Class SslContext

java.lang.Object
io.netty.handler.ssl.SslContext
Direct Known Subclasses:
DelegatingSslContext, JdkSslContext, ReferenceCountedOpenSslContext
public abstract class SslContext extends java.lang.Object
A secure socket protocol implementation which acts as a factory for SSLEngine and SslHandler. Internally, it is implemented via JDK's SSLContext or OpenSSL's SSL_CTX.

Making your server support SSL/TLS

// In your ChannelInitializer:
ChannelPipeline p = channel.pipeline();
SslContext sslCtx = SslContextBuilder.forServer(...).build();
p.addLast("ssl", sslCtx.newHandler(channel.alloc()));
...

Making your client support SSL/TLS

// In your ChannelInitializer:
ChannelPipeline p = channel.pipeline();
SslContext sslCtx = SslContextBuilder.forClient().build();
p.addLast("ssl", sslCtx.newHandler(channel.alloc(), host, port));
...

  • Field Details

    • logger

      private static final InternalLogger logger

    • DEFAULT_ENDPOINT_VERIFICATION_ALGORITHM_PROPERTY

      private static final java.lang.String DEFAULT_ENDPOINT_VERIFICATION_ALGORITHM_PROPERTY
      See Also:

    • defaultEndpointVerificationAlgorithm

      protected static final java.lang.String defaultEndpointVerificationAlgorithm
      Endpoint verification is enabled by default from Netty 4.2 onward, but it wasn't in Netty 4.1 and earlier. The "io.netty.handler.ssl.defaultEndpointVerificationAlgorithm" can be set to one of the following values to control this behavior:
      • "HTTPS" — verify subject by DNS hostnames; this is the Netty 4.2 default.
      • "LDAP" — verify subject by LDAP identity.
      • "NONE" — don't enable endpoint verification by default; this is the Netty 4.1 behavior.

    • SESSION_ID_CONTEXT_SALT_GENERATOR

      private static final java.security.SecureRandom SESSION_ID_CONTEXT_SALT_GENERATOR

    • SESSION_ID_CONTEXT_DOMAIN_SEPARATOR

      private static final java.lang.String SESSION_ID_CONTEXT_DOMAIN_SEPARATOR
      See Also:

    • SESSION_ID_CONTEXT_SALT_LENGTH

      private static final int SESSION_ID_CONTEXT_SALT_LENGTH
      See Also:

    • ALIAS

      static final java.lang.String ALIAS
      See Also:

    • X509_CERT_FACTORY

      static final java.security.cert.CertificateFactory X509_CERT_FACTORY

    • startTls

      private final boolean startTls

    • attributes

      private final AttributeMap attributes

    • resumptionController

      final ResumptionController resumptionController

    • OID_PKCS5_PBES2

      private static final java.lang.String OID_PKCS5_PBES2
      See Also:

    • PBES2

      private static final java.lang.String PBES2
      See Also:

  • Constructor Details

    • SslContext

      protected SslContext()
      Creates a new instance (startTls set to false).

    • SslContext

      protected SslContext(boolean startTls)
      Creates a new instance.

    • SslContext

      SslContext(boolean startTls, ResumptionController resumptionController)

  • Method Details

    • defaultServerProvider

      public static SslProvider defaultServerProvider()
      Returns the default server-side implementation provider currently in use.
      Returns:
      SslProvider.OPENSSL if OpenSSL is available. SslProvider.JDK otherwise.

    • defaultClientProvider

      public static SslProvider defaultClientProvider()
      Returns the default client-side implementation provider currently in use.
      Returns:
      SslProvider.OPENSSL if OpenSSL is available. SslProvider.JDK otherwise.

    • defaultProvider

      private static SslProvider defaultProvider()

    • newServerContext

      @Deprecated public static SslContext newServerContext(java.io.File certChainFile, java.io.File keyFile) throws javax.net.ssl.SSLException
      Deprecated.
      Replaced by SslContextBuilder
      Creates a new server-side SslContext.
      Parameters:
      certChainFile - an X.509 certificate chain file in PEM format
      keyFile - a PKCS#8 private key file in PEM format
      Returns:
      a new server-side SslContext
      Throws:
      javax.net.ssl.SSLException

    • newServerContext

      @Deprecated public static SslContext newServerContext(java.io.File certChainFile, java.io.File keyFile, java.lang.String keyPassword) throws javax.net.ssl.SSLException
      Deprecated.
      Replaced by SslContextBuilder
      Creates a new server-side SslContext.
      Parameters:
      certChainFile - an X.509 certificate chain file in PEM format
      keyFile - a PKCS#8 private key file in PEM format
      keyPassword - the password of the keyFile. null if it's not password-protected.
      Returns:
      a new server-side SslContext
      Throws:
      javax.net.ssl.SSLException

    • newServerContext

      @Deprecated public static SslContext newServerContext(java.io.File certChainFile, java.io.File keyFile, java.lang.String keyPassword, java.lang.Iterable<java.lang.String> ciphers, java.lang.Iterable<java.lang.String> nextProtocols, long sessionCacheSize, long sessionTimeout) throws javax.net.ssl.SSLException
      Deprecated.
      Replaced by SslContextBuilder
      Creates a new server-side SslContext.
      Parameters:
      certChainFile - an X.509 certificate chain file in PEM format
      keyFile - a PKCS#8 private key file in PEM format
      keyPassword - the password of the keyFile. null if it's not password-protected.
      ciphers - the cipher suites to enable, in the order of preference. null to use the default cipher suites.
      nextProtocols - the application layer protocols to accept, in the order of preference. null to disable TLS NPN/ALPN extension.
      sessionCacheSize - the size of the cache used for storing SSL session objects. 0 to use the default value.
      sessionTimeout - the timeout for the cached SSL session objects, in seconds. 0 to use the default value.
      Returns:
      a new server-side SslContext
      Throws:
      javax.net.ssl.SSLException

