Modifier and Type	Class and Description
public static interface	SniX509ExtendedKeyManager.SniSelector Selects a certificate based on SNI information.

Modifier and Type	Field and Description
private UnaryOperator<String>	_aliasMapper
private final X509ExtendedKeyManager	_delegate
private final SslContextFactory.Server	_sslContextFactory
private static final Logger	LOG

Access	Constructor and Description
public	SniX509ExtendedKeyManager(X509ExtendedKeyManager keyManager, SslContextFactory.Server sslContextFactory)

Method Summary

Modifier and Type	Method and Description
public String	chooseClientAlias(String[] the key algorithm type name(s), ordered with the most-preferred key type first. keyType, Principal[] the list of acceptable CA issuer subject names or null if it does not matter which issuers are used. issuers, Socket the socket to be used for this connection. This parameter can be null, which indicates that implementations are free to select an alias applicable to any socket. socket) Implements javax.net.ssl.X509KeyManager.chooseClientAlias. Choose an alias to authenticate the client side of a secure socket given the public key type and the list of certificate issuer authorities recognized by the peer (if any).
public String	chooseEngineClientAlias(String[] the key algorithm type name(s), ordered with the most-preferred key type first. keyType, Principal[] the list of acceptable CA issuer subject names or null if it does not matter which issuers are used. issuers, SSLEngine the `SSLEngine` to be used for this connection. This parameter can be null, which indicates that implementations of this interface are free to select an alias applicable to any engine. engine) Overrides javax.net.ssl.X509ExtendedKeyManager.chooseEngineClientAlias. Choose an alias to authenticate the client side of an `SSLEngine` connection given the public key type and the list of certificate issuer authorities recognized by the peer (if any).
public String	chooseEngineServerAlias(String the key algorithm type name. keyType, Principal[] the list of acceptable CA issuer subject names or null if it does not matter which issuers are used. issuers, SSLEngine the `SSLEngine` to be used for this connection. This parameter can be null, which indicates that implementations of this interface are free to select an alias applicable to any engine. engine) Overrides javax.net.ssl.X509ExtendedKeyManager.chooseEngineServerAlias. Choose an alias to authenticate the server side of an `SSLEngine` connection given the public key type and the list of certificate issuer authorities recognized by the peer (if any).
protected String	chooseServerAlias(String keyType, Principal[] issuers, Collection<SNIMatcher> matchers, SSLSession session)
public String	chooseServerAlias(String the key algorithm type name. keyType, Principal[] the list of acceptable CA issuer subject names or null if it does not matter which issuers are used. issuers, Socket the socket to be used for this connection. This parameter can be null, which indicates that implementations are free to select an alias applicable to any socket. socket) Implements javax.net.ssl.X509KeyManager.chooseServerAlias. Choose an alias to authenticate the server side of a secure socket given the public key type and the list of certificate issuer authorities recognized by the peer (if any).
public UnaryOperator<String>	getAliasMapper() Returns: the function that transforms the alias
public X509Certificate[]	getCertificateChain(String the alias name alias) Implements javax.net.ssl.X509KeyManager.getCertificateChain. Returns the certificate chain associated with the given alias.
public String[]	getClientAliases(String the key algorithm type name keyType, Principal[] the list of acceptable CA issuer subject names, or null if it does not matter which issuers are used. issuers) Implements javax.net.ssl.X509KeyManager.getClientAliases. Get the matching aliases for authenticating the client side of a secure socket given the public key type and the list of certificate issuer authorities recognized by the peer (if any).
public PrivateKey	getPrivateKey(String the alias name alias) Implements javax.net.ssl.X509KeyManager.getPrivateKey. Returns the key associated with the given alias.
public String[]	getServerAliases(String the key algorithm type name keyType, Principal[] the list of acceptable CA issuer subject names or null if it does not matter which issuers are used. issuers) Implements javax.net.ssl.X509KeyManager.getServerAliases. Get the matching aliases for authenticating the server side of a secure socket given the public key type and the list of certificate issuer authorities recognized by the peer (if any).
public void	setAliasMapper(UnaryOperator<String> the function that transforms the alias aliasMapper) Sets a function that transforms the alias into a possibly different alias, invoked when the SNI logic must choose the alias to pick the right certificate.

Field Detail

_aliasMapper	back to summary
private UnaryOperator<String> _aliasMapper

_delegate	back to summary
private final X509ExtendedKeyManager _delegate

_sslContextFactory	back to summary
private final SslContextFactory.Server _sslContextFactory

LOG	back to summary
private static final Logger LOG

Constructor Detail

SniX509ExtendedKeyManager	back to summary
public SniX509ExtendedKeyManager(X509ExtendedKeyManager keyManager, SslContextFactory.Server sslContextFactory)

Method Detail

chooseClientAlias	back to summary
public String chooseClientAlias(String[] keyType, Principal[] issuers, Socket socket) Implements javax.net.ssl.X509KeyManager.chooseClientAlias. Doc from javax.net.ssl.X509KeyManager.chooseClientAlias. Choose an alias to authenticate the client side of a secure socket given the public key type and the list of certificate issuer authorities recognized by the peer (if any). Parameters keyType:String[] the key algorithm type name(s), ordered with the most-preferred key type first. issuers:Principal[] the list of acceptable CA issuer subject names or null if it does not matter which issuers are used. socket:Socket the socket to be used for this connection. This parameter can be null, which indicates that implementations are free to select an alias applicable to any socket. Returns:String the alias name for the desired key, or null if there are no matches. Annotations @Override

chooseClientAlias

back to summary

public String chooseClientAlias(String[] keyType, Principal[] issuers, Socket socket)

Implements javax.net.ssl.X509KeyManager.chooseClientAlias.

Doc from javax.net.ssl.X509KeyManager.chooseClientAlias.

Choose an alias to authenticate the client side of a secure socket given the public key type and the list of certificate issuer authorities recognized by the peer (if any).

Parameters

keyType:String[]: the key algorithm type name(s), ordered with the most-preferred key type first.
issuers:Principal[]: the list of acceptable CA issuer subject names or null if it does not matter which issuers are used.
socket:Socket: the socket to be used for this connection. This parameter can be null, which indicates that implementations are free to select an alias applicable to any socket.

Returns:String

the alias name for the desired key, or null if there are no matches.

Annotations

@Override

chooseEngineClientAlias back to summary

chooseEngineClientAlias	back to summary
public String chooseEngineClientAlias(String[] keyType, Principal[] issuers, SSLEngine engine) Overrides javax.net.ssl.X509ExtendedKeyManager.chooseEngineClientAlias. Doc from javax.net.ssl.X509ExtendedKeyManager.chooseEngineClientAlias. Choose an alias to authenticate the client side of an `SSLEngine` connection given the public key type and the list of certificate issuer authorities recognized by the peer (if any). The default implementation returns null. Parameters keyType:String[] the key algorithm type name(s), ordered with the most-preferred key type first. issuers:Principal[] the list of acceptable CA issuer subject names or null if it does not matter which issuers are used. engine:SSLEngine the `SSLEngine` to be used for this connection. This parameter can be null, which indicates that implementations of this interface are free to select an alias applicable to any engine. Returns:String the alias name for the desired key, or null if there are no matches. Annotations @Override

public String chooseEngineClientAlias(String[] keyType, Principal[] issuers, SSLEngine engine)

Overrides javax.net.ssl.X509ExtendedKeyManager.chooseEngineClientAlias.

Doc from javax.net.ssl.X509ExtendedKeyManager.chooseEngineClientAlias.

Choose an alias to authenticate the client side of an SSLEngine connection given the public key type and the list of certificate issuer authorities recognized by the peer (if any).

The default implementation returns null.

Parameters

keyType:String[]: the key algorithm type name(s), ordered with the most-preferred key type first.
issuers:Principal[]: the list of acceptable CA issuer subject names or null if it does not matter which issuers are used.
engine:SSLEngine: the SSLEngine to be used for this connection. This parameter can be null, which indicates that implementations of this interface are free to select an alias applicable to any engine.

Returns:String

the alias name for the desired key, or null if there are no matches.

Annotations

@Override

chooseEngineServerAlias back to summary

chooseEngineServerAlias	back to summary
public String chooseEngineServerAlias(String keyType, Principal[] issuers, SSLEngine engine) Overrides javax.net.ssl.X509ExtendedKeyManager.chooseEngineServerAlias. Doc from javax.net.ssl.X509ExtendedKeyManager.chooseEngineServerAlias. Choose an alias to authenticate the server side of an `SSLEngine` connection given the public key type and the list of certificate issuer authorities recognized by the peer (if any). The default implementation returns null. Parameters keyType:String the key algorithm type name. issuers:Principal[] the list of acceptable CA issuer subject names or null if it does not matter which issuers are used. engine:SSLEngine the `SSLEngine` to be used for this connection. This parameter can be null, which indicates that implementations of this interface are free to select an alias applicable to any engine. Returns:String the alias name for the desired key, or null if there are no matches. Annotations @Override

public String chooseEngineServerAlias(String keyType, Principal[] issuers, SSLEngine engine)

Overrides javax.net.ssl.X509ExtendedKeyManager.chooseEngineServerAlias.

Doc from javax.net.ssl.X509ExtendedKeyManager.chooseEngineServerAlias.

Choose an alias to authenticate the server side of an SSLEngine connection given the public key type and the list of certificate issuer authorities recognized by the peer (if any).

The default implementation returns null.

Parameters

keyType:String: the key algorithm type name.
issuers:Principal[]: the list of acceptable CA issuer subject names or null if it does not matter which issuers are used.
engine:SSLEngine: the SSLEngine to be used for this connection. This parameter can be null, which indicates that implementations of this interface are free to select an alias applicable to any engine.

Returns:String

the alias name for the desired key, or null if there are no matches.

Annotations

@Override

chooseServerAlias	back to summary
protected String chooseServerAlias(String keyType, Principal[] issuers, Collection<SNIMatcher> matchers, SSLSession session)

chooseServerAlias	back to summary
public String chooseServerAlias(String keyType, Principal[] issuers, Socket socket) Implements javax.net.ssl.X509KeyManager.chooseServerAlias. Doc from javax.net.ssl.X509KeyManager.chooseServerAlias. Choose an alias to authenticate the server side of a secure socket given the public key type and the list of certificate issuer authorities recognized by the peer (if any). Parameters keyType:String the key algorithm type name. issuers:Principal[] the list of acceptable CA issuer subject names or null if it does not matter which issuers are used. socket:Socket the socket to be used for this connection. This parameter can be null, which indicates that implementations are free to select an alias applicable to any socket. Returns:String the alias name for the desired key, or null if there are no matches. Annotations @Override

chooseServerAlias

back to summary

public String chooseServerAlias(String keyType, Principal[] issuers, Socket socket)

Implements javax.net.ssl.X509KeyManager.chooseServerAlias.

Doc from javax.net.ssl.X509KeyManager.chooseServerAlias.

Choose an alias to authenticate the server side of a secure socket given the public key type and the list of certificate issuer authorities recognized by the peer (if any).

Parameters

keyType:String: the key algorithm type name.
issuers:Principal[]: the list of acceptable CA issuer subject names or null if it does not matter which issuers are used.
socket:Socket: the socket to be used for this connection. This parameter can be null, which indicates that implementations are free to select an alias applicable to any socket.

Returns:String

the alias name for the desired key, or null if there are no matches.

Annotations

@Override

getAliasMapper	back to summary
public UnaryOperator<String> getAliasMapper() Returns:UnaryOperator<String> the function that transforms the alias See Also `setAliasMapper(UnaryOperator)`

getCertificateChain	back to summary
public X509Certificate[] getCertificateChain(String alias) Implements javax.net.ssl.X509KeyManager.getCertificateChain. Doc from javax.net.ssl.X509KeyManager.getCertificateChain. Returns the certificate chain associated with the given alias. Parameters alias:String the alias name Returns:X509Certificate[] the certificate chain (ordered with the user's certificate first and the root certificate authority last), or null if the alias can't be found. Annotations @Override

getCertificateChain

back to summary

public X509Certificate[] getCertificateChain(String alias)

Implements javax.net.ssl.X509KeyManager.getCertificateChain.

Doc from javax.net.ssl.X509KeyManager.getCertificateChain.

Returns the certificate chain associated with the given alias.

Parameters

alias:String: the alias name

Returns:X509Certificate[]

the certificate chain (ordered with the user's certificate first and the root certificate authority last), or null if the alias can't be found.

