boolean trySetCipherSuite(CipherSuite suite) {
        /*
         * If we're resuming a session we know we can
         * support this key exchange algorithm and in fact
         * have already cached the result of it in
         * the session state.
         */
        if (resumingSession) {
            return true;
        }

        if (suite.isNegotiable() == false) {
            return false;
        }

        // must not negotiate the obsoleted weak cipher suites.
        if (protocolVersion.v >= suite.obsoleted) {
            return false;
        }

        // must not negotiate unsupported cipher suites.
        if (protocolVersion.v < suite.supported) {
            return false;
        }

        KeyExchange keyExchange = suite.keyExchange;

        // null out any existing references
        privateKey = null;
        certs = null;
        dh = null;
        tempPrivateKey = null;
        tempPublicKey = null;

        Collection<SignatureAndHashAlgorithm> supportedSignAlgs = null;
        if (protocolVersion.v >= ProtocolVersion.TLS12.v) {
            if (peerSupportedSignAlgs != null) {
                supportedSignAlgs = peerSupportedSignAlgs;
            } else {
                SignatureAndHashAlgorithm algorithm = null;

                // we may optimize the performance
                switch (keyExchange) {
                    // If the negotiated key exchange algorithm is one of
                    // (RSA, DHE_RSA, DH_RSA, RSA_PSK, ECDH_RSA, ECDHE_RSA),
                    // behave as if client had sent the value {sha1,rsa}.
                    case K_RSA:
                    case K_DHE_RSA:
                    case K_DH_RSA:
                    // case K_RSA_PSK:
                    case K_ECDH_RSA:
                    case K_ECDHE_RSA:
                        algorithm = SignatureAndHashAlgorithm.valueOf(
                                HashAlgorithm.SHA1.value,
                                SignatureAlgorithm.RSA.value, 0);
                        break;
                    // If the negotiated key exchange algorithm is one of
                    // (DHE_DSS, DH_DSS), behave as if the client had
                    // sent the value {sha1,dsa}.
                    case K_DHE_DSS:
                    case K_DH_DSS:
                        algorithm = SignatureAndHashAlgorithm.valueOf(
                                HashAlgorithm.SHA1.value,
                                SignatureAlgorithm.DSA.value, 0);
                        break;
                    // If the negotiated key exchange algorithm is one of
                    // (ECDH_ECDSA, ECDHE_ECDSA), behave as if the client
                    // had sent value {sha1,ecdsa}.
                    case K_ECDH_ECDSA:
                    case K_ECDHE_ECDSA:
                        algorithm = SignatureAndHashAlgorithm.valueOf(
                                HashAlgorithm.SHA1.value,
                                SignatureAlgorithm.ECDSA.value, 0);
                        break;
                    default:
                        // no peer supported signature algorithms
                }

                if (algorithm == null) {
                    supportedSignAlgs =
                        Collections.<SignatureAndHashAlgorithm>emptySet();
                } else {
                    supportedSignAlgs =
                        new ArrayList<SignatureAndHashAlgorithm>(1);
                    supportedSignAlgs.add(algorithm);
                }

                // Sets the peer supported signature algorithm to use in KM
                // temporarily.
                session.setPeerSupportedSignatureAlgorithms(supportedSignAlgs);
            }
        }

        switch (keyExchange) {
        case K_RSA:
            // need RSA certs for authentication
            if (setupPrivateKeyAndChain("RSA") == false) {
                return false;
            }
            break;
        case K_RSA_EXPORT:
            // need RSA certs for authentication
            if (setupPrivateKeyAndChain("RSA") == false) {
                return false;
            }

            try {
               if (JsseJce.getRSAKeyLength(certs[0].getPublicKey()) > 512) {
                    if (!setupEphemeralRSAKeys(suite.exportable)) {
                        return false;
                    }
               }
            } catch (RuntimeException e) {
                // could not determine keylength, ignore key
                return false;
            }
            break;
        case K_DHE_RSA:
            // need RSA certs for authentication
            if (setupPrivateKeyAndChain("RSA") == false) {
                return false;
            }

            // get preferable peer signature algorithm for server key exchange
            if (protocolVersion.v >= ProtocolVersion.TLS12.v) {
                preferableSignatureAlgorithm =
                    SignatureAndHashAlgorithm.getPreferableAlgorithm(
                                        supportedSignAlgs, "RSA", privateKey);
                if (preferableSignatureAlgorithm == null) {
                    return false;
                }
            }

            setupEphemeralDHKeys(suite.exportable);
            break;
        case K_ECDHE_RSA:
            // need RSA certs for authentication
            if (setupPrivateKeyAndChain("RSA") == false) {
                return false;
            }

