Although HTTP/3 has been standardized as of June 2022, many projects still do not adopt HTTPS, which is concerning.

The official release of HTTP/3 was announced on June 6, 2022, by the IETF QUIC and HTTP working group. For more details, refer to this article.

On June 6, 2022, Robin Mark, a member of the IETF QUIC and HTTP working group, announced on Twitter that after five years of development, HTTP/3 has officially been standardized as RFC 9114 — the third major version of the Hypertext Transfer Protocol.

With HTTP/3, resource consumption can be reduced, supporting environmental protection and business growth.

This article explores several common questions about digital certificates.

Note: While the fundamental principles of digital certificates are similar, their implementations and applications vary widely, making it impossible to cover all scenarios exhaustively.

For a comprehensive reference, consider reading Zhang Deming’s book titled "Complete Guide to PKI/CA and Digital Certificate Technology", which is highly recommended.

I. What Is a Digital Certificate

Source: Baidu Encyclopedia

The term "digital certificate" is not originally Chinese but translates from the English "digital certificate." Essentially, a digital certificate is an electronic document issued by a Certificate Authority (CA) to provide a level of trust and authenticity in e-commerce transactions. It plays a crucial role in ensuring transaction security, such as when shopping online where users install digital certificates to protect financial data. [2]

The CA employs digital encryption techniques to authenticate users and manage secure communications. Through these certificates, the CA ensures that data transmitted over the internet remains encrypted, signed, and verified, preventing unauthorized access or tampering. Even if credentials like passwords are compromised, account integrity and funds remain protected due to the robust nature of certificate-based authentication. [2]

Digital certificates function similarly to identity cards in society, allowing users to verify identities during online interactions. The CA acts as a trusted third party responsible for issuing and managing these certificates. In China, the qualification for operating a CA center is granted by the Ministry of Industry and Information Technology, with only around 50 companies authorized nationwide. [2]

At its core, digital certificates utilize Public Key Infrastructure (PKI), employing a pair of keys — public and private — for encryption and decryption. The private key is used for signing and decrypting, kept secret by the user, while the public key enables verification and encryption, shared among multiple parties. [3]

Key functionalities of digital certificates include: [3]
Firstly, information sent by one party is encrypted using the recipient's public key, remaining in ciphertext form throughout transmission. Only the intended recipient can decrypt the message using their private key, ensuring confidentiality and integrity. [3]
Secondly, digital signatures work similarly to encryption. After data is encrypted, the recipient signs it with their private key before sending it back. This signature confirms authenticity and prevents repudiation. [3]

There are various formats for digital certificates, including X.509v3 (1997), X.509v4 (1997), and X.509v1 (1988). The most commonly used version is X.509v3, developed by the International Telecommunication Union, containing elements such as certificate serial number, validity period, and public key information. Regardless of version, digital certificates can be applied across network security solutions.

From a layman's perspective, a certificate can be thought of as a kind of password or cipher — essentially a means of authentication. However, technically speaking, knowing the theory behind digital certificates is far from being able to implement them practically.

II. How HTTP/2 Works with Digital Certificates

The general principle is illustrated below:

Web Encryption Overveiw

HTTPS Implementation Guide

III. Generating Development Certificates Using Java

You can use keytool to generate a certificate, for example:

# Generate certificate
keytool -genkey -alias http2test -storetype PKCS12 -keyalg RSA -keysize 2048 -keystore spring-rsa-test.p12 -dname "CN=hc.work,OU=LZF,O=HC,l=SH,ST=SH,C=CN" -storepass ziligengsheng

# Delete certificate (use keytool, not OS commands)
keytool -delete -alias http2test -keystore spring-rsa-test.p12 -storepass ziligengsheng

IV. Common Certificate Authorities

Domestic: According to Baidu Encyclopedia, there are approximately 50 licensed CAs in China, with certifications issued by the Ministry of Industry and Information Technology.

International: Examples include Symantec SSL, GeoTrust SSL, Comodo SSL, Thawte SSL, and RapidSSL certificates.

Additionally, China also has root certificate authorities such as Shanghai CA:

Recently, Shanghai CA joined the "Commercial Cryptography Certificate Trust Program," initiated by Qianxin Trusted Browser in collaboration with Kylin and UOS operating systems. As one of the first CA vendors certified by Qianxin, Kylin, and UOS, Shanghai CA’s root certificate will be pre-installed in the Qianxin Trusted Browser on these platforms.

When choosing a CA, consider why certain organizations exist, what differentiates them, and how to select appropriately.

V. Digital Certificate Security in China

This is a serious issue that needs attention. When self-reliance becomes necessary, we must evaluate how to resolve this challenge. The government is already taking steps to address it.

VI. Enabling HTTP/2 in Spring Boot 2

Spring Boot leverages underlying containers like Tomcat, which supports HTTP/2 natively starting from version 9.

Reference: Spring Boot HTTP/2 Configurasion

The two primary steps are:

1. Use Oracle JDK's keytool to generate a certificate.
2. Configure Spring Boot accordingly.

Note: This certificate is intended for development environments only and should not be used in production. Certificates are inexpensive — the cost is negligible compared to even basic footwear — so don't skimp.

Test Environment: Windows 11, Spring Boot 2.6.7

The proces is straightforward.

Following the above steps, testing with Firefox yields results as shown in the figure below: