com.rabbitmq.client

Class PemReader

java.lang.Object

com.rabbitmq.client.PemReader

public final class PemReader
extends Object

Note: this class is copied from org.apache.zookeeper.util.PemReader (see https://github.com/apache/zookeeper/blob/master/zookeeper-server/src/main/java/org/apache/zookeeper/util/PemReader.java) under the same Apache License 2.0 (ASL).

The following modifications have been made to the original source code:

• removed methods around loading trustStores.
• updated the regular expressions to avoid exponential backtracking.

Method Summary

Modifier and Type	Method and Description
static KeyStore	loadKeyStore(String certificateChainContents, String privateKeyContents, Optional<String> keyPassword) Loads a KeyStore from PEM file contents.
static PrivateKey	loadPrivateKey(String privateKey, Optional<String> keyPassword) Loads a private key from PEM-formatted content.
static List<X509Certificate>	readCertificateChain(String certificateChainContents) Reads a chain of X.509 certificates from PEM-formatted content.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Detail

loadKeyStore

public static KeyStore loadKeyStore(String certificateChainContents,
                                    String privateKeyContents,
                                    Optional<String> keyPassword)
                             throws IOException,
                                    GeneralSecurityException

Loads a KeyStore from PEM file contents.

This method reads a private key and certificate chain from PEM-formatted content and stores them in a JKS KeyStore. The certificate file must contain at least one certificate.

Parameters:

certificateChainContents - the PEM-formatted content containing the certificate chain

privateKeyContents - the PEM-formatted content containing the private key

keyPassword - optional password for the private key; if the key is encrypted, this password will be used to decrypt it

Returns:

a KeyStore containing the private key and certificate chain

Throws:

IOException - if an I/O error occurs while reading the PEM content

GeneralSecurityException - if a security-related error occurs, such as:

• the private key cannot be loaded
• the certificate chain is empty
• the KeyStore cannot be initialized

CertificateException - if the certificate file does not contain any certificates

readCertificateChain

public static List<X509Certificate> readCertificateChain(String certificateChainContents)
                                                  throws CertificateException

Reads a chain of X.509 certificates from PEM-formatted content.

This method extracts all certificates found in the provided PEM content. Certificates are identified by BEGIN CERTIFICATE and END CERTIFICATE markers. The certificates are returned in the order they appear in the input.

Parameters:

certificateChainContents - the PEM-formatted content containing one or more certificates

Returns:

a list of X.509 certificates extracted from the PEM content; may be empty if no certificates are found

Throws:

CertificateException - if any certificate cannot be parsed or generated

loadPrivateKey

public static PrivateKey loadPrivateKey(String privateKey,
                                        Optional<String> keyPassword)
                                 throws IOException,
                                        GeneralSecurityException

Loads a private key from PEM-formatted content.

This method supports both encrypted and unencrypted private keys. The key must be in PKCS#8 format. To convert a key to PKCS#8 format, use: openssl pkcs8 -topk8 ...

The method attempts to load the key using RSA, EC, and DSA algorithms in that order.

Parameters:

privateKey - the PEM-formatted content containing the private key

keyPassword - optional password for decrypting an encrypted private key; if empty, the key is assumed to be unencrypted

Returns:

the loaded private key

Throws:

IOException - if an I/O error occurs while reading the key

GeneralSecurityException - if a security-related error occurs, such as:

• no private key is found in the content
• the key format is invalid
• the key cannot be decrypted with the provided password
• the key algorithm is not supported (RSA, EC, or DSA)