Class JdkSslContext

java.lang.Object

io.netty.handler.ssl.SslContext

io.netty.handler.ssl.JdkSslContext

Direct Known Subclasses:

JdkSslClientContext, JdkSslServerContext

public class JdkSslContext
extends SslContext

An SslContext which uses JDK's SSL/TLS implementation.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
private static final class	JdkSslContext.Defaults

Field Summary

Fields

Modifier and Type	Field	Description
private final JdkApplicationProtocolNegotiator	apn
private final java.lang.String[]	cipherSuites
private final ClientAuth	clientAuth
private static final java.util.List<java.lang.String>	DEFAULT_CIPHERS
private static final java.util.List<java.lang.String>	DEFAULT_CIPHERS_NON_TLSV13
private static final java.lang.String[]	DEFAULT_PROTOCOLS
private static final java.security.Provider	DEFAULT_PROVIDER
private final java.lang.String	endpointIdentificationAlgorithm
private final boolean	isClient
private static final InternalLogger	logger
(package private) static final java.lang.String	PROTOCOL
private final java.lang.String[]	protocols
private final java.util.List<javax.net.ssl.SNIServerName>	serverNames
private final javax.net.ssl.SSLContext	sslContext
private static final java.util.Set<java.lang.String>	SUPPORTED_CIPHERS
private static final java.util.Set<java.lang.String>	SUPPORTED_CIPHERS_NON_TLSV13
private final java.util.List<java.lang.String>	unmodifiableCipherSuites

Fields inherited from class SslContext

ALIAS, defaultEndpointVerificationAlgorithm, resumptionController, X509_CERT_FACTORY

Constructor Summary

Constructors

Constructor	Description
JdkSslContext(javax.net.ssl.SSLContext sslContext, boolean isClient, ClientAuth clientAuth)	Deprecated. Use JdkSslContext(SSLContext, boolean, Iterable, CipherSuiteFilter, ApplicationProtocolConfig, ClientAuth, String[], boolean)
JdkSslContext(javax.net.ssl.SSLContext sslContext, boolean isClient, java.lang.Iterable<java.lang.String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn, ClientAuth clientAuth)	Deprecated. Use JdkSslContext(SSLContext, boolean, Iterable, CipherSuiteFilter, ApplicationProtocolConfig, ClientAuth, String[], boolean)
JdkSslContext(javax.net.ssl.SSLContext sslContext, boolean isClient, java.lang.Iterable<java.lang.String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn, ClientAuth clientAuth, java.lang.String[] protocols, boolean startTls)	Creates a new JdkSslContext from a pre-configured SSLContext.
JdkSslContext(javax.net.ssl.SSLContext sslContext, boolean isClient, java.lang.Iterable<java.lang.String> ciphers, CipherSuiteFilter cipherFilter, JdkApplicationProtocolNegotiator apn, ClientAuth clientAuth, java.lang.String[] protocols, boolean startTls)
JdkSslContext(javax.net.ssl.SSLContext sslContext, boolean isClient, java.lang.Iterable<java.lang.String> ciphers, CipherSuiteFilter cipherFilter, JdkApplicationProtocolNegotiator apn, ClientAuth clientAuth, java.lang.String[] protocols, boolean startTls, java.lang.String endpointIdentificationAlgorithm, java.util.List<javax.net.ssl.SNIServerName> serverNames, ResumptionController resumptionController)

