OpenJDK 27 · javax.net.ssl.SSLParameters · APIdia, the JavaDoc alternative

Modifier and Type	Field and Description
private AlgorithmConstraints	algorithmConstraints
private String[]	applicationProtocols
private String[]	cipherSuites
private boolean	enableRetransmissions
private String	identificationAlgorithm
private int	maximumPacketSize
private String[]	namedGroups
private boolean	needClientAuth
private boolean	preferLocalCipherSuites
private String[]	protocols
private String[]	signatureSchemes
private Collection<SNIMatcher>	sniMatchers
private List<SNIServerName>	sniNames
private boolean	wantClientAuth

Access	Constructor and Description
public	SSLParameters() Constructs SSLParameters.
public	SSLParameters(String[] the array of ciphersuites (or null) cipherSuites) Constructs SSLParameters from the specified array of ciphersuites.
public	SSLParameters(String[] the array of ciphersuites (or null) cipherSuites, String[] the array of protocols (or null) protocols) Constructs SSLParameters from the specified array of ciphersuites and protocols.

Method Summary

Modifier and Type	Method and Description
private static String[]	clone(String[] s)
public AlgorithmConstraints	Returns: the cryptographic algorithm constraints, or null if the constraints have not been set getAlgorithmConstraints() Returns the cryptographic algorithm constraints.
public String[]	Returns: a non-null, possibly zero-length array of application protocol `String`s. The array is ordered based on protocol preference, with the first entry being the most preferred. getApplicationProtocols() Returns a prioritized array of application-layer protocol names that can be negotiated over the SSL/TLS/DTLS protocols.
public String[]	Returns: a copy of the array of ciphersuites or null if none have been set. getCipherSuites() Returns a copy of the array of ciphersuites or null if none have been set.
public boolean	Returns: true, if DTLS handshake retransmissions should be enabled getEnableRetransmissions() Returns whether DTLS handshake retransmissions should be enabled.
public String	Returns: the endpoint identification algorithm, or null if none has been set. getEndpointIdentificationAlgorithm() Gets the endpoint identification algorithm.
public int	Returns: the maximum expected network packet size, or `0` if use the implicit size that is automatically specified by the underlying implementation and this object has not been populated by any connection. getMaximumPacketSize() Returns the maximum expected network packet size in bytes for SSL/TLS/DTLS records.
public String[]	Returns: an array of key exchange named group names `Strings` or `null` if none have been set. For non-null returns, this method will return a new array each time it is invoked. The array is ordered based on named group preference, with the first entry being the most preferred. Providers should ignore unknown named group names while establishing the SSL/TLS/DTLS connections. getNamedGroups() Returns a prioritized array of key exchange named groups names that can be used over the SSL/TLS/DTLS protocols.
public boolean	Returns: whether client authentication should be required. getNeedClientAuth() Returns whether client authentication should be required.
public String[]	Returns: a copy of the array of protocols or null if none have been set. getProtocols() Returns a copy of the array of protocols or null if none have been set.
public final List<SNIServerName>	Returns: null or an immutable list of non-null `SNIServerName`s getServerNames() Returns a `List` containing all `SNIServerName`s of the Server Name Indication (SNI) parameter, or null if none has been set.
public String[]	Returns: an array of signature scheme `Strings` or `null` if none have been set. For non-null returns, this method will return a new array each time it is invoked. The array is ordered based on signature scheme preference, with the first entry being the most preferred. Providers should ignore unknown signature scheme names while establishing the SSL/TLS/DTLS connections. getSignatureSchemes() Returns a prioritized array of signature scheme names that can be used over the SSL/TLS/DTLS protocols.
public final Collection<SNIMatcher>	Returns: null or an immutable collection of non-null `SNIMatcher`s getSNIMatchers() Returns a `Collection` containing all `SNIMatcher`s of the Server Name Indication (SNI) parameter, or null if none has been set.
public final boolean	Returns: whether local cipher suites order in `#getCipherSuites` should be honored during SSL/TLS/DTLS handshaking. getUseCipherSuitesOrder() Returns whether the local cipher suites preference should be honored.
public boolean	Returns: whether client authentication should be requested. getWantClientAuth() Returns whether client authentication should be requested.
public void	setAlgorithmConstraints(AlgorithmConstraints the algorithm constraints (or null) constraints) Sets the cryptographic algorithm constraints, which will be used in addition to any configured by the runtime environment.
public void	setApplicationProtocols(String[] an ordered array of application protocols, with `protocols[0]` being the most preferred. If the array is empty (zero-length), protocol indications will not be used. protocols) Sets the prioritized array of application-layer protocol names that can be negotiated over the SSL/TLS/DTLS protocols.
public void	setCipherSuites(String[] the array of ciphersuites (or null). Note that the standard list of cipher suite names may be found in the JSSE Cipher Suite Names section of the Java Security Standard Algorithm Names Specification. Providers may support cipher suite names not found in this list or might not use the recommended name for a certain cipher suite. cipherSuites) Sets the array of ciphersuites.
public void	setEnableRetransmissions(boolean `true` indicates that DTLS handshake retransmissions should be enabled; `false` indicates that DTLS handshake retransmissions should be disabled enableRetransmissions) Sets whether DTLS handshake retransmissions should be enabled.
public void	setEndpointIdentificationAlgorithm(String The standard string name of the endpoint identification algorithm (or null). See the Java Security Standard Algorithm Names document for information about standard algorithm names. algorithm) Sets the endpoint identification algorithm.
public void	setMaximumPacketSize(int the maximum expected network packet size in bytes, or `0` to use the implicit size that is automatically specified by the underlying implementation. maximumPacketSize) Sets the maximum expected network packet size in bytes for SSL/TLS/DTLS records.
public void	setNamedGroups(String[] an ordered array of key exchange named group names with the first entry being the most preferred, or `null`. This method will make a copy of this array. Providers should ignore unknown named group scheme names while establishing the SSL/TLS/DTLS connections. namedGroups) Sets the prioritized array of key exchange named groups names that can be used over the SSL/TLS/DTLS protocols.
public void	setNeedClientAuth(boolean whether client authentication should be required needClientAuth) Sets whether client authentication should be required.
public void	setProtocols(String[] the array of protocols (or null) protocols) Sets the array of protocols.
public final void	setServerNames(List<SNIServerName> the list of desired `SNIServerName`s (or null) serverNames) Sets the desired `SNIServerName`s of the Server Name Indication (SNI) parameter.
public void	setSignatureSchemes(String[] an ordered array of signature scheme names with the first entry being the most preferred, or `null`. This method will make a copy of this array. Providers should ignore unknown signature scheme names while establishing the SSL/TLS/DTLS connections. signatureSchemes) Sets the prioritized array of signature scheme names that can be used over the SSL/TLS/DTLS protocols.
public final void	setSNIMatchers(Collection<SNIMatcher> the collection of `SNIMatcher`s (or null) matchers) Sets the `SNIMatcher`s of the Server Name Indication (SNI) parameter.
public final void	setUseCipherSuitesOrder(boolean whether local cipher suites order in `#getCipherSuites` should be honored during SSL/TLS/DTLS handshaking. honorOrder) Sets whether the local cipher suites preference should be honored.
public void	setWantClientAuth(boolean whether client authentication should be requested wantClientAuth) Sets whether client authentication should be requested.

