Java SslContextFactory类代码示例

import org.eclipse.jetty.util.ssl.SslContextFactory; //导入依赖的package包/类
@Override
public void customize(Server server) {
    // HTTPS Configuration
    HttpConfiguration httpsConfig = new HttpConfiguration();
    httpsConfig.setSecureScheme("https");
    httpsConfig.setSecurePort(8443);
    httpsConfig.addCustomizer(new SecureRequestCustomizer());

    // SSL Context Factory for HTTPS and HTTP/2
    SslContextFactory sslContextFactory = new SslContextFactory();
    sslContextFactory.setKeyStoreResource(newClassPathResource("keystore"));
    sslContextFactory.setKeyStorePassword("OBF:1vny1zlo1x8e1vnw1vn61x8g1zlu1vn4");
    sslContextFactory.setKeyManagerPassword("OBF:1u2u1wml1z7s1z7a1wnl1u2g");
    sslContextFactory.setCipherComparator(HTTP2Cipher.COMPARATOR);

    // SSL Connection Factory
    SslConnectionFactory ssl = new SslConnectionFactory(sslContextFactory, "h2");

    // HTTP/2 Connector
    ServerConnector http2Connector = new ServerConnector(server, ssl, new HTTP2ServerConnectionFactory(httpsConfig));
    http2Connector.setPort(8443);
    server.addConnector(http2Connector);
}
 

import org.eclipse.jetty.util.ssl.SslContextFactory; //导入依赖的package包/类
@Test
public void testRetry() throws Exception {
    SalesforceComponent sf = context().getComponent("salesforce", SalesforceComponent.class);
    String accessToken = sf.getSession().getAccessToken();

    SslContextFactory sslContextFactory = new SslContextFactory();
    sslContextFactory.setSslContext(new SSLContextParameters().createSSLContext(context));
    HttpClient httpClient = new HttpClient(sslContextFactory);
    httpClient.setConnectTimeout(60000);
    httpClient.start();

    String uri = sf.getLoginConfig().getLoginUrl() + "/services/oauth2/revoke?token=" + accessToken;
    Request logoutGet = httpClient.newRequest(uri)
        .method(HttpMethod.GET)
        .timeout(1, TimeUnit.MINUTES);

    ContentResponse response = logoutGet.send();
    assertEquals(HttpStatus.OK_200, response.getStatus());

    JobInfo jobInfo = new JobInfo();
    jobInfo.setOperation(OperationEnum.INSERT);
    jobInfo.setContentType(ContentType.CSV);
    jobInfo.setObject(Merchandise__c.class.getSimpleName());
    createJob(jobInfo);
}
 

import org.eclipse.jetty.util.ssl.SslContextFactory; //导入依赖的package包/类
private void configureSslTrustStore(SslContextFactory factory, Ssl ssl) {
	if (ssl.getTrustStorePassword() != null) {
		factory.setTrustStorePassword(ssl.getTrustStorePassword());
	}
	if (ssl.getTrustStore() != null) {
		try {
			URL url = ResourceUtils.getURL(ssl.getTrustStore());
			factory.setTrustStoreResource(Resource.newResource(url));
		}
		catch (IOException ex) {
			throw new EmbeddedServletContainerException(
					"Could not find trust store '" + ssl.getTrustStore() + "'", ex);
		}
	}
	if (ssl.getTrustStoreType() != null) {
		factory.setTrustStoreType(ssl.getTrustStoreType());
	}
	if (ssl.getTrustStoreProvider() != null) {
		factory.setTrustStoreProvider(ssl.getTrustStoreProvider());
	}
}
 

import org.eclipse.jetty.util.ssl.SslContextFactory; //导入依赖的package包/类
private void configureSslKeyStore(SslContextFactory factory, Ssl ssl) {
	try {
		URL url = ResourceUtils.getURL(ssl.getKeyStore());
		factory.setKeyStoreResource(Resource.newResource(url));
	}
	catch (IOException ex) {
		throw new EmbeddedServletContainerException(
				"Could not find key store '" + ssl.getKeyStore() + "'", ex);
	}
	if (ssl.getKeyStoreType() != null) {
		factory.setKeyStoreType(ssl.getKeyStoreType());
	}
	if (ssl.getKeyStoreProvider() != null) {
		factory.setKeyStoreProvider(ssl.getKeyStoreProvider());
	}
}
 

import org.eclipse.jetty.util.ssl.SslContextFactory; //导入依赖的package包/类
private HttpClient createHttpClient() {
    //Allow ssl by default
    SslContextFactory sslContextFactory = new SslContextFactory();
    //Don't exclude RSA because Sixt needs them, dammit!
    sslContextFactory.setExcludeCipherSuites("");
    HttpClient client = new HttpClient(sslContextFactory);
    client.setFollowRedirects(false);
    client.setMaxConnectionsPerDestination(16);
    client.setConnectTimeout(FeatureFlags.getHttpConnectTimeout(serviceProperties));
    client.setAddressResolutionTimeout(FeatureFlags.getHttpAddressResolutionTimeout(serviceProperties));
    //You can set more restrictive timeouts per request, but not less, so
    //  we set the maximum timeout of 1 hour here.
    client.setIdleTimeout(60 * 60 * 1000);
    try {
        client.start();
    } catch (Exception e) {
        logger.error("Error building http client", e);
    }
    return client;
}
 

import org.eclipse.jetty.util.ssl.SslContextFactory; //导入依赖的package包/类
private HttpClient createHttpClient() {
    SslContextFactory sslContextFactory = new SslContextFactory();
    sslContextFactory.setExcludeCipherSuites("");
    HttpClient client = new HttpClient(sslContextFactory);
    client.setFollowRedirects(false);
    client.setMaxConnectionsPerDestination(2);
    //You can set more restrictive timeouts per request, but not less, so
    //  we set the maximum timeout of 1 hour here.
    client.setIdleTimeout(60 * 60 * 1000);
    try {
        client.start();
    } catch (Exception e) {
        logger.error("Error building http client", e);
    }
    return client;
}
 

import org.eclipse.jetty.util.ssl.SslContextFactory; //导入依赖的package包/类
/**
 * Creates a server connector.
 *
 * If an HTTPS key store is configured, returns a SSL connector for HTTPS.
 *
 * Otherwise, returns a normal HTTP connector by default.
 *
 * @param server The server.
 * @return The server connector.
 */
@SuppressWarnings("squid:S2095")
private ServerConnector createConnector(final Server server) {
    final String keyStorePath = (String) configuration.get(MinijaxProperties.SSL_KEY_STORE_PATH);

    if (keyStorePath == null || keyStorePath.isEmpty()) {
        // Normal HTTP
        return new ServerConnector(server);
    }

    final String keyStorePassword = (String) configuration.get(MinijaxProperties.SSL_KEY_STORE_PASSWORD);
    final String keyManagerPassword = (String) configuration.get(MinijaxProperties.SSL_KEY_MANAGER_PASSWORD);

    final HttpConfiguration https = new HttpConfiguration();
    https.addCustomizer(new SecureRequestCustomizer());

    final SslContextFactory sslContextFactory = new SslContextFactory();
    sslContextFactory.setKeyStorePath(Minijax.class.getClassLoader().getResource(keyStorePath).toExternalForm());
    sslContextFactory.setKeyStorePassword(keyStorePassword);
    sslContextFactory.setKeyManagerPassword(keyManagerPassword);

    return new ServerConnector(server,
            new SslConnectionFactory(sslContextFactory, "http/1.1"),
            new HttpConnectionFactory(https));
}
 

import org.eclipse.jetty.util.ssl.SslContextFactory; //导入依赖的package包/类
private void configureSslKeyStore(SslContextFactory factory, Ssl ssl) {
    try {
        URL url = ResourceUtils.getURL(ssl.getKeyStore());
        factory.setKeyStoreResource(Resource.newResource(url));
    } catch (IOException ex) {
        throw new WebServerException(
                "Could not find key store '" + ssl.getKeyStore() + "'", ex);
    }

    if (ssl.getKeyStoreType() != null) {
        factory.setKeyStoreType(ssl.getKeyStoreType());
    }

    if (ssl.getKeyStoreProvider() != null) {
        factory.setKeyStoreProvider(ssl.getKeyStoreProvider());
    }
}
 

import org.eclipse.jetty.util.ssl.SslContextFactory; //导入依赖的package包/类
private void configureSslTrustStore(final SslContextFactory factory, final Ssl ssl) {
    if (ssl.getTrustStorePassword() != null) {
        factory.setTrustStorePassword(ssl.getTrustStorePassword());
    }

    if (ssl.getTrustStore() != null) {
        try {
            URL url = ResourceUtils.getURL(ssl.getTrustStore());
            factory.setTrustStoreResource(Resource.newResource(url));
        } catch (IOException ex) {
            throw new WebServerException(
                    "Could not find trust store '" + ssl.getTrustStore() + "'", ex);
        }
    }

    if (ssl.getTrustStoreType() != null) {
        factory.setTrustStoreType(ssl.getTrustStoreType());
    }

    if (ssl.getTrustStoreProvider() != null) {
        factory.setTrustStoreProvider(ssl.getTrustStoreProvider());
    }
}
 

import org.eclipse.jetty.util.ssl.SslContextFactory; //导入依赖的package包/类
/**
 * Create an HTTPS connector for given jetty server instance. If the config has specified keystore/truststore settings
 * they will be used else a self-signed certificate is generated and used.
 *
 * @param hostName
 * @param config {@link DremioConfig} containing SSL related settings if any.
 * @param embeddedJetty Jetty server instance needed for creating a ServerConnector.
 *
 * @return Initialized {@link ServerConnector} for HTTPS connections and the trust store. Trust store is non-null only
 * when in case of auto generated self-signed certificate.
 * @throws Exception
 */
public Pair<ServerConnector, KeyStore> createHttpsConnector(final Server embeddedJetty,
    final DremioConfig config, final String hostName, final String... alternativeNames) throws Exception {
  logger.info("Setting up HTTPS connector for web server");

  final SslContextFactory sslContextFactory = new SslContextFactory();

  Pair<KeyStore, String> keyStore = getKeyStore(config, hostName, alternativeNames);
  KeyStore trustStore = getTrustStore(config);

  sslContextFactory.setKeyStore(keyStore.getLeft());
  // Assuming that the keystore and the keymanager passwords are the same
  // based on JSSE examples...
  sslContextFactory.setKeyManagerPassword(keyStore.getRight());
  sslContextFactory.setTrustStore(trustStore);

  // Disable ciphers, protocols and other that are considered weak/vulnerable
  sslContextFactory.setExcludeCipherSuites(
      "TLS_DHE.*",
      "TLS_EDH.*"
      // TODO: there are few other ciphers that Chrome complains about being obsolete. Research more about them and
      // include here.
  );

  sslContextFactory.setExcludeProtocols("SSLv3");
  sslContextFactory.setRenegotiationAllowed(false);

  // SSL Connector
  final ServerConnector sslConnector = new ServerConnector(embeddedJetty,
      new SslConnectionFactory(sslContextFactory, HttpVersion.HTTP_1_1.asString()),
      new HttpConnectionFactory(new HttpConfiguration()));

  return Pair.of(sslConnector, trustStore);
}
 

import org.eclipse.jetty.util.ssl.SslContextFactory; //导入依赖的package包/类
public SslContextFactory getSslContextFactory() throws GeneralSecurityException, IOException {
    SslContextFactory sslContextFactory = new SslContextFactory();
    KeyStore keyStore = KeyStore.getInstance(properties.getProperty(MINIFI_C2_SERVER_KEYSTORE_TYPE));
    Path keyStorePath = Paths.get(C2_SERVER_HOME).resolve(properties.getProperty(MINIFI_C2_SERVER_KEYSTORE)).toAbsolutePath();
    logger.debug("keystore path: " + keyStorePath);
    try (InputStream inputStream = Files.newInputStream(keyStorePath)) {
        keyStore.load(inputStream, properties.getProperty(MINIFI_C2_SERVER_KEYSTORE_PASSWD).toCharArray());
    }
    sslContextFactory.setKeyStore(keyStore);
    sslContextFactory.setKeyManagerPassword(properties.getProperty(MINIFI_C2_SERVER_KEY_PASSWD));
    sslContextFactory.setWantClientAuth(true);

    String trustStorePath = Paths.get(C2_SERVER_HOME).resolve(properties.getProperty(MINIFI_C2_SERVER_TRUSTSTORE)).toAbsolutePath().toFile().getAbsolutePath();
    logger.debug("truststore path: " + trustStorePath);
    sslContextFactory.setTrustStorePath(trustStorePath);
    sslContextFactory.setTrustStoreType(properties.getProperty(MINIFI_C2_SERVER_TRUSTSTORE_TYPE));
    sslContextFactory.setTrustStorePassword(properties.getProperty(MINIFI_C2_SERVER_TRUSTSTORE_PASSWD));
    try {
        sslContextFactory.start();
    } catch (Exception e) {
        throw new IOException(e);
    }
    return sslContextFactory;
}
 

import org.eclipse.jetty.util.ssl.SslContextFactory; //导入依赖的package包/类
private SslContextFactory createSslContextFactory(OptionMap options) {
    SslContextFactory context = new SslContextFactory();
    Object keystore = options.get("keystore");
    if (keystore instanceof KeyStore) {
        context.setKeyStore((KeyStore) keystore);
    } else {
        throw new MisconfigurationException("");
    }
    context.setKeyStorePassword(options.getString("keystorePassword"));

    Object truststore = options.get("truststore");
     if (truststore instanceof KeyStore) {
        context.setTrustStore((KeyStore) truststore);
    }
    context.setTrustStorePassword(options.getString("truststorePassword"));

    String clientAuth = options.getString("clientAuth", "none");
    switch (clientAuth) {
        case "need": context.setNeedClientAuth(true); break;
        case "want": context.setWantClientAuth(true); break;
    }

    return context;
}
 

import org.eclipse.jetty.util.ssl.SslContextFactory; //导入依赖的package包/类
private void setupSSL(Server server,HttpConfiguration http_config) {
	SslContextFactory sslContextFactory = new SslContextFactory();
	
	if (sslKeyStoreFile!=null)
		sslContextFactory.setKeyStorePath(sslKeyStoreFile);
	else if (sslKeyStore!=null)
		sslContextFactory.setKeyStore(sslKeyStore);
	else {
		log.log(Level.SEVERE,"Error while configuring SSL connection. Missing KeyStore!");
		return;
	}
	sslContextFactory.setKeyStorePassword(new String(sslKeyStorePassword));
	sslContextFactory.setExcludeCipherSuites("SSL_RSA_WITH_DES_CBC_SHA",
			"SSL_DHE_RSA_WITH_DES_CBC_SHA", "SSL_DHE_DSS_WITH_DES_CBC_SHA",
			"SSL_RSA_EXPORT_WITH_RC4_40_MD5",
			"SSL_RSA_EXPORT_WITH_DES40_CBC_SHA",
			"SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA",
			"SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA");
	HttpConfiguration https_config = new HttpConfiguration(http_config);
	https_config.addCustomizer(new SecureRequestCustomizer());
	ServerConnector sslConnector = new ServerConnector(server,
		new SslConnectionFactory(sslContextFactory,HttpVersion.HTTP_1_1.asString()),
		new HttpConnectionFactory(https_config));
	sslConnector.setPort(daemonPortSecure);
	server.addConnector(sslConnector);
}
 

import org.eclipse.jetty.util.ssl.SslContextFactory; //导入依赖的package包/类
private ServerConnector createSSLServerConnector(Connector connectorConfig)
{
    SslContextFactory sslFact = new SslContextFactory();
    if (StringUtils.isNotBlank(connectorConfig.getKeyStorePath()))
    {
        sslFact.setKeyStorePath(connectorConfig.getKeyStorePath());
    }
    if (StringUtils.isNotBlank(connectorConfig.getKeyStorePassword()))
    {
        sslFact.setKeyStorePassword(connectorConfig.getKeyStorePassword());
    }
    if (StringUtils.isNotBlank(connectorConfig.getKeyManagerPassword()))
    {
        sslFact.setKeyManagerPassword(connectorConfig.getKeyManagerPassword());
    }
    if (StringUtils.isNotBlank(connectorConfig.getTrustStorePath()))
    {
        sslFact.setTrustStorePath(connectorConfig.getTrustStorePath());
    }
    if (StringUtils.isNotBlank(connectorConfig.getTrustStorePassword()))
    {
        sslFact.setTrustStorePassword(connectorConfig.getTrustStorePassword());
    }

    return new ServerConnector(internal, sslFact);
}
 

import org.eclipse.jetty.util.ssl.SslContextFactory; //导入依赖的package包/类
public static void addHttpsConnector(Server server, int port) throws IOException, URISyntaxException {

        String keyStoreFile = resourceAsFile("ssltest-keystore.jks").getAbsolutePath();
        SslContextFactory sslContextFactory = new SslContextFactory(keyStoreFile);
        sslContextFactory.setKeyStorePassword("changeit");

        String trustStoreFile = resourceAsFile("ssltest-cacerts.jks").getAbsolutePath();
        sslContextFactory.setTrustStorePath(trustStoreFile);
        sslContextFactory.setTrustStorePassword("changeit");

        HttpConfiguration httpsConfig = new HttpConfiguration();
        httpsConfig.setSecureScheme("https");
        httpsConfig.setSecurePort(port);
        httpsConfig.addCustomizer(new SecureRequestCustomizer());

        ServerConnector connector = new ServerConnector(server, new SslConnectionFactory(sslContextFactory, "http/1.1"), new HttpConnectionFactory(httpsConfig));
        connector.setPort(port);

        server.addConnector(connector);
    }