Tomcat 10.1.19 · org.apache.tomcat.jni.SSLContext · APIdia, the JavaDoc alternative

Modifier and Type	Class and Description
public static interface	SSLContext.SNICallBack Interface implemented by components that will receive the call back to select an OpenSSL SSLContext based on the host name requested by the client.

Modifier and Type	Field and Description
public static final byte[]	DEFAULT_SESSION_ID_CONTEXT
private static final Map<Long, SSLContext.SNICallBack>	sniCallBacks A map of default SSL Contexts to SNICallBack instances (in Tomcat these are instances of AprEndpoint) that will be used to determine the SSL Context to use bases on the SNI host name.

Access	Constructor and Description
public	SSLContext()

Method Summary

Modifier and Type	Method and Description
public static native boolean	Returns: `true` if success, `false` otherwise. addChainCertificateRaw(long Server or Client context to use. ctx, byte[] Byte array with the certificate in DER encoding. cert) Add a certificate to the certificate chain.
public static native boolean	Returns: `true` if success, `false` otherwise. addClientCACertificateRaw(long Server or Client context to use. ctx, byte[] Byte array with the certificate in DER encoding. cert) Add a CA certificate we accept as issuer for peer certs
public static native void	clearOptions(long Server or Client context to use. ctx, int See SSL.SSL_OP_* for option flags. options) Clears OpenSSL Options.
public static native int	Returns: APR Status code. free(long Server or Client context to free. ctx) Free the resources used by the Context
public static native String[]	Returns: ciphers getCiphers(long Server or Client context to use. ctx) Returns all cipher suites that are enabled for negotiation in an SSL handshake.
public static native int	Returns: options See SSL.SSL_OP_* for option flags. getOptions(long Server or Client context to use. ctx) Get OpenSSL Option.
public static native long	Returns: the value set getSessionCacheMode(long Server or Client context to use. ctx) Get the mode of the current used internal session cache.
public static native long	Returns: the size getSessionCacheSize(long Server or Client context to use. ctx) Get the size of the internal session cache.
public static native long	Returns: the timeout getSessionCacheTimeout(long Server or Client context to use. ctx) Get the timeout for the internal session cache in seconds.
public static native long	Returns: The Java representation of a pointer to the newly created SSL Context make(long The pool to use. pool, int The SSL protocol to use. It can be any combination of the following: `SSL#SSL_PROTOCOL_SSLV2` `SSL#SSL_PROTOCOL_SSLV3` `SSL#SSL_PROTOCOL_TLSV1` `SSL#SSL_PROTOCOL_TLSV1_1` `SSL#SSL_PROTOCOL_TLSV1_2` `SSL#SSL_PROTOCOL_TLSV1_3` `SSL#SSL_PROTOCOL_ALL` ( == all TLS versions, no SSL) protocol, int SSL mode to use SSL_MODE_CLIENT SSL_MODE_SERVER SSL_MODE_COMBINED mode) Create a new SSL context.
public static native long	sessionAccept(long ctx)
public static native long	sessionAcceptGood(long ctx)
public static native long	sessionAcceptRenegotiate(long ctx)
public static native long	sessionCacheFull(long ctx)
public static native long	sessionCbHits(long ctx)
public static native long	sessionConnect(long ctx)
public static native long	sessionConnectGood(long ctx)
public static native long	sessionConnectRenegotiate(long ctx)
public static native long	sessionHits(long ctx)
public static native long	sessionMisses(long ctx)
public static native long	sessionNumber(long ctx)
public static native long	sessionTimeouts(long ctx)
public static native void	setAlpnProtos(long Server context to use. ctx, String[] protocols in priority order alpnProtos, int see `SSL#SSL_SELECTOR_FAILURE_NO_ADVERTISE` and `SSL#SSL_SELECTOR_FAILURE_CHOOSE_MY_LAST_PROTOCOL` selectorFailureBehavior) Set application layer protocol for application layer protocol negotiation extension
public static native boolean	Returns: `true` if the operation was successful setCACertificate(long Server or Client context to use. ctx, String File of concatenated PEM-encoded CA Certificates for Client Auth. file, String Directory of PEM-encoded CA Certificates for Client Auth. path) Set File and Directory of concatenated PEM-encoded CA Certificates for Client Auth This directive sets the all-in-one file where you can assemble the Certificates of Certification Authorities (CA) whose clients you deal with.
