DNS_2> 
#DNS.3       = <DNS_3>
#DNS.4       = <DNS_4>

# Add these if you need them. But usually you don't want them or
#   need them in production. You may need them for development.
# DNS.5       = localhost
# DNS.6       = localhost.localdomain
# DNS.7       = 127.0.0.1

# IPv6 localhost
# DNS.8     = ::1

  3. Generate a CA private key and certificate pair. The following link can help:
    PRIVATE CERTIFICATION AUTHORITY (CA)

  4. Once you have the pair (i.e. key is ca.key.pem and the certificate is ca.cert.crt), sign the CSR using the following command:

    openssl x509 -req -days 365 -sha256 -in domain.csr -extfile v3.cnf -CA ca.cert.crt -CAkey ca.key.pem -CAcreateserial -out domain.crt

Viewing the generated certificate from CSR

  1. View the signed certificate using the following the command:

    openssl x509 -in domain.crt -text

Certificate Signing Request (CSR)

April 20, 2021 / / 0 Comments

Generating a CSR

  1. Download OpenSSL binaries from the following link if you are using windows:

    https://slproweb.com/products/Win32OpenSSL.html

  2. Create a domain.cnf file using the following template:

    [ req ]
default_bits        = 2048
default_keyfile     = private.pem
distinguished_name  = subject
req_extensions      = req_ext
x509_extensions     = x509_ext
string_mask         = utf8only

[ subject ]
countryName         = Country Name (2 letter code)
countryName_default     = <2_LETTER_COUNTRY_CODE>

stateOrProvinceName     = State or Province Name (full name)
stateOrProvinceName_default = <STATE_NAME>

localityName            = Locality Name (eg, city)
localityName_default        = <CITY_NAME>

organizationName         = Organization Name (eg, company)
organizationName_default    = <ORGANIZATION_NAME>

organizationalUnitName         = Organizational Unit (eg, section)
organizationalUnitName_default = <ORGANIZATIONAL_UNIT>

commonName          = Common Name (e.g. server FQDN or YOUR name)
commonName_default      = <YOUR_NAME>

emailAddress            = Email Address
emailAddress_default        = <YOUR_EMAIL_ADDR>

# Section x509_ext is used when generating a self-signed certificate. I.e., openssl req -x509 ...
[ x509_ext ]

subjectKeyIdentifier        = hash
authorityKeyIdentifier    = keyid,issuer

basicConstraints        = CA:false
keyUsage            = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName          = @alternate_names
nsComment           = "Self-signed Certificate"

# Section req_ext is used when generating a certificate signing request. I.e., openssl req ...
[ req_ext ]

subjectKeyIdentifier        = hash

basicConstraints        = CA:false
keyUsage            = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName          = @alternate_names
nsComment           = "Private Certificate"

[ alternate_names ]

DNS.1        = <DNS_1>

# Add more DNS by incrementing the DNS.<SUFFIX> like the following.
# DNS.2       = <DNS_2>
# DNS.3       = <DNS_3>
# DNS.4       = <DNS_4>

# Add these if you need them. But usually you don't want them or
#   need them in production. You may need them for development.
# DNS.5       = localhost
# DNS.6       = localhost.localdomain
# DNS.7       = 127.0.0.1

# IPv6 localhost
# DNS.8     = ::1

    Replace the following fields on the template:

    Field Name Description
    2_LETTER_COUNTRY_CODE The two letter code of your country.
    STATE_NAME The name of your state.
    CITY_NAME The name of your city.
    ORGANIZATION_NAME The name of your organization.
    ORGANIZATIONAL_UNIT The name of your section in the organization.
    YOUR_NAME Your full name.
    YOUR_EMAIL_ADDR Your email address.
    DNS_<INDEX> Your DNS name.

