Top Fields Constructors Methods
org.postgresql.ssl

public Class PKCS12KeyManager

extends Object
implements X509KeyManager
Class Inheritance
All Implemented Interfaces
javax.net.ssl.X509KeyManager, javax.net.ssl.KeyManager
Imports
org.postgresql.jdbc.ResourceLock, org.postgresql.util.GT, .PSQLException, .PSQLState, org.checkerframework.checker.nullness.qual.Nullable, java.io.FileInputStream, java.net.Socket, java.security.KeyStore, .KeyStoreException, .Principal, .PrivateKey, java.security.cert.Certificate, .X509Certificate, javax.net.ssl.X509KeyManager, javax.security.auth.callback.Callback, .CallbackHandler, .PasswordCallback, .UnsupportedCallbackException, javax.security.auth.x500.X500Principal

Field Summary

Modifier and TypeField and Description
private final CallbackHandler
cbh

private @Nullable PSQLException
error

private final String
keyfile

private final KeyStore
keyStore

pack-priv boolean
keystoreLoaded

private final ResourceLock
lock

Constructor Summary

AccessConstructor and Description
public
PKCS12KeyManager(String pkcsFile, CallbackHandler cbh)

Method Summary

Modifier and TypeMethod and Description
public @Nullable String
chooseClientAlias(String[]
the key algorithm type name(s), ordered with the most-preferred key type first.
keyType, @Nullable Principal[]
the list of acceptable CA issuer subject names or null if it does not matter which issuers are used.
principals, @Nullable Socket
the socket to be used for this connection. This parameter can be null, which indicates that implementations are free to select an alias applicable to any socket.
socket)

Implements javax.net.ssl.X509KeyManager.chooseClientAlias.

Choose an alias to authenticate the client side of a secure socket given the public key type and the list of certificate issuer authorities recognized by the peer (if any).

public @Nullable String
chooseServerAlias(String
the key algorithm type name.
s, @Nullable Principal[]
the list of acceptable CA issuer subject names or null if it does not matter which issuers are used.
principals, @Nullable Socket
the socket to be used for this connection. This parameter can be null, which indicates that implementations are free to select an alias applicable to any socket.
socket)

Implements javax.net.ssl.X509KeyManager.chooseServerAlias.

Choose an alias to authenticate the server side of a secure socket given the public key type and the list of certificate issuer authorities recognized by the peer (if any).

public @Nullable X509Certificate[]
getCertificateChain(String
the alias name
alias)

Implements javax.net.ssl.X509KeyManager.getCertificateChain.

Returns the certificate chain associated with the given alias.

public @Nullable String[]
getClientAliases(String
the key algorithm type name
keyType, @Nullable Principal[]
the list of acceptable CA issuer subject names, or null if it does not matter which issuers are used.
principals)

Implements javax.net.ssl.X509KeyManager.getClientAliases.

Get the matching aliases for authenticating the client side of a secure socket given the public key type and the list of certificate issuer authorities recognized by the peer (if any).

public @Nullable PrivateKey
getPrivateKey(String
the alias name
s)

Implements javax.net.ssl.X509KeyManager.getPrivateKey.

Returns the key associated with the given alias.

public @Nullable String[]
getServerAliases(String
the key algorithm type name
s, @Nullable Principal[]
the list of acceptable CA issuer subject names or null if it does not matter which issuers are used.
principals)

Implements javax.net.ssl.X509KeyManager.getServerAliases.

Get the matching aliases for authenticating the server side of a secure socket given the public key type and the list of certificate issuer authorities recognized by the peer (if any).

private void
loadKeyStore()

public void
throwKeyManagerException()

getCertificateChain and getPrivateKey cannot throw exceptions, therefore any exception is stored in error and can be raised by this method.

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

cbhback to summary
private final CallbackHandler cbh
errorback to summary
private @Nullable PSQLException error
keyfileback to summary
private final String keyfile
keyStoreback to summary
private final KeyStore keyStore
keystoreLoadedback to summary
pack-priv boolean keystoreLoaded
lockback to summary
private final ResourceLock lock

Constructor Detail

PKCS12KeyManagerback to summary
public PKCS12KeyManager(String pkcsFile, CallbackHandler cbh) throws PSQLException

Method Detail

chooseClientAliasback to summary
public @Nullable String chooseClientAlias(String[] keyType, @Nullable Principal[] principals, @Nullable Socket socket)

Implements javax.net.ssl.X509KeyManager.chooseClientAlias.

Doc from javax.net.ssl.X509KeyManager.chooseClientAlias.

Choose an alias to authenticate the client side of a secure socket given the public key type and the list of certificate issuer authorities recognized by the peer (if any).

Parameters
keyType:String[]

the key algorithm type name(s), ordered with the most-preferred key type first.

principals:@Nullable Principal[]

the list of acceptable CA issuer subject names or null if it does not matter which issuers are used.

socket:@Nullable Socket

the socket to be used for this connection. This parameter can be null, which indicates that implementations are free to select an alias applicable to any socket.

Returns:@Nullable String

the alias name for the desired key, or null if there are no matches.

Annotations
@Override
chooseServerAliasback to summary
public @Nullable String chooseServerAlias(String s, @Nullable Principal[] principals, @Nullable Socket socket)

Implements javax.net.ssl.X509KeyManager.chooseServerAlias.

Doc from javax.net.ssl.X509KeyManager.chooseServerAlias.

Choose an alias to authenticate the server side of a secure socket given the public key type and the list of certificate issuer authorities recognized by the peer (if any).

Parameters
s:String

the key algorithm type name.

principals:@Nullable Principal[]

the list of acceptable CA issuer subject names or null if it does not matter which issuers are used.

socket:@Nullable Socket

the socket to be used for this connection. This parameter can be null, which indicates that implementations are free to select an alias applicable to any socket.

Returns:@Nullable String

the alias name for the desired key, or null if there are no matches.

Annotations
@Override
getCertificateChainback to summary
public @Nullable X509Certificate[] getCertificateChain(String alias)

Implements javax.net.ssl.X509KeyManager.getCertificateChain.

Doc from javax.net.ssl.X509KeyManager.getCertificateChain.

Returns the certificate chain associated with the given alias.

Parameters
alias:String

the alias name

Returns:@Nullable X509Certificate[]

the certificate chain (ordered with the user's certificate first and the root certificate authority last), or null if the alias can't be found.

Annotations
@Override
getClientAliasesback to summary
public @Nullable String[] getClientAliases(String keyType, @Nullable Principal[] principals)

Implements javax.net.ssl.X509KeyManager.getClientAliases.

Doc from javax.net.ssl.X509KeyManager.getClientAliases.

Get the matching aliases for authenticating the client side of a secure socket given the public key type and the list of certificate issuer authorities recognized by the peer (if any).

Parameters
keyType:String

the key algorithm type name

principals:@Nullable Principal[]

the list of acceptable CA issuer subject names, or null if it does not matter which issuers are used.

Returns:@Nullable String[]

an array of the matching alias names, or null if there were no matches.

Annotations
@Override
getPrivateKeyback to summary
public @Nullable PrivateKey getPrivateKey(String s)

Implements javax.net.ssl.X509KeyManager.getPrivateKey.

Doc from javax.net.ssl.X509KeyManager.getPrivateKey.

Returns the key associated with the given alias.

Parameters
s:String

the alias name

Returns:@Nullable PrivateKey

the requested key, or null if the alias can't be found.

Annotations
@Override
getServerAliasesback to summary
public @Nullable String[] getServerAliases(String s, @Nullable Principal[] principals)

Implements javax.net.ssl.X509KeyManager.getServerAliases.

Doc from javax.net.ssl.X509KeyManager.getServerAliases.

Get the matching aliases for authenticating the server side of a secure socket given the public key type and the list of certificate issuer authorities recognized by the peer (if any).

Parameters
s:String

the key algorithm type name

principals:@Nullable Principal[]

the list of acceptable CA issuer subject names or null if it does not matter which issuers are used.

Returns:@Nullable String[]

an array of the matching alias names, or null if there were no matches.

Annotations
@Override
loadKeyStoreback to summary
private void loadKeyStore() throws Exception
throwKeyManagerExceptionback to summary
public void throwKeyManagerException() throws PSQLException

getCertificateChain and getPrivateKey cannot throw exceptions, therefore any exception is stored in error and can be raised by this method.

Exceptions
PSQLException:
if any exception is stored in error and can be raised