public class SSLUtil
extends java.lang.Object
Modifier and Type | Field and Description |
---|---|
private static javax.net.ssl.KeyManager[] |
defaultKeyManagers |
private static org.apache.http.conn.ssl.SSLSocketFactory |
defaultSocketFactory |
private static javax.net.ssl.TrustManager[] |
defaultTrustManagers |
Constructor and Description |
---|
SSLUtil() |
Modifier and Type | Method and Description |
---|---|
private static javax.net.ssl.KeyManager[] |
createKeyManagers(java.security.KeyStore keyStore,
java.lang.String password,
java.lang.String provider,
java.lang.String algorithm) |
static java.security.KeyStore |
createKeyStore(java.io.InputStream store,
java.lang.String password,
java.lang.String type,
java.lang.String provider)
Create a key-store from the given input stream
|
private static javax.net.ssl.TrustManager[] |
createTrustManagers(java.security.KeyStore keyStore,
java.lang.String provider,
java.lang.String algorithm) |
static java.security.cert.Certificate |
getCertificate(java.io.InputStream cert,
java.lang.String type,
java.lang.String provider)
Get the certificate that is found in the given input stream.
|
private static javax.net.ssl.KeyManager[] |
getDefaultKeyManagers()
Get the default keys manages as configured in the base.config file by
ssl.keystore.* settings.
|
private static javax.net.ssl.TrustManager[] |
getDefaultTrustManagers()
Get the default trust manages as configured in the base.config file by
ssl.truststore.* settings.
|
static javax.net.ssl.SSLContext |
getSSLContext(byte[] serverCertificate,
byte[] clientCertificate,
java.lang.String clientCertificatePassword)
Create a SSL context that optionally uses the given trusted server certificate
and client certificate.
|
static org.apache.http.conn.ssl.SSLSocketFactory |
getSSLSocketFactory()
Get a SSL Socket Factory object that is used to create SSL sockets.
|
static org.apache.http.conn.ssl.SSLSocketFactory |
getSSLSocketFactory(byte[] serverCertificate,
byte[] clientCertificate,
java.lang.String clientCertificatePassword)
Create a SSL socket factory that optionally uses the given trusted server certificate
and client certificate.
|
private static javax.net.ssl.KeyManager[] defaultKeyManagers
private static javax.net.ssl.TrustManager[] defaultTrustManagers
private static org.apache.http.conn.ssl.SSLSocketFactory defaultSocketFactory
public static org.apache.http.conn.ssl.SSLSocketFactory getSSLSocketFactory()
URL u = ... // A https url URLConnection conn = u.openConnection(); if (conn instanceof HttpsURLConnection) { ((HttpsURLConnection)conn).setSSLSocketFactory(SSLUtil.getSSLSocketFactory()); }Unless a key-store and/or trust-store has been configured this method returns a default socket factory provided by
HttpsURLConnection.getDefaultSSLSocketFactory()
.
A key-store is used to store personal certificates that are used for authentication with the server. A key-store can be setup with the following configuration options in base.config.
A trust-store is used to store public certificates of of servers that are trusted. The default trust-store uses the certificates that are shipped with the java runtime in $JAVA_HOME/jre/lib/security/cacerts. A trust-store can be setup with the following configuration options in base.config.
public static javax.net.ssl.SSLContext getSSLContext(byte[] serverCertificate, byte[] clientCertificate, java.lang.String clientCertificatePassword)
serverCertificate
- The trusted server certificate data or null to use
the default trusted certificates (see getSSLSocketFactory()
. The
data must represent a X.509 certificate in binary or base64-encoded DER
formatclientCertificate
- The client certificate to use for authorization with
the server or null to use the default certificates. The data must represent
a PKCS #12 cretificate in binary formclientCertificatePassword
- A password used to unlock the client
certificatepublic static org.apache.http.conn.ssl.SSLSocketFactory getSSLSocketFactory(byte[] serverCertificate, byte[] clientCertificate, java.lang.String clientCertificatePassword)
getSSLSocketFactory()
is returned.serverCertificate
- The trusted server certificate data or null to use
the default trusted certificates (see getSSLSocketFactory()
. The
data must represent a X.509 certificate in binary or base64-encoded DER
formatclientCertificate
- The client certificate to use for authorization with
the server or null to use the default certificates. The data must represent
a PKCS #12 cretificate in binary formclientCertificatePassword
- A password used to unlock the client
certificateprivate static javax.net.ssl.TrustManager[] getDefaultTrustManagers() throws java.security.KeyStoreException, java.security.NoSuchAlgorithmException, java.security.cert.CertificateException, java.security.NoSuchProviderException, java.io.IOException
java.security.KeyStoreException
java.security.NoSuchAlgorithmException
java.security.cert.CertificateException
java.security.NoSuchProviderException
java.io.IOException
private static javax.net.ssl.KeyManager[] getDefaultKeyManagers() throws java.security.UnrecoverableKeyException, java.security.KeyStoreException, java.security.NoSuchAlgorithmException, java.security.cert.CertificateException, java.security.NoSuchProviderException, java.io.IOException
java.security.UnrecoverableKeyException
java.security.KeyStoreException
java.security.NoSuchAlgorithmException
java.security.cert.CertificateException
java.security.NoSuchProviderException
java.io.IOException
public static java.security.KeyStore createKeyStore(java.io.InputStream store, java.lang.String password, java.lang.String type, java.lang.String provider) throws java.security.KeyStoreException, java.security.NoSuchProviderException, java.security.NoSuchAlgorithmException, java.security.cert.CertificateException, java.io.IOException
store
- The stream with key-store datapassword
- The password to unlock the keystorejava.security.KeyStoreException
java.security.NoSuchProviderException
java.security.NoSuchAlgorithmException
java.security.cert.CertificateException
java.io.IOException
public static java.security.cert.Certificate getCertificate(java.io.InputStream cert, java.lang.String type, java.lang.String provider) throws java.security.cert.CertificateException, java.security.NoSuchProviderException
cert
- The stream with the certificate informationtype
- The type of the certificate, usually "X.509"X509Certificate
java.security.cert.CertificateException
java.security.NoSuchProviderException
private static javax.net.ssl.KeyManager[] createKeyManagers(java.security.KeyStore keyStore, java.lang.String password, java.lang.String provider, java.lang.String algorithm) throws java.security.KeyStoreException, java.security.NoSuchAlgorithmException, java.security.cert.CertificateException, java.io.IOException, java.security.UnrecoverableKeyException, java.security.NoSuchProviderException
java.security.KeyStoreException
java.security.NoSuchAlgorithmException
java.security.cert.CertificateException
java.io.IOException
java.security.UnrecoverableKeyException
java.security.NoSuchProviderException
private static javax.net.ssl.TrustManager[] createTrustManagers(java.security.KeyStore keyStore, java.lang.String provider, java.lang.String algorithm) throws java.security.KeyStoreException, java.security.NoSuchAlgorithmException, java.security.cert.CertificateException, java.io.IOException, java.security.NoSuchProviderException
java.security.KeyStoreException
java.security.NoSuchAlgorithmException
java.security.cert.CertificateException
java.io.IOException
java.security.NoSuchProviderException