Deprecated
(4.3) use SSLConnectionSocketFactory.
SSLSocketFactory can be used to validate the identity of the HTTPS server against a list of trusted certificates and to authenticate to the HTTPS server using a private key.
SSLSocketFactory will enable server authentication when supplied with
a trust-store file containing one or several trusted certificates. The client
secure socket will reject the connection during the SSL session handshake if the target HTTPS
server attempts to authenticate itself with a non-trusted certificate.
Use JDK keytool utility to import a trusted certificate and generate a trust-store file:
keytool -import -alias "my server cert" -file server.crt -keystore my.truststore
In special cases the standard trust verification process can be bypassed by using a custom
TrustStrategy. This interface is primarily intended for allowing self-signed
certificates to be accepted as trusted without having to add them to the trust-store file.
SSLSocketFactory will enable client authentication when supplied with
a key-store file containing a private key/public certificate
pair. The client secure socket will use the private key to authenticate
itself to the target HTTPS server during the SSL session handshake if
requested to do so by the server.
The target HTTPS server will in its turn verify the certificate presented
by the client in order to establish client's authenticity.
Use the following sequence of actions to generate a key-store file
Use JDK keytool utility to generate a new key
keytool -genkey -v -alias "my client key" -validity 365 -keystore my.keystore
For simplicity use the same password for the key as that of the key-store
Issue a certificate signing request (CSR)
keytool -certreq -alias "my client key" -file mycertreq.csr -keystore my.keystore
Send the certificate request to the trusted Certificate Authority for signature. One may choose to act as her own CA and sign the certificate request using a PKI tool, such as OpenSSL.
Import the trusted CA root certificate
keytool -import -alias "my trusted ca" -file caroot.crt -keystore my.keystore
Import the PKCS#7 file containg the complete certificate chain
keytool -import -alias "my client key" -file mycert.p7 -keystore my.keystore
Verify the content the resultant keystore file
keytool -list -v -keystore my.keystore
| Modifier and Type | Field and Description |
|---|---|
| public static final X509HostnameVerifier | ALLOW_ALL_HOSTNAME_VERIFIER
Deprecated
as a consequence of
X509HostnameVerifier being deprecated.
|
| public static final X509HostnameVerifier | BROWSER_COMPATIBLE_HOSTNAME_VERIFIER
Deprecated
as a consequence of
X509HostnameVerifier being deprecated.
|
| private volatile X509HostnameVerifier | hostnameVerifier
Deprecated
as a consequence of
X509HostnameVerifier being deprecated.
|
| private final HostNameResolver | nameResolver
Deprecated
as a consequence of
HostNameResolver being deprecated.
|
| private final SSLSocketFactory | |
| public static final String | |
| public static final String | |
| public static final X509HostnameVerifier | STRICT_HOSTNAME_VERIFIER
Deprecated
as a consequence of
X509HostnameVerifier being deprecated.
|
| private final String[] | |
| private final String[] | |
| public static final String |
| Access | Constructor and Description |
|---|---|
| public | SSLSocketFactory(final String algorithm, final KeyStore keystore, final String keyPassword, final KeyStore truststore, final SecureRandom random, final HostNameResolver nameResolver)
Deprecated
as a consequence of
HostNameResolver being deprecated.
|
| public | SSLSocketFactory(final String algorithm, final KeyStore keystore, final String keyPassword, final KeyStore truststore, final SecureRandom random, final TrustStrategy trustStrategy, final X509HostnameVerifier hostnameVerifier)
Deprecated
as a consequence of
X509HostnameVerifier being deprecated.
|
| public | SSLSocketFactory(final String algorithm, final KeyStore keystore, final String keyPassword, final KeyStore truststore, final SecureRandom random, final X509HostnameVerifier hostnameVerifier)
Deprecated
as a consequence of
X509HostnameVerifier being deprecated.
|
| public | |
| public | |
| public | |
| public | SSLSocketFactory(final TrustStrategy trustStrategy, final X509HostnameVerifier hostnameVerifier)
Deprecated
as a consequence of
X509HostnameVerifier being deprecated.
|
| public | |
| public | |
| public | SSLSocketFactory(final SSLContext sslContext, final HostNameResolver nameResolver)
Deprecated
as a consequence of
HostNameResolver being deprecated.
|
| public | SSLSocketFactory(final SSLContext sslContext, final X509HostnameVerifier hostnameVerifier)
Deprecated
as a consequence of
X509HostnameVerifier being deprecated.
|
| public | SSLSocketFactory(final SSLContext sslContext, final String[] supportedProtocols, final String[] supportedCipherSuites, final X509HostnameVerifier hostnameVerifier)
Deprecated
as a consequence of
X509HostnameVerifier being deprecated.
|
| public | SSLSocketFactory(final SSLSocketFactory socketfactory, final X509HostnameVerifier hostnameVerifier)
Deprecated
as a consequence of
X509HostnameVerifier being deprecated.
|
| public | SSLSocketFactory(final SSLSocketFactory socketfactory, final String[] supportedProtocols, final String[] supportedCipherSuites, final X509HostnameVerifier hostnameVerifier)
Deprecated
as a consequence of
X509HostnameVerifier being deprecated.
|
| Modifier and Type | Method and Description |
|---|---|
| public Socket | connectSocket(final Socket
the socket to connect, as obtained from
socket, final InetSocketAddress createSocket.
null indicates that a new socket
should be created and connected.the remote address to connect to. remoteAddress, final InetSocketAddress the local address to bind the socket to, or
localAddress, final HttpParams null for anyadditional params)parameters for connectingImplements org.
Deprecated
as a consequence of
Connects a socket to the target host with the given remote address.
HttpParams being deprecated.
|
| public Socket | connectSocket(final Socket
the socket to connect, as obtained from
socket, final String createSocket.
null indicates that a new socket
should be created and connected.the host to connect to host, final int the port to connect to on the host port, final InetAddress the local address to bind the socket to, or
local, final int null for anythe port on the local machine,
0 or a negative number for any localPort, final HttpParams additional params)parameters for connectingImplements org.
Deprecated
as a consequence of
Connects a socket to the given host.
HttpParams being deprecated.
|
| public Socket | connectSocket(final int
connect timeout. connectTimeout, final Socket the socket to connect, as obtained from socket, final HttpHost createSocket(HttpContext).
null indicates that a new socket should be created and connected.target host as specified by the caller (end user). host, final InetSocketAddress the resolved remote address to connect to. remoteAddress, final InetSocketAddress the local address to bind the socket to, or localAddress, final HttpContext null for any.the actual HTTP context. context)Implements org. |
| public Socket | createLayeredSocket(final Socket
the existing socket socket, final String the name of the target host. host, final int the port to connect to on the target host port, final HttpParams HTTP parameters params)Implements org.
Deprecated
as a consequence of
Returns a socket connected to the given host that is layered over an
existing socket.
HttpParams being deprecated.
|
| public Socket | createLayeredSocket(final Socket
the existing socket socket, final String the name of the target host. host, final int the port to connect to on the target host port, final boolean a flag for closing the underling socket when the created
socket is closed autoClose)Implements org. |
| public Socket | createLayeredSocket(final Socket
the existing socket socket, final String the name of the target host. target, final int the port to connect to on the target host. port, final HttpContext the actual HTTP context. context)Implements org. |
| public Socket | createSocket(final HttpParams
Optional parameters. Parameters passed to this method will have no effect.
This method will create a unconnected instance of params)Socket class.Implements org.
Deprecated
as a consequence of
Creates a new, unconnected socket.
HttpParams being deprecated.
|
| public Socket | createSocket()
Implements org. |
| public Socket | createSocket(final Socket
the existing socket socket, final String the host name/IP host, final int the port on the host port, final boolean a flag for closing the underling socket when the created
socket is closed autoClose)Implements org. |
| public Socket | createSocket(final HttpContext context)
Implements org. |
| public X509HostnameVerifier | |
| public static SSLSocketFactory | Returns: default SSL socket factory
Deprecated
as a consequence of
Obtains default SSL socket factory with an SSL context based on the standard JSSE
trust material (SSLSocketFactory being deprecated.
cacerts file in the security properties directory).
|
| public static SSLSocketFactory | Returns: default system SSL socket factory
Deprecated
as a consequence of
Obtains default SSL socket factory with an SSL context based on system properties
as described in
"JavaTM Secure Socket Extension (JSSE) Reference Guide for the JavaTM 2 Platform
Standard Edition 5
SSLSocketFactory being deprecated.
|
| private void | |
| public boolean | Returns: truethe connected socket sock)Implements org. |
| protected void | prepareSocket(final SSLSocket socket)
Performs any custom initialization for a newly created SSLSocket (before the SSL handshake happens). |
| public void | setHostnameVerifier(final X509HostnameVerifier hostnameVerifier)
Deprecated
as a consequence of
X509HostnameVerifier being deprecated.
|
| private static String[] | |
| private void |
| ALLOW_ALL_HOSTNAME_VERIFIER | back to summary |
|---|---|
| public static final X509HostnameVerifier ALLOW_ALL_HOSTNAME_VERIFIER
Deprecated as a consequence of | |
| BROWSER_COMPATIBLE_HOSTNAME_VERIFIER | back to summary |
|---|---|
| public static final X509HostnameVerifier BROWSER_COMPATIBLE_HOSTNAME_VERIFIER
Deprecated as a consequence of | |
| hostnameVerifier | back to summary |
|---|---|
| private volatile X509HostnameVerifier hostnameVerifier
Deprecated as a consequence of | |
| nameResolver | back to summary |
|---|---|
| private final HostNameResolver nameResolver
Deprecated as a consequence of | |
| socketfactory | back to summary |
|---|---|
| private final SSLSocketFactory socketfactory | |
| SSL | back to summary |
|---|---|
| public static final String SSL | |
| SSLV2 | back to summary |
|---|---|
| public static final String SSLV2 | |
| STRICT_HOSTNAME_VERIFIER | back to summary |
|---|---|
| public static final X509HostnameVerifier STRICT_HOSTNAME_VERIFIER
Deprecated as a consequence of | |
| supportedCipherSuites | back to summary |
|---|---|
| private final String[] supportedCipherSuites | |
| supportedProtocols | back to summary |
|---|---|
| private final String[] supportedProtocols | |
| TLS | back to summary |
|---|---|
| public static final String TLS | |
| SSLSocketFactory | back to summary |
|---|---|
| public SSLSocketFactory(final String algorithm, final KeyStore keystore, final String keyPassword, final KeyStore truststore, final SecureRandom random, final HostNameResolver nameResolver) throws NoSuchAlgorithmException, KeyManagementException, KeyStoreException, UnrecoverableKeyException
Deprecated as a consequence of | |
| SSLSocketFactory | back to summary |
|---|---|
| public SSLSocketFactory(final String algorithm, final KeyStore keystore, final String keyPassword, final KeyStore truststore, final SecureRandom random, final TrustStrategy trustStrategy, final X509HostnameVerifier hostnameVerifier) throws NoSuchAlgorithmException, KeyManagementException, KeyStoreException, UnrecoverableKeyException
Deprecated as a consequence of
| |
| SSLSocketFactory | back to summary |
|---|---|
| public SSLSocketFactory(final String algorithm, final KeyStore keystore, final String keyPassword, final KeyStore truststore, final SecureRandom random, final X509HostnameVerifier hostnameVerifier) throws NoSuchAlgorithmException, KeyManagementException, KeyStoreException, UnrecoverableKeyException
Deprecated as a consequence of
| |
| SSLSocketFactory | back to summary |
|---|---|
| public SSLSocketFactory(final KeyStore keystore, final String keystorePassword, final KeyStore truststore) throws NoSuchAlgorithmException, KeyManagementException, KeyStoreException, UnrecoverableKeyException | |
| SSLSocketFactory | back to summary |
|---|---|
| public SSLSocketFactory(final KeyStore keystore, final String keystorePassword) throws NoSuchAlgorithmException, KeyManagementException, KeyStoreException, UnrecoverableKeyException | |
| SSLSocketFactory | back to summary |
|---|---|
| public SSLSocketFactory(final KeyStore truststore) throws NoSuchAlgorithmException, KeyManagementException, KeyStoreException, UnrecoverableKeyException | |
| SSLSocketFactory | back to summary |
|---|---|
| public SSLSocketFactory(final TrustStrategy trustStrategy, final X509HostnameVerifier hostnameVerifier) throws NoSuchAlgorithmException, KeyManagementException, KeyStoreException, UnrecoverableKeyException
Deprecated as a consequence of
| |
| SSLSocketFactory | back to summary |
|---|---|
public SSLSocketFactory(final TrustStrategy trustStrategy) throws NoSuchAlgorithmException, KeyManagementException, KeyStoreException, UnrecoverableKeyException
| |
| SSLSocketFactory | back to summary |
|---|---|
| public SSLSocketFactory(final SSLContext sslContext) | |
| SSLSocketFactory | back to summary |
|---|---|
| public SSLSocketFactory(final SSLContext sslContext, final HostNameResolver nameResolver)
Deprecated as a consequence of | |
| SSLSocketFactory | back to summary |
|---|---|
| public SSLSocketFactory(final SSLContext sslContext, final X509HostnameVerifier hostnameVerifier)
Deprecated as a consequence of
| |
| SSLSocketFactory | back to summary |
|---|---|
| public SSLSocketFactory(final SSLContext sslContext, final String[] supportedProtocols, final String[] supportedCipherSuites, final X509HostnameVerifier hostnameVerifier)
Deprecated as a consequence of
| |
| SSLSocketFactory | back to summary |
|---|---|
| public SSLSocketFactory(final SSLSocketFactory socketfactory, final X509HostnameVerifier hostnameVerifier)
Deprecated as a consequence of
| |
| SSLSocketFactory | back to summary |
|---|---|
| public SSLSocketFactory(final SSLSocketFactory socketfactory, final String[] supportedProtocols, final String[] supportedCipherSuites, final X509HostnameVerifier hostnameVerifier)
Deprecated as a consequence of
| |
| connectSocket | back to summary |
|---|---|
| public Socket connectSocket(final Socket socket, final InetSocketAddress remoteAddress, final InetSocketAddress localAddress, final HttpParams params) throws IOException, UnknownHostException, ConnectTimeoutException Implements org. Doc from org. Deprecated as a consequence of Connects a socket to the target host with the given remote address.
Please note that
| |
| connectSocket | back to summary |
|---|---|
| public Socket connectSocket(final Socket socket, final String host, final int port, final InetAddress local, final int localPort, final HttpParams params) throws IOException, UnknownHostException, ConnectTimeoutException Implements org. Doc from org. Deprecated as a consequence of Connects a socket to the given host.
| |
| connectSocket | back to summary |
|---|---|
| public Socket connectSocket(final int connectTimeout, final Socket socket, final HttpHost host, final InetSocketAddress remoteAddress, final InetSocketAddress localAddress, final HttpContext context) throws IOException Implements org. Doc from org. Connects the socket to the target host with the given resolved remote address.
| |
| createLayeredSocket | back to summary |
|---|---|
| public Socket createLayeredSocket(final Socket socket, final String host, final int port, final HttpParams params) throws IOException, UnknownHostException Implements org. Doc from org. Deprecated as a consequence of Returns a socket connected to the given host that is layered over an existing socket. Used primarily for creating secure sockets through proxies.
| |
| createLayeredSocket | back to summary |
|---|---|
| public Socket createLayeredSocket(final Socket socket, final String host, final int port, final boolean autoClose) throws IOException, UnknownHostException Implements org. Doc from org. Returns a socket connected to the given host that is layered over an existing socket. Used primarily for creating secure sockets through proxies.
| |
| createLayeredSocket | back to summary |
|---|---|
| public Socket createLayeredSocket(final Socket socket, final String target, final int port, final HttpContext context) throws IOException Implements org. Doc from org. Returns a socket connected to the given host that is layered over an existing socket. Used primarily for creating secure sockets through proxies.
| |
| createSocket | back to summary |
|---|---|
| public Socket createSocket(final HttpParams params) throws IOException Implements org. Doc from org. Deprecated as a consequence of Creates a new, unconnected socket. The socket should subsequently be passed to
| |
| createSocket | back to summary |
|---|---|
| public Socket createSocket() throws IOException Implements org. Doc from org. Creates a new, unconnected socket.
The socket should subsequently be passed to
| |
| createSocket | back to summary |
|---|---|
| public Socket createSocket(final Socket socket, final String host, final int port, final boolean autoClose) throws IOException, UnknownHostException Implements org. Doc from org. Returns a socket connected to the given host that is layered over an existing socket. Used primarily for creating secure sockets through proxies.
| |
| createSocket | back to summary |
|---|---|
| public Socket createSocket(final HttpContext context) throws IOException Implements org. Doc from org. Creates new, unconnected socket. The socket should subsequently be passed to
| |
| getHostnameVerifier | back to summary |
|---|---|
| public X509HostnameVerifier getHostnameVerifier()
Deprecated as a consequence of | |
| getSocketFactory | back to summary |
|---|---|
| public static SSLSocketFactory getSocketFactory() throws SSLInitializationException
Deprecated as a consequence of Obtains default SSL socket factory with an SSL context based on the standard JSSE
trust material (
| |
| getSystemSocketFactory | back to summary |
|---|---|
| public static SSLSocketFactory getSystemSocketFactory() throws SSLInitializationException
Deprecated as a consequence of Obtains default SSL socket factory with an SSL context based on system properties as described in "JavaTM Secure Socket Extension (JSSE) Reference Guide for the JavaTM 2 Platform Standard Edition 5
| |
| internalPrepareSocket | back to summary |
|---|---|
| private void internalPrepareSocket(final SSLSocket socket) throws IOException | |
| isSecure | back to summary |
|---|---|
| public boolean isSecure(final Socket sock) throws IllegalArgumentException Implements org. Checks whether a socket connection is secure. This factory creates TLS/SSL socket connections which, by default, are considered secure. Derived classes may override this method to perform runtime checks, for example based on the cypher suite.
| |
| prepareSocket | back to summary |
|---|---|
| protected void prepareSocket(final SSLSocket socket) throws IOException Performs any custom initialization for a newly created SSLSocket
(before the SSL handshake happens).
The default implementation is a no-op, but could be overridden to, e.g.,
call
| |
| setHostnameVerifier | back to summary |
|---|---|
| public void setHostnameVerifier(final X509HostnameVerifier hostnameVerifier)
Deprecated as a consequence of | |
| split | back to summary |
|---|---|
| private static String[] split(final String s) | |
| verifyHostname | back to summary |
|---|---|
| private void verifyHostname(final SSLSocket sslsock, final String hostname) throws IOException | |