Modifier and Type	Class and Description
public static class	TlsServerCredentials.Builder Builder for `TlsServerCredentials`.
public static enum	TlsServerCredentials.ClientAuth The level of authentication the server should expect from the client.
public static enum	TlsServerCredentials.Feature Features to understand TLS configuration.

Modifier and Type	Field and Description
private final byte[]	certificateChain
private final TlsServerCredentials.ClientAuth	clientAuth
private final boolean	fakeFeature
private final List<KeyManager>	keyManagers
private final byte[]	privateKey
private final String	privateKeyPassword
private final byte[]	rootCertificates
private final List<TrustManager>	trustManagers

Access	Constructor and Description
pack-priv	TlsServerCredentials(TlsServerCredentials.Builder builder)

Method Summary

Modifier and Type	Method and Description
public static ServerCredentials	create(File certChain, File privateKey) Creates an instance using provided certificate chain and private key.
public static ServerCredentials	create(InputStream certChain, InputStream privateKey) Creates an instance using provided certificate chain and private key.
public byte[]	getCertificateChain() The certificate chain for the server's identity, as a new byte array.
public TlsServerCredentials.ClientAuth	getClientAuth() Non-`null` setting indicating whether the server should expect a client's identity.
public List<KeyManager>	getKeyManagers() Returns the key manager list which provides the server's identity.
public byte[]	getPrivateKey() The private key for the server's identity, as a new byte array.
public String	getPrivateKeyPassword() Returns the password to decrypt the private key, or `null` if unencrypted.
public byte[]	getRootCertificates() Root trust certificates for verifying the client's identity that override the system's defaults.
public List<TrustManager>	getTrustManagers() Returns the trust manager list which verifies the client's identity.
public Set<TlsServerCredentials.Feature>	Returns: empty set if the caller can adequately understand the configuration incomprehensible(Set<TlsServerCredentials.Feature> the features understood by the caller understoodFeatures) Returns an empty set if this credential can be adequately understood via the features listed, otherwise returns a hint of features that are lacking to understand the configuration to be used for manual debugging.
public static TlsServerCredentials.Builder	newBuilder() Creates a builder for changing default configuration.
private static void	requiredFeature(Set<TlsServerCredentials.Feature> understoodFeatures, Set<TlsServerCredentials.Feature> incomprehensible, TlsServerCredentials.Feature feature)

certificateChain	back to summary
private final byte[] certificateChain

clientAuth	back to summary
private final TlsServerCredentials.ClientAuth clientAuth

fakeFeature	back to summary
private final boolean fakeFeature

keyManagers	back to summary
private final List<KeyManager> keyManagers

privateKey	back to summary
private final byte[] privateKey

privateKeyPassword	back to summary
private final String privateKeyPassword

rootCertificates	back to summary
private final byte[] rootCertificates

trustManagers	back to summary
private final List<TrustManager> trustManagers

TlsServerCredentials	back to summary
pack-priv TlsServerCredentials(TlsServerCredentials.Builder builder)

Method Detail

create	back to summary
public static ServerCredentials create(File certChain, File privateKey) throws IOException Creates an instance using provided certificate chain and private key. Generally they should be PEM-encoded and the key is an unencrypted PKCS#8 key (file headers have "BEGIN CERTIFICATE" and "BEGIN PRIVATE KEY").

create	back to summary
public static ServerCredentials create(InputStream certChain, InputStream privateKey) throws IOException Creates an instance using provided certificate chain and private key. Generally they should be PEM-encoded and the key is an unencrypted PKCS#8 key (file headers have "BEGIN CERTIFICATE" and "BEGIN PRIVATE KEY"). The streams will not be automatically closed.

create

back to summary

public static ServerCredentials create(InputStream certChain, InputStream privateKey) throws IOException

Creates an instance using provided certificate chain and private key. Generally they should be PEM-encoded and the key is an unencrypted PKCS#8 key (file headers have "BEGIN CERTIFICATE" and "BEGIN PRIVATE KEY").

The streams will not be automatically closed.

getCertificateChain	back to summary
public byte[] getCertificateChain() The certificate chain for the server's identity, as a new byte array. Generally should be PEM-encoded. If `null`, some feature is providing key manager information via a different method.

getClientAuth	back to summary
public TlsServerCredentials.ClientAuth getClientAuth() Non-`null` setting indicating whether the server should expect a client's identity.

getKeyManagers	back to summary
public List<KeyManager> getKeyManagers() Returns the key manager list which provides the server's identity. Entries are scanned checking for specific types, like `javax.net.ssl.X509KeyManager`. Only a single entry for a type is used. Entries earlier in the list are higher priority. If `null`, key manager information is provided via a different method.

getPrivateKey	back to summary
public byte[] getPrivateKey() The private key for the server's identity, as a new byte array. Generally should be in PKCS#8 format. If encrypted, `getPrivateKeyPassword` is the decryption key. If unencrypted, the password will be `null`. If `null`, some feature is providing key manager information via a different method.

getPrivateKeyPassword	back to summary
public String getPrivateKeyPassword() Returns the password to decrypt the private key, or `null` if unencrypted.

getRootCertificates	back to summary
public byte[] getRootCertificates() Root trust certificates for verifying the client's identity that override the system's defaults. Generally PEM-encoded with multiple certificates concatenated.

getTrustManagers	back to summary
public List<TrustManager> getTrustManagers() Returns the trust manager list which verifies the client's identity. Entries are scanned checking for specific types, like `javax.net.ssl.X509TrustManager`. Only a single entry for a type is used. Entries earlier in the list are higher priority. If `null`, trust manager information is provided via the system's default or a different method.

incomprehensible back to summary

incomprehensible	back to summary
public Set<TlsServerCredentials.Feature> incomprehensible(Set<TlsServerCredentials.Feature> understoodFeatures) Returns an empty set if this credential can be adequately understood via the features listed, otherwise returns a hint of features that are lacking to understand the configuration to be used for manual debugging. An "understood" feature does not imply the caller is able to fully handle the feature. It simply means the caller understands the feature enough to use the appropriate APIs to read the configuration. The caller may support just a subset of a feature, in which case the caller would need to look at the configuration to determine if only the supported subset is used. This method may not be as simple as a set difference. There may be multiple features that can independently satisfy a piece of configuration. If the configuration is incomprehensible, all such features would be returned, even though only one may be necessary. An empty set does not imply that the credentials are fully understood. There may be optional configuration that can be ignored if not understood. Since `Feature` is an `enum`, `understoodFeatures` should generally be an `java.util.EnumSet`. `understoodFeatures` will not be modified. Parameters understoodFeatures:Set<TlsServerCredentials.Feature> the features understood by the caller Returns:Set<TlsServerCredentials.Feature> empty set if the caller can adequately understand the configuration

public Set<TlsServerCredentials.Feature> incomprehensible(Set<TlsServerCredentials.Feature> understoodFeatures)

Returns an empty set if this credential can be adequately understood via the features listed, otherwise returns a hint of features that are lacking to understand the configuration to be used for manual debugging.

An "understood" feature does not imply the caller is able to fully handle the feature. It simply means the caller understands the feature enough to use the appropriate APIs to read the configuration. The caller may support just a subset of a feature, in which case the caller would need to look at the configuration to determine if only the supported subset is used.

This method may not be as simple as a set difference. There may be multiple features that can independently satisfy a piece of configuration. If the configuration is incomprehensible, all such features would be returned, even though only one may be necessary.

An empty set does not imply that the credentials are fully understood. There may be optional configuration that can be ignored if not understood.

Since Feature is an enum, understoodFeatures should generally be an java.util.EnumSet. understoodFeatures will not be modified.

Parameters

understoodFeatures:Set<TlsServerCredentials.Feature>: the features understood by the caller

Returns:Set<TlsServerCredentials.Feature>

empty set if the caller can adequately understand the configuration

newBuilder	back to summary
public static TlsServerCredentials.Builder newBuilder() Creates a builder for changing default configuration. There is no default key manager, so key material must be specified. The default trust manager uses the system's root certificates. By default no client authentication will occur.

requiredFeature	back to summary
private static void requiredFeature(Set<TlsServerCredentials.Feature> understoodFeatures, Set<TlsServerCredentials.Feature> incomprehensible, TlsServerCredentials.Feature feature)

io.grpc back to summary

public final Class TlsServerCredentials.Builder

Class Inheritance

extends Object

java.lang.Object
io.grpc.TlsServerCredentials.Builder

Builder for TlsServerCredentials.

Field Summary

Modifier and Type	Field and Description
private byte[]	certificateChain
private TlsServerCredentials.ClientAuth	clientAuth
private boolean	fakeFeature
private List<KeyManager>	keyManagers
private byte[]	privateKey
private String	privateKeyPassword
private byte[]	rootCertificates
private List<TrustManager>	trustManagers

Constructor Summary

Access	Constructor and Description
private	Builder()

Method Summary

Modifier and Type	Method and Description
public ServerCredentials	build() Construct the credentials.
private void	clearKeyManagers()
private void	clearTrustManagers()
public TlsServerCredentials.Builder	clientAuth(TlsServerCredentials.ClientAuth clientAuth) Indicates whether the server should expect a client's identity.
public TlsServerCredentials.Builder	keyManager(File certChain, File privateKey) Use the provided certificate chain and private key as the server's identity.
public TlsServerCredentials.Builder	keyManager(File certChain, File privateKey, String privateKeyPassword) Use the provided certificate chain and possibly-encrypted private key as the server's identity.
public TlsServerCredentials.Builder	keyManager(InputStream certChain, InputStream privateKey) Use the provided certificate chain and private key as the server's identity.
public TlsServerCredentials.Builder	keyManager(InputStream certChain, InputStream privateKey, String privateKeyPassword) Use the provided certificate chain and possibly-encrypted private key as the server's identity.
public TlsServerCredentials.Builder	keyManager(KeyManager... keyManagers) Have the provided key manager select the server's identity.
public TlsServerCredentials.Builder	requireFakeFeature() Requires `Feature#FAKE` to be understood.
public TlsServerCredentials.Builder	trustManager(File rootCerts) Use the provided root certificates to verify the client's identity instead of the system's default.
public TlsServerCredentials.Builder	trustManager(InputStream rootCerts) Use the provided root certificates to verify the client's identity instead of the system's default.
public TlsServerCredentials.Builder	trustManager(TrustManager... trustManagers) Have the provided trust manager verify the client's identity instead of the system's default.

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

Field Detail

certificateChain	back to summary
private byte[] certificateChain

clientAuth	back to summary
private TlsServerCredentials.ClientAuth clientAuth

fakeFeature	back to summary
private boolean fakeFeature

keyManagers	back to summary
private List<KeyManager> keyManagers

privateKey	back to summary
private byte[] privateKey

privateKeyPassword	back to summary
private String privateKeyPassword

rootCertificates	back to summary
private byte[] rootCertificates

trustManagers	back to summary
private List<TrustManager> trustManagers

Constructor Detail

Builder	back to summary
private Builder()

Method Detail

build	back to summary
public ServerCredentials build() Construct the credentials.

clearKeyManagers	back to summary
private void clearKeyManagers()

clearTrustManagers	back to summary
private void clearTrustManagers()

clientAuth	back to summary
public TlsServerCredentials.Builder clientAuth(TlsServerCredentials.ClientAuth clientAuth) Indicates whether the server should expect a client's identity. Must not be `null`. Defaults to `ClientAuth#NONE`.

keyManager	back to summary
public TlsServerCredentials.Builder keyManager(File certChain, File privateKey) throws IOException Use the provided certificate chain and private key as the server's identity. Generally they should be PEM-encoded and the key is an unencrypted PKCS#8 key (file headers have "BEGIN CERTIFICATE" and "BEGIN PRIVATE KEY").

keyManager	back to summary
public TlsServerCredentials.Builder keyManager(File certChain, File privateKey, String privateKeyPassword) throws IOException Use the provided certificate chain and possibly-encrypted private key as the server's identity. Generally they should be PEM-encoded and the key is a PKCS#8 key. If the private key is unencrypted, then password must be `null`.

keyManager	back to summary
public TlsServerCredentials.Builder keyManager(InputStream certChain, InputStream privateKey) throws IOException Use the provided certificate chain and private key as the server's identity. Generally they should be PEM-encoded and the key is an unencrypted PKCS#8 key (file headers have "BEGIN CERTIFICATE" and "BEGIN PRIVATE KEY").

keyManager	back to summary
public TlsServerCredentials.Builder keyManager(InputStream certChain, InputStream privateKey, String privateKeyPassword) throws IOException Use the provided certificate chain and possibly-encrypted private key as the server's identity. Generally they should be PEM-encoded and the key is a PKCS#8 key. If the private key is unencrypted, then password must be `null`.

keyManager	back to summary
public TlsServerCredentials.Builder keyManager(KeyManager... keyManagers) Have the provided key manager select the server's identity. Although multiple are allowed, only the first instance implementing a particular interface is used. So generally there will just be a single entry and it implements `javax.net.ssl.X509KeyManager`.

requireFakeFeature	back to summary
public TlsServerCredentials.Builder requireFakeFeature() Requires `Feature#FAKE` to be understood. For use in testing consumers of this credential.

trustManager	back to summary
public TlsServerCredentials.Builder trustManager(File rootCerts) throws IOException Use the provided root certificates to verify the client's identity instead of the system's default. Generally they should be PEM-encoded with all the certificates concatenated together (file header has "BEGIN CERTIFICATE", and would occur once per certificate).

trustManager	back to summary
public TlsServerCredentials.Builder trustManager(InputStream rootCerts) throws IOException Use the provided root certificates to verify the client's identity instead of the system's default. Generally they should be PEM-encoded with all the certificates concatenated together (file header has "BEGIN CERTIFICATE", and would occur once per certificate).

trustManager	back to summary
public TlsServerCredentials.Builder trustManager(TrustManager... trustManagers) Have the provided trust manager verify the client's identity instead of the system's default. Although multiple are allowed, only the first instance implementing a particular interface is used. So generally there will just be a single entry and it implements `javax.net.ssl.X509TrustManager`.

io.grpc back to summary

public final Enum TlsServerCredentials.ClientAuth

Class Inheritance

extends Enum<TlsServerCredentials.ClientAuth>

java.lang.Object
java.lang.Enum
io.grpc.TlsServerCredentials.ClientAuth

The level of authentication the server should expect from the client.

Field Summary

Modifier and Type	Field and Description
public static final TlsServerCredentials.ClientAuth	NONE Clients will not present any identity.
public static final TlsServerCredentials.ClientAuth	OPTIONAL Clients are requested to present their identity, but clients without identities are permitted.
public static final TlsServerCredentials.ClientAuth	REQUIRE Clients are requested to present their identity, and are required to provide a valid identity.

Constructor Summary

Access	Constructor and Description
private	ClientAuth()

Method Summary

Modifier and Type	Method and Description
public static TlsServerCredentials.ClientAuth	valueOf(String name)
public static TlsServerCredentials.ClientAuth[]	values()

Inherited from java.lang.Enum:: clone compareTo describeConstable equals finalize getDeclaringClass hashCode name ordinal toString valueOf

Field Detail

NONE	back to summary
public static final TlsServerCredentials.ClientAuth NONE Clients will not present any identity.

OPTIONAL	back to summary
public static final TlsServerCredentials.ClientAuth OPTIONAL Clients are requested to present their identity, but clients without identities are permitted.

REQUIRE	back to summary
public static final TlsServerCredentials.ClientAuth REQUIRE Clients are requested to present their identity, and are required to provide a valid identity.

Constructor Detail

ClientAuth	back to summary
private ClientAuth()

Method Detail

valueOf	back to summary
public static TlsServerCredentials.ClientAuth valueOf(String name)

values	back to summary
public static TlsServerCredentials.ClientAuth[] values()

io.grpc back to summary

public final Enum TlsServerCredentials.Feature

Class Inheritance

extends Enum<TlsServerCredentials.Feature>

java.lang.Object
java.lang.Enum
io.grpc.TlsServerCredentials.Feature

Features to understand TLS configuration. Additional enum values may be added in the future.

Field Summary

Modifier and Type	Field and Description
public static final TlsServerCredentials.Feature	CUSTOM_MANAGERS Key managers and trust managers may be specified as `KeyManager` and `TrustManager` objects.
public static final TlsServerCredentials.Feature	FAKE A feature that no consumer should understand.
public static final TlsServerCredentials.Feature	MTLS Client certificates may be requested and verified.

Constructor Summary

Access	Constructor and Description
private	Feature()

Method Summary

Modifier and Type	Method and Description
public static TlsServerCredentials.Feature	valueOf(String name)
public static TlsServerCredentials.Feature[]	values()

Inherited from java.lang.Enum:: clone compareTo describeConstable equals finalize getDeclaringClass hashCode name ordinal toString valueOf

Field Detail

CUSTOM_MANAGERS back to summary

public static final TlsServerCredentials.Feature CUSTOM_MANAGERS

Key managers and trust managers may be specified as KeyManager and TrustManager objects. This feature by itself only implies getKeyManagers() needs to be observed. But along with MTLS, then getTrustManagers() needs to be observed as well. When a manager is non-null, then it is wholly responsible for key or trust material and usage; there is no need to check other manager sources like getCertificateChain() or getPrivateKey() (if KeyManager is available), or getRootCertificates() (if TrustManager is available).

If other manager sources are available (e.g., getPrivateKey() != null), then they may be alternative representations of the same configuration and the consumer is free to use those alternative representations if it prefers. But before doing so it must first check that it understands that alternative representation by using incomprehensible without the CUSTOM_MANAGERS feature.

FAKE	back to summary
public static final TlsServerCredentials.Feature FAKE A feature that no consumer should understand. It should be used for unit testing to confirm a call to `incomprehensible()` is implemented properly.

MTLS	back to summary
public static final TlsServerCredentials.Feature MTLS Client certificates may be requested and verified. This feature requires observing `getRootCertificates()` and `getClientAuth()`. The root certificates are used to configure a trust manager for verifying the client's identity. If no root certificates are provided the trust manager will default to the system's root certificates.

Constructor Detail

Feature	back to summary
private Feature()

Method Detail

valueOf	back to summary
public static TlsServerCredentials.Feature valueOf(String name)

values	back to summary
public static TlsServerCredentials.Feature[] values()

public final Class TlsServerCredentials

Nested and Inner Type Summary

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail

public final Class TlsServerCredentials.Builder

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail

public final Enum TlsServerCredentials.ClientAuth

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail

public final Enum TlsServerCredentials.Feature

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail