PKI Explained: How Certificates Actually Work in Production

package io.thecodeforge.dsa;

import java.security.*;
import java.security.spec.ECGenParameterSpec;
import java.util.Base64;

/**
 * Demonstrates the asymmetric signing primitive that underlies every
 * certificate verification in PKI. This is NOT a full PKI implementation —
 * it's the cryptographic foundation you need to understand before certificates
 * make sense.
 *
 * Production context: a payment gateway signing webhook payloads so the
 * receiving merchant can verify the payload wasn't tampered with in transit.
 */
public class AsymmetricSigningDemo {

    public static void main(String[] args) throws Exception {

        // --- KEY GENERATION ---
        // ECDSA with P-256 curve: the modern default. Prefer this over RSA-2048
        // for new systems. Smaller key, faster ops, same effective security.
        KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("EC");
        keyPairGenerator.initialize(new ECGenParameterSpec("secp256r1"), new SecureRandom());
        KeyPair gatewayKeyPair = keyPairGenerator.generateKeyPair();

        PublicKey  gatewayPublicKey  = gatewayKeyPair.getPublic();
        PrivateKey gatewayPrivateKey = gatewayKeyPair.getPrivate();

        // Simulate: gateway publishes its public key to merchants during onboarding.
        // This key is not secret — it's meant to be distributed.
        System.out.println("Gateway Public Key (share this openly):");
        System.out.println(Base64.getEncoder().encodeToString(gatewayPublicKey.getEncoded()));
        System.out.println();

        // --- SIGNING (happens inside the gateway before dispatching webhook) ---
        String webhookPayload = "{\"event\":\"payment.captured\",\"amount\":4999,\"currency\":\"GBP\"}";

        Signature signer = Signature.getInstance("SHA256withECDSA");
        signer.initSign(gatewayPrivateKey); // private key NEVER leaves this service
        signer.update(webhookPayload.getBytes());
        byte[] signature = signer.sign();

        String encodedSignature = Base64.getEncoder().encodeToString(signature);
        System.out.println("Webhook payload : " + webhookPayload);
        System.out.println("Signature (send in X-Gateway-Signature header): " + encodedSignature);
        System.out.println();

        // --- VERIFICATION (happens inside the merchant's webhook handler) ---
        // The merchant only needs the public key — never touches the private key.
        Signature verifier = Signature.getInstance("SHA256withECDSA");
        verifier.initVerify(gatewayPublicKey); // public key used for verification
        verifier.update(webhookPayload.getBytes());

        boolean isAuthentic = verifier.verify(Base64.getDecoder().decode(encodedSignature));
        System.out.println("Signature valid? " + isAuthentic); // true: payload is genuine

        // --- TAMPER DETECTION ---
        // Simulate a man-in-the-middle modifying the amount
        String tamperedPayload = "{\"event\":\"payment.captured\",\"amount\":1,\"currency\":\"GBP\"}";

        Signature tamperedVerifier = Signature.getInstance("SHA256withECDSA");
        tamperedVerifier.initVerify(gatewayPublicKey);
        tamperedVerifier.update(tamperedPayload.getBytes()); // different bytes → different hash

        boolean tamperedResult = tamperedVerifier.verify(Base64.getDecoder().decode(encodedSignature));
        System.out.println("Tampered payload valid? " + tamperedResult); // false: tampering detected
    }
}

package io.thecodeforge.dsa;

import javax.net.ssl.*;
import java.io.FileInputStream;
import java.security.KeyStore;
import java.security.cert.*;
import java.util.Arrays;

/**
 * Production utility: inspect the certificate chain returned by a live TLS
 * endpoint. Run this against your own services during CI to catch chain
 * issues before they reach production.
 *
 * Real-world use: added to a fintech deployment pipeline after an Intermediate
 * CA cert was accidentally omitted from the Nginx config, causing mobile clients
 * (which don't do AIA fetching) to fail while desktop browsers succeeded.
 */
public class CertificateChainInspector {

    public static void main(String[] args) throws Exception {
        String targetHost = "api.example.com"; // replace with your service host
        int    targetPort = 443;

        // Build an SSL context backed by the default JVM trust store (cacerts).
        // This reflects exactly what your service-to-service calls will see.
        SSLContext sslContext = SSLContext.getDefault();
        SSLSocketFactory socketFactory = sslContext.getSocketFactory();

        // Open the TLS connection and capture the certificate chain presented
        // by the server — this is what the handshake actually receives.
        try (SSLSocket sslSocket = (SSLSocket) socketFactory.createSocket(targetHost, targetPort)) {
            sslSocket.startHandshake(); // triggers the full TLS handshake

            SSLSession session = sslSocket.getSession();
            Certificate[] peerCertificates = session.getPeerCertificates();

            System.out.printf("Chain length: %d (should be 2 or 3 — if 1, Intermediate is missing)%n",
                    peerCertificates.length);
            System.out.println();

            // Index 0 is always the leaf (end-entity) certificate.
            // Index 1 is the Intermediate CA.
            // Index 2 (if present) is a second Intermediate or the Root.
            for (int i = 0; i < peerCertificates.length; i++) {
                X509Certificate cert = (X509Certificate) peerCertificates[i];

                System.out.printf("=== Certificate [%d] ===%n", i);
                System.out.println("Subject : " + cert.getSubjectX500Principal().getName());
                System.out.println("Issuer  : " + cert.getIssuerX500Principal().getName());
                System.out.println("Valid from : " + cert.getNotBefore());
                System.out.println("Expires    : " + cert.getNotAfter()); // track this in alerting

                // Key usage tells you what this certificate is authorised to do.
                // End-entity certs should NOT have keyCertSign set — only CAs should.
                boolean[] keyUsage = cert.getKeyUsage();
                if (keyUsage != null) {
                    System.out.println("Key Usage  : " + Arrays.toString(keyUsage));
                    // keyUsage[5] == true means keyCertSign — a red flag on a leaf cert
                    if (keyUsage[5]) {
                        System.out.println("  ⚠ WARNING: keyCertSign is set — this cert can sign other certs");
                    }
                }

                // SAN (Subject Alternative Names) is what modern TLS checks for hostname matching.
                // CN matching was deprecated in RFC 2818 — if there's no SAN, expect errors in
                // Chrome 58+ and Java 8u181+ with the 'No subject alternative names present' message.
                try {
                    Collection<List<?>> sans = cert.getSubjectAlternativeNames();
                    if (sans != null) {
                        System.out.println("SANs :");
                        for (List<?> san : sans) {
                            // Type 2 = dNSName, Type 7 = iPAddress
                            System.out.println("  type=" + san.get(0) + " value=" + san.get(1));
                        }
                    } else {
                        System.out.println("  ⚠ WARNING: No SANs — hostname validation will fail in modern clients");
                    }
                } catch (CertificateParsingException e) {
                    System.out.println("  Could not parse SANs: " + e.getMessage());
                }
                System.out.println();
            }
        }
    }
}

package io.thecodeforge.dsa;

import javax.net.ssl.*;
import java.io.FileInputStream;
import java.net.URI;
import java.net.http.*;
import java.security.KeyStore;
import java.time.Duration;

/**
 * Production pattern: an order-processing service calling an inventory service
 * using mTLS. Both services have certificates issued by the same internal CA.
 * The calling service presents its own certificate — the server validates it
 * against the internal CA trust store, not a public CA.
 *
 * Prerequisite: generate keystores with:
 *   keytool -genkeypair -alias order-service -keyalg EC -groupname secp256r1
 *     -keystore order-service-keystore.p12 -storetype PKCS12 -validity 1
 *   (validity 1 day — short-lived certificates, rotated via Vault or cert-manager)
 *
 * The internal CA cert goes into the truststore:
 *   keytool -import -alias internal-ca -file internal-ca.crt
 *     -keystore internal-ca-truststore.p12 -storetype PKCS12
 */
public class MutualTlsServiceClient {

    // Paths to keystores — in production these come from Vault agent injection
    // or a Kubernetes secret mounted as a volume, NOT from environment variables.
    private static final String KEYSTORE_PATH   = "/etc/certs/order-service-keystore.p12";
    private static final String TRUSTSTORE_PATH = "/etc/certs/internal-ca-truststore.p12";

    // In production: read from Vault or a secrets manager, never hardcoded.
    private static final char[] KEYSTORE_PASSWORD   = "changeit".toCharArray();
    private static final char[] TRUSTSTORE_PASSWORD = "changeit".toCharArray();

    public static void main(String[] args) throws Exception {
        HttpClient mtlsClient = buildMtlsHttpClient();

        HttpRequest inventoryRequest = HttpRequest.newBuilder()
                .uri(URI.create("https://inventory-service.internal:8443/api/v1/stock/SKU-99821"))
                .timeout(Duration.ofSeconds(5))
                .header("Accept", "application/json")
                .GET()
                .build();

        HttpResponse<String> response = mtlsClient.send(
                inventoryRequest,
                HttpResponse.BodyHandlers.ofString()
        );

        System.out.println("Status : " + response.statusCode());
        System.out.println("Body   : " + response.body());
    }

    private static HttpClient buildMtlsHttpClient() throws Exception {

        // --- KEYSTORE: our identity ---
        // Contains the order-service's private key and its certificate.
        // Presented to the inventory service during the TLS handshake.
        KeyStore identityKeystore = KeyStore.getInstance("PKCS12");
        try (FileInputStream keystoreStream = new FileInputStream(KEYSTORE_PATH)) {
            identityKeystore.load(keystoreStream, KEYSTORE_PASSWORD);
        }

        KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(
                KeyManagerFactory.getDefaultAlgorithm() // SunX509
        );
        keyManagerFactory.init(identityKeystore, KEYSTORE_PASSWORD);

        // --- TRUSTSTORE: who we trust ---
        // Contains only the internal CA certificate, NOT the public CA bundle.
        // This prevents any publicly-trusted cert from impersonating an internal service.
        KeyStore internalTruststore = KeyStore.getInstance("PKCS12");
        try (FileInputStream truststoreStream = new FileInputStream(TRUSTSTORE_PATH)) {
            internalTruststore.load(truststoreStream, TRUSTSTORE_PASSWORD);
        }

        TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(
                TrustManagerFactory.getDefaultAlgorithm() // PKIX
        );
        trustManagerFactory.init(internalTruststore); // scoped to internal CA only

        // --- SSL CONTEXT ---
        // TLSv1.3 only. Drop TLS 1.0 and 1.1 — they're deprecated and broken.
        // TLS 1.2 is acceptable if you have legacy services that don't support 1.3 yet.
        SSLContext sslContext = SSLContext.getInstance("TLSv1.3");
        sslContext.init(
                keyManagerFactory.getKeyManagers(),   // our certificate presented to server
                trustManagerFactory.getTrustManagers(), // CAs we accept server certs from
                null // SecureRandom: null means JVM default (acceptable for most cases)
        );

        return HttpClient.newBuilder()
                .sslContext(sslContext)
                .connectTimeout(Duration.ofSeconds(3))
                .version(HttpClient.Version.HTTP_2) // HTTP/2 over TLS 1.3 — no overhead
                .build();
    }
}

package io.thecodeforge.dsa;

import java.io.FileInputStream;
import java.security.KeyStore;
import java.security.cert.X509Certificate;
import java.time.Duration;
import java.time.Instant;
import java.util.*;

/**
 * Production health check: expose certificate expiry for every cert in the
 * service's keystore as a structured health endpoint.
 *
 * Wire this into Spring Boot Actuator, Dropwizard HealthCheck, or your custom
 * /health endpoint. Feed the output into your APM (Datadog, New Relic, etc.)
 * as a custom metric: cert.days_until_expiry, tagged by alias.
 *
 * Rule: if any cert expires within CRITICAL_THRESHOLD_DAYS, the health check
 * returns DEGRADED and PagerDuty fires. This is non-negotiable.
 */
public class CertificateExpiryHealthIndicator {