    • newServerContext

      @Deprecated public static SslContext newServerContext(java.io.File certChainFile, java.io.File keyFile, java.lang.String keyPassword, java.lang.Iterable<java.lang.String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn, long sessionCacheSize, long sessionTimeout) throws javax.net.ssl.SSLException
      Deprecated.
      Replaced by SslContextBuilder
      Creates a new server-side SslContext.
      Parameters:
      certChainFile - an X.509 certificate chain file in PEM format
      keyFile - a PKCS#8 private key file in PEM format
      keyPassword - the password of the keyFile. null if it's not password-protected.
      ciphers - the cipher suites to enable, in the order of preference. null to use the default cipher suites.
      cipherFilter - a filter to apply over the supplied list of ciphers
      apn - Provides a means to configure parameters related to application protocol negotiation.
      sessionCacheSize - the size of the cache used for storing SSL session objects. 0 to use the default value.
      sessionTimeout - the timeout for the cached SSL session objects, in seconds. 0 to use the default value.
      Returns:
      a new server-side SslContext
      Throws:
      javax.net.ssl.SSLException

    • newServerContext

      @Deprecated public static SslContext newServerContext(SslProvider provider, java.io.File certChainFile, java.io.File keyFile) throws javax.net.ssl.SSLException
      Deprecated.
      Replaced by SslContextBuilder
      Creates a new server-side SslContext.
      Parameters:
      provider - the SslContext implementation to use. null to use the current default one.
      certChainFile - an X.509 certificate chain file in PEM format
      keyFile - a PKCS#8 private key file in PEM format
      Returns:
      a new server-side SslContext
      Throws:
      javax.net.ssl.SSLException

    • newServerContext

      @Deprecated public static SslContext newServerContext(SslProvider provider, java.io.File certChainFile, java.io.File keyFile, java.lang.String keyPassword) throws javax.net.ssl.SSLException
      Deprecated.
      Replaced by SslContextBuilder
      Creates a new server-side SslContext.
      Parameters:
      provider - the SslContext implementation to use. null to use the current default one.
      certChainFile - an X.509 certificate chain file in PEM format
      keyFile - a PKCS#8 private key file in PEM format
      keyPassword - the password of the keyFile. null if it's not password-protected.
      Returns:
      a new server-side SslContext
      Throws:
      javax.net.ssl.SSLException

    • newServerContext

      @Deprecated public static SslContext newServerContext(SslProvider provider, java.io.File certChainFile, java.io.File keyFile, java.lang.String keyPassword, java.lang.Iterable<java.lang.String> ciphers, java.lang.Iterable<java.lang.String> nextProtocols, long sessionCacheSize, long sessionTimeout) throws javax.net.ssl.SSLException
      Deprecated.
      Replaced by SslContextBuilder
      Creates a new server-side SslContext.
      Parameters:
      provider - the SslContext implementation to use. null to use the current default one.
      certChainFile - an X.509 certificate chain file in PEM format
      keyFile - a PKCS#8 private key file in PEM format
      keyPassword - the password of the keyFile. null if it's not password-protected.
      ciphers - the cipher suites to enable, in the order of preference. null to use the default cipher suites.
      nextProtocols - the application layer protocols to accept, in the order of preference. null to disable TLS NPN/ALPN extension.
      sessionCacheSize - the size of the cache used for storing SSL session objects. 0 to use the default value.
      sessionTimeout - the timeout for the cached SSL session objects, in seconds. 0 to use the default value.
      Returns:
      a new server-side SslContext
      Throws:
      javax.net.ssl.SSLException

    • newServerContext

      @Deprecated public static SslContext newServerContext(SslProvider provider, java.io.File certChainFile, java.io.File keyFile, java.lang.String keyPassword, javax.net.ssl.TrustManagerFactory trustManagerFactory, java.lang.Iterable<java.lang.String> ciphers, java.lang.Iterable<java.lang.String> nextProtocols, long sessionCacheSize, long sessionTimeout) throws javax.net.ssl.SSLException
      Deprecated.
      Replaced by SslContextBuilder
      Creates a new server-side SslContext.
      Parameters:
      provider - the SslContext implementation to use. null to use the current default one.
      certChainFile - an X.509 certificate chain file in PEM format
      keyFile - a PKCS#8 private key file in PEM format
      keyPassword - the password of the keyFile. null if it's not password-protected.
      trustManagerFactory - the TrustManagerFactory that provides the TrustManagers that verifies the certificates sent from servers. null to use the default.
      ciphers - the cipher suites to enable, in the order of preference. null to use the default cipher suites.
      nextProtocols - the application layer protocols to accept, in the order of preference. null to disable TLS NPN/ALPN extension.
      sessionCacheSize - the size of the cache used for storing SSL session objects. 0 to use the default value.
      sessionTimeout - the timeout for the cached SSL session objects, in seconds. 0 to use the default value.
      Returns:
      a new server-side SslContext
      Throws:
      javax.net.ssl.SSLException

    • newServerContext

      @Deprecated public static SslContext newServerContext(SslProvider provider, java.io.File certChainFile, java.io.File keyFile, java.lang.String keyPassword, java.lang.Iterable<java.lang.String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn, long sessionCacheSize, long sessionTimeout) throws javax.net.ssl.SSLException
      Deprecated.
      Replaced by SslContextBuilder
      Creates a new server-side SslContext.
      Parameters:
      provider - the SslContext implementation to use. null to use the current default one.
      certChainFile - an X.509 certificate chain file in PEM format
      keyFile - a PKCS#8 private key file in PEM format
      keyPassword - the password of the keyFile. null if it's not password-protected.
      ciphers - the cipher suites to enable, in the order of preference. null to use the default cipher suites.
      cipherFilter - a filter to apply over the supplied list of ciphers Only required if provider is SslProvider.JDK
      apn - Provides a means to configure parameters related to application protocol negotiation.
      sessionCacheSize - the size of the cache used for storing SSL session objects. 0 to use the default value.
      sessionTimeout - the timeout for the cached SSL session objects, in seconds. 0 to use the default value.
      Returns:
      a new server-side SslContext
      Throws:
      javax.net.ssl.SSLException

    • newServerContext

      @Deprecated public static SslContext newServerContext(SslProvider provider, java.io.File trustCertCollectionFile, javax.net.ssl.TrustManagerFactory trustManagerFactory, java.io.File keyCertChainFile, java.io.File keyFile, java.lang.String keyPassword, javax.net.ssl.KeyManagerFactory keyManagerFactory, java.lang.Iterable<java.lang.String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn, long sessionCacheSize, long sessionTimeout) throws javax.net.ssl.SSLException
      Deprecated.
      Replaced by SslContextBuilder
      Creates a new server-side SslContext.
      Parameters:
      provider - the SslContext implementation to use. null to use the current default one.
      trustCertCollectionFile - an X.509 certificate collection file in PEM format. This provides the certificate collection used for mutual authentication. null to use the system default
      trustManagerFactory - the TrustManagerFactory that provides the TrustManagers that verifies the certificates sent from clients. null to use the default or the results of parsing trustCertCollectionFile. This parameter is ignored if provider is not SslProvider.JDK.
      keyCertChainFile - an X.509 certificate chain file in PEM format
      keyFile - a PKCS#8 private key file in PEM format
      keyPassword - the password of the keyFile. null if it's not password-protected.
      keyManagerFactory - the KeyManagerFactory that provides the KeyManagers that is used to encrypt data being sent to clients. null to use the default or the results of parsing keyCertChainFile and keyFile. This parameter is ignored if provider is not SslProvider.JDK.
      ciphers - the cipher suites to enable, in the order of preference. null to use the default cipher suites.
      cipherFilter - a filter to apply over the supplied list of ciphers Only required if provider is SslProvider.JDK
      apn - Provides a means to configure parameters related to application protocol negotiation.
      sessionCacheSize - the size of the cache used for storing SSL session objects. 0 to use the default value.
      sessionTimeout - the timeout for the cached SSL session objects, in seconds. 0 to use the default value.
      Returns:
      a new server-side SslContext
      Throws:
      javax.net.ssl.SSLException

    • newServerContext

      static SslContext newServerContext(SslProvider provider, java.io.File trustCertCollectionFile, javax.net.ssl.TrustManagerFactory trustManagerFactory, java.io.File keyCertChainFile, java.io.File keyFile, java.lang.String keyPassword, javax.net.ssl.KeyManagerFactory keyManagerFactory, java.lang.Iterable<java.lang.String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn, long sessionCacheSize, long sessionTimeout, java.lang.String keyStore) throws javax.net.ssl.SSLException
      Creates a new server-side SslContext.
      Parameters:
      provider - the SslContext implementation to use. null to use the current default one.
      trustCertCollectionFile - an X.509 certificate collection file in PEM format. This provides the certificate collection used for mutual authentication. null to use the system default
      trustManagerFactory - the TrustManagerFactory that provides the TrustManagers that verifies the certificates sent from clients. null to use the default or the results of parsing trustCertCollectionFile. This parameter is ignored if provider is not SslProvider.JDK.
      keyCertChainFile - an X.509 certificate chain file in PEM format
      keyFile - a PKCS#8 private key file in PEM format
      keyPassword - the password of the keyFile. null if it's not password-protected.
      keyManagerFactory - the KeyManagerFactory that provides the KeyManagers that is used to encrypt data being sent to clients. null to use the default or the results of parsing keyCertChainFile and keyFile. This parameter is ignored if provider is not SslProvider.JDK.
      ciphers - the cipher suites to enable, in the order of preference. null to use the default cipher suites.
      cipherFilter - a filter to apply over the supplied list of ciphers Only required if provider is SslProvider.JDK
      apn - Provides a means to configure parameters related to application protocol negotiation.
      sessionCacheSize - the size of the cache used for storing SSL session objects. 0 to use the default value.
      sessionTimeout - the timeout for the cached SSL session objects, in seconds. 0 to use the default value.
      keyStore - the keystore type that should be used
      Returns:
      a new server-side SslContext
      Throws:
      javax.net.ssl.SSLException

    • newServerContextInternal

      static SslContext newServerContextInternal(SslProvider provider, java.security.Provider sslContextProvider, java.security.cert.X509Certificate[] trustCertCollection, javax.net.ssl.TrustManagerFactory trustManagerFactory, java.security.cert.X509Certificate[] keyCertChain, java.security.PrivateKey key, java.lang.String keyPassword, javax.net.ssl.KeyManagerFactory keyManagerFactory, java.lang.Iterable<java.lang.String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn, long sessionCacheSize, long sessionTimeout, ClientAuth clientAuth, java.lang.String[] protocols, boolean startTls, boolean enableOcsp, java.security.SecureRandom secureRandom, java.lang.String keyStoreType, java.util.Map.Entry<SslContextOption<?>, java.lang.Object>[] ctxOptions, java.util.List<OpenSslCredential> credentials) throws javax.net.ssl.SSLException
      Throws:
      javax.net.ssl.SSLException

    • verifyNullSslContextProvider

      private static void verifyNullSslContextProvider(SslProvider provider, java.security.Provider sslContextProvider)

    • newClientContext

      @Deprecated public static SslContext newClientContext() throws javax.net.ssl.SSLException
      Deprecated.
      Replaced by SslContextBuilder
      Creates a new client-side SslContext.
      Returns:
      a new client-side SslContext
      Throws:
      javax.net.ssl.SSLException

    • newClientContext

      @Deprecated public static SslContext newClientContext(java.io.File certChainFile) throws javax.net.ssl.SSLException
      Deprecated.
      Replaced by SslContextBuilder
      Creates a new client-side SslContext.
      Parameters:
      certChainFile - an X.509 certificate chain file in PEM format
      Returns:
      a new client-side SslContext
      Throws:
      javax.net.ssl.SSLException

    • newClientContext

      @Deprecated public static SslContext newClientContext(javax.net.ssl.TrustManagerFactory trustManagerFactory) throws javax.net.ssl.SSLException
      Deprecated.
      Replaced by SslContextBuilder
      Creates a new client-side SslContext.
      Parameters:
      trustManagerFactory - the TrustManagerFactory that provides the TrustManagers that verifies the certificates sent from servers. null to use the default.
      Returns:
      a new client-side SslContext
      Throws:
      javax.net.ssl.SSLException

    • newClientContext

      @Deprecated public static SslContext newClientContext(java.io.File certChainFile, javax.net.ssl.TrustManagerFactory trustManagerFactory) throws javax.net.ssl.SSLException
      Deprecated.
      Replaced by SslContextBuilder
      Creates a new client-side SslContext.
      Parameters:
      certChainFile - an X.509 certificate chain file in PEM format. null to use the system default
      trustManagerFactory - the TrustManagerFactory that provides the TrustManagers that verifies the certificates sent from servers. null to use the default.
      Returns:
      a new client-side SslContext
      Throws:
      javax.net.ssl.SSLException

    • newClientContext

      @Deprecated public static SslContext newClientContext(java.io.File certChainFile, javax.net.ssl.TrustManagerFactory trustManagerFactory, java.lang.Iterable<java.lang.String> ciphers, java.lang.Iterable<java.lang.String> nextProtocols, long sessionCacheSize, long sessionTimeout) throws javax.net.ssl.SSLException
      Deprecated.
      Replaced by SslContextBuilder
      Creates a new client-side SslContext.
      Parameters:
      certChainFile - an X.509 certificate chain file in PEM format. null to use the system default
      trustManagerFactory - the TrustManagerFactory that provides the TrustManagers that verifies the certificates sent from servers. null to use the default.
      ciphers - the cipher suites to enable, in the order of preference. null to use the default cipher suites.
      nextProtocols - the application layer protocols to accept, in the order of preference. null to disable TLS NPN/ALPN extension.
      sessionCacheSize - the size of the cache used for storing SSL session objects. 0 to use the default value.
      sessionTimeout - the timeout for the cached SSL session objects, in seconds. 0 to use the default value.
      Returns:
      a new client-side SslContext
      Throws:
      javax.net.ssl.SSLException

    • newClientContext

      @Deprecated public static SslContext newClientContext(java.io.File certChainFile, javax.net.ssl.TrustManagerFactory trustManagerFactory, java.lang.Iterable<java.lang.String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn, long sessionCacheSize, long sessionTimeout) throws javax.net.ssl.SSLException
      Deprecated.
      Replaced by SslContextBuilder
      Creates a new client-side SslContext.
      Parameters:
      certChainFile - an X.509 certificate chain file in PEM format. null to use the system default
      trustManagerFactory - the TrustManagerFactory that provides the TrustManagers that verifies the certificates sent from servers. null to use the default.
      ciphers - the cipher suites to enable, in the order of preference. null to use the default cipher suites.
      cipherFilter - a filter to apply over the supplied list of ciphers
      apn - Provides a means to configure parameters related to application protocol negotiation.
      sessionCacheSize - the size of the cache used for storing SSL session objects. 0 to use the default value.
      sessionTimeout - the timeout for the cached SSL session objects, in seconds. 0 to use the default value.
      Returns:
      a new client-side SslContext
      Throws:
      javax.net.ssl.SSLException

    • newClientContext

      @Deprecated public static SslContext newClientContext(SslProvider provider) throws javax.net.ssl.SSLException
      Deprecated.
      Replaced by SslContextBuilder
      Creates a new client-side SslContext.
      Parameters:
      provider - the SslContext implementation to use. null to use the current default one.
      Returns:
      a new client-side SslContext
      Throws:
      javax.net.ssl.SSLException

    • newClientContext

      @Deprecated public static SslContext newClientContext(SslProvider provider, java.io.File certChainFile) throws javax.net.ssl.SSLException
      Deprecated.
      Replaced by SslContextBuilder
      Creates a new client-side SslContext.
      Parameters:
      provider - the SslContext implementation to use. null to use the current default one.
      certChainFile - an X.509 certificate chain file in PEM format. null to use the system default
      Returns:
      a new client-side SslContext
      Throws:
      javax.net.ssl.SSLException

    • newClientContext

      @Deprecated public static SslContext newClientContext(SslProvider provider, javax.net.ssl.TrustManagerFactory trustManagerFactory) throws javax.net.ssl.SSLException
      Deprecated.
      Replaced by SslContextBuilder
      Creates a new client-side SslContext.
      Parameters:
      provider - the SslContext implementation to use. null to use the current default one.
      trustManagerFactory - the TrustManagerFactory that provides the TrustManagers that verifies the certificates sent from servers. null to use the default.
      Returns:
      a new client-side SslContext
      Throws:
      javax.net.ssl.SSLException

    • newClientContext

      @Deprecated public static SslContext newClientContext(SslProvider provider, java.io.File certChainFile, javax.net.ssl.TrustManagerFactory trustManagerFactory) throws javax.net.ssl.SSLException
      Deprecated.
      Replaced by SslContextBuilder
      Creates a new client-side SslContext.
      Parameters:
      provider - the SslContext implementation to use. null to use the current default one.
      certChainFile - an X.509 certificate chain file in PEM format. null to use the system default
      trustManagerFactory - the TrustManagerFactory that provides the TrustManagers that verifies the certificates sent from servers. null to use the default.
      Returns:
      a new client-side SslContext
      Throws:
      javax.net.ssl.SSLException

    • newClientContext

      @Deprecated public static SslContext newClientContext(SslProvider provider, java.io.File certChainFile, javax.net.ssl.TrustManagerFactory trustManagerFactory, java.lang.Iterable<java.lang.String> ciphers, java.lang.Iterable<java.lang.String> nextProtocols, long sessionCacheSize, long sessionTimeout) throws javax.net.ssl.SSLException
      Deprecated.
      Replaced by SslContextBuilder
      Creates a new client-side SslContext.
      Parameters:
      provider - the SslContext implementation to use. null to use the current default one.
      certChainFile - an X.509 certificate chain file in PEM format. null to use the system default
      trustManagerFactory - the TrustManagerFactory that provides the TrustManagers that verifies the certificates sent from servers. null to use the default.
      ciphers - the cipher suites to enable, in the order of preference. null to use the default cipher suites.
      nextProtocols - the application layer protocols to accept, in the order of preference. null to disable TLS NPN/ALPN extension.
      sessionCacheSize - the size of the cache used for storing SSL session objects. 0 to use the default value.
      sessionTimeout - the timeout for the cached SSL session objects, in seconds. 0 to use the default value.
      Returns:
      a new client-side SslContext
      Throws:
      javax.net.ssl.SSLException

    • newClientContext

      @Deprecated public static SslContext newClientContext(SslProvider provider, java.io.File certChainFile, javax.net.ssl.TrustManagerFactory trustManagerFactory, java.lang.Iterable<java.lang.String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn, long sessionCacheSize, long sessionTimeout) throws javax.net.ssl.SSLException
      Deprecated.
      Replaced by SslContextBuilder
      Creates a new client-side SslContext.
      Parameters:
      provider - the SslContext implementation to use. null to use the current default one.
      certChainFile - an X.509 certificate chain file in PEM format. null to use the system default
      trustManagerFactory - the TrustManagerFactory that provides the TrustManagers that verifies the certificates sent from servers. null to use the default.
      ciphers - the cipher suites to enable, in the order of preference. null to use the default cipher suites.
      cipherFilter - a filter to apply over the supplied list of ciphers
      apn - Provides a means to configure parameters related to application protocol negotiation.
      sessionCacheSize - the size of the cache used for storing SSL session objects. 0 to use the default value.
      sessionTimeout - the timeout for the cached SSL session objects, in seconds. 0 to use the default value.
      Returns:
      a new client-side SslContext
      Throws:
      javax.net.ssl.SSLException

    • newClientContext

      @Deprecated public static SslContext newClientContext(SslProvider provider, java.io.File trustCertCollectionFile, javax.net.ssl.TrustManagerFactory trustManagerFactory, java.io.File keyCertChainFile, java.io.File keyFile, java.lang.String keyPassword, javax.net.ssl.KeyManagerFactory keyManagerFactory, java.lang.Iterable<java.lang.String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn, long sessionCacheSize, long sessionTimeout) throws javax.net.ssl.SSLException
      Deprecated.
      Replaced by SslContextBuilder
      Creates a new client-side SslContext.
      Parameters:
      provider - the SslContext implementation to use. null to use the current default one.
      trustCertCollectionFile - an X.509 certificate collection file in PEM format. null to use the system default
      trustManagerFactory - the TrustManagerFactory that provides the TrustManagers that verifies the certificates sent from servers. null to use the default or the results of parsing trustCertCollectionFile. This parameter is ignored if provider is not SslProvider.JDK.
      keyCertChainFile - an X.509 certificate chain file in PEM format. This provides the public key for mutual authentication. null to use the system default
      keyFile - a PKCS#8 private key file in PEM format. This provides the private key for mutual authentication. null for no mutual authentication.
      keyPassword - the password of the keyFile. null if it's not password-protected. Ignored if keyFile is null.
      keyManagerFactory - the KeyManagerFactory that provides the KeyManagers that is used to encrypt data being sent to servers. null to use the default or the results of parsing keyCertChainFile and keyFile. This parameter is ignored if provider is not SslProvider.JDK.
      ciphers - the cipher suites to enable, in the order of preference. null to use the default cipher suites.
      cipherFilter - a filter to apply over the supplied list of ciphers
      apn - Provides a means to configure parameters related to application protocol negotiation.
      sessionCacheSize - the size of the cache used for storing SSL session objects. 0 to use the default value.
      sessionTimeout - the timeout for the cached SSL session objects, in seconds. 0 to use the default value.
      Returns:
      a new client-side SslContext
      Throws:
      javax.net.ssl.SSLException

    • newClientContextInternal

      static SslContext newClientContextInternal(SslProvider provider, java.security.Provider sslContextProvider, java.security.cert.X509Certificate[] trustCert, javax.net.ssl.TrustManagerFactory trustManagerFactory, java.security.cert.X509Certificate[] keyCertChain, java.security.PrivateKey key, java.lang.String keyPassword, javax.net.ssl.KeyManagerFactory keyManagerFactory, java.lang.Iterable<java.lang.String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn, java.lang.String[] protocols, long sessionCacheSize, long sessionTimeout, boolean enableOcsp, java.security.SecureRandom secureRandom, java.lang.String keyStoreType, java.lang.String endpointIdentificationAlgorithm, java.util.List<javax.net.ssl.SNIServerName> serverNames, java.util.Map.Entry<SslContextOption<?>, java.lang.Object>[] options, java.util.List<OpenSslCredential> credentials) throws javax.net.ssl.SSLException
      Throws:
      javax.net.ssl.SSLException

    • newClientContextInternal

      static SslContext newClientContextInternal(SslProvider provider, java.security.Provider sslContextProvider, java.security.cert.X509Certificate[] trustCert, javax.net.ssl.TrustManagerFactory trustManagerFactory, java.security.cert.X509Certificate[] keyCertChain, java.security.PrivateKey key, java.lang.String keyPassword, javax.net.ssl.KeyManagerFactory keyManagerFactory, java.lang.Iterable<java.lang.String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn, java.lang.String[] protocols, long sessionCacheSize, long sessionTimeout, boolean startTls, boolean enableOcsp, java.security.SecureRandom secureRandom, java.lang.String keyStoreType, java.lang.String endpointIdentificationAlgorithm, java.util.List<javax.net.ssl.SNIServerName> serverNames, java.util.Map.Entry<SslContextOption<?>, java.lang.Object>[] options, java.util.List<OpenSslCredential> credentials) throws javax.net.ssl.SSLException
      Throws:
      javax.net.ssl.SSLException

    • toApplicationProtocolConfig

      static ApplicationProtocolConfig toApplicationProtocolConfig(java.lang.Iterable<java.lang.String> nextProtocols)

    • attributes

      public final AttributeMap attributes()
      Returns the AttributeMap that belongs to this SslContext .

    • isServer

      public final boolean isServer()
      Returns true if and only if this context is for server-side.

    • isClient

      public abstract boolean isClient()
      Returns the true if and only if this context is for client-side.

    • cipherSuites

      public abstract java.util.List<java.lang.String> cipherSuites()
      Returns the list of enabled cipher suites, in the order of preference.

    • sessionCacheSize

      public long sessionCacheSize()
      Returns the size of the cache used for storing SSL session objects.

    • sessionTimeout

      public long sessionTimeout()
      Returns the timeout for the cached SSL session objects, in seconds.

    • nextProtocols

      @Deprecated public final java.util.List<java.lang.String> nextProtocols()
      Deprecated.
      Use applicationProtocolNegotiator() instead.

    • applicationProtocolNegotiator

      public abstract ApplicationProtocolNegotiator applicationProtocolNegotiator()
      Returns the object responsible for negotiating application layer protocols for the TLS NPN/ALPN extensions.

    • newEngine

      public abstract javax.net.ssl.SSLEngine newEngine(ByteBufAllocator alloc)
      Creates a new SSLEngine.

      If SslProvider.OPENSSL_REFCNT is used then the object must be released. One way to do this is to wrap in a SslHandler and insert it into a pipeline. See newHandler(ByteBufAllocator).

      Returns:
      a new SSLEngine

    • newEngine

      public abstract javax.net.ssl.SSLEngine newEngine(ByteBufAllocator alloc, java.lang.String peerHost, int peerPort)
      Creates a new SSLEngine using advisory peer information.

      If SslProvider.OPENSSL_REFCNT is used then the object must be released. One way to do this is to wrap in a SslHandler and insert it into a pipeline. See newHandler(ByteBufAllocator, String, int).

      Parameters:
      peerHost - the non-authoritative name of the host
      peerPort - the non-authoritative port
      Returns:
      a new SSLEngine

    • sessionContext

      public abstract javax.net.ssl.SSLSessionContext sessionContext()
      Returns the SSLSessionContext object held by this context.

    • newHandler

      public final SslHandler newHandler(ByteBufAllocator alloc)
      Create a new SslHandler.
      See Also:

    • newHandler

      protected SslHandler newHandler(ByteBufAllocator alloc, boolean startTls)
      Create a new SslHandler.
      See Also:

    • newHandler

      public SslHandler newHandler(ByteBufAllocator alloc, java.util.concurrent.Executor delegatedTaskExecutor)
      Creates a new SslHandler.

      If SslProvider.OPENSSL_REFCNT is used then the returned SslHandler will release the engine that is wrapped. If the returned SslHandler is not inserted into a pipeline then you may leak native memory!

      Beware: the underlying generated SSLEngine won't have hostname verification enabled by default. If you create SslHandler for the client side and want proper security, we advice that you configure the SSLEngine (see SSLParameters.setEndpointIdentificationAlgorithm(String)): 

      SSLEngine sslEngine = sslHandler.engine();
SSLParameters sslParameters = sslEngine.getSSLParameters();
// only available since Java 7
sslParameters.setEndpointIdentificationAlgorithm("HTTPS");
sslEngine.setSSLParameters(sslParameters);

      The underlying SSLEngine may not follow the restrictions imposed by the SSLEngine javadocs which limits wrap/unwrap to operate on a single SSL/TLS packet.

      Parameters:
      alloc - If supported by the SSLEngine then the SSLEngine will use this to allocate ByteBuf objects.
      delegatedTaskExecutor - the Executor that will be used to execute tasks that are returned by SSLEngine.getDelegatedTask().
      Returns:
      a new SslHandler

    • newHandler

      protected SslHandler newHandler(ByteBufAllocator alloc, boolean startTls, java.util.concurrent.Executor executor)
      Create a new SslHandler.
      See Also:

    • newHandler

      public final SslHandler newHandler(ByteBufAllocator alloc, java.lang.String peerHost, int peerPort)
      Creates a new SslHandler
      See Also:

    • newHandler

      protected SslHandler newHandler(ByteBufAllocator alloc, java.lang.String peerHost, int peerPort, boolean startTls)
      Create a new SslHandler.
      See Also:

    • newHandler

      public SslHandler newHandler(ByteBufAllocator alloc, java.lang.String peerHost, int peerPort, java.util.concurrent.Executor delegatedTaskExecutor)
      Creates a new SslHandler with advisory peer information.

      If SslProvider.OPENSSL_REFCNT is used then the returned SslHandler will release the engine that is wrapped. If the returned SslHandler is not inserted into a pipeline then you may leak native memory!

      Beware: the underlying generated SSLEngine won't have hostname verification enabled by default. If you create SslHandler for the client side and want proper security, we advice that you configure the SSLEngine (see SSLParameters.setEndpointIdentificationAlgorithm(String)): 

      SSLEngine sslEngine = sslHandler.engine();
SSLParameters sslParameters = sslEngine.getSSLParameters();
// only available since Java 7
sslParameters.setEndpointIdentificationAlgorithm("HTTPS");
sslEngine.setSSLParameters(sslParameters);

      The underlying SSLEngine may not follow the restrictions imposed by the SSLEngine javadocs which limits wrap/unwrap to operate on a single SSL/TLS packet.

      Parameters:
      alloc - If supported by the SSLEngine then the SSLEngine will use this to allocate ByteBuf objects.
      peerHost - the non-authoritative name of the host
      peerPort - the non-authoritative port
      delegatedTaskExecutor - the Executor that will be used to execute tasks that are returned by SSLEngine.getDelegatedTask().
      Returns:
      a new SslHandler

    • newHandler

      protected SslHandler newHandler(ByteBufAllocator alloc, java.lang.String peerHost, int peerPort, boolean startTls, java.util.concurrent.Executor delegatedTaskExecutor)

    • generateKeySpec

      @Deprecated protected static java.security.spec.PKCS8EncodedKeySpec generateKeySpec(char[] password, byte[] key) throws java.io.IOException, java.security.NoSuchAlgorithmException, javax.crypto.NoSuchPaddingException, java.security.spec.InvalidKeySpecException, java.security.InvalidKeyException, java.security.InvalidAlgorithmParameterException
      Deprecated.
      Generates a key specification for an (encrypted) private key.
      Parameters:
      password - characters, if null an unencrypted key is assumed
      key - bytes of the DER encoded private key
      Returns:
      a key specification
      Throws:
      java.io.IOException - if parsing key fails
      java.security.NoSuchAlgorithmException - if the algorithm used to encrypt key is unknown
      javax.crypto.NoSuchPaddingException - if the padding scheme specified in the decryption algorithm is unknown
      java.security.spec.InvalidKeySpecException - if the decryption key based on password cannot be generated
      java.security.InvalidKeyException - if the decryption key based on password cannot be used to decrypt key
      java.security.InvalidAlgorithmParameterException - if decryption algorithm parameters are somehow faulty

    • getPBEAlgorithm

      private static java.lang.String getPBEAlgorithm(javax.crypto.EncryptedPrivateKeyInfo encryptedPrivateKeyInfo)

    • buildKeyStore

      protected static java.security.KeyStore buildKeyStore(java.security.cert.X509Certificate[] certChain, java.security.PrivateKey key, char[] keyPasswordChars, java.lang.String keyStoreType) throws java.security.KeyStoreException, java.security.NoSuchAlgorithmException, java.security.cert.CertificateException, java.io.IOException
      Generates a new KeyStore.
      Parameters:
      certChain - an X.509 certificate chain
      key - a PKCS#8 private key
      keyPasswordChars - the password of the keyFile. null if it's not password-protected.
      keyStoreType - The KeyStore Type you want to use
      Returns:
      generated KeyStore.
      Throws:
      java.security.KeyStoreException
      java.security.NoSuchAlgorithmException
      java.security.cert.CertificateException
      java.io.IOException

    • toPrivateKey

      protected static java.security.PrivateKey toPrivateKey(java.io.File keyFile, java.lang.String keyPassword) throws java.security.NoSuchAlgorithmException, javax.crypto.NoSuchPaddingException, java.security.spec.InvalidKeySpecException, java.security.InvalidAlgorithmParameterException, java.security.KeyException, java.io.IOException
      Throws:
      java.security.NoSuchAlgorithmException
      javax.crypto.NoSuchPaddingException
      java.security.spec.InvalidKeySpecException
      java.security.InvalidAlgorithmParameterException
      java.security.KeyException
      java.io.IOException

    • toPrivateKey

      static java.security.PrivateKey toPrivateKey(java.io.File keyFile, java.lang.String keyPassword, boolean tryBouncyCastle) throws java.security.NoSuchAlgorithmException, javax.crypto.NoSuchPaddingException, java.security.spec.InvalidKeySpecException, java.security.InvalidAlgorithmParameterException, java.security.KeyException, java.io.IOException
      Throws:
      java.security.NoSuchAlgorithmException
      javax.crypto.NoSuchPaddingException
      java.security.spec.InvalidKeySpecException
      java.security.InvalidAlgorithmParameterException
      java.security.KeyException
      java.io.IOException

    • toPrivateKey

      protected static java.security.PrivateKey toPrivateKey(java.io.InputStream keyInputStream, java.lang.String keyPassword) throws java.security.NoSuchAlgorithmException, javax.crypto.NoSuchPaddingException, java.security.spec.InvalidKeySpecException, java.security.InvalidAlgorithmParameterException, java.security.KeyException, java.io.IOException
      Throws:
      java.security.NoSuchAlgorithmException
      javax.crypto.NoSuchPaddingException
      java.security.spec.InvalidKeySpecException
      java.security.InvalidAlgorithmParameterException
      java.security.KeyException
      java.io.IOException

    • getPrivateKeyFromByteBuffer

      private static java.security.PrivateKey getPrivateKeyFromByteBuffer(ByteBuf encodedKeyBuf, java.lang.String keyPassword) throws java.security.NoSuchAlgorithmException, javax.crypto.NoSuchPaddingException, java.security.spec.InvalidKeySpecException, java.security.InvalidAlgorithmParameterException, java.security.KeyException, java.io.IOException
      Throws:
      java.security.NoSuchAlgorithmException
      javax.crypto.NoSuchPaddingException
      java.security.spec.InvalidKeySpecException
      java.security.InvalidAlgorithmParameterException
      java.security.KeyException
      java.io.IOException

    • buildTrustManagerFactory

      @Deprecated protected static javax.net.ssl.TrustManagerFactory buildTrustManagerFactory(java.io.File certChainFile, javax.net.ssl.TrustManagerFactory trustManagerFactory) throws java.security.NoSuchAlgorithmException, java.security.cert.CertificateException, java.security.KeyStoreException, java.io.IOException
      Deprecated.
      Build a TrustManagerFactory from a certificate chain file.
      Parameters:
      certChainFile - The certificate file to build from.
      trustManagerFactory - The existing TrustManagerFactory that will be used if not null.
      Returns:
      A TrustManagerFactory which contains the certificates in certChainFile
      Throws:
      java.security.NoSuchAlgorithmException
      java.security.cert.CertificateException
      java.security.KeyStoreException
      java.io.IOException

    • buildTrustManagerFactory

      protected static javax.net.ssl.TrustManagerFactory buildTrustManagerFactory(java.io.File certChainFile, javax.net.ssl.TrustManagerFactory trustManagerFactory, java.lang.String keyType) throws java.security.NoSuchAlgorithmException, java.security.cert.CertificateException, java.security.KeyStoreException, java.io.IOException
      Build a TrustManagerFactory from a certificate chain file.
      Parameters:
      certChainFile - The certificate file to build from.
      trustManagerFactory - The existing TrustManagerFactory that will be used if not null.
      keyType - The KeyStore Type you want to use
      Returns:
      A TrustManagerFactory which contains the certificates in certChainFile
      Throws:
      java.security.NoSuchAlgorithmException
      java.security.cert.CertificateException
      java.security.KeyStoreException
      java.io.IOException

    • toX509Certificates

      protected static java.security.cert.X509Certificate[] toX509Certificates(java.io.File file) throws java.security.cert.CertificateException
      Throws:
      java.security.cert.CertificateException

    • toX509Certificates

      protected static java.security.cert.X509Certificate[] toX509Certificates(java.io.InputStream in) throws java.security.cert.CertificateException
      Throws:
      java.security.cert.CertificateException

    • getCertificatesFromBuffers

      private static java.security.cert.X509Certificate[] getCertificatesFromBuffers(ByteBuf[] certs) throws java.security.cert.CertificateException
      Throws:
      java.security.cert.CertificateException

    • buildTrustManagerFactory

      protected static javax.net.ssl.TrustManagerFactory buildTrustManagerFactory(java.security.cert.X509Certificate[] certCollection, javax.net.ssl.TrustManagerFactory trustManagerFactory, java.lang.String keyStoreType) throws java.security.NoSuchAlgorithmException, java.security.cert.CertificateException, java.security.KeyStoreException, java.io.IOException
      Throws:
      java.security.NoSuchAlgorithmException
      java.security.cert.CertificateException
      java.security.KeyStoreException
      java.io.IOException

    • toPrivateKeyInternal

      static java.security.PrivateKey toPrivateKeyInternal(java.io.File keyFile, java.lang.String keyPassword) throws javax.net.ssl.SSLException
      Throws:
      javax.net.ssl.SSLException

    • toX509CertificatesInternal

      static java.security.cert.X509Certificate[] toX509CertificatesInternal(java.io.File file) throws javax.net.ssl.SSLException
      Throws:
      javax.net.ssl.SSLException

    • buildKeyManagerFactory

      protected static javax.net.ssl.KeyManagerFactory buildKeyManagerFactory(java.security.cert.X509Certificate[] certChainFile, java.lang.String keyAlgorithm, java.security.PrivateKey key, java.lang.String keyPassword, javax.net.ssl.KeyManagerFactory kmf, java.lang.String keyStore) throws java.security.KeyStoreException, java.security.NoSuchAlgorithmException, java.io.IOException, java.security.cert.CertificateException, java.security.UnrecoverableKeyException
      Throws:
      java.security.KeyStoreException
      java.security.NoSuchAlgorithmException
      java.io.IOException
      java.security.cert.CertificateException
      java.security.UnrecoverableKeyException

    • buildKeyManagerFactory

      static javax.net.ssl.KeyManagerFactory buildKeyManagerFactory(java.security.KeyStore ks, java.lang.String keyAlgorithm, char[] keyPasswordChars, javax.net.ssl.KeyManagerFactory kmf) throws java.security.KeyStoreException, java.security.NoSuchAlgorithmException, java.security.UnrecoverableKeyException
      Throws:
      java.security.KeyStoreException
      java.security.NoSuchAlgorithmException
      java.security.UnrecoverableKeyException

    • keyStorePassword

      static char[] keyStorePassword(java.lang.String keyPassword)

    • deriveSessionIdContext

      @UnstableApi protected static byte[] deriveSessionIdContext(ClientAuth clientAuth, java.security.cert.X509Certificate[] keyCertChain, java.security.cert.X509Certificate[] trustCertCollection, boolean opaque)
      Derives the session_id_context for a server context from the material that determines which clients it accepts: the ClientAuth mode, the certificate chain it presents and the certificates it trusts.

      The session_id_context scopes session resumption: a session (and therefore its client-authentication state) can only be resumed by a context that uses the same session_id_context. It must hence differ between contexts which, when sharing a session cache or session-ticket keys, must not accept each others sessions (for example because they use a different ClientAuth mode or trust configuration), but it should be the same for contexts that are configured identically (for example on different nodes of a cluster that share session-ticket keys), so resumption keeps working between them. See SSL_CTX_set_session_id_context and GHSA-6xv6-9mgg-mfvc.

      Parameters:
      clientAuth - the ClientAuth mode of the context.
      keyCertChain - the certificate chain the context presents, or null if unknown.
      trustCertCollection - the certificates the context trusts, or null if it uses the default.
      opaque - true if parts of the configuration (like a custom TrustManagerFactory) can not be digested. As we then can not tell if two contexts behave the same, a random salt is mixed in so the result is unique to the context.
      Returns:
      at most 32 bytes that are suitable to be used as session_id_context.

    • updateDigest

      private static void updateDigest(java.security.MessageDigest digest, java.security.cert.X509Certificate[] certificates) throws java.security.cert.CertificateEncodingException
      Throws:
      java.security.cert.CertificateEncodingException

    • updateDigest

      private static void updateDigest(java.security.MessageDigest digest, byte[] bytes)