APIdia Launch Partner
Top Description Inners Fields Constructors Methods
sun.security.ssl

pack-priv final Class X509KeyManagerImpl

extends X509KeyManagerCertChecking
Class Inheritance
Imports
java.lang.ref.*, java.net.Socket, java.security.AlgorithmConstraints, .KeyStore, .KeyStore.Builder, .KeyStore.Entry, .KeyStore.PrivateKeyEntry, .KeyStoreException, .NoSuchAlgorithmException, .Principal, .PrivateKey, .UnrecoverableEntryException, java.security.cert.X509Certificate, java.util.*, java.util.concurrent.atomic.AtomicLong, javax.net.ssl.*, javax.security.auth.x500.X500Principal
The new X509 key manager implementation. The main differences to the old SunX509 key manager are: . it is based around the KeyStore.Builder API. This allows it to use other forms of KeyStore protection or password input (e.g. a CallbackHandler) or to have keys within one KeyStore protected by different keys. . it can use multiple KeyStores at the same time. . it is explicitly designed to accommodate KeyStores that change over the lifetime of the process. . it makes an effort to choose the key that matches best, i.e. one that is not expired and has the appropriate certificate extensions. Note that this code is not explicitly performance optimized yet.
Author
Andreas Sterbenz

Nested and Inner Type Summary

Modifier and TypeClass and Description
private static class
X509KeyManagerImpl.SizedMap<K, V>

Field Summary

Modifier and TypeField and Description
private final List<KeyStore.Builder>
builders

private final Map<String, Reference<KeyStore.PrivateKeyEntry>>
entryCacheMap

private final AtomicLong
uidCounter

private static Date
verificationDate

Constructor Summary

AccessConstructor and Description
pack-priv
X509KeyManagerImpl(KeyStore.Builder builder)

pack-priv
X509KeyManagerImpl(List<KeyStore.Builder> builders)

Method Summary

Modifier and TypeMethod and Description
private String
chooseAlias(List<X509KeyManagerCertChecking.KeyType> keyTypeList, Principal[] issuers, X509KeyManagerCertChecking.CheckType checkType, AlgorithmConstraints constraints, List<SNIServerName> requestedServerNames, String idAlgorithm)

public String
chooseClientAlias(String[] keyTypes, Principal[] issuers, Socket socket)

Implements javax.net.ssl.X509KeyManager.chooseClientAlias.

Choose an alias to authenticate the client side of a secure socket given the public key type and the list of certificate issuer authorities recognized by the peer (if any).

public String
chooseEngineClientAlias(String[] keyTypes, Principal[] issuers, SSLEngine engine)

Overrides javax.net.ssl.X509ExtendedKeyManager.chooseEngineClientAlias.

Choose an alias to authenticate the client side of an SSLEngine connection given the public key type and the list of certificate issuer authorities recognized by the peer (if any).

public String
chooseEngineServerAlias(String keyType, Principal[] issuers, SSLEngine engine)

Overrides javax.net.ssl.X509ExtendedKeyManager.chooseEngineServerAlias.

Choose an alias to authenticate the server side of an SSLEngine connection given the public key type and the list of certificate issuer authorities recognized by the peer (if any).

pack-priv String
chooseQuicClientAlias(String[] keyTypes, Principal[] issuers, QuicTLSEngineImpl quicTLSEngine)

Implements abstract sun.security.ssl.X509KeyManagerCertChecking.chooseQuicClientAlias.

pack-priv String
chooseQuicServerAlias(String keyType, X500Principal[] issuers, QuicTLSEngineImpl quicTLSEngine)

Implements abstract sun.security.ssl.X509KeyManagerCertChecking.chooseQuicServerAlias.

public String
chooseServerAlias(String keyType, Principal[] issuers, Socket socket)

Implements javax.net.ssl.X509KeyManager.chooseServerAlias.

Choose an alias to authenticate the server side of a secure socket given the public key type and the list of certificate issuer authorities recognized by the peer (if any).

private String[]
getAliases(String keyType, Principal[] issuers, X509KeyManagerCertChecking.CheckType checkType)

private List<X509KeyManagerCertChecking.EntryStatus>
getAliases(int builderIndex, List<X509KeyManagerCertChecking.KeyType> keyTypes, Set<X500Principal> issuerSet, boolean findAll, X509KeyManagerCertChecking.CheckType checkType, AlgorithmConstraints constraints, List<SNIServerName> requestedServerNames, String idAlgorithm)

public X509Certificate[]
getCertificateChain(String alias)

Implements javax.net.ssl.X509KeyManager.getCertificateChain.

Returns the certificate chain associated with the given alias.

public String[]
getClientAliases(String keyType, Principal[] issuers)

Implements javax.net.ssl.X509KeyManager.getClientAliases.

Get the matching aliases for authenticating the client side of a secure socket given the public key type and the list of certificate issuer authorities recognized by the peer (if any).

private KeyStore.PrivateKeyEntry
getEntry(String alias)

public PrivateKey
getPrivateKey(String alias)

Implements javax.net.ssl.X509KeyManager.getPrivateKey.

Returns the key associated with the given alias.

public String[]
getServerAliases(String keyType, Principal[] issuers)

Implements javax.net.ssl.X509KeyManager.getServerAliases.

Get the matching aliases for authenticating the server side of a secure socket given the public key type and the list of certificate issuer authorities recognized by the peer (if any).

protected boolean
isCheckingDisabled()

Implements abstract sun.security.ssl.X509KeyManagerCertChecking.isCheckingDisabled.

private String
makeAlias(X509KeyManagerCertChecking.EntryStatus entry)

private String[]
toAliases(List<X509KeyManagerCertChecking.EntryStatus> results)

Inherited from sun.security.ssl.X509KeyManagerCertChecking:
checkAliasgetAlgorithmConstraintsgetAlgorithmConstraintsgetAlgorithmConstraintsgetIssuerSetgetKeyTypes

Field Detail

buildersback to summary
private final List<KeyStore.Builder> builders
entryCacheMapback to summary
private final Map<String, Reference<KeyStore.PrivateKeyEntry>> entryCacheMap
uidCounterback to summary
private final AtomicLong uidCounter
verificationDateback to summary
private static Date verificationDate

Constructor Detail

X509KeyManagerImplback to summary
pack-priv X509KeyManagerImpl(KeyStore.Builder builder)
X509KeyManagerImplback to summary
pack-priv X509KeyManagerImpl(List<KeyStore.Builder> builders)

Method Detail

chooseAliasback to summary
private String chooseAlias(List<X509KeyManagerCertChecking.KeyType> keyTypeList, Principal[] issuers, X509KeyManagerCertChecking.CheckType checkType, AlgorithmConstraints constraints, List<SNIServerName> requestedServerNames, String idAlgorithm)
chooseClientAliasback to summary
public String chooseClientAlias(String[] keyTypes, Principal[] issuers, Socket socket)

Implements javax.net.ssl.X509KeyManager.chooseClientAlias.

Doc from javax.net.ssl.X509KeyManager.chooseClientAlias.

Choose an alias to authenticate the client side of a secure socket given the public key type and the list of certificate issuer authorities recognized by the peer (if any).

Annotations
@Override
chooseEngineClientAliasback to summary
public String chooseEngineClientAlias(String[] keyTypes, Principal[] issuers, SSLEngine engine)

Overrides javax.net.ssl.X509ExtendedKeyManager.chooseEngineClientAlias.

Doc from javax.net.ssl.X509ExtendedKeyManager.chooseEngineClientAlias.

Choose an alias to authenticate the client side of an SSLEngine connection given the public key type and the list of certificate issuer authorities recognized by the peer (if any).

The default implementation returns null.

Annotations
@Override
chooseEngineServerAliasback to summary
public String chooseEngineServerAlias(String keyType, Principal[] issuers, SSLEngine engine)

Overrides javax.net.ssl.X509ExtendedKeyManager.chooseEngineServerAlias.

Doc from javax.net.ssl.X509ExtendedKeyManager.chooseEngineServerAlias.

Choose an alias to authenticate the server side of an SSLEngine connection given the public key type and the list of certificate issuer authorities recognized by the peer (if any).

The default implementation returns null.

Annotations
@Override
chooseQuicClientAliasback to summary
pack-priv String chooseQuicClientAlias(String[] keyTypes, Principal[] issuers, QuicTLSEngineImpl quicTLSEngine)

Implements abstract sun.security.ssl.X509KeyManagerCertChecking.chooseQuicClientAlias.

Annotations
@Override
chooseQuicServerAliasback to summary
pack-priv String chooseQuicServerAlias(String keyType, X500Principal[] issuers, QuicTLSEngineImpl quicTLSEngine)

Implements abstract sun.security.ssl.X509KeyManagerCertChecking.chooseQuicServerAlias.

Annotations
@Override
chooseServerAliasback to summary
public String chooseServerAlias(String keyType, Principal[] issuers, Socket socket)

Implements javax.net.ssl.X509KeyManager.chooseServerAlias.

Doc from javax.net.ssl.X509KeyManager.chooseServerAlias.

Choose an alias to authenticate the server side of a secure socket given the public key type and the list of certificate issuer authorities recognized by the peer (if any).

Annotations
@Override
getAliasesback to summary
private String[] getAliases(String keyType, Principal[] issuers, X509KeyManagerCertChecking.CheckType checkType)
getAliasesback to summary
private List<X509KeyManagerCertChecking.EntryStatus> getAliases(int builderIndex, List<X509KeyManagerCertChecking.KeyType> keyTypes, Set<X500Principal> issuerSet, boolean findAll, X509KeyManagerCertChecking.CheckType checkType, AlgorithmConstraints constraints, List<SNIServerName> requestedServerNames, String idAlgorithm) throws KeyStoreException
getCertificateChainback to summary
public X509Certificate[] getCertificateChain(String alias)

Implements javax.net.ssl.X509KeyManager.getCertificateChain.

Doc from javax.net.ssl.X509KeyManager.getCertificateChain.

Returns the certificate chain associated with the given alias.

Annotations
@Override
getClientAliasesback to summary
public String[] getClientAliases(String keyType, Principal[] issuers)

Implements javax.net.ssl.X509KeyManager.getClientAliases.

Doc from javax.net.ssl.X509KeyManager.getClientAliases.

Get the matching aliases for authenticating the client side of a secure socket given the public key type and the list of certificate issuer authorities recognized by the peer (if any).

Annotations
@Override
getEntryback to summary
private KeyStore.PrivateKeyEntry getEntry(String alias)
getPrivateKeyback to summary
public PrivateKey getPrivateKey(String alias)

Implements javax.net.ssl.X509KeyManager.getPrivateKey.

Doc from javax.net.ssl.X509KeyManager.getPrivateKey.

Returns the key associated with the given alias.

Annotations
@Override
getServerAliasesback to summary
public String[] getServerAliases(String keyType, Principal[] issuers)

Implements javax.net.ssl.X509KeyManager.getServerAliases.

Doc from javax.net.ssl.X509KeyManager.getServerAliases.

Get the matching aliases for authenticating the server side of a secure socket given the public key type and the list of certificate issuer authorities recognized by the peer (if any).

Annotations
@Override
isCheckingDisabledback to summary
protected boolean isCheckingDisabled()

Implements abstract sun.security.ssl.X509KeyManagerCertChecking.isCheckingDisabled.

Annotations
@Override
makeAliasback to summary
private String makeAlias(X509KeyManagerCertChecking.EntryStatus entry)
toAliasesback to summary
private String[] toAliases(List<X509KeyManagerCertChecking.EntryStatus> results)
sun.security.ssl back to summary

private Class X509KeyManagerImpl.SizedMap<K, V>

extends LinkedHashMap<K, V>
Class Inheritance

Field Summary

Modifier and TypeField and Description
private static final long
serialVersionUID

Hides java.util.LinkedHashMap.serialVersionUID.

Constructor Summary

AccessConstructor and Description
private
SizedMap()

Method Summary

Modifier and TypeMethod and Description
protected boolean
removeEldestEntry(Map.Entry<K, V> eldest)

Overrides java.util.LinkedHashMap.removeEldestEntry.

Returns true if this map should remove its eldest entry.

Inherited from java.util.LinkedHashMap:
clearcontainsValueentrySetforEachgetgetOrDefaultkeySetnewLinkedHashMapputFirstputLastreplaceAllreversedsequencedEntrySetsequencedKeySetsequencedValuesvalues

Field Detail

serialVersionUIDback to summary
private static final long serialVersionUID

Hides java.util.LinkedHashMap.serialVersionUID.

Annotations
@Serial

Constructor Detail

SizedMapback to summary
private SizedMap()

Method Detail

removeEldestEntryback to summary
protected boolean removeEldestEntry(Map.Entry<K, V> eldest)

Overrides java.util.LinkedHashMap.removeEldestEntry.

Doc from java.util.LinkedHashMap.removeEldestEntry.

Returns true if this map should remove its eldest entry. This method is invoked by put and putAll after inserting a new entry into the map. It provides the implementor with the opportunity to remove the eldest entry each time a new one is added. This is useful if the map represents a cache: it allows the map to reduce memory consumption by deleting stale entries.

Sample use: this override will allow the map to grow up to 100 entries and then delete the eldest entry each time a new entry is added, maintaining a steady state of 100 entries. 

    private static final int MAX_ENTRIES = 100;

    protected boolean removeEldestEntry(Map.Entry eldest) {
       return size() > MAX_ENTRIES;
    }

This method typically does not modify the map in any way, instead allowing the map to modify itself as directed by its return value. It is permitted for this method to modify the map directly, but if it does so, it must return false (indicating that the map should not attempt any further modification). The effects of returning true after modifying the map from within this method are unspecified.

This implementation merely returns false (so that this map acts like a normal map - the eldest element is never removed).

Annotations
@Override