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

algorithmConstraints	back to summary
private AlgorithmConstraints algorithmConstraints

applicationProtocols	back to summary
private String[] applicationProtocols

cipherSuites	back to summary
private String[] cipherSuites

enableRetransmissions	back to summary
private boolean enableRetransmissions

identificationAlgorithm	back to summary
private String identificationAlgorithm

maximumPacketSize	back to summary
private int maximumPacketSize

namedGroups	back to summary
private String[] namedGroups

needClientAuth	back to summary
private boolean needClientAuth

preferLocalCipherSuites	back to summary
private boolean preferLocalCipherSuites

protocols	back to summary
private String[] protocols

signatureSchemes	back to summary
private String[] signatureSchemes

sniMatchers	back to summary
private Collection<SNIMatcher> sniMatchers

sniNames	back to summary
private List<SNIServerName> sniNames

wantClientAuth	back to summary
private boolean wantClientAuth

SSLParameters	back to summary
public SSLParameters() Constructs SSLParameters. The values of cipherSuites, protocols, cryptographic algorithm constraints, endpoint identification algorithm, signature schemes, server names and server name matchers are set to `null`; useCipherSuitesOrder, wantClientAuth and needClientAuth are set to `false`; enableRetransmissions is set to `true`; maximum network packet size is set to `0`.

SSLParameters	back to summary
public SSLParameters(String[] cipherSuites) Constructs SSLParameters from the specified array of ciphersuites. Calling this constructor is equivalent to calling the no-args constructor followed by `setCipherSuites(cipherSuites);`. Note that the standard list of cipher suite names may be found in the JSSE Cipher Suite Names section of the Java Security Standard Algorithm Names Specification. Providers may support cipher suite names not found in this list. Parameters cipherSuites:String[] the array of ciphersuites (or null) Annotations @SuppressWarnings:this-escape External Specification Java Security Standard Algorithm Names

SSLParameters	back to summary
public SSLParameters(String[] cipherSuites, String[] protocols) Constructs SSLParameters from the specified array of ciphersuites and protocols. Calling this constructor is equivalent to calling the no-args constructor followed by `setCipherSuites(cipherSuites); setProtocols(protocols);`. Note that the standard list of cipher suite names may be found in the JSSE Cipher Suite Names section of the Java Security Standard Algorithm Names Specification. Providers may support cipher suite names not found in this list. Parameters cipherSuites:String[] the array of ciphersuites (or null) protocols:String[] the array of protocols (or null) Annotations @SuppressWarnings:this-escape External Specification Java Security Standard Algorithm Names

Method Detail

clone	back to summary
private static String[] clone(String[] s)

getAlgorithmConstraints back to summary

getAlgorithmConstraints	back to summary
public AlgorithmConstraints getAlgorithmConstraints() Returns the cryptographic algorithm constraints. Returns:AlgorithmConstraints the cryptographic algorithm constraints, or null if the constraints have not been set Since 1.7 See Also `setAlgorithmConstraints(AlgorithmConstraints)`

public AlgorithmConstraints getAlgorithmConstraints()

Returns the cryptographic algorithm constraints.

Returns:AlgorithmConstraints: the cryptographic algorithm constraints, or null if the constraints have not been set
Since: 1.7
See Also: setAlgorithmConstraints(AlgorithmConstraints)

getApplicationProtocols back to summary

getApplicationProtocols	back to summary
public String[] getApplicationProtocols() Returns a prioritized array of application-layer protocol names that can be negotiated over the SSL/TLS/DTLS protocols. The array could be empty (zero-length), in which case protocol indications will not be used. This method will return a new array each time it is invoked. Returns:String[] a non-null, possibly zero-length array of application protocol `String`s. The array is ordered based on protocol preference, with the first entry being the most preferred. Since 9 See Also `setApplicationProtocols`

public String[] getApplicationProtocols()

Returns a prioritized array of application-layer protocol names that can be negotiated over the SSL/TLS/DTLS protocols.

The array could be empty (zero-length), in which case protocol indications will not be used.

This method will return a new array each time it is invoked.

Returns:String[]: a non-null, possibly zero-length array of application protocol Strings. The array is ordered based on protocol preference, with the first entry being the most preferred.
Since: 9
See Also: setApplicationProtocols

getCipherSuites	back to summary
public String[] getCipherSuites() Returns a copy of the array of ciphersuites or null if none have been set. The returned array includes cipher suites from the list of standard cipher suite names in the JSSE Cipher Suite Names section of the Java Security Standard Algorithm Names Specification, and may also include other cipher suites that the provider supports. Returns:String[] a copy of the array of ciphersuites or null if none have been set. External Specification Java Security Standard Algorithm Names

getCipherSuites

back to summary

public String[] getCipherSuites()

Returns a copy of the array of ciphersuites or null if none have been set.

