如何配置Play应用程序以使用Let's Encrypt证书？

Question

一旦我获得证书，我该如何从中生成一个JKS密钥库？

如何配置Play应用程序以使用此密钥存储区？

还有什么我需要做的？

Answer 1

这里是一个脚本来获取（更新）letsencrypt证书：

#!/bin/bash 

/path/to/your/app/stop # stop the play application; especially if it is running on port 80 otherwise the certificate generation will fail 

rm -rf /etc/letsencrypt.bak 

mv /etc/letsencrypt /etc/letsencrypt.bak 

./letsencrypt-auto certonly --standalone -n -m email@example.com --agree-tos -d example.com -d www.example.com 

cd /etc/letsencrypt/live/example.com 

openssl pkcs12 -export -in fullchain.pem -inkey privkey.pem -out cert_and_key.p12 -CAfile chain.pem -caname root -passout pass:your_password 

keytool -importkeystore -srcstorepass your_password -destkeystore keyStore.jks -srckeystore cert_and_key.p12 -srcstoretype PKCS12 -storepass your_password 

/path/to/your/app/start # start the application 

您可以安排一个cron作业定期为letsencrypt目前证书后90天过期运行此脚本。

一旦你获得证书，你需要进行如下修改应用程序启动脚本：

/path/to/your/app/app_name_script -Dhttps.port=443 -Dplay.server.https.keyStore.path=/etc/letsencrypt/live/example.com/keyStore.jks -Dplay.server.https.keyStore.password=your_password -Djdk.tls.ephemeralDHKeySize=2048 -Djdk.tls.rejectClientInitiatedRenegotiation=true # ... more parameters if required 

快到了。当您运行应用程序时，您可以从SSL Labs获得A-的评分。评级降级与Forward Secrecy有关。为了理清转发安全性问题（并获得一个完整的一个评级），你需要通过实现自定义SSLEngineProvider指定密码套件的顺序：

package controllers 

import java.nio.file._ 
import java.security.KeyStore 
import javax.net.ssl._ 

import play.core.ApplicationProvider 
import play.server.api._ 

class CustomSslEngineProvider(appProvider: ApplicationProvider) extends SSLEngineProvider { 

    val priorityCipherSuites = List(
    "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", 
    "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", 
    "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA") 


    def readPassword(): Array[Char] = System.getProperty("play.server.https.keyStore.password").toCharArray 

    def readKeyInputStream(): java.io.InputStream = { 
    val keyPath = FileSystems.getDefault.getPath(System.getProperty("play.server.https.keyStore.path")) 
    Files.newInputStream(keyPath) 
    } 

    def readKeyManagers(): Array[KeyManager] = { 
    val password = readPassword() 
    val keyInputStream = readKeyInputStream() 
    try { 
     val keyStore = KeyStore.getInstance(KeyStore.getDefaultType) 
     keyStore.load(keyInputStream, password) 
     val kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm) 
     kmf.init(keyStore, password) 

     kmf.getKeyManagers 
    } finally { 
     keyInputStream.close() 
    } 
    } 

    def createSSLContext(): SSLContext = { 
    val keyManagers = readKeyManagers() 
    val sslContext = SSLContext.getInstance("TLS") 
    sslContext.init(keyManagers, Array.empty, null) 
    sslContext 
    } 

    override def createSSLEngine(): SSLEngine = { 
    val ctx = createSSLContext() 
    val sslEngine = ctx.createSSLEngine 
    val cipherSuites = sslEngine.getEnabledCipherSuites.toList 
    val orderedCipherSuites = 
     priorityCipherSuites.filter(cipherSuites.contains) ::: cipherSuites.filterNot(priorityCipherSuites.contains) 
    sslEngine.setEnabledCipherSuites(orderedCipherSuites.toArray) 
    val params = sslEngine.getSSLParameters 
    params.setUseCipherSuitesOrder(true) 
    sslEngine.setSSLParameters(params) 
    sslEngine 
    } 
} 

不要忘记设置

play.server.https.engineProvider = controllers.CustomSslEngineProvider

在 application.conf

。

使用Play测试2.5.x