Top Description Inners Fields Constructors Methods
org.eclipse.jetty.util.ssl

public Class SniX509ExtendedKeyManager

extends X509ExtendedKeyManager
Class Inheritance
Imports
java.net.Socket, java.security.Principal, .PrivateKey, java.security.cert.X509Certificate, java.util.Arrays, .Collection, .Collections, .LinkedHashMap, .List, .Map, .Objects, java.util.function.UnaryOperator, java.util.stream.Collectors, javax.net.ssl.ExtendedSSLSession, .SNIHostName, .SNIMatcher, .SNIServerName, .SSLEngine, .SSLHandshakeException, .SSLSession, .SSLSocket, .X509ExtendedKeyManager, org.slf4j.Logger, .LoggerFactory

A X509ExtendedKeyManager that selects a key with an alias retrieved from SNI information, delegating other processing to a nested X509ExtendedKeyManager.

Can only be used on server side.

Nested and Inner Type Summary

Modifier and TypeClass and Description
public static interface
SniX509ExtendedKeyManager.SniSelector

Selects a certificate based on SNI information.

Field Summary

Modifier and TypeField and Description
private UnaryOperator<String>
_aliasMapper

private final X509ExtendedKeyManager
_delegate

private final SslContextFactory.Server
_sslContextFactory

private static final Logger
LOG

Constructor Summary

AccessConstructor and Description
public
SniX509ExtendedKeyManager(X509ExtendedKeyManager keyManager, SslContextFactory.Server sslContextFactory)

Method Summary

Modifier and TypeMethod and Description
public String
chooseClientAlias(String[]
the key algorithm type name(s), ordered with the most-preferred key type first.
keyType, Principal[]
the list of acceptable CA issuer subject names or null if it does not matter which issuers are used.
issuers, Socket
the socket to be used for this connection. This parameter can be null, which indicates that implementations are free to select an alias applicable to any socket.
socket)

Implements javax.net.ssl.X509KeyManager.chooseClientAlias.

Choose an alias to authenticate the client side of a secure socket given the public key type and the list of certificate issuer authorities recognized by the peer (if any).
public String
chooseEngineClientAlias(String[]
the key algorithm type name(s), ordered with the most-preferred key type first.
keyType, Principal[]
the list of acceptable CA issuer subject names or null if it does not matter which issuers are used.
issuers, SSLEngine
the SSLEngine to be used for this connection. This parameter can be null, which indicates that implementations of this interface are free to select an alias applicable to any engine.
engine)

Overrides javax.net.ssl.X509ExtendedKeyManager.chooseEngineClientAlias.

Choose an alias to authenticate the client side of an SSLEngine connection given the public key type and the list of certificate issuer authorities recognized by the peer (if any).
public String
chooseEngineServerAlias(String
the key algorithm type name.
keyType, Principal[]
the list of acceptable CA issuer subject names or null if it does not matter which issuers are used.
issuers, SSLEngine
the SSLEngine to be used for this connection. This parameter can be null, which indicates that implementations of this interface are free to select an alias applicable to any engine.
engine)

Overrides javax.net.ssl.X509ExtendedKeyManager.chooseEngineServerAlias.

Choose an alias to authenticate the server side of an SSLEngine connection given the public key type and the list of certificate issuer authorities recognized by the peer (if any).
protected String
chooseServerAlias(String keyType, Principal[] issuers, Collection<SNIMatcher> matchers, SSLSession session)

public String
chooseServerAlias(String
the key algorithm type name.
keyType, Principal[]
the list of acceptable CA issuer subject names or null if it does not matter which issuers are used.
issuers, Socket
the socket to be used for this connection. This parameter can be null, which indicates that implementations are free to select an alias applicable to any socket.
socket)

Implements javax.net.ssl.X509KeyManager.chooseServerAlias.

Choose an alias to authenticate the server side of a secure socket given the public key type and the list of certificate issuer authorities recognized by the peer (if any).
public UnaryOperator<String>

Returns:

the function that transforms the alias
getAliasMapper()

public X509Certificate[]
getCertificateChain(String
the alias name
alias)

Implements javax.net.ssl.X509KeyManager.getCertificateChain.

Returns the certificate chain associated with the given alias.
public String[]
getClientAliases(String
the key algorithm type name
keyType, Principal[]
the list of acceptable CA issuer subject names, or null if it does not matter which issuers are used.
issuers)

Implements javax.net.ssl.X509KeyManager.getClientAliases.

Get the matching aliases for authenticating the client side of a secure socket given the public key type and the list of certificate issuer authorities recognized by the peer (if any).
public PrivateKey
getPrivateKey(String
the alias name
alias)

Implements javax.net.ssl.X509KeyManager.getPrivateKey.

Returns the key associated with the given alias.
public String[]
getServerAliases(String
the key algorithm type name
keyType, Principal[]
the list of acceptable CA issuer subject names or null if it does not matter which issuers are used.
issuers)

Implements javax.net.ssl.X509KeyManager.getServerAliases.

