Core :: Utilities 12.0.6 · org.eclipse.jetty.util.ssl.SslContextFactory

Modifier and Type	Class and Description
pack-priv static class	SslContextFactory.AliasSNIMatcher
public static class	SslContextFactory.Client
private static class	SslContextFactory.Factory
public static class	SslContextFactory.Server
public static class	SslContextFactory.X509ExtendedKeyManagerWrapper A wrapper that delegates to another (if not `null`) X509ExtendedKeyManager.
public static class	SslContextFactory.X509ExtendedTrustManagerWrapper A wrapper that delegates to another (if not `null`) X509ExtendedTrustManager.

Modifier and Type	Field and Description
private final Map<String, X509>	_aliasX509
private String	_certAlias
private final Map<String, X509>	_certHosts
private final Map<String, X509>	_certWilds
private Comparator<String>	_cipherComparator
private String	_crlPath
private boolean	_enableCRLDP
private boolean	_enableOCSP
private String	_endpointIdentificationAlgorithm
private final Set<String>	_excludeCipherSuites
private final Set<String>	_excludeProtocols
private SslContextFactory.Factory	_factory
private HostnameVerifier	_hostnameVerifier
private final Set<String>	_includeCipherSuites
private final Set<String>	_includeProtocols
private String	_keyManagerFactoryAlgorithm
private Password	_keyManagerPassword
private Password	_keyStorePassword
private String	_keyStoreProvider
private Resource	_keyStoreResource
private String	_keyStoreType
private final AutoLock	_lock Hides org.eclipse.jetty.util.component.AbstractLifeCycle._lock.
private int	_maxCertPathLength
private String	_ocspResponderURL
private PKIXCertPathChecker	_pkixCertPathChecker
private boolean	_renegotiationAllowed
private int	_renegotiationLimit
private String	_secureRandomAlgorithm
private String[]	_selectedCipherSuites
private String[]	_selectedProtocols
private boolean	_sessionCachingEnabled
private SSLContext	_setContext
private KeyStore	_setKeyStore
private KeyStore	_setTrustStore
private String	_sslProtocol
private String	_sslProvider
private int	_sslSessionCacheSize
private int	_sslSessionTimeout
private boolean	_trustAll
private String	_trustManagerFactoryAlgorithm
private Password	_trustStorePassword
private String	_trustStoreProvider
private Resource	_trustStoreResource
private String	_trustStoreType
private boolean	_useCipherSuitesOrder
private boolean	_validateCerts
private boolean	_validatePeerCerts
private CertificateFactory	_x509CertificateFactory
private static final String[]	DEFAULT_EXCLUDED_CIPHER_SUITES Default Excluded Cipher Suite List
private static final String[]	DEFAULT_EXCLUDED_PROTOCOLS Default Excluded Protocols List
public static final String	DEFAULT_KEYMANAGERFACTORY_ALGORITHM
public static final String	DEFAULT_TRUSTMANAGERFACTORY_ALGORITHM
private static final Pattern	KEY_SIZE_PATTERN
public static final String	KEYPASSWORD_PROPERTY String name of key password property.
private static final Logger	LOG Hides org.eclipse.jetty.util.component.ContainerLifeCycle.LOG.
private static final Logger	LOG_CONFIG
public static final String	PASSWORD_PROPERTY String name of keystore password property.
public static final TrustManager[]	TRUST_ALL_CERTS
private static final String	X_509

Access	Constructor and Description
protected	SslContextFactory() Construct an instance of SslContextFactory with the default configuration.
public	SslContextFactory(boolean whether to blindly trust all certificates trustAll) Construct an instance of SslContextFactory that trusts all certificates

Method Summary

Modifier and Type	Method and Description
public void	addExcludeCipherSuites(String... Cipher names to add to `SSLEngine#setEnabledCipherSuites(String[])` cipher) You can either use the exact Cipher suite name or a a regular expression.
public void	addExcludeProtocols(String... Protocol name patterns to add to `SSLEngine#setEnabledProtocols(String[])` protocol) You can either use the exact Protocol name or a a regular expression.
pack-priv Map<String, X509>	aliasCerts()
protected void	checkCiphers(SSLParameters supported)
protected void	checkConfiguration()
protected void	checkEndPointIdentificationAlgorithm()
private void	checkIsStarted() Check if the lifecycle has been started and throw runtime exception
protected void	checkProtocols(SSLParameters supported)
protected void	checkTrustAll()
public void	customize(SSLEngine the SSLEngine to customize sslEngine) Customize an SslEngine instance with the configuration of this factory, by calling `customize(SSLParameters)`
public SSLParameters	Returns: The passed instance of sslParams (returned as a convenience) customize(SSLParameters The parameters to customize sslParams) Customize an SslParameters instance with the configuration of this factory.
public static int	Returns: int indicating the effective key entropy bit-length. deduceKeyLength(String String name of the TLS cipher suite. cipherSuite) Given the name of a TLS/SSL cipher suite, return an int representing it effective stream cipher key strength.
protected void	doStart() Overrides org.eclipse.jetty.util.component.ContainerLifeCycle.doStart. Creates the SSLContext object and starts the lifecycle
protected void	doStop() Overrides org.eclipse.jetty.util.component.ContainerLifeCycle.doStop. Stops the managed lifecycle beans in the reverse order they were added.
public String	dump() Overrides org.eclipse.jetty.util.component.ContainerLifeCycle.dump. Overrides default org.eclipse.jetty.util.component.Dumpable.dump.
public void	dump(Appendable The appendable to dump to out, String The indent to apply after any new lines. indent) Overrides org.eclipse.jetty.util.component.ContainerLifeCycle.dump. Implements org.eclipse.jetty.util.component.Dumpable.dump. Dump this object (and children) into an Appendable using the provided indent after any new lines.
public Set<String>	getAliases()
public String	Returns: Alias of SSL certificate for the connector getCertAlias()
public static X509Certificate[]	Returns: the certificate chain getCertChain(SSLSession the session to use for active peer certificates sslSession) Obtain the X509 Certificate Chain from the provided SSLSession using this SslContextFactory's optional Provider specific `CertificateFactory`.
protected CertificateFactory	getCertificateFactoryInstance(String type)
protected CertStore	getCertStoreInstance(Collection<? extends CRL> crls)
public Comparator<String>	getCipherComparator()
public String	Returns: Path to file that contains Certificate Revocation List getCrlPath()
public String	Returns: the endpoint identification algorithm getEndpointIdentificationAlgorithm()
public String[]	Returns: The array of cipher suite name patterns to exclude from `SSLEngine#setEnabledCipherSuites(String[])` getExcludeCipherSuites()
public String[]	Returns: The array of protocol names to exclude from `SSLEngine#setEnabledProtocols(String[])` getExcludeProtocols()
public HostnameVerifier	Returns: the HostnameVerifier used by a client to verify host names in the server certificate getHostnameVerifier() Get the HostnameVerifier used by a client to verify host names in the server certificate.
public String[]	Returns: The array of Cipher suite names to include in `SSLEngine#setEnabledCipherSuites(String[])` getIncludeCipherSuites()
public String[]	Returns: The array of protocol name patterns to include in `SSLEngine#setEnabledProtocols(String[])` getIncludeProtocols()
public String	Returns: The algorithm name (default "SunX509") used by the `KeyManagerFactory` getKeyManagerFactoryAlgorithm()
protected KeyManagerFactory	getKeyManagerFactoryInstance()
public String	getKeyManagerPassword()
protected KeyManager[]	getKeyManagers(KeyStore keyStore)
public KeyStore	getKeyStore()
public String	getKeyStorePassword()
public String	Returns: The file or URL of the SSL Key store. getKeyStorePath()
public String	Returns: The provider of the key store getKeyStoreProvider()
public Resource	getKeyStoreResource()
public String	Returns: The type of the key store (default "PKCS12") getKeyStoreType()
public int	Returns: Maximum number of intermediate certificates in the certification path (-1 for unlimited) getMaxCertPathLength()
public String	Returns: Location of the OCSP Responder getOcspResponderURL()
protected Password	Returns: the Password object getPassword(String the realm realm) Returns the password object for the given realm.
public PKIXCertPathChecker	getPkixCertPathChecker()
public String	Returns: The SSL protocol (default "TLS") passed to `SSLContext#getInstance(String, String)` getProtocol()
public String	Returns: The optional Security Provider name. getProvider() Get the optional Security Provider name.
public int	Returns: The number of renegotiations allowed for this connection. When the limit is 0 renegotiation will be denied. If the limit is less than 0 then no limit is applied. getRenegotiationLimit()
public String	Returns: The algorithm name, which if set is passed to `SecureRandom#getInstance(String)` to obtain the `SecureRandom` instance passed to `SSLContext#init(javax.net.ssl.KeyManager[], javax.net.ssl.TrustManager[], SecureRandom)` getSecureRandomAlgorithm()
protected SecureRandom	getSecureRandomInstance()
public String[]	getSelectedCipherSuites()
public String[]	getSelectedProtocols()
public SSLContext	Returns: The SSLContext getSslContext()
protected SSLContext	getSSLContextInstance()
public int	Returns: SSL session cache size getSslSessionCacheSize() Get SSL session cache size.
public int	Returns: SSL session timeout getSslSessionTimeout() Get SSL session timeout.
public String	Returns: The algorithm name (default "SunX509") used by the `TrustManagerFactory` getTrustManagerFactoryAlgorithm()
protected TrustManagerFactory	getTrustManagerFactoryInstance()
protected TrustManager[]	getTrustManagers(KeyStore trustStore, Collection<? extends CRL> crls)
public KeyStore	getTrustStore()
public String	getTrustStorePath()
public String	Returns: The provider of the trust store getTrustStoreProvider()
public Resource	getTrustStoreResource()
public String	Returns: The type of the trust store getTrustStoreType()
public X509	getX509(String alias)
public X509Certificate[]	Returns: the certificate chain getX509CertChain(SSLSession the session to use for active peer certificates sslSession) Obtain the X509 Certificate Chain from the provided SSLSession using this SslContextFactory's optional Provider specific `CertificateFactory`.
private static X509Certificate[]	getX509CertChain(CertificateFactory certificateFactory, SSLSession sslSession)
pack-priv Map<String, X509>	hostCerts()
public boolean	Returns: true if CRL Distribution Points support is enabled isEnableCRLDP()
public boolean	Returns: true if On-Line Certificate Status Protocol support is enabled isEnableOCSP()
public boolean	Returns: whether TLS renegotiation is allowed (true by default) isRenegotiationAllowed()
public boolean	Returns: true if SSL Session caching is enabled isSessionCachingEnabled()
public boolean	Returns: True if all certificates should be trusted if there is no KeyStore or TrustStore isTrustAll()
public boolean	isUseCipherSuitesOrder()
public boolean	Returns: true if SSL certificate has to be validated isValidateCerts()
public boolean	Returns: true if SSL certificates of the peer have to be validated isValidatePeerCerts()
private void	load()
protected Collection<? extends CRL>	Returns: Collection of CRL's loadCRL(String path of certificate revocation list file crlPath) Loads certificate revocation list (CRL) from a file.
protected KeyStore	Returns: the key store instance loadKeyStore(Resource the resource to load the keystore from resource) Override this method to provide alternate way to load a keystore.
protected KeyStore	Returns: the key store instance loadTrustStore(Resource the resource to load the truststore from resource) Override this method to provide alternate way to load a truststore.
public Password	Returns: the new Password object newPassword(String the password string password) Creates a new Password object.
protected PKIXBuilderParameters	newPKIXBuilderParameters(KeyStore trustStore, Collection<? extends CRL> crls)
public SSLEngine	Returns: a new, "scratch" `SSLEngine` newSSLEngine() Factory method for "scratch" `SSLEngine`s, usually only used for retrieving configuration information such as the application buffer size or the list of protocols/ciphers.
public SSLEngine	Returns: a new `SSLEngine` newSSLEngine(String the remote host host, int the remote port port) General purpose factory method for creating `SSLEngine`s, although creation of `SSLEngine`s on the server-side should prefer `newSSLEngine(InetSocketAddress)`.
public SSLEngine	Returns: a new `SSLEngine` newSSLEngine(InetSocketAddress the remote peer address address) Server-side only factory method for creating `SSLEngine`s.
public SSLServerSocket	newSslServerSocket(String host, int port, int backlog)
public SSLSocket	newSslSocket()
protected void	processIncludeCipherSuites(String[] supportedCipherSuites, List<String> selectedCiphers) Deprecated no replacement
private List<String>	processIncludeExcludePatterns(String type, String[] enabled, String[] supported, Set<String> included, Set<String> excluded)
public void	reload(Consumer<SslContextFactory> consumer)
protected void	removeExcludedCipherSuites(List<String> selectedCiphers) Deprecated no replacement
protected void	selectCipherSuites(String[] Array of enabled cipher suites enabledCipherSuites, String[] Array of supported cipher suites supportedCipherSuites) Select cipher suites to be used by the connector based on configured inclusion and exclusion lists as well as enabled and supported cipher suite lists.
pack-priv List<SslSelectionDump>	selectionDump()
public void	selectProtocols(String[] Array of enabled protocols enabledProtocols, String[] Array of supported protocols supportedProtocols) Select protocols to be used by the connector based on configured inclusion and exclusion lists as well as enabled and supported protocols.
public void	setCertAlias(String Alias of SSL certificate for the connector certAlias) Set the default certificate Alias.
public void	setCipherComparator(Comparator<String> cipherComparator)
public void	setCrlPath(String Path to file that contains Certificate Revocation List crlPath)
public void	setEnableCRLDP(boolean true - turn on, false - turns off enableCRLDP) Enables CRL Distribution Points Support
public void	setEnableOCSP(boolean true - turn on, false - turn off enableOCSP) Enables On-Line Certificate Status Protocol support
public void	setEndpointIdentificationAlgorithm(String Set the endpointIdentificationAlgorithm endpointIdentificationAlgorithm) When set to "HTTPS" hostname verification will be enabled.
public void	setExcludeCipherSuites(String... The array of cipher suite names to exclude from `SSLEngine#setEnabledCipherSuites(String[])` cipherSuites) You can either use the exact Cipher suite name or a a regular expression.
public void	setExcludeProtocols(String... The array of protocol names to exclude from `SSLEngine#setEnabledProtocols(String[])` protocols) You can either use the exact Protocol name or a a regular expression.
public void	setHostnameVerifier(HostnameVerifier the HostnameVerifier used by a client to verify host names in the server certificate hostnameVerifier) Sets a `HostnameVerifier` used by a client to verify host names in the server certificate.
public void	setIncludeCipherSuites(String... The array of cipher suite names to include in `SSLEngine#setEnabledCipherSuites(String[])` cipherSuites) You can either use the exact Cipher suite name or a a regular expression.
public void	setIncludeProtocols(String... The array of protocol name patterns to include in `SSLEngine#setEnabledProtocols(String[])` protocols) You can either use the exact Protocol name or a a regular expression.
public void	setKeyManagerFactoryAlgorithm(String The algorithm name (default "SunX509") used by the `KeyManagerFactory` algorithm)
public void	setKeyManagerPassword(String The password (if any) for the specific key within the key store. If null is passed and the org.eclipse.jetty.ssl.keypassword system property is set, then the `getPassword(String)` is used to obtain a password from the org.eclipse.jetty.ssl.keypassword system property. password)
public void	setKeyStore(KeyStore the key store to set keyStore) Set the key store.
public void	setKeyStorePassword(String The password for the key store. If null is passed and a keystore is set, then the `getPassword(String)` is used to obtain a password either from the org.eclipse.jetty.ssl.password system property. password)
public void	setKeyStorePath(String The file or URL of the SSL Key store. keyStorePath)
public void	setKeyStoreProvider(String The provider of the key store keyStoreProvider)
public void	setKeyStoreResource(Resource the key store resource to set resource) Set the key store resource.
public void	setKeyStoreType(String The type of the key store keyStoreType)
public void	setMaxCertPathLength(int maximum number of intermediate certificates in the certification path (-1 for unlimited) maxCertPathLength)
public void	setOcspResponderURL(String location of the OCSP Responder ocspResponderURL) Set the location of the OCSP Responder.
public void	setPkixCertPathChecker(PKIXCertPathChecker pkixCertPatchChecker)
public void	setProtocol(String The SSL protocol (default "TLS") passed to `SSLContext#getInstance(String, String)` protocol)
public void	setProvider(String The optional Security Provider name. provider) Set the optional Security Provider name.
public void	setRenegotiationAllowed(boolean whether TLS renegotiation is allowed renegotiationAllowed) Set whether TLS renegotiation is allowed.
public void	setRenegotiationLimit(int The number of renegotions allowed for this connection. When the limit is 0 renegotiation will be denied. If the limit is less than 0 then no limit is applied. Default 5. renegotiationLimit)
public void	setSecureRandomAlgorithm(String The algorithm name, which if set is passed to `SecureRandom#getInstance(String)` to obtain the `SecureRandom` instance passed to `SSLContext#init(javax.net.ssl.KeyManager[], javax.net.ssl.TrustManager[], SecureRandom)` algorithm)
public void	setSessionCachingEnabled(boolean the value of the flag enableSessionCaching) Set the flag to enable SSL Session caching.
public void	setSslContext(SSLContext Set a preconfigured SSLContext sslContext)
public void	setSslSessionCacheSize(int SSL session cache size to set. A value of -1 (default) uses the JVM default, 0 means unlimited and positive number is a max size. sslSessionCacheSize) Set SSL session cache size.
public void	setSslSessionTimeout(int SSL session timeout to set in seconds. A value of -1 (default) uses the JVM default, 0 means unlimited and positive number is a timeout in seconds. sslSessionTimeout) Set SSL session timeout.
public void	setTrustAll(boolean True if all certificates should be trusted if there is no KeyStore or TrustStore trustAll)
public void	setTrustManagerFactoryAlgorithm(String The algorithm name (default "SunX509") used by the `TrustManagerFactory` Use the string "TrustAll" to install a trust manager that trusts all. algorithm)
public void	setTrustStore(KeyStore the trust store to set trustStore) Set the trust store.
public void	setTrustStorePassword(String The password for the truststore. If null is passed then the `getPassword(String)` is used to obtain a password from the org.eclipse.jetty.ssl.password system property. password)
public void	setTrustStorePath(String The file name or URL of the trust store location trustStorePath)
public void	setTrustStoreProvider(String The provider of the trust store trustStoreProvider)
public void	setTrustStoreResource(Resource the trust store resource to set resource) Set the trust store resource.
public void	setTrustStoreType(String The type of the trust store trustStoreType)
public void	setUseCipherSuitesOrder(boolean useCipherSuitesOrder)
public void	setValidateCerts(boolean true if SSL certificates have to be validated validateCerts) Set true if SSL certificates have to be validated.
public void	setValidatePeerCerts(boolean true if SSL certificates of the peer have to be validated validatePeerCerts) Set true if SSL certificates of the peer have to be validated.
public String	toString() Overrides org.eclipse.jetty.util.component.AbstractLifeCycle.toString. Returns a string representation of the object.
private void	unload()
public void	validateCerts(X509Certificate[] certs)
pack-priv Map<String, X509>	wildCerts()

public abstract Class SslContextFactory

Nested and Inner Type Summary

Field Summary

Constructor Summary

Method Summary