Class SslContextBuilder


  • public final class SslContextBuilder
    extends Object
    Builder for configuring a new SslContext for creation.
    • Method Detail

      • forServer

        public static SslContextBuilder forServer​(File keyCertChainFile,
                                                  File keyFile)
        Creates a builder for new server-side SslContext.
        Parameters:
        keyCertChainFile - an X.509 certificate chain file in PEM format
        keyFile - a PKCS#8 private key file in PEM format
        See Also:
        keyManager(File, File)
      • forServer

        public static SslContextBuilder forServer​(File keyCertChainFile,
                                                  File keyFile,
                                                  String keyPassword)
        Creates a builder for new server-side SslContext.
        Parameters:
        keyCertChainFile - an X.509 certificate chain file in PEM format
        keyFile - a PKCS#8 private key file in PEM format
        keyPassword - the password of the keyFile, or null if it's not password-protected
        See Also:
        keyManager(File, File, String)
      • forServer

        public static SslContextBuilder forServer​(KeyManagerFactory keyManagerFactory)
        Creates a builder for new server-side SslContext. If you use SslProvider#OPENSSL or SslProvider#OPENSSL_REFCNT consider using OpenSslX509KeyManagerFactory or OpenSslCachingX509KeyManagerFactory.
        Parameters:
        keyManagerFactory - non-null factory for server's private key
        See Also:
        keyManager(KeyManagerFactory)
      • trustManager

        public SslContextBuilder trustManager​(File trustCertCollectionFile)
        Trusted certificates for verifying the remote endpoint's certificate. The file should contain an X.509 certificate collection in PEM format. null uses the system default.
      • trustManager

        public SslContextBuilder trustManager​(InputStream trustCertCollectionInputStream)
        Trusted certificates for verifying the remote endpoint's certificate. The input stream should contain an X.509 certificate collection in PEM format. null uses the system default. The caller is responsible for calling InputStream.close() after build() has been called.
      • trustManager

        public SslContextBuilder trustManager​(X509Certificate... trustCertCollection)
        Trusted certificates for verifying the remote endpoint's certificate, null uses the system default.
      • trustManager

        public SslContextBuilder trustManager​(Iterable<? extends X509Certificate> trustCertCollection)
        Trusted certificates for verifying the remote endpoint's certificate, null uses the system default.
      • trustManager

        public SslContextBuilder trustManager​(TrustManagerFactory trustManagerFactory)
        Trusted manager for verifying the remote endpoint's certificate. null uses the system default.
      • keyManager

        public SslContextBuilder keyManager​(File keyCertChainFile,
                                            File keyFile)
        Identifying certificate for this host. keyCertChainFile and keyFile may be null for client contexts, which disables mutual authentication.
        Parameters:
        keyCertChainFile - an X.509 certificate chain file in PEM format
        keyFile - a PKCS#8 private key file in PEM format
      • keyManager

        public SslContextBuilder keyManager​(InputStream keyCertChainInputStream,
                                            InputStream keyInputStream)
        Identifying certificate for this host. keyCertChainInputStream and keyInputStream may be null for client contexts, which disables mutual authentication.
        Parameters:
        keyCertChainInputStream - an input stream for an X.509 certificate chain in PEM format. The caller is responsible for calling InputStream.close() after build() has been called.
        keyInputStream - an input stream for a PKCS#8 private key in PEM format. The caller is responsible for calling InputStream.close() after build() has been called.
      • keyManager

        public SslContextBuilder keyManager​(PrivateKey key,
                                            X509Certificate... keyCertChain)
        Identifying certificate for this host. keyCertChain and key may be null for client contexts, which disables mutual authentication.
        Parameters:
        key - a PKCS#8 private key
        keyCertChain - an X.509 certificate chain
      • keyManager

        public SslContextBuilder keyManager​(PrivateKey key,
                                            Iterable<? extends X509Certificate> keyCertChain)
        Identifying certificate for this host. keyCertChain and key may be null for client contexts, which disables mutual authentication.
        Parameters:
        key - a PKCS#8 private key
        keyCertChain - an X.509 certificate chain
      • keyManager

        public SslContextBuilder keyManager​(File keyCertChainFile,
                                            File keyFile,
                                            String keyPassword)
        Identifying certificate for this host. keyCertChainFile and keyFile may be null for client contexts, which disables mutual authentication.
        Parameters:
        keyCertChainFile - an X.509 certificate chain file in PEM format
        keyFile - a PKCS#8 private key file in PEM format
        keyPassword - the password of the keyFile, or null if it's not password-protected
      • keyManager

        public SslContextBuilder keyManager​(InputStream keyCertChainInputStream,
                                            InputStream keyInputStream,
                                            String keyPassword)
        Identifying certificate for this host. keyCertChainInputStream and keyInputStream may be null for client contexts, which disables mutual authentication.
        Parameters:
        keyCertChainInputStream - an input stream for an X.509 certificate chain in PEM format. The caller is responsible for calling InputStream.close() after build() has been called.
        keyInputStream - an input stream for a PKCS#8 private key in PEM format. The caller is responsible for calling InputStream.close() after build() has been called.
        keyPassword - the password of the keyInputStream, or null if it's not password-protected
      • keyManager

        public SslContextBuilder keyManager​(PrivateKey key,
                                            String keyPassword,
                                            X509Certificate... keyCertChain)
        Identifying certificate for this host. keyCertChain and key may be null for client contexts, which disables mutual authentication.
        Parameters:
        key - a PKCS#8 private key file
        keyPassword - the password of the key, or null if it's not password-protected
        keyCertChain - an X.509 certificate chain
      • keyManager

        public SslContextBuilder keyManager​(PrivateKey key,
                                            String keyPassword,
                                            Iterable<? extends X509Certificate> keyCertChain)
        Identifying certificate for this host. keyCertChain and key may be null for client contexts, which disables mutual authentication.
        Parameters:
        key - a PKCS#8 private key file
        keyPassword - the password of the key, or null if it's not password-protected
        keyCertChain - an X.509 certificate chain
      • keyManager

        public SslContextBuilder keyManager​(KeyManagerFactory keyManagerFactory)
        Identifying manager for this host. keyManagerFactory may be null for client contexts, which disables mutual authentication. Using a KeyManagerFactory is only supported for SslProvider.JDK or SslProvider#OPENSSL / SslProvider#OPENSSL_REFCNT if the used openssl version is 1.0.1+. You can check if your openssl version supports using a KeyManagerFactory by calling OpenSsl#supportsKeyManagerFactory(). If this is not the case you must use keyManager(File, File) or keyManager(File, File, String). If you use SslProvider#OPENSSL or SslProvider#OPENSSL_REFCNT consider using OpenSslX509KeyManagerFactory or OpenSslCachingX509KeyManagerFactory.
      • ciphers

        public SslContextBuilder ciphers​(Iterable<String> ciphers)
        The cipher suites to enable, in the order of preference. null to use default cipher suites.
      • ciphers

        public SslContextBuilder ciphers​(Iterable<String> ciphers,
                                         CipherSuiteFilter cipherFilter)
        The cipher suites to enable, in the order of preference. cipherFilter will be applied to the ciphers before use. If ciphers is null, then the default cipher suites will be used.
      • sessionCacheSize

        public SslContextBuilder sessionCacheSize​(long sessionCacheSize)
        Set the size of the cache used for storing SSL session objects. 0 to use the default value.
      • sessionTimeout

        public SslContextBuilder sessionTimeout​(long sessionTimeout)
        Set the timeout for the cached SSL session objects, in seconds. 0 to use the default value.
      • startTls

        public SslContextBuilder startTls​(boolean startTls)
        true if the first write request shouldn't be encrypted.
      • enableOcsp

        @UnstableApi
        public SslContextBuilder enableOcsp​(boolean enableOcsp)
        Enables OCSP stapling. Please note that not all SslProvider implementations support OCSP stapling and an exception will be thrown upon build().
        See Also:
        OpenSsl#isOcspSupported()