Package org.microproxy.tls

Class SslContexts

java.lang.Object
org.microproxy.tls.SslContexts
public final class SslContexts extends Object
Small factory methods for SSLContexts. The contexts made here remember how they validate servers (trustManagerOf(javax.net.ssl.SSLContext)), so that TLS stacks other than the JDK's, such as QUIC's to HTTP/3 servers, can validate servers the same way.

  • Method Details

    • trustManagerOf

      public static X509TrustManager trustManagerOf(SSLContext context)
      How a context made by this class validates servers: its trust manager, which trusts every server for trustAll(). Contexts made elsewhere are unknown, except the JDK's default context (SSLContext.getDefault()), whose trust is the JDK's default trust store.
      Parameters:
      context - the context
      Returns:
      its trust manager, or null if it is unknown

    • trustsAll

      public static boolean trustsAll(X509TrustManager trustManager)
      Whether trustManager trusts every server without checking, as trustAll()'s does.
      Parameters:
      trustManager - the trust manager
      Returns:
      whether it accepts any server certificate

    • systemDefault

      public static SSLContext systemDefault()
      Returns a context using the JDK's default trust store and no client certificate.
      Returns:
      a context using the JDK's default trust store and no client certificate

    • trustAll

      public static SSLContext trustAll()
      A context that trusts every server. Insecure; for tests and debugging.
      Returns:
      a context that trusts every server

    • trusting

      public static SSLContext trusting(X509Certificate... anchors)
      A context that trusts only the given certificates.
      Parameters:
      anchors - the trusted CA certificates
      Returns:
      a context that trusts only the given certificates

    • systemDefaultPlus

      public static SSLContext systemDefaultPlus(X509Certificate... extraAnchors)
      A context that trusts the JDK's default trust store and, in addition, extraAnchors (e.g. a corporate or test CA). Host names are still verified where endpoint identification is enabled.
      Parameters:
      extraAnchors - the CA certificates trusted in addition to the system defaults
      Returns:
      a context that trusts the JDK's default trust store and, in addition, extraAnchors (e.g. a corporate or test CA)

    • withKey

      public static SSLContext withKey(PrivateKey key, X509Certificate[] chain, TrustManager[] trustManagers)
      A context presenting chain (leaf first) with key, trusting trustAnchors (or the system default when none are given).
      Parameters:
      key - the private key matching the leaf certificate
      chain - the certificate chain, leaf first
      trustManagers - the peer certificate validators, or null for system defaults
      Returns:
      a TLS context using the supplied private key, chain and peer validators