public static native boolean	Returns: `true` if the operation was successful setCARevocation(long Server or Client context to use. ctx, String File of concatenated PEM-encoded CA CRLs for Client Auth. file, String Directory of PEM-encoded CA Certificates for Client Auth. path) Set File of concatenated PEM-encoded CA CRLs or directory of PEM-encoded CA Certificates for Client Auth This directive sets the all-in-one file where you can assemble the Certificate Revocation Lists (CRL) of Certification Authorities (CA) whose clients you deal with.
public static native boolean	Returns: `true` if the operation was successful setCertificate(long Server or Client context to use. ctx, String Certificate file. cert, String Private Key file to use if not in cert. key, String Certificate password. If null and certificate is encrypted, password prompt will be displayed. password, int Certificate index SSL_AIDX_RSA or SSL_AIDX_DSA. idx) Set Certificate Point setCertificateFile at a PEM encoded certificate.
public static native boolean	Returns: `true` if the operation was successful setCertificateChainFile(long Server or Client context to use. ctx, String File of PEM-encoded Server CA Certificates. file, boolean Skip first certificate if chain file is inside certificate file. skipfirst) Set File of PEM-encoded Server CA Certificates This directive sets the optional all-in-one file where you can assemble the certificates of Certification Authorities (CA) which form the certificate chain of the server certificate.
public static native boolean	Returns: `true` if success, `false` otherwise. setCertificateRaw(long Server or Client context to use. ctx, byte[] Byte array with the certificate in DER encoding. cert, byte[] Byte array with the Private Key file in PEM format. key, int Certificate index SSL_AIDX_RSA or SSL_AIDX_DSA. sslAidxRsa) Set CertificateRaw Use keystore a certificate and key to fill the BIOP
public static native void	setCertVerifyCallback(long Server or Client context to use. ctx, CertificateVerifier the verifier to call during handshake. verifier) Allow to hook `CertificateVerifier` into the handshake processing.
public static native boolean	Returns: `true` if the operation was successful setCipherSuite(long Server or Client context to use. ctx, String An OpenSSL cipher specification. ciphers) Cipher Suite available for negotiation in SSL handshake.
public static native void	setOptions(long Server or Client context to use. ctx, int See SSL.SSL_OP_* for option flags. options) Set OpenSSL Option.
public static native long	Returns: the value set setSessionCacheMode(long Server or Client context to use. ctx, long The mode to set mode) Set the mode of the internal session cache and return the previous used mode.
public static native long	Returns: the value set setSessionCacheSize(long Server or Client context to use. ctx, long The cache size size) Set the size of the internal session cache.
public static native long	Returns: the value set setSessionCacheTimeout(long Server or Client context to use. ctx, long Timeout value timeoutSeconds) Set the timeout for the internal session cache in seconds.
public static native boolean	Returns: `true` if success, `false` otherwise. setSessionIdContext(long Server context to use. ctx, byte[] can be any kind of binary data, it is therefore possible to use e.g. the name of the application and/or the hostname and/or service name sidCtx) Set the context within which session be reused (server side only) http://www.openssl.org/docs/ssl/SSL_CTX_set_session_id_context.html
public static native void	setSessionTicketKeys(long Server or Client context to use. ctx, byte[] Some session keys keys) Set TLS session keys.
public static native void	setVerify(long Server or Client context to use. ctx, int Type of Client Certificate verification. level, int Maximum depth of CA Certificates in Client Certificate verification. depth) Set Type of Client Certificate verification and Maximum depth of CA Certificates in Client Certificate verification.
public static long	Returns: The Java representation of the pointer to the OpenSSL SSLContext to use for the given host or zero if no SSLContext could be identified sniCallBack(long The OpenSSL SSLContext that the handshake started to use. This will be the default OpenSSL SSLContext for the endpoint associated with the socket. currentCtx, String The host name requested by the client sniHostName) When tc-native encounters a SNI extension in the TLS handshake it will call this method to determine which OpenSSL SSLContext to use for the connection.

