Java SslContextFactory.setTrustStore方法代码示例

import org.eclipse.jetty.util.ssl.SslContextFactory; //导入方法依赖的package包/类
/**
 * Create an HTTPS connector for given jetty server instance. If the config has specified keystore/truststore settings
 * they will be used else a self-signed certificate is generated and used.
 *
 * @param hostName
 * @param config {@link DremioConfig} containing SSL related settings if any.
 * @param embeddedJetty Jetty server instance needed for creating a ServerConnector.
 *
 * @return Initialized {@link ServerConnector} for HTTPS connections and the trust store. Trust store is non-null only
 * when in case of auto generated self-signed certificate.
 * @throws Exception
 */
public Pair<ServerConnector, KeyStore> createHttpsConnector(final Server embeddedJetty,
    final DremioConfig config, final String hostName, final String... alternativeNames) throws Exception {
  logger.info("Setting up HTTPS connector for web server");

  final SslContextFactory sslContextFactory = new SslContextFactory();

  Pair<KeyStore, String> keyStore = getKeyStore(config, hostName, alternativeNames);
  KeyStore trustStore = getTrustStore(config);

  sslContextFactory.setKeyStore(keyStore.getLeft());
  // Assuming that the keystore and the keymanager passwords are the same
  // based on JSSE examples...
  sslContextFactory.setKeyManagerPassword(keyStore.getRight());
  sslContextFactory.setTrustStore(trustStore);

  // Disable ciphers, protocols and other that are considered weak/vulnerable
  sslContextFactory.setExcludeCipherSuites(
      "TLS_DHE.*",
      "TLS_EDH.*"
      // TODO: there are few other ciphers that Chrome complains about being obsolete. Research more about them and
      // include here.
  );

  sslContextFactory.setExcludeProtocols("SSLv3");
  sslContextFactory.setRenegotiationAllowed(false);

  // SSL Connector
  final ServerConnector sslConnector = new ServerConnector(embeddedJetty,
      new SslConnectionFactory(sslContextFactory, HttpVersion.HTTP_1_1.asString()),
      new HttpConnectionFactory(new HttpConfiguration()));

  return Pair.of(sslConnector, trustStore);
}
 

import org.eclipse.jetty.util.ssl.SslContextFactory; //导入方法依赖的package包/类
private SslContextFactory createSslContextFactory(OptionMap options) {
    SslContextFactory context = new SslContextFactory();
    Object keystore = options.get("keystore");
    if (keystore instanceof KeyStore) {
        context.setKeyStore((KeyStore) keystore);
    } else {
        throw new MisconfigurationException("");
    }
    context.setKeyStorePassword(options.getString("keystorePassword"));

    Object truststore = options.get("truststore");
     if (truststore instanceof KeyStore) {
        context.setTrustStore((KeyStore) truststore);
    }
    context.setTrustStorePassword(options.getString("truststorePassword"));

    String clientAuth = options.getString("clientAuth", "none");
    switch (clientAuth) {
        case "need": context.setNeedClientAuth(true); break;
        case "want": context.setWantClientAuth(true); break;
    }

    return context;
}
 

import org.eclipse.jetty.util.ssl.SslContextFactory; //导入方法依赖的package包/类
@SuppressWarnings("deprecation")
private static SslContextFactory getSslContextFactory(ZeppelinConfiguration conf) {
  // Note that the API for the SslContextFactory is different for
  // Jetty version 9
  SslContextFactory sslContextFactory = new SslContextFactory();

  // Set keystore
  sslContextFactory.setKeyStore(conf.getKeyStorePath());
  sslContextFactory.setKeyStoreType(conf.getKeyStoreType());
  sslContextFactory.setKeyStorePassword(conf.getKeyStorePassword());
  sslContextFactory.setKeyManagerPassword(conf.getKeyManagerPassword());

  // Set truststore
  sslContextFactory.setTrustStore(conf.getTrustStorePath());
  sslContextFactory.setTrustStoreType(conf.getTrustStoreType());
  sslContextFactory.setTrustStorePassword(conf.getTrustStorePassword());

  sslContextFactory.setNeedClientAuth(conf.useClientAuth());

  return sslContextFactory;
}
 

import org.eclipse.jetty.util.ssl.SslContextFactory; //导入方法依赖的package包/类
/**
 * Configure the SSL connection.
 * @param factory the Jetty {@link SslContextFactory}.
 * @param ssl the ssl details.
 */
protected void configureSsl(SslContextFactory factory, Ssl ssl) {
	factory.setProtocol(ssl.getProtocol());
	configureSslClientAuth(factory, ssl);
	configureSslPasswords(factory, ssl);
	factory.setCertAlias(ssl.getKeyAlias());
	if (ssl.getCiphers() != null) {
		factory.setIncludeCipherSuites(ssl.getCiphers());
	}
	if (ssl.getEnabledProtocols() != null) {
		factory.setIncludeProtocols(ssl.getEnabledProtocols());
	}
	if (getSslStoreProvider() != null) {
		try {
			factory.setKeyStore(getSslStoreProvider().getKeyStore());
			factory.setTrustStore(getSslStoreProvider().getTrustStore());
		}
		catch (Exception ex) {
			throw new IllegalStateException("Unable to set SSL store", ex);
		}
	}
	else {
		configureSslKeyStore(factory, ssl);
		configureSslTrustStore(factory, ssl);
	}
}
 

import org.eclipse.jetty.util.ssl.SslContextFactory; //导入方法依赖的package包/类
/**
 * Configure the SSL connection.
 *
 * @param factory the Jetty {@link SslContextFactory}.
 * @param ssl the ssl details.
 */
protected void configureSsl(SslContextFactory factory, Ssl ssl) {
    factory.setProtocol(ssl.getProtocol());
    configureSslClientAuth(factory, ssl);
    configureSslPasswords(factory, ssl);
    factory.setCertAlias(ssl.getKeyAlias());

    if (!ObjectUtils.isEmpty(ssl.getCiphers())) {
        factory.setIncludeCipherSuites(ssl.getCiphers());
        factory.setExcludeCipherSuites();
    }

    if (ssl.getEnabledProtocols() != null) {
        factory.setIncludeProtocols(ssl.getEnabledProtocols());
    }

    if (getSslStoreProvider() != null) {
        try {
            factory.setKeyStore(getSslStoreProvider().getKeyStore());
            factory.setTrustStore(getSslStoreProvider().getTrustStore());
        } catch (Exception ex) {
            throw new IllegalStateException("Unable to set SSL store", ex);
        }
    } else {
        configureSslKeyStore(factory, ssl);
        configureSslTrustStore(factory, ssl);
    }
}
 

import org.eclipse.jetty.util.ssl.SslContextFactory; //导入方法依赖的package包/类
/**
 * Configure the SSL connection.
 * @param factory the Jetty {@link SslContextFactory}.
 * @param ssl the ssl details.
 */
protected void configureSsl(SslContextFactory factory, Ssl ssl) {
	factory.setProtocol(ssl.getProtocol());
	configureSslClientAuth(factory, ssl);
	configureSslPasswords(factory, ssl);
	factory.setCertAlias(ssl.getKeyAlias());
	if (!ObjectUtils.isEmpty(ssl.getCiphers())) {
		factory.setIncludeCipherSuites(ssl.getCiphers());
		factory.setExcludeCipherSuites();
	}
	if (ssl.getEnabledProtocols() != null) {
		factory.setIncludeProtocols(ssl.getEnabledProtocols());
	}
	if (getSslStoreProvider() != null) {
		try {
			factory.setKeyStore(getSslStoreProvider().getKeyStore());
			factory.setTrustStore(getSslStoreProvider().getTrustStore());
		}
		catch (Exception ex) {
			throw new IllegalStateException("Unable to set SSL store", ex);
		}
	}
	else {
		configureSslKeyStore(factory, ssl);
		configureSslTrustStore(factory, ssl);
	}
}
 

import org.eclipse.jetty.util.ssl.SslContextFactory; //导入方法依赖的package包/类
/**
 * Initialize HTTPS server to which trusted Auths connect
 * @param properties Auth server's properties to get paths for key stores and certificates
 * @param authKeyStorePassword Password for Auth's key store that is used for communication with trusted Auths
 * @return HTTPS server object
 * @throws CertificateException When there is a problem with certificate.
 * @throws NoSuchAlgorithmException If the specified algorithm cannot be found.
 * @throws KeyStoreException When there is a problem with accessing key store.
 * @throws IOException If there is a problem in IO.
 */
private Server initServerForTrustedAuths(AuthServerProperties properties, String authKeyStorePassword)
        throws CertificateException, NoSuchAlgorithmException, KeyStoreException, IOException
{
    TrustedAuthConnectionHandler trustedAuthConnectionHandler = new TrustedAuthConnectionHandler(this);

    Server serverForTrustedAuths = new Server();
    serverForTrustedAuths.setHandler(trustedAuthConnectionHandler);

    SslContextFactory sslContextFactory = new SslContextFactory();
    sslContextFactory.setTrustAll(false);
    sslContextFactory.setKeyStore(AuthCrypto.loadKeyStore(properties.getInternetKeyStorePath(), authKeyStorePassword));
    sslContextFactory.setKeyStorePassword(authKeyStorePassword);

    KeyStore serverTrustStore = KeyStore.getInstance(KeyStore.getDefaultType());
    serverTrustStore.load(null, authKeyStorePassword.toCharArray());
    String[] trustedCACertPaths = properties.getTrustedCACertPaths();
    for (int i = 0; i < trustedCACertPaths.length; i++) {
        serverTrustStore.setCertificateEntry("" + i, AuthCrypto.loadCertificateFromFile(trustedCACertPaths[i]));
    }
    sslContextFactory.setTrustStore(serverTrustStore);
    sslContextFactory.setNeedClientAuth(true);

    HttpConfiguration httpConfig = new HttpConfiguration();
    httpConfig.setPersistentConnectionsEnabled(true);
    httpConfig.setSecureScheme("https");
    // time out with out keep alive messages?
    //httpConfig.setBlockingTimeout();

    httpConfig.addCustomizer(new SecureRequestCustomizer());
    //new SSL
    ServerConnector connector = new ServerConnector(serverForTrustedAuths,
            new SslConnectionFactory(sslContextFactory, "http/1.1"), new HttpConnectionFactory(httpConfig));

    connector.setPort(properties.getTrustedAuthPort());

    // Idle time out for keep alive connections
    // time out with out requests?
    connector.setIdleTimeout(properties.getTrustedAuthPortIdleTimeout());

    serverForTrustedAuths.setConnectors(new org.eclipse.jetty.server.Connector[]{connector});

    return serverForTrustedAuths;
}