Interface TlsManager

All Superinterfaces:
NamedService
All Known Implementing Classes:
ConfiguredTlsManager
@Contract public interface TlsManager extends NamedService
Implementors of this contract are responsible for initializing a single SSLContext identity and managing the TlsReloadableComponent instances that provide its key and trust material. Once the context is exposed through an Tls instance, its identity must not change. Post-initialization material changes are published through the reload methods.

  • Method Details

    • init

      void init(TlsConfig tls)
      Initializes this manager before any other method is called. This method is only called when TLS is enabled. In case TLS is disabled, none of the methods on this type can be called.

      A manager can be shared, so this method may be called more than once. Later calls must not replace state already exposed through an Tls instance. Implementations may ignore later calls or reject incompatible configuration.

      Parameters:
      tls - TLS configuration

    • reload

      @Deprecated(forRemoval=true, since="27.0.0") default void reload(Tls tls)
      Deprecated, for removal: This API element is subject to removal in a future version.
      use reload(TlsMaterial), this method will be removed in the next major version of Helidon
      This method will multiplex the call to all TlsReloadableComponents that are being managed by this manager.
      Parameters:
      tls - the new tls instance
      See Also:

    • reload

      default void reload(TlsMaterial material)
      This method will multiplex the call to all TlsReloadableComponents that are being managed by this manager.
      Parameters:
      material - the new TLS material
      See Also:

    • generation

      default long generation()
      Generation of TLS material changes reported by this manager.

      The generation after the manager's first successful initialization is 0. An implementation that overrides this method must advance the value whenever key or trust material changes, including when a reload fails after it may have published a change. A concurrent read must not return while a material change is being published, and every direct or provider-driven material publication path must participate. All post-initialization publication paths must be serialized with the mechanism used by this method.

      A caller can obtain a coherent snapshot by reading the generation, obtaining the manager state, and then reading the generation again, accepting the snapshot only when both values are equal. An overriding implementation must ensure equal values mean no material publication crossed that interval.

      The compatibility default always returns 0. A manager that supports reload but does not override this method does not report those reloads, so its generation may lag behind its current material.

      Returns:
      current TLS material generation

    • sslContext

      SSLContext sslContext()
      SSL context created by this manager. This method is called only after init(io.helidon.common.tls.TlsConfig) and only if TlsConfig.enabled() is true. The returned context identity must remain stable after the first successful initialization.
      Returns:
      the SSL context to use

    • keyManager

      Optional<X509KeyManager> keyManager()
      The key manager in use.
      Returns:
      key manager

    • trustManager

      Optional<X509TrustManager> trustManager()
      The trust manager in use.
      Returns:
      trust manager