Method Summary

Modifier and Type	Method	Description
final JdkApplicationProtocolNegotiator	applicationProtocolNegotiator()	Returns the object responsible for negotiating application layer protocols for the TLS NPN/ALPN extensions.
protected static javax.net.ssl.KeyManagerFactory	buildKeyManagerFactory(java.io.File certChainFile, java.io.File keyFile, java.lang.String keyPassword, javax.net.ssl.KeyManagerFactory kmf)	Deprecated. will be removed.
(package private) static javax.net.ssl.KeyManagerFactory	buildKeyManagerFactory(java.io.File certChainFile, java.io.File keyFile, java.lang.String keyPassword, javax.net.ssl.KeyManagerFactory kmf, java.lang.String keyStore)	Build a KeyManagerFactory based upon a key file, key file password, and a certificate chain.
protected static javax.net.ssl.KeyManagerFactory	buildKeyManagerFactory(java.io.File certChainFile, java.lang.String keyAlgorithm, java.io.File keyFile, java.lang.String keyPassword, javax.net.ssl.KeyManagerFactory kmf)	Deprecated. will be removed.
(package private) static javax.net.ssl.KeyManagerFactory	buildKeyManagerFactory(java.io.File certChainFile, java.lang.String keyAlgorithm, java.io.File keyFile, java.lang.String keyPassword, javax.net.ssl.KeyManagerFactory kmf, java.lang.String keyStore)	Build a KeyManagerFactory based upon a key algorithm, key file, key file password, and a certificate chain.
final java.util.List<java.lang.String>	cipherSuites()	Returns the list of enabled cipher suites, in the order of preference.
private javax.net.ssl.SSLEngine	configureAndWrapEngine(javax.net.ssl.SSLEngine engine, ByteBufAllocator alloc)
private void	configureSSLParameters(javax.net.ssl.SSLEngine engine)
final javax.net.ssl.SSLContext	context()	Returns the JDK SSLContext object held by this context.
private static java.util.List<java.lang.String>	defaultCiphers(javax.net.ssl.SSLEngine engine, java.util.Set<java.lang.String> supportedCiphers)
private static java.lang.String[]	defaultProtocols(javax.net.ssl.SSLContext context, javax.net.ssl.SSLEngine engine)
final boolean	isClient()	Returns the true if and only if this context is for client-side.
private static boolean	isTlsV13Supported(java.lang.String[] protocols)
final javax.net.ssl.SSLEngine	newEngine(ByteBufAllocator alloc)	Creates a new SSLEngine.
final javax.net.ssl.SSLEngine	newEngine(ByteBufAllocator alloc, java.lang.String peerHost, int peerPort)	Creates a new SSLEngine using advisory peer information.
final javax.net.ssl.SSLSessionContext	sessionContext()	Returns the JDK SSLSessionContext object held by this context.
private static java.util.Set<java.lang.String>	supportedCiphers(javax.net.ssl.SSLEngine engine)
(package private) static JdkApplicationProtocolNegotiator	toNegotiator(ApplicationProtocolConfig config, boolean isServer)	Translate a ApplicationProtocolConfig object to a JdkApplicationProtocolNegotiator object.

Methods inherited from class SslContext

attributes, buildKeyManagerFactory, buildKeyManagerFactory, buildKeyStore, buildTrustManagerFactory, buildTrustManagerFactory, buildTrustManagerFactory, defaultClientProvider, defaultServerProvider, deriveSessionIdContext, generateKeySpec, isServer, keyStorePassword, newClientContext, newClientContext, newClientContext, newClientContext, newClientContext, newClientContext, newClientContext, newClientContext, newClientContext, newClientContext, newClientContext, newClientContext, newClientContext, newClientContextInternal, newClientContextInternal, newHandler, newHandler, newHandler, newHandler, newHandler, newHandler, newHandler, newHandler, newServerContext, newServerContext, newServerContext, newServerContext, newServerContext, newServerContext, newServerContext, newServerContext, newServerContext, newServerContext, newServerContext, newServerContextInternal, nextProtocols, sessionCacheSize, sessionTimeout, toApplicationProtocolConfig, toPrivateKey, toPrivateKey, toPrivateKey, toPrivateKeyInternal, toX509Certificates, toX509Certificates, toX509CertificatesInternal

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

logger

private static final InternalLogger logger

PROTOCOL

static final java.lang.String PROTOCOL

See Also:

• Constant Field Values

DEFAULT_PROTOCOLS

private static final java.lang.String[] DEFAULT_PROTOCOLS

DEFAULT_CIPHERS

private static final java.util.List<java.lang.String> DEFAULT_CIPHERS

DEFAULT_CIPHERS_NON_TLSV13

private static final java.util.List<java.lang.String> DEFAULT_CIPHERS_NON_TLSV13

SUPPORTED_CIPHERS

private static final java.util.Set<java.lang.String> SUPPORTED_CIPHERS

SUPPORTED_CIPHERS_NON_TLSV13

private static final java.util.Set<java.lang.String> SUPPORTED_CIPHERS_NON_TLSV13

DEFAULT_PROVIDER

private static final java.security.Provider DEFAULT_PROVIDER

protocols

private final java.lang.String[] protocols

cipherSuites

private final java.lang.String[] cipherSuites

unmodifiableCipherSuites

private final java.util.List<java.lang.String> unmodifiableCipherSuites

apn

private final JdkApplicationProtocolNegotiator apn

clientAuth

private final ClientAuth clientAuth

sslContext

private final javax.net.ssl.SSLContext sslContext

isClient

private final boolean isClient

endpointIdentificationAlgorithm

private final java.lang.String endpointIdentificationAlgorithm

serverNames

private final java.util.List<javax.net.ssl.SNIServerName> serverNames

Constructor Details

JdkSslContext

@Deprecated
public JdkSslContext(javax.net.ssl.SSLContext sslContext,
 boolean isClient,
 ClientAuth clientAuth)

Deprecated.

Use JdkSslContext(SSLContext, boolean, Iterable, CipherSuiteFilter, ApplicationProtocolConfig, ClientAuth, String[], boolean)

Creates a new JdkSslContext from a pre-configured SSLContext.

Parameters:

sslContext - the SSLContext to use.

isClient - true if this context should create SSLEngines for client-side usage.

clientAuth - the ClientAuth to use. This will only be used when is false.

JdkSslContext

@Deprecated
public JdkSslContext(javax.net.ssl.SSLContext sslContext,
 boolean isClient,
 java.lang.Iterable<java.lang.String> ciphers,
 CipherSuiteFilter cipherFilter,
 ApplicationProtocolConfig apn,
 ClientAuth clientAuth)

Deprecated.

Use JdkSslContext(SSLContext, boolean, Iterable, CipherSuiteFilter, ApplicationProtocolConfig, ClientAuth, String[], boolean)

Creates a new JdkSslContext from a pre-configured SSLContext.

Parameters:

sslContext - the SSLContext to use.

isClient - true if this context should create SSLEngines for client-side usage.

ciphers - the ciphers to use or null if the standard should be used.

cipherFilter - the filter to use.

apn - the ApplicationProtocolConfig to use.

clientAuth - the ClientAuth to use. This will only be used when is false.

JdkSslContext

public JdkSslContext(javax.net.ssl.SSLContext sslContext,
 boolean isClient,
 java.lang.Iterable<java.lang.String> ciphers,
 CipherSuiteFilter cipherFilter,
 ApplicationProtocolConfig apn,
 ClientAuth clientAuth,
 java.lang.String[] protocols,
 boolean startTls)

Creates a new JdkSslContext from a pre-configured SSLContext.

Parameters:

sslContext - the SSLContext to use.

isClient - true if this context should create SSLEngines for client-side usage.

ciphers - the ciphers to use or null if the standard should be used.

cipherFilter - the filter to use.

apn - the ApplicationProtocolConfig to use.

clientAuth - the ClientAuth to use. This will only be used when is false.

protocols - the protocols to enable, or null to enable the default protocols.

startTls - true if the first write request shouldn't be encrypted

JdkSslContext

JdkSslContext(javax.net.ssl.SSLContext sslContext,
 boolean isClient,
 java.lang.Iterable<java.lang.String> ciphers,
 CipherSuiteFilter cipherFilter,
 JdkApplicationProtocolNegotiator apn,
 ClientAuth clientAuth,
 java.lang.String[] protocols,
 boolean startTls)

JdkSslContext

JdkSslContext(javax.net.ssl.SSLContext sslContext,
 boolean isClient,
 java.lang.Iterable<java.lang.String> ciphers,
 CipherSuiteFilter cipherFilter,
 JdkApplicationProtocolNegotiator apn,
 ClientAuth clientAuth,
 java.lang.String[] protocols,
 boolean startTls,
 java.lang.String endpointIdentificationAlgorithm,
 java.util.List<javax.net.ssl.SNIServerName> serverNames,
 ResumptionController resumptionController)

Method Details

defaultProtocols

private static java.lang.String[] defaultProtocols(javax.net.ssl.SSLContext context,
 javax.net.ssl.SSLEngine engine)

supportedCiphers

private static java.util.Set<java.lang.String> supportedCiphers(javax.net.ssl.SSLEngine engine)

defaultCiphers

private static java.util.List<java.lang.String> defaultCiphers(javax.net.ssl.SSLEngine engine,
 java.util.Set<java.lang.String> supportedCiphers)

isTlsV13Supported

private static boolean isTlsV13Supported(java.lang.String[] protocols)

context

public final javax.net.ssl.SSLContext context()

Returns the JDK SSLContext object held by this context.

isClient

public final boolean isClient()

Description copied from class: SslContext

Returns the true if and only if this context is for client-side.

Specified by:

isClient in class SslContext

sessionContext

public final javax.net.ssl.SSLSessionContext sessionContext()

Returns the JDK SSLSessionContext object held by this context.

Specified by:

sessionContext in class SslContext

cipherSuites

public final java.util.List<java.lang.String> cipherSuites()

Description copied from class: SslContext

Returns the list of enabled cipher suites, in the order of preference.

Specified by:

cipherSuites in class SslContext

newEngine

public final javax.net.ssl.SSLEngine newEngine(ByteBufAllocator alloc)

Description copied from class: SslContext

Creates a new SSLEngine.

If SslProvider.OPENSSL_REFCNT is used then the object must be released. One way to do this is to wrap in a SslHandler and insert it into a pipeline. See SslContext.newHandler(ByteBufAllocator).

Specified by:

newEngine in class SslContext

Returns:

a new SSLEngine

newEngine

public final javax.net.ssl.SSLEngine newEngine(ByteBufAllocator alloc,
 java.lang.String peerHost,
 int peerPort)

Description copied from class: SslContext

Creates a new SSLEngine using advisory peer information.

If SslProvider.OPENSSL_REFCNT is used then the object must be released. One way to do this is to wrap in a SslHandler and insert it into a pipeline. See SslContext.newHandler(ByteBufAllocator, String, int).

Specified by:

newEngine in class SslContext

Parameters:

peerHost - the non-authoritative name of the host

peerPort - the non-authoritative port

Returns:

a new SSLEngine

configureAndWrapEngine

private javax.net.ssl.SSLEngine configureAndWrapEngine(javax.net.ssl.SSLEngine engine,
 ByteBufAllocator alloc)

configureSSLParameters

private void configureSSLParameters(javax.net.ssl.SSLEngine engine)

applicationProtocolNegotiator

public final JdkApplicationProtocolNegotiator applicationProtocolNegotiator()

Description copied from class: SslContext

Returns the object responsible for negotiating application layer protocols for the TLS NPN/ALPN extensions.

Specified by:

applicationProtocolNegotiator in class SslContext

toNegotiator

static JdkApplicationProtocolNegotiator toNegotiator(ApplicationProtocolConfig config,
 boolean isServer)

Translate a ApplicationProtocolConfig object to a JdkApplicationProtocolNegotiator object.

Parameters:

config - The configuration which defines the translation

isServer - true if a server false otherwise.

Returns:

The results of the translation

buildKeyManagerFactory

static javax.net.ssl.KeyManagerFactory buildKeyManagerFactory(java.io.File certChainFile,
 java.io.File keyFile,
 java.lang.String keyPassword,
 javax.net.ssl.KeyManagerFactory kmf,
 java.lang.String keyStore)
                                                       throws java.security.UnrecoverableKeyException,
java.security.KeyStoreException,
java.security.NoSuchAlgorithmException,
javax.crypto.NoSuchPaddingException,
java.security.spec.InvalidKeySpecException,
java.security.InvalidAlgorithmParameterException,
java.security.cert.CertificateException,
java.security.KeyException,
java.io.IOException

Build a KeyManagerFactory based upon a key file, key file password, and a certificate chain.

Parameters:

certChainFile - an X.509 certificate chain file in PEM format

keyFile - a PKCS#8 private key file in PEM format

keyPassword - the password of the keyFile. null if it's not password-protected.

kmf - The existing KeyManagerFactory that will be used if not null

keyStore - the KeyStore that should be used in the KeyManagerFactory

Returns:

A KeyManagerFactory based upon a key file, key file password, and a certificate chain.

Throws:

java.security.UnrecoverableKeyException

java.security.KeyStoreException

java.security.NoSuchAlgorithmException

javax.crypto.NoSuchPaddingException

java.security.spec.InvalidKeySpecException

java.security.InvalidAlgorithmParameterException

java.security.cert.CertificateException

java.security.KeyException

java.io.IOException

buildKeyManagerFactory

@Deprecated
protected static javax.net.ssl.KeyManagerFactory buildKeyManagerFactory(java.io.File certChainFile,
 java.io.File keyFile,
 java.lang.String keyPassword,
 javax.net.ssl.KeyManagerFactory kmf)
                                                                 throws java.security.UnrecoverableKeyException,
java.security.KeyStoreException,
java.security.NoSuchAlgorithmException,
javax.crypto.NoSuchPaddingException,
java.security.spec.InvalidKeySpecException,
java.security.InvalidAlgorithmParameterException,
java.security.cert.CertificateException,
java.security.KeyException,
java.io.IOException

Deprecated.

will be removed.

Build a KeyManagerFactory based upon a key file, key file password, and a certificate chain.

Parameters:

certChainFile - an X.509 certificate chain file in PEM format

keyFile - a PKCS#8 private key file in PEM format

keyPassword - the password of the keyFile. null if it's not password-protected.

kmf - The existing KeyManagerFactory that will be used if not null

Returns:

A KeyManagerFactory based upon a key file, key file password, and a certificate chain.

Throws:

java.security.UnrecoverableKeyException

java.security.KeyStoreException

java.security.NoSuchAlgorithmException

javax.crypto.NoSuchPaddingException

java.security.spec.InvalidKeySpecException

java.security.InvalidAlgorithmParameterException

java.security.cert.CertificateException

java.security.KeyException

java.io.IOException

buildKeyManagerFactory

static javax.net.ssl.KeyManagerFactory buildKeyManagerFactory(java.io.File certChainFile,
 java.lang.String keyAlgorithm,
 java.io.File keyFile,
 java.lang.String keyPassword,
 javax.net.ssl.KeyManagerFactory kmf,
 java.lang.String keyStore)
                                                       throws java.security.KeyStoreException,
java.security.NoSuchAlgorithmException,
javax.crypto.NoSuchPaddingException,
java.security.spec.InvalidKeySpecException,
java.security.InvalidAlgorithmParameterException,
java.io.IOException,
java.security.cert.CertificateException,
java.security.KeyException,
java.security.UnrecoverableKeyException

Build a KeyManagerFactory based upon a key algorithm, key file, key file password, and a certificate chain.

Parameters:

certChainFile - an X.509 certificate chain file in PEM format

keyAlgorithm - the standard name of the requested algorithm. See the Java Secure Socket Extension Reference Guide for information about standard algorithm names.

keyFile - a PKCS#8 private key file in PEM format

keyPassword - the password of the keyFile. null if it's not password-protected.

kmf - The existing KeyManagerFactory that will be used if not null

keyStore - the KeyStore that should be used in the KeyManagerFactory

Returns:

A KeyManagerFactory based upon a key algorithm, key file, key file password, and a certificate chain.

Throws:

java.security.KeyStoreException

java.security.NoSuchAlgorithmException

javax.crypto.NoSuchPaddingException

java.security.spec.InvalidKeySpecException

java.security.InvalidAlgorithmParameterException

java.io.IOException

java.security.cert.CertificateException

java.security.KeyException

java.security.UnrecoverableKeyException

buildKeyManagerFactory

@Deprecated
protected static javax.net.ssl.KeyManagerFactory buildKeyManagerFactory(java.io.File certChainFile,
 java.lang.String keyAlgorithm,
 java.io.File keyFile,
 java.lang.String keyPassword,
 javax.net.ssl.KeyManagerFactory kmf)
                                                                 throws java.security.KeyStoreException,
java.security.NoSuchAlgorithmException,
javax.crypto.NoSuchPaddingException,
java.security.spec.InvalidKeySpecException,
java.security.InvalidAlgorithmParameterException,
java.io.IOException,
java.security.cert.CertificateException,
java.security.KeyException,
java.security.UnrecoverableKeyException

Deprecated.

will be removed.

Build a KeyManagerFactory based upon a key algorithm, key file, key file password, and a certificate chain.

Parameters:

certChainFile - an buildKeyManagerFactory X.509 certificate chain file in PEM format

keyAlgorithm - the standard name of the requested algorithm. See the Java Secure Socket Extension Reference Guide for information about standard algorithm names.

keyFile - a PKCS#8 private key file in PEM format

keyPassword - the password of the keyFile. null if it's not password-protected.

kmf - The existing KeyManagerFactory that will be used if not null

Returns:

A KeyManagerFactory based upon a key algorithm, key file, key file password, and a certificate chain.

Throws:

java.security.KeyStoreException

java.security.NoSuchAlgorithmException

javax.crypto.NoSuchPaddingException

java.security.spec.InvalidKeySpecException

java.security.InvalidAlgorithmParameterException

java.io.IOException

java.security.cert.CertificateException

java.security.KeyException

java.security.UnrecoverableKeyException