Class SslContext
- Direct Known Subclasses:
DelegatingSslContext
,JdkSslContext
,ReferenceCountedOpenSslContext
SSLEngine
and SslHandler
.
Internally, it is implemented via JDK's SSLContext
or OpenSSL's SSL_CTX
.
Making your server support SSL/TLS
// In yourChannelInitializer
:ChannelPipeline
p = channel.pipeline();SslContext
sslCtx =SslContextBuilder.forServer(...)
.build(); p.addLast("ssl",sslCtx.newHandler(channel.alloc())
); ...
Making your client support SSL/TLS
// In yourChannelInitializer
:ChannelPipeline
p = channel.pipeline();SslContext
sslCtx =SslContextBuilder.forClient()
.build(); p.addLast("ssl",sslCtx.newHandler(channel.alloc(), host, port)
); ...
-
Field Summary
FieldsModifier and TypeFieldDescription(package private) static final String
private final AttributeMap
private static final String
private static final String
(package private) final ResumptionController
private final boolean
(package private) static final CertificateFactory
-
Constructor Summary
ConstructorsModifierConstructorDescriptionprotected
Creates a new instance (startTls set tofalse
).protected
SslContext
(boolean startTls) Creates a new instance.(package private)
SslContext
(boolean startTls, ResumptionController resumptionController) -
Method Summary
Modifier and TypeMethodDescriptionabstract ApplicationProtocolNegotiator
Returns the object responsible for negotiating application layer protocols for the TLS NPN/ALPN extensions.final AttributeMap
Returns theAttributeMap
that belongs to thisSslContext
.protected static KeyManagerFactory
buildKeyManagerFactory
(X509Certificate[] certChainFile, String keyAlgorithm, PrivateKey key, String keyPassword, KeyManagerFactory kmf, String keyStore) (package private) static KeyManagerFactory
buildKeyManagerFactory
(KeyStore ks, String keyAlgorithm, char[] keyPasswordChars, KeyManagerFactory kmf) protected static KeyStore
buildKeyStore
(X509Certificate[] certChain, PrivateKey key, char[] keyPasswordChars, String keyStoreType) Generates a newKeyStore
.protected static TrustManagerFactory
buildTrustManagerFactory
(File certChainFile, TrustManagerFactory trustManagerFactory) Deprecated.protected static TrustManagerFactory
buildTrustManagerFactory
(File certChainFile, TrustManagerFactory trustManagerFactory, String keyType) Build aTrustManagerFactory
from a certificate chain file.protected static TrustManagerFactory
buildTrustManagerFactory
(X509Certificate[] certCollection, TrustManagerFactory trustManagerFactory, String keyStoreType) Returns the list of enabled cipher suites, in the order of preference.static SslProvider
Returns the default client-side implementation provider currently in use.private static SslProvider
static SslProvider
Returns the default server-side implementation provider currently in use.protected static PKCS8EncodedKeySpec
generateKeySpec
(char[] password, byte[] key) Deprecated.private static X509Certificate[]
getCertificatesFromBuffers
(ByteBuf[] certs) private static String
getPBEAlgorithm
(EncryptedPrivateKeyInfo encryptedPrivateKeyInfo) private static PrivateKey
getPrivateKeyFromByteBuffer
(ByteBuf encodedKeyBuf, String keyPassword) abstract boolean
isClient()
Returns thetrue
if and only if this context is for client-side.final boolean
isServer()
Returnstrue
if and only if this context is for server-side.(package private) static char[]
keyStorePassword
(String keyPassword) static SslContext
Deprecated.static SslContext
newClientContext
(SslProvider provider) Deprecated.Replaced bySslContextBuilder
static SslContext
newClientContext
(SslProvider provider, File certChainFile) Deprecated.Replaced bySslContextBuilder
static SslContext
newClientContext
(SslProvider provider, File certChainFile, TrustManagerFactory trustManagerFactory) Deprecated.Replaced bySslContextBuilder
static SslContext
newClientContext
(SslProvider provider, File trustCertCollectionFile, TrustManagerFactory trustManagerFactory, File keyCertChainFile, File keyFile, String keyPassword, KeyManagerFactory keyManagerFactory, Iterable<String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn, long sessionCacheSize, long sessionTimeout) Deprecated.Replaced bySslContextBuilder
static SslContext
newClientContext
(SslProvider provider, File certChainFile, TrustManagerFactory trustManagerFactory, Iterable<String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn, long sessionCacheSize, long sessionTimeout) Deprecated.Replaced bySslContextBuilder
static SslContext
newClientContext
(SslProvider provider, File certChainFile, TrustManagerFactory trustManagerFactory, Iterable<String> ciphers, Iterable<String> nextProtocols, long sessionCacheSize, long sessionTimeout) Deprecated.Replaced bySslContextBuilder
static SslContext
newClientContext
(SslProvider provider, TrustManagerFactory trustManagerFactory) Deprecated.Replaced bySslContextBuilder
static SslContext
newClientContext
(File certChainFile) Deprecated.Replaced bySslContextBuilder
static SslContext
newClientContext
(File certChainFile, TrustManagerFactory trustManagerFactory) Deprecated.Replaced bySslContextBuilder
static SslContext
newClientContext
(File certChainFile, TrustManagerFactory trustManagerFactory, Iterable<String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn, long sessionCacheSize, long sessionTimeout) Deprecated.Replaced bySslContextBuilder
static SslContext
newClientContext
(File certChainFile, TrustManagerFactory trustManagerFactory, Iterable<String> ciphers, Iterable<String> nextProtocols, long sessionCacheSize, long sessionTimeout) Deprecated.Replaced bySslContextBuilder
static SslContext
newClientContext
(TrustManagerFactory trustManagerFactory) Deprecated.Replaced bySslContextBuilder
(package private) static SslContext
newClientContextInternal
(SslProvider provider, Provider sslContextProvider, X509Certificate[] trustCert, TrustManagerFactory trustManagerFactory, X509Certificate[] keyCertChain, PrivateKey key, String keyPassword, KeyManagerFactory keyManagerFactory, Iterable<String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn, String[] protocols, long sessionCacheSize, long sessionTimeout, boolean enableOcsp, SecureRandom secureRandom, String keyStoreType, String endpointIdentificationAlgorithm, Map.Entry<SslContextOption<?>, Object>... options) abstract SSLEngine
newEngine
(ByteBufAllocator alloc) Creates a newSSLEngine
.abstract SSLEngine
newEngine
(ByteBufAllocator alloc, String peerHost, int peerPort) Creates a newSSLEngine
using advisory peer information.final SslHandler
newHandler
(ByteBufAllocator alloc) Create a new SslHandler.protected SslHandler
newHandler
(ByteBufAllocator alloc, boolean startTls) Create a new SslHandler.protected SslHandler
newHandler
(ByteBufAllocator alloc, boolean startTls, Executor executor) Create a new SslHandler.final SslHandler
newHandler
(ByteBufAllocator alloc, String peerHost, int peerPort) Creates a newSslHandler
protected SslHandler
newHandler
(ByteBufAllocator alloc, String peerHost, int peerPort, boolean startTls) Create a new SslHandler.protected SslHandler
newHandler
(ByteBufAllocator alloc, String peerHost, int peerPort, boolean startTls, Executor delegatedTaskExecutor) newHandler
(ByteBufAllocator alloc, String peerHost, int peerPort, Executor delegatedTaskExecutor) Creates a newSslHandler
with advisory peer information.newHandler
(ByteBufAllocator alloc, Executor delegatedTaskExecutor) Creates a newSslHandler
.static SslContext
newServerContext
(SslProvider provider, File certChainFile, File keyFile) Deprecated.Replaced bySslContextBuilder
static SslContext
newServerContext
(SslProvider provider, File certChainFile, File keyFile, String keyPassword) Deprecated.Replaced bySslContextBuilder
static SslContext
newServerContext
(SslProvider provider, File certChainFile, File keyFile, String keyPassword, Iterable<String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn, long sessionCacheSize, long sessionTimeout) Deprecated.Replaced bySslContextBuilder
static SslContext
newServerContext
(SslProvider provider, File certChainFile, File keyFile, String keyPassword, Iterable<String> ciphers, Iterable<String> nextProtocols, long sessionCacheSize, long sessionTimeout) Deprecated.Replaced bySslContextBuilder
static SslContext
newServerContext
(SslProvider provider, File certChainFile, File keyFile, String keyPassword, TrustManagerFactory trustManagerFactory, Iterable<String> ciphers, Iterable<String> nextProtocols, long sessionCacheSize, long sessionTimeout) Deprecated.Replaced bySslContextBuilder
static SslContext
newServerContext
(SslProvider provider, File trustCertCollectionFile, TrustManagerFactory trustManagerFactory, File keyCertChainFile, File keyFile, String keyPassword, KeyManagerFactory keyManagerFactory, Iterable<String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn, long sessionCacheSize, long sessionTimeout) Deprecated.Replaced bySslContextBuilder
(package private) static SslContext
newServerContext
(SslProvider provider, File trustCertCollectionFile, TrustManagerFactory trustManagerFactory, File keyCertChainFile, File keyFile, String keyPassword, KeyManagerFactory keyManagerFactory, Iterable<String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn, long sessionCacheSize, long sessionTimeout, String keyStore) Creates a new server-sideSslContext
.static SslContext
newServerContext
(File certChainFile, File keyFile) Deprecated.Replaced bySslContextBuilder
static SslContext
newServerContext
(File certChainFile, File keyFile, String keyPassword) Deprecated.Replaced bySslContextBuilder
static SslContext
newServerContext
(File certChainFile, File keyFile, String keyPassword, Iterable<String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn, long sessionCacheSize, long sessionTimeout) Deprecated.Replaced bySslContextBuilder
static SslContext
newServerContext
(File certChainFile, File keyFile, String keyPassword, Iterable<String> ciphers, Iterable<String> nextProtocols, long sessionCacheSize, long sessionTimeout) Deprecated.Replaced bySslContextBuilder
(package private) static SslContext
newServerContextInternal
(SslProvider provider, Provider sslContextProvider, X509Certificate[] trustCertCollection, TrustManagerFactory trustManagerFactory, X509Certificate[] keyCertChain, PrivateKey key, String keyPassword, KeyManagerFactory keyManagerFactory, Iterable<String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn, long sessionCacheSize, long sessionTimeout, ClientAuth clientAuth, String[] protocols, boolean startTls, boolean enableOcsp, SecureRandom secureRandom, String keyStoreType, Map.Entry<SslContextOption<?>, Object>... ctxOptions) Deprecated.UseapplicationProtocolNegotiator()
instead.long
Returns the size of the cache used for storing SSL session objects.abstract SSLSessionContext
Returns theSSLSessionContext
object held by this context.long
Returns the timeout for the cached SSL session objects, in seconds.(package private) static ApplicationProtocolConfig
toApplicationProtocolConfig
(Iterable<String> nextProtocols) protected static PrivateKey
toPrivateKey
(File keyFile, String keyPassword) (package private) static PrivateKey
toPrivateKey
(File keyFile, String keyPassword, boolean tryBouncyCastle) protected static PrivateKey
toPrivateKey
(InputStream keyInputStream, String keyPassword) (package private) static PrivateKey
toPrivateKeyInternal
(File keyFile, String keyPassword) protected static X509Certificate[]
toX509Certificates
(File file) protected static X509Certificate[]
(package private) static X509Certificate[]
private static void
verifyNullSslContextProvider
(SslProvider provider, Provider sslContextProvider)
-
Field Details
-
ALIAS
- See Also:
-
X509_CERT_FACTORY
-
startTls
private final boolean startTls -
attributes
-
resumptionController
-
OID_PKCS5_PBES2
- See Also:
-
PBES2
- See Also:
-
-
Constructor Details
-
SslContext
protected SslContext()Creates a new instance (startTls set tofalse
). -
SslContext
protected SslContext(boolean startTls) Creates a new instance. -
SslContext
SslContext(boolean startTls, ResumptionController resumptionController)
-
-
Method Details
-
defaultServerProvider
Returns the default server-side implementation provider currently in use.- Returns:
SslProvider.OPENSSL
if OpenSSL is available.SslProvider.JDK
otherwise.
-
defaultClientProvider
Returns the default client-side implementation provider currently in use.- Returns:
SslProvider.OPENSSL
if OpenSSL is available.SslProvider.JDK
otherwise.
-
defaultProvider
-
newServerContext
@Deprecated public static SslContext newServerContext(File certChainFile, File keyFile) throws SSLException Deprecated.Replaced bySslContextBuilder
Creates a new server-sideSslContext
.- Parameters:
certChainFile
- an X.509 certificate chain file in PEM formatkeyFile
- a PKCS#8 private key file in PEM format- Returns:
- a new server-side
SslContext
- Throws:
SSLException
-
newServerContext
@Deprecated public static SslContext newServerContext(File certChainFile, File keyFile, String keyPassword) throws SSLException Deprecated.Replaced bySslContextBuilder
Creates a new server-sideSslContext
.- Parameters:
certChainFile
- an X.509 certificate chain file in PEM formatkeyFile
- a PKCS#8 private key file in PEM formatkeyPassword
- the password of thekeyFile
.null
if it's not password-protected.- Returns:
- a new server-side
SslContext
- Throws:
SSLException
-
newServerContext
@Deprecated public static SslContext newServerContext(File certChainFile, File keyFile, String keyPassword, Iterable<String> ciphers, Iterable<String> nextProtocols, long sessionCacheSize, long sessionTimeout) throws SSLException Deprecated.Replaced bySslContextBuilder
Creates a new server-sideSslContext
.- Parameters:
certChainFile
- an X.509 certificate chain file in PEM formatkeyFile
- a PKCS#8 private key file in PEM formatkeyPassword
- the password of thekeyFile
.null
if it's not password-protected.ciphers
- the cipher suites to enable, in the order of preference.null
to use the default cipher suites.nextProtocols
- the application layer protocols to accept, in the order of preference.null
to disable TLS NPN/ALPN extension.sessionCacheSize
- the size of the cache used for storing SSL session objects.0
to use the default value.sessionTimeout
- the timeout for the cached SSL session objects, in seconds.0
to use the default value.- Returns:
- a new server-side
SslContext
- Throws:
SSLException
-
newServerContext
@Deprecated public static SslContext newServerContext(File certChainFile, File keyFile, String keyPassword, Iterable<String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn, long sessionCacheSize, long sessionTimeout) throws SSLException Deprecated.Replaced bySslContextBuilder
Creates a new server-sideSslContext
.- Parameters:
certChainFile
- an X.509 certificate chain file in PEM formatkeyFile
- a PKCS#8 private key file in PEM formatkeyPassword
- the password of thekeyFile
.null
if it's not password-protected.ciphers
- the cipher suites to enable, in the order of preference.null
to use the default cipher suites.cipherFilter
- a filter to apply over the supplied list of ciphersapn
- Provides a means to configure parameters related to application protocol negotiation.sessionCacheSize
- the size of the cache used for storing SSL session objects.0
to use the default value.sessionTimeout
- the timeout for the cached SSL session objects, in seconds.0
to use the default value.- Returns:
- a new server-side
SslContext
- Throws:
SSLException
-
newServerContext
@Deprecated public static SslContext newServerContext(SslProvider provider, File certChainFile, File keyFile) throws SSLException Deprecated.Replaced bySslContextBuilder
Creates a new server-sideSslContext
.- Parameters:
provider
- theSslContext
implementation to use.null
to use the current default one.certChainFile
- an X.509 certificate chain file in PEM formatkeyFile
- a PKCS#8 private key file in PEM format- Returns:
- a new server-side
SslContext
- Throws:
SSLException
-
newServerContext
@Deprecated public static SslContext newServerContext(SslProvider provider, File certChainFile, File keyFile, String keyPassword) throws SSLException Deprecated.Replaced bySslContextBuilder
Creates a new server-sideSslContext
.- Parameters:
provider
- theSslContext
implementation to use.null
to use the current default one.certChainFile
- an X.509 certificate chain file in PEM formatkeyFile
- a PKCS#8 private key file in PEM formatkeyPassword
- the password of thekeyFile
.null
if it's not password-protected.- Returns:
- a new server-side
SslContext
- Throws:
SSLException
-
newServerContext
@Deprecated public static SslContext newServerContext(SslProvider provider, File certChainFile, File keyFile, String keyPassword, Iterable<String> ciphers, Iterable<String> nextProtocols, long sessionCacheSize, long sessionTimeout) throws SSLException Deprecated.Replaced bySslContextBuilder
Creates a new server-sideSslContext
.- Parameters:
provider
- theSslContext
implementation to use.null
to use the current default one.certChainFile
- an X.509 certificate chain file in PEM formatkeyFile
- a PKCS#8 private key file in PEM formatkeyPassword
- the password of thekeyFile
.null
if it's not password-protected.ciphers
- the cipher suites to enable, in the order of preference.null
to use the default cipher suites.nextProtocols
- the application layer protocols to accept, in the order of preference.null
to disable TLS NPN/ALPN extension.sessionCacheSize
- the size of the cache used for storing SSL session objects.0
to use the default value.sessionTimeout
- the timeout for the cached SSL session objects, in seconds.0
to use the default value.- Returns:
- a new server-side
SslContext
- Throws:
SSLException
-
newServerContext
