acme4j | Java client for ACME | TLS library

by shred Java Version: 3.1.1 License: Apache-2.0

X-Ray Key Features Code Snippets Community Discussions(4)Vulnerabilities Install Support

kandi X-RAY | acme4j Summary

acme4j is a Java library typically used in Security, TLS applications. acme4j has build file available, it has a Permissive License and it has low support. However acme4j has 5 bugs and it has 2 vulnerabilities. You can download it from GitHub, Maven.

Java client for ACME (Let's Encrypt)

Support

Quality

Security

License

Reuse

Support

acme4j has a low active ecosystem.

It has 378 star(s) with 70 fork(s). There are 26 watchers for this library.

It had no major release in the last 12 months.

There are 3 open issues and 75 have been closed. On average issues are closed in 19 days. There are 3 open pull requests and 0 closed requests.

It has a neutral sentiment in the developer community.

The latest version of acme4j is 3.1.1

Quality

acme4j has 5 bugs (1 blocker, 0 critical, 4 major, 0 minor) and 261 code smells.

Security

acme4j has no vulnerabilities reported, and its dependent libraries have no vulnerabilities reported.

acme4j code analysis shows 2 unresolved vulnerabilities (0 blocker, 1 critical, 1 major, 0 minor).

There are 44 security hotspots that need review.

License

acme4j is licensed under the Apache-2.0 License. This license is Permissive.

Permissive licenses have the least restrictions, and you can use them in most projects.

Reuse

acme4j releases are available to install and integrate.

Deployable package is available in Maven.

Build file is available. You can build the component from source.

acme4j saves you 5219 person hours of effort in developing the same functionality from scratch.

It has 10962 lines of code, 763 functions and 129 files.

It has medium code complexity. Code complexity directly impacts maintainability of the code.

Top functions reviewed by kandi - BETA

kandi has reviewed acme4j and discovered the below as its top functions. This is intended to give you an instant insight into acme4j implemented functionality, and help decide if they suit your requirements.

Create a new Order
Perform an OAuth request .
Creates a JsonWebRequest .
Create a new account .
Creates a TLS certificate .
Sign a key pair .
Parses a string representing a timestamp .
Returns a map of all service providers .
Generate an ACME response .
Returns a string representation of this problem .

Get all kandi verified functions for this library.

acme4j Key Features

No Key Features are available at this moment for acme4j.

acme4j Examples and Code Snippets

No Code Snippets are available at this moment for acme4j.

Community Discussions

Trending Discussions on acme4j

Spring boot and Lets Encrypt no cipher suites in common

Adding a new Extension to my generated certificate

SSL Labs: Incorrect Order, Extra Certs

Extension unknown: DER encoded OCTET string error in generated certificate

QUESTION

Spring boot and Lets Encrypt no cipher suites in common

Asked 2019-May-02 at 23:00

Using the awesome library acme4j, I've created 3 files.

domain.csr
domain.key
domain-chain.crt

The problem I have is when I convert those to a keystore.p12 I can't get Spring boot working with it. I've used the following command to create the keystore.p12 file:

...

ANSWER

Answered 2019-May-02 at 22:59

I'm not familiar with the configuration you're using, but I'd try to use key-store-password: secret in addition to key-password: secret (which you already have).

The Java keystore format (in general) allows for two passwords: one for the store, and one for the key itself.

For the p12 file you've generated, they should be the same. Whether both need to be specified depends on the tool that loads this configuration (some libraries would fall back on the keystore password if the key wasn't specified, for example).

If the store and key aren't unlocked, the certificate won't be in use, so it will try to use an anonymous cipher suite which is not advertised by the client and also likely to be disabled by default on the server.

Source https://stackoverflow.com/questions/55959315

QUESTION

Adding a new Extension to my generated certificate

Asked 2019-Mar-02 at 15:41

I need to add a new Extension of OID 1.3.6.1.5.5.7.1.26 in my certificate. I got this OID extension in my certificate but with the following error:

Certificate Extensions: 10 [1]: ObjectId: 1.3.6.1.5.5.7.1.26 Criticality=false
Extension unknown: DER encoded OCTET string =
0000: 04 0C 30 0A 13 08 33 39 20 64 63 20 32 62 ..0...
39 dc 2b

I want this OID to be recognized similar to other extensions like AuthorityInfoAccess, etc.

Do I need to edit the jar of Bouncy Castle X509 class?

Im using ACME4j as a client and Letsencrypt Boulder as my server.

Here is the CSR Builder code for signing up the certificate.

...

ANSWER

Answered 2017-Mar-28 at 12:58

As the OID 1.3.6.1.5.5.7.1.26 is still a draft, I believe it's very unlikely that tools and systems like Let's Encrypt recognize this extension (they'll probably do it after this extension becomes official, and I really don't know the bureaucratic process behind such approvals).

Which means you'll probably have to code it. I've been using Bouncy Castle for a couple of years but never had to create a new ASN1 structure. But if I had to, I'd take a look at its source code as an initial guidance.

Considering the ASN1 structure of this extension:

Source https://stackoverflow.com/questions/43045079

QUESTION

SSL Labs: Incorrect Order, Extra Certs

Asked 2018-Oct-17 at 15:03

I'm getting an error "Chain issues: Incorrect order, Extra certs" from https://www.ssllabs.com/ssltest/analyze.html?d=api.quotecrunchers.com when I test the SSL for my website.

I've built the https mechanism into a spring boot application using the following:

The acme4j library to communicate with the Let's Encrypt CA.
Java code to write the Let's Encrypt certificate to a java keystore.
Java code to cause the embedded Tomcat server to apply for a certificate from Let's Encrypt over HTTP and then restart using HTTPS once it has the certificate.

I'm planning on open sourcing this code once I've got it tidied up.

Currently though, I'm only achieving a B rating using ssllabs.com

See https://www.ssllabs.com/ssltest/analyze.html?d=api.quotecrunchers.com

There are several issues with my https, but the issue I am concerned about is where it says "Chain issues: Incorrect order, Extra certs".

Why am I getting this, and what should I be doing instead?

Any help is greatly appreciated!

...

ANSWER

Answered 2018-Oct-17 at 15:03

When one connects to your site, here is what is sent by it as seen by openssl s_client:

Source https://stackoverflow.com/questions/52853723

QUESTION

Extension unknown: DER encoded OCTET string error in generated certificate

Asked 2017-Apr-11 at 12:37

I have created a SSL certificate using acme client acme4j: https://github.com/shred/acme4j.

But while I'm generating a self signed certificate I'm facing an exception while parsing it. Here is the my generated certificate:

...

ANSWER

Answered 2017-Apr-10 at 15:37

1.3.6.1.5.5.7.1.26 seems to be the OID for a Telephony Number (TN) Authorization List, which is only defined in a draft document (https://datatracker.ietf.org/doc/draft-ietf-stir-certificates/); BouncyCastle likely doesn't have a pretty printer for it, so it's showing you the raw encoded payload.

While I'm not an expert in telephony, I'm pretty sure that ('yuz8xxz', 'yuz8xxz') isn't a valid Service Provider Code list, and '123456'-'123456' is not a valid telephone number range. So it's pretty unclear what you're looking for with this certificate extension, and I'd be highly surprised if Let's Encrypt signed off on it.

Source https://stackoverflow.com/questions/43326366

Community Discussions, Code Snippets contain sources that include Stack Exchange Network

Vulnerabilities

No vulnerabilities reported

Install acme4j

You can download it from GitHub, Maven.
You can use acme4j like any standard Java library. Please include the the jar files in your classpath. You can also use any IDE and you can run and debug the acme4j component as you would do with any other Java program. Best practice is to use a build tool that supports dependency management such as Maven or Gradle. For Maven installation, please refer maven.apache.org. For Gradle installation, please refer gradle.org .