Package io.netty.handler.ssl
Class JdkSslContext
- java.lang.Object
-
- io.netty.handler.ssl.SslContext
-
- io.netty.handler.ssl.JdkSslContext
-
- Direct Known Subclasses:
JdkSslClientContext
,JdkSslServerContext
public class JdkSslContext extends SslContext
AnSslContext
which uses JDK's SSL/TLS implementation.
-
-
Nested Class Summary
Nested Classes Modifier and Type Class Description private static class
JdkSslContext.Defaults
-
Field Summary
Fields Modifier and Type Field Description private JdkApplicationProtocolNegotiator
apn
private java.lang.String[]
cipherSuites
private ClientAuth
clientAuth
private static java.util.List<java.lang.String>
DEFAULT_CIPHERS
private static java.util.List<java.lang.String>
DEFAULT_CIPHERS_NON_TLSV13
private static java.lang.String[]
DEFAULT_PROTOCOLS
private static java.security.Provider
DEFAULT_PROVIDER
private boolean
isClient
private static InternalLogger
logger
(package private) static java.lang.String
PROTOCOL
private java.lang.String[]
protocols
private javax.net.ssl.SSLContext
sslContext
private static java.util.Set<java.lang.String>
SUPPORTED_CIPHERS
private static java.util.Set<java.lang.String>
SUPPORTED_CIPHERS_NON_TLSV13
private java.util.List<java.lang.String>
unmodifiableCipherSuites
-
Fields inherited from class io.netty.handler.ssl.SslContext
ALIAS, X509_CERT_FACTORY
-
-
Constructor Summary
Constructors Constructor Description JdkSslContext(javax.net.ssl.SSLContext sslContext, boolean isClient, ClientAuth clientAuth)
JdkSslContext(javax.net.ssl.SSLContext sslContext, boolean isClient, java.lang.Iterable<java.lang.String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn, ClientAuth clientAuth)
JdkSslContext(javax.net.ssl.SSLContext sslContext, boolean isClient, java.lang.Iterable<java.lang.String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn, ClientAuth clientAuth, java.lang.String[] protocols, boolean startTls)
Creates a newJdkSslContext
from a pre-configuredSSLContext
.JdkSslContext(javax.net.ssl.SSLContext sslContext, boolean isClient, java.lang.Iterable<java.lang.String> ciphers, CipherSuiteFilter cipherFilter, JdkApplicationProtocolNegotiator apn, ClientAuth clientAuth, java.lang.String[] protocols, boolean startTls)
-
Method Summary
All Methods Static Methods Instance Methods Concrete Methods Deprecated Methods Modifier and Type Method Description JdkApplicationProtocolNegotiator
applicationProtocolNegotiator()
Returns the object responsible for negotiating application layer protocols for the TLS NPN/ALPN extensions.protected static javax.net.ssl.KeyManagerFactory
buildKeyManagerFactory(java.io.File certChainFile, java.io.File keyFile, java.lang.String keyPassword, javax.net.ssl.KeyManagerFactory kmf)
Deprecated.will be removed.(package private) static javax.net.ssl.KeyManagerFactory
buildKeyManagerFactory(java.io.File certChainFile, java.io.File keyFile, java.lang.String keyPassword, javax.net.ssl.KeyManagerFactory kmf, java.lang.String keyStore)
Build aKeyManagerFactory
based upon a key file, key file password, and a certificate chain.protected static javax.net.ssl.KeyManagerFactory
buildKeyManagerFactory(java.io.File certChainFile, java.lang.String keyAlgorithm, java.io.File keyFile, java.lang.String keyPassword, javax.net.ssl.KeyManagerFactory kmf)
Deprecated.will be removed.(package private) static javax.net.ssl.KeyManagerFactory
buildKeyManagerFactory(java.io.File certChainFile, java.lang.String keyAlgorithm, java.io.File keyFile, java.lang.String keyPassword, javax.net.ssl.KeyManagerFactory kmf, java.lang.String keyStore)
Build aKeyManagerFactory
based upon a key algorithm, key file, key file password, and a certificate chain.java.util.List<java.lang.String>
cipherSuites()
Returns the list of enabled cipher suites, in the order of preference.private javax.net.ssl.SSLEngine
configureAndWrapEngine(javax.net.ssl.SSLEngine engine, ByteBufAllocator alloc)
