Interface SSLContext

All Known Implementing Classes:
OpenSSLContext
public interface SSLContext
This interface is needed to override the default SSLContext class to allow SSL implementation pluggability without having to use JCE. With regular JSSE it will do nothing but delegate to the SSLContext.

  • Method Details

    • init

      void init(KeyManager[] kms, TrustManager[] tms, SecureRandom sr) throws KeyManagementException
      Initializes the SSL context with the given key managers, trust managers, and random number generator.
      Parameters:
      kms - The key managers
      tms - The trust managers
      sr - The secure random number generator
      Throws:
      KeyManagementException - if initialization fails

    • destroy

      void destroy()
      Destroys this SSL context and releases any associated resources.

    • getServerSessionContext

      SSLSessionContext getServerSessionContext()
      Returns the server session context.
      Returns:
      The server session context

    • createSSLEngine

      SSLEngine createSSLEngine()
      Creates a new SSL engine.
      Returns:
      The new SSL engine

    • createSSLEngine

      default SSLEngine createSSLEngine(boolean clientMode)
      Creates a new SSL engine for the requested mode.
      Parameters:
      clientMode - true for client mode, otherwise server mode
      Returns:
      The new SSL engine

    • getServerSocketFactory

      SSLServerSocketFactory getServerSocketFactory()
      Returns the server socket factory.
      Returns:
      The server socket factory

    • getSupportedSSLParameters

      SSLParameters getSupportedSSLParameters()
      Returns the supported SSL parameters.
      Returns:
      The supported SSL parameters

    • getCertificateChain

      X509Certificate[] getCertificateChain(String alias)
      Returns the certificate chain for the given alias.
      Parameters:
      alias - The alias
      Returns:
      The certificate chain

    • getServerKeyManagers

      default X509KeyManager[] getServerKeyManagers(SSLHostConfigCertificate certificate)
      Returns the key managers that may serve the given certificate configuration, in preference order. Used by getServedAlias(SSLHostConfigCertificate) to resolve the alias actually served. The default returns an empty array (no key manager known); implementations backed by one or more key managers override it to expose them.
      Parameters:
      certificate - The certificate configuration
      Returns:
      The key managers that may serve the certificate, possibly empty, never null

    • getServedAlias

      default String getServedAlias(SSLHostConfigCertificate certificate)
      Returns the alias of the certificate served for the given certificate configuration, for use with getCertificateChain(String). The key managers from getServerKeyManagers(SSLHostConfigCertificate) are consulted in preference order and the first one that names an alias decides, just as JSSE only uses the first key manager:
      • A JSSEKeyManager, which Tomcat pins to an alias, serves that alias in every handshake. This can differ from SSLHostConfigCertificate.getCertificateKeyAlias(), for example after SunMSCAPI Windows-MY numbered-duplicate resolution.
      • Any other key manager chooses an alias itself, for example one from a FIPS key manager factory, which Tomcat does not wrap, or one over an in-memory key store that holds only the selected key. The configured alias (or SSLUtilBase.DEFAULT_KEY_ALIAS when none is configured) is used if that key manager holds it, otherwise the alias it would choose - for example for a key that an in-memory key store holds under another alias, or the synthetic alias generated by the NewSunX509 key manager.
      If no key manager names an alias, the configured (or default) alias is returned.

      For a key manager that Tomcat does not wrap, such as one from a FIPS key manager factory, the result is the configured alias when that key manager holds it. A JSSE handshake may nevertheless be served a different entry, as the key manager chooses per handshake, for example by key type or server name, and this cannot be predicted. Certificate monitoring based on the result is therefore only reliable if the configured alias identifies the certificate that is served.

      Parameters:
      certificate - The certificate configuration
      Returns:
      The served alias, never null

    • getAcceptedIssuers

      X509Certificate[] getAcceptedIssuers()
      Returns the accepted issuers.
      Returns:
      The accepted issuers