Get the matching aliases for authenticating the server side of a secure socket given the public key type and the list of certificate issuer authorities recognized by the peer (if any).
public void
setAliasMapper(UnaryOperator<String>
the function that transforms the alias
aliasMapper)

Sets a function that transforms the alias into a possibly different alias, invoked when the SNI logic must choose the alias to pick the right certificate.

Field Detail

_aliasMapperback to summary
private UnaryOperator<String> _aliasMapper
_delegateback to summary
private final X509ExtendedKeyManager _delegate
_sslContextFactoryback to summary
private final SslContextFactory.Server _sslContextFactory
LOGback to summary
private static final Logger LOG

Constructor Detail

SniX509ExtendedKeyManagerback to summary
public SniX509ExtendedKeyManager(X509ExtendedKeyManager keyManager, SslContextFactory.Server sslContextFactory)

Method Detail

chooseClientAliasback to summary
public String chooseClientAlias(String[] keyType, Principal[] issuers, Socket socket)

Implements javax.net.ssl.X509KeyManager.chooseClientAlias.

Doc from javax.net.ssl.X509KeyManager.chooseClientAlias.

Choose an alias to authenticate the client side of a secure socket given the public key type and the list of certificate issuer authorities recognized by the peer (if any).

Parameters
keyType:String[]

the key algorithm type name(s), ordered with the most-preferred key type first.

issuers:Principal[]

the list of acceptable CA issuer subject names or null if it does not matter which issuers are used.

socket:Socket

the socket to be used for this connection. This parameter can be null, which indicates that implementations are free to select an alias applicable to any socket.

Returns:String

the alias name for the desired key, or null if there are no matches.

Annotations
@Override
chooseEngineClientAliasback to summary
public String chooseEngineClientAlias(String[] keyType, Principal[] issuers, SSLEngine engine)

Overrides javax.net.ssl.X509ExtendedKeyManager.chooseEngineClientAlias.

Doc from javax.net.ssl.X509ExtendedKeyManager.chooseEngineClientAlias.

Choose an alias to authenticate the client side of an SSLEngine connection given the public key type and the list of certificate issuer authorities recognized by the peer (if any).

The default implementation returns null.

Parameters
keyType:String[]

the key algorithm type name(s), ordered with the most-preferred key type first.

issuers:Principal[]

the list of acceptable CA issuer subject names or null if it does not matter which issuers are used.

engine:SSLEngine

the SSLEngine to be used for this connection. This parameter can be null, which indicates that implementations of this interface are free to select an alias applicable to any engine.

Returns:String

the alias name for the desired key, or null if there are no matches.

Annotations
@Override
chooseEngineServerAliasback to summary
public String chooseEngineServerAlias(String keyType, Principal[] issuers, SSLEngine engine)

Overrides javax.net.ssl.X509ExtendedKeyManager.chooseEngineServerAlias.

Doc from javax.net.ssl.X509ExtendedKeyManager.chooseEngineServerAlias.

Choose an alias to authenticate the server side of an SSLEngine connection given the public key type and the list of certificate issuer authorities recognized by the peer (if any).

The default implementation returns null.

Parameters
keyType:String

the key algorithm type name.

issuers:Principal[]

the list of acceptable CA issuer subject names or null if it does not matter which issuers are used.

engine:SSLEngine

the SSLEngine to be used for this connection. This parameter can be null, which indicates that implementations of this interface are free to select an alias applicable to any engine.

Returns:String

the alias name for the desired key, or null if there are no matches.

Annotations
@Override
chooseServerAliasback to summary
protected String chooseServerAlias(String keyType, Principal[] issuers, Collection<SNIMatcher> matchers, SSLSession session)
chooseServerAliasback to summary
public String chooseServerAlias(String keyType, Principal[] issuers, Socket socket)

Implements javax.net.ssl.X509KeyManager.chooseServerAlias.

Doc from javax.net.ssl.X509KeyManager.chooseServerAlias.

Choose an alias to authenticate the server side of a secure socket given the public key type and the list of certificate issuer authorities recognized by the peer (if any).

Parameters
keyType:String

the key algorithm type name.

issuers:Principal[]

the list of acceptable CA issuer subject names or null if it does not matter which issuers are used.

socket:Socket

the socket to be used for this connection. This parameter can be null, which indicates that implementations are free to select an alias applicable to any socket.

Returns:String

the alias name for the desired key, or null if there are no matches.

Annotations
@Override
getAliasMapperback to summary
public UnaryOperator<String> getAliasMapper()
Returns:UnaryOperator<String>

the function that transforms the alias

See Also
setAliasMapper(UnaryOperator)
getCertificateChainback to summary
public X509Certificate[] getCertificateChain(String alias)

Implements javax.net.ssl.X509KeyManager.getCertificateChain.

Doc from javax.net.ssl.X509KeyManager.getCertificateChain.

Returns the certificate chain associated with the given alias.

Parameters
alias:String

the alias name

Returns:X509Certificate[]

the certificate chain (ordered with the user's certificate first and the root certificate authority last), or null if the alias can't be found.

Annotations
@Override
getClientAliasesback to summary
public String[] getClientAliases(String keyType, Principal[] issuers)

Implements javax.net.ssl.X509KeyManager.getClientAliases.

Doc from javax.net.ssl.X509KeyManager.getClientAliases.

Get the matching aliases for authenticating the client side of a secure socket given the public key type and the list of certificate issuer authorities recognized by the peer (if any).

Parameters
keyType:String

the key algorithm type name

issuers:Principal[]

the list of acceptable CA issuer subject names, or null if it does not matter which issuers are used.

Returns:String[]

an array of the matching alias names, or null if there were no matches.

Annotations
@Override
getPrivateKeyback to summary
public PrivateKey getPrivateKey(String alias)

Implements javax.net.ssl.X509KeyManager.getPrivateKey.

Doc from javax.net.ssl.X509KeyManager.getPrivateKey.

Returns the key associated with the given alias.

Parameters
alias:String

the alias name

Returns:PrivateKey

the requested key, or null if the alias can't be found.

Annotations
@Override
getServerAliasesback to summary
public String[] getServerAliases(String keyType, Principal[] issuers)

Implements javax.net.ssl.X509KeyManager.getServerAliases.

Doc from javax.net.ssl.X509KeyManager.getServerAliases.

Get the matching aliases for authenticating the server side of a secure socket given the public key type and the list of certificate issuer authorities recognized by the peer (if any).

Parameters
keyType:String

the key algorithm type name

issuers:Principal[]

the list of acceptable CA issuer subject names or null if it does not matter which issuers are used.

Returns:String[]

an array of the matching alias names, or null if there were no matches.

Annotations
@Override
setAliasMapperback to summary
public void setAliasMapper(UnaryOperator<String> aliasMapper)

Sets a function that transforms the alias into a possibly different alias, invoked when the SNI logic must choose the alias to pick the right certificate.

This function is required when using the PKIX KeyManagerFactory algorithm which suffers from bug https://bugs.openjdk.java.net/browse/JDK-8246262, where aliases are returned by the OpenJDK implementation to the application in the form N.0.alias where N is an always increasing number. Such mangled aliases won't match the aliases in the keystore, so that for example SNI matching will always fail.

Other implementations such as BouncyCastle have been reported to mangle the alias in a different way, namely 0.alias.N.

This function allows to "unmangle" the alias from the implementation specific mangling back to just alias so that SNI matching will work again.

Parameters
aliasMapper:UnaryOperator<String>

the function that transforms the alias

org.eclipse.jetty.util.ssl back to summary

public Interface SniX509ExtendedKeyManager.SniSelector

Known Direct Implementers
org.eclipse.jetty.util.ssl.SslContextFactory.Server
Annotations
@FunctionalInterface

Selects a certificate based on SNI information.

Field Summary

Modifier and TypeField and Description
public static final String
DELEGATE

Method Summary

Modifier and TypeMethod and Description
public String

Returns:

the alias of the certificate to return to the client, from the certificates list, or SniSelector#DELEGATE if the certificate choice should be delegated to the nested key manager or null for no match.
sniSelect(String
the key algorithm type name
keyType, Principal[]
the list of acceptable CA issuer subject names or null if it does not matter which issuers are used
issuers, SSLSession
the TLS handshake session or null if not known.
session, String
the server name indication sent by the client, or null if the client did not send the server name indication
sniHost, Collection<X509>
the list of certificates matching keyType and issuers known to this SslContextFactory
certificates)

Selects a certificate based on SNI information.

Field Detail

DELEGATEback to summary
public static final String DELEGATE

Method Detail

sniSelectback to summary
public String sniSelect(String keyType, Principal[] issuers, SSLSession session, String sniHost, Collection<X509> certificates) throws SSLHandshakeException

Selects a certificate based on SNI information.

This method may be invoked multiple times during the TLS handshake, with different parameters. For example, the keyType could be different, and subsequently the collection of certificates (because they need to match the keyType).

Parameters
keyType:String

the key algorithm type name

issuers:Principal[]

the list of acceptable CA issuer subject names or null if it does not matter which issuers are used

session:SSLSession

the TLS handshake session or null if not known.

sniHost:String

the server name indication sent by the client, or null if the client did not send the server name indication

certificates:Collection<X509>

the list of certificates matching keyType and issuers known to this SslContextFactory

Returns:String

the alias of the certificate to return to the client, from the certificates list, or SniSelector#DELEGATE if the certificate choice should be delegated to the nested key manager or null for no match.

Exceptions
SSLHandshakeException:
if the TLS handshake should be aborted