javax.net.ssl.SSLContext
context()
Returns the JDKSSLContext
object held by this context.private static java.util.List<java.lang.String>
defaultCiphers(javax.net.ssl.SSLEngine engine, java.util.Set<java.lang.String> supportedCiphers)
private static java.lang.String[]
defaultProtocols(javax.net.ssl.SSLContext context, javax.net.ssl.SSLEngine engine)
boolean
isClient()
Returns thetrue
if and only if this context is for client-side.private static boolean
isTlsV13Supported(java.lang.String[] protocols)
javax.net.ssl.SSLEngine
newEngine(ByteBufAllocator alloc)
Creates a newSSLEngine
.javax.net.ssl.SSLEngine
newEngine(ByteBufAllocator alloc, java.lang.String peerHost, int peerPort)
Creates a newSSLEngine
using advisory peer information.javax.net.ssl.SSLSessionContext
sessionContext()
Returns the JDKSSLSessionContext
object held by this context.private static java.util.Set<java.lang.String>
supportedCiphers(javax.net.ssl.SSLEngine engine)
(package private) static JdkApplicationProtocolNegotiator
toNegotiator(ApplicationProtocolConfig config, boolean isServer)
Translate aApplicationProtocolConfig
object to aJdkApplicationProtocolNegotiator
object.-
Methods inherited from class io.netty.handler.ssl.SslContext
attributes, buildKeyManagerFactory, buildKeyManagerFactory, buildKeyStore, buildTrustManagerFactory, buildTrustManagerFactory, buildTrustManagerFactory, defaultClientProvider, defaultServerProvider, generateKeySpec, isServer, keyStorePassword, newClientContext, newClientContext, newClientContext, newClientContext, newClientContext, newClientContext, newClientContext, newClientContext, newClientContext, newClientContext, newClientContext, newClientContext, newClientContext, newClientContextInternal, newHandler, newHandler, newHandler, newHandler, newHandler, newHandler, newHandler, newHandler, newServerContext, newServerContext, newServerContext, newServerContext, newServerContext, newServerContext, newServerContext, newServerContext, newServerContext, newServerContext, newServerContext, newServerContextInternal, nextProtocols, sessionCacheSize, sessionTimeout, toApplicationProtocolConfig, toPrivateKey, toPrivateKey, toPrivateKey, toPrivateKeyInternal, toX509Certificates, toX509Certificates, toX509CertificatesInternal
-
-
-
-
Field Detail
-
logger
private static final InternalLogger logger
-
PROTOCOL
static final java.lang.String PROTOCOL
- See Also:
- Constant Field Values
-
DEFAULT_PROTOCOLS
private static final java.lang.String[] DEFAULT_PROTOCOLS
-
DEFAULT_CIPHERS
private static final java.util.List<java.lang.String> DEFAULT_CIPHERS
-
DEFAULT_CIPHERS_NON_TLSV13
private static final java.util.List<java.lang.String> DEFAULT_CIPHERS_NON_TLSV13
-
SUPPORTED_CIPHERS
private static final java.util.Set<java.lang.String> SUPPORTED_CIPHERS
-
SUPPORTED_CIPHERS_NON_TLSV13
private static final java.util.Set<java.lang.String> SUPPORTED_CIPHERS_NON_TLSV13
-
DEFAULT_PROVIDER
private static final java.security.Provider DEFAULT_PROVIDER
-
protocols
private final java.lang.String[] protocols
-
cipherSuites
private final java.lang.String[] cipherSuites
-
unmodifiableCipherSuites
private final java.util.List<java.lang.String> unmodifiableCipherSuites
-
apn
private final JdkApplicationProtocolNegotiator apn
-
clientAuth
private final ClientAuth clientAuth
-
sslContext
private final javax.net.ssl.SSLContext sslContext
-
isClient
private final boolean isClient
-
-
Constructor Detail
-
JdkSslContext
@Deprecated public JdkSslContext(javax.net.ssl.SSLContext sslContext, boolean isClient, ClientAuth clientAuth)
Deprecated.Creates a newJdkSslContext
from a pre-configuredSSLContext
.- Parameters:
sslContext
- theSSLContext
to use.isClient
-true
if this context should createSSLEngine
s for client-side usage.clientAuth
- theClientAuth
to use. This will only be used when {@param isClient} isfalse
.