The returned array includes cipher suites from the list of standard cipher suite names in the JSSE Cipher Suite Names section of the Java Security Standard Algorithm Names Specification, and may also include other cipher suites that the provider supports.

Returns:String[]: a copy of the array of ciphersuites or null if none have been set.
External Specification: Java Security Standard Algorithm Names

getEnableRetransmissions back to summary

getEnableRetransmissions	back to summary
public boolean getEnableRetransmissions() Returns whether DTLS handshake retransmissions should be enabled. This method only applies to DTLS. Returns:boolean true, if DTLS handshake retransmissions should be enabled Since 9 See Also `setEnableRetransmissions(boolean)`

public boolean getEnableRetransmissions()

Returns whether DTLS handshake retransmissions should be enabled. This method only applies to DTLS.

Returns:boolean: true, if DTLS handshake retransmissions should be enabled
Since: 9
See Also: setEnableRetransmissions(boolean)

getEndpointIdentificationAlgorithm back to summary

getEndpointIdentificationAlgorithm	back to summary
public String getEndpointIdentificationAlgorithm() Gets the endpoint identification algorithm. Returns:String the endpoint identification algorithm, or null if none has been set. Since 1.7 See Also `X509ExtendedTrustManager`, `setEndpointIdentificationAlgorithm(String)`

public String getEndpointIdentificationAlgorithm()

Gets the endpoint identification algorithm.

Returns:String: the endpoint identification algorithm, or null if none has been set.
Since: 1.7
See Also: X509ExtendedTrustManager, setEndpointIdentificationAlgorithm(String)

getMaximumPacketSize back to summary

getMaximumPacketSize	back to summary
public int getMaximumPacketSize() Returns the maximum expected network packet size in bytes for SSL/TLS/DTLS records. API Note The implicit size may not be a fixed value, especially for a DTLS protocols implementation. Implementation Note For SSL/TLS/DTLS connections, the underlying provider should calculate and specify the implicit value of the maximum expected network packet size if it is not configured explicitly. For any connection populated object, this method should never return `0` so that applications can retrieve the actual implicit size of the underlying implementation. An implementation should attempt to comply with the maximum packet size configuration. However, if the maximum packet size is too small to hold a minimal record, an implementation may try to generate as minimal records as possible. This may cause a generated packet to be larger than the maximum packet size. Returns:int the maximum expected network packet size, or `0` if use the implicit size that is automatically specified by the underlying implementation and this object has not been populated by any connection. Since 9 See Also `setMaximumPacketSize(int)`

public int getMaximumPacketSize()

Returns the maximum expected network packet size in bytes for SSL/TLS/DTLS records.

API Note

The implicit size may not be a fixed value, especially for a DTLS protocols implementation.

Implementation Note

For SSL/TLS/DTLS connections, the underlying provider should calculate and specify the implicit value of the maximum expected network packet size if it is not configured explicitly. For any connection populated object, this method should never return 0 so that applications can retrieve the actual implicit size of the underlying implementation.

An implementation should attempt to comply with the maximum packet size configuration. However, if the maximum packet size is too small to hold a minimal record, an implementation may try to generate as minimal records as possible. This may cause a generated packet to be larger than the maximum packet size.

Returns:int: the maximum expected network packet size, or 0 if use the implicit size that is automatically specified by the underlying implementation and this object has not been populated by any connection.
Since: 9
See Also: setMaximumPacketSize(int)

getNamedGroups back to summary

getNamedGroups	back to summary
public String[] getNamedGroups() Returns a prioritized array of key exchange named groups names that can be used over the SSL/TLS/DTLS protocols. Note that the standard list of key exchange named groups are defined in the Named Groups section of the Java Security Standard Algorithm Names Specification. Providers may support named groups not defined in this list or may not use the recommended name for a certain named group. The set of named groups that will be used over the SSL/TLS/DTLS connections is determined by the returned array of this method and the underlying provider-specific default named groups. If the returned array is `null`, then the underlying provider-specific default named groups will be used over the SSL/TLS/DTLS connections. If the returned array is empty (zero-length), then the named group negotiation mechanism is turned off for SSL/TLS/DTLS protocols, and the connections may not be able to be established if the negotiation mechanism is required by a certain SSL/TLS/DTLS protocol. This parameter will override the underlying provider-specific default name groups. If the returned array is not `null` or empty (zero-length), then the named groups in the returned array will be used over the SSL/TLS/DTLS connections. This parameter will override the underlying provider-specific default named groups. This method returns the most recent value passed to `setNamedGroups` if that method has been called and otherwise returns the default named groups for connection populated objects, or `null` for pre-populated objects. API Note Note that a provider may not have been updated to support this method and in that case may return `null` instead of the default named groups for connection populated objects. Implementation Note The SunJSSE provider supports this method. Implementation Note Note that applications may use the `jdk.tls.namedGroups` system property with the SunJSSE provider to override the provider-specific default named groups. Returns:String[] an array of key exchange named group names `Strings` or `null` if none have been set. For non-null returns, this method will return a new array each time it is invoked. The array is ordered based on named group preference, with the first entry being the most preferred. Providers should ignore unknown named group names while establishing the SSL/TLS/DTLS connections. Since 20 External Specification Java Security Standard Algorithm Names See Also `setNamedGroups`

public String[] getNamedGroups()

Returns a prioritized array of key exchange named groups names that can be used over the SSL/TLS/DTLS protocols.

Note that the standard list of key exchange named groups are defined in the Named Groups section of the Java Security Standard Algorithm Names Specification. Providers may support named groups not defined in this list or may not use the recommended name for a certain named group.