@Deprecated public static SslContext newServerContext(SslProvider provider, File certChainFile, File keyFile, String keyPassword, TrustManagerFactory trustManagerFactory, Iterable<String> ciphers, Iterable<String> nextProtocols, long sessionCacheSize, long sessionTimeout) throws SSLException Deprecated.Replaced bySslContextBuilder
Creates a new server-sideSslContext
.- Parameters:
provider
- theSslContext
implementation to use.null
to use the current default one.certChainFile
- an X.509 certificate chain file in PEM formatkeyFile
- a PKCS#8 private key file in PEM formatkeyPassword
- the password of thekeyFile
.null
if it's not password-protected.trustManagerFactory
- theTrustManagerFactory
that provides theTrustManager
s that verifies the certificates sent from servers.null
to use the default.ciphers
- the cipher suites to enable, in the order of preference.null
to use the default cipher suites.nextProtocols
- the application layer protocols to accept, in the order of preference.null
to disable TLS NPN/ALPN extension.sessionCacheSize
- the size of the cache used for storing SSL session objects.0
to use the default value.sessionTimeout
- the timeout for the cached SSL session objects, in seconds.0
to use the default value.- Returns:
- a new server-side
SslContext
- Throws:
SSLException
-
newServerContext
@Deprecated public static SslContext newServerContext(SslProvider provider, File certChainFile, File keyFile, String keyPassword, Iterable<String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn, long sessionCacheSize, long sessionTimeout) throws SSLException Deprecated.Replaced bySslContextBuilder
Creates a new server-sideSslContext
.- Parameters:
provider
- theSslContext
implementation to use.null
to use the current default one.certChainFile
- an X.509 certificate chain file in PEM formatkeyFile
- a PKCS#8 private key file in PEM formatkeyPassword
- the password of thekeyFile
.null
if it's not password-protected.ciphers
- the cipher suites to enable, in the order of preference.null
to use the default cipher suites.cipherFilter
- a filter to apply over the supplied list of ciphers Only required ifprovider
isSslProvider.JDK
apn
- Provides a means to configure parameters related to application protocol negotiation.sessionCacheSize
- the size of the cache used for storing SSL session objects.0
to use the default value.sessionTimeout
- the timeout for the cached SSL session objects, in seconds.0
to use the default value.- Returns:
- a new server-side
SslContext
- Throws:
SSLException
-
newServerContext
@Deprecated public static SslContext newServerContext(SslProvider provider, File trustCertCollectionFile, TrustManagerFactory trustManagerFactory, File keyCertChainFile, File keyFile, String keyPassword, KeyManagerFactory keyManagerFactory, Iterable<String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn, long sessionCacheSize, long sessionTimeout) throws SSLException Deprecated.Replaced bySslContextBuilder
Creates a new server-sideSslContext
.- Parameters:
provider
- theSslContext
implementation to use.null
to use the current default one.trustCertCollectionFile
- an X.509 certificate collection file in PEM format. This provides the certificate collection used for mutual authentication.null
to use the system defaulttrustManagerFactory
- theTrustManagerFactory
that provides theTrustManager
s that verifies the certificates sent from clients.null
to use the default or the results of parsingtrustCertCollectionFile
. This parameter is ignored ifprovider
is notSslProvider.JDK
.keyCertChainFile
- an X.509 certificate chain file in PEM formatkeyFile
- a PKCS#8 private key file in PEM formatkeyPassword
- the password of thekeyFile
.null
if it's not password-protected.keyManagerFactory
- theKeyManagerFactory
that provides theKeyManager
s that is used to encrypt data being sent to clients.null
to use the default or the results of parsingkeyCertChainFile
andkeyFile
. This parameter is ignored ifprovider
is notSslProvider.JDK
.ciphers
- the cipher suites to enable, in the order of preference.null
to use the default cipher suites.cipherFilter
- a filter to apply over the supplied list of ciphers Only required ifprovider
isSslProvider.JDK
apn
- Provides a means to configure parameters related to application protocol negotiation.sessionCacheSize
- the size of the cache used for storing SSL session objects.0
to use the default value.sessionTimeout
- the timeout for the cached SSL session objects, in seconds.0
to use the default value.- Returns:
- a new server-side
SslContext
- Throws:
SSLException
-
newServerContext
static SslContext newServerContext(SslProvider provider, File trustCertCollectionFile, TrustManagerFactory trustManagerFactory, File keyCertChainFile, File keyFile, String keyPassword, KeyManagerFactory keyManagerFactory, Iterable<String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn, long sessionCacheSize, long sessionTimeout, String keyStore) throws SSLException Creates a new server-sideSslContext
.- Parameters:
provider
- theSslContext
implementation to use.null
to use the current default one.trustCertCollectionFile
- an X.509 certificate collection file in PEM format. This provides the certificate collection used for mutual authentication.null
to use the system defaulttrustManagerFactory
- theTrustManagerFactory
that provides theTrustManager
s that verifies the certificates sent from clients.null
to use the default or the results of parsingtrustCertCollectionFile
. This parameter is ignored ifprovider
is notSslProvider.JDK
.keyCertChainFile
- an X.509 certificate chain file in PEM formatkeyFile