    Example:

    [ req ]
default_bits        = 2048
default_keyfile     = private.pem
distinguished_name  = subject
req_extensions      = req_ext
x509_extensions     = x509_ext
string_mask         = utf8only

[ subject ]
countryName         = Country Name (2 letter code)
countryName_default     = NZ

stateOrProvinceName     = State or Province Name (full name)
stateOrProvinceName_default = Wellington

localityName            = Locality Name (eg, city)
localityName_default        = Wellington

organizationName         = Organization Name (eg, company)
organizationName_default    = My Organization

organizationalUnitName         = Organizational Unit (eg, section)
organizationalUnitName_default = IT Department

commonName          = Common Name (e.g. server FQDN or YOUR name)
commonName_default      = www.ronella.xyz

emailAddress            = Email Address
emailAddress_default        = ron@ronella.xyz

# Section x509_ext is used when generating a self-signed certificate. I.e., openssl req -x509 ...
[ x509_ext ]

subjectKeyIdentifier        = hash
authorityKeyIdentifier    = keyid,issuer

basicConstraints        = CA:false
keyUsage            = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName          = @alternate_names
nsComment           = "Self-signed Certificate"

# Section req_ext is used when generating a certificate signing request. I.e., openssl req ...
[ req_ext ]

subjectKeyIdentifier        = hash

basicConstraints        = CA:false
keyUsage            = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName          = @alternate_names
nsComment           = "Private Certificate"

[ alternate_names ]

DNS.1        = www.ronella.xyz

# Add more DNS by incrementing the DNS.<SUFFIX> like the following.
# DNS.2       = <DNS_2>
# DNS.3       = <DNS_3>
# DNS.4       = <DNS_4>

# Add these if you need them. But usually you don't want them or
#   need them in production. You may need them for development.
# DNS.5       = localhost
# DNS.6       = localhost.localdomain
# DNS.7       = 127.0.0.1

# IPv6 localhost
# DNS.8     = ::1

  3. Generate a private key using the following command:

    openssl genrsa -out domain.key.pem 2048

  4. Generate the CSR using the private key with the following command:

    openssl req -new -key domain.key.pem -nodes -out domain.csr -config domain.cnf

Viewing the Generated CSR

  1. View the generated CSR using the following command:

    openssl req -text -noout -verify -in domain.csr

Private Certification Authority (CA)

April 20, 2021 / / 0 Comments

Create the private key and certificate pair.

  1. Download OpenSSL binaries from the following link if you are using windows:

    https://slproweb.com/products/Win32OpenSSL.html

  2. Create a ca.cnf file using the following template:

    [ req ]
default_bits        = 2048
default_keyfile     = private.pem
distinguished_name  = subject
req_extensions      = req_ext
x509_extensions     = x509_ext
string_mask         = utf8only

# The Subject DN can be formed using X501 or RFC 4514 (see RFC 4519 for a description).
#   Its sort of a mashup. For example, RFC 4514 does not provide emailAddress.
[ subject ]
countryName         = Country Name (2 letter code)
countryName_default     = <2_LETTER_COUNTRY_CODE>

stateOrProvinceName     = State or Province Name (full name)
stateOrProvinceName_default = <STATE_NAME>

localityName            = Locality Name (eg, city)
localityName_default        = <CITY_NAME>

organizationName         = Organization Name (eg, company)
organizationName_default    = <ORGANIZATION_NAME>

organizationalUnitName         = Organizational Unit (eg, section)
organizationalUnitName_default = <ORGANIZATIONAL_UNIT>

# Use a friendly name here because it's presented to the user. The server's DNS
#   names are placed in Subject Alternate Names. Plus, DNS names here is deprecated
#   by both IETF and CA/Browser Forums. If you place a DNS name here, then you
#   must include the DNS name in the SAN too (otherwise, Chrome and others that
#   strictly follow the CA/Browser Baseline Requirements will fail).
commonName          = Common Name (e.g. server FQDN or YOUR name)
commonName_default      = <YOUR_NAME>

emailAddress            = Email Address
emailAddress_default        = <YOUR_EMAIL_ADDR>

