Module nl.altindag.ssl

Package nl.altindag.ssl.keymanager

Class AggregatedX509ExtendedKeyManager

java.lang.Object

javax.net.ssl.X509ExtendedKeyManager

nl.altindag.ssl.keymanager.AggregatedX509ExtendedKeyManager

All Implemented Interfaces:

KeyManager, X509KeyManager, CombinableX509KeyManager, RoutableX509KeyManager

public final class AggregatedX509ExtendedKeyManager
extends X509ExtendedKeyManager
implements CombinableX509KeyManager, RoutableX509KeyManager

Represents an ordered list of X509ExtendedKeyManager with most-preferred managers first.

This is necessary because of the fine-print on SSLContext.init(javax.net.ssl.KeyManager[], javax.net.ssl.TrustManager[], java.security.SecureRandom): Only the first instance of a particular key and/or key manager implementation type in the array is used. (For example, only the first javax.net.ssl.X509KeyManager in the array will be used.) The KeyManager can be build from one or more of any combination provided within the KeyManagerUtils.KeyManagerBuilder.

This includes:

     - Any amount of custom KeyManagers
     - Any amount of custom Identities
 

NOTE: Please don't use this class directly as it is part of the internal API. Class name and methods can be changed any time. Instead use the KeyManagerUtils which provides the same functionality while it has a stable API because it is part of the public API.

See Also:

• http://stackoverflow.com/questions/1793979/registering-multiple-keystores-in-jvm
• http://codyaray.com/2013/04/java-ssl-with-multiple-keystores

Field Summary

Fields

Modifier and Type	Field	Description
(package private) final Map<String,X509ExtendedKeyManager>	keyManagers
private final Map<String,List<URI>>	preferredAliasToHost

Fields inherited from interface nl.altindag.ssl.keymanager.RoutableX509KeyManager

NON_NULL

Constructor Summary

Constructors

Constructor	Description
AggregatedX509ExtendedKeyManager(Map<String,? extends X509ExtendedKeyManager> keyManagers)	Creates a new AggregatedX509ExtendedKeyManager.
AggregatedX509ExtendedKeyManager(Map<String,? extends X509ExtendedKeyManager> keyManagers, Map<String,List<URI>> preferredAliasToHost)	Creates a new AggregatedX509ExtendedKeyManager.

Method Summary

Modifier and Type	Method	Description
String	chooseClientAlias(String[] keyType, Principal[] issuers, Socket socket)	Chooses the first non-null client alias returned from the delegate X509ExtendedKeyManager, or null if there are no matches.
String	chooseEngineClientAlias(String[] keyTypes, Principal[] issuers, SSLEngine sslEngine)	Chooses the first non-null client alias returned from the delegate X509ExtendedKeyManager, or null if there are no matches.
String	chooseEngineServerAlias(String keyType, Principal[] issuers, SSLEngine sslEngine)	Chooses the first non-null server alias returned from the delegate X509ExtendedKeyManager, or null if there are no matches.
String	chooseServerAlias(String keyType, Principal[] issuers, Socket socket)	Chooses the first non-null server alias returned from the delegate X509ExtendedKeyManager, or null if there are no matches.
X509Certificate[]	getCertificateChain(String alias)	Returns the first non-null certificate chain associated with the given alias, or null if the alias can't be found.
String[]	getClientAliases(String keyType, Principal[] issuers)	Get all matching aliases for authenticating the client side of a secure socket, or null if there are no matches.
Map<String,List<URI>>	getIdentityRoute()
Map<String,X509ExtendedKeyManager>	getInnerKeyManagers()
PrivateKey	getPrivateKey(String alias)	Returns the first non-null private key associated with the given alias, or null if the alias can't be found.
String[]	getServerAliases(String keyType, Principal[] issuers)	Get all matching aliases for authenticating the server side of a secure socket, or null if there are no matches.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface nl.altindag.ssl.keymanager.CombinableX509KeyManager

extractInnerField, getAliases

Methods inherited from interface nl.altindag.ssl.keymanager.RoutableX509KeyManager

chooseAlias, chooseClientAlias, chooseServerAlias, containsInetSocketAddress, getPreferredClientAlias, getPreferredClientAlias, getPreferredServerAlias, getPreferredServerAlias

Field Details

keyManagers

final Map<String,X509ExtendedKeyManager> keyManagers

preferredAliasToHost

private final Map<String,List<URI>> preferredAliasToHost

Constructor Details

AggregatedX509ExtendedKeyManager

public AggregatedX509ExtendedKeyManager(Map<String,? extends X509ExtendedKeyManager> keyManagers)

Creates a new AggregatedX509ExtendedKeyManager.

Parameters:

keyManagers - the X509ExtendedKeyManager, ordered with the most-preferred managers first.

AggregatedX509ExtendedKeyManager

public AggregatedX509ExtendedKeyManager(Map<String,? extends X509ExtendedKeyManager> keyManagers,
 Map<String,List<URI>> preferredAliasToHost)

Creates a new AggregatedX509ExtendedKeyManager.

Parameters:

keyManagers - the X509ExtendedKeyManager, ordered with the most-preferred managers first.

preferredAliasToHost - the preferred client alias to be used for the given host

Method Details

chooseClientAlias

public String chooseClientAlias(String[] keyType,
 Principal[] issuers,
 Socket socket)

Chooses the first non-null client alias returned from the delegate X509ExtendedKeyManager, or null if there are no matches.

Specified by:

chooseClientAlias in interface X509KeyManager

chooseEngineClientAlias

public String chooseEngineClientAlias(String[] keyTypes,
 Principal[] issuers,
 SSLEngine sslEngine)

Chooses the first non-null client alias returned from the delegate X509ExtendedKeyManager, or null if there are no matches.

Overrides:

chooseEngineClientAlias in class X509ExtendedKeyManager

chooseServerAlias

public String chooseServerAlias(String keyType,
 Principal[] issuers,
 Socket socket)

Chooses the first non-null server alias returned from the delegate X509ExtendedKeyManager, or null if there are no matches.

Specified by:

chooseServerAlias in interface X509KeyManager

chooseEngineServerAlias

public String chooseEngineServerAlias(String keyType,
 Principal[] issuers,
 SSLEngine sslEngine)

Chooses the first non-null server alias returned from the delegate X509ExtendedKeyManager, or null if there are no matches.

Overrides:

chooseEngineServerAlias in class X509ExtendedKeyManager

getPrivateKey

public PrivateKey getPrivateKey(String alias)

Returns the first non-null private key associated with the given alias, or null if the alias can't be found.

Specified by:

getPrivateKey in interface X509KeyManager

getCertificateChain

public X509Certificate[] getCertificateChain(String alias)

Returns the first non-null certificate chain associated with the given alias, or null if the alias can't be found.

Specified by:

getCertificateChain in interface X509KeyManager

getClientAliases

public String[] getClientAliases(String keyType,
 Principal[] issuers)

Get all matching aliases for authenticating the client side of a secure socket, or null if there are no matches.

Specified by:

getClientAliases in interface X509KeyManager

getServerAliases

public String[] getServerAliases(String keyType,
 Principal[] issuers)

Get all matching aliases for authenticating the server side of a secure socket, or null if there are no matches.

Specified by:

getServerAliases in interface X509KeyManager

getInnerKeyManagers

public Map<String,X509ExtendedKeyManager> getInnerKeyManagers()

Specified by:

getInnerKeyManagers in interface CombinableX509KeyManager

getIdentityRoute

public Map<String,List<URI>> getIdentityRoute()

Specified by:

getIdentityRoute in interface RoutableX509KeyManager