-
JdkSslContext
@Deprecated public JdkSslContext(javax.net.ssl.SSLContext sslContext, boolean isClient, java.lang.Iterable<java.lang.String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn, ClientAuth clientAuth)
Deprecated.Creates a newJdkSslContext
from a pre-configuredSSLContext
.- Parameters:
sslContext
- theSSLContext
to use.isClient
-true
if this context should createSSLEngine
s for client-side usage.ciphers
- the ciphers to use ornull
if the standard should be used.cipherFilter
- the filter to use.apn
- theApplicationProtocolConfig
to use.clientAuth
- theClientAuth
to use. This will only be used when {@param isClient} isfalse
.
-
JdkSslContext
public JdkSslContext(javax.net.ssl.SSLContext sslContext, boolean isClient, java.lang.Iterable<java.lang.String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn, ClientAuth clientAuth, java.lang.String[] protocols, boolean startTls)
Creates a newJdkSslContext
from a pre-configuredSSLContext
.- Parameters:
sslContext
- theSSLContext
to use.isClient
-true
if this context should createSSLEngine
s for client-side usage.ciphers
- the ciphers to use ornull
if the standard should be used.cipherFilter
- the filter to use.apn
- theApplicationProtocolConfig
to use.clientAuth
- theClientAuth
to use. This will only be used when {@param isClient} isfalse
.protocols
- the protocols to enable, ornull
to enable the default protocols.startTls
-true
if the first write request shouldn't be encrypted
-
JdkSslContext
JdkSslContext(javax.net.ssl.SSLContext sslContext, boolean isClient, java.lang.Iterable<java.lang.String> ciphers, CipherSuiteFilter cipherFilter, JdkApplicationProtocolNegotiator apn, ClientAuth clientAuth, java.lang.String[] protocols, boolean startTls)
-
-
Method Detail
-
defaultProtocols
private static java.lang.String[] defaultProtocols(javax.net.ssl.SSLContext context, javax.net.ssl.SSLEngine engine)
-
supportedCiphers
private static java.util.Set<java.lang.String> supportedCiphers(javax.net.ssl.SSLEngine engine)
-
defaultCiphers
private static java.util.List<java.lang.String> defaultCiphers(javax.net.ssl.SSLEngine engine, java.util.Set<java.lang.String> supportedCiphers)
-
isTlsV13Supported
private static boolean isTlsV13Supported(java.lang.String[] protocols)
-
context
public final javax.net.ssl.SSLContext context()
Returns the JDKSSLContext
object held by this context.
-
isClient
public final boolean isClient()
Description copied from class:SslContext
Returns thetrue
if and only if this context is for client-side.- Specified by:
isClient
in classSslContext
-
sessionContext
public final javax.net.ssl.SSLSessionContext sessionContext()
Returns the JDKSSLSessionContext
object held by this context.- Specified by:
sessionContext
in classSslContext
-
cipherSuites
public final java.util.List<java.lang.String> cipherSuites()
Description copied from class:SslContext
Returns the list of enabled cipher suites, in the order of preference.- Specified by:
cipherSuites
in classSslContext
-
newEngine
public final javax.net.ssl.SSLEngine newEngine(ByteBufAllocator alloc)
Description copied from class:SslContext
Creates a newSSLEngine
.If
SslProvider.OPENSSL_REFCNT
is used then the object must be released. One way to do this is to wrap in aSslHandler
and insert it into a pipeline. SeeSslContext.newHandler(ByteBufAllocator)
.- Specified by:
newEngine
in classSslContext
- Returns:
- a new
SSLEngine
-
newEngine
public final javax.net.ssl.SSLEngine newEngine(ByteBufAllocator alloc, java.lang.String peerHost, int peerPort)
Description copied from class:SslContext
Creates a newSSLEngine
using advisory peer information.If
SslProvider.OPENSSL_REFCNT
is used then the object must be released. One way to do this is to wrap in aSslHandler
and insert it into a pipeline. SeeSslContext.newHandler(ByteBufAllocator, String, int)
.- Specified by:
newEngine
in classSslContext
peerHost
- the non-authoritative name of the hostpeerPort
- the non-authoritative port- Returns:
- a new
SSLEngine
-
configureAndWrapEngine
private javax.net.ssl.SSLEngine configureAndWrapEngine(javax.net.ssl.SSLEngine engine, ByteBufAllocator alloc)
-
applicationProtocolNegotiator
public final JdkApplicationProtocolNegotiator applicationProtocolNegotiator()
Description copied from class:SslContext
Returns the object responsible for negotiating application layer protocols for the TLS NPN/ALPN extensions.- Specified by:
applicationProtocolNegotiator
in classSslContext
-
toNegotiator
static JdkApplicationProtocolNegotiator toNegotiator(ApplicationProtocolConfig config, boolean isServer)
Translate aApplicationProtocolConfig
object to aJdkApplicationProtocolNegotiator
object.- Parameters:
config
- The configuration which defines the translationisServer
-true
if a serverfalse
otherwise.- Returns:
- The results of the translation
-
buildKeyManagerFactory
static javax.net.ssl.KeyManagerFactory buildKeyManagerFactory(java.io.File certChainFile, java.io.File keyFile, java.lang.String keyPassword, javax.net.ssl.KeyManagerFactory kmf, java.lang.String keyStore) throws java.security.UnrecoverableKeyException, java.security.KeyStoreException, java.security.NoSuchAlgorithmException, javax.crypto.NoSuchPaddingException, java.security.spec.InvalidKeySpecException, java.security.InvalidAlgorithmParameterException, java.security.cert.CertificateException, java.security.KeyException, java.io.IOException
Build aKeyManagerFactory
based upon a key file, key file password, and a certificate chain.- Parameters:
certChainFile
- an X.509 certificate chain file in PEM formatkeyFile
- a PKCS#8 private key file in PEM formatkeyPassword
- the password of thekeyFile
.null
if it's not password-protected.kmf
- The existingKeyManagerFactory
that will be used if notnull
keyStore
- theKeyStore
that should be used in theKeyManagerFactory
- Returns:
- A
KeyManagerFactory
based upon a key file, key file password, and a certificate chain. - Throws:
java.security.UnrecoverableKeyException
java.security.KeyStoreException
java.security.NoSuchAlgorithmException
javax.crypto.NoSuchPaddingException
java.security.spec.InvalidKeySpecException
java.security.InvalidAlgorithmParameterException
java.security.cert.CertificateException
java.security.KeyException
java.io.IOException
-
buildKeyManagerFactory
@Deprecated protected static javax.net.ssl.KeyManagerFactory buildKeyManagerFactory(java.io.File certChainFile, java.io.File keyFile, java.lang.String keyPassword, javax.net.ssl.KeyManagerFactory kmf) throws java.security.UnrecoverableKeyException, java.security.KeyStoreException, java.security.NoSuchAlgorithmException, javax.crypto.NoSuchPaddingException, java.security.spec.InvalidKeySpecException, java.security.InvalidAlgorithmParameterException, java.security.cert.CertificateException, java.security.KeyException, java.io.IOException
Deprecated.will be removed.Build aKeyManagerFactory
based upon a key file, key file password, and a certificate chain.- Parameters:
certChainFile
- an X.509 certificate chain file in PEM formatkeyFile
- a PKCS#8 private key file in PEM formatkeyPassword
- the password of thekeyFile
.null
if it's not password-protected.kmf
- The existingKeyManagerFactory
that will be used if notnull
- Returns:
- A
KeyManagerFactory
based upon a key file, key file password, and a certificate chain. - Throws:
java.security.UnrecoverableKeyException
java.security.KeyStoreException
java.security.NoSuchAlgorithmException
javax.crypto.NoSuchPaddingException
java.security.spec.InvalidKeySpecException
java.security.InvalidAlgorithmParameterException
java.security.cert.CertificateException
java.security.KeyException
java.io.IOException
-
buildKeyManagerFactory
static javax.net.ssl.KeyManagerFactory buildKeyManagerFactory(java.io.File certChainFile, java.lang.String keyAlgorithm, java.io.File keyFile, java.lang.String keyPassword, javax.net.ssl.KeyManagerFactory kmf, java.lang.String keyStore) throws java.security.KeyStoreException, java.security.NoSuchAlgorithmException, javax.crypto.NoSuchPaddingException, java.security.spec.InvalidKeySpecException, java.security.InvalidAlgorithmParameterException, java.io.IOException, java.security.cert.CertificateException, java.security.KeyException, java.security.UnrecoverableKeyException
Build aKeyManagerFactory
based upon a key algorithm, key file, key file password, and a certificate chain.- Parameters:
certChainFile
- an X.509 certificate chain file in PEM formatkeyAlgorithm
- the standard name of the requested algorithm. See the Java Secure Socket Extension Reference Guide for information about standard algorithm names.keyFile
- a PKCS#8 private key file in PEM formatkeyPassword
- the password of thekeyFile
.null
if it's not password-protected.kmf
- The existingKeyManagerFactory
that will be used if notnull
keyStore
- theKeyStore
that should be used in theKeyManagerFactory
- Returns:
- A
KeyManagerFactory
based upon a key algorithm, key file, key file password, and a certificate chain. - Throws:
java.security.KeyStoreException
java.security.NoSuchAlgorithmException
javax.crypto.NoSuchPaddingException
java.security.spec.InvalidKeySpecException
java.security.InvalidAlgorithmParameterException
java.io.IOException
java.security.cert.CertificateException
java.security.KeyException
java.security.UnrecoverableKeyException
-
buildKeyManagerFactory
@Deprecated protected static javax.net.ssl.KeyManagerFactory buildKeyManagerFactory(java.io.File certChainFile, java.lang.String keyAlgorithm, java.io.File keyFile, java.lang.String keyPassword, javax.net.ssl.KeyManagerFactory kmf) throws java.security.KeyStoreException, java.security.NoSuchAlgorithmException, javax.crypto.NoSuchPaddingException, java.security.spec.InvalidKeySpecException, java.security.InvalidAlgorithmParameterException, java.io.IOException, java.security.cert.CertificateException, java.security.KeyException, java.security.UnrecoverableKeyException
Deprecated.will be removed.Build aKeyManagerFactory
based upon a key algorithm, key file, key file password, and a certificate chain.- Parameters:
certChainFile
- an buildKeyManagerFactory X.509 certificate chain file in PEM formatkeyAlgorithm
- the standard name of the requested algorithm. See the Java Secure Socket Extension Reference Guide for information about standard algorithm names.keyFile
- a PKCS#8 private key file in PEM formatkeyPassword
- the password of thekeyFile
.null
if it's not password-protected.kmf
- The existingKeyManagerFactory
that will be used if notnull
- Returns:
- A
KeyManagerFactory
based upon a key algorithm, key file, key file password, and a certificate chain. - Throws:
java.security.KeyStoreException
java.security.NoSuchAlgorithmException
javax.crypto.NoSuchPaddingException
java.security.spec.InvalidKeySpecException
java.security.InvalidAlgorithmParameterException
java.io.IOException
java.security.cert.CertificateException
java.security.KeyException
java.security.UnrecoverableKeyException
-
-