Package io.grpc.util
Class AdvancedTlsX509TrustManager
java.lang.Object
javax.net.ssl.X509ExtendedTrustManager
io.grpc.util.AdvancedTlsX509TrustManager
- All Implemented Interfaces:
TrustManager
,X509TrustManager
AdvancedTlsX509TrustManager is an
X509ExtendedTrustManager
that allows users to configure
advanced TLS features, such as root certificate reloading and peer cert custom verification.
The basic instantiation pattern is
new Builder().build().useSystemDefaultTrustCerts();
For Android users: this class is only supported in API level 24 and above.
-
Nested Class Summary
Nested ClassesModifier and TypeClassDescriptionstatic final class
Builds a newAdvancedTlsX509TrustManager
.static interface
private class
static interface
static enum
The verification mode when authenticating the peer certificate. -
Field Summary
FieldsModifier and TypeFieldDescriptionprivate X509ExtendedTrustManager
private static final Logger
private static final int
private static final String
private final AdvancedTlsX509TrustManager.Verification
-
Constructor Summary
ConstructorsModifierConstructorDescriptionprivate
AdvancedTlsX509TrustManager
(AdvancedTlsX509TrustManager.Verification verification, AdvancedTlsX509TrustManager.SslSocketAndEnginePeerVerifier socketAndEnginePeerVerifier) -
Method Summary
Modifier and TypeMethodDescriptionvoid
checkClientTrusted
(X509Certificate[] chain, String authType) void
checkClientTrusted
(X509Certificate[] chain, String authType, Socket socket) void
checkClientTrusted
(X509Certificate[] chain, String authType, SSLEngine engine) void
checkServerTrusted
(X509Certificate[] chain, String authType) void
checkServerTrusted
(X509Certificate[] chain, String authType, Socket socket) void
checkServerTrusted
(X509Certificate[] chain, String authType, SSLEngine engine) private void
checkTrusted
(X509Certificate[] chain, String authType, SSLEngine sslEngine, Socket socket, boolean checkingServer) private static X509ExtendedTrustManager
createDelegateTrustManager
(KeyStore keyStore) private long
readAndUpdate
(File trustCertFile, long oldTime) Reads the trust certificates specified in the path location, and updates the key store if the modified time has changed since last read.void
updateTrustCredentials
(File trustCertFile) Updates the trust certificates from a local file path.updateTrustCredentials
(File trustCertFile, long period, TimeUnit unit, ScheduledExecutorService executor) Schedules aScheduledExecutorService
to read trust certificates from a local file path periodically, and updates the cached trust certs if there is an update.void
updateTrustCredentials
(X509Certificate[] trustCerts) Updates the current cached trust certificates as well as the key store.void
updateTrustCredentialsFromFile
(File trustCertFile) Deprecated.updateTrustCredentialsFromFile
(File trustCertFile, long period, TimeUnit unit, ScheduledExecutorService executor) void
Uses the default trust certificates stored on user's local system.
-
Field Details
-
log
-
MINIMUM_REFRESH_PERIOD_IN_MINUTES
private static final int MINIMUM_REFRESH_PERIOD_IN_MINUTES- See Also:
-
NOT_ENOUGH_INFO_MESSAGE
- See Also:
-
verification
-
socketAndEnginePeerVerifier
private final AdvancedTlsX509TrustManager.SslSocketAndEnginePeerVerifier socketAndEnginePeerVerifier -
delegateManager
-
-
Constructor Details
-
AdvancedTlsX509TrustManager
private AdvancedTlsX509TrustManager(AdvancedTlsX509TrustManager.Verification verification, AdvancedTlsX509TrustManager.SslSocketAndEnginePeerVerifier socketAndEnginePeerVerifier)
-
-
Method Details
-
checkClientTrusted
public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException - Throws:
CertificateException
-
checkClientTrusted
public void checkClientTrusted(X509Certificate[] chain, String authType, Socket socket) throws CertificateException - Specified by:
checkClientTrusted
in classX509ExtendedTrustManager
- Throws:
CertificateException
-
checkClientTrusted
public void checkClientTrusted(X509Certificate[] chain, String authType, SSLEngine engine) throws CertificateException - Specified by:
checkClientTrusted
in classX509ExtendedTrustManager
- Throws:
CertificateException
-
checkServerTrusted
public void checkServerTrusted(X509Certificate[] chain, String authType, SSLEngine engine) throws CertificateException - Specified by:
checkServerTrusted
in classX509ExtendedTrustManager
- Throws:
CertificateException
-
checkServerTrusted
public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException - Throws:
CertificateException
-
checkServerTrusted
public void checkServerTrusted(X509Certificate[] chain, String authType, Socket socket) throws CertificateException - Specified by:
checkServerTrusted
in classX509ExtendedTrustManager
- Throws:
CertificateException
-
getAcceptedIssuers
-
useSystemDefaultTrustCerts
