BAEL-8591 added code for mTLS calls with Java Client

Author: amijkum

core-java-modules/core-java-httpclient/src/main/java/com/baeldung/mtls/httpclient/HttpClientExample.java

@@ -0,0 +1,37 @@
+package com.baeldung.mtls.httpclient;
+
+import java.io.IOException;
+import java.net.URI;
+import java.net.http.HttpClient;
+import java.net.http.HttpRequest;
+import java.net.http.HttpResponse;
+import java.security.KeyManagementException;
+import java.security.KeyStoreException;
+import java.security.NoSuchAlgorithmException;
+import java.security.UnrecoverableKeyException;
+import java.security.cert.CertificateException;
+import java.security.spec.InvalidKeySpecException;
+
+import javax.net.ssl.SSLContext;
+
+public class HttpClientExample {
+
+    public static void main(String[] args)
+        throws IOException, CertificateException, NoSuchAlgorithmException, KeyStoreException, UnrecoverableKeyException, InvalidKeySpecException,
+               KeyManagementException {
+        SSLContext sslContext = SslContextBuilder.buildSslContext();
+        HttpClient client = HttpClient.newBuilder()
+            .sslContext(sslContext)
+            .build();
+
+        HttpRequest exactRequest = HttpRequest.newBuilder()
+            .uri(URI.create("https://localhost/ping"))
+            .GET()
+            .build();
+
+        HttpResponse<String> response = client.sendAsync(exactRequest, HttpResponse.BodyHandlers.ofString())
+            .join();
+
+    }
+
+}

core-java-modules/core-java-httpclient/src/main/java/com/baeldung/mtls/httpclient/HttpURLConnectionExample.java

@@ -0,0 +1,34 @@
+package com.baeldung.mtls.httpclient;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.net.URL;
+import java.nio.charset.Charset;
+import java.security.KeyManagementException;
+import java.security.KeyStoreException;
+import java.security.NoSuchAlgorithmException;
+import java.security.UnrecoverableKeyException;
+import java.security.cert.CertificateException;
+import java.security.spec.InvalidKeySpecException;
+
+import javax.net.ssl.HostnameVerifier;
+import javax.net.ssl.HttpsURLConnection;
+import javax.net.ssl.SSLContext;
+
+public class HttpURLConnectionExample {
+
+    public static void main(String[] args)
+        throws IOException, CertificateException, NoSuchAlgorithmException, KeyStoreException, UnrecoverableKeyException, InvalidKeySpecException,
+               KeyManagementException {
+        SSLContext sslContext = SslContextBuilder.buildSslContext();
+
+        HostnameVerifier allHostsValid = (hostname, session) -> true;
+        HttpsURLConnection httpsURLConnection = (HttpsURLConnection) new URL("https://127.0.0.1/ping").openConnection();
+        httpsURLConnection.setSSLSocketFactory(sslContext.getSocketFactory());
+        httpsURLConnection.setHostnameVerifier(allHostsValid);
+
+        InputStream inputStream = httpsURLConnection.getInputStream();
+        String response = new String(inputStream.readAllBytes(), Charset.defaultCharset());
+    }
+
+}

core-java-modules/core-java-httpclient/src/main/java/com/baeldung/mtls/httpclient/SslContextBuilder.java

@@ -0,0 +1,81 @@
+package com.baeldung.mtls.httpclient;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.nio.charset.Charset;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.security.Key;
+import java.security.KeyFactory;
+import java.security.KeyManagementException;
+import java.security.KeyStore;
+import java.security.KeyStoreException;
+import java.security.NoSuchAlgorithmException;
+import java.security.UnrecoverableKeyException;
+import java.security.cert.Certificate;
+import java.security.cert.CertificateException;
+import java.security.cert.CertificateFactory;
+import java.security.cert.X509Certificate;
+import java.security.spec.InvalidKeySpecException;
+import java.security.spec.PKCS8EncodedKeySpec;
+import java.util.Base64;
+import java.util.Collection;
+import java.util.Properties;
+
+import javax.net.ssl.KeyManagerFactory;
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.TrustManager;
+import javax.net.ssl.X509TrustManager;
+
+public class SslContextBuilder {
+
+    public static SSLContext buildSslContext()
+        throws IOException, CertificateException, InvalidKeySpecException, NoSuchAlgorithmException, KeyStoreException, UnrecoverableKeyException,
+               KeyManagementException {
+        final Properties props = System.getProperties();
+        props.setProperty("jdk.internal.httpclient.disableHostnameVerification", Boolean.TRUE.toString());
+
+        String privateKeyPath = "/etc/certs/client.key.pkcs8";
+        String publicKeyPath = "/etc/certs/client.crt";
+
+        final byte[] publicData = Files.readAllBytes(Path.of(publicKeyPath));
+        final byte[] privateData = Files.readAllBytes(Path.of(privateKeyPath));
+
+        String privateString = new String(privateData, Charset.defaultCharset()).replace("-----BEGIN PRIVATE KEY-----", "")
+            .replaceAll(System.lineSeparator(), "")
+            .replace("-----END PRIVATE KEY-----", "");
+
+        byte[] encoded = Base64.getDecoder()
+            .decode(privateString);
+
+        final CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509");
+        final Collection<? extends Certificate> chain = certificateFactory.generateCertificates(new ByteArrayInputStream(publicData));
+
+        Key key = KeyFactory.getInstance("RSA")
+            .generatePrivate(new PKCS8EncodedKeySpec(encoded));
+
+        KeyStore clientKeyStore = KeyStore.getInstance("jks");
+        final char[] pwdChars = "test".toCharArray();
+        clientKeyStore.load(null, null);
+        clientKeyStore.setKeyEntry("test", key, pwdChars, chain.toArray(new Certificate[0]));
+
+        KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance("SunX509");
+        keyManagerFactory.init(clientKeyStore, pwdChars);
+
+        TrustManager[] acceptAllTrustManager = { new X509TrustManager() {
+            public X509Certificate[] getAcceptedIssuers() {
+                return new X509Certificate[0];
+            }
+
+            public void checkClientTrusted(X509Certificate[] certs, String authType) {
+            }
+
+            public void checkServerTrusted(X509Certificate[] certs, String authType) {
+            }
+        } };
+        SSLContext sslContext = SSLContext.getInstance("TLS");
+        sslContext.init(keyManagerFactory.getKeyManagers(), acceptAllTrustManager, new java.security.SecureRandom());
+        return sslContext;
+    }
+
+}