private SSLContext buildSSLContext(String keystorePath, String keystoreType, String keystorePassword, String keystoreKeyPassword, String keystoreCertAlias,
                                       String truststorePath, String truststoreType, String truststorePassword,
                                       boolean validateCerts, String crlPath,
                                       String secureRandomAlgorithm,
                                       boolean validatePeerCerts, boolean enableCRLDP,
                                       boolean enableOCSP, String ocspResponderURL,
                                       String sslKeystoreProvider,
                                       String sslTruststoreProvider,
                                       String sslProvider) {
        try {
            URL keyStoreURL = loadResource(keystorePath);
            KeyStore keyStore = getKeyStore(keyStoreURL,
                    keystoreType != null ? keystoreType : "JKS",
                    keystorePassword, sslKeystoreProvider);

            // key managers
            String _keyManagerFactoryAlgorithm = Security.getProperty("ssl.KeyManagerFactory.algorithm") == null
                    ? KeyManagerFactory.getDefaultAlgorithm()
                    : Security.getProperty("ssl.KeyManagerFactory.algorithm");
            KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(_keyManagerFactoryAlgorithm);
            keyManagerFactory.init(keyStore, keystoreKeyPassword == null ? null : keystoreKeyPassword.toCharArray());
            KeyManager[] keyManagers = keyManagerFactory.getKeyManagers();

            // trust managers - possibly with OCSP
            TrustManager[] trustManagers = null;
            SecureRandom random = (secureRandomAlgorithm == null) ? null : SecureRandom.getInstance(secureRandomAlgorithm);
            if (truststorePath != null) {
                URL trustStoreURL = loadResource(truststorePath);
                KeyStore trustStore = getKeyStore(trustStoreURL,
                        truststoreType != null ? truststoreType : "JKS",
                        truststorePassword, sslTruststoreProvider);

                String _trustManagerFactoryAlgorithm = Security.getProperty("ssl.TrustManagerFactory.algorithm") == null
                        ? TrustManagerFactory.getDefaultAlgorithm()
                        : Security.getProperty("ssl.TrustManagerFactory.algorithm");

                Collection<? extends CRL> crls = crlPath == null ? null : loadCRL(crlPath);

                if (validateCerts && keyStore != null) {
                    if (keystoreCertAlias == null) {
                        List<String> aliases = Collections.list(keyStore.aliases());
                        keystoreCertAlias = aliases.size() == 1 ? aliases.get(0) : null;
                    }

                    Certificate cert = keystoreCertAlias == null ? null : keyStore.getCertificate(keystoreCertAlias);
                    if (cert == null) {
                        throw new IllegalArgumentException("No certificate found in the keystore" + (keystoreCertAlias == null ? "" : " for alias \"" + keystoreCertAlias + "\""));
                    }

                    CertificateValidator validator = new CertificateValidator(trustStore, crls);
                    validator.setEnableCRLDP(enableCRLDP);
                    validator.setEnableOCSP(enableOCSP);
                    validator.setOcspResponderURL(ocspResponderURL);
                    validator.validate(keyStore, cert);
                }

                // Revocation checking is only supported for PKIX algorithm
                // see org.eclipse.jetty.util.ssl.SslContextFactory.getTrustManagers()
                if (validatePeerCerts && _trustManagerFactoryAlgorithm.equalsIgnoreCase("PKIX")) {
                    PKIXBuilderParameters pbParams = new PKIXBuilderParameters(trustStore, new X509CertSelector());

                    // Make sure revocation checking is enabled
                    pbParams.setRevocationEnabled(true);

                    if (crls != null && !crls.isEmpty()) {
                        pbParams.addCertStore(CertStore.getInstance("Collection", new CollectionCertStoreParameters(crls)));
                    }

                    if (enableCRLDP) {
                        // Enable Certificate Revocation List Distribution Points (CRLDP) support
                        System.setProperty("com.sun.security.enableCRLDP", "true");
                    }

                    if (enableOCSP) {
                        // Enable On-Line Certificate Status Protocol (OCSP) support
                        Security.setProperty("ocsp.enable", "true");

                        if (ocspResponderURL != null) {
                            // Override location of OCSP Responder
                            Security.setProperty("ocsp.responderURL", ocspResponderURL);
                        }
                    }

                    TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(_trustManagerFactoryAlgorithm);
                    trustManagerFactory.init(new CertPathTrustManagerParameters(pbParams));

                    trustManagers = trustManagerFactory.getTrustManagers();
                } else {
                    TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(_trustManagerFactoryAlgorithm);
                    trustManagerFactory.init(trustStore);

                    trustManagers = trustManagerFactory.getTrustManagers();
                }
            }

            SSLContext context;
            if (null == sslProvider || sslProvider.isEmpty()) {
                context = SSLContext.getInstance("TLS");
            } else {
                context = SSLContext.getInstance("TLS", sslProvider);
            }

            context.init(keyManagers, trustManagers, random);

            return context;
        } catch (Exception e) {
            throw new IllegalArgumentException("Unable to build SSL context", e);
        }
    }
private SSLContext buildSSLContext ( String keystorePath , String keystoreType , String keystorePassword , String keystoreKeyPassword , String keystoreCertAlias , String truststorePath , String truststoreType , String truststorePassword , boolean validateCerts , String crlPath , String secureRandomAlgorithm , boolean validatePeerCerts , boolean enableCRLDP , boolean enableOCSP , String ocspResponderURL , String sslKeystoreProvider , String sslTruststoreProvider , String sslProvider ) { try { URL keyStoreURL = loadResource ( keystorePath ) ; KeyStore keyStore = getKeyStore ( keyStoreURL , keystoreType != null ? keystoreType : "JKS" , keystorePassword , sslKeystoreProvider ) ; String _keyManagerFactoryAlgorithm = Security . getProperty ( "ssl.KeyManagerFactory.algorithm" ) == null ? KeyManagerFactory . getDefaultAlgorithm ( ) : Security . getProperty ( "ssl.KeyManagerFactory.algorithm" ) ; KeyManagerFactory keyManagerFactory = KeyManagerFactory . getInstance ( _keyManagerFactoryAlgorithm ) ; keyManagerFactory . init ( keyStore , keystoreKeyPassword == null ? null : keystoreKeyPassword . toCharArray ( ) ) ; KeyManager [ ] keyManagers = keyManagerFactory . getKeyManagers ( ) ; TrustManager [ ] trustManagers = null ; SecureRandom random = ( secureRandomAlgorithm == null ) ? null : SecureRandom . getInstance ( secureRandomAlgorithm ) ; if ( truststorePath != null ) { URL trustStoreURL = loadResource ( truststorePath ) ; KeyStore trustStore = getKeyStore ( trustStoreURL , truststoreType != null ? truststoreType : "JKS" , truststorePassword , sslTruststoreProvider ) ; String _trustManagerFactoryAlgorithm = Security . getProperty ( "ssl.TrustManagerFactory.algorithm" ) == null ? TrustManagerFactory . getDefaultAlgorithm ( ) : Security . getProperty ( "ssl.TrustManagerFactory.algorithm" ) ; Collection < ? extends CRL > crls = crlPath == null ? null : loadCRL ( crlPath ) ; if ( validateCerts && keyStore != null ) { if ( keystoreCertAlias == null ) { List < String > aliases = Collections . list ( keyStore . aliases ( ) ) ; keystoreCertAlias = aliases . size ( ) == 1 ? aliases . get ( 0 ) : null ; } Certificate cert = keystoreCertAlias == null ? null : keyStore . getCertificate ( keystoreCertAlias ) ; if ( cert == null ) { throw new IllegalArgumentException ( "No certificate found in the keystore" + ( keystoreCertAlias == null ? "" : " for alias \"" + keystoreCertAlias + "\"" ) ) ; } CertificateValidator validator = new CertificateValidator ( trustStore , crls ) ; validator . setEnableCRLDP ( enableCRLDP ) ; validator . setEnableOCSP ( enableOCSP ) ; validator . setOcspResponderURL ( ocspResponderURL ) ; validator . validate ( keyStore , cert ) ; } if ( validatePeerCerts && _trustManagerFactoryAlgorithm . equalsIgnoreCase ( "PKIX" ) ) { PKIXBuilderParameters pbParams = new PKIXBuilderParameters ( trustStore , new X509CertSelector ( ) ) ; pbParams . setRevocationEnabled ( true ) ; if ( crls != null && ! crls . isEmpty ( ) ) { pbParams . addCertStore ( CertStore . getInstance ( "Collection" , new CollectionCertStoreParameters ( crls ) ) ) ; } if ( enableCRLDP ) { System . setProperty ( "com.sun.security.enableCRLDP" , "true" ) ; } if ( enableOCSP ) { Security . setProperty ( "ocsp.enable" , "true" ) ; if ( ocspResponderURL != null ) { Security . setProperty ( "ocsp.responderURL" , ocspResponderURL ) ; } } TrustManagerFactory trustManagerFactory = TrustManagerFactory . getInstance ( _trustManagerFactoryAlgorithm ) ; trustManagerFactory . init ( new CertPathTrustManagerParameters ( pbParams ) ) ; trustManagers = trustManagerFactory . getTrustManagers ( ) ; } else { TrustManagerFactory trustManagerFactory = TrustManagerFactory . getInstance ( _trustManagerFactoryAlgorithm ) ; trustManagerFactory . init ( trustStore ) ; trustManagers = trustManagerFactory . getTrustManagers ( ) ; } } SSLContext context ; if ( null == sslProvider || sslProvider . isEmpty ( ) ) { context = SSLContext . getInstance ( "TLS" ) ; } else { context = SSLContext . getInstance ( "TLS" , sslProvider ) ; } context . init ( keyManagers , trustManagers , random ) ; return context ; } catch ( Exception e ) { throw new IllegalArgumentException ( "Unable to build SSL context" , e ) ; } }
Build {@link SSLContext} using arguments only
@param keystorePath
@param keystoreType
@param keystorePassword
@param keystoreCertAlias
@param truststorePath
@param truststoreType
@param truststorePassword
@param validateCerts
@param crlPath
@param secureRandomAlgorithm
@param validatePeerCerts
@param enableCRLDP
@param enableOCSP
@param ocspResponderURL
@return