- a PKCS#8 private key file in PEM formatkeyPassword
- the password of thekeyFile
.null
if it's not password-protected.keyManagerFactory
- theKeyManagerFactory
that provides theKeyManager
s that is used to encrypt data being sent to clients.null
to use the default or the results of parsingkeyCertChainFile
andkeyFile
. This parameter is ignored ifprovider
is notSslProvider.JDK
.ciphers
- the cipher suites to enable, in the order of preference.null
to use the default cipher suites.cipherFilter
- a filter to apply over the supplied list of ciphers Only required ifprovider
isSslProvider.JDK
apn
- Provides a means to configure parameters related to application protocol negotiation.sessionCacheSize
- the size of the cache used for storing SSL session objects.0
to use the default value.sessionTimeout
- the timeout for the cached SSL session objects, in seconds.0
to use the default value.keyStore
- the keystore type that should be used- Returns:
- a new server-side
SslContext
- Throws:
SSLException
-
newServerContextInternal
static SslContext newServerContextInternal(SslProvider provider, Provider sslContextProvider, X509Certificate[] trustCertCollection, TrustManagerFactory trustManagerFactory, X509Certificate[] keyCertChain, PrivateKey key, String keyPassword, KeyManagerFactory keyManagerFactory, Iterable<String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn, long sessionCacheSize, long sessionTimeout, ClientAuth clientAuth, String[] protocols, boolean startTls, boolean enableOcsp, SecureRandom secureRandom, String keyStoreType, Map.Entry<SslContextOption<?>, Object>... ctxOptions) throws SSLException- Throws:
SSLException
-
verifyNullSslContextProvider
-
newClientContext
Deprecated.Replaced bySslContextBuilder
Creates a new client-sideSslContext
.- Returns:
- a new client-side
SslContext
- Throws:
SSLException
-
newClientContext
Deprecated.Replaced bySslContextBuilder
Creates a new client-sideSslContext
.- Parameters:
certChainFile
- an X.509 certificate chain file in PEM format- Returns:
- a new client-side
SslContext
- Throws:
SSLException
-
newClientContext
@Deprecated public static SslContext newClientContext(TrustManagerFactory trustManagerFactory) throws SSLException Deprecated.Replaced bySslContextBuilder
Creates a new client-sideSslContext
.- Parameters:
trustManagerFactory
- theTrustManagerFactory
that provides theTrustManager
s that verifies the certificates sent from servers.null
to use the default.- Returns:
- a new client-side
SslContext
- Throws:
SSLException
-
newClientContext
@Deprecated public static SslContext newClientContext(File certChainFile, TrustManagerFactory trustManagerFactory) throws SSLException Deprecated.Replaced bySslContextBuilder
Creates a new client-sideSslContext
.- Parameters:
certChainFile
- an X.509 certificate chain file in PEM format.null
to use the system defaulttrustManagerFactory
- theTrustManagerFactory
that provides theTrustManager
s that verifies the certificates sent from servers.null
to use the default.- Returns:
- a new client-side
SslContext
- Throws:
SSLException
-
newClientContext
@Deprecated public static SslContext newClientContext(File certChainFile, TrustManagerFactory trustManagerFactory, Iterable<String> ciphers, Iterable<String> nextProtocols, long sessionCacheSize, long sessionTimeout) throws SSLException Deprecated.Replaced bySslContextBuilder
Creates a new client-sideSslContext
.- Parameters:
certChainFile
- an X.509 certificate chain file in PEM format.null
to use the system defaulttrustManagerFactory
- theTrustManagerFactory
that provides theTrustManager
s that verifies the certificates sent from servers.null
to use the default.ciphers
- the cipher suites to enable, in the order of preference.null
to use the default cipher suites.nextProtocols
- the application layer protocols to accept, in the order of preference.null
to disable TLS NPN/ALPN extension.sessionCacheSize
- the size of the cache used for storing SSL session objects.0
to use the default value.sessionTimeout
- the timeout for the cached SSL session objects, in seconds.0
to use the default value.- Returns:
- a new client-side
SslContext
- Throws:
SSLException
-
newClientContext
@Deprecated public static SslContext newClientContext(File certChainFile, TrustManagerFactory trustManagerFactory, Iterable<String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn, long sessionCacheSize, long sessionTimeout) throws SSLException Deprecated.Replaced bySslContextBuilder
Creates a new client-sideSslContext
.- Parameters:
certChainFile
- an X.509 certificate chain file in PEM format.null
to use the system defaulttrustManagerFactory
- theTrustManagerFactory
that provides theTrustManager
s that verifies the certificates sent from servers.null
to use the default.ciphers
- the cipher suites to enable, in the order of preference.null
to use the default cipher suites.cipherFilter
- a filter to apply over the supplied list of ciphersapn
- Provides a means to configure parameters related to application protocol negotiation.sessionCacheSize
- the size of the cache used for storing SSL session objects.0
to use the default value.sessionTimeout
- the timeout for the cached SSL session objects, in seconds.0
to use the default value.- Returns:
- a new client-side
SslContext
- Throws:
SSLException
-
newClientContext
Deprecated.Replaced bySslContextBuilder
Creates a new client-sideSslContext
.- Parameters:
provider
- theSslContext
implementation to use.null
to use the current default one.- Returns:
- a new client-side
SslContext
- Throws:
SSLException
-
newClientContext
@Deprecated public static SslContext newClientContext(SslProvider provider, File certChainFile) throws SSLException Deprecated.Replaced bySslContextBuilder
Creates a new client-sideSslContext
.- Parameters:
provider
- theSslContext
implementation to use.null
to use the current default one.certChainFile
- an X.509 certificate chain file in PEM format.null
to use the system default- Returns:
- a new client-side
SslContext
- Throws:
SSLException
-
newClientContext
@Deprecated public static SslContext newClientContext(SslProvider provider, TrustManagerFactory trustManagerFactory) throws SSLException Deprecated.Replaced bySslContextBuilder
Creates a new client-sideSslContext
.- Parameters:
provider
- theSslContext
implementation to use.null
to use the current default one.trustManagerFactory
- theTrustManagerFactory
that provides theTrustManager
s that verifies the certificates sent from servers.null
to use the default.- Returns:
- a new client-side
SslContext
- Throws:
SSLException
-
newClientContext
@Deprecated public static SslContext newClientContext(SslProvider provider, File certChainFile, TrustManagerFactory trustManagerFactory) throws SSLException Deprecated.Replaced bySslContextBuilder
Creates a new client-sideSslContext
.- Parameters:
provider
- theSslContext
implementation to use.null
to use the current default one.certChainFile
- an X.509 certificate chain file in PEM format.null
to use the system defaulttrustManagerFactory
- theTrustManagerFactory
that provides theTrustManager
s that verifies the certificates sent from servers.null
to use the default.- Returns:
- a new client-side
SslContext
- Throws:
SSLException
-
newClientContext
@Deprecated public static SslContext newClientContext(SslProvider provider, File certChainFile, TrustManagerFactory trustManagerFactory, Iterable<String> ciphers, Iterable<String> nextProtocols, long sessionCacheSize, long sessionTimeout) throws SSLException Deprecated.Replaced bySslContextBuilder
Creates a new client-sideSslContext
.- Parameters:
provider
- theSslContext
implementation to use.null
to use the current default one.certChainFile
- an X.509 certificate chain file in PEM format.null
to use the system defaulttrustManagerFactory
- theTrustManagerFactory
that provides theTrustManager
s that verifies the certificates sent from servers.null
to use the default.ciphers
- the cipher suites to enable, in the order of preference.null
to use the default cipher suites.nextProtocols
- the application layer protocols to accept, in the order of preference.null
to disable TLS NPN/ALPN extension.sessionCacheSize
- the size of the cache used for storing SSL session objects.0
to use the default value.sessionTimeout
- the timeout for the cached SSL session objects, in seconds.0
to use the default value.- Returns:
- a new client-side
SslContext
- Throws:
SSLException
-
newClientContext
@Deprecated public static SslContext newClientContext(SslProvider provider, File certChainFile, TrustManagerFactory trustManagerFactory, Iterable<String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn, long sessionCacheSize, long sessionTimeout) throws SSLException Deprecated.Replaced bySslContextBuilder
Creates a new client-sideSslContext
.- Parameters:
provider
- theSslContext
implementation to use.null
to use the current default one.certChainFile
- an X.509 certificate chain file in PEM format.null
to use the system defaulttrustManagerFactory
- theTrustManagerFactory
that provides theTrustManager
s that verifies the certificates sent from servers.null
to use the default.ciphers
- the cipher suites to enable, in the order of preference.null
to use the default cipher suites.cipherFilter
- a filter to apply over the supplied list of ciphersapn
- Provides a means to configure parameters related to application protocol negotiation.sessionCacheSize
- the size of the cache used for storing SSL session objects.0
to use the default value.sessionTimeout
- the timeout for the cached SSL session objects, in seconds.0
to use the default value.- Returns:
- a new client-side
SslContext
- Throws:
SSLException
-
newClientContext
@Deprecated public static SslContext newClientContext(SslProvider provider, File trustCertCollectionFile, TrustManagerFactory trustManagerFactory, File keyCertChainFile, File keyFile, String keyPassword, KeyManagerFactory keyManagerFactory, Iterable<String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn, long sessionCacheSize, long sessionTimeout) throws SSLException Deprecated.Replaced bySslContextBuilder
Creates a new client-sideSslContext
.- Parameters:
provider
- theSslContext
implementation to use.null
to use the current default one.trustCertCollectionFile
- an X.509 certificate collection file in PEM format.null
to use the system defaulttrustManagerFactory
- theTrustManagerFactory
that provides theTrustManager
s that verifies the certificates sent from servers.null
to use the default or the results of parsingtrustCertCollectionFile
. This parameter is ignored ifprovider
is notSslProvider.JDK
.keyCertChainFile
- an X.509 certificate chain file in PEM format. This provides the public key for mutual authentication.null
to use the system defaultkeyFile
- a PKCS#8 private key file in PEM format. This provides the private key for mutual authentication.null
for no mutual authentication.keyPassword
- the password of thekeyFile
.null
if it's not password-protected. Ignored ifkeyFile
isnull
.keyManagerFactory
- theKeyManagerFactory
that provides theKeyManager
s that is used to encrypt data being sent to servers.null
to use the default or the results of parsingkeyCertChainFile
andkeyFile
. This parameter is ignored ifprovider
is notSslProvider.JDK
.ciphers
- the cipher suites to enable, in the order of preference.null
to use the default cipher suites.cipherFilter
- a filter to apply over the supplied list of ciphersapn
- Provides a means to configure parameters related to application protocol negotiation.sessionCacheSize
- the size of the cache used for storing SSL session objects.0
to use the default value.sessionTimeout
- the timeout for the cached SSL session objects, in seconds.0
to use the default value.- Returns:
- a new client-side
SslContext
- Throws:
SSLException
-
newClientContextInternal
static SslContext newClientContextInternal(SslProvider provider, Provider sslContextProvider, X509Certificate[] trustCert, TrustManagerFactory trustManagerFactory, X509Certificate[] keyCertChain, PrivateKey key, String keyPassword, KeyManagerFactory keyManagerFactory, Iterable<String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn, String[] protocols, long sessionCacheSize, long sessionTimeout, boolean enableOcsp, SecureRandom secureRandom, String keyStoreType, String endpointIdentificationAlgorithm, Map.Entry<SslContextOption<?>, Object>... options) throws SSLException- Throws:
SSLException
-
toApplicationProtocolConfig
-
attributes
Returns theAttributeMap
that belongs to thisSslContext
. -
isServer
public final boolean isServer()Returnstrue
if and only if this context is for server-side. -
isClient
public abstract boolean isClient()Returns thetrue
if and only if this context is for client-side. -
cipherSuites
Returns the list of enabled cipher suites, in the order of preference. -
sessionCacheSize
public long sessionCacheSize()Returns the size of the cache used for storing SSL session objects. -
sessionTimeout
public long sessionTimeout()Returns the timeout for the cached SSL session objects, in seconds. -
nextProtocols
Deprecated.UseapplicationProtocolNegotiator()
instead. -
applicationProtocolNegotiator
Returns the object responsible for negotiating application layer protocols for the TLS NPN/ALPN extensions. -
newEngine
Creates a newSSLEngine
.If
SslProvider.OPENSSL_REFCNT
is used then the object must be released. One way to do this is to wrap in aSslHandler
and insert it into a pipeline. SeenewHandler(ByteBufAllocator)
.- Returns:
- a new
SSLEngine
-
newEngine
Creates a newSSLEngine
using advisory peer information.If
SslProvider.OPENSSL_REFCNT
is used then the object must be released. One way to do this is to wrap in aSslHandler
and insert it into a pipeline. SeenewHandler(ByteBufAllocator, String, int)
.- Parameters:
peerHost
- the non-authoritative name of the hostpeerPort
- the non-authoritative port- Returns:
- a new
SSLEngine
-
sessionContext
Returns theSSLSessionContext
object held by this context. -
newHandler
Create a new SslHandler.- See Also:
-
newHandler
Create a new SslHandler.- See Also:
-
newHandler
Creates a newSslHandler
.If
SslProvider.OPENSSL_REFCNT
is used then the returnedSslHandler
will release the engine that is wrapped. If the returnedSslHandler
is not inserted into a pipeline then you may leak native memory!Beware: the underlying generated
SSLEngine
won't have hostname verification enabled by default. If you createSslHandler
for the client side and want proper security, we advice that you configure theSSLEngine
(seeSSLParameters.setEndpointIdentificationAlgorithm(String)
):SSLEngine sslEngine = sslHandler.engine(); SSLParameters sslParameters = sslEngine.getSSLParameters(); // only available since Java 7 sslParameters.setEndpointIdentificationAlgorithm("HTTPS"); sslEngine.setSSLParameters(sslParameters);
The underlying
SSLEngine
may not follow the restrictions imposed by the SSLEngine javadocs which limits wrap/unwrap to operate on a single SSL/TLS packet.- Parameters:
alloc
- If supported by the SSLEngine then the SSLEngine will use this to allocate ByteBuf objects.delegatedTaskExecutor
- theExecutor
that will be used to execute tasks that are returned bySSLEngine.getDelegatedTask()
.- Returns:
- a new
SslHandler
-
newHandler
Create a new SslHandler.- See Also:
-
newHandler
Creates a newSslHandler
- See Also:
-
newHandler
protected SslHandler newHandler(ByteBufAllocator alloc, String peerHost, int peerPort, boolean startTls) Create a new SslHandler.- See Also:
-
newHandler
public SslHandler newHandler(ByteBufAllocator alloc, String peerHost, int peerPort, Executor delegatedTaskExecutor) Creates a newSslHandler
with advisory peer information.If
SslProvider.OPENSSL_REFCNT
is used then the returnedSslHandler
will release the engine that is wrapped. If the returnedSslHandler
is not inserted into a pipeline then you may leak native memory!Beware: the underlying generated
SSLEngine
won't have hostname verification enabled by default. If you createSslHandler
for the client side and want proper security, we advice that you configure theSSLEngine
(seeSSLParameters.setEndpointIdentificationAlgorithm(String)
):SSLEngine sslEngine = sslHandler.engine(); SSLParameters sslParameters = sslEngine.getSSLParameters(); // only available since Java 7 sslParameters.setEndpointIdentificationAlgorithm("HTTPS"); sslEngine.setSSLParameters(sslParameters);
The underlying
SSLEngine
may not follow the restrictions imposed by the SSLEngine javadocs which limits wrap/unwrap to operate on a single SSL/TLS packet.- Parameters:
alloc
- If supported by the SSLEngine then the SSLEngine will use this to allocate ByteBuf objects.peerHost
- the non-authoritative name of the hostpeerPort
- the non-authoritative portdelegatedTaskExecutor
- theExecutor
that will be used to execute tasks that are returned bySSLEngine.getDelegatedTask()
.- Returns:
- a new
SslHandler
-
newHandler
protected SslHandler newHandler(ByteBufAllocator alloc, String peerHost, int peerPort, boolean startTls, Executor delegatedTaskExecutor) -
generateKeySpec
@Deprecated protected static PKCS8EncodedKeySpec generateKeySpec(char[] password, byte[] key) throws IOException, NoSuchAlgorithmException, NoSuchPaddingException, InvalidKeySpecException, InvalidKeyException, InvalidAlgorithmParameterException Deprecated.Generates a key specification for an (encrypted) private key.- Parameters:
password
- characters, ifnull
an unencrypted key is assumedkey
- bytes of the DER encoded private key- Returns:
- a key specification
- Throws:
IOException
- if parsingkey
failsNoSuchAlgorithmException
- if the algorithm used to encryptkey
is unknownNoSuchPaddingException
- if the padding scheme specified in the decryption algorithm is unknownInvalidKeySpecException
- if the decryption key based onpassword
cannot be generatedInvalidKeyException
- if the decryption key based onpassword
cannot be used to decryptkey
InvalidAlgorithmParameterException
- if decryption algorithm parameters are somehow faulty
-
getPBEAlgorithm
-
buildKeyStore
protected static KeyStore buildKeyStore(X509Certificate[] certChain, PrivateKey key, char[] keyPasswordChars, String keyStoreType) throws KeyStoreException, NoSuchAlgorithmException, CertificateException, IOException Generates a newKeyStore
.- Parameters:
certChain
- an X.509 certificate chainkey
- a PKCS#8 private keykeyPasswordChars
- the password of thekeyFile
.null
if it's not password-protected.keyStoreType
- The KeyStore Type you want to use- Returns:
- generated
KeyStore
. - Throws:
KeyStoreException
NoSuchAlgorithmException
CertificateException
IOException
-
toPrivateKey
protected static PrivateKey toPrivateKey(File keyFile, String keyPassword) throws NoSuchAlgorithmException, NoSuchPaddingException, InvalidKeySpecException, InvalidAlgorithmParameterException, KeyException, IOException -
toPrivateKey
static PrivateKey toPrivateKey(File keyFile, String keyPassword, boolean tryBouncyCastle) throws NoSuchAlgorithmException, NoSuchPaddingException, InvalidKeySpecException, InvalidAlgorithmParameterException, KeyException, IOException -
toPrivateKey
protected static PrivateKey toPrivateKey(InputStream keyInputStream, String keyPassword) throws NoSuchAlgorithmException, NoSuchPaddingException, InvalidKeySpecException, InvalidAlgorithmParameterException, KeyException, IOException -
getPrivateKeyFromByteBuffer
private static PrivateKey getPrivateKeyFromByteBuffer(ByteBuf encodedKeyBuf, String keyPassword) throws NoSuchAlgorithmException, NoSuchPaddingException, InvalidKeySpecException, InvalidAlgorithmParameterException, KeyException, IOException -
buildTrustManagerFactory
@Deprecated protected static TrustManagerFactory buildTrustManagerFactory(File certChainFile, TrustManagerFactory trustManagerFactory) throws NoSuchAlgorithmException, CertificateException, KeyStoreException, IOException Deprecated.Build aTrustManagerFactory
from a certificate chain file.- Parameters:
certChainFile
- The certificate file to build from.trustManagerFactory
- The existingTrustManagerFactory
that will be used if notnull
.- Returns:
- A
TrustManagerFactory
which contains the certificates incertChainFile
- Throws:
NoSuchAlgorithmException
CertificateException
KeyStoreException
IOException
-
buildTrustManagerFactory
protected static TrustManagerFactory buildTrustManagerFactory(File certChainFile, TrustManagerFactory trustManagerFactory, String keyType) throws NoSuchAlgorithmException, CertificateException, KeyStoreException, IOException Build aTrustManagerFactory
from a certificate chain file.- Parameters:
certChainFile
- The certificate file to build from.trustManagerFactory
- The existingTrustManagerFactory
that will be used if notnull
.keyType
- The KeyStore Type you want to use- Returns:
- A
TrustManagerFactory
which contains the certificates incertChainFile
- Throws:
NoSuchAlgorithmException
CertificateException
KeyStoreException
IOException
-
toX509Certificates
- Throws:
CertificateException
-
toX509Certificates
- Throws:
CertificateException
-
getCertificatesFromBuffers
private static X509Certificate[] getCertificatesFromBuffers(ByteBuf[] certs) throws CertificateException - Throws:
CertificateException
-
buildTrustManagerFactory
protected static TrustManagerFactory buildTrustManagerFactory(X509Certificate[] certCollection, TrustManagerFactory trustManagerFactory, String keyStoreType) throws NoSuchAlgorithmException, CertificateException, KeyStoreException, IOException -
toPrivateKeyInternal
- Throws:
SSLException
-
toX509CertificatesInternal
- Throws:
SSLException
-
buildKeyManagerFactory
protected static KeyManagerFactory buildKeyManagerFactory(X509Certificate[] certChainFile, String keyAlgorithm, PrivateKey key, String keyPassword, KeyManagerFactory kmf, String keyStore) throws KeyStoreException, NoSuchAlgorithmException, IOException, CertificateException, UnrecoverableKeyException -
buildKeyManagerFactory
static KeyManagerFactory buildKeyManagerFactory(KeyStore ks, String keyAlgorithm, char[] keyPasswordChars, KeyManagerFactory kmf) throws KeyStoreException, NoSuchAlgorithmException, UnrecoverableKeyException -
keyStorePassword
-
SslContextBuilder