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

DEFAULT_SESSION_ID_CONTEXT	back to summary
public static final byte[] DEFAULT_SESSION_ID_CONTEXT

sniCallBacks	back to summary
private static final Map<Long, SSLContext.SNICallBack> sniCallBacks A map of default SSL Contexts to SNICallBack instances (in Tomcat these are instances of AprEndpoint) that will be used to determine the SSL Context to use bases on the SNI host name. It is structured this way since a Tomcat instance may have several TLS enabled endpoints that each have different SSL Context mappings for the same host name.

SSLContext	back to summary
public SSLContext()

Method Detail

addChainCertificateRaw back to summary

addChainCertificateRaw	back to summary
public static native boolean addChainCertificateRaw(long ctx, byte[] cert) Add a certificate to the certificate chain. Certs should be added in order starting with the issuer of the host certs and working up the certificate chain to the CA. Use keystore a certificate chain to fill the BIOP Parameters ctx:long Server or Client context to use. cert:byte[] Byte array with the certificate in DER encoding. Returns:boolean `true` if success, `false` otherwise.

public static native boolean addChainCertificateRaw(long ctx, byte[] cert)

Add a certificate to the certificate chain. Certs should be added in order starting with the issuer of the host certs and working up the certificate chain to the CA.
Use keystore a certificate chain to fill the BIOP

Parameters

ctx:long: Server or Client context to use.
cert:byte[]: Byte array with the certificate in DER encoding.

Returns:boolean

true if success, false otherwise.

addClientCACertificateRaw back to summary

addClientCACertificateRaw	back to summary
public static native boolean addClientCACertificateRaw(long ctx, byte[] cert) Add a CA certificate we accept as issuer for peer certs Parameters ctx:long Server or Client context to use. cert:byte[] Byte array with the certificate in DER encoding. Returns:boolean `true` if success, `false` otherwise.

public static native boolean addClientCACertificateRaw(long ctx, byte[] cert)

Add a CA certificate we accept as issuer for peer certs

Parameters

ctx:long: Server or Client context to use.
cert:byte[]: Byte array with the certificate in DER encoding.

Returns:boolean

true if success, false otherwise.

clearOptions	back to summary
public static native void clearOptions(long ctx, int options) Clears OpenSSL Options. Parameters ctx:long Server or Client context to use. options:int See SSL.SSL_OP_* for option flags.

clearOptions

back to summary

public static native void clearOptions(long ctx, int options)

Clears OpenSSL Options.

Parameters

ctx:long: Server or Client context to use.
options:int: See SSL.SSL_OP_* for option flags.

free	back to summary
public static native int free(long ctx) Free the resources used by the Context Parameters ctx:long Server or Client context to free. Returns:int APR Status code.

free

back to summary

public static native int free(long ctx)

Free the resources used by the Context

Parameters

ctx:long: Server or Client context to free.

Returns:int

APR Status code.

getCiphers	back to summary
public static native String[] getCiphers(long ctx) Returns all cipher suites that are enabled for negotiation in an SSL handshake. Parameters ctx:long Server or Client context to use. Returns:String[] ciphers

getCiphers

back to summary

public static native String[] getCiphers(long ctx)

Returns all cipher suites that are enabled for negotiation in an SSL handshake.

Parameters

ctx:long: Server or Client context to use.

Returns:String[]

ciphers

getOptions	back to summary
public static native int getOptions(long ctx) Get OpenSSL Option. Parameters ctx:long Server or Client context to use. Returns:int options See SSL.SSL_OP_* for option flags.

getOptions

back to summary

public static native int getOptions(long ctx)

Get OpenSSL Option.

Parameters

ctx:long: Server or Client context to use.

Returns:int

options See SSL.SSL_OP_* for option flags.

getSessionCacheMode	back to summary
public static native long getSessionCacheMode(long ctx) Get the mode of the current used internal session cache. Parameters ctx:long Server or Client context to use. Returns:long the value set

getSessionCacheMode

back to summary

public static native long getSessionCacheMode(long ctx)

Get the mode of the current used internal session cache.

Parameters

ctx:long: Server or Client context to use.

Returns:long

the value set

getSessionCacheSize	back to summary
public static native long getSessionCacheSize(long ctx) Get the size of the internal session cache. http://www.openssl.org/docs/ssl/SSL_CTX_sess_get_cache_size.html Parameters ctx:long Server or Client context to use. Returns:long the size

getSessionCacheSize

back to summary

public static native long getSessionCacheSize(long ctx)

Get the size of the internal session cache. http://www.openssl.org/docs/ssl/SSL_CTX_sess_get_cache_size.html

Parameters

ctx:long: Server or Client context to use.

Returns:long

the size

getSessionCacheTimeout	back to summary
public static native long getSessionCacheTimeout(long ctx) Get the timeout for the internal session cache in seconds. http://www.openssl.org/docs/ssl/SSL_CTX_set_timeout.html Parameters ctx:long Server or Client context to use. Returns:long the timeout

getSessionCacheTimeout

back to summary

public static native long getSessionCacheTimeout(long ctx)

Get the timeout for the internal session cache in seconds. http://www.openssl.org/docs/ssl/SSL_CTX_set_timeout.html

Parameters

ctx:long: Server or Client context to use.

Returns:long

the timeout

make back to summary

make	back to summary
public static native long make(long pool, int protocol, int mode) throws Exception Create a new SSL context. Parameters pool:long The pool to use. protocol:int The SSL protocol to use. It can be any combination of the following: `SSL#SSL_PROTOCOL_SSLV2` `SSL#SSL_PROTOCOL_SSLV3` `SSL#SSL_PROTOCOL_TLSV1` `SSL#SSL_PROTOCOL_TLSV1_1` `SSL#SSL_PROTOCOL_TLSV1_2` `SSL#SSL_PROTOCOL_TLSV1_3` `SSL#SSL_PROTOCOL_ALL` ( == all TLS versions, no SSL) mode:int SSL mode to use SSL_MODE_CLIENT SSL_MODE_SERVER SSL_MODE_COMBINED Returns:long The Java representation of a pointer to the newly created SSL Context Exceptions Exception: If the SSL Context could not be created

public static native long make(long pool, int protocol, int mode) throws Exception

Create a new SSL context.

Parameters

pool:long

The pool to use.

protocol:int

The SSL protocol to use. It can be any combination of the following:

SSL#SSL_PROTOCOL_SSLV2
SSL#SSL_PROTOCOL_SSLV3
SSL#SSL_PROTOCOL_TLSV1
SSL#SSL_PROTOCOL_TLSV1_1
SSL#SSL_PROTOCOL_TLSV1_2
SSL#SSL_PROTOCOL_TLSV1_3
SSL#SSL_PROTOCOL_ALL ( == all TLS versions, no SSL)

mode:int

SSL mode to use

SSL_MODE_CLIENT
SSL_MODE_SERVER
SSL_MODE_COMBINED

Returns:long

The Java representation of a pointer to the newly created SSL Context

Exceptions

Exception:: If the SSL Context could not be created

sessionAccept	back to summary
public static native long sessionAccept(long ctx)

sessionAcceptGood	back to summary
public static native long sessionAcceptGood(long ctx)

sessionAcceptRenegotiate	back to summary
public static native long sessionAcceptRenegotiate(long ctx)

sessionCacheFull	back to summary
public static native long sessionCacheFull(long ctx)

sessionCbHits	back to summary
public static native long sessionCbHits(long ctx)

sessionConnect	back to summary
public static native long sessionConnect(long ctx)

sessionConnectGood	back to summary
public static native long sessionConnectGood(long ctx)

sessionConnectRenegotiate	back to summary
public static native long sessionConnectRenegotiate(long ctx)

sessionHits	back to summary
public static native long sessionHits(long ctx)

sessionMisses	back to summary
public static native long sessionMisses(long ctx)

sessionNumber	back to summary
public static native long sessionNumber(long ctx)

sessionTimeouts	back to summary
public static native long sessionTimeouts(long ctx)

setAlpnProtos back to summary

setAlpnProtos	back to summary
public static native void setAlpnProtos(long ctx, String[] alpnProtos, int selectorFailureBehavior) Set application layer protocol for application layer protocol negotiation extension Parameters ctx:long Server context to use. alpnProtos:String[] protocols in priority order selectorFailureBehavior:int see `SSL#SSL_SELECTOR_FAILURE_NO_ADVERTISE` and `SSL#SSL_SELECTOR_FAILURE_CHOOSE_MY_LAST_PROTOCOL`

public static native void setAlpnProtos(long ctx, String[] alpnProtos, int selectorFailureBehavior)

Set application layer protocol for application layer protocol negotiation extension

Parameters

ctx:long: Server context to use.
alpnProtos:String[]: protocols in priority order
selectorFailureBehavior:int: see SSL#SSL_SELECTOR_FAILURE_NO_ADVERTISE and SSL#SSL_SELECTOR_FAILURE_CHOOSE_MY_LAST_PROTOCOL

setCACertificate back to summary

setCACertificate	back to summary
public static native boolean setCACertificate(long ctx, String file, String path) throws Exception Set File and Directory of concatenated PEM-encoded CA Certificates for Client Auth This directive sets the all-in-one file where you can assemble the Certificates of Certification Authorities (CA) whose clients you deal with. These are used for Client Authentication. Such a file is simply the concatenation of the various PEM-encoded Certificate files, in order of preference. This can be used alternatively and/or additionally to path. The files in this directory have to be PEM-encoded and are accessed through hash filenames. So usually you can't just place the Certificate files there: you also have to create symbolic links named hash-value.N. And you should always make sure this directory contains the appropriate symbolic links. Use the Makefile which comes with mod_ssl to accomplish this task. Parameters ctx:long Server or Client context to use. file:String File of concatenated PEM-encoded CA Certificates for Client Auth. path:String Directory of PEM-encoded CA Certificates for Client Auth. Returns:boolean `true` if the operation was successful Exceptions Exception: An error occurred

public static native boolean setCACertificate(long ctx, String file, String path) throws Exception

Set File and Directory of concatenated PEM-encoded CA Certificates for Client Auth
This directive sets the all-in-one file where you can assemble the Certificates of Certification Authorities (CA) whose clients you deal with. These are used for Client Authentication. Such a file is simply the concatenation of the various PEM-encoded Certificate files, in order of preference. This can be used alternatively and/or additionally to path.
The files in this directory have to be PEM-encoded and are accessed through hash filenames. So usually you can't just place the Certificate files there: you also have to create symbolic links named hash-value.N. And you should always make sure this directory contains the appropriate symbolic links. Use the Makefile which comes with mod_ssl to accomplish this task.

Parameters

ctx:long: Server or Client context to use.
file:String: File of concatenated PEM-encoded CA Certificates for Client Auth.
path:String: Directory of PEM-encoded CA Certificates for Client Auth.

Returns:boolean

true if the operation was successful

Exceptions

Exception:: An error occurred

setCARevocation back to summary

setCARevocation	back to summary
public static native boolean setCARevocation(long ctx, String file, String path) throws Exception Set File of concatenated PEM-encoded CA CRLs or directory of PEM-encoded CA Certificates for Client Auth This directive sets the all-in-one file where you can assemble the Certificate Revocation Lists (CRL) of Certification Authorities (CA) whose clients you deal with. These are used for Client Authentication. Such a file is simply the concatenation of the various PEM-encoded CRL files, in order of preference. The files in this directory have to be PEM-encoded and are accessed through hash filenames. So usually you can't just place the Certificate files there: you also have to create symbolic links named hash-value.N. And you should always make sure this directory contains the appropriate symbolic links. Use the Makefile which comes with mod_ssl to accomplish this task. Parameters ctx:long Server or Client context to use. file:String File of concatenated PEM-encoded CA CRLs for Client Auth. path:String Directory of PEM-encoded CA Certificates for Client Auth. Returns:boolean `true` if the operation was successful Exceptions Exception: An error occurred

public static native boolean setCARevocation(long ctx, String file, String path) throws Exception

Set File of concatenated PEM-encoded CA CRLs or directory of PEM-encoded CA Certificates for Client Auth
This directive sets the all-in-one file where you can assemble the Certificate Revocation Lists (CRL) of Certification Authorities (CA) whose clients you deal with. These are used for Client Authentication. Such a file is simply the concatenation of the various PEM-encoded CRL files, in order of preference.
The files in this directory have to be PEM-encoded and are accessed through hash filenames. So usually you can't just place the Certificate files there: you also have to create symbolic links named hash-value.N. And you should always make sure this directory contains the appropriate symbolic links. Use the Makefile which comes with mod_ssl to accomplish this task.

Parameters

ctx:long: Server or Client context to use.
file:String: File of concatenated PEM-encoded CA CRLs for Client Auth.
path:String: Directory of PEM-encoded CA Certificates for Client Auth.

Returns:boolean

true if the operation was successful

Exceptions

Exception:: An error occurred

setCertificate back to summary

setCertificate	back to summary
public static native boolean setCertificate(long ctx, String cert, String key, String password, int idx) throws Exception Set Certificate Point setCertificateFile at a PEM encoded certificate. If the certificate is encrypted, then you will be prompted for a pass phrase. Note that a kill -HUP will prompt again. A test certificate can be generated with 'make certificate' under built time. Keep in mind that if you've both a RSA and a DSA certificate you can configure both in parallel (to also allow the use of DSA ciphers, etc.) If the key is not combined with the certificate, use key param to point at the key file. Keep in mind that if you've both a RSA and a DSA private key you can configure both in parallel (to also allow the use of DSA ciphers, etc.) Parameters ctx:long Server or Client context to use. cert:String Certificate file. key:String Private Key file to use if not in cert. password:String Certificate password. If null and certificate is encrypted, password prompt will be displayed. idx:int Certificate index SSL_AIDX_RSA or SSL_AIDX_DSA. Returns:boolean `true` if the operation was successful Exceptions Exception: An error occurred

public static native boolean setCertificate(long ctx, String cert, String key, String password, int idx) throws Exception

Set Certificate
Point setCertificateFile at a PEM encoded certificate. If the certificate is encrypted, then you will be prompted for a pass phrase. Note that a kill -HUP will prompt again. A test certificate can be generated with 'make certificate' under built time. Keep in mind that if you've both a RSA and a DSA certificate you can configure both in parallel (to also allow the use of DSA ciphers, etc.)
If the key is not combined with the certificate, use key param to point at the key file. Keep in mind that if you've both a RSA and a DSA private key you can configure both in parallel (to also allow the use of DSA ciphers, etc.)

Parameters

ctx:long: Server or Client context to use.
cert:String: Certificate file.
key:String: Private Key file to use if not in cert.
password:String: Certificate password. If null and certificate is encrypted, password prompt will be displayed.
idx:int: Certificate index SSL_AIDX_RSA or SSL_AIDX_DSA.

Returns:boolean

true if the operation was successful

Exceptions

Exception:: An error occurred

setCertificateChainFile back to summary

setCertificateChainFile	back to summary
public static native boolean setCertificateChainFile(long ctx, String file, boolean skipfirst) Set File of PEM-encoded Server CA Certificates This directive sets the optional all-in-one file where you can assemble the certificates of Certification Authorities (CA) which form the certificate chain of the server certificate. This starts with the issuing CA certificate of of the server certificate and can range up to the root CA certificate. Such a file is simply the concatenation of the various PEM-encoded CA Certificate files, usually in certificate chain order. But be careful: Providing the certificate chain works only if you are using a single (either RSA or DSA) based server certificate. If you are using a coupled RSA+DSA certificate pair, this will work only if actually both certificates use the same certificate chain. Else the browsers will be confused in this situation. Parameters ctx:long Server or Client context to use. file:String File of PEM-encoded Server CA Certificates. skipfirst:boolean Skip first certificate if chain file is inside certificate file. Returns:boolean `true` if the operation was successful

public static native boolean setCertificateChainFile(long ctx, String file, boolean skipfirst)

Set File of PEM-encoded Server CA Certificates
This directive sets the optional all-in-one file where you can assemble the certificates of Certification Authorities (CA) which form the certificate chain of the server certificate. This starts with the issuing CA certificate of of the server certificate and can range up to the root CA certificate. Such a file is simply the concatenation of the various PEM-encoded CA Certificate files, usually in certificate chain order.
But be careful: Providing the certificate chain works only if you are using a single (either RSA or DSA) based server certificate. If you are using a coupled RSA+DSA certificate pair, this will work only if actually both certificates use the same certificate chain. Else the browsers will be confused in this situation.

Parameters

ctx:long: Server or Client context to use.
file:String: File of PEM-encoded Server CA Certificates.
skipfirst:boolean: Skip first certificate if chain file is inside certificate file.

Returns:boolean

true if the operation was successful

setCertificateRaw back to summary

setCertificateRaw	back to summary
public static native boolean setCertificateRaw(long ctx, byte[] cert, byte[] key, int sslAidxRsa) Set CertificateRaw Use keystore a certificate and key to fill the BIOP Parameters ctx:long Server or Client context to use. cert:byte[] Byte array with the certificate in DER encoding. key:byte[] Byte array with the Private Key file in PEM format. sslAidxRsa:int Certificate index SSL_AIDX_RSA or SSL_AIDX_DSA. Returns:boolean `true` if success, `false` otherwise.

public static native boolean setCertificateRaw(long ctx, byte[] cert, byte[] key, int sslAidxRsa)

Set CertificateRaw
Use keystore a certificate and key to fill the BIOP

Parameters

ctx:long: Server or Client context to use.
cert:byte[]: Byte array with the certificate in DER encoding.
key:byte[]: Byte array with the Private Key file in PEM format.
sslAidxRsa:int: Certificate index SSL_AIDX_RSA or SSL_AIDX_DSA.

Returns:boolean

true if success, false otherwise.

setCertVerifyCallback back to summary

setCertVerifyCallback	back to summary
public static native void setCertVerifyCallback(long ctx, CertificateVerifier verifier) Allow to hook `CertificateVerifier` into the handshake processing. This will call `SSL_CTX_set_cert_verify_callback` and so replace the default verification callback used by openssl Parameters ctx:long Server or Client context to use. verifier:CertificateVerifier the verifier to call during handshake.

public static native void setCertVerifyCallback(long ctx, CertificateVerifier verifier)

Allow to hook CertificateVerifier into the handshake processing. This will call SSL_CTX_set_cert_verify_callback and so replace the default verification callback used by openssl

Parameters

ctx:long: Server or Client context to use.
verifier:CertificateVerifier: the verifier to call during handshake.

setCipherSuite back to summary

setCipherSuite	back to summary
public static native boolean setCipherSuite(long ctx, String ciphers) throws Exception Cipher Suite available for negotiation in SSL handshake. This complex directive uses a colon-separated cipher-spec string consisting of OpenSSL cipher specifications to configure the Cipher Suite the client is permitted to negotiate in the SSL handshake phase. Notice that this directive can be used both in per-server and per-directory context. In per-server context it applies to the standard SSL handshake when a connection is established. In per-directory context it forces an SSL renegotiation with the reconfigured Cipher Suite after the HTTP request was read but before the HTTP response is sent. Parameters ctx:long Server or Client context to use. ciphers:String An OpenSSL cipher specification. Returns:boolean `true` if the operation was successful Exceptions Exception: An error occurred

public static native boolean setCipherSuite(long ctx, String ciphers) throws Exception

Cipher Suite available for negotiation in SSL handshake.
This complex directive uses a colon-separated cipher-spec string consisting of OpenSSL cipher specifications to configure the Cipher Suite the client is permitted to negotiate in the SSL handshake phase. Notice that this directive can be used both in per-server and per-directory context. In per-server context it applies to the standard SSL handshake when a connection is established. In per-directory context it forces an SSL renegotiation with the reconfigured Cipher Suite after the HTTP request was read but before the HTTP response is sent.

Parameters

ctx:long: Server or Client context to use.
ciphers:String: An OpenSSL cipher specification.

Returns:boolean

true if the operation was successful

Exceptions

Exception:: An error occurred

setOptions	back to summary
public static native void setOptions(long ctx, int options) Set OpenSSL Option. Parameters ctx:long Server or Client context to use. options:int See SSL.SSL_OP_* for option flags.

setOptions

back to summary

public static native void setOptions(long ctx, int options)

Set OpenSSL Option.

Parameters

ctx:long: Server or Client context to use.
options:int: See SSL.SSL_OP_* for option flags.

setSessionCacheMode	back to summary
public static native long setSessionCacheMode(long ctx, long mode) Set the mode of the internal session cache and return the previous used mode. Parameters ctx:long Server or Client context to use. mode:long The mode to set Returns:long the value set

setSessionCacheMode

back to summary

public static native long setSessionCacheMode(long ctx, long mode)

Set the mode of the internal session cache and return the previous used mode.

Parameters

ctx:long: Server or Client context to use.
mode:long: The mode to set

Returns:long

the value set

setSessionCacheSize	back to summary
public static native long setSessionCacheSize(long ctx, long size) Set the size of the internal session cache. http://www.openssl.org/docs/ssl/SSL_CTX_sess_set_cache_size.html Parameters ctx:long Server or Client context to use. size:long The cache size Returns:long the value set

setSessionCacheSize

back to summary

public static native long setSessionCacheSize(long ctx, long size)

Set the size of the internal session cache. http://www.openssl.org/docs/ssl/SSL_CTX_sess_set_cache_size.html

Parameters

ctx:long: Server or Client context to use.
size:long: The cache size

Returns:long

the value set

setSessionCacheTimeout	back to summary
public static native long setSessionCacheTimeout(long ctx, long timeoutSeconds) Set the timeout for the internal session cache in seconds. http://www.openssl.org/docs/ssl/SSL_CTX_set_timeout.html Parameters ctx:long Server or Client context to use. timeoutSeconds:long Timeout value Returns:long the value set

setSessionCacheTimeout

back to summary

public static native long setSessionCacheTimeout(long ctx, long timeoutSeconds)

Set the timeout for the internal session cache in seconds. http://www.openssl.org/docs/ssl/SSL_CTX_set_timeout.html

Parameters

ctx:long: Server or Client context to use.
timeoutSeconds:long: Timeout value

Returns:long

the value set

setSessionIdContext back to summary

setSessionIdContext	back to summary
public static native boolean setSessionIdContext(long ctx, byte[] sidCtx) Set the context within which session be reused (server side only) http://www.openssl.org/docs/ssl/SSL_CTX_set_session_id_context.html Parameters ctx:long Server context to use. sidCtx:byte[] can be any kind of binary data, it is therefore possible to use e.g. the name of the application and/or the hostname and/or service name Returns:boolean `true` if success, `false` otherwise.

public static native boolean setSessionIdContext(long ctx, byte[] sidCtx)

Set the context within which session be reused (server side only) http://www.openssl.org/docs/ssl/SSL_CTX_set_session_id_context.html

Parameters

ctx:long: Server context to use.
sidCtx:byte[]: can be any kind of binary data, it is therefore possible to use e.g. the name of the application and/or the hostname and/or service name

Returns:boolean

true if success, false otherwise.

setSessionTicketKeys	back to summary
public static native void setSessionTicketKeys(long ctx, byte[] keys) Set TLS session keys. This allows us to share keys across TFEs. Parameters ctx:long Server or Client context to use. keys:byte[] Some session keys

setSessionTicketKeys

back to summary

public static native void setSessionTicketKeys(long ctx, byte[] keys)

Set TLS session keys. This allows us to share keys across TFEs.

Parameters

ctx:long: Server or Client context to use.
keys:byte[]: Some session keys

setVerify back to summary

setVerify	back to summary
public static native void setVerify(long ctx, int level, int depth) Set Type of Client Certificate verification and Maximum depth of CA Certificates in Client Certificate verification. This directive sets the Certificate verification level for the Client Authentication. Notice that this directive can be used both in per-server and per-directory context. In per-server context it applies to the client authentication process used in the standard SSL handshake when a connection is established. In per-directory context it forces an SSL renegotiation with the reconfigured client verification level after the HTTP request was read but before the HTTP response is sent. The following levels are available for level: SSL_CVERIFY_NONE - No client Certificate is required at all SSL_CVERIFY_OPTIONAL - The client may present a valid Certificate SSL_CVERIFY_REQUIRE - The client has to present a valid Certificate SSL_CVERIFY_OPTIONAL_NO_CA - The client may present a valid Certificate but it need not to be (successfully) verifiable The depth actually is the maximum number of intermediate certificate issuers, i.e. the number of CA certificates which are max allowed to be followed while verifying the client certificate. A depth of 0 means that self-signed client certificates are accepted only, the default depth of 1 means the client certificate can be self-signed or has to be signed by a CA which is directly known to the server (i.e. the CA's certificate is under `setCACertificatePath`), etc. Parameters ctx:long Server or Client context to use. level:int Type of Client Certificate verification. depth:int Maximum depth of CA Certificates in Client Certificate verification.

public static native void setVerify(long ctx, int level, int depth)

Set Type of Client Certificate verification and Maximum depth of CA Certificates in Client Certificate verification.
This directive sets the Certificate verification level for the Client Authentication. Notice that this directive can be used both in per-server and per-directory context. In per-server context it applies to the client authentication process used in the standard SSL handshake when a connection is established. In per-directory context it forces an SSL renegotiation with the reconfigured client verification level after the HTTP request was read but before the HTTP response is sent.
The following levels are available for level:

SSL_CVERIFY_NONE           - No client Certificate is required at all
SSL_CVERIFY_OPTIONAL       - The client may present a valid Certificate
SSL_CVERIFY_REQUIRE        - The client has to present a valid Certificate
SSL_CVERIFY_OPTIONAL_NO_CA - The client may present a valid Certificate
                             but it need not to be (successfully) verifiable

The depth actually is the maximum number of intermediate certificate issuers, i.e. the number of CA certificates which are max allowed to be followed while verifying the client certificate. A depth of 0 means that self-signed client certificates are accepted only, the default depth of 1 means the client certificate can be self-signed or has to be signed by a CA which is directly known to the server (i.e. the CA's certificate is under setCACertificatePath), etc.

Parameters

ctx:long: Server or Client context to use.
level:int: Type of Client Certificate verification.
depth:int: Maximum depth of CA Certificates in Client Certificate verification.

sniCallBack	back to summary
public static long sniCallBack(long currentCtx, String sniHostName) When tc-native encounters a SNI extension in the TLS handshake it will call this method to determine which OpenSSL SSLContext to use for the connection. Parameters currentCtx:long The OpenSSL SSLContext that the handshake started to use. This will be the default OpenSSL SSLContext for the endpoint associated with the socket. sniHostName:String The host name requested by the client Returns:long The Java representation of the pointer to the OpenSSL SSLContext to use for the given host or zero if no SSLContext could be identified

sniCallBack

back to summary

public static long sniCallBack(long currentCtx, String sniHostName)

When tc-native encounters a SNI extension in the TLS handshake it will call this method to determine which OpenSSL SSLContext to use for the connection.

Parameters

currentCtx:long: The OpenSSL SSLContext that the handshake started to use. This will be the default OpenSSL SSLContext for the endpoint associated with the socket.
sniHostName:String: The host name requested by the client

Returns:long

The Java representation of the pointer to the OpenSSL SSLContext to use for the given host or zero if no SSLContext could be identified

public final Class SSLContext

Nested and Inner Type Summary

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail

public Interface SSLContext.SNICallBack

Method Summary

Method Detail