Netty/TomcatNative [OpenSSL - Classes] 2.0.62.Final · io.netty.internal.tcnative.SSLContext

Modifier and Type	Field and Description
private static final int	MAX_ALPN_NPN_PROTO_SIZE

Access	Constructor and Description
private	SSLContext()

Method Summary

Modifier and Type	Method and Description
public static int	Returns: one on success or zero on error addCertificateCompressionAlgorithm(long context, to which, the algorithm should be added. ctx, int indicates whether decompression support should be advertized, compression should be applied for peers which support it, or both. This allows the caller to support one way compression only. `SSL#SSL_CERT_COMPRESSION_DIRECTION_COMPRESS` `SSL#SSL_CERT_COMPRESSION_DIRECTION_DECOMPRESS` `SSL#SSL_CERT_COMPRESSION_DIRECTION_BOTH` direction, final CertificateCompressionAlgo implementation of the compression and or decompression algorithm as a `CertificateCompressionAlgo` algorithm) Adds a certificate compression algorithm to the given `SSLContext` or throws an exception if certificate compression is not supported or the algorithm not recognized.
private static native int	addCertificateCompressionAlgorithm0(long ctx, int direction, int algorithmId, final CertificateCompressionAlgo algorithm)
public static native void	clearOptions(long Server or Client context to use. ctx, int See SSL.SSL_OP_* for option flags. options) Clears OpenSSL Options.
public static native void	disableOcsp(long ctx) Disables OCSP stapling on the given `SSLContext`.
public static native void	enableOcsp(long ctx, boolean client) Enables OCSP stapling for the given `SSLContext` or throws an exception if OCSP stapling is not supported.
public static native int	Returns: APR Status code. free(long Server or Client context to free. ctx) Free the resources used by the Context
public static native int	Returns: the mode. getMode(long context to use ctx) Call SSL_CTX_get_mode
public static native int	Returns: options See SSL.SSL_OP_* for option flags. getOptions(long Server or Client context to use. ctx) Get OpenSSL Option.
public static native long	Returns: the current mode getSessionCacheMode(long Server or Client context to use ctx) Get the mode of the current used internal session cache.
public static native long	Returns: the current value getSessionCacheSize(long Server or Client context to use. ctx) Get the size of the internal session cache.
public static native long	Returns: the current value getSessionCacheTimeout(long Server or Client context to use ctx) Get the timeout for the internal session cache in seconds.
public static native long	getSslCtx(long ctx) Returns the `SSL_CTX`.
public static native long	Returns: the SSLContext struct make(int The SSL protocol to use. It can be any combination of the following: `SSL#SSL_PROTOCOL_SSLV2` `SSL#SSL_PROTOCOL_SSLV3` `SSL#SSL_PROTOCOL_TLSV1` `SSL#SSL_PROTOCOL_TLSV1_1` `SSL#SSL_PROTOCOL_TLSV1_2` `SSL#SSL_PROTOCOL_ALL` ( == all TLS versions, no SSL) protocol, int SSL mode to use SSL_MODE_CLIENT SSL_MODE_SERVER SSL_MODE_COMBINED mode) Initialize new SSL context
private static byte[]	protocolsToWireFormat(String[] protocols)
public static native long	Returns: the current number sessionAccept(long Server or Client context to use ctx) Session resumption statistics methods.
public static native long	Returns: the current number sessionAcceptGood(long Server or Client context to use ctx) Session resumption statistics methods.
public static native long	Returns: the current number sessionAcceptRenegotiate(long Server or Client context to use ctx) Session resumption statistics methods.
public static native long	Returns: the current number sessionCacheFull(long Server or Client context to use ctx) Session resumption statistics methods.
public static native long	Returns: the current number sessionCbHits(long Server or Client context to use ctx) Session resumption statistics methods.
public static native long	Returns: the current number sessionConnect(long Server or Client context to use ctx) Session resumption statistics methods.
public static native long	Returns: the current number sessionConnectGood(long Server or Client context to use ctx) Session resumption statistics methods.
public static native long	Returns: the current number sessionConnectRenegotiate(long Server or Client context to use ctx) Session resumption statistics methods.
public static native long	Returns: the current number sessionHits(long Server or Client context to use ctx) Session resumption statistics methods.
public static native long	Returns: the current number sessionMisses(long Server or Client context to use ctx) Session resumption statistics methods.
public static native long	Returns: the current number sessionNumber(long Server or Client context to use ctx) Session resumption statistics methods.
public static native long	Returns: the current number sessionTicketKeyFail(long Server or Client context to use ctx) TLS session ticket key resumption statistics.
public static native long	Returns: the current number sessionTicketKeyNew(long Server or Client context to use ctx) TLS session ticket key resumption statistics.
public static native long	Returns: the current number sessionTicketKeyRenew(long Server or Client context to use ctx) TLS session ticket key resumption statistics.
public static native long	Returns: the current number sessionTicketKeyResume(long Server or Client context to use ctx) TLS session ticket key resumption statistics.
public static native long	Returns: the current number sessionTimeouts(long Server or Client context to use ctx) Session resumption statistics methods.
public static void	setAlpnProtos(long Server context to use. ctx, String[] protocols in priority order alpnProtos, int see `SSL#SSL_SELECTOR_FAILURE_NO_ADVERTISE` and `SSL#SSL_SELECTOR_FAILURE_CHOOSE_MY_LAST_PROTOCOL` selectorFailureBehavior) Set application layer protocol for application layer protocol negotiation extension
private static native void	setAlpnProtos0(long ctx, byte[] alpnProtos, int selectorFailureBehavior)
public static native boolean	Returns: `true` if successful, `false` otherwise. setCACertificateBio(long Server context to use. ctx, long Directory of PEM-encoded CA Certificates for Client Auth. certBio) Set concatenated PEM-encoded CA Certificates for Client Auth This directive sets the all-in-one BIO where you can assemble the Certificates of Certification Authorities (CA) whose clients you deal with.
public static native boolean	Returns: `true` if successful setCertificate(long Server or Client context to use. ctx, String Certificate file. cert, String Private Key file to use if not in cert. key, String Certificate password. If null and certificate is encrypted, password prompt will be displayed. password) Set Certificate Point setCertificateFile at a PEM encoded certificate.
public static native boolean	Returns: `true` if successful setCertificateBio(long Server or Client context to use. ctx, long Certificate BIO. certBio, long Private Key BIO to use if not in cert. keyBio, String Certificate password. If null and certificate is encrypted, password prompt will be displayed. password) Set Certificate Point setCertificate at a PEM encoded certificate stored in a BIO.
public static native void	setCertificateCallback(long Server or Client context to use. ctx, CertificateCallback the callback to call during certificate selection. callback) Allow to hook `CertificateCallback` into the certificate choosing process.
public static native boolean	Returns: `true` if successful setCertificateChainBio(long Server or Client context to use. ctx, long BIO of PEM-encoded Server CA Certificates. bio, boolean Skip first certificate if chain file is inside certificate file. skipfirst) Set BIO of PEM-encoded Server CA Certificates This directive sets the optional all-in-one file where you can assemble the certificates of Certification Authorities (CA) which form the certificate chain of the server certificate.
public static native boolean	Returns: `true` if successful setCertificateChainFile(long Server or Client context to use. ctx, String File of PEM-encoded Server CA Certificates. file, boolean Skip first certificate if chain file is inside certificate file. skipfirst) Set File of PEM-encoded Server CA Certificates This directive sets the optional all-in-one file where you can assemble the certificates of Certification Authorities (CA) which form the certificate chain of the server certificate.
public static native void	setCertRequestedCallback(long Server or Client context to use. ctx, CertificateRequestedCallback the callback to call during certificate selection. callback) Deprecated use `setCertificateCallback(long, CertificateCallback)` Allow to hook `CertificateRequestedCallback` into the certificate choosing process.
public static native void	setCertVerifyCallback(long Server or Client context to use. ctx, CertificateVerifier the verifier to call during handshake. verifier) Allow to hook `CertificateVerifier` into the handshake processing.
public static boolean	Returns: `true` if successful setCipherSuite(long Server or Client context to use. ctx, String An SSL cipher specification. ciphers) Deprecated Use `setCipherSuite(long, String, boolean)`. Cipher Suite available for negotiation in SSL handshake.
public static native boolean	Returns: `true` if successful setCipherSuite(long Server or Client context to use. ctx, String An SSL cipher specification. ciphers, boolean `true` if the ciphers are for TLSv1.3 tlsv13) Cipher Suite available for negotiation in SSL handshake.
public static native void	setContextId(long Context to use. ctx, String String that uniquely identifies this context. id) Set Session context id. Usually host:port combination.
public static boolean	Returns: `true` if successful, `false` otherwise. setCurvesList(long context to use ctx, String... the curves to use. curves) Sets the curves to use.
private static native boolean	setCurvesList0(long ctx, String curves)
public static native void	setMaxCertList(long context to use ctx, int the maximum number of bytes size) Set the maximum number of bytes for the certificate chain during handshake.
public static native int	Returns: the set mode. setMode(long context to use ctx, int the mode mode) Call SSL_CTX_set_mode
public static void	setNpnProtos(long Server context to use. ctx, String[] protocols in priority order nextProtos, int see `SSL#SSL_SELECTOR_FAILURE_NO_ADVERTISE` and `SSL#SSL_SELECTOR_FAILURE_CHOOSE_MY_LAST_PROTOCOL` selectorFailureBehavior) Set next protocol for next protocol negotiation extension
private static native void	setNpnProtos0(long ctx, byte[] nextProtos, int selectorFailureBehavior)
public static native boolean	Returns: `true` if successful, `false` otherwise. setNumTickets(long context to use ctx, int the number of tickets tickets) Set the number of TLSv1.3 session tickets that will be sent to the client after a full handshake.
public static native void	setOptions(long Server or Client context to use. ctx, int See SSL.SSL_OP_* for option flags. options) Set OpenSSL Option.
public static void	setPrivateKeyMethod(long context to use ctx, final SSLPrivateKeyMethod method to use for the given context. method) Set the `SSLPrivateKeyMethod` to use for the given `SSLContext`.
public static void	setPrivateKeyMethod(long context to use ctx, AsyncSSLPrivateKeyMethod method to use for the given context. method) Sets the `AsyncSSLPrivateKeyMethod` to use for the given `SSLContext`.
private static native void	setPrivateKeyMethod0(long ctx, AsyncSSLPrivateKeyMethod method)
public static native long	Returns: the previous set value setSessionCacheMode(long Server or Client context to use ctx, long the mode of the cache mode) Set the mode of the internal session cache and return the previous used mode.
public static native long	Returns: the previous set value setSessionCacheSize(long Server or Client context to use. ctx, long the size of the cache size) Set the size of the internal session cache.
public static native long	Returns: the previous set value setSessionCacheTimeout(long Server or Client context to use. ctx, long the timeout of the cache timeoutSeconds) Set the timeout for the internal session cache in seconds.
public static native boolean	Returns: `true` if success, `false` otherwise. setSessionIdContext(long Server context to use. ctx, byte[] can be any kind of binary data, it is therefore possible to use e.g. the name of the application and/or the hostname and/or service name sidCtx) Set the context within which session be reused (server side only).
public static void	setSessionTicketKeys(long Server or Client context to use ctx, SessionTicketKey[] the `SessionTicketKey`s keys) Set TLS session ticket keys.
private static native void	setSessionTicketKeys0(long ctx, byte[] keys) Set TLS session keys.
public static native void	setSniHostnameMatcher(long Server or Client context to use. ctx, SniHostNameMatcher the matcher to call during sni hostname matching. matcher) Allow to hook `SniHostNameMatcher` into the sni processing.
public static native void	setSSLSessionCache(long context to use. ctx, SSLSessionCache cache to use for the given context. cache) Set the `SSLSessionCache` that will be used if session caching is enabled.
public static native void	setTmpDHLength(long Server context to use. ctx, int the length. length) Set length of the DH to use.
public static native void	setUseTasks(long context to use ctx, boolean `true` to enable, `false` to disable. useTasks) Enable or disable producing of tasks that should be obtained via `SSL#getTask(long)` and run.
public static native void	setVerify(long Server or Client context to use. ctx, int Type of Client Certificate verification. level, int Maximum depth of CA Certificates in Client Certificate verification. depth) Set Type of Client Certificate verification and Maximum depth of CA Certificates in Client Certificate verification.

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

MAX_ALPN_NPN_PROTO_SIZE	back to summary
private static final int MAX_ALPN_NPN_PROTO_SIZE

SSLContext	back to summary
private SSLContext()

Method Detail

addCertificateCompressionAlgorithm back to summary

addCertificateCompressionAlgorithm	back to summary
public static int addCertificateCompressionAlgorithm(long ctx, int direction, final CertificateCompressionAlgo algorithm) Adds a certificate compression algorithm to the given `SSLContext` or throws an exception if certificate compression is not supported or the algorithm not recognized. For servers, algorithm preference order is dictated by the order of algorithm registration. Most preferred algorithm should be registered first. This method is currently only supported when `BoringSSL` is used. SSL_CTX_add_cert_compression_alg rfc8879 Parameters ctx:long context, to which, the algorithm should be added. direction:int indicates whether decompression support should be advertized, compression should be applied for peers which support it, or both. This allows the caller to support one way compression only. `SSL#SSL_CERT_COMPRESSION_DIRECTION_COMPRESS` `SSL#SSL_CERT_COMPRESSION_DIRECTION_DECOMPRESS` `SSL#SSL_CERT_COMPRESSION_DIRECTION_BOTH` algorithm:CertificateCompressionAlgo implementation of the compression and or decompression algorithm as a `CertificateCompressionAlgo` Returns:int one on success or zero on error

public static int addCertificateCompressionAlgorithm(long ctx, int direction, final CertificateCompressionAlgo algorithm)

Adds a certificate compression algorithm to the given SSLContext or throws an exception if certificate compression is not supported or the algorithm not recognized. For servers, algorithm preference order is dictated by the order of algorithm registration. Most preferred algorithm should be registered first. This method is currently only supported when BoringSSL is used. SSL_CTX_add_cert_compression_alg rfc8879

Parameters

ctx:long

context, to which, the algorithm should be added.

direction:int

indicates whether decompression support should be advertized, compression should be applied for peers which support it, or both. This allows the caller to support one way compression only.

SSL#SSL_CERT_COMPRESSION_DIRECTION_COMPRESS
SSL#SSL_CERT_COMPRESSION_DIRECTION_DECOMPRESS
SSL#SSL_CERT_COMPRESSION_DIRECTION_BOTH

algorithm:CertificateCompressionAlgo

implementation of the compression and or decompression algorithm as a CertificateCompressionAlgo

Returns:int

one on success or zero on error

addCertificateCompressionAlgorithm0	back to summary
private static native int addCertificateCompressionAlgorithm0(long ctx, int direction, int algorithmId, final CertificateCompressionAlgo algorithm)

clearOptions	back to summary
public static native void clearOptions(long ctx, int options) Clears OpenSSL Options. Parameters ctx:long Server or Client context to use. options:int See SSL.SSL_OP_* for option flags.

clearOptions

back to summary

public static native void clearOptions(long ctx, int options)

Clears OpenSSL Options.

Parameters

ctx:long: Server or Client context to use.
options:int: See SSL.SSL_OP_* for option flags.

disableOcsp back to summary

disableOcsp	back to summary
public static native void disableOcsp(long ctx) Disables OCSP stapling on the given `SSLContext`. SSL_set_tlsext_status_type Search for OCSP

public static native void disableOcsp(long ctx)

Disables OCSP stapling on the given SSLContext.

SSL_set_tlsext_status_type

Search for OCSP

enableOcsp back to summary

enableOcsp	back to summary
public static native void enableOcsp(long ctx, boolean client) Enables OCSP stapling for the given `SSLContext` or throws an exception if OCSP stapling is not supported. SSL_set_tlsext_status_type Search for OCSP

public static native void enableOcsp(long ctx, boolean client)

Enables OCSP stapling for the given SSLContext or throws an exception if OCSP stapling is not supported.

SSL_set_tlsext_status_type

Search for OCSP

free	back to summary
public static native int free(long ctx) Free the resources used by the Context Parameters ctx:long Server or Client context to free. Returns:int APR Status code.

free

back to summary

public static native int free(long ctx)

Free the resources used by the Context

Parameters

ctx:long: Server or Client context to free.

Returns:int

APR Status code.

getMode	back to summary
public static native int getMode(long ctx) Call SSL_CTX_get_mode Parameters ctx:long context to use Returns:int the mode.

getMode

back to summary

public static native int getMode(long ctx)

Call SSL_CTX_get_mode

Parameters

ctx:long: context to use

Returns:int

the mode.

getOptions	back to summary
public static native int getOptions(long ctx) Get OpenSSL Option. Parameters ctx:long Server or Client context to use. Returns:int options See SSL.SSL_OP_* for option flags.

getOptions

back to summary

public static native int getOptions(long ctx)

Get OpenSSL Option.

Parameters

ctx:long: Server or Client context to use.

Returns:int

options See SSL.SSL_OP_* for option flags.

getSessionCacheMode	back to summary
public static native long getSessionCacheMode(long ctx) Get the mode of the current used internal session cache. Parameters ctx:long Server or Client context to use Returns:long the current mode

getSessionCacheMode

back to summary

public static native long getSessionCacheMode(long ctx)

Get the mode of the current used internal session cache.

Parameters

ctx:long: Server or Client context to use

Returns:long

the current mode

getSessionCacheSize	back to summary
public static native long getSessionCacheSize(long ctx) Get the size of the internal session cache. See man SSL_CTX_sess_get_cache_size Parameters ctx:long Server or Client context to use. Returns:long the current value

getSessionCacheSize

back to summary

public static native long getSessionCacheSize(long ctx)

Get the size of the internal session cache. See man SSL_CTX_sess_get_cache_size

Parameters

ctx:long: Server or Client context to use.

Returns:long

the current value

getSessionCacheTimeout	back to summary
public static native long getSessionCacheTimeout(long ctx) Get the timeout for the internal session cache in seconds. See man SSL_CTX_get_timeout Parameters ctx:long Server or Client context to use Returns:long the current value

getSessionCacheTimeout

back to summary

public static native long getSessionCacheTimeout(long ctx)

Get the timeout for the internal session cache in seconds. See man SSL_CTX_get_timeout

Parameters

ctx:long: Server or Client context to use

Returns:long

the current value

getSslCtx	back to summary
public static native long getSslCtx(long ctx) Returns the `SSL_CTX`.

make back to summary

make	back to summary
public static native long make(int protocol, int mode) throws Exception Initialize new SSL context Parameters protocol:int The SSL protocol to use. It can be any combination of the following: `SSL#SSL_PROTOCOL_SSLV2` `SSL#SSL_PROTOCOL_SSLV3` `SSL#SSL_PROTOCOL_TLSV1` `SSL#SSL_PROTOCOL_TLSV1_1` `SSL#SSL_PROTOCOL_TLSV1_2` `SSL#SSL_PROTOCOL_ALL` ( == all TLS versions, no SSL) mode:int SSL mode to use SSL_MODE_CLIENT SSL_MODE_SERVER SSL_MODE_COMBINED Returns:long the SSLContext struct Exceptions Exception: if an error happened

public static native long make(int protocol, int mode) throws Exception

Initialize new SSL context

Parameters

protocol:int

The SSL protocol to use. It can be any combination of the following:

SSL#SSL_PROTOCOL_SSLV2
SSL#SSL_PROTOCOL_SSLV3
SSL#SSL_PROTOCOL_TLSV1
SSL#SSL_PROTOCOL_TLSV1_1
SSL#SSL_PROTOCOL_TLSV1_2
SSL#SSL_PROTOCOL_ALL ( == all TLS versions, no SSL)

mode:int

SSL mode to use

SSL_MODE_CLIENT
SSL_MODE_SERVER
SSL_MODE_COMBINED

Returns:long

the SSLContext struct

Exceptions

Exception:: if an error happened

protocolsToWireFormat	back to summary
private static byte[] protocolsToWireFormat(String[] protocols)

sessionAccept	back to summary
public static native long sessionAccept(long ctx) Session resumption statistics methods. See man SSL_CTX_sess_number Parameters ctx:long Server or Client context to use Returns:long the current number

sessionAccept

back to summary

public static native long sessionAccept(long ctx)

Session resumption statistics methods. See man SSL_CTX_sess_number

Parameters

ctx:long: Server or Client context to use

Returns:long

the current number

sessionAcceptGood	back to summary
public static native long sessionAcceptGood(long ctx) Session resumption statistics methods. See man SSL_CTX_sess_number Parameters ctx:long Server or Client context to use Returns:long the current number

sessionAcceptGood

back to summary

public static native long sessionAcceptGood(long ctx)

Session resumption statistics methods. See man SSL_CTX_sess_number

Parameters

ctx:long: Server or Client context to use

Returns:long

the current number

sessionAcceptRenegotiate	back to summary
public static native long sessionAcceptRenegotiate(long ctx) Session resumption statistics methods. See man SSL_CTX_sess_number Parameters ctx:long Server or Client context to use Returns:long the current number

sessionAcceptRenegotiate

back to summary

public static native long sessionAcceptRenegotiate(long ctx)

Session resumption statistics methods. See man SSL_CTX_sess_number

Parameters

ctx:long: Server or Client context to use

Returns:long

the current number

sessionCacheFull	back to summary
public static native long sessionCacheFull(long ctx) Session resumption statistics methods. See man SSL_CTX_sess_number Parameters ctx:long Server or Client context to use Returns:long the current number

sessionCacheFull

back to summary

public static native long sessionCacheFull(long ctx)

Session resumption statistics methods. See man SSL_CTX_sess_number

Parameters

ctx:long: Server or Client context to use

Returns:long

the current number

sessionCbHits	back to summary
public static native long sessionCbHits(long ctx) Session resumption statistics methods. See man SSL_CTX_sess_number Parameters ctx:long Server or Client context to use Returns:long the current number

sessionCbHits

back to summary

public static native long sessionCbHits(long ctx)

Session resumption statistics methods. See man SSL_CTX_sess_number

Parameters

ctx:long: Server or Client context to use

Returns:long

the current number

sessionConnect	back to summary
public static native long sessionConnect(long ctx) Session resumption statistics methods. See man SSL_CTX_sess_number Parameters ctx:long Server or Client context to use Returns:long the current number

sessionConnect

back to summary

public static native long sessionConnect(long ctx)

Session resumption statistics methods. See man SSL_CTX_sess_number

Parameters

ctx:long: Server or Client context to use

Returns:long

the current number

sessionConnectGood	back to summary
public static native long sessionConnectGood(long ctx) Session resumption statistics methods. See man SSL_CTX_sess_number Parameters ctx:long Server or Client context to use Returns:long the current number

sessionConnectGood

back to summary

public static native long sessionConnectGood(long ctx)

Session resumption statistics methods. See man SSL_CTX_sess_number

Parameters

ctx:long: Server or Client context to use

Returns:long

the current number

sessionConnectRenegotiate	back to summary
public static native long sessionConnectRenegotiate(long ctx) Session resumption statistics methods. See man SSL_CTX_sess_number Parameters ctx:long Server or Client context to use Returns:long the current number

sessionConnectRenegotiate

back to summary

public static native long sessionConnectRenegotiate(long ctx)

Session resumption statistics methods. See man SSL_CTX_sess_number

Parameters

ctx:long: Server or Client context to use

Returns:long

the current number

sessionHits	back to summary
public static native long sessionHits(long ctx) Session resumption statistics methods. See man SSL_CTX_sess_number Parameters ctx:long Server or Client context to use Returns:long the current number

sessionHits

back to summary

public static native long sessionHits(long ctx)

Session resumption statistics methods. See man SSL_CTX_sess_number

Parameters

ctx:long: Server or Client context to use

Returns:long

the current number

sessionMisses	back to summary
public static native long sessionMisses(long ctx) Session resumption statistics methods. See man SSL_CTX_sess_number Parameters ctx:long Server or Client context to use Returns:long the current number

sessionMisses

back to summary

public static native long sessionMisses(long ctx)

Session resumption statistics methods. See man SSL_CTX_sess_number

Parameters

ctx:long: Server or Client context to use

Returns:long

the current number

sessionNumber	back to summary
public static native long sessionNumber(long ctx) Session resumption statistics methods. See man SSL_CTX_sess_number Parameters ctx:long Server or Client context to use Returns:long the current number

sessionNumber

back to summary

public static native long sessionNumber(long ctx)

Session resumption statistics methods. See man SSL_CTX_sess_number

Parameters

ctx:long: Server or Client context to use

Returns:long

the current number

sessionTicketKeyFail	back to summary
public static native long sessionTicketKeyFail(long ctx) TLS session ticket key resumption statistics. Parameters ctx:long Server or Client context to use Returns:long the current number

sessionTicketKeyFail

back to summary

public static native long sessionTicketKeyFail(long ctx)

TLS session ticket key resumption statistics.

Parameters

ctx:long: Server or Client context to use

Returns:long

the current number

sessionTicketKeyNew	back to summary
public static native long sessionTicketKeyNew(long ctx) TLS session ticket key resumption statistics. Parameters ctx:long Server or Client context to use Returns:long the current number

sessionTicketKeyNew

back to summary

public static native long sessionTicketKeyNew(long ctx)

TLS session ticket key resumption statistics.

Parameters

ctx:long: Server or Client context to use

Returns:long

the current number

sessionTicketKeyRenew	back to summary
public static native long sessionTicketKeyRenew(long ctx) TLS session ticket key resumption statistics. Parameters ctx:long Server or Client context to use Returns:long the current number

sessionTicketKeyRenew

back to summary

public static native long sessionTicketKeyRenew(long ctx)

TLS session ticket key resumption statistics.

Parameters

ctx:long: Server or Client context to use

Returns:long

the current number

sessionTicketKeyResume	back to summary
public static native long sessionTicketKeyResume(long ctx) TLS session ticket key resumption statistics. Parameters ctx:long Server or Client context to use Returns:long the current number

sessionTicketKeyResume

back to summary

public static native long sessionTicketKeyResume(long ctx)

TLS session ticket key resumption statistics.

Parameters

ctx:long: Server or Client context to use

Returns:long

the current number

sessionTimeouts	back to summary
public static native long sessionTimeouts(long ctx) Session resumption statistics methods. See man SSL_CTX_sess_number Parameters ctx:long Server or Client context to use Returns:long the current number

sessionTimeouts

back to summary

public static native long sessionTimeouts(long ctx)

Session resumption statistics methods. See man SSL_CTX_sess_number

Parameters

ctx:long: Server or Client context to use

Returns:long

the current number

setAlpnProtos back to summary

setAlpnProtos	back to summary
public static void setAlpnProtos(long ctx, String[] alpnProtos, int selectorFailureBehavior) Set application layer protocol for application layer protocol negotiation extension Parameters ctx:long Server context to use. alpnProtos:String[] protocols in priority order selectorFailureBehavior:int see `SSL#SSL_SELECTOR_FAILURE_NO_ADVERTISE` and `SSL#SSL_SELECTOR_FAILURE_CHOOSE_MY_LAST_PROTOCOL`

public static void setAlpnProtos(long ctx, String[] alpnProtos, int selectorFailureBehavior)

Set application layer protocol for application layer protocol negotiation extension

Parameters

ctx:long: Server context to use.
alpnProtos:String[]: protocols in priority order
selectorFailureBehavior:int: see SSL#SSL_SELECTOR_FAILURE_NO_ADVERTISE and SSL#SSL_SELECTOR_FAILURE_CHOOSE_MY_LAST_PROTOCOL

setAlpnProtos0	back to summary
private static native void setAlpnProtos0(long ctx, byte[] alpnProtos, int selectorFailureBehavior)

setCACertificateBio back to summary

setCACertificateBio	back to summary
public static native boolean setCACertificateBio(long ctx, long certBio) Set concatenated PEM-encoded CA Certificates for Client Auth This directive sets the all-in-one BIO where you can assemble the Certificates of Certification Authorities (CA) whose clients you deal with. These are used for Client Authentication. Such a BIO is simply the concatenation of the various PEM-encoded Certificate files, in order of preference. This can be used alternatively and/or additionally to path. Parameters ctx:long Server context to use. certBio:long Directory of PEM-encoded CA Certificates for Client Auth. Returns:boolean `true` if successful, `false` otherwise.

public static native boolean setCACertificateBio(long ctx, long certBio)

Set concatenated PEM-encoded CA Certificates for Client Auth
This directive sets the all-in-one BIO where you can assemble the Certificates of Certification Authorities (CA) whose clients you deal with. These are used for Client Authentication. Such a BIO is simply the concatenation of the various PEM-encoded Certificate files, in order of preference. This can be used alternatively and/or additionally to path.

Parameters

ctx:long: Server context to use.
certBio:long: Directory of PEM-encoded CA Certificates for Client Auth.

Returns:boolean

true if successful, false otherwise.

setCertificate back to summary

setCertificate	back to summary
public static native boolean setCertificate(long ctx, String cert, String key, String password) throws Exception Set Certificate Point setCertificateFile at a PEM encoded certificate. If the certificate is encrypted, then you will be prompted for a pass phrase. Note that a kill -HUP will prompt again. A test certificate can be generated with `make certificate' under built time. Keep in mind that if you've both a RSA and a DSA certificate you can configure both in parallel (to also allow the use of DSA ciphers, etc.) If the key is not combined with the certificate, use key param to point at the key file. Keep in mind that if you've both a RSA and a DSA private key you can configure both in parallel (to also allow the use of DSA ciphers, etc.) Parameters ctx:long Server or Client context to use. cert:String Certificate file. key:String Private Key file to use if not in cert. password:String Certificate password. If null and certificate is encrypted, password prompt will be displayed. Returns:boolean `true` if successful Exceptions Exception: if an error happened

public static native boolean setCertificate(long ctx, String cert, String key, String password) throws Exception

Set Certificate

Point setCertificateFile at a PEM encoded certificate. If the certificate is encrypted, then you will be prompted for a pass phrase. Note that a kill -HUP will prompt again. A test certificate can be generated with `make certificate' under built time. Keep in mind that if you've both a RSA and a DSA certificate you can configure both in parallel (to also allow the use of DSA ciphers, etc.)

If the key is not combined with the certificate, use key param to point at the key file. Keep in mind that if you've both a RSA and a DSA private key you can configure both in parallel (to also allow the use of DSA ciphers, etc.)

Parameters

ctx:long: Server or Client context to use.
cert:String: Certificate file.
key:String: Private Key file to use if not in cert.
password:String: Certificate password. If null and certificate is encrypted, password prompt will be displayed.

Returns:boolean

true if successful

Exceptions

Exception:: if an error happened

setCertificateBio back to summary

setCertificateBio	back to summary
public static native boolean setCertificateBio(long ctx, long certBio, long keyBio, String password) throws Exception Set Certificate Point setCertificate at a PEM encoded certificate stored in a BIO. If the certificate is encrypted, then you will be prompted for a pass phrase. Note that a kill -HUP will prompt again. A test certificate can be generated with `make certificate' under built time. Keep in mind that if you've both a RSA and a DSA certificate you can configure both in parallel (to also allow the use of DSA ciphers, etc.) If the key is not combined with the certificate, use key param to point at the key file. Keep in mind that if you've both a RSA and a DSA private key you can configure both in parallel (to also allow the use of DSA ciphers, etc.) Parameters ctx:long Server or Client context to use. certBio:long Certificate BIO. keyBio:long Private Key BIO to use if not in cert. password:String Certificate password. If null and certificate is encrypted, password prompt will be displayed. Returns:boolean `true` if successful Exceptions Exception: if an error happened

public static native boolean setCertificateBio(long ctx, long certBio, long keyBio, String password) throws Exception

Set Certificate

Point setCertificate at a PEM encoded certificate stored in a BIO. If the certificate is encrypted, then you will be prompted for a pass phrase. Note that a kill -HUP will prompt again. A test certificate can be generated with `make certificate' under built time. Keep in mind that if you've both a RSA and a DSA certificate you can configure both in parallel (to also allow the use of DSA ciphers, etc.)

Parameters

ctx:long: Server or Client context to use.
certBio:long: Certificate BIO.
keyBio:long: Private Key BIO to use if not in cert.
password:String: Certificate password. If null and certificate is encrypted, password prompt will be displayed.

Returns:boolean

true if successful

Exceptions

Exception:: if an error happened

setCertificateCallback back to summary

setCertificateCallback	back to summary
public static native void setCertificateCallback(long ctx, CertificateCallback callback) Allow to hook `CertificateCallback` into the certificate choosing process. This will call `SSL_CTX_set_cert_cb` and so replace the default verification callback used by openssl Parameters ctx:long Server or Client context to use. callback:CertificateCallback the callback to call during certificate selection.

public static native void setCertificateCallback(long ctx, CertificateCallback callback)

Allow to hook CertificateCallback into the certificate choosing process. This will call SSL_CTX_set_cert_cb and so replace the default verification callback used by openssl

Parameters

ctx:long: Server or Client context to use.
callback:CertificateCallback: the callback to call during certificate selection.

setCertificateChainBio back to summary

setCertificateChainBio	back to summary
public static native boolean setCertificateChainBio(long ctx, long bio, boolean skipfirst) Set BIO of PEM-encoded Server CA Certificates This directive sets the optional all-in-one file where you can assemble the certificates of Certification Authorities (CA) which form the certificate chain of the server certificate. This starts with the issuing CA certificate of of the server certificate and can range up to the root CA certificate. Such a file is simply the concatenation of the various PEM-encoded CA Certificate files, usually in certificate chain order. But be careful: Providing the certificate chain works only if you are using a single (either RSA or DSA) based server certificate. If you are using a coupled RSA+DSA certificate pair, this will work only if actually both certificates use the same certificate chain. Otherwsie the browsers will be confused in this situation. Parameters ctx:long Server or Client context to use. bio:long BIO of PEM-encoded Server CA Certificates. skipfirst:boolean Skip first certificate if chain file is inside certificate file. Returns:boolean `true` if successful

public static native boolean setCertificateChainBio(long ctx, long bio, boolean skipfirst)

Set BIO of PEM-encoded Server CA Certificates

This directive sets the optional all-in-one file where you can assemble the certificates of Certification Authorities (CA) which form the certificate chain of the server certificate. This starts with the issuing CA certificate of of the server certificate and can range up to the root CA certificate. Such a file is simply the concatenation of the various PEM-encoded CA Certificate files, usually in certificate chain order.

But be careful: Providing the certificate chain works only if you are using a single (either RSA or DSA) based server certificate. If you are using a coupled RSA+DSA certificate pair, this will work only if actually both certificates use the same certificate chain. Otherwsie the browsers will be confused in this situation.

Parameters

ctx:long: Server or Client context to use.
bio:long: BIO of PEM-encoded Server CA Certificates.
skipfirst:boolean: Skip first certificate if chain file is inside certificate file.

Returns:boolean

true if successful

setCertificateChainFile back to summary

setCertificateChainFile	back to summary
public static native boolean setCertificateChainFile(long ctx, String file, boolean skipfirst) Set File of PEM-encoded Server CA Certificates This directive sets the optional all-in-one file where you can assemble the certificates of Certification Authorities (CA) which form the certificate chain of the server certificate. This starts with the issuing CA certificate of of the server certificate and can range up to the root CA certificate. Such a file is simply the concatenation of the various PEM-encoded CA Certificate files, usually in certificate chain order. But be careful: Providing the certificate chain works only if you are using a single (either RSA or DSA) based server certificate. If you are using a coupled RSA+DSA certificate pair, this will work only if actually both certificates use the same certificate chain. Else the browsers will be confused in this situation. Parameters ctx:long Server or Client context to use. file:String File of PEM-encoded Server CA Certificates. skipfirst:boolean Skip first certificate if chain file is inside certificate file. Returns:boolean `true` if successful

public static native boolean setCertificateChainFile(long ctx, String file, boolean skipfirst)

Set File of PEM-encoded Server CA Certificates
This directive sets the optional all-in-one file where you can assemble the certificates of Certification Authorities (CA) which form the certificate chain of the server certificate. This starts with the issuing CA certificate of of the server certificate and can range up to the root CA certificate. Such a file is simply the concatenation of the various PEM-encoded CA Certificate files, usually in certificate chain order.
But be careful: Providing the certificate chain works only if you are using a single (either RSA or DSA) based server certificate. If you are using a coupled RSA+DSA certificate pair, this will work only if actually both certificates use the same certificate chain. Else the browsers will be confused in this situation.

Parameters

ctx:long: Server or Client context to use.
file:String: File of PEM-encoded Server CA Certificates.
skipfirst:boolean: Skip first certificate if chain file is inside certificate file.

Returns:boolean

true if successful

setCertRequestedCallback back to summary

setCertRequestedCallback	back to summary
public static native void setCertRequestedCallback(long ctx, CertificateRequestedCallback callback) Deprecated use `setCertificateCallback(long, CertificateCallback)` Allow to hook `CertificateRequestedCallback` into the certificate choosing process. This will call `SSL_CTX_set_client_cert_cb` and so replace the default verification callback used by openssl Parameters ctx:long Server or Client context to use. callback:CertificateRequestedCallback the callback to call during certificate selection. Annotations @Deprecated

public static native void setCertRequestedCallback(long ctx, CertificateRequestedCallback callback)

Deprecated

use setCertificateCallback(long, CertificateCallback)

Allow to hook CertificateRequestedCallback into the certificate choosing process. This will call SSL_CTX_set_client_cert_cb and so replace the default verification callback used by openssl

Parameters

ctx:long: Server or Client context to use.
callback:CertificateRequestedCallback: the callback to call during certificate selection.

Annotations

@Deprecated

setCertVerifyCallback back to summary

setCertVerifyCallback	back to summary
public static native void setCertVerifyCallback(long ctx, CertificateVerifier verifier) Allow to hook `CertificateVerifier` into the handshake processing. This will call `SSL_CTX_set_cert_verify_callback` and so replace the default verification callback used by openssl Parameters ctx:long Server or Client context to use. verifier:CertificateVerifier the verifier to call during handshake.

public static native void setCertVerifyCallback(long ctx, CertificateVerifier verifier)

Allow to hook CertificateVerifier into the handshake processing. This will call SSL_CTX_set_cert_verify_callback and so replace the default verification callback used by openssl

Parameters

ctx:long: Server or Client context to use.
verifier:CertificateVerifier: the verifier to call during handshake.

setCipherSuite back to summary

setCipherSuite	back to summary
public static boolean setCipherSuite(long ctx, String ciphers) throws Exception Deprecated Use `setCipherSuite(long, String, boolean)`. Cipher Suite available for negotiation in SSL handshake. This complex directive uses a colon-separated cipher-spec string consisting of OpenSSL cipher specifications to configure the Cipher Suite the client is permitted to negotiate in the SSL handshake phase. Notice that this directive can be used both in per-server and per-directory context. In per-server context it applies to the standard SSL handshake when a connection is established. In per-directory context it forces a SSL renegotiation with the reconfigured Cipher Suite after the HTTP request was read but before the HTTP response is sent. Parameters ctx:long Server or Client context to use. ciphers:String An SSL cipher specification. Returns:boolean `true` if successful Annotations @Deprecated Exceptions Exception: if an error happened

public static boolean setCipherSuite(long ctx, String ciphers) throws Exception

Deprecated

Use setCipherSuite(long, String, boolean).

Cipher Suite available for negotiation in SSL handshake.
This complex directive uses a colon-separated cipher-spec string consisting of OpenSSL cipher specifications to configure the Cipher Suite the client is permitted to negotiate in the SSL handshake phase. Notice that this directive can be used both in per-server and per-directory context. In per-server context it applies to the standard SSL handshake when a connection is established. In per-directory context it forces a SSL renegotiation with the reconfigured Cipher Suite after the HTTP request was read but before the HTTP response is sent.

Parameters

ctx:long: Server or Client context to use.
ciphers:String: An SSL cipher specification.

Returns:boolean

true if successful

Annotations

@Deprecated

Exceptions

Exception:: if an error happened

setCipherSuite back to summary

setCipherSuite	back to summary
public static native boolean setCipherSuite(long ctx, String ciphers, boolean tlsv13) throws Exception Cipher Suite available for negotiation in SSL handshake. This complex directive uses a colon-separated cipher-spec string consisting of OpenSSL cipher specifications to configure the Cipher Suite the client is permitted to negotiate in the SSL handshake phase. Notice that this directive can be used both in per-server and per-directory context. In per-server context it applies to the standard SSL handshake when a connection is established. In per-directory context it forces a SSL renegotiation with the reconfigured Cipher Suite after the HTTP request was read but before the HTTP response is sent. Parameters ctx:long Server or Client context to use. ciphers:String An SSL cipher specification. tlsv13:boolean `true` if the ciphers are for TLSv1.3 Returns:boolean `true` if successful Exceptions Exception: if an error happened

public static native boolean setCipherSuite(long ctx, String ciphers, boolean tlsv13) throws Exception

Parameters

ctx:long: Server or Client context to use.
ciphers:String: An SSL cipher specification.
tlsv13:boolean: true if the ciphers are for TLSv1.3

Returns:boolean

true if successful

Exceptions

Exception:: if an error happened

setContextId	back to summary
public static native void setContextId(long ctx, String id) Set Session context id. Usually host:port combination. Parameters ctx:long Context to use. id:String String that uniquely identifies this context.

setContextId

back to summary

public static native void setContextId(long ctx, String id)

Set Session context id. Usually host:port combination.

Parameters

ctx:long: Context to use.
id:String: String that uniquely identifies this context.

setCurvesList back to summary

setCurvesList	back to summary
public static boolean setCurvesList(long ctx, String... curves) Sets the curves to use. See SSL_CTX_set1_curves_list. Parameters ctx:long context to use curves:String[] the curves to use. Returns:boolean `true` if successful, `false` otherwise.

public static boolean setCurvesList(long ctx, String... curves)

Sets the curves to use. See SSL_CTX_set1_curves_list.

Parameters

ctx:long: context to use
curves:String[]: the curves to use.

Returns:boolean

true if successful, false otherwise.

setCurvesList0	back to summary
private static native boolean setCurvesList0(long ctx, String curves)

setMaxCertList

back to summary

public static native void setMaxCertList(long ctx, int size)

Set the maximum number of bytes for the certificate chain during handshake. See SSL_CTX_set_max_cert_list for more details.

Parameters

ctx:long: context to use
size:int: the maximum number of bytes

setMode

back to summary

public static native int setMode(long ctx, int mode)

Call SSL_CTX_set_mode

Parameters

ctx:long: context to use
mode:int: the mode

Returns:int

the set mode.

setNpnProtos back to summary

public static void setNpnProtos(long ctx, String[] nextProtos, int selectorFailureBehavior)

Set next protocol for next protocol negotiation extension

Parameters

ctx:long: Server context to use.
nextProtos:String[]: protocols in priority order
selectorFailureBehavior:int: see SSL#SSL_SELECTOR_FAILURE_NO_ADVERTISE and SSL#SSL_SELECTOR_FAILURE_CHOOSE_MY_LAST_PROTOCOL

setNpnProtos0	back to summary
private static native void setNpnProtos0(long ctx, byte[] nextProtos, int selectorFailureBehavior)

setNumTickets back to summary

public static native boolean setNumTickets(long ctx, int tickets)

Set the number of TLSv1.3 session tickets that will be sent to the client after a full handshake. See SSL_CTX_set_num_tickets for more details.

Parameters

ctx:long: context to use
tickets:int: the number of tickets

Returns:boolean

true if successful, false otherwise.

setOptions

back to summary

public static native void setOptions(long ctx, int options)

Set OpenSSL Option.

Parameters

ctx:long: Server or Client context to use.
options:int: See SSL.SSL_OP_* for option flags.

setPrivateKeyMethod back to summary

public static void setPrivateKeyMethod(long ctx, final SSLPrivateKeyMethod method)

Set the SSLPrivateKeyMethod to use for the given SSLContext. This allows to offload private key operations if needed. This method is currently only supported when BoringSSL is used.

Parameters

ctx:long: context to use
method:SSLPrivateKeyMethod: method to use for the given context.

setPrivateKeyMethod back to summary

public static void setPrivateKeyMethod(long ctx, AsyncSSLPrivateKeyMethod method)

Sets the AsyncSSLPrivateKeyMethod to use for the given SSLContext. This allows to offload private key operations if needed. This method is currently only supported when BoringSSL is used.

Parameters

ctx:long: context to use
method:AsyncSSLPrivateKeyMethod: method to use for the given context.

setPrivateKeyMethod0	back to summary
private static native void setPrivateKeyMethod0(long ctx, AsyncSSLPrivateKeyMethod method)

setSessionCacheMode

back to summary

public static native long setSessionCacheMode(long ctx, long mode)

Set the mode of the internal session cache and return the previous used mode.

Parameters

ctx:long: Server or Client context to use
mode:long: the mode of the cache

Returns:long

the previous set value

setSessionCacheSize

back to summary

public static native long setSessionCacheSize(long ctx, long size)

Set the size of the internal session cache. See man SSL_CTX_sess_set_cache_size

Parameters

ctx:long: Server or Client context to use.
size:long: the size of the cache

Returns:long

the previous set value

setSessionCacheTimeout

back to summary

public static native long setSessionCacheTimeout(long ctx, long timeoutSeconds)

Set the timeout for the internal session cache in seconds. See man SSL_CTX_set_timeout

Parameters

ctx:long: Server or Client context to use.
timeoutSeconds:long: the timeout of the cache

Returns:long

the previous set value

setSessionIdContext back to summary

public static native boolean setSessionIdContext(long ctx, byte[] sidCtx)

Set the context within which session be reused (server side only). See man SSL_CTX_set_session_id_context

Parameters

ctx:long: Server context to use.
sidCtx:byte[]: can be any kind of binary data, it is therefore possible to use e.g. the name of the application and/or the hostname and/or service name

Returns:boolean

true if success, false otherwise.

setSessionTicketKeys back to summary

public static void setSessionTicketKeys(long ctx, SessionTicketKey[] keys)

Set TLS session ticket keys.

The first key in the list is the primary key. Tickets dervied from the other keys in the list will be accepted but updated to a new ticket using the primary key. This is useful for implementing ticket key rotation. See RFC 5077

Parameters

ctx:long: Server or Client context to use
keys:SessionTicketKey[]: the SessionTicketKeys

setSessionTicketKeys0	back to summary
private static native void setSessionTicketKeys0(long ctx, byte[] keys) Set TLS session keys.

setSniHostnameMatcher back to summary

public static native void setSniHostnameMatcher(long ctx, SniHostNameMatcher matcher)

Allow to hook SniHostNameMatcher into the sni processing. This will call SSL_CTX_set_tlsext_servername_callback and so replace the default callback used by openssl

Parameters

ctx:long: Server or Client context to use.
matcher:SniHostNameMatcher: the matcher to call during sni hostname matching.

setSSLSessionCache back to summary

public static native void setSSLSessionCache(long ctx, SSLSessionCache cache)

Set the SSLSessionCache that will be used if session caching is enabled.

Parameters

ctx:long: context to use.
cache:SSLSessionCache: cache to use for the given context.

setTmpDHLength

back to summary

public static native void setTmpDHLength(long ctx, int length)

Set length of the DH to use.

Parameters

ctx:long: Server context to use.
length:int: the length.

setUseTasks back to summary

public static native void setUseTasks(long ctx, boolean useTasks)

Enable or disable producing of tasks that should be obtained via SSL#getTask(long) and run.

Parameters

ctx:long: context to use
useTasks:boolean: true to enable, false to disable.

setVerify back to summary

public static native void setVerify(long ctx, int level, int depth)

Set Type of Client Certificate verification and Maximum depth of CA Certificates in Client Certificate verification.
This directive sets the Certificate verification level for the Client Authentication. Notice that this directive can be used both in per-server and per-directory context. In per-server context it applies to the client authentication process used in the standard SSL handshake when a connection is established. In per-directory context it forces a SSL renegotiation with the reconfigured client verification level after the HTTP request was read but before the HTTP response is sent.
The following levels are available for level:

SSL#SSL_CVERIFY_IGNORED - The level is ignored. Only depth will change.
SSL#SSL_CVERIFY_NONE - No client Certificate is required at all
SSL#SSL_CVERIFY_OPTIONAL - The client may present a valid Certificate
SSL#SSL_CVERIFY_REQUIRED - The client has to present a valid Certificate

The depth actually is the maximum number of intermediate certificate issuers, i.e. the number of CA certificates which are max allowed to be followed while verifying the client certificate. A depth of 0 means that self-signed client certificates are accepted only, the default depth of 1 means the client certificate can be self-signed or has to be signed by a CA which is directly known to the server (i.e. the CA's certificate is under setCACertificatePath), etc.

Parameters

ctx:long: Server or Client context to use.
level:int: Type of Client Certificate verification.
depth:int: Maximum depth of CA Certificates in Client Certificate verification.

public final Class SSLContext

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail