Refactor CA trust (and update URLs)

[TymanWasTaken]

Description

Migrates our current strategy of loading a single DER file (and one that is already trusted through cross-signing) using an entire dedicated class to a new method of loading multiple certificates in a keystore, without a dedicated class. Explanation of the root certificates added, their hashes, and why they are added is located in a javadoc comment for future clarity.

In addition, I just swapped all instances of polyfrost.cc to polyfrost.org :)

Related Issue(s)

None

How to test

The current state of testing on the modern branch doesn't seem great but you can just download the keystore and test the code yourself in another project with JDK 1.8u51:

Example code

package org.example;

import javax.net.ssl.HttpsURLConnection;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLSocketFactory;
import javax.net.ssl.TrustManagerFactory;
import java.io.IOException;
import java.net.URL;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.Paths;
import java.security.KeyManagementException;
import java.security.KeyStore;
import java.security.KeyStoreException;
import java.security.NoSuchAlgorithmException;
import java.security.cert.CertificateException;

public class Main {
    private static SSLSocketFactory getSSLSocketFactory() throws KeyManagementException, KeyStoreException, IOException, NoSuchAlgorithmException, CertificateException {
        KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
        Path keyStorePath = Paths.get(System.getProperty("java.home"), "lib", "security", "cacerts");
        keyStore.load(Files.newInputStream(keyStorePath), null);
        keyStore.load(Files.newInputStream(Paths.get(/* KEYSTORE PATH HERE */)), "polyfrost".toCharArray());
        TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        trustManagerFactory.init(keyStore);
        SSLContext sslContext = SSLContext.getInstance("TLS");
        sslContext.init(null, trustManagerFactory.getTrustManagers(), null);
        return sslContext.getSocketFactory();
    }

    public static void main(String[] args) throws IOException, KeyStoreException, CertificateException, NoSuchAlgorithmException, KeyManagementException {
        URL url = new URL("https://valid-isrgrootx1.letsencrypt.org/");
        HttpsURLConnection con = (HttpsURLConnection) url.openConnection();
        con.setRequestMethod("GET");
        con.setConnectTimeout(15000);
        con.setReadTimeout(15000);
        con.setSSLSocketFactory(Main.getSSLSocketFactory());
        int status = con.getResponseCode();
        System.out.println("Request succeeded");
    }
}

Release Notes

fix downloads from sites with certificates issued by letsencrypt and a few other issuers

Documentation

N/A