public void useSystemDefaultTrustCerts() throws CertificateException, KeyStoreException, NoSuchAlgorithmExceptionUses the default trust certificates stored on user's local system. After this is used, functions that will provide new credential data(e.g. updateTrustCredentials) should not be called. -
createDelegateTrustManager
private static X509ExtendedTrustManager createDelegateTrustManager(KeyStore keyStore) throws CertificateException, KeyStoreException, NoSuchAlgorithmException -
checkTrusted
private void checkTrusted(X509Certificate[] chain, String authType, SSLEngine sslEngine, Socket socket, boolean checkingServer) throws CertificateException - Throws:
CertificateException
-
updateTrustCredentials
public void updateTrustCredentials(X509Certificate[] trustCerts) throws IOException, GeneralSecurityException Updates the current cached trust certificates as well as the key store.- Parameters:
trustCerts
- the trust certificates that are going to be used- Throws:
IOException
GeneralSecurityException
-
updateTrustCredentials
Updates the trust certificates from a local file path.- Parameters:
trustCertFile
- the file on disk holding the trust certificates- Throws:
IOException
GeneralSecurityException
-
updateTrustCredentials
public AdvancedTlsX509TrustManager.Closeable updateTrustCredentials(File trustCertFile, long period, TimeUnit unit, ScheduledExecutorService executor) throws IOException, GeneralSecurityException Schedules aScheduledExecutorService
to read trust certificates from a local file path periodically, and updates the cached trust certs if there is an update. You must close the returned Closeable before calling this method again or other update methods (useSystemDefaultTrustCerts()
,updateTrustCredentials(X509Certificate[])
,updateTrustCredentialsFromFile(File)
). Before scheduling the task, the method synchronously reads and updates trust certificates once. If the provided period is less than 1 minute, it is automatically adjusted to 1 minute.- Parameters:
trustCertFile
- the file on disk holding the trust certificatesperiod
- the period between successive read-and-update executionsunit
- the time unit of the initialDelay and period parametersexecutor
- the executor service we use to read and update the credentials- Returns:
- an object that caller should close when the file refreshes are not needed
- Throws:
IOException
GeneralSecurityException
-
updateTrustCredentialsFromFile
@Deprecated @InlineMe(replacement="this.updateTrustCredentials(trustCertFile, period, unit, executor)") @ExperimentalApi("https://github.com/grpc/grpc-java/issues/8024") public AdvancedTlsX509TrustManager.Closeable updateTrustCredentialsFromFile(File trustCertFile, long period, TimeUnit unit, ScheduledExecutorService executor) throws IOException, GeneralSecurityException Schedules aScheduledExecutorService
to read trust certificates from a local file path periodically, and updates the cached trust certs if there is an update. You must close the returned Closeable before calling this method again or other update methods (useSystemDefaultTrustCerts()
,updateTrustCredentials(X509Certificate[])
,updateTrustCredentialsFromFile(File)
). Before scheduling the task, the method synchronously reads and updates trust certificates once. If the provided period is less than 1 minute, it is automatically adjusted to 1 minute.- Parameters:
trustCertFile
- the file on disk holding the trust certificatesperiod
- the period between successive read-and-update executionsunit
- the time unit of the initialDelay and period parametersexecutor
- the executor service we use to read and update the credentials- Returns:
- an object that caller should close when the file refreshes are not needed
- Throws:
IOException
GeneralSecurityException
-
updateTrustCredentialsFromFile
@Deprecated @InlineMe(replacement="this.updateTrustCredentials(trustCertFile)") @ExperimentalApi("https://github.com/grpc/grpc-java/issues/8024") public void updateTrustCredentialsFromFile(File trustCertFile) throws IOException, GeneralSecurityException Deprecated.Updates the trust certificates from a local file path.- Parameters:
trustCertFile
- the file on disk holding the trust certificates- Throws:
IOException
GeneralSecurityException
-
readAndUpdate
private long readAndUpdate(File trustCertFile, long oldTime) throws IOException, GeneralSecurityException Reads the trust certificates specified in the path location, and updates the key store if the modified time has changed since last read.- Parameters:
trustCertFile
- the file on disk holding the trust certificatesoldTime
- the time when the trust file is modified during last execution- Returns:
- oldTime if failed or the modified time is not changed, otherwise the new modified time
- Throws:
IOException
GeneralSecurityException
-
newBuilder
-
updateTrustCredentials(File)