    // Alert at 30 days warning, page at 7 days critical.
    // These numbers came from a post-incident review — 14 days wasn't enough
    // buffer for the procurement cycle at one enterprise client.
    private static final long WARNING_THRESHOLD_DAYS  = 30;
    private static final long CRITICAL_THRESHOLD_DAYS = 7;

    public static void main(String[] args) throws Exception {
        String keystorePath     = "/etc/certs/order-service-keystore.p12";
        char[] keystorePassword = "changeit".toCharArray();

        List<CertificateExpiryReport> report = inspectKeystore(keystorePath, keystorePassword);

        HealthStatus overallStatus = HealthStatus.HEALTHY;

        for (CertificateExpiryReport entry : report) {
            System.out.printf("Alias: %-30s | Expires: %s | Days remaining: %d | Status: %s%n",
                    entry.alias(), entry.expiresAt(), entry.daysRemaining(), entry.status());

            // Escalate overall status to the worst individual status
            if (entry.status() == HealthStatus.CRITICAL) {
                overallStatus = HealthStatus.CRITICAL;
            } else if (entry.status() == HealthStatus.WARNING && overallStatus != HealthStatus.CRITICAL) {
                overallStatus = HealthStatus.WARNING;
            }
        }

        System.out.println();
        System.out.println("Overall certificate health: " + overallStatus);

        // In production: if CRITICAL, throw an exception to fail the readiness probe.
        // This prevents Kubernetes from sending traffic to a service with an expired cert
        // that will cause every downstream mTLS handshake to fail.
        if (overallStatus == HealthStatus.CRITICAL) {
            throw new CertificateCriticalException(
                    "One or more certificates expire within " + CRITICAL_THRESHOLD_DAYS + " days. Rotation required immediately."
            );
        }
    }

    private static List<CertificateExpiryReport> inspectKeystore(
            String keystorePath, char[] password) throws Exception {

        KeyStore keystore = KeyStore.getInstance("PKCS12");
        try (FileInputStream inputStream = new FileInputStream(keystorePath)) {
            keystore.load(inputStream, password);
        }

        List<CertificateExpiryReport> reports = new ArrayList<>();
        Enumeration<String> aliases = keystore.aliases();

        while (aliases.hasMoreElements()) {
            String alias = aliases.nextElement();

            // Only inspect certificate entries — skip private key entries without certs
            if (!keystore.isCertificateEntry(alias) && !keystore.isKeyEntry(alias)) continue;

            X509Certificate cert = (X509Certificate) keystore.getCertificate(alias);
            if (cert == null) continue;

            Instant expiresAt = cert.getNotAfter().toInstant();
            long daysRemaining = Duration.between(Instant.now(), expiresAt).toDays();

            HealthStatus status;
            if (daysRemaining <= 0) {
                status = HealthStatus.EXPIRED; // already dead
            } else if (daysRemaining <= CRITICAL_THRESHOLD_DAYS) {
                status = HealthStatus.CRITICAL;
            } else if (daysRemaining <= WARNING_THRESHOLD_DAYS) {
                status = HealthStatus.WARNING;
            } else {
                status = HealthStatus.HEALTHY;
            }

            reports.add(new CertificateExpiryReport(alias, expiresAt, daysRemaining, status));
        }

        return reports;
    }

    // Structured report per certificate entry in the keystore
    record CertificateExpiryReport(
            String alias,
            Instant expiresAt,
            long daysRemaining,
            HealthStatus status
    ) {}

    enum HealthStatus { HEALTHY, WARNING, CRITICAL, EXPIRED }

    static class CertificateCriticalException extends RuntimeException {
        CertificateCriticalException(String message) { super(message); }
    }
}