Qui di seguito ti riporto i miei appunti di quando ho attivato un certificato Let'sEncrypt come base per lo scambio dati B4A-B4J. Sono solo note raccolte leggendo qua e là, ma dovrebbero essere sufficienti.
*****************************************************************************
Key Manager Password: abcdef12pkcs
Keystore password: abcdef12key
*****************************************************************************
NB: le due passwprd precedenti sono esempi generici; utilizza quelle che riteni più opportune, ma ricorda di distinguere bene i ruoli tra KeyManager e Keystore (v. oltre)
***** Installa certbot
sudo apt-get update
sudo apt-get install software-properties-common
sudo add-apt-repository ppa:certbot/certbot
sudo apt-get update
sudo apt-get install certbot
sudo certbot certonly --webroot -w /opt/CloudServer/http_public -d mysitehere.com -d
www.mysitehere.com
sudo certbot certonly --standalone -d mysitehere.com -d
www.mysitehere.com
(replaced mysitehere.com with my actual domain name for my website where my B4J app is running.)
The above created a folder in etc/letsencrypt/live/mysitehere.com/
In that directory there is a few .pem files.
**** prepara PKCS12 file ****************
sudo openssl pkcs12 -export -out keystore.pkcs12 -in /etc/letsencrypt/live/mysitehere.com/fullchain.pem -inkey /etc/letsencrypt/live/mysitehere.com/privkey.pem
This will have you create a password. This is your "Key Manager" password. It's the password that unlocks your key / certificate. Don't forget / loose this password. It will have you enter it twice.
******** prepara il KEYSTORE file ****
sudo keytool -importkeystore -srckeystore keystore.pkcs12 -srcstoretype PKCS12 -destkeystore keystore.jks
oppure
sudo keytool -v -importkeystore -srckeystore domaincert.p12 -srcstoretype PKCS12 -destkeystore keystore.jks -deststoretype JKS
Note: “keystore.jks” will be the name of the final keystore file. You can change it to whatever you like (I named it “jetty.keystore”).
1) This will have you set up a password and re-enter the password. This password is your "Key Store" password. This is the password that opens the key store file.
2) It will then ask you for you password that you used to create the domaincert.p12 file (the "Key Manager" password). The password can be the same for both - if you prefer
Once this is done, you'll have a keystore file named keystore.jks (or whatever you called it).
Now, copy this keystore file to the same place as your jserver .jar file.
****************** Erel tutorial ***
https://www.b4x.com/android/forum/threads/server-ssl-connections.40130/#content
The server configuration is done with SslConfiguration object. This code should be called before the server is stared.
Private Sub ConfigureSSL (SslPort As Int)
'example of SSL connector configuration
Dim ssl As SslConfiguration
ssl.Initialize
ssl.SetKeyStorePath(File.DirApp, "test2.keystore") 'path to keystore file
ssl.KeyStorePassword = "123456"
ssl.KeyManagerPassword = "654321"
srvr.SetSslConfiguration(ssl, SslPort)
'add filter to redirect all traffic from http to https (optional)
srvr.AddFilter("/*", "HttpsFilter", False)
End Sub
We need to create a SslConfiguration object and set the path and passwords of the keystore file.
Then we call Server.SetSslConfiguration with the configuration object and the https port we want to listen to.
We can use a Filter class to redirect all http traffic to https:
'Return True to allow the request to proceed.
Public Sub Filter(req As ServletRequest, resp As ServletResponse) As Boolean
If req.Secure Then
Return True
Else
resp.SendRedirect(req.FullRequestURI.Replace("http:", "https:") _
.Replace(Main.srvr.Port, Main.srvr.SslPort))
Return False
End If
End Sub
This code checks whether the request is a secure request. If not it redirects the request to the https port and sets the scheme to https.
Note that trying to connect with http to the https port or with https to the http port will result with an error.
Filters do not apply to web sockets. You can use WebSocket.Secure to make sure that a secure connection has been made (this will be the case if the current request is a https request, unless someone has tampered the JavaScript code).
udg
