Class CaptureCertificateAuthority

java.lang.Object
com.shaft.capture.proxy.CaptureCertificateAuthority
public final class CaptureCertificateAuthority extends Object
Per-installation self-signed root certificate authority used to impersonate HTTPS hosts for mobile API capture. Generated once per machine under ~/.shaft/capture-ca/ and reused on every subsequent capture session; the private key is written with owner-only permissions and is never logged, transmitted, or included in any capture artifact -- only the public certificate is ever exported (for installation as a trusted CA on the device being captured).

  • Constructor Details

    • CaptureCertificateAuthority

      public CaptureCertificateAuthority()
      Loads the per-installation CA from ~/.shaft/capture-ca/, generating and persisting a new one if none exists yet.
      Throws:
      CaptureProxyException - if the CA could not be loaded or generated

    • CaptureCertificateAuthority

      public CaptureCertificateAuthority(Path directory)
      Loads (or generates) the CA under an explicit directory. Production code should prefer the no-arg constructor's shared per-machine ~/.shaft/capture-ca directory; this overload exists for tests and tools that must not touch that real, persistent, shared location and need an isolated (for example @TempDir-backed) directory instead.
      Parameters:
      directory - directory the CA key/cert are stored in

  • Method Details

    • certificate

      public X509Certificate certificate()
      Returns the CA's root certificate (public data only -- safe to export for device trust installation).
      Returns:
      root CA certificate

    • keyPair

      public KeyPair keyPair()
      Returns the CA's key pair. The private key never leaves this process -- callers must not serialize or transmit it.
      Returns:
      root CA key pair

    • directory

      public Path directory()
      Returns the directory this CA's key/certificate are persisted under.
      Returns:
      CA storage directory

    • exportCertificatePem

      public String exportCertificatePem()
      Exports the root CA certificate (public data only) as PEM text, for a user to install as a trusted CA on the mobile device/emulator being captured.
      Returns:
      PEM-encoded root CA certificate

    • issueLeafCertificate

      public X509Certificate issueLeafCertificate(String hostname, PublicKey leafPublicKey)
      Issues a short-lived leaf certificate for hostname, signed by this CA, impersonating that host for MITM interception. The leaf never has CA capability (basic constraints CA=false) so it cannot itself be used to mint further certificates.
      Parameters:
      hostname - the host being impersonated (recorded as the certificate's CN and DNS SAN)
      leafPublicKey - the public key the leaf certificate binds to
      Returns:
      a certificate for hostname, signed by this CA