javademos/http3/src/Tls.java

import java.io.FileInputStream;
import java.net.http.HttpClient;
import java.security.KeyStore;
import java.security.cert.CertificateFactory;
import javax.net.ssl.SSLContext;
import javax.net.ssl.TrustManagerFactory;

/** Trusts only the self-signed test certificate in certs/cert.pem (made by server/make-cert.sh). */
final class Tls {
    static SSLContext context() throws Exception {
        KeyStore ks = KeyStore.getInstance("PKCS12");
        ks.load(null);
        try (var in = new FileInputStream("certs/cert.pem")) {
            ks.setCertificateEntry("test", CertificateFactory.getInstance("X.509").generateCertificate(in));
        }
        TrustManagerFactory tmf = TrustManagerFactory.getInstance("PKIX");
        tmf.init(ks);
        SSLContext ctx = SSLContext.getInstance("TLS");
        ctx.init(null, tmf.getTrustManagers(), null);
        return ctx;
    }

    static HttpClient.Builder builder() throws Exception {
        return HttpClient.newBuilder().sslContext(context());
    }
}