public final class SSLContext extends Object
Constructor and Description |
---|
SSLContext() |
Modifier and Type | Method and Description |
---|---|
static void |
clearOptions(long ctx,
int options)
Clears OpenSSL Options.
|
static int |
free(long ctx)
Free the resources used by the Context
|
static int |
getMode(long ctx)
Call SSL_CTX_get_mode
|
static int |
getOptions(long ctx)
Get OpenSSL Option.
|
static long |
getSessionCacheMode(long ctx)
Get the mode of the current used internal session cache.
|
static long |
getSessionCacheSize(long ctx)
Get the size of the internal session cache.
|
static long |
getSessionCacheTimeout(long ctx)
Get the timeout for the internal session cache in seconds.
|
static long |
make(long pool,
int protocol,
int mode)
Initialize new SSL context
|
static long |
sessionAccept(long ctx)
Session resumption statistics methods.
|
static long |
sessionAcceptGood(long ctx) |
static long |
sessionAcceptRenegotiate(long ctx) |
static long |
sessionCacheFull(long ctx) |
static long |
sessionCbHits(long ctx) |
static long |
sessionConnect(long ctx) |
static long |
sessionConnectGood(long ctx) |
static long |
sessionConnectRenegotiate(long ctx) |
static long |
sessionHits(long ctx) |
static long |
sessionMisses(long ctx) |
static long |
sessionNumber(long ctx) |
static long |
sessionTicketKeyFail(long ctx) |
static long |
sessionTicketKeyNew(long ctx)
TLS session ticket key resumption statistics.
|
static long |
sessionTicketKeyRenew(long ctx) |
static long |
sessionTicketKeyResume(long ctx) |
static long |
sessionTimeouts(long ctx) |
static void |
setAlpnProtos(long ctx,
String[] alpnProtos,
int selectorFailureBehavior)
Set application layer protocol for application layer protocol negotiation extension
|
static void |
setBIO(long ctx,
long bio,
int dir)
Associate BIOCallback for input or output data capture.
|
static boolean |
setCACertificate(long ctx,
String file,
String path)
Set File and Directory of concatenated PEM-encoded CA Certificates
for Client Auth
This directive sets the all-in-one file where you can assemble the Certificates of Certification Authorities (CA) whose clients you deal with. |
static boolean |
setCACertificateBio(long ctx,
long certBio)
Set concatenated PEM-encoded CA Certificates for Client Auth
This directive sets the all-in-one BIO where you can assemble the Certificates of Certification Authorities (CA) whose clients you deal with. |
static boolean |
setCARevocation(long ctx,
String file,
String path)
Set File of concatenated PEM-encoded CA CRLs or
directory of PEM-encoded CA Certificates for Client Auth
This directive sets the all-in-one file where you can assemble the Certificate Revocation Lists (CRL) of Certification Authorities (CA) whose clients you deal with. |
static boolean |
setCertificate(long ctx,
String cert,
String key,
String password)
Set Certificate
|
static boolean |
setCertificate(long ctx,
String cert,
String key,
String password,
int idx)
Deprecated.
Use
setCertificate(long, String, String, String)
Set Certificate Point setCertificateFile at a PEM encoded certificate. If the certificate is encrypted, then you will be prompted for a pass phrase. Note that a kill -HUP will prompt again. A test certificate can be generated with `make certificate' under built time. Keep in mind that if you've both a RSA and a DSA certificate you can configure both in parallel (to also allow the use of DSA ciphers, etc.) If the key is not combined with the certificate, use key param to point at the key file. Keep in mind that if you've both a RSA and a DSA private key you can configure both in parallel (to also allow the use of DSA ciphers, etc.) |
static boolean |
setCertificateBio(long ctx,
long certBio,
long keyBio,
String password)
Set Certificate
|
static boolean |
setCertificateBio(long ctx,
long certBio,
long keyBio,
String password,
int idx)
Deprecated.
Use
setCertificateBio(long, long, long, String)
Set Certificate
Point setCertificate at a PEM encoded certificate stored in a BIO. If the certificate is encrypted, then you will be prompted for a pass phrase. Note that a kill -HUP will prompt again. A test certificate can be generated with `make certificate' under built time. Keep in mind that if you've both a RSA and a DSA certificate you can configure both in parallel (to also allow the use of DSA ciphers, etc.) If the key is not combined with the certificate, use key param to point at the key file. Keep in mind that if you've both a RSA and a DSA private key you can configure both in parallel (to also allow the use of DSA ciphers, etc.) |
static boolean |
setCertificateChainBio(long ctx,
long bio,
boolean skipfirst)
Set BIO of PEM-encoded Server CA Certificates
|
static boolean |
setCertificateChainFile(long ctx,
String file,
boolean skipfirst)
Set File of PEM-encoded Server CA Certificates
This directive sets the optional all-in-one file where you can assemble the certificates of Certification Authorities (CA) which form the certificate chain of the server certificate. |
static void |
setCertRequestedCallback(long ctx,
CertificateRequestedCallback callback)
Allow to hook
CertificateRequestedCallback into the certificate choosing process. |
static void |
setCertVerifyCallback(long ctx,
CertificateVerifier verifier)
Allow to hook
CertificateVerifier into the handshake processing. |
static boolean |
setCipherSuite(long ctx,
String ciphers)
Cipher Suite available for negotiation in SSL handshake.
|
static void |
setContextId(long ctx,
String id)
Set Session context id.
|
static int |
setMode(long ctx,
int mode)
Call SSL_CTX_set_mode
|
static void |
setNextProtos(long ctx,
String nextProtos)
Deprecated.
|
static void |
setNpnProtos(long ctx,
String[] nextProtos,
int selectorFailureBehavior)
Set next protocol for next protocol negotiation extension
|
static void |
setOptions(long ctx,
int options)
Set OpenSSL Option.
|
static void |
setQuietShutdown(long ctx,
boolean mode)
Sets the "quiet shutdown" flag for ctx to be
mode.
|
static void |
setRandom(long ctx,
String file)
Set file for randomness
|
static long |
setSessionCacheMode(long ctx,
long mode)
Set the mode of the internal session cache and return the previous used mode.
|
static long |
setSessionCacheSize(long ctx,
long size)
Set the size of the internal session cache.
|
static long |
setSessionCacheTimeout(long ctx,
long timeoutSeconds)
Set the timeout for the internal session cache in seconds.
|
static boolean |
setSessionIdContext(long ctx,
byte[] sidCtx)
Set the context within which session be reused (server side only)
http://www.openssl.org/docs/ssl/SSL_CTX_set_session_id_context.html
|
static void |
setSessionTicketKeys(long ctx,
byte[] keys)
Deprecated.
|
static void |
setSessionTicketKeys(long ctx,
SessionTicketKey[] keys)
Set TLS session ticket keys.
|
static void |
setShutdownType(long ctx,
int type)
Set SSL connection shutdown type
The following levels are available for level: |
static void |
setTmpDH(long ctx,
String cert)
Set DH parameters
|
static void |
setTmpDHLength(long ctx,
int length)
Set length of the DH to use.
|
static void |
setTmpECDHByCurveName(long ctx,
String curveName)
Set ECDH elliptic curve by name
|
static void |
setVerify(long ctx,
int level,
int depth)
Set Type of Client Certificate verification and Maximum depth of CA Certificates
in Client Certificate verification.
|
public static long make(long pool, int protocol, int mode) throws Exception
pool
- The pool to use.protocol
- The SSL protocol to use. It can be any combination of
the following:
SSL.SSL_PROTOCOL_SSLV2
SSL.SSL_PROTOCOL_SSLV3
SSL.SSL_PROTOCOL_TLSV1
SSL.SSL_PROTOCOL_TLSV1_1
SSL.SSL_PROTOCOL_TLSV1_2
SSL.SSL_PROTOCOL_ALL
( == all TLS versions, no SSL)
mode
- SSL mode to use
SSL_MODE_CLIENT SSL_MODE_SERVER SSL_MODE_COMBINED
Exception
public static int free(long ctx)
ctx
- Server or Client context to free.public static void setContextId(long ctx, String id)
ctx
- Context to use.id
- String that uniquely identifies this context.public static void setBIO(long ctx, long bio, int dir)
[ERROR] -- Critical error messages [WARN] -- Warning messages [INFO] -- Informational messages [DEBUG] -- Debugging messagedCallback can use that word to determine application logging level by intercepting write call. If the bio is set to 0 no error messages will be displayed. Default is to use the stderr output stream.
ctx
- Server or Client context to use.bio
- BIO handle to use, created with SSL.newBIOdir
- BIO direction (1 for input 0 for output).public static void setOptions(long ctx, int options)
ctx
- Server or Client context to use.options
- See SSL.SSL_OP_* for option flags.public static int getOptions(long ctx)
ctx
- Server or Client context to use.public static void clearOptions(long ctx, int options)
ctx
- Server or Client context to use.options
- See SSL.SSL_OP_* for option flags.public static void setQuietShutdown(long ctx, boolean mode)
ctx
- Server or Client context to use.mode
- True to set the quiet shutdown.public static boolean setCipherSuite(long ctx, String ciphers) throws Exception
ctx
- Server or Client context to use.ciphers
- An SSL cipher specification.Exception
public static boolean setCARevocation(long ctx, String file, String path) throws Exception
ctx
- Server or Client context to use.file
- File of concatenated PEM-encoded CA CRLs for Client Auth.path
- Directory of PEM-encoded CA Certificates for Client Auth.Exception
public static boolean setCertificateChainFile(long ctx, String file, boolean skipfirst)
ctx
- Server or Client context to use.file
- File of PEM-encoded Server CA Certificates.skipfirst
- Skip first certificate if chain file is inside
certificate file.public static boolean setCertificateChainBio(long ctx, long bio, boolean skipfirst)
This directive sets the optional all-in-one file where you can assemble the certificates of Certification Authorities (CA) which form the certificate chain of the server certificate. This starts with the issuing CA certificate of of the server certificate and can range up to the root CA certificate. Such a file is simply the concatenation of the various PEM-encoded CA Certificate files, usually in certificate chain order.
But be careful: Providing the certificate chain works only if you are using a single (either RSA or DSA) based server certificate. If you are using a coupled RSA+DSA certificate pair, this will work only if actually both certificates use the same certificate chain. Otherwsie the browsers will be confused in this situation.
ctx
- Server or Client context to use.bio
- BIO of PEM-encoded Server CA Certificates.skipfirst
- Skip first certificate if chain file is inside
certificate file.@Deprecated public static boolean setCertificate(long ctx, String cert, String key, String password, int idx) throws Exception
setCertificate(long, String, String, String)
Set Certificate
Point setCertificateFile at a PEM encoded certificate. If the certificate is encrypted, then you will be prompted for a pass phrase. Note that a kill -HUP will prompt again. A test certificate can be generated with `make certificate' under built time. Keep in mind that if you've both a RSA and a DSA certificate you can configure both in parallel (to also allow the use of DSA ciphers, etc.)
If the key is not combined with the certificate, use key param to point at the key file. Keep in mind that if you've both a RSA and a DSA private key you can configure both in parallel (to also allow the use of DSA ciphers, etc.)
ctx
- Server or Client context to use.cert
- Certificate file.key
- Private Key file to use if not in cert.password
- Certificate password. If null and certificate
is encrypted, password prompt will be displayed.idx
- deprecated and ignored.Exception
public static boolean setCertificate(long ctx, String cert, String key, String password) throws Exception
Point setCertificateFile at a PEM encoded certificate. If the certificate is encrypted, then you will be prompted for a pass phrase. Note that a kill -HUP will prompt again. A test certificate can be generated with `make certificate' under built time. Keep in mind that if you've both a RSA and a DSA certificate you can configure both in parallel (to also allow the use of DSA ciphers, etc.)
If the key is not combined with the certificate, use key param to point at the key file. Keep in mind that if you've both a RSA and a DSA private key you can configure both in parallel (to also allow the use of DSA ciphers, etc.)
ctx
- Server or Client context to use.cert
- Certificate file.key
- Private Key file to use if not in cert.password
- Certificate password. If null and certificate
is encrypted, password prompt will be displayed.Exception
@Deprecated public static boolean setCertificateBio(long ctx, long certBio, long keyBio, String password, int idx) throws Exception
setCertificateBio(long, long, long, String)
Set Certificate
Point setCertificate at a PEM encoded certificate stored in a BIO. If the certificate is encrypted, then you will be prompted for a pass phrase. Note that a kill -HUP will prompt again. A test certificate can be generated with `make certificate' under built time. Keep in mind that if you've both a RSA and a DSA certificate you can configure both in parallel (to also allow the use of DSA ciphers, etc.)
If the key is not combined with the certificate, use key param to point at the key file. Keep in mind that if you've both a RSA and a DSA private key you can configure both in parallel (to also allow the use of DSA ciphers, etc.)
ctx
- Server or Client context to use.certBio
- Certificate BIO.keyBio
- Private Key BIO to use if not in cert.password
- Certificate password. If null and certificate
is encrypted, password prompt will be displayed.idx
- deprecated and ignored.Exception
public static boolean setCertificateBio(long ctx, long certBio, long keyBio, String password) throws Exception
Point setCertificate at a PEM encoded certificate stored in a BIO. If the certificate is encrypted, then you will be prompted for a pass phrase. Note that a kill -HUP will prompt again. A test certificate can be generated with `make certificate' under built time. Keep in mind that if you've both a RSA and a DSA certificate you can configure both in parallel (to also allow the use of DSA ciphers, etc.)
If the key is not combined with the certificate, use key param to point at the key file. Keep in mind that if you've both a RSA and a DSA private key you can configure both in parallel (to also allow the use of DSA ciphers, etc.)
ctx
- Server or Client context to use.certBio
- Certificate BIO.keyBio
- Private Key BIO to use if not in cert.password
- Certificate password. If null and certificate
is encrypted, password prompt will be displayed.Exception
public static long setSessionCacheSize(long ctx, long size)
public static long getSessionCacheSize(long ctx)
public static long setSessionCacheTimeout(long ctx, long timeoutSeconds)
public static long getSessionCacheTimeout(long ctx)
public static long setSessionCacheMode(long ctx, long mode)
public static long getSessionCacheMode(long ctx)
public static long sessionAccept(long ctx)
public static long sessionAcceptGood(long ctx)
public static long sessionAcceptRenegotiate(long ctx)
public static long sessionCacheFull(long ctx)
public static long sessionCbHits(long ctx)
public static long sessionConnect(long ctx)
public static long sessionConnectGood(long ctx)
public static long sessionConnectRenegotiate(long ctx)
public static long sessionHits(long ctx)
public static long sessionMisses(long ctx)
public static long sessionNumber(long ctx)
public static long sessionTimeouts(long ctx)
public static long sessionTicketKeyNew(long ctx)
public static long sessionTicketKeyResume(long ctx)
public static long sessionTicketKeyRenew(long ctx)
public static long sessionTicketKeyFail(long ctx)
public static void setSessionTicketKeys(long ctx, SessionTicketKey[] keys)
The first key in the list is the primary key. Tickets dervied from the other keys in the list will be accepted but updated to a new ticket using the primary key. This is useful for implementing ticket key rotation.
@Deprecated public static void setSessionTicketKeys(long ctx, byte[] keys)
setSessionTicketKeys(long, SessionTicketKey[])
public static boolean setCACertificate(long ctx, String file, String path) throws Exception
ctx
- Server or Client context to use.file
- File of concatenated PEM-encoded CA Certificates for
Client Auth.path
- Directory of PEM-encoded CA Certificates for Client Auth.Exception
public static boolean setCACertificateBio(long ctx, long certBio)
ctx
- Server context to use.certBio
- Directory of PEM-encoded CA Certificates for Client Auth.true
if successful, false
otherwise.public static void setRandom(long ctx, String file)
ctx
- Server or Client context to use.file
- random file.public static void setShutdownType(long ctx, int type)
SSL_SHUTDOWN_TYPE_STANDARD SSL_SHUTDOWN_TYPE_UNCLEAN SSL_SHUTDOWN_TYPE_ACCURATE
ctx
- Server or Client context to use.type
- Shutdown type to use.public static void setVerify(long ctx, int level, int depth)
SSL_CVERIFY_NONE - No client Certificate is required at all SSL_CVERIFY_OPTIONAL - The client may present a valid Certificate SSL_CVERIFY_REQUIRE - The client has to present a valid Certificate SSL_CVERIFY_OPTIONAL_NO_CA - The client may present a valid Certificate but it need not to be (successfully) verifiable
setCACertificatePath
), etc.ctx
- Server or Client context to use.level
- Type of Client Certificate verification.depth
- Maximum depth of CA Certificates in Client Certificate
verification.public static void setCertVerifyCallback(long ctx, CertificateVerifier verifier)
CertificateVerifier
into the handshake processing.
This will call SSL_CTX_set_cert_verify_callback
and so replace the default verification
callback used by opensslctx
- Server or Client context to use.verifier
- the verifier to call during handshake.public static void setCertRequestedCallback(long ctx, CertificateRequestedCallback callback)
CertificateRequestedCallback
into the certificate choosing process.
This will call SSL_CTX_set_client_cert_cb
and so replace the default verification
callback used by opensslctx
- Server or Client context to use.callback
- the callback to call during certificate selection.@Deprecated public static void setNextProtos(long ctx, String nextProtos)
setNpnProtos(long, String[], int)
ctx
- Server context to use.nextProtos
- comma delimited list of protocols in priority orderpublic static void setNpnProtos(long ctx, String[] nextProtos, int selectorFailureBehavior)
ctx
- Server context to use.nextProtos
- protocols in priority orderselectorFailureBehavior
- see SSL.SSL_SELECTOR_FAILURE_NO_ADVERTISE
and SSL.SSL_SELECTOR_FAILURE_CHOOSE_MY_LAST_PROTOCOL
public static void setAlpnProtos(long ctx, String[] alpnProtos, int selectorFailureBehavior)
ctx
- Server context to use.alpnProtos
- protocols in priority orderselectorFailureBehavior
- see SSL.SSL_SELECTOR_FAILURE_NO_ADVERTISE
and SSL.SSL_SELECTOR_FAILURE_CHOOSE_MY_LAST_PROTOCOL
public static void setTmpDH(long ctx, String cert) throws Exception
ctx
- Server context to use.cert
- DH param file (can be generated from e.g. openssl dhparam -rand - 2048 > dhparam.pem
-
see the OpenSSL documentation).Exception
public static void setTmpDHLength(long ctx, int length)
ctx
- Server context to use.length
- the length.public static void setTmpECDHByCurveName(long ctx, String curveName) throws Exception
ctx
- Server context to use.curveName
- the name of the elliptic curve to use
(available names can be obtained from openssl ecparam -list_curves
).Exception
public static boolean setSessionIdContext(long ctx, byte[] sidCtx)
ctx
- Server context to use.sidCtx
- can be any kind of binary data, it is therefore possible to use e.g. the name
of the application and/or the hostname and/or service nametrue
if success, false
otherwise.public static int setMode(long ctx, int mode)
ctx
- context to usemode
- the modepublic static int getMode(long ctx)
ctx
- context to useCopyright © 2008–2024 The Netty Project. All rights reserved.