            // get preferable peer signature algorithm for server key exchange
            if (protocolVersion.v >= ProtocolVersion.TLS12.v) {
                preferableSignatureAlgorithm =
                    SignatureAndHashAlgorithm.getPreferableAlgorithm(
                                        supportedSignAlgs, "RSA", privateKey);
                if (preferableSignatureAlgorithm == null) {
                    return false;
                }
            }

            if (setupEphemeralECDHKeys() == false) {
                return false;
            }
            break;
        case K_DHE_DSS:
            // get preferable peer signature algorithm for server key exchange
            if (protocolVersion.v >= ProtocolVersion.TLS12.v) {
                preferableSignatureAlgorithm =
                    SignatureAndHashAlgorithm.getPreferableAlgorithm(
                                                supportedSignAlgs, "DSA");
                if (preferableSignatureAlgorithm == null) {
                    return false;
                }
            }

            // need DSS certs for authentication
            if (setupPrivateKeyAndChain("DSA") == false) {
                return false;
            }
            setupEphemeralDHKeys(suite.exportable);
            break;
        case K_ECDHE_ECDSA:
            // get preferable peer signature algorithm for server key exchange
            if (protocolVersion.v >= ProtocolVersion.TLS12.v) {
                preferableSignatureAlgorithm =
                    SignatureAndHashAlgorithm.getPreferableAlgorithm(
                                            supportedSignAlgs, "ECDSA");
                if (preferableSignatureAlgorithm == null) {
                    return false;
                }
            }

            // need EC cert signed using EC
            if (setupPrivateKeyAndChain("EC_EC") == false) {
                return false;
            }
            if (setupEphemeralECDHKeys() == false) {
                return false;
            }
            break;
        case K_ECDH_RSA:
            // need EC cert signed using RSA
            if (setupPrivateKeyAndChain("EC_RSA") == false) {
                return false;
            }
            setupStaticECDHKeys();
            break;
        case K_ECDH_ECDSA:
            // need EC cert signed using EC
            if (setupPrivateKeyAndChain("EC_EC") == false) {
                return false;
            }
            setupStaticECDHKeys();
            break;
        case K_KRB5:
        case K_KRB5_EXPORT:
            // need Kerberos Key
            if (!setupKerberosKeys()) {
                return false;
            }
            break;
        case K_DH_ANON:
            // no certs needed for anonymous
            setupEphemeralDHKeys(suite.exportable);
            break;
        case K_ECDH_ANON:
            // no certs needed for anonymous
            if (setupEphemeralECDHKeys() == false) {
                return false;
            }
            break;
        default:
            // internal error, unknown key exchange
            throw new RuntimeException("Unrecognized cipherSuite: " + suite);
        }
        setCipherSuite(suite);

        // set the peer implicit supported signature algorithms
        if (protocolVersion.v >= ProtocolVersion.TLS12.v) {
            if (peerSupportedSignAlgs == null) {
                setPeerSupportedSignAlgs(supportedSignAlgs);
                // we had alreay update the session
            }
        }
        return true;
    }
boolean trySetCipherSuite ( CipherSuite suite ) { if ( resumingSession ) { return true ; } if ( suite . isNegotiable ( ) == false ) { return false ; } if ( protocolVersion . v >= suite . obsoleted ) { return false ; } if ( protocolVersion . v < suite . supported ) { return false ; } KeyExchange keyExchange = suite . keyExchange ; privateKey = null ; certs = null ; dh = null ; tempPrivateKey = null ; tempPublicKey = null ; Collection < SignatureAndHashAlgorithm > supportedSignAlgs = null ; if ( protocolVersion . v >= ProtocolVersion . TLS12 . v ) { if ( peerSupportedSignAlgs != null ) { supportedSignAlgs = peerSupportedSignAlgs ; } else { SignatureAndHashAlgorithm algorithm = null ; switch ( keyExchange ) { case K_RSA : case K_DHE_RSA : case K_DH_RSA : case K_ECDH_RSA : case K_ECDHE_RSA : algorithm = SignatureAndHashAlgorithm . valueOf ( HashAlgorithm . SHA1 . value , SignatureAlgorithm . RSA . value , 0 ) ; break ; case K_DHE_DSS : case K_DH_DSS : algorithm = SignatureAndHashAlgorithm . valueOf ( HashAlgorithm . SHA1 . value , SignatureAlgorithm . DSA . value , 0 ) ; break ; case K_ECDH_ECDSA : case K_ECDHE_ECDSA : algorithm = SignatureAndHashAlgorithm . valueOf ( HashAlgorithm . SHA1 . value , SignatureAlgorithm . ECDSA . value , 0 ) ; break ; default : } if ( algorithm == null ) { supportedSignAlgs = Collections . < SignatureAndHashAlgorithm > emptySet ( ) ; } else { supportedSignAlgs = new ArrayList < SignatureAndHashAlgorithm > ( 1 ) ; supportedSignAlgs . add ( algorithm ) ; } session . setPeerSupportedSignatureAlgorithms ( supportedSignAlgs ) ; } } switch ( keyