Comments (9)
acme4j is currently using Bouncy Castle for these purposes:
- Generating a CSR for ordering a certificate
- Creating a X509Certificate for the tls-alpn-01 challenge
- All utility classes in the
org.shredzone.acme4j.util
package - The acme4j-smime module makes extensive use of Bouncy Castle for parsing, validating, and creating S/MIME emails
I would like to remove the Bouncy Castle dependency, but unfortunately the Java Cryptography Framework offers no sufficient alternatives.
It is possible to avoid Bouncy Castle if you do not use the tls-alpn-01 challenge, the acme4j-smime module, and the utility classes. But when ordering a certificate, you would then have to create a CSR yourself by other means, and then invoke Order.execute(byte[] csr)
.
from acme4j.
Thanks, I will try your suggestion -
I only need HTTP-01 protocol as I am developing a Java Helidon wen server, extension and want to minimize external dependencies to the absolutely necessary minimum (similar to the ACME plug-in IBM did for OpenLiberty). I Have not looked at IBM's code too much, but from what I saw, they do not use Bouncy Castle ...
Another question - any strong reason for using SLF4J instead of the Java 9 Platform logging, which serves the same purpose - a facade for other logging frameworks (including SLF4J)?
from acme4j.
I just had a quick look at IBM's OpenLiberty source, and they use acme4j. π They also use acme4j's CSRBuilder
, so I am sure they use Bouncy Castle.
You could use OpenSSL for creating CSRs, but then you'll have a dependency to an external tool.
About logging: I will have a look at JEP 264 and check if it is an option to switch. I could remove a dependency that way, but I first have to make sure it won't break existing logging.
from acme4j.
Thanks you for proving me wrong on IBM OpenLiberty!
I just looked at some code for generating CSR in Java here. In the RELATED section below the article they offer other useful examples
from acme4j.
Your example uses a lot of sun.*
packages, which are not part of the public Java API: https://www.oracle.com/java/technologies/faq-sun-packages.html
So this is not an option. However you could still use it in your code, and invoke Order.execute(byte[] csr)
with the generated CSR.
from acme4j.
Sorry ..Indeed, sun.com.* stuff is not good (probably does not work on other JDKs at all).
As for the logging .. this is interesting
from acme4j.
Btw, feel free to close this issue.
I would also recommend enabling the Discussions tab for this project, for topics like this
from acme4j.
Discussions are enabled now. Thank you for the pointer.
Feel free to reopen if you found a way to remove the BC dependency.
from acme4j.
Thank you @shred !
The arguments and justifications for you choices explained in the above thread are very solid, so I will use acme4j as is. If I discover a better replacement for bouncyc castle, I will bring it to your attention.
from acme4j.
Related Issues (20)
- http://${domain}/.well-known/acme-challenge/${token}
- acme4j example is creating zero- length crt files HOT 10
- preferred-chain attribute, for alternate chains HOT 2
- Can only parse traditional files HOT 2
- EAB HMAC keys with arbitrary lengths HOT 5
- CVE-2023-33201 from Bouncy Castle HOT 8
- add utils to do pre validation or help HOT 1
- How to check if certificate needs renewal without ordering a new one? HOT 8
- Is there a way to keep txt unchanged and verify twiceοΌ HOT 2
- New account registration HOT 2
- Allow to pass query parameters in directory URL HOT 2
- Provide example showing how to save and load existing certificates HOT 2
- AcmeJsonResource#update throws AcmeRetryAfterException even if resource is ready HOT 4
- Abstract away certificate renewal HOT 6
- response is not reading correctly HOT 3
- Java 22 Support HOT 1
- OrderBuilder.replaces() functions assume auto-renewal support by the server HOT 3
- The request attempted to finalize an order that is not ready to be finalized HOT 2
- acme4j 3.x wrongly validates pebble certificate HOT 4
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
π Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. πππ
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google β€οΈ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from acme4j.