Setting the file. One moment. 70
Creating Amazon Aurora Db Cluster With Instances
93
Routing Traffic With Route53 And CloudFront
Resilience Program Design
Creating API Gateway Stage
(opens in a new tab)
scripts/Db2SslTest.java
Java·146 lines·6 KB
11
* Compile: javac Db2SslTest.java
12 * Run: java Db2SslTest <host> <port> <pemFile>
13 * Example: java Db2SslTest mydb2.abc123def456.us-west-1.rds.amazonaws.com 50443 /tmp/us-west-1-bundle.pem
14 *
15 * No JDBC driver needed — tests the raw SSL handshake the same way the blog
16 * approach works (Java TrustManager loaded from PEM, no keystore/keytool).
17 */
18public class Db2SslTest {
19
20 public static void main(String[] args) throws Exception {
21 if (args.length < 3) {
22 System.err.println("Usage: java Db2SslTest <host> <port> <pem-file>");
23 System.exit(1);
24 }
25 String host = args[0];
26 int port = Integer.parseInt(args[1]);
27 String pemPath = args[2];
28
29 System.out.println("============================================================");
30 System.out.println(" RDS DB2 Java SSL Test (no GSKit, no keystore)");
31 System.out.printf (" Host : %s%n", host);
32 System.out.printf (" Port : %d%n", port);
33 System.out.printf (" PEM : %s%n", pemPath);
34 System.out.println("============================================================");
35 System.out.println();
36
37 // 1. Load certs from PEM
38 List<X509Certificate> certs = loadPem(pemPath);
39 System.out.printf("[PEM] %d certificate(s) loaded from %s%n", certs.size(), pemPath);
40 for (int i = 0; i < certs.size(); i++) {
41 X509Certificate c = certs.get(i);
42 System.out.printf(" [%d] Subject : %s%n", i, c.getSubjectX500Principal().getName());
43 System.out.printf(" Issuer : %s%n", c.getIssuerX500Principal().getName());
44 System.out.printf(" Expires : %s%n", c.getNotAfter());
45 }
46 System.out.println();
47
48 // 2. TCP
49 System.out.print("[TCP] Connecting... ");
50 try (Socket s = new Socket()) {
51 s.connect(new InetSocketAddress(host, port), 5000);
52 System.out.println("OK");
53 } catch (Exception e) {
54 System.out.println("FAIL: " + e.getMessage());
55 System.exit(1);
56 }
57
58 // 3. TLS with PEM-based TrustManager (blog approach)
59 System.out.println();
60 testTls("TLS with PEM TrustManager (blog approach)", host, port,
61 buildSslContext(certs, false), false);
62
63 // 4. TLS with PEM TrustManager, TLSv1.2 only
64 testTls("TLS with PEM TrustManager, TLSv1.2 only", host, port,
65 buildSslContext(certs, true), true);
66
67 // 5. TLS trust-all (no cert check)
68 testTls("TLS trust-all (no cert verification)", host, port,
69 buildTrustAllContext(), false);
70
71 System.out.println();
72 System.out.println("============================================================");
73 }
74
75 // -------------------------------------------------------------------------
76
77 static void testTls(String label, String host, int port,
78 SSLContext ctx, boolean tlsv12Only) {
79 System.out.printf("[TLS] %s%n", label);
80 try {
81 SSLSocketFactory factory = ctx.getSocketFactory();
82 try (SSLSocket ssl = (SSLSocket) factory.createSocket()) {
83 if (tlsv12Only) {
84 ssl.setEnabledProtocols(new String[]{"TLSv1.2"});
85 }
86 ssl.connect(new InetSocketAddress(host, port), 5000);
87 ssl.startHandshake();
88 SSLSession session = ssl.getSession();
89 System.out.printf(" Status : OK%n");
90 System.out.printf(" Protocol : %s%n", session.getProtocol());
91 System.out.printf(" Cipher : %s%n", session.getCipherSuite());
92 X509Certificate peer = (X509Certificate) session.getPeerCertificates()[0];
93 System.out.printf(" Subject : %s%n", peer.getSubjectX500Principal().getName());
94 System.out.printf(" Expires : %s%n", peer.getNotAfter());
95 }
96 } catch (Exception e) {
97 System.out.printf(" Status : FAIL%n");
98 System.out.printf(" Error : %s%n", e.getMessage());
99 }
100 System.out.println();
101 }
102
103 // Build SSLContext from PEM certs — same approach as the blog (no keystore/keytool)
104 static SSLContext buildSslContext(List<X509Certificate> certs, boolean tlsv12Only)
105 throws Exception {
106 KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
107 ks.load(null, null);
108 for (int i = 0; i < certs.size(); i++) {
109 ks.setCertificateEntry("rds-ca-" + i, certs.get(i));
110 }
111 TrustManagerFactory tmf = TrustManagerFactory.getInstance(
112 TrustManagerFactory.getDefaultAlgorithm());
113 tmf.init(ks);
114 SSLContext ctx = SSLContext.getInstance(tlsv12Only ? "TLSv1.2" : "TLS");
115 ctx.init(null, tmf.getTrustManagers(), null);
116 return ctx;
117 }
118
119 // Trust-all context for baseline check
120 static SSLContext buildTrustAllContext() throws Exception {
121 TrustManager[] trustAll = new TrustManager[]{
122 new X509TrustManager() {
123 public X509Certificate[] getAcceptedIssuers() { return new X509Certificate[0]; }
124 public void checkClientTrusted(X509Certificate[] c, String a) {}
125 public void checkServerTrusted(X509Certificate[] c, String a) {}
126 }
127 };
128 SSLContext ctx = SSLContext.getInstance("TLS");
129 ctx.init(null, trustAll, null);
130 return ctx;
131 }
132
133 // Load all certs from a PEM bundle (handles multi-cert bundles)
134 static List<X509Certificate> loadPem(String path) throws Exception {
135 CertificateFactory cf = CertificateFactory.getInstance("X.509");
136 List<X509Certificate> certs = new ArrayList<>();
137 try (InputStream in = new FileInputStream(path)) {
138 Collection<? extends java.security.cert.Certificate> c = cf.generateCertificates(in);
139 for (java.security.cert.Certificate cert : c) {
140 certs.add((X509Certificate) cert);
141 }
142 }
143 if (certs.isEmpty()) throw new Exception("No certificates found in " + path);
144 return certs;
145 }
146}