Examples with TrustManagerFactory javax.net.ssl.TrustManagerFactory used on opensource projects

Example 76 with TrustManagerFactory

use of javax.net.ssl.TrustManagerFactory in project qpid-broker-j by apache.

the class SiteSpecificTrustStoreImpl method generateTrustManagers.

private void generateTrustManagers() {
    try {
        java.security.KeyStore inMemoryKeyStore = java.security.KeyStore.getInstance(java.security.KeyStore.getDefaultType());
        inMemoryKeyStore.load(null, null);
        inMemoryKeyStore.setCertificateEntry("1", _x509Certificate);
        TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        tmf.init(inMemoryKeyStore);
        _trustManagers = tmf.getTrustManagers();
    } catch (IOException | GeneralSecurityException e) {
        throw new IllegalConfigurationException("Cannot load certificate(s) :" + e, e);
    }
}

Example 77 with TrustManagerFactory

use of javax.net.ssl.TrustManagerFactory in project qpid-broker-j by apache.

the class TrustManagerTest method testQpidMultipleTrustManagerWithRegularTrustStore.

/**
 * Tests that the QpidMultipleTrustManager gives the expected behaviour when wrapping a
 * regular TrustManager against the broker truststore.
 */
public void testQpidMultipleTrustManagerWithRegularTrustStore() throws Exception {
    final QpidMultipleTrustManager mulTrustManager = new QpidMultipleTrustManager();
    final KeyStore ts = SSLUtil.getInitializedKeyStore(TestSSLConstants.BROKER_TRUSTSTORE, TestSSLConstants.BROKER_TRUSTSTORE_PASSWORD, STORE_TYPE);
    final TrustManagerFactory tmf = TrustManagerFactory.getInstance(DEFAULT_TRUST_MANAGER_ALGORITHM);
    tmf.init(ts);
    final TrustManager[] delegateTrustManagers = tmf.getTrustManagers();
    boolean trustManagerAdded = false;
    for (final TrustManager tm : delegateTrustManagers) {
        if (tm instanceof X509TrustManager) {
            // add broker's trust manager
            mulTrustManager.addTrustManager((X509TrustManager) tm);
            trustManagerAdded = true;
        }
    }
    assertTrue("The regular trust manager for the trust store was not added", trustManagerAdded);
    try {
        // verify the CA-trusted app1 cert (should succeed)
        mulTrustManager.checkClientTrusted(this.getClientChain(TestSSLConstants.KEYSTORE, TestSSLConstants.CERT_ALIAS_APP1), "RSA");
    } catch (CertificateException ex) {
        fail("Trusted client's validation against the broker's multi store manager failed.");
    }
    try {
        // verify the CA-trusted app2 cert (should succeed)
        mulTrustManager.checkClientTrusted(this.getClientChain(TestSSLConstants.KEYSTORE, TestSSLConstants.CERT_ALIAS_APP2), "RSA");
    } catch (CertificateException ex) {
        fail("Trusted client's validation against the broker's multi store manager failed.");
    }
    try {
        // verify the untrusted cert (should fail)
        mulTrustManager.checkClientTrusted(this.getClientChain(TestSSLConstants.UNTRUSTED_KEYSTORE, TestSSLConstants.CERT_ALIAS_UNTRUSTED_CLIENT), "RSA");
        fail("Untrusted client's validation against the broker's multi store manager unexpectedly passed.");
    } catch (CertificateException ex) {
    // expected
    }
}

Example 78 with TrustManagerFactory

use of javax.net.ssl.TrustManagerFactory in project qpid-broker-j by apache.

the class TrustManagerTest method testQpidMultipleTrustManagerWithPeerStore.

/**
 * Tests that the QpidMultipleTrustManager gives the expected behaviour when wrapping a
 * QpidPeersOnlyTrustManager against the broker peerstore.
 */
public void testQpidMultipleTrustManagerWithPeerStore() throws Exception {
    final QpidMultipleTrustManager mulTrustManager = new QpidMultipleTrustManager();
    final KeyStore ps = SSLUtil.getInitializedKeyStore(TestSSLConstants.BROKER_PEERSTORE, TestSSLConstants.BROKER_PEERSTORE_PASSWORD, STORE_TYPE);
    final TrustManagerFactory pmf = TrustManagerFactory.getInstance(DEFAULT_TRUST_MANAGER_ALGORITHM);
    pmf.init(ps);
    final TrustManager[] delegatePeerManagers = pmf.getTrustManagers();
    boolean peerManagerAdded = false;
    for (final TrustManager tm : delegatePeerManagers) {
        if (tm instanceof X509TrustManager) {
            // add broker's peer manager
            mulTrustManager.addTrustManager(new QpidPeersOnlyTrustManager(ps, (X509TrustManager) tm));
            peerManagerAdded = true;
        }
    }
    assertTrue("The QpidPeersOnlyTrustManager for the peerstore was not added", peerManagerAdded);
    try {
        // verify the trusted app1 cert (should succeed as the key is in the peerstore)
        mulTrustManager.checkClientTrusted(this.getClientChain(TestSSLConstants.KEYSTORE, TestSSLConstants.CERT_ALIAS_APP1), "RSA");
    } catch (CertificateException ex) {
        fail("Trusted client's validation against the broker's multi store manager failed.");
    }
    try {
        // verify the untrusted app2 cert (should fail as the key is not in the peerstore)
        mulTrustManager.checkClientTrusted(this.getClientChain(TestSSLConstants.KEYSTORE, TestSSLConstants.CERT_ALIAS_APP2), "RSA");
        fail("Untrusted client's validation against the broker's multi store manager unexpectedly passed.");
    } catch (CertificateException ex) {
    // expected
    }
    try {
        // verify the untrusted cert (should fail as the key is not in the peerstore)
        mulTrustManager.checkClientTrusted(this.getClientChain(TestSSLConstants.UNTRUSTED_KEYSTORE, TestSSLConstants.CERT_ALIAS_UNTRUSTED_CLIENT), "RSA");
        fail("Untrusted client's validation against the broker's multi store manager unexpectedly passed.");
    } catch (CertificateException ex) {
    // expected
    }
}

Example 79 with TrustManagerFactory

use of javax.net.ssl.TrustManagerFactory in project nifi by apache.

the class SslContextFactory method createSslContext.

public static SSLContext createSslContext(final NiFiProperties props, final boolean strict) throws SslContextCreationException {
    final boolean hasKeystoreProperties = hasKeystoreProperties(props);
    if (hasKeystoreProperties == false) {
        if (strict) {
            throw new SslContextCreationException("SSL context cannot be created because keystore properties have not been configured.");
        } else {
            return null;
        }
    } else if (props.getNeedClientAuth() && hasTruststoreProperties(props) == false) {
        throw new SslContextCreationException("Need client auth is set to 'true', but no truststore properties are configured.");
    }
    try {
        // prepare the trust store
        final KeyStore trustStore;
        if (hasTruststoreProperties(props)) {
            trustStore = KeyStoreUtils.getTrustStore(props.getProperty(NiFiProperties.SECURITY_TRUSTSTORE_TYPE));
            try (final InputStream trustStoreStream = new FileInputStream(props.getProperty(NiFiProperties.SECURITY_TRUSTSTORE))) {
                trustStore.load(trustStoreStream, props.getProperty(NiFiProperties.SECURITY_TRUSTSTORE_PASSWD).toCharArray());
            }
        } else {
            trustStore = null;
        }
        final TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        trustManagerFactory.init(trustStore);
        // prepare the key store
        final KeyStore keyStore = KeyStoreUtils.getKeyStore(props.getProperty(NiFiProperties.SECURITY_KEYSTORE_TYPE));
        try (final InputStream keyStoreStream = new FileInputStream(props.getProperty(NiFiProperties.SECURITY_KEYSTORE))) {
            keyStore.load(keyStoreStream, props.getProperty(NiFiProperties.SECURITY_KEYSTORE_PASSWD).toCharArray());
        }
        KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
        // if the key password is provided, try to use that - otherwise default to the keystore password
        if (StringUtils.isNotBlank(props.getProperty(NiFiProperties.SECURITY_KEY_PASSWD))) {
            keyManagerFactory.init(keyStore, props.getProperty(NiFiProperties.SECURITY_KEY_PASSWD).toCharArray());
        } else {
            keyManagerFactory.init(keyStore, props.getProperty(NiFiProperties.SECURITY_KEYSTORE_PASSWD).toCharArray());
        }
        // initialize the ssl context
        final SSLContext sslContext = SSLContext.getInstance("TLS");
        sslContext.init(keyManagerFactory.getKeyManagers(), trustManagerFactory.getTrustManagers(), null);
        sslContext.getDefaultSSLParameters().setNeedClientAuth(props.getNeedClientAuth());
        return sslContext;
    } catch (final KeyStoreException | IOException | NoSuchAlgorithmException | CertificateException | UnrecoverableKeyException | KeyManagementException e) {
        throw new SslContextCreationException(e);
    }
}

Example 80 with TrustManagerFactory

use of javax.net.ssl.TrustManagerFactory in project pentaho-kettle by pentaho.

the class Rest method setConfig.

private void setConfig() throws KettleException {
    if (data.config == null) {
        // Use ApacheHttpClient for supporting proxy authentication.
        data.config = new DefaultApacheHttpClient4Config();
        if (!Utils.isEmpty(data.realProxyHost)) {
            // PROXY CONFIGURATION
            data.config.getProperties().put(ApacheHttpClient4Config.PROPERTY_PROXY_URI, "http://" + data.realProxyHost + ":" + data.realProxyPort);
            if (!Utils.isEmpty(data.realHttpLogin) && !Utils.isEmpty(data.realHttpPassword)) {
                AuthScope authScope = new AuthScope(data.realProxyHost, data.realProxyPort);
                UsernamePasswordCredentials credentials = new UsernamePasswordCredentials(data.realHttpLogin, data.realHttpPassword);
                CredentialsProvider credentialsProvider = new BasicCredentialsProvider();
                credentialsProvider.setCredentials(authScope, credentials);
                data.config.getProperties().put(ApacheHttpClient4Config.PROPERTY_CREDENTIALS_PROVIDER, credentialsProvider);
            }
        } else {
            if (!Utils.isEmpty(data.realHttpLogin)) {
                // Basic authentication
                data.basicAuthentication = new HTTPBasicAuthFilter(data.realHttpLogin, data.realHttpPassword);
            }
        }
        if (meta.isPreemptive()) {
            data.config.getProperties().put(ApacheHttpClient4Config.PROPERTY_PREEMPTIVE_BASIC_AUTHENTICATION, true);
        }
        // SSL TRUST STORE CONFIGURATION
        if (!Utils.isEmpty(data.trustStoreFile)) {
            try (FileInputStream trustFileStream = new FileInputStream(data.trustStoreFile)) {
                KeyStore trustStore = KeyStore.getInstance("JKS");
                trustStore.load(trustFileStream, data.trustStorePassword.toCharArray());
                TrustManagerFactory tmf = TrustManagerFactory.getInstance("SunX509");
                tmf.init(trustStore);
                SSLContext ctx = SSLContext.getInstance("SSL");
                ctx.init(null, tmf.getTrustManagers(), null);
                HostnameVerifier hv = new HostnameVerifier() {

                    public boolean verify(String hostname, SSLSession session) {
                        if (isDebug()) {
                            logDebug("Warning: URL Host: " + hostname + " vs. " + session.getPeerHost());
                        }
                        return true;
                    }
                };
                data.config.getProperties().put(HTTPSProperties.PROPERTY_HTTPS_PROPERTIES, new HTTPSProperties(hv, ctx));
            } catch (NoSuchAlgorithmException e) {
                throw new KettleException(BaseMessages.getString(PKG, "Rest.Error.NoSuchAlgorithm"), e);
            } catch (KeyStoreException e) {
                throw new KettleException(BaseMessages.getString(PKG, "Rest.Error.KeyStoreException"), e);
            } catch (CertificateException e) {
                throw new KettleException(BaseMessages.getString(PKG, "Rest.Error.CertificateException"), e);
            } catch (FileNotFoundException e) {
                throw new KettleException(BaseMessages.getString(PKG, "Rest.Error.FileNotFound", data.trustStoreFile), e);
            } catch (IOException e) {
                throw new KettleException(BaseMessages.getString(PKG, "Rest.Error.IOException"), e);
            } catch (KeyManagementException e) {
                throw new KettleException(BaseMessages.getString(PKG, "Rest.Error.KeyManagementException"), e);
            }
        }
    }
}