The set of named groups that will be used over the SSL/TLS/DTLS connections is determined by the returned array of this method and the underlying provider-specific default named groups.

If the returned array is null, then the underlying provider-specific default named groups will be used over the SSL/TLS/DTLS connections.

If the returned array is empty (zero-length), then the named group negotiation mechanism is turned off for SSL/TLS/DTLS protocols, and the connections may not be able to be established if the negotiation mechanism is required by a certain SSL/TLS/DTLS protocol. This parameter will override the underlying provider-specific default name groups.

If the returned array is not null or empty (zero-length), then the named groups in the returned array will be used over the SSL/TLS/DTLS connections. This parameter will override the underlying provider-specific default named groups.

This method returns the most recent value passed to setNamedGroups if that method has been called and otherwise returns the default named groups for connection populated objects, or null for pre-populated objects.

API Note

Note that a provider may not have been updated to support this method and in that case may return null instead of the default named groups for connection populated objects.

Implementation Note

The SunJSSE provider supports this method.

Implementation Note

Note that applications may use the jdk.tls.namedGroups system property with the SunJSSE provider to override the provider-specific default named groups.

Returns:String[]: an array of key exchange named group names Strings or null if none have been set. For non-null returns, this method will return a new array each time it is invoked. The array is ordered based on named group preference, with the first entry being the most preferred. Providers should ignore unknown named group names while establishing the SSL/TLS/DTLS connections.
Since: 20
External Specification: Java Security Standard Algorithm Names
See Also: setNamedGroups

getNeedClientAuth	back to summary
public boolean getNeedClientAuth() Returns whether client authentication should be required. Returns:boolean whether client authentication should be required.

getNeedClientAuth

back to summary

public boolean getNeedClientAuth()

Returns whether client authentication should be required.

Returns:boolean: whether client authentication should be required.

getProtocols	back to summary
public String[] getProtocols() Returns a copy of the array of protocols or null if none have been set. Returns:String[] a copy of the array of protocols or null if none have been set.

getProtocols

back to summary

public String[] getProtocols()

Returns a copy of the array of protocols or null if none have been set.

Returns:String[]: a copy of the array of protocols or null if none have been set.

getServerNames back to summary

getServerNames	back to summary
public final List<SNIServerName> getServerNames() Returns a `List` containing all `SNIServerName`s of the Server Name Indication (SNI) parameter, or null if none has been set. This method is only useful to `SSLSocket`s or `SSLEngine`s operating in client mode. For SSL/TLS/DTLS connections, the underlying SSL/TLS/DTLS provider may specify a default value for a certain server name type. In client mode, it is recommended that, by default, providers should include the server name indication whenever the server can be located by a supported server name type. It is recommended that providers initialize default Server Name Indications when creating `SSLSocket`/`SSLEngine`s. In the following examples, the server name may be represented by an instance of `SNIHostName` which has been initialized with the hostname "www.example.com" and type `StandardConstants#SNI_HOST_NAME`. Socket socket = sslSocketFactory.createSocket("www.example.com", 443); or SSLEngine engine = sslContext.createSSLEngine("www.example.com", 443); Returns:List<SNIServerName> null or an immutable list of non-null `SNIServerName`s Since 1.8 See Also `List`, `setServerNames(List)`

public final List<SNIServerName> getServerNames()

Returns a List containing all SNIServerNames of the Server Name Indication (SNI) parameter, or null if none has been set.

This method is only useful to SSLSockets or SSLEngines operating in client mode.

For SSL/TLS/DTLS connections, the underlying SSL/TLS/DTLS provider may specify a default value for a certain server name type. In client mode, it is recommended that, by default, providers should include the server name indication whenever the server can be located by a supported server name type.

It is recommended that providers initialize default Server Name Indications when creating SSLSocket/SSLEngines. In the following examples, the server name may be represented by an instance of SNIHostName which has been initialized with the hostname "www.example.com" and type StandardConstants#SNI_HOST_NAME.

    Socket socket =
        sslSocketFactory.createSocket("www.example.com", 443);

    SSLEngine engine =
        sslContext.createSSLEngine("www.example.com", 443);

Returns:List<SNIServerName>: null or an immutable list of non-null SNIServerNames
Since: 1.8
See Also: List, setServerNames(List)

getSignatureSchemes back to summary

getSignatureSchemes	back to summary
public String[] getSignatureSchemes() Returns a prioritized array of signature scheme names that can be used over the SSL/TLS/DTLS protocols. Note that the standard list of signature scheme names are defined in the Signature Schemes section of the Java Security Standard Algorithm Names Specification. Providers may support signature schemes not defined in this list or may not use the recommended name for a certain signature scheme. The set of signature schemes that will be used over the SSL/TLS/DTLS connections is determined by the returned array of this method and the underlying provider-specific default signature schemes. If the returned array is `null`, then the underlying provider-specific default signature schemes will be used over the SSL/TLS/DTLS connections. If the returned array is empty (zero-length), then the signature scheme negotiation mechanism is turned off for SSL/TLS/DTLS protocols, and the connections may not be able to be established if the negotiation mechanism is required by a certain SSL/TLS/DTLS protocol. This parameter will override the underlying provider-specific default signature schemes. If the returned array is not `null` or empty (zero-length), then the signature schemes in the returned array will be used over the SSL/TLS/DTLS connections. This parameter will override the underlying provider-specific default signature schemes. This method returns the most recent value passed to `setSignatureSchemes` if that method has been called and otherwise returns the default signature schemes for connection populated objects, or `null` for pre-populated objects. API Note Note that a provider may not have been updated to support this method and in that case may return `null` instead of the default signature schemes for connection populated objects. Implementation Note The SunJSSE provider supports this method. Implementation Note Note that applications may use the `jdk.tls.client.SignatureSchemes` and/or `jdk.tls.server.SignatureSchemes` system properties with the SunJSSE provider to override the provider-specific default signature schemes. Returns:String[] an array of signature scheme `Strings` or `null` if none have been set. For non-null returns, this method will return a new array each time it is invoked. The array is ordered based on signature scheme preference, with the first entry being the most preferred. Providers should ignore unknown signature scheme names while establishing the SSL/TLS/DTLS connections. Since 19 External Specification Java Security Standard Algorithm Names See Also `setSignatureSchemes`

public String[] getSignatureSchemes()

Returns a prioritized array of signature scheme names that can be used over the SSL/TLS/DTLS protocols.

