網頁憑證信任圖解：TLS 握手、憑證鏈、Trust Store 到 openssl 排錯

1
2
3
4
5
6
7
8
9

>>> ClientHello
<<< ServerHello
<<< ChangeCipherSpec        # 相容舊中介設備用的假訊息，1.3 沒有實際作用
<<< EncryptedExtensions     # 從這裡開始已經加密
<<< Certificate
<<< CertificateVerify
<<< Finished
>>> ChangeCipherSpec
>>> Finished

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

openssl s_client -connect github.com:443 -servername github.com -brief </dev/null
# CONNECTION ESTABLISHED
# Protocol version: TLSv1.3
# Ciphersuite: TLS_AES_128_GCM_SHA256
# Peer certificate: CN=github.com
# Hash used: SHA256
# Signature type: ecdsa_secp256r1_sha256
# Verification: OK
# Peer Temp Key: X25519, 253 bits

openssl s_client -connect github.com:443 -servername github.com -tls1_2 -brief </dev/null
# Protocol version: TLSv1.2
# Ciphersuite: ECDHE-ECDSA-AES128-GCM-SHA256

1
2
3
4
5
6
7
8

Certificate
├── tbsCertificate        # "to be signed"，所有欄位都在這裡
│   ├── version, serialNumber, signature algorithm
│   ├── issuer, validity, subject
│   ├── subjectPublicKeyInfo
│   └── extensions        # v3 才有，現代驗證規則幾乎都在這裡
├── signatureAlgorithm
└── signatureValue        # Issuer 用自己的私鑰，對 tbsCertificate 簽名

1

openssl x509 -in github-0.pem -noout -text

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3e:1d:60:26:b4:b0:ae:a2:79:dc:a2:ef:bb:ce:d8:2b     # CA 內唯一，撤銷時靠它識別
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication CA DV E36
        Validity
            Not Before: Oct 30 00:00:00 2026 GMT
            Not After : Jan 27 23:59:59 2027 GMT                # 約 90 天
        Subject: CN=github.com                                   # 只有 CN，沒有 O：這是 DV 憑證
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit field, 128 bit security level)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                17:99:A8:04:C1:6F:E4:2D:70:A8:0A:10:3D:03:D3:E9:1A:B8:26:63   # = 上一層的 SKI
            X509v3 Subject Key Identifier:
                8C:B0:2A:1E:AE:EE:86:5D:00:01:35:B1:E5:8B:69:23:A5:3E:3C:71
            X509v3 Key Usage: critical
                Digital Signature
            X509v3 Basic Constraints: critical
                CA:FALSE                                         # 不能再拿去簽別的憑證
            X509v3 Extended Key Usage:
                TLS Web Server Authentication                    # serverAuth
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6449.1.2.2.7
                  CPS: https://sectigo.com/CPS
                Policy: 2.23.140.1.2.1                           # CA/B Forum 的 DV 標記
            Authority Information Access:
                CA Issuers - URI:http://crt.sectigo.com/SectigoPublicServerAuthenticationCADVE36.crt
                OCSP - URI:http://ocsp.sectigo.com
            X509v3 Subject Alternative Name:
                DNS:github.com, DNS:www.github.com               # 主機名比對只看這裡
            CT Precertificate SCTs:
                Signed Certificate Timestamp:                    # 已登錄到公開的 CT log
                    Timestamp : Oct 30 00:21:07.488 2026 GMT
                ...
    Signature Algorithm: ecdsa-with-SHA256
    Signature Value:
        30:44:02:20:22:21:55:0b:...

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

你產生私鑰 (private key) ──推導出──> 公鑰 (public key)
        │                                 │
        │                                 ▼
        └──── 用私鑰簽名 ────────> CSR（公鑰 + 想要的名稱）
                                          │ 送給 CA
                                          ▼
                    CA 驗證你擁有網域後，用「CA 自己的私鑰」簽名
                                          │
                                          ▼
                            憑證（你的公鑰 + 名稱 + CA 簽章）

1

openssl s_client -connect github.com:443 -servername github.com -showcerts </dev/null

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

Certificate chain
 0 s:CN=github.com
   i:C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication CA DV E36
   a:PKEY: EC, (prime256v1); sigalg: ecdsa-with-SHA256
   v:NotBefore: Oct 30 00:00:00 2026 GMT; NotAfter: Jan 27 23:59:59 2027 GMT
 1 s:C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication CA DV E36
   i:C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication Root E46
   a:PKEY: EC, (prime256v1); sigalg: ecdsa-with-SHA384
   v:NotBefore: Mar 22 00:00:00 2021 GMT; NotAfter: Mar 21 23:59:59 2036 GMT
 2 s:C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication Root E46
   i:C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust ECC Certification Authority
   a:PKEY: EC, (secp384r1); sigalg: ecdsa-with-SHA384
   v:NotBefore: Mar 22 00:00:00 2021 GMT; NotAfter: Jan 18 23:59:59 2038 GMT

1
2

leaf          AKI = 17:99:A8:...    ──等於──>  DV E36 的 SKI
DV E36 中繼   AKI = D1:22:DA:...    ──等於──>  Root E46 的 SKI

1
2
3
4

openssl s_client -connect incomplete-chain.badssl.com:443 -servername incomplete-chain.badssl.com </dev/null 2>/dev/null | grep -E 'verify error|Verify return'
# verify error:num=20:unable to get local issuer certificate
# verify error:num=21:unable to verify the first certificate
# Verify return code: 21 (unable to verify the first certificate)

1
2
3
4
5
6
7

# 預設
javax.net.ssl.SSLHandshakeException: PKIX path building failed:
  sun.security.provider.certpath.SunCertPathBuilderException:
  unable to find valid certification path to requested target

# 加上 -Dcom.sun.security.enableAIAcaIssuers=true
200

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

# macOS 系統內建的 root（Safari、多數 macOS App 用這份）
security find-certificate -a /System/Library/Keychains/SystemRootCertificates.keychain | grep -c '"labl"'
# 151

# macOS 內建 curl（LibreSSL）用的 bundle
grep -c 'BEGIN CERTIFICATE' /etc/ssl/cert.pem
# 128

# Homebrew 的 OpenSSL 用的 bundle
grep -c 'BEGIN CERTIFICATE' /opt/homebrew/etc/openssl@4/cert.pem
# 188

# Java（Corretto 21 GA 版，2023-09 發佈）
keytool -list -cacerts -storepass changeit | grep -c trustedCertEntry
# 145

1
2
3

keytool -list -cacerts -storepass changeit | grep -iE 'usertrustecc|sectigo|isrg'
# letsencryptisrgx1 [jdk], ..., trustedCertEntry,
# usertrusteccca [jdk], ..., trustedCertEntry,

1
2
3

1. -Djavax.net.ssl.trustStore 指定的檔案
2. $JAVA_HOME/lib/security/jssecacerts（如果存在）
3. $JAVA_HOME/lib/security/cacerts

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

openssl x509 -in leaf.pem -noout -ext subjectAltName
# X509v3 Subject Alternative Name:
#     DNS:localhost, DNS:*.lab.test, IP Address:127.0.0.1

openssl verify -CAfile root.pem -untrusted intermediate.pem -verify_hostname api.lab.test leaf.pem
# leaf.pem: OK

openssl verify -CAfile root.pem -untrusted intermediate.pem -verify_hostname lab.test leaf.pem
# CN=localhost
# error 62 at 0 depth lookup: hostname mismatch
# error leaf.pem: verification failed

openssl verify -CAfile root.pem -untrusted intermediate.pem -verify_hostname a.b.lab.test leaf.pem
# CN=localhost
# error 62 at 0 depth lookup: hostname mismatch
# error leaf.pem: verification failed

openssl verify -CAfile root.pem -untrusted intermediate.pem -verify_ip 127.0.0.2 leaf.pem
# CN=localhost
# error 64 at 0 depth lookup: IP address mismatch
# error leaf.pem: verification failed