# Section x509_ext is used when generating a self-signed certificate. I.e., openssl req -x509 ...
[ x509_ext ]

subjectKeyIdentifier        = hash
authorityKeyIdentifier    = keyid,issuer

basicConstraints        = CA:TRUE
keyUsage            = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyCertSign, cRLSign
nsComment           = "Private CA"

# Section req_ext is used when generating a certificate signing request. I.e., openssl req ...
[ req_ext ]

subjectKeyIdentifier        = hash

basicConstraints        = CA:true
keyUsage            = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyCertSign, cRLSign
nsComment           = "Private CA"

    Replace the following fields on the template:

    Field Name Description
    2_LETTER_COUNTRY_CODE The two letter code of your country.
    STATE_NAME The name of your state.
    CITY_NAME The name of your city.
    ORGANIZATION_NAME The name of your organization.
    ORGANIZATIONAL_UNIT The name of your section in the organization.
    YOUR_NAME Your full name or anything that represents you as a CA.
    YOUR_EMAIL_ADDR Your email address.

    Example:

    [ req ]
default_bits        = 2048
default_keyfile     = private.pem
distinguished_name  = subject
req_extensions      = req_ext
x509_extensions     = x509_ext
string_mask         = utf8only

# The Subject DN can be formed using X501 or RFC 4514 (see RFC 4519 for a description).
#   Its sort of a mashup. For example, RFC 4514 does not provide emailAddress.
[ subject ]
countryName         = Country Name (2 letter code)
countryName_default     = NZ

stateOrProvinceName     = State or Province Name (full name)
stateOrProvinceName_default = Wellington

localityName            = Locality Name (eg, city)
localityName_default        = Wellington

organizationName         = Organization Name (eg, company)
organizationName_default    = My Company

organizationalUnitName         = Organizational Unit (eg, section)
organizationalUnitName_default = IT Department

# Use a friendly name here because it's presented to the user. The server's DNS
#   names are placed in Subject Alternate Names. Plus, DNS names here is deprecated
#   by both IETF and CA/Browser Forums. If you place a DNS name here, then you
#   must include the DNS name in the SAN too (otherwise, Chrome and others that
#   strictly follow the CA/Browser Baseline Requirements will fail).
commonName          = Common Name (e.g. server FQDN or YOUR name)
commonName_default      = Ronaldo Webb CA APR 2021

emailAddress            = Email Address
emailAddress_default        = ron@ronella.xyz

# Section x509_ext is used when generating a self-signed certificate. I.e., openssl req -x509 ...
[ x509_ext ]

subjectKeyIdentifier        = hash
authorityKeyIdentifier    = keyid,issuer

basicConstraints        = CA:TRUE
keyUsage            = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyCertSign, cRLSign
nsComment           = "Private CA"

# Section req_ext is used when generating a certificate signing request. I.e., openssl req ...
[ req_ext ]

subjectKeyIdentifier        = hash

basicConstraints        = CA:true
keyUsage            = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyCertSign, cRLSign
nsComment           = "Private CA"

  3. Generate a private key using the following command:

    openssl genrsa -out ca.key.pem 2048

  4. Generate a certificate with a validity of 10 years from the private key using the following command:

    openssl req -x509 -sha256 -new -nodes -key ca.key.pem -days 3650 -out ca.cert.crt -config ca.cnf

Viewing the generated certificate

  1. View the generated certificate using the following command:

    openssl x509 -in ca.cert.crt -text

Generating a Self-signed CA Certificate for JSON Web Token (JWT) in Java

April 19, 2021 / / 0 Comments

In the world of secure communication and authentication, JSON Web Tokens (JWTs) play a crucial role. They are often used to verify the authenticity of clients and servers, ensuring secure data transmission. In this guide, we will walk you through the steps to generate a self-signed CA certificate for JWTs in Java.

Prerequisites

Before we get started, make sure you have the necessary tools and binaries installed. If you're using Windows, you can download the OpenSSL binaries from slproweb.com.

Step 1: Generate an RSA Private Key

The first step is to generate an RSA private key, which will be used to create the self-signed certificate. Open your terminal or command prompt and run the following command:

openssl genrsa -aes256 -out jwt.private.pem 2048

This command generates an encrypted PEM private key. If you wish to generate a decrypted PEM based on it, you can use the following command:

openssl rsa -in jwt.private.pem -out decrypted.jwt.private.pem

Step 2: Generate a Public Key (Optional)

Generating a public key is optional in the context of creating a self-signed CA certificate for JWTs in Java. However, if you want to generate one, use the following command:

openssl rsa -pubout -in jwt.private.pem -out jwt.public.pem

The public key generation is not used in the Java keystores, but it can be useful for other purposes.

Step 3: Generate a Self-signed CA Certificate

Now, it's time to create the self-signed CA certificate using the private key you generated earlier. This certificate will be valid for one year. Customize the template by replacing the placeholder values with your own information. Run the following command:

openssl req -key jwt.private.pem -new -x509 -sha256 -days 365 -subj "/C=<2_LETTER_COUNTRY_CODE>/ST=<STATE_NAME>/L=<CITY_NAME>/O=<ORGANIZATION_NAME>/OU=<ORGANIZATIONAL_UNIT>/CN=<YOUR_NAME>/emailAddress=<YOUR_EMAIL_ADDR>" -out jwt.cert.pem

Here's a breakdown of the fields you need to replace:

  • <2_LETTER_COUNTRY_CODE>: The two-letter code of your country.
  • <STATE_NAME>: The name of your state.
  • <CITY_NAME>: The name of your city.
  • <ORGANIZATION_NAME>: The name of your organization.
  • <ORGANIZATIONAL_UNIT>: The name of your section in the organization.
  • <YOUR_NAME>: Your full name.
  • <YOUR_EMAIL_ADDR>: Your email address.

For example:

openssl req -key jwt.private.pem -new -x509 -sha256 -days 365 -subj "/C=NZ/ST=Wellington/L=Wellington/O=RnE/OU=IT/CN=Ronaldo Webb/emailAddress=ron@ronella.xyz" -out jwt.cert.pem

Step 4: Generate a PKCS12 File

Now, create a PKCS12 file by combining the generated private key and certificate. Give it the "selfsigned" alias using the following command:

openssl pkcs12 -export -in jwt.cert.pem -inkey jwt.private.pem -out jwt.pfx -name "selfsigned"

Step 5: Store the PKCS12 Content in a Java Keystore

Java applications often use keystores for certificate management. To store the content of the PKCS12 file in a Java keystore, use the following command:

"%JAVA_HOME%\bin\keytool" -importkeystore -destkeystore jwt-ks.jks -deststorepass password -deststoretype PKCS12 -srckeystore jwt.pfx -srcstoretype PKCS12 -srcstorepass password

Replace "%JAVA_HOME%" with the path to your Java installation directory and customize the keystore name and password as needed.

Step 6: Store the Certificate in a Java Truststore

In Java, truststores are used to store certificates that are trusted for secure communication. Store the certificate you generated earlier in a Java truststore with the "selfsigned" alias using the following command:

"%JAVA_HOME%\bin\keytool" -import -file jwt.cert.pem -keystore jwt-ts.jks -storetype PKCS12 -storepass password -alias selfsigned

Again, make sure to adjust the paths, keystore name, password, and alias according to your requirements.

By following these steps, you can generate a self-signed CA certificate for JWTs in Java, ensuring secure authentication and data transmission in your applications.

Related Topics

For further information on working with JWTs in Java, you can explore these related topics.

« Older posts Newer posts »

© 2025 Ron and Ella Wiki Page

Theme by Anders Noren — Up ↑