Note that the standard list of signature scheme names are defined in the Signature Schemes section of the Java Security Standard Algorithm Names Specification. Providers may support signature schemes not defined in this list or may not use the recommended name for a certain signature scheme.

The set of signature schemes that will be used over the SSL/TLS/DTLS connections is determined by the returned array of this method and the underlying provider-specific default signature schemes.

If the returned array is null, then the underlying provider-specific default signature schemes will be used over the SSL/TLS/DTLS connections.

If the returned array is empty (zero-length), then the signature scheme negotiation mechanism is turned off for SSL/TLS/DTLS protocols, and the connections may not be able to be established if the negotiation mechanism is required by a certain SSL/TLS/DTLS protocol. This parameter will override the underlying provider-specific default signature schemes.

If the returned array is not null or empty (zero-length), then the signature schemes in the returned array will be used over the SSL/TLS/DTLS connections. This parameter will override the underlying provider-specific default signature schemes.

This method returns the most recent value passed to setSignatureSchemes if that method has been called and otherwise returns the default signature schemes for connection populated objects, or null for pre-populated objects.

API Note

Note that a provider may not have been updated to support this method and in that case may return null instead of the default signature schemes for connection populated objects.

Implementation Note

The SunJSSE provider supports this method.

Implementation Note

Note that applications may use the jdk.tls.client.SignatureSchemes and/or jdk.tls.server.SignatureSchemes system properties with the SunJSSE provider to override the provider-specific default signature schemes.

Returns:String[]: an array of signature scheme Strings or null if none have been set. For non-null returns, this method will return a new array each time it is invoked. The array is ordered based on signature scheme preference, with the first entry being the most preferred. Providers should ignore unknown signature scheme names while establishing the SSL/TLS/DTLS connections.
Since: 19
External Specification: Java Security Standard Algorithm Names
See Also: setSignatureSchemes

getSNIMatchers back to summary

getSNIMatchers	back to summary
public final Collection<SNIMatcher> getSNIMatchers() Returns a `Collection` containing all `SNIMatcher`s of the Server Name Indication (SNI) parameter, or null if none has been set. This method is only useful to `SSLSocket`s or `SSLEngine`s operating in server mode. For better interoperability, providers generally will not define default matchers so that by default servers will ignore the SNI extension and continue the handshake. Returns:Collection<SNIMatcher> null or an immutable collection of non-null `SNIMatcher`s Since 1.8 See Also `SNIMatcher`, `setSNIMatchers(Collection)`

public final Collection<SNIMatcher> getSNIMatchers()

Returns a Collection containing all SNIMatchers of the Server Name Indication (SNI) parameter, or null if none has been set.

This method is only useful to SSLSockets or SSLEngines operating in server mode.

For better interoperability, providers generally will not define default matchers so that by default servers will ignore the SNI extension and continue the handshake.

Returns:Collection<SNIMatcher>: null or an immutable collection of non-null SNIMatchers
Since: 1.8
See Also: SNIMatcher, setSNIMatchers(Collection)

getUseCipherSuitesOrder back to summary

getUseCipherSuitesOrder	back to summary
public final boolean getUseCipherSuitesOrder() Returns whether the local cipher suites preference should be honored. Returns:boolean whether local cipher suites order in `#getCipherSuites` should be honored during SSL/TLS/DTLS handshaking. Since 1.8 See Also `setUseCipherSuitesOrder(boolean)`

public final boolean getUseCipherSuitesOrder()

Returns whether the local cipher suites preference should be honored.

Returns:boolean: whether local cipher suites order in #getCipherSuites should be honored during SSL/TLS/DTLS handshaking.
Since: 1.8
See Also: setUseCipherSuitesOrder(boolean)

getWantClientAuth	back to summary
public boolean getWantClientAuth() Returns whether client authentication should be requested. Returns:boolean whether client authentication should be requested.

getWantClientAuth

back to summary

public boolean getWantClientAuth()

Returns whether client authentication should be requested.

Returns:boolean: whether client authentication should be requested.

setAlgorithmConstraints back to summary

setAlgorithmConstraints	back to summary
public void setAlgorithmConstraints(AlgorithmConstraints constraints) Sets the cryptographic algorithm constraints, which will be used in addition to any configured by the runtime environment. If the `constraints` parameter is non-null, every cryptographic algorithm, key and algorithm parameters used in the SSL/TLS/DTLS handshake must be permitted by the constraints. Parameters constraints:AlgorithmConstraints the algorithm constraints (or null) Since 1.7

public void setAlgorithmConstraints(AlgorithmConstraints constraints)

Sets the cryptographic algorithm constraints, which will be used in addition to any configured by the runtime environment.

If the constraints parameter is non-null, every cryptographic algorithm, key and algorithm parameters used in the SSL/TLS/DTLS handshake must be permitted by the constraints.