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

openssl x509 -in cn-only.pem -noout -subject -ext subjectAltName
# No extensions in certificate          （沒有 SAN）
# subject=CN=legacy.lab.test

openssl verify -CAfile root.pem -untrusted intermediate.pem cn-only.pem
# cn-only.pem: OK                        （不檢查主機名時，鏈本身沒問題）

openssl verify -CAfile root.pem -untrusted intermediate.pem -verify_hostname legacy.lab.test cn-only.pem
# CN=legacy.lab.test
# error 62 at 0 depth lookup: hostname mismatch
# error cn-only.pem: verification failed

1
2

openssl s_client -connect github.com:443 -servername github.com </dev/null 2>/dev/null \
  | openssl x509 -noout -issuer -fingerprint -sha256

1

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

1
2
3
4
5
6

curl -sI https://github.com | grep -i '^strict'
# strict-transport-security: max-age=31536000; includeSubdomains; preload

curl -sI http://github.com | grep -iE '^HTTP|^location'
# HTTP/1.1 301 Moved Permanently
# location: https://github.com/

1
2
3
4
5
6
7

curl -s 'https://hstspreload.org/api/v2/status?domain=github.com'
# {
#   "name": "github.com",
#   "status": "preloaded",
#   "bulk": true,
#   "preloadedDomain": "github.com"
# }

1
2
3
4
5
6
7
8
9

@Bean
SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http.headers(headers -> headers
            .httpStrictTransportSecurity(hsts -> hsts
                    .includeSubDomains(true)
                    .preload(true)
                    .maxAgeInSeconds(31536000)));
    return http.build();
}

1
2

server:
  forward-headers-strategy: NATIVE   # 或 FRAMEWORK；Tomcat 也可以用 server.tomcat.remoteip.*

1

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

# 假裝現在是 2027-03-01（leaf 在 2027-01-30 到期）
openssl verify -CAfile root.pem -untrusted intermediate.pem \
  -attime $(date -j -f %Y-%m-%d 2027-03-01 +%s) leaf.pem
# CN=localhost
# error 10 at 0 depth lookup: certificate has expired
# error leaf.pem: verification failed

# 假裝現在是 2026-01-01（root 是 2026-11 才建立的）
openssl verify -CAfile root.pem -untrusted intermediate.pem \
  -attime $(date -j -f %Y-%m-%d 2026-01-01 +%s) leaf.pem
# C=TW, O=Bill Lab, CN=Bill Lab Root CA
# error 9 at 2 depth lookup: certificate is not yet valid or the system clock is incorrect
# error leaf.pem: verification failed

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

openssl x509 -in leaf.pem -noout -enddate -checkend $((30*86400))
# notAfter=Jan 30 15:35:13 2027 GMT
# Certificate will not expire
echo $?
# 0

openssl x509 -in leaf.pem -noout -checkend $((100*86400))
# Certificate will expire
echo $?
# 1

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

for host in github.com expired.badssl.com; do
  pem=$(openssl s_client -connect "$host:443" -servername "$host" </dev/null 2>/dev/null)
  end=$(echo "$pem" | openssl x509 -noout -enddate | cut -d= -f2)
  if echo "$pem" | openssl x509 -noout -checkend $((30*86400)) >/dev/null; then
    echo "OK     $host  $end"
  else
    echo "RENEW  $host  $end"
  fi
done
# OK     github.com  Jan 27 23:59:59 2027 GMT
# RENEW  expired.badssl.com  Apr 12 23:59:59 2015 GMT

1
2
3
4
5
6

/usr/bin/openssl version
# LibreSSL 3.3.6
openssl version
# OpenSSL 4.1.0 23 Oct 2026 (Library: OpenSSL 4.1.0 23 Oct 2026)
openssl version -d          # 預設 trust store 所在的目錄
# OPENSSLDIR: "/opt/homebrew/etc/openssl@4"

1

openssl s_client -connect github.com:443 -servername github.com -showcerts </dev/null

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

Certificate chain
 0 s:CN=github.com
   i:C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication CA DV E36
 ...
---
Server certificate
subject=CN=github.com
issuer=C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication CA DV E36
---
Peer signature type: ecdsa_secp256r1_sha256
Peer Temp Key: X25519, 253 bits
---
SSL handshake has read 3133 bytes and written 1835 bytes
Verification: OK
---
New, TLSv1.3, Cipher is TLS_AES_128_GCM_SHA256
Protocol: TLSv1.3
Verify return code: 0 (ok)

1
2
3
4
5
6

openssl s_client -connect github.com:443 -servername github.com -showcerts </dev/null 2>/dev/null \
  | awk '/BEGIN CERTIFICATE/{n++; f=sprintf("github-%d.pem", n-1)}
         /BEGIN CERTIFICATE/,/END CERTIFICATE/{print > f}'

ls github-*.pem
# github-0.pem  github-1.pem  github-2.pem

1
2
3

openssl x509 -in github-0.pem -noout -subject -issuer -dates -ext subjectAltName
openssl x509 -in github-0.pem -noout -fingerprint -sha256
# sha256 Fingerprint=7D:C4:D8:5C:F1:E3:10:97:12:25:BC:9A:92:57:67:90:43:A2:43:D7:0A:3C:C2:A9:1C:C5:D3:89:89:2C:27:76

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

# 只給 leaf：預設名單裡沒有中繼憑證，建不了鏈
openssl verify github-0.pem
# CN=github.com
# error 20 at 0 depth lookup: unable to get local issuer certificate
# error github-0.pem: verification failed

# 補上中繼憑證
openssl verify -untrusted github-1.pem github-0.pem
# github-0.pem: OK

# -show_chain 看實際建出來的鏈
openssl verify -untrusted github-1.pem -show_chain github-0.pem
# github-0.pem: OK
# Chain:
# depth=0: CN=github.com (untrusted)
# depth=1: C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication CA DV E36 (untrusted)
# depth=2: C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication Root E46

1
2
3
4
5
6
7

openssl x509 -in leaf.pem -noout -pubkey | openssl sha256
# SHA2-256(stdin)= 80ccfd2ffa6dfd8225a479c6ec3134022c54934820d0956864243e1484215af5
openssl pkey -in leaf.key -pubout | openssl sha256
# SHA2-256(stdin)= 80ccfd2ffa6dfd8225a479c6ec3134022c54934820d0956864243e1484215af5   ← 相同，是一對

openssl pkey -in intermediate.key -pubout | openssl sha256
# SHA2-256(stdin)= b369fc0f2f16fb1b374ec572e0d1ec7f6f1dd1a59a9670381dfd6a27ff125a8c   ← 不同

1
2
3
4

basicConstraints=critical,CA:TRUE,pathlen:0
keyUsage=critical,keyCertSign,cRLSign
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always

1
2
3
4
5
6

basicConstraints=critical,CA:FALSE
keyUsage=critical,digitalSignature
extendedKeyUsage=serverAuth
subjectAltName=DNS:localhost,DNS:*.lab.test,IP:127.0.0.1
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always

1
2
3
4
5
6

openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out root.key
openssl req -x509 -new -key root.key -sha256 -days 3650 \
  -subj "/C=TW/O=Bill Lab/CN=Bill Lab Root CA" \
  -addext "basicConstraints=critical,CA:TRUE" \
  -addext "keyUsage=critical,keyCertSign,cRLSign" \
  -out root.pem

1
2
3
4
5
6
7

openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out intermediate.key
openssl req -new -key intermediate.key \
  -subj "/C=TW/O=Bill Lab/CN=Bill Lab Intermediate CA" -out intermediate.csr
openssl x509 -req -in intermediate.csr -CA root.pem -CAkey root.key \
  -days 1825 -sha256 -extfile intermediate.ext -out intermediate.pem
# Certificate request self-signature ok
# subject=C=TW, O=Bill Lab, CN=Bill Lab Intermediate CA

1
2
3
4
5
6
7
8

openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out leaf.key
openssl req -new -key leaf.key -subj "/CN=localhost" -out leaf.csr
openssl x509 -req -in leaf.csr -CA intermediate.pem -CAkey intermediate.key \
  -days 90 -sha256 -extfile leaf.ext -out leaf.pem
# Certificate request self-signature ok
# subject=CN=localhost

cat leaf.pem intermediate.pem > fullchain.pem      # 給伺服器用：leaf 在前

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

# 只信任 root，沒給中繼憑證 → 20（伺服器沒送中繼憑證就是這個狀況）
openssl verify -CAfile root.pem leaf.pem
# CN=localhost
# error 20 at 0 depth lookup: unable to get local issuer certificate
# error leaf.pem: verification failed

# 補上中繼憑證 → OK
openssl verify -CAfile root.pem -untrusted intermediate.pem -show_chain leaf.pem
# leaf.pem: OK
# Chain:
# depth=0: CN=localhost (untrusted)
# depth=1: C=TW, O=Bill Lab, CN=Bill Lab Intermediate CA (untrusted)
# depth=2: C=TW, O=Bill Lab, CN=Bill Lab Root CA

# 把 root 跟著鏈一起「送」，但不放進信任名單 → 19（防火牆 SSL inspection 就是這個狀況）
cat intermediate.pem root.pem > chain-with-root.pem
openssl verify -untrusted chain-with-root.pem leaf.pem
# C=TW, O=Bill Lab, CN=Bill Lab Root CA
# error 19 at 2 depth lookup: self-signed certificate in certificate chain
# error leaf.pem: verification failed

# 只用系統名單 → 20 at 1（內部 CA 沒加進名單）
openssl verify -untrusted intermediate.pem leaf.pem
# C=TW, O=Bill Lab, CN=Bill Lab Intermediate CA
# error 20 at 1 depth lookup: unable to get local issuer certificate
# error leaf.pem: verification failed

# 單獨驗 root → 18
openssl verify root.pem
# C=TW, O=Bill Lab, CN=Bill Lab Root CA
# error 18 at 0 depth lookup: self-signed certificate
# error root.pem: verification failed

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

# 中繼憑證設成 CA:FALSE，再用它簽 leaf → 79
openssl verify -CAfile root.pem -untrusted bad-int.pem leaf-bad.pem
# C=TW, O=Bill Lab, CN=Bad Intermediate
# error 79 at 1 depth lookup: invalid CA certificate
# error leaf-bad.pem: verification failed

# leaf 的 EKU 只有 clientAuth
openssl verify -CAfile root.pem -untrusted intermediate.pem leaf-client.pem
# leaf-client.pem: OK                     ← 不指定用途時不檢查 EKU
openssl verify -CAfile root.pem -untrusted intermediate.pem -purpose sslserver leaf-client.pem
# CN=localhost
# error 26 at 0 depth lookup: unsuitable certificate purpose
# error leaf-client.pem: verification failed

1
2
3
4
5
6
7

# 終端機 A：用 leaf + 中繼憑證開一個 TLS server
openssl s_server -accept 8443 -cert leaf.pem -key leaf.key -cert_chain intermediate.pem -www

# 終端機 B：用自己的 root 驗證
openssl s_client -connect localhost:8443 -CAfile root.pem -verify_hostname localhost </dev/null
# 預期：Verify return code: 0 (ok)
# 拿掉 -CAfile 改用系統名單：預期 Verify return code: 20

1
2

openssl s_client -connect repo.maven.apache.org:443 -servername repo.maven.apache.org -showcerts </dev/null 2>/dev/null \
  | grep -E '^ *[0-9] s:|^ *i:'

1

openssl x509 -in corp-root.pem -noout -subject -fingerprint -sha256

1
2

sudo keytool -importcert -cacerts -alias corp-root -file corp-root.pem -storepass changeit -noprompt
keytool -list -cacerts -storepass changeit -alias corp-root

1
2
3
4

mkdir -p ~/.certs
cp "$JAVA_HOME/lib/security/cacerts" ~/.certs/java-cacerts
keytool -importcert -keystore ~/.certs/java-cacerts -storepass changeit \
  -alias corp-root -file corp-root.pem -noprompt

1
2

java -Djavax.net.ssl.trustStore=$HOME/.certs/java-cacerts \
     -Djavax.net.ssl.trustStorePassword=changeit -jar app.jar

1
2
3

# Maven：放在專案的 .mvn/jvm.config，或環境變數 MAVEN_OPTS
-Djavax.net.ssl.trustStore=/Users/you/.certs/java-cacerts
-Djavax.net.ssl.trustStorePassword=changeit

1
2
3

# Gradle：~/.gradle/gradle.properties（不要提交到專案的 git）
systemProp.javax.net.ssl.trustStore=/Users/you/.certs/java-cacerts
systemProp.javax.net.ssl.trustStorePassword=changeit

1

java -Djavax.net.ssl.trustStoreType=Windows-ROOT -jar app.jar

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class TlsCheck {

    public static void main(String[] args) {
        HttpClient client = HttpClient.newHttpClient();
        for (String url : args) {
            try {
                HttpRequest request = HttpRequest.newBuilder(URI.create(url)).build();
                int status = client.send(request, HttpResponse.BodyHandlers.discarding()).statusCode();
                System.out.println(url + " " + status);
            } catch (Exception e) {
                Throwable root = e;
                while (root.getCause() != null) {
                    root = root.getCause();
                }
                System.out.println(url + " FAIL " + e);
                System.out.println("  root cause: " + root);
            }
        }
    }
}

1
2

java -Djavax.net.ssl.trustStore=$HOME/.certs/java-cacerts -Djavax.net.ssl.trustStorePassword=changeit \
  TlsCheck.java https://github.com https://repo.maven.apache.org

1
2
3
4
5
6
7
8

cat /etc/ssl/cert.pem corp-root.pem > ~/.certs/ca-bundle.pem

# curl：單次用 --cacert，長期用環境變數
curl --cacert ~/.certs/ca-bundle.pem https://github.com
export CURL_CA_BUNDLE=$HOME/.certs/ca-bundle.pem

# git
git config --global http.sslCAInfo ~/.certs/ca-bundle.pem

1
2

COPY corp-root.pem /usr/local/share/ca-certificates/corp-root.crt
RUN update-ca-certificates

1

docker run -v "$(pwd)/certs:/certificates/" -e USE_SYSTEM_CA_CERTS=1 eclipse-temurin:21

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

FROM eclipse-temurin:21-jdk AS build
COPY corp-root.pem /tmp/corp-root.pem
RUN keytool -importcert -cacerts -storepass changeit -noprompt -alias corp-root -file /tmp/corp-root.pem
COPY . /app
WORKDIR /app
RUN ./mvnw -q package -DskipTests

FROM eclipse-temurin:21-jre
COPY --from=build /app/target/app.jar /app/app.jar
ENTRYPOINT ["java", "-jar", "/app/app.jar"]

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

# macOS：加進系統 Keychain 並設為信任（Safari、Chrome 會生效）
sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain root.pem

# Ubuntu / Debian
sudo cp root.pem /usr/local/share/ca-certificates/bill-lab-root.crt
sudo update-ca-certificates

# RHEL / Amazon Linux
sudo cp root.pem /etc/pki/ca-trust/source/anchors/bill-lab-root.pem
sudo update-ca-trust

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

spring:
  ssl:
    bundle:
      pem:
        server:
          reload-on-update: true
          keystore:
            certificate: "file:/etc/app/tls/fullchain.pem"
            private-key: "file:/etc/app/tls/leaf.key"

server:
  port: 8443
  ssl:
    bundle: "server"

1
2
3
4
5
6
7

spring:
  ssl:
    bundle:
      pem:
        internal-ca:
          truststore:
            certificate: "classpath:certs/root.pem"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

import org.springframework.boot.restclient.autoconfigure.RestClientSsl;   // Spring Boot 4.x
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.client.RestClient;

@Configuration
class InternalApiClientConfig {

    @Bean
    RestClient internalApiClient(RestClient.Builder builder, RestClientSsl ssl) {
        return builder
                .baseUrl("https://api.lab.test:8443")
                .apply(ssl.fromBundle("internal-ca"))
                .build();
    }
}