Examples with KeyManager javax.net.ssl.KeyManager used on opensource projects

Example 61 with KeyManager

use of javax.net.ssl.KeyManager in project presto by prestodb.

the class OkHttpUtil method setupSsl.

public static void setupSsl(OkHttpClient.Builder clientBuilder, Optional<String> keyStorePath, Optional<String> keyStorePassword, Optional<String> trustStorePath, Optional<String> trustStorePassword) {
    if (!keyStorePath.isPresent() && !trustStorePath.isPresent()) {
        return;
    }
    try {
        // load KeyStore if configured and get KeyManagers
        KeyStore keyStore = null;
        KeyManager[] keyManagers = null;
        if (keyStorePath.isPresent()) {
            char[] keyManagerPassword;
            try {
                // attempt to read the key store as a PEM file
                keyStore = PemReader.loadKeyStore(new File(keyStorePath.get()), new File(keyStorePath.get()), keyStorePassword);
                // for PEM encoded keys, the password is used to decrypt the specific key (and does not protect the keystore itself)
                keyManagerPassword = new char[0];
            } catch (IOException | GeneralSecurityException ignored) {
                keyManagerPassword = keyStorePassword.map(String::toCharArray).orElse(null);
                keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
                try (InputStream in = new FileInputStream(keyStorePath.get())) {
                    keyStore.load(in, keyManagerPassword);
                }
            }
            validateCertificates(keyStore);
            KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
            keyManagerFactory.init(keyStore, keyManagerPassword);
            keyManagers = keyManagerFactory.getKeyManagers();
        }
        // load TrustStore if configured, otherwise use KeyStore
        KeyStore trustStore = keyStore;
        if (trustStorePath.isPresent()) {
            trustStore = loadTrustStore(new File(trustStorePath.get()), trustStorePassword);
        }
        // create TrustManagerFactory
        TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        trustManagerFactory.init(trustStore);
        // get X509TrustManager
        TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();
        if ((trustManagers.length != 1) || !(trustManagers[0] instanceof X509TrustManager)) {
            throw new RuntimeException("Unexpected default trust managers:" + Arrays.toString(trustManagers));
        }
        X509TrustManager trustManager = (X509TrustManager) trustManagers[0];
        // create SSLContext
        SSLContext sslContext = SSLContext.getInstance("TLS");
        sslContext.init(keyManagers, new TrustManager[] { trustManager }, null);
        clientBuilder.sslSocketFactory(sslContext.getSocketFactory(), trustManager);
    } catch (GeneralSecurityException | IOException e) {
        throw new ClientException("Error setting up SSL: " + e.getMessage(), e);
    }
}

Example 62 with KeyManager

use of javax.net.ssl.KeyManager in project presto by prestodb.

the class SslContextProvider method buildSslContext.

public Optional<SSLContext> buildSslContext() {
    if (!keystorePath.isPresent() && !truststorePath.isPresent()) {
        return Optional.empty();
    }
    try {
        // load KeyStore if configured and get KeyManagers
        KeyStore keystore = null;
        KeyManager[] keyManagers = null;
        if (keystorePath.isPresent()) {
            char[] keyManagerPassword;
            try {
                // attempt to read the key store as a PEM file
                keystore = loadKeyStore(keystorePath.get(), keystorePath.get(), keystorePassword);
                // for PEM encoded keys, the password is used to decrypt the specific key (and does not
                // protect the keystore itself)
                keyManagerPassword = new char[0];
            } catch (IOException | GeneralSecurityException ignored) {
                keyManagerPassword = keystorePassword.map(String::toCharArray).orElse(null);
                keystore = KeyStore.getInstance(KeyStore.getDefaultType());
                try (InputStream in = new FileInputStream(keystorePath.get())) {
                    keystore.load(in, keyManagerPassword);
                }
            }
            validateCertificates(keystore);
            KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
            keyManagerFactory.init(keystore, keyManagerPassword);
            keyManagers = keyManagerFactory.getKeyManagers();
        }
        // load TrustStore if configured, otherwise use KeyStore
        KeyStore truststore = keystore;
        if (truststorePath.isPresent()) {
            truststore = loadTrustStore(truststorePath.get(), truststorePassword);
        }
        // create TrustManagerFactory
        TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        trustManagerFactory.init(truststore);
        // get X509TrustManager
        TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();
        if ((trustManagers.length != 1) || !(trustManagers[0] instanceof X509TrustManager)) {
            throw new RuntimeException("Unexpected default trust managers:" + Arrays.toString(trustManagers));
        }
        X509TrustManager trustManager = (X509TrustManager) trustManagers[0];
        // create SSLContext
        SSLContext result = SSLContext.getInstance("SSL");
        result.init(keyManagers, new TrustManager[] { trustManager }, null);
        return Optional.of(result);
    } catch (GeneralSecurityException | IOException e) {
        throw new PrestoException(CASSANDRA_SSL_INITIALIZATION_FAILURE, e);
    }
}

Example 63 with KeyManager

use of javax.net.ssl.KeyManager in project ninja by ninjaframework.

the class StandaloneHelper method createSSLContext.

public static SSLContext createSSLContext(URI keystoreUri, char[] keystorePassword, URI truststoreUri, char[] truststorePassword) throws Exception {
    // load keystore
    KeyStore keystore = loadKeyStore(keystoreUri, keystorePassword);
    KeyManager[] keyManagers;
    KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
    keyManagerFactory.init(keystore, keystorePassword);
    keyManagers = keyManagerFactory.getKeyManagers();
    // load truststore
    KeyStore truststore = loadKeyStore(truststoreUri, truststorePassword);
    TrustManager[] trustManagers;
    TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
    trustManagerFactory.init(truststore);
    trustManagers = trustManagerFactory.getTrustManagers();
    SSLContext sslContext;
    sslContext = SSLContext.getInstance("TLS");
    sslContext.init(keyManagers, trustManagers, null);
    return sslContext;
}

Example 64 with KeyManager

use of javax.net.ssl.KeyManager in project pinpoint by naver.

the class CertService method newSSLContext.

private SSLContext newSSLContext(KeyManagerFactory kmf, TrustManagerFactory tmf) throws NoSuchAlgorithmException, KeyManagementException {
    SSLContext sslContext = SSLContext.getInstance("SSL");
    KeyManager[] keyManagers = kmf.getKeyManagers();
    TrustManager[] trustManagers = tmf.getTrustManagers();
    sslContext.init(keyManagers, trustManagers, new SecureRandom());
    return sslContext;
}

Example 65 with KeyManager

use of javax.net.ssl.KeyManager in project druid by druid-io.

the class TLSUtils method createSSLContext.

public static SSLContext createSSLContext(@Nullable String protocol, @Nullable String trustStoreType, String trustStorePath, @Nullable String trustStoreAlgorithm, @Nullable PasswordProvider trustStorePasswordProvider, @Nullable String keyStoreType, @Nullable String keyStorePath, @Nullable String keyStoreAlgorithm, @Nullable String certAlias, @Nullable PasswordProvider keyStorePasswordProvider, @Nullable PasswordProvider keyManagerFactoryPasswordProvider, @Nullable Boolean validateHostnames, TLSCertificateChecker tlsCertificateChecker) {
    SSLContext sslContext;
    try {
        sslContext = SSLContext.getInstance(protocol == null ? "TLSv1.2" : protocol);
        KeyStore trustStore = KeyStore.getInstance(trustStoreType == null ? KeyStore.getDefaultType() : trustStoreType);
        try (final InputStream trustStoreFileStream = Files.newInputStream(Paths.get(trustStorePath))) {
            trustStore.load(trustStoreFileStream, trustStorePasswordProvider == null ? null : trustStorePasswordProvider.getPassword().toCharArray());
        }
        TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(trustStoreAlgorithm == null ? TrustManagerFactory.getDefaultAlgorithm() : trustStoreAlgorithm);
        trustManagerFactory.init(trustStore);
        KeyManager[] keyManagers;
        if (keyStorePath != null) {
            KeyStore keyStore = KeyStore.getInstance(keyStoreType == null ? KeyStore.getDefaultType() : keyStoreType);
            try (final InputStream keyStoreFileStream = Files.newInputStream(Paths.get(keyStorePath))) {
                keyStore.load(keyStoreFileStream, keyStorePasswordProvider == null ? null : keyStorePasswordProvider.getPassword().toCharArray());
                KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(keyStoreAlgorithm == null ? KeyManagerFactory.getDefaultAlgorithm() : keyStoreAlgorithm);
                keyManagerFactory.init(keyStore, keyManagerFactoryPasswordProvider == null ? null : keyManagerFactoryPasswordProvider.getPassword().toCharArray());
                keyManagers = createAliasedKeyManagers(keyManagerFactory.getKeyManagers(), certAlias);
            }
        } else {
            keyManagers = null;
        }
        TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();
        TrustManager[] newTrustManagers = new TrustManager[trustManagers.length];
        for (int i = 0; i < trustManagers.length; i++) {
            if (trustManagers[i] instanceof X509ExtendedTrustManager) {
                newTrustManagers[i] = new CustomCheckX509TrustManager((X509ExtendedTrustManager) trustManagers[i], tlsCertificateChecker, validateHostnames == null ? true : validateHostnames);
            } else {
                newTrustManagers[i] = trustManagers[i];
                log.info("Encountered non-X509ExtendedTrustManager: " + trustManagers[i].getClass());
            }
        }
        sslContext.init(keyManagers, newTrustManagers, null);
    } catch (CertificateException | KeyManagementException | IOException | KeyStoreException | NoSuchAlgorithmException | UnrecoverableKeyException e) {
        throw new RuntimeException(e);
    }
    return sslContext;
}