Parameters

constraints:AlgorithmConstraints: the algorithm constraints (or null)

Since

1.7

setApplicationProtocols back to summary

setApplicationProtocols	back to summary
public void setApplicationProtocols(String[] protocols) Sets the prioritized array of application-layer protocol names that can be negotiated over the SSL/TLS/DTLS protocols. If application-layer protocols are supported by the underlying SSL/TLS implementation, this method configures which values can be negotiated by protocols such as RFC 7301 , the Application Layer Protocol Negotiation (ALPN). If this end of the connection is expected to offer application protocol values, all protocols configured by this method will be sent to the peer. If this end of the connection is expected to select the application protocol value, the `protocols` configured by this method are compared with those sent by the peer. The first matched value becomes the negotiated value. If none of the `protocols` were actually requested by the peer, the underlying protocol will determine what action to take. (For example, ALPN will send a `"no_application_protocol"` alert and terminate the connection.) The `String` values must be presented using the network byte representation expected by the peer. For example, if an ALPN `String` should be exchanged using `UTF-8`, the `String` should be converted to its `byte[]` representation and stored as a byte-oriented `String` before calling this method. For example: // Encode 3 Meetei Mayek letters (HUK, UN, I) using Unicode Escapes // 0xabcd->0xabcf, 2 Unicode bytes/letter. String HUK_UN_I = "\uabcd\uabce\uabcf"; // Convert into UTF-8 encoded bytes (3 bytes/letter) byte[] bytes = HUK_UN_I.getBytes(StandardCharsets.UTF_8); // Preserve octet byte order by using ISO_8859_1 encoding String encodedHukUnI = new String(bytes, StandardCharsets.ISO_8859_1); // Also, encode a two byte RFC 8701 GREASE ALPN value // e.g. 0x0A, 0x1A, 0x2A...0xFA String rfc8701Grease8A = "\u008A\u008A"; // Set the ALPN vlues on the sslSocket. SSLParameters p = sslSocket.getSSLParameters(); p.setApplicationProtocols(new String[] { "h2", "http/1.1", encodedHukUnI, rfc8701Grease8A}); sslSocket.setSSLParameters(p); Implementation Specification This method will make a copy of the `protocols` array. Parameters protocols:String[] an ordered array of application protocols, with `protocols[0]` being the most preferred. If the array is empty (zero-length), protocol indications will not be used. Exceptions IllegalArgumentException: if protocols is null, or if any element in a non-empty array is null or an empty (zero-length) string Since 9 External Specification https://www.rfc-editor.org/info/rfc7301 See Also `getApplicationProtocols`

public void setApplicationProtocols(String[] protocols)

Sets the prioritized array of application-layer protocol names that can be negotiated over the SSL/TLS/DTLS protocols.

If application-layer protocols are supported by the underlying SSL/TLS implementation, this method configures which values can be negotiated by protocols such as RFC 7301 , the Application Layer Protocol Negotiation (ALPN).

If this end of the connection is expected to offer application protocol values, all protocols configured by this method will be sent to the peer.

If this end of the connection is expected to select the application protocol value, the protocols configured by this method are compared with those sent by the peer. The first matched value becomes the negotiated value. If none of the protocols were actually requested by the peer, the underlying protocol will determine what action to take. (For example, ALPN will send a "no_application_protocol" alert and terminate the connection.)

The String values must be presented using the network byte representation expected by the peer. For example, if an ALPN String should be exchanged using UTF-8, the String should be converted to its byte[] representation and stored as a byte-oriented String before calling this method. For example:

    // Encode 3 Meetei Mayek letters (HUK, UN, I) using Unicode Escapes
    //     0xabcd->0xabcf, 2 Unicode bytes/letter.
    String HUK_UN_I =  "\uabcd\uabce\uabcf";

    // Convert into UTF-8 encoded bytes (3 bytes/letter)
    byte[] bytes = HUK_UN_I.getBytes(StandardCharsets.UTF_8);

    // Preserve octet byte order by using ISO_8859_1 encoding
    String encodedHukUnI =
        new String(bytes, StandardCharsets.ISO_8859_1);

    // Also, encode a two byte RFC 8701 GREASE ALPN value
    //     e.g. 0x0A, 0x1A, 0x2A...0xFA
    String rfc8701Grease8A = "\u008A\u008A";

    // Set the ALPN vlues on the sslSocket.
    SSLParameters p = sslSocket.getSSLParameters();
    p.setApplicationProtocols(new String[] {
            "h2", "http/1.1", encodedHukUnI, rfc8701Grease8A});
    sslSocket.setSSLParameters(p);

Implementation Specification

This method will make a copy of the protocols array.

Parameters

protocols:String[]: an ordered array of application protocols, with protocols[0] being the most preferred. If the array is empty (zero-length), protocol indications will not be used.

Exceptions

IllegalArgumentException:: if protocols is null, or if any element in a non-empty array is null or an empty (zero-length) string

Since

External Specification

https://www.rfc-editor.org/info/rfc7301

See Also

getApplicationProtocols

setCipherSuites	back to summary
public void setCipherSuites(String[] cipherSuites) Sets the array of ciphersuites. Parameters cipherSuites:String[] the array of ciphersuites (or null). Note that the standard list of cipher suite names may be found in the JSSE Cipher Suite Names section of the Java Security Standard Algorithm Names Specification. Providers may support cipher suite names not found in this list or might not use the recommended name for a certain cipher suite. External Specification Java Security Standard Algorithm Names

setCipherSuites

back to summary

public void setCipherSuites(String[] cipherSuites)

Sets the array of ciphersuites.

Parameters

cipherSuites:String[]: the array of ciphersuites (or null). Note that the standard list of cipher suite names may be found in the JSSE Cipher Suite Names section of the Java Security Standard Algorithm Names Specification. Providers may support cipher suite names not found in this list or might not use the recommended name for a certain cipher suite.

External Specification

Java Security Standard Algorithm Names

setEnableRetransmissions back to summary

setEnableRetransmissions	back to summary
public void setEnableRetransmissions(boolean enableRetransmissions) Sets whether DTLS handshake retransmissions should be enabled. This method only applies to DTLS. Parameters enableRetransmissions:boolean `true` indicates that DTLS handshake retransmissions should be enabled; `false` indicates that DTLS handshake retransmissions should be disabled Since 9 See Also `getEnableRetransmissions()`

public void setEnableRetransmissions(boolean enableRetransmissions)

Sets whether DTLS handshake retransmissions should be enabled. This method only applies to DTLS.

Parameters

enableRetransmissions:boolean: true indicates that DTLS handshake retransmissions should be enabled; false indicates that DTLS handshake retransmissions should be disabled

Since

See Also

getEnableRetransmissions()

setEndpointIdentificationAlgorithm back to summary

setEndpointIdentificationAlgorithm	back to summary
public void setEndpointIdentificationAlgorithm(String algorithm) Sets the endpoint identification algorithm. If the `algorithm` parameter is non-null or non-empty, the endpoint identification/verification procedures must be handled during SSL/TLS/DTLS handshaking. This is to prevent man-in-the-middle attacks. Parameters algorithm:String The standard string name of the endpoint identification algorithm (or null). See the Java Security Standard Algorithm Names document for information about standard algorithm names. Since 1.7 External Specification Java Security Standard Algorithm Names See Also `X509ExtendedTrustManager`

public void setEndpointIdentificationAlgorithm(String algorithm)

Sets the endpoint identification algorithm.

If the algorithm parameter is non-null or non-empty, the endpoint identification/verification procedures must be handled during SSL/TLS/DTLS handshaking. This is to prevent man-in-the-middle attacks.

Parameters

algorithm:String: The standard string name of the endpoint identification algorithm (or null). See the Java Security Standard Algorithm Names document for information about standard algorithm names.

Since

1.7

External Specification

Java Security Standard Algorithm Names

See Also

X509ExtendedTrustManager

setMaximumPacketSize back to summary

setMaximumPacketSize	back to summary
public void setMaximumPacketSize(int maximumPacketSize) Sets the maximum expected network packet size in bytes for SSL/TLS/DTLS records. API Note It is recommended that if possible, the maximum packet size should not be less than 256 bytes so that small handshake messages, such as HelloVerifyRequests, are not fragmented. Implementation Note If the maximum packet size is too small to hold a minimal record, an implementation may attempt to generate as minimal records as possible. However, this may cause a generated packet to be larger than the maximum packet size. Parameters maximumPacketSize:int the maximum expected network packet size in bytes, or `0` to use the implicit size that is automatically specified by the underlying implementation. Exceptions IllegalArgumentException: if `maximumPacketSize` is negative. Since 9 See Also `getMaximumPacketSize()`

public void setMaximumPacketSize(int maximumPacketSize)

Sets the maximum expected network packet size in bytes for SSL/TLS/DTLS records.

API Note

It is recommended that if possible, the maximum packet size should not be less than 256 bytes so that small handshake messages, such as HelloVerifyRequests, are not fragmented.

Implementation Note

If the maximum packet size is too small to hold a minimal record, an implementation may attempt to generate as minimal records as possible. However, this may cause a generated packet to be larger than the maximum packet size.

Parameters

maximumPacketSize:int: the maximum expected network packet size in bytes, or 0 to use the implicit size that is automatically specified by the underlying implementation.

Exceptions

IllegalArgumentException:: if maximumPacketSize is negative.

Since

See Also

getMaximumPacketSize()

setNamedGroups back to summary

setNamedGroups	back to summary
public void setNamedGroups(String[] namedGroups) Sets the prioritized array of key exchange named groups names that can be used over the SSL/TLS/DTLS protocols. Note that the standard list of key exchange named groups are defined in the Named Groups section of the Java Security Standard Algorithm Names Specification. Providers may support named groups not defined in this list or may not use the recommended name for a certain named group. The set of named groups that will be used over the SSL/TLS/DTLS connections is determined by the input parameter `namedGroups` array and the underlying provider-specific default named groups. See `getNamedGroups` for specific details on how the parameters are used in SSL/TLS/DTLS connections. API Note Note that a provider may not have been updated to support this method and in that case may ignore the named groups that are set. Implementation Note The SunJSSE provider supports this method. Parameters namedGroups:String[] an ordered array of key exchange named group names with the first entry being the most preferred, or `null`. This method will make a copy of this array. Providers should ignore unknown named group scheme names while establishing the SSL/TLS/DTLS connections. Exceptions IllegalArgumentException: if any element in the `namedGroups` array is a duplicate, `null` or blank. Since 20 External Specification Java Security Standard Algorithm Names See Also `getNamedGroups`

public void setNamedGroups(String[] namedGroups)

Sets the prioritized array of key exchange named groups names that can be used over the SSL/TLS/DTLS protocols.

The set of named groups that will be used over the SSL/TLS/DTLS connections is determined by the input parameter namedGroups array and the underlying provider-specific default named groups. See getNamedGroups for specific details on how the parameters are used in SSL/TLS/DTLS connections.

API Note

Note that a provider may not have been updated to support this method and in that case may ignore the named groups that are set.

Implementation Note

The SunJSSE provider supports this method.

Parameters

namedGroups:String[]: an ordered array of key exchange named group names with the first entry being the most preferred, or null. This method will make a copy of this array. Providers should ignore unknown named group scheme names while establishing the SSL/TLS/DTLS connections.

Exceptions

IllegalArgumentException:: if any element in the namedGroups array is a duplicate, null or blank.

Since

External Specification

Java Security Standard Algorithm Names

See Also

getNamedGroups

setNeedClientAuth back to summary

setNeedClientAuth	back to summary
public void setNeedClientAuth(boolean needClientAuth) Sets whether client authentication should be required. Calling this method clears the `wantClientAuth` flag. Parameters needClientAuth:boolean whether client authentication should be required

public void setNeedClientAuth(boolean needClientAuth)

Sets whether client authentication should be required. Calling this method clears the wantClientAuth flag.

Parameters

needClientAuth:boolean: whether client authentication should be required

setProtocols	back to summary
public void setProtocols(String[] protocols) Sets the array of protocols. Parameters protocols:String[] the array of protocols (or null)

setProtocols

back to summary

public void setProtocols(String[] protocols)

Sets the array of protocols.

Parameters

protocols:String[]: the array of protocols (or null)

setServerNames back to summary

setServerNames	back to summary
public final void setServerNames(List<SNIServerName> serverNames) Sets the desired `SNIServerName`s of the Server Name Indication (SNI) parameter. This method is only useful to `SSLSocket`s or `SSLEngine`s operating in client mode. Note that the `serverNames` list is cloned to protect against subsequent modification. Parameters serverNames:List<SNIServerName> the list of desired `SNIServerName`s (or null) Exceptions NullPointerException: if the `serverNames` contains `null` element IllegalArgumentException: if the `serverNames` contains more than one name of the same name type Since 1.8 See Also `SNIServerName`, `getServerNames()`

public final void setServerNames(List<SNIServerName> serverNames)

Sets the desired SNIServerNames of the Server Name Indication (SNI) parameter.

This method is only useful to SSLSockets or SSLEngines operating in client mode.

Note that the serverNames list is cloned to protect against subsequent modification.

Parameters

serverNames:List<SNIServerName>: the list of desired SNIServerNames (or null)

Exceptions

NullPointerException:: if the serverNames contains null element
IllegalArgumentException:: if the serverNames contains more than one name of the same name type

Since

1.8

See Also

SNIServerName, getServerNames()

setSignatureSchemes back to summary

setSignatureSchemes	back to summary
public void setSignatureSchemes(String[] signatureSchemes) Sets the prioritized array of signature scheme names that can be used over the SSL/TLS/DTLS protocols. Note that the standard list of signature scheme names are defined in the Signature Schemes section of the Java Security Standard Algorithm Names Specification. Providers may support signature schemes not defined in this list or may not use the recommended name for a certain signature scheme. The set of signature schemes that will be used over the SSL/TLS/DTLS connections is determined by the input parameter `signatureSchemes` array and the underlying provider-specific default signature schemes. See `getSignatureSchemes` for specific details on how the parameters are used in SSL/TLS/DTLS connections. API Note Note that a provider may not have been updated to support this method and in that case may ignore the schemes that are set. Implementation Note The SunJSSE provider supports this method. Parameters signatureSchemes:String[] an ordered array of signature scheme names with the first entry being the most preferred, or `null`. This method will make a copy of this array. Providers should ignore unknown signature scheme names while establishing the SSL/TLS/DTLS connections. Exceptions IllegalArgumentException: if any element in the `signatureSchemes` array is `null` or blank. Since 19 External Specification Java Security Standard Algorithm Names See Also `getSignatureSchemes`

public void setSignatureSchemes(String[] signatureSchemes)

Sets the prioritized array of signature scheme names that can be used over the SSL/TLS/DTLS protocols.

The set of signature schemes that will be used over the SSL/TLS/DTLS connections is determined by the input parameter signatureSchemes array and the underlying provider-specific default signature schemes. See getSignatureSchemes for specific details on how the parameters are used in SSL/TLS/DTLS connections.

API Note

Note that a provider may not have been updated to support this method and in that case may ignore the schemes that are set.

Implementation Note

The SunJSSE provider supports this method.

Parameters

signatureSchemes:String[]: an ordered array of signature scheme names with the first entry being the most preferred, or null. This method will make a copy of this array. Providers should ignore unknown signature scheme names while establishing the SSL/TLS/DTLS connections.

Exceptions

IllegalArgumentException:: if any element in the signatureSchemes array is null or blank.

Since

External Specification

Java Security Standard Algorithm Names

See Also

getSignatureSchemes

setSNIMatchers back to summary

setSNIMatchers	back to summary
public final void setSNIMatchers(Collection<SNIMatcher> matchers) Sets the `SNIMatcher`s of the Server Name Indication (SNI) parameter. This method is only useful to `SSLSocket`s or `SSLEngine`s operating in server mode. Note that the `matchers` collection is cloned to protect against subsequent modification. Parameters matchers:Collection<SNIMatcher> the collection of `SNIMatcher`s (or null) Exceptions NullPointerException: if the `matchers` contains `null` element IllegalArgumentException: if the `matchers` contains more than one name of the same name type Since 1.8 See Also `Collection`, `SNIMatcher`, `getSNIMatchers()`

public final void setSNIMatchers(Collection<SNIMatcher> matchers)

Sets the SNIMatchers of the Server Name Indication (SNI) parameter.

This method is only useful to SSLSockets or SSLEngines operating in server mode.

Note that the matchers collection is cloned to protect against subsequent modification.

Parameters

matchers:Collection<SNIMatcher>: the collection of SNIMatchers (or null)

Exceptions

NullPointerException:: if the matchers contains null element
IllegalArgumentException:: if the matchers contains more than one name of the same name type

Since

1.8

setUseCipherSuitesOrder back to summary

setUseCipherSuitesOrder	back to summary
public final void setUseCipherSuitesOrder(boolean honorOrder) Sets whether the local cipher suites preference should be honored. Parameters honorOrder:boolean whether local cipher suites order in `#getCipherSuites` should be honored during SSL/TLS/DTLS handshaking. Since 1.8 See Also `getUseCipherSuitesOrder()`

public final void setUseCipherSuitesOrder(boolean honorOrder)

Sets whether the local cipher suites preference should be honored.

Parameters

honorOrder:boolean: whether local cipher suites order in #getCipherSuites should be honored during SSL/TLS/DTLS handshaking.

Since

1.8

See Also

getUseCipherSuitesOrder()

setWantClientAuth back to summary

setWantClientAuth	back to summary
public void setWantClientAuth(boolean wantClientAuth) Sets whether client authentication should be requested. Calling this method clears the `needClientAuth` flag. Parameters wantClientAuth:boolean whether client authentication should be requested

public void setWantClientAuth(boolean wantClientAuth)

Sets whether client authentication should be requested. Calling this method clears the needClientAuth flag.

Parameters

wantClientAuth:boolean: whether client authentication should be requested

public Class SSLParameters

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail