如何配置Play應用程序以使用Let's Encrypt證書？

Question

一旦我獲得證書，我該如何從中生成一個JKS密鑰庫？

如何配置Play應用程序以使用此密鑰存儲區？

還有什麼我需要做的？

Answer 1

這裏是一個腳本來獲取（更新）letsencrypt證書：

#!/bin/bash 

/path/to/your/app/stop # stop the play application; especially if it is running on port 80 otherwise the certificate generation will fail 

rm -rf /etc/letsencrypt.bak 

mv /etc/letsencrypt /etc/letsencrypt.bak 

./letsencrypt-auto certonly --standalone -n -m email@example.com --agree-tos -d example.com -d www.example.com 

cd /etc/letsencrypt/live/example.com 

openssl pkcs12 -export -in fullchain.pem -inkey privkey.pem -out cert_and_key.p12 -CAfile chain.pem -caname root -passout pass:your_password 

keytool -importkeystore -srcstorepass your_password -destkeystore keyStore.jks -srckeystore cert_and_key.p12 -srcstoretype PKCS12 -storepass your_password 

/path/to/your/app/start # start the application 

您可以安排一個cron作業定期爲letsencrypt目前證書後90天過期運行此腳本。

一旦你獲得證書，你需要進行如下修改應用程序啓動腳本：

/path/to/your/app/app_name_script -Dhttps.port=443 -Dplay.server.https.keyStore.path=/etc/letsencrypt/live/example.com/keyStore.jks -Dplay.server.https.keyStore.password=your_password -Djdk.tls.ephemeralDHKeySize=2048 -Djdk.tls.rejectClientInitiatedRenegotiation=true # ... more parameters if required 

快到了。當您運行應用程序時，您可以從SSL Labs獲得A-的評分。評級降級與Forward Secrecy有關。爲了理清轉發安全性問題（並獲得一個完整的一個評級），你需要通過實現自定義SSLEngineProvider指定密碼套件的順序：

package controllers 

import java.nio.file._ 
import java.security.KeyStore 
import javax.net.ssl._ 

import play.core.ApplicationProvider 
import play.server.api._ 

class CustomSslEngineProvider(appProvider: ApplicationProvider) extends SSLEngineProvider { 

    val priorityCipherSuites = List(
    "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", 
    "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", 
    "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA") 


    def readPassword(): Array[Char] = System.getProperty("play.server.https.keyStore.password").toCharArray 

    def readKeyInputStream(): java.io.InputStream = { 
    val keyPath = FileSystems.getDefault.getPath(System.getProperty("play.server.https.keyStore.path")) 
    Files.newInputStream(keyPath) 
    } 

    def readKeyManagers(): Array[KeyManager] = { 
    val password = readPassword() 
    val keyInputStream = readKeyInputStream() 
    try { 
     val keyStore = KeyStore.getInstance(KeyStore.getDefaultType) 
     keyStore.load(keyInputStream, password) 
     val kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm) 
     kmf.init(keyStore, password) 

     kmf.getKeyManagers 
    } finally { 
     keyInputStream.close() 
    } 
    } 

    def createSSLContext(): SSLContext = { 
    val keyManagers = readKeyManagers() 
    val sslContext = SSLContext.getInstance("TLS") 
    sslContext.init(keyManagers, Array.empty, null) 
    sslContext 
    } 

    override def createSSLEngine(): SSLEngine = { 
    val ctx = createSSLContext() 
    val sslEngine = ctx.createSSLEngine 
    val cipherSuites = sslEngine.getEnabledCipherSuites.toList 
    val orderedCipherSuites = 
     priorityCipherSuites.filter(cipherSuites.contains) ::: cipherSuites.filterNot(priorityCipherSuites.contains) 
    sslEngine.setEnabledCipherSuites(orderedCipherSuites.toArray) 
    val params = sslEngine.getSSLParameters 
    params.setUseCipherSuitesOrder(true) 
    sslEngine.setSSLParameters(params) 
    sslEngine 
    } 
} 

不要忘記設置

play.server.https.engineProvider = controllers.CustomSslEngineProvider

在 application.conf

。

使用Play測試2.5.x