Modifier and Type	Class and Description
public static class	TlsChannelCredentials.Builder Builder for `TlsChannelCredentials`.
public static enum	TlsChannelCredentials.Feature Features to understand TLS configuration.

Modifier and Type	Field and Description
private final byte[]	certificateChain
private final boolean	fakeFeature
private final List<KeyManager>	keyManagers
private final byte[]	privateKey
private final String	privateKeyPassword
private final byte[]	rootCertificates
private final List<TrustManager>	trustManagers

Access	Constructor and Description
pack-priv	TlsChannelCredentials(TlsChannelCredentials.Builder builder)

Method Summary

Modifier and Type	Method and Description
public static ChannelCredentials	create() Use TLS with its defaults.
public byte[]	getCertificateChain() The certificate chain for the client's identity, as a new byte array.
public List<KeyManager>	getKeyManagers() Returns the key manager list which provides the client's identity.
public byte[]	getPrivateKey() The private key for the client's identity, as a new byte array.
public String	getPrivateKeyPassword() Returns the password to decrypt the private key, or `null` if unencrypted.
public byte[]	getRootCertificates() Root trust certificates for verifying the server's identity that override the system's defaults.
public List<TrustManager>	getTrustManagers() Returns the trust manager list which verifies the server's identity.
public Set<TlsChannelCredentials.Feature>	Returns: empty set if the caller can adequately understand the configuration incomprehensible(Set<TlsChannelCredentials.Feature> the features understood by the caller understoodFeatures) Returns an empty set if this credential can be adequately understood via the features listed, otherwise returns a hint of features that are lacking to understand the configuration to be used for manual debugging.
public static TlsChannelCredentials.Builder	newBuilder() Creates a builder for changing default configuration.
private static void	requiredFeature(Set<TlsChannelCredentials.Feature> understoodFeatures, Set<TlsChannelCredentials.Feature> incomprehensible, TlsChannelCredentials.Feature feature)
public ChannelCredentials	withoutBearerTokens() Implements abstract io.grpc.ChannelCredentials.withoutBearerTokens. Returns the ChannelCredentials stripped of its CallCredentials.

certificateChain	back to summary
private final byte[] certificateChain

fakeFeature	back to summary
private final boolean fakeFeature

keyManagers	back to summary
private final List<KeyManager> keyManagers

privateKey	back to summary
private final byte[] privateKey

privateKeyPassword	back to summary
private final String privateKeyPassword

rootCertificates	back to summary
private final byte[] rootCertificates

trustManagers	back to summary
private final List<TrustManager> trustManagers

TlsChannelCredentials	back to summary
pack-priv TlsChannelCredentials(TlsChannelCredentials.Builder builder)

Method Detail

create	back to summary
public static ChannelCredentials create() Use TLS with its defaults.

getCertificateChain	back to summary
public byte[] getCertificateChain() The certificate chain for the client's identity, as a new byte array. Generally should be PEM-encoded. If `null`, some feature is providing key manager information via a different method or no client identity is available.

getKeyManagers	back to summary
public List<KeyManager> getKeyManagers() Returns the key manager list which provides the client's identity. Entries are scanned checking for specific types, like `javax.net.ssl.X509KeyManager`. Only a single entry for a type is used. Entries earlier in the list are higher priority. If `null`, key manager information is provided via a different method or no client identity is available.

getPrivateKey	back to summary
public byte[] getPrivateKey() The private key for the client's identity, as a new byte array. Generally should be in PKCS#8 format. If encrypted, `getPrivateKeyPassword` is the decryption key. If unencrypted, the password will be `null`. If `null`, some feature is providing key manager information via a different method or no client identity is available.

getPrivateKeyPassword	back to summary
public String getPrivateKeyPassword() Returns the password to decrypt the private key, or `null` if unencrypted.

getRootCertificates	back to summary
public byte[] getRootCertificates() Root trust certificates for verifying the server's identity that override the system's defaults. Generally PEM-encoded with multiple certificates concatenated.

getTrustManagers	back to summary
public List<TrustManager> getTrustManagers() Returns the trust manager list which verifies the server's identity. Entries are scanned checking for specific types, like `javax.net.ssl.X509TrustManager`. Only a single entry for a type is used. Entries earlier in the list are higher priority. If `null`, trust manager information is provided via the system's default or a different method.

incomprehensible back to summary

incomprehensible	back to summary
public Set<TlsChannelCredentials.Feature> incomprehensible(Set<TlsChannelCredentials.Feature> understoodFeatures) Returns an empty set if this credential can be adequately understood via the features listed, otherwise returns a hint of features that are lacking to understand the configuration to be used for manual debugging. An "understood" feature does not imply the caller is able to fully handle the feature. It simply means the caller understands the feature enough to use the appropriate APIs to read the configuration. The caller may support just a subset of a feature, in which case the caller would need to look at the configuration to determine if only the supported subset is used. This method may not be as simple as a set difference. There may be multiple features that can independently satisfy a piece of configuration. If the configuration is incomprehensible, all such features would be returned, even though only one may be necessary. An empty set does not imply that the credentials are fully understood. There may be optional configuration that can be ignored if not understood. Since `Feature` is an `enum`, `understoodFeatures` should generally be an `java.util.EnumSet`. `understoodFeatures` will not be modified. Parameters understoodFeatures:Set<TlsChannelCredentials.Feature> the features understood by the caller Returns:Set<TlsChannelCredentials.Feature> empty set if the caller can adequately understand the configuration

public Set<TlsChannelCredentials.Feature> incomprehensible(Set<TlsChannelCredentials.Feature> understoodFeatures)

Returns an empty set if this credential can be adequately understood via the features listed, otherwise returns a hint of features that are lacking to understand the configuration to be used for manual debugging.

An "understood" feature does not imply the caller is able to fully handle the feature. It simply means the caller understands the feature enough to use the appropriate APIs to read the configuration. The caller may support just a subset of a feature, in which case the caller would need to look at the configuration to determine if only the supported subset is used.

This method may not be as simple as a set difference. There may be multiple features that can independently satisfy a piece of configuration. If the configuration is incomprehensible, all such features would be returned, even though only one may be necessary.

An empty set does not imply that the credentials are fully understood. There may be optional configuration that can be ignored if not understood.

Since Feature is an enum, understoodFeatures should generally be an java.util.EnumSet. understoodFeatures will not be modified.

Parameters

understoodFeatures:Set<TlsChannelCredentials.Feature>: the features understood by the caller

Returns:Set<TlsChannelCredentials.Feature>

empty set if the caller can adequately understand the configuration

newBuilder	back to summary
public static TlsChannelCredentials.Builder newBuilder() Creates a builder for changing default configuration.

requiredFeature	back to summary
private static void requiredFeature(Set<TlsChannelCredentials.Feature> understoodFeatures, Set<TlsChannelCredentials.Feature> incomprehensible, TlsChannelCredentials.Feature feature)

withoutBearerTokens	back to summary
public ChannelCredentials withoutBearerTokens() Implements abstract io.grpc.ChannelCredentials.withoutBearerTokens. Doc from io.grpc.ChannelCredentials.withoutBearerTokens. Returns the ChannelCredentials stripped of its CallCredentials. In the future, this may strip only some of the CallCredentials, preserving call credentials that are safe from replay attacks (e.g., if the token is bound to the channel's certificate). Annotations @Override

withoutBearerTokens

back to summary

public ChannelCredentials withoutBearerTokens()

Implements abstract io.grpc.ChannelCredentials.withoutBearerTokens.

Doc from io.grpc.ChannelCredentials.withoutBearerTokens.

Returns the ChannelCredentials stripped of its CallCredentials. In the future, this may strip only some of the CallCredentials, preserving call credentials that are safe from replay attacks (e.g., if the token is bound to the channel's certificate).

Annotations

@Override

io.grpc back to summary

public final Class TlsChannelCredentials.Builder

Class Inheritance

extends Object

java.lang.Object
io.grpc.TlsChannelCredentials.Builder

Builder for TlsChannelCredentials.

Field Summary

Modifier and Type	Field and Description
private byte[]	certificateChain
private boolean	fakeFeature
private List<KeyManager>	keyManagers
private byte[]	privateKey
private String	privateKeyPassword
private byte[]	rootCertificates
private List<TrustManager>	trustManagers

Constructor Summary

Access	Constructor and Description
private	Builder()

Method Summary

Modifier and Type	Method and Description
public ChannelCredentials	build() Construct the credentials.
private void	clearKeyManagers()
private void	clearTrustManagers()
public TlsChannelCredentials.Builder	keyManager(File certChain, File privateKey) Use the provided certificate chain and private key as the client's identity.
public TlsChannelCredentials.Builder	keyManager(File certChain, File privateKey, String privateKeyPassword) Use the provided certificate chain and possibly-encrypted private key as the client's identity.
public TlsChannelCredentials.Builder	keyManager(InputStream certChain, InputStream privateKey) Use the provided certificate chain and private key as the client's identity.
public TlsChannelCredentials.Builder	keyManager(InputStream certChain, InputStream privateKey, String privateKeyPassword) Use the provided certificate chain and possibly-encrypted private key as the client's identity.
public TlsChannelCredentials.Builder	keyManager(KeyManager... keyManagers) Have the provided key manager select the client's identity.
public TlsChannelCredentials.Builder	requireFakeFeature() Requires `Feature#FAKE` to be understood.
public TlsChannelCredentials.Builder	trustManager(File rootCerts) Use the provided root certificates to verify the server's identity instead of the system's default.
public TlsChannelCredentials.Builder	trustManager(InputStream rootCerts) Use the provided root certificates to verify the server's identity instead of the system's default.
public TlsChannelCredentials.Builder	trustManager(TrustManager... trustManagers) Have the provided trust manager verify the server's identity instead of the system's default.

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

Field Detail

certificateChain	back to summary
private byte[] certificateChain

fakeFeature	back to summary
private boolean fakeFeature

keyManagers	back to summary
private List<KeyManager> keyManagers

privateKey	back to summary
private byte[] privateKey

privateKeyPassword	back to summary
private String privateKeyPassword

rootCertificates	back to summary
private byte[] rootCertificates

trustManagers	back to summary
private List<TrustManager> trustManagers

Constructor Detail

Builder	back to summary
private Builder()

Method Detail

build	back to summary
public ChannelCredentials build() Construct the credentials.

clearKeyManagers	back to summary
private void clearKeyManagers()

clearTrustManagers	back to summary
private void clearTrustManagers()

keyManager	back to summary
public TlsChannelCredentials.Builder keyManager(File certChain, File privateKey) throws IOException Use the provided certificate chain and private key as the client's identity. Generally they should be PEM-encoded and the key is an unencrypted PKCS#8 key (file headers have "BEGIN CERTIFICATE" and "BEGIN PRIVATE KEY").

keyManager	back to summary
public TlsChannelCredentials.Builder keyManager(File certChain, File privateKey, String privateKeyPassword) throws IOException Use the provided certificate chain and possibly-encrypted private key as the client's identity. Generally they should be PEM-encoded and the key is a PKCS#8 key. If the private key is unencrypted, then password must be `null`.

keyManager	back to summary
public TlsChannelCredentials.Builder keyManager(InputStream certChain, InputStream privateKey) throws IOException Use the provided certificate chain and private key as the client's identity. Generally they should be PEM-encoded and the key is an unencrypted PKCS#8 key (file headers have "BEGIN CERTIFICATE" and "BEGIN PRIVATE KEY").

keyManager	back to summary
public TlsChannelCredentials.Builder keyManager(InputStream certChain, InputStream privateKey, String privateKeyPassword) throws IOException Use the provided certificate chain and possibly-encrypted private key as the client's identity. Generally they should be PEM-encoded and the key is a PKCS#8 key. If the private key is unencrypted, then password must be `null`.

keyManager	back to summary
public TlsChannelCredentials.Builder keyManager(KeyManager... keyManagers) Have the provided key manager select the client's identity. Although multiple are allowed, only the first instance implementing a particular interface is used. So generally there will just be a single entry and it implements `javax.net.ssl.X509KeyManager`.

requireFakeFeature	back to summary
public TlsChannelCredentials.Builder requireFakeFeature() Requires `Feature#FAKE` to be understood. For use in testing consumers of this credential.

trustManager	back to summary
public TlsChannelCredentials.Builder trustManager(File rootCerts) throws IOException Use the provided root certificates to verify the server's identity instead of the system's default. Generally they should be PEM-encoded with all the certificates concatenated together (file header has "BEGIN CERTIFICATE", and would occur once per certificate).

trustManager	back to summary
public TlsChannelCredentials.Builder trustManager(InputStream rootCerts) throws IOException Use the provided root certificates to verify the server's identity instead of the system's default. Generally they should be PEM-encoded with all the certificates concatenated together (file header has "BEGIN CERTIFICATE", and would occur once per certificate).

trustManager	back to summary
public TlsChannelCredentials.Builder trustManager(TrustManager... trustManagers) Have the provided trust manager verify the server's identity instead of the system's default. Although multiple are allowed, only the first instance implementing a particular interface is used. So generally there will just be a single entry and it implements `javax.net.ssl.X509TrustManager`.

io.grpc back to summary

public final Enum TlsChannelCredentials.Feature

Class Inheritance

extends Enum<TlsChannelCredentials.Feature>

java.lang.Object
java.lang.Enum
io.grpc.TlsChannelCredentials.Feature

Features to understand TLS configuration. Additional enum values may be added in the future.

Field Summary

Modifier and Type	Field and Description
public static final TlsChannelCredentials.Feature	CUSTOM_MANAGERS Key managers and trust managers may be specified as `KeyManager` and `TrustManager` objects.
public static final TlsChannelCredentials.Feature	FAKE A feature that no consumer should understand.
public static final TlsChannelCredentials.Feature	MTLS Client identity may be provided and server verification can be tuned.

Constructor Summary

Access	Constructor and Description
private	Feature()

Method Summary

Modifier and Type	Method and Description
public static TlsChannelCredentials.Feature	valueOf(String name)
public static TlsChannelCredentials.Feature[]	values()

Inherited from java.lang.Enum:: clone compareTo describeConstable equals finalize getDeclaringClass hashCode name ordinal toString valueOf

Field Detail

CUSTOM_MANAGERS back to summary

CUSTOM_MANAGERS	back to summary
public static final TlsChannelCredentials.Feature CUSTOM_MANAGERS Key managers and trust managers may be specified as `KeyManager` and `TrustManager` objects. This feature requires observing `getKeyManagers()` and `getTrustManagers()`. Generally `MTLS` should also be supported, as that is the more common method of configuration. When a manager is non-`null`, then it is wholly responsible for key or trust material and usage; there is no need to check other manager sources like `getCertificateChain()` or `getPrivateKey()` (if `KeyManager` is available), or `getRootCertificates()` (if `TrustManager` is available). If other manager sources are available (e.g., `getPrivateKey() != null`), then they may be alternative representations of the same configuration and the consumer is free to use those alternative representations if it prefers. But before doing so it must first check that it understands that alternative representation by using `incomprehensible` without the `CUSTOM_MANAGERS` feature.

public static final TlsChannelCredentials.Feature CUSTOM_MANAGERS

Key managers and trust managers may be specified as KeyManager and TrustManager objects. This feature requires observing getKeyManagers() and getTrustManagers(). Generally MTLS should also be supported, as that is the more common method of configuration. When a manager is non-null, then it is wholly responsible for key or trust material and usage; there is no need to check other manager sources like getCertificateChain() or getPrivateKey() (if KeyManager is available), or getRootCertificates() (if TrustManager is available).

If other manager sources are available (e.g., getPrivateKey() != null), then they may be alternative representations of the same configuration and the consumer is free to use those alternative representations if it prefers. But before doing so it must first check that it understands that alternative representation by using incomprehensible without the CUSTOM_MANAGERS feature.

FAKE	back to summary
public static final TlsChannelCredentials.Feature FAKE A feature that no consumer should understand. It should be used for unit testing to confirm a call to `incomprehensible()` is implemented properly.

MTLS back to summary

public static final TlsChannelCredentials.Feature MTLS

Client identity may be provided and server verification can be tuned. This feature requires observing getCertificateChain, getPrivateKey, and getPrivateKeyPassword as well as getRootCertificates(). The certificate chain and private key are used to configure a key manager to provide the client's identity. If no certificate chain and private key are provided the client will have no identity. The root certificates are used to configure a trust manager for verifying the server's identity. If no root certificates are provided the trust manager will default to the system's root certificates.

Constructor Detail

Feature	back to summary
private Feature()

Method Detail

valueOf	back to summary
public static TlsChannelCredentials.Feature valueOf(String name)

values	back to summary
public static TlsChannelCredentials.Feature[] values()

public final Class TlsChannelCredentials

Nested and Inner Type Summary

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail

public final Class TlsChannelCredentials.Builder

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail

public final Enum TlsChannelCredentials.Feature

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail