Class ConfiguredTlsManager

java.lang.Object
io.helidon.common.tls.ConfiguredTlsManager
All Implemented Interfaces:
TlsManager, NamedService
public class ConfiguredTlsManager extends Object implements TlsManager
The default configured TlsManager implementation.

  • Constructor Details

    • ConfiguredTlsManager

      protected ConfiguredTlsManager(String name, String type)
      Configured tls manager constructor.
      Parameters:
      name - the manager name
      type - the manager type

  • Method Details

    • name

      public String name()
      Description copied from interface: NamedService
      Name of this implementation, as provided in ConfiguredProvider.create(Config, String).
      Specified by:
      name in interface NamedService
      Returns:
      name of this service

    • type

      public String type()
      Description copied from interface: NamedService
      Type of this implementation, to distinguish instances of same type, with different NamedService.name(). Use for example ConfiguredProvider.configKey() to define the type.
      Specified by:
      type in interface NamedService
      Returns:
      type of this service

    • sslContext

      public SSLContext sslContext()
      Description copied from interface: TlsManager
      SSL context created by this manager. This method is called only after TlsManager.init(io.helidon.common.tls.TlsConfig) and only if TlsConfig.enabled() is true. The returned context identity must remain stable after the first successful initialization.
      Specified by:
      sslContext in interface TlsManager
      Returns:
      the SSL context to use

    • init

      public void init(TlsConfig tlsConfig)
      Description copied from interface: TlsManager
      Initializes this manager before any other method is called. This method is only called when TLS is enabled. In case TLS is disabled, none of the methods on this type can be called.

      A manager can be shared, so this method may be called more than once. Later calls must not replace state already exposed through an Tls instance. Implementations may ignore later calls or reject incompatible configuration.

      Specified by:
      init in interface TlsManager
      Parameters:
      tlsConfig - TLS configuration

    • reload

      @Deprecated(forRemoval=true, since="27.0.0") public void reload(Tls tls)
      Deprecated, for removal: This API element is subject to removal in a future version.
      Description copied from interface: TlsManager
      This method will multiplex the call to all TlsReloadableComponents that are being managed by this manager.
      Specified by:
      reload in interface TlsManager
      Parameters:
      tls - the new tls instance
      See Also:

    • reload

      public void reload(TlsMaterial material)
      Description copied from interface: TlsManager
      This method will multiplex the call to all TlsReloadableComponents that are being managed by this manager.
      Specified by:
      reload in interface TlsManager
      Parameters:
      material - the new TLS material
      See Also:

    • generation

      public long generation()
      Description copied from interface: TlsManager
      Generation of TLS material changes reported by this manager.

      The generation after the manager's first successful initialization is 0. An implementation that overrides this method must advance the value whenever key or trust material changes, including when a reload fails after it may have published a change. A concurrent read must not return while a material change is being published, and every direct or provider-driven material publication path must participate. All post-initialization publication paths must be serialized with the mechanism used by this method.

      A caller can obtain a coherent snapshot by reading the generation, obtaining the manager state, and then reading the generation again, accepting the snapshot only when both values are equal. An overriding implementation must ensure equal values mean no material publication crossed that interval.

      The compatibility default always returns 0. A manager that supports reload but does not override this method does not report those reloads, so its generation may lag behind its current material.

      Specified by:
      generation in interface TlsManager
      Returns:
      current TLS material generation

    • keyManager

      public Optional<X509KeyManager> keyManager()
      Description copied from interface: TlsManager
      The key manager in use.
      Specified by:
      keyManager in interface TlsManager
      Returns:
      key manager

    • trustManager

      public Optional<X509TrustManager> trustManager()
      Description copied from interface: TlsManager
      The trust manager in use.
      Specified by:
      trustManager in interface TlsManager
      Returns:
      trust manager

    • reload

      protected void reload(Optional<X509KeyManager> keyManager, Optional<X509TrustManager> trustManager)
      Reload the current SSL context with the provided key manager and trust manager (if defined).

      Subclasses must route every key and trust material publication through this method to retain the inherited TlsManager.generation() tracking. A subclass that bypasses this method owns the generation contract.

      Parameters:
      keyManager - key manager to use
      trustManager - trust manager to use

    • initSslContext

      protected void initSslContext(TlsConfig tlsConfig, SecureRandom secureRandom, KeyManager[] keyManagers, TrustManager[] trustManagers)
      Initialize and set the SSLContext on this manager instance. The first successful initialization retains generation 0; later calls are ignored. Use TlsManager.reload(io.helidon.common.tls.TlsMaterial) for later material changes.
      Parameters:
      tlsConfig - the tls configuration
      secureRandom - the secure random
      keyManagers - the key managers
      trustManagers - the trust managers

    • secureRandom

      protected SecureRandom secureRandom(TlsConfig tlsConfig)
      Load secure random.
      Parameters:
      tlsConfig - TLS configuration
      Returns:
      secure random

    • secureRandom

      protected SecureRandom secureRandom(TlsMaterial material)
      Load secure random.
      Parameters:
      material - TLS material
      Returns:
      secure random

    • buildKmf

      protected KeyManagerFactory buildKmf(TlsConfig target, SecureRandom secureRandom, PrivateKey privateKey, Certificate[] certificates)
      Build the key manager factory.
      Parameters:
      target - the tls configuration
      secureRandom - the secure random
      privateKey - the private key for the key store
      certificates - the certificates for the keystore
      Returns:
      a key manager factory instance

    • buildKmf

      protected KeyManagerFactory buildKmf(TlsMaterial target, SecureRandom secureRandom, PrivateKey privateKey, Certificate[] certificates)
      Build the key manager factory.
      Parameters:
      target - the TLS material
      secureRandom - the secure random
      privateKey - the private key for the key store
      certificates - the certificates for the keystore
      Returns:
      a key manager factory instance

    • internalKeystore

      protected KeyStore internalKeystore(TlsConfig tlsConfig)
      Creates an internal keystore and loads it with no password and no data.
      Parameters:
      tlsConfig - TLS config
      Returns:
      a new keystore

    • internalKeystore

      protected KeyStore internalKeystore(TlsMaterial material)
      Creates an internal keystore and loads it with no password and no data.
      Parameters:
      material - TLS material
      Returns:
      a new keystore

    • createTmf

      protected TrustManagerFactory createTmf(TlsConfig tlsConfig)
      Create a new trust manager factory based on the configuration (i.e., the algorithm and provider).
      Parameters:
      tlsConfig - TLS config
      Returns:
      a new trust manager factory

    • createTmf

      protected TrustManagerFactory createTmf(TlsMaterial material)
      Create a new trust manager factory based on the TLS material (i.e., the algorithm and provider).
      Parameters:
      material - TLS material
      Returns:
      a new trust manager factory

    • initializeTmf

      protected void initializeTmf(TrustManagerFactory tmf, KeyStore keyStore, TlsConfig tlsConfig)
      Perform initialization of the TrustManagerFactory based on the provided TLS configuration.
      Parameters:
      tmf - trust manager factory to be initialized
      keyStore - keystore
      tlsConfig - tls configuration

    • initializeTmf

      protected void initializeTmf(TrustManagerFactory tmf, KeyStore keyStore, TlsMaterial material)
      Perform initialization of the TrustManagerFactory based on the provided TLS material.
      Parameters:
      tmf - trust manager factory to be initialized
      keyStore - keystore
      material - TLS material

    • trustAllTmf

      protected TrustManagerFactory trustAllTmf()
      Creates a trust all trust manager factory.
      Returns:
      a new trust manager factory trusting all