Top Description Fields Constructors Methods
org.apache.tomcat.util.net

public abstract Class SSLUtilBase

extends Object
implements SSLUtil
Class Inheritance
All Implemented Interfaces
org.apache.tomcat.util.net.SSLUtil
Known Direct Subclasses
org.apache.tomcat.util.net.jsse.JSSEUtil, org.apache.tomcat.util.net.openssl.OpenSSLUtil
Imports
java.io.BufferedReader, .IOException, .InputStream, .InputStreamReader, java.net.URI, java.nio.charset.StandardCharsets, java.security.DomainLoadStoreParameter, .Key, .KeyStore, java.security.cert.CRL, .CRLException, .CertPathParameters, .CertStore, .CertStoreParameters, .Certificate, .CertificateException, .CertificateExpiredException, .CertificateFactory, .CertificateNotYetValidException, .CollectionCertStoreParameters, .PKIXBuilderParameters, .X509CertSelector, .X509Certificate, java.util.ArrayList, .Collection, .Collections, .Date, .Enumeration, .List, .Locale, .Set, javax.net.ssl.CertPathTrustManagerParameters, .KeyManager, .KeyManagerFactory, .ManagerFactoryParameters, .SSLSessionContext, .TrustManager, .TrustManagerFactory, .X509KeyManager, org.apache.juli.logging.Log, .LogFactory, org.apache.tomcat.util.file.ConfigFileLoader, org.apache.tomcat.util.net.jsse.JSSEKeyManager, .PEMFile, org.apache.tomcat.util.res.StringManager, org.apache.tomcat.util.security.KeyStoreUtil
Common base class for SSLUtil implementations.

Field Summary

Modifier and TypeField and Description
protected final SSLHostConfigCertificate
certificate

public static final String
DEFAULT_KEY_ALIAS

private final String[]
enabledCiphers

private final String[]
enabledProtocols

private static final Log
log

private static final StringManager
sm

protected final SSLHostConfig
sslHostConfig

Constructor Summary

AccessConstructor and Description
protected
SSLUtilBase(SSLHostConfigCertificate certificate)

protected
SSLUtilBase(SSLHostConfigCertificate certificate, boolean warnTls13)

Method Summary

Modifier and TypeMethod and Description
private void
checkTrustStoreEntries(KeyStore trustStore)

public void
configureSessionContext(SSLSessionContext sslSessionContext)

Implements org.apache.tomcat.util.net.SSLUtil.configureSessionContext.

public final SSLContext
createSSLContext(List<String> negotiableProtocols)

Implements org.apache.tomcat.util.net.SSLUtil.createSSLContext.

protected abstract SSLContext
createSSLContextInternal(List<String> negotiableProtocols)

protected Collection<? extends CRL>

Returns:

the CRLs collection
getCRLs(String
The path to the CRL file.
crlf)

Load the collection of CRLs.

pack-priv static <T> List<T>
getEnabled(String name, Log log, boolean warnOnSkip, Collection<T> configured, Collection<T> implemented)

public String[]
getEnabledCiphers()

Implements org.apache.tomcat.util.net.SSLUtil.getEnabledCiphers.

The set of enabled ciphers is the intersection of the implemented ciphers and the configured ciphers.

public String[]
getEnabledProtocols()

Implements org.apache.tomcat.util.net.SSLUtil.getEnabledProtocols.

The set of enabled protocols is the intersection of the implemented protocols and the configured protocols.

protected abstract Set<String>
getImplementedCiphers()

protected abstract Set<String>
getImplementedProtocols()

public KeyManager[]
getKeyManagers()

Implements org.apache.tomcat.util.net.SSLUtil.getKeyManagers.

protected abstract Log
getLog()

protected CertPathParameters

Returns:

The parameters including the CRLs and TrustStore.
getParameters(String
The path to the CRL file.
crlf, KeyStore
The configured TrustStore.
trustStore, boolean
Should the JSSE provider perform revocation checks? Ignored if crlf is non-null. Configuration of revocation checks are expected to be via proprietary JSSE provider methods.
revocationEnabled)

Return the initialization parameters for the TrustManager.

pack-priv static KeyStore
getStore(String type, String provider, String path, String pass, String passFile)

public TrustManager[]
getTrustManagers()

Implements org.apache.tomcat.util.net.SSLUtil.getTrustManagers.

protected abstract boolean
isTls13RenegAuthAvailable()

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

certificateback to summary
protected final SSLHostConfigCertificate certificate
DEFAULT_KEY_ALIASback to summary
public static final String DEFAULT_KEY_ALIAS
enabledCiphersback to summary
private final String[] enabledCiphers
enabledProtocolsback to summary
private final String[] enabledProtocols
logback to summary
private static final Log log
smback to summary
private static final StringManager sm
sslHostConfigback to summary
protected final SSLHostConfig sslHostConfig

Constructor Detail

SSLUtilBaseback to summary
protected SSLUtilBase(SSLHostConfigCertificate certificate)
SSLUtilBaseback to summary
protected SSLUtilBase(SSLHostConfigCertificate certificate, boolean warnTls13)

Method Detail

checkTrustStoreEntriesback to summary
private void checkTrustStoreEntries(KeyStore trustStore) throws Exception
configureSessionContextback to summary
public void configureSessionContext(SSLSessionContext sslSessionContext)

Implements org.apache.tomcat.util.net.SSLUtil.configureSessionContext.

Annotations
@Override
createSSLContextback to summary
public final SSLContext createSSLContext(List<String> negotiableProtocols) throws Exception

Implements org.apache.tomcat.util.net.SSLUtil.createSSLContext.

Annotations
@Override
createSSLContextInternalback to summary
protected abstract SSLContext createSSLContextInternal(List<String> negotiableProtocols) throws Exception
getCRLsback to summary
protected Collection<? extends CRL> getCRLs(String crlf) throws IOException, CRLException, CertificateException

Load the collection of CRLs.

Parameters
crlf:String

The path to the CRL file.

Returns:Collection<? extends CRL>

the CRLs collection

Exceptions
IOException:
Error reading CRL file
CRLException:
CRL error
CertificateException:
Error processing certificate
getEnabledback to summary
pack-priv static <T> List<T> getEnabled(String name, Log log, boolean warnOnSkip, Collection<T> configured, Collection<T> implemented)
getEnabledCiphersback to summary
public String[] getEnabledCiphers()

Implements org.apache.tomcat.util.net.SSLUtil.getEnabledCiphers.

Doc from org.apache.tomcat.util.net.SSLUtil.getEnabledCiphers.

The set of enabled ciphers is the intersection of the implemented ciphers and the configured ciphers. If no ciphers are explicitly configured, then the default ciphers will be included in the returned array.

The ciphers used during the TLS handshake may be further restricted by the getEnabledProtocols() and the certificates.

Returns:String[]

The ciphers currently enabled and available for clients to select from for the associated connection

Annotations
@Override
getEnabledProtocolsback to summary
public String[] getEnabledProtocols()

Implements org.apache.tomcat.util.net.SSLUtil.getEnabledProtocols.

Doc from org.apache.tomcat.util.net.SSLUtil.getEnabledProtocols.

The set of enabled protocols is the intersection of the implemented protocols and the configured protocols. If no protocols are explicitly configured, then all of the implemented protocols will be included in the returned array.

Returns:String[]

The protocols currently enabled and available for clients to select from for the associated connection

Annotations
@Override
getImplementedCiphersback to summary
protected abstract Set<String> getImplementedCiphers()
getImplementedProtocolsback to summary
protected abstract Set<String> getImplementedProtocols()
getKeyManagersback to summary
public KeyManager[] getKeyManagers() throws Exception

Implements org.apache.tomcat.util.net.SSLUtil.getKeyManagers.

Annotations
@Override
getLogback to summary
protected abstract Log getLog()
getParametersback to summary
protected CertPathParameters getParameters(String crlf, KeyStore trustStore, boolean revocationEnabled) throws Exception

Return the initialization parameters for the TrustManager. Currently, only the default PKIX is supported.

Parameters
crlf:String

The path to the CRL file.

trustStore:KeyStore

The configured TrustStore.

revocationEnabled:boolean

Should the JSSE provider perform revocation checks? Ignored if crlf is non-null. Configuration of revocation checks are expected to be via proprietary JSSE provider methods.

Returns:CertPathParameters

The parameters including the CRLs and TrustStore.

Exceptions
Exception:
An error occurred
getStoreback to summary
pack-priv static KeyStore getStore(String type, String provider, String path, String pass, String passFile) throws IOException
getTrustManagersback to summary
public TrustManager[] getTrustManagers() throws Exception

Implements org.apache.tomcat.util.net.SSLUtil.getTrustManagers.

Annotations
@Override
isTls13RenegAuthAvailableback to summary
protected abstract boolean isTls13RenegAuthAvailable()