Annotations

@Override

getClientAliases	back to summary
public String[] getClientAliases(String keyType, Principal[] issuers) Implements javax.net.ssl.X509KeyManager.getClientAliases. Doc from javax.net.ssl.X509KeyManager.getClientAliases. Get the matching aliases for authenticating the client side of a secure socket given the public key type and the list of certificate issuer authorities recognized by the peer (if any). Parameters keyType:String the key algorithm type name issuers:Principal[] the list of acceptable CA issuer subject names, or null if it does not matter which issuers are used. Returns:String[] an array of the matching alias names, or null if there were no matches. Annotations @Override

getClientAliases

back to summary

public String[] getClientAliases(String keyType, Principal[] issuers)

Implements javax.net.ssl.X509KeyManager.getClientAliases.

Doc from javax.net.ssl.X509KeyManager.getClientAliases.

Get the matching aliases for authenticating the client side of a secure socket given the public key type and the list of certificate issuer authorities recognized by the peer (if any).

Parameters

keyType:String: the key algorithm type name
issuers:Principal[]: the list of acceptable CA issuer subject names, or null if it does not matter which issuers are used.

Returns:String[]

an array of the matching alias names, or null if there were no matches.

Annotations

@Override

getPrivateKey	back to summary
public PrivateKey getPrivateKey(String alias) Implements javax.net.ssl.X509KeyManager.getPrivateKey. Doc from javax.net.ssl.X509KeyManager.getPrivateKey. Returns the key associated with the given alias. Parameters alias:String the alias name Returns:PrivateKey the requested key, or null if the alias can't be found. Annotations @Override

getPrivateKey

back to summary

public PrivateKey getPrivateKey(String alias)

Implements javax.net.ssl.X509KeyManager.getPrivateKey.

Doc from javax.net.ssl.X509KeyManager.getPrivateKey.

Returns the key associated with the given alias.

Parameters

alias:String: the alias name

Returns:PrivateKey

the requested key, or null if the alias can't be found.

Annotations

@Override

getServerAliases	back to summary
public String[] getServerAliases(String keyType, Principal[] issuers) Implements javax.net.ssl.X509KeyManager.getServerAliases. Doc from javax.net.ssl.X509KeyManager.getServerAliases. Get the matching aliases for authenticating the server side of a secure socket given the public key type and the list of certificate issuer authorities recognized by the peer (if any). Parameters keyType:String the key algorithm type name issuers:Principal[] the list of acceptable CA issuer subject names or null if it does not matter which issuers are used. Returns:String[] an array of the matching alias names, or null if there were no matches. Annotations @Override

getServerAliases

back to summary

public String[] getServerAliases(String keyType, Principal[] issuers)

Implements javax.net.ssl.X509KeyManager.getServerAliases.

Doc from javax.net.ssl.X509KeyManager.getServerAliases.

Get the matching aliases for authenticating the server side of a secure socket given the public key type and the list of certificate issuer authorities recognized by the peer (if any).

Parameters

keyType:String: the key algorithm type name
issuers:Principal[]: the list of acceptable CA issuer subject names or null if it does not matter which issuers are used.

Returns:String[]

an array of the matching alias names, or null if there were no matches.

Annotations

@Override

setAliasMapper back to summary

setAliasMapper	back to summary
public void setAliasMapper(UnaryOperator<String> aliasMapper) Sets a function that transforms the alias into a possibly different alias, invoked when the SNI logic must choose the alias to pick the right certificate. This function is required when using the `PKIX KeyManagerFactory algorithm` which suffers from bug https://bugs.openjdk.java.net/browse/JDK-8246262, where aliases are returned by the OpenJDK implementation to the application in the form `N.0.alias` where `N` is an always increasing number. Such mangled aliases won't match the aliases in the keystore, so that for example SNI matching will always fail. Other implementations such as BouncyCastle have been reported to mangle the alias in a different way, namely `0.alias.N`. This function allows to "unmangle" the alias from the implementation specific mangling back to just `alias` so that SNI matching will work again. Parameters aliasMapper:UnaryOperator<String> the function that transforms the alias

public void setAliasMapper(UnaryOperator<String> aliasMapper)

Sets a function that transforms the alias into a possibly different alias, invoked when the SNI logic must choose the alias to pick the right certificate.

This function is required when using the PKIX KeyManagerFactory algorithm which suffers from bug https://bugs.openjdk.java.net/browse/JDK-8246262, where aliases are returned by the OpenJDK implementation to the application in the form N.0.alias where N is an always increasing number. Such mangled aliases won't match the aliases in the keystore, so that for example SNI matching will always fail.

Other implementations such as BouncyCastle have been reported to mangle the alias in a different way, namely 0.alias.N.

This function allows to "unmangle" the alias from the implementation specific mangling back to just alias so that SNI matching will work again.

Parameters

aliasMapper:UnaryOperator<String>: the function that transforms the alias

org.eclipse.jetty.util.ssl back to summary

public Interface SniX509ExtendedKeyManager.SniSelector

Known Direct Implementers

org.eclipse.jetty.util.ssl.SslContextFactory.Server

Annotations

@FunctionalInterface

Selects a certificate based on SNI information.

Field Summary

Modifier and Type	Field and Description
public static final String	DELEGATE

Method Summary

Modifier and Type Method and Description

Modifier and Type	Method and Description
public String	Returns: the alias of the certificate to return to the client, from the `certificates` list, or `SniSelector#DELEGATE` if the certificate choice should be delegated to the nested key manager or null for no match. sniSelect(String the key algorithm type name keyType, Principal[] the list of acceptable CA issuer subject names or null if it does not matter which issuers are used issuers, SSLSession the TLS handshake session or null if not known. session, String the server name indication sent by the client, or null if the client did not send the server name indication sniHost, Collection<X509> the list of certificates matching `keyType` and `issuers` known to this SslContextFactory certificates) Selects a certificate based on SNI information.

public String

Returns:

the alias of the certificate to return to the client, from the certificates list, or SniSelector#DELEGATE if the certificate choice should be delegated to the nested key manager or null for no match.

sniSelect(String

the key algorithm type name

keyType, Principal[]

the list of acceptable CA issuer subject names or null if it does not matter which issuers are used

issuers, SSLSession

the TLS handshake session or null if not known.

session, String

the server name indication sent by the client, or null if the client did not send the server name indication

sniHost, Collection<X509>

the list of certificates matching keyType and issuers known to this SslContextFactory

certificates)

Selects a certificate based on SNI information.

Field Detail

DELEGATE	back to summary
public static final String DELEGATE

Method Detail

sniSelect back to summary

sniSelect	back to summary
public String sniSelect(String keyType, Principal[] issuers, SSLSession session, String sniHost, Collection<X509> certificates) throws SSLHandshakeException Selects a certificate based on SNI information. This method may be invoked multiple times during the TLS handshake, with different parameters. For example, the `keyType` could be different, and subsequently the collection of certificates (because they need to match the `keyType`). Parameters keyType:String the key algorithm type name issuers:Principal[] the list of acceptable CA issuer subject names or null if it does not matter which issuers are used session:SSLSession the TLS handshake session or null if not known. sniHost:String the server name indication sent by the client, or null if the client did not send the server name indication certificates:Collection<X509> the list of certificates matching `keyType` and `issuers` known to this SslContextFactory Returns:String the alias of the certificate to return to the client, from the `certificates` list, or `SniSelector#DELEGATE` if the certificate choice should be delegated to the nested key manager or null for no match. Exceptions SSLHandshakeException: if the TLS handshake should be aborted

public String sniSelect(String keyType, Principal[] issuers, SSLSession session, String sniHost, Collection<X509> certificates) throws SSLHandshakeException

Selects a certificate based on SNI information.

This method may be invoked multiple times during the TLS handshake, with different parameters. For example, the keyType could be different, and subsequently the collection of certificates (because they need to match the keyType).

Parameters

keyType:String: the key algorithm type name
issuers:Principal[]: the list of acceptable CA issuer subject names or null if it does not matter which issuers are used
session:SSLSession: the TLS handshake session or null if not known.
sniHost:String: the server name indication sent by the client, or null if the client did not send the server name indication
certificates:Collection<X509>: the list of certificates matching keyType and issuers known to this SslContextFactory

Returns:String

Exceptions

SSLHandshakeException:: if the TLS handshake should be aborted

public Class SniX509ExtendedKeyManager

Nested and Inner Type Summary

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail

public Interface SniX509ExtendedKeyManager.SniSelector

Field Summary

Method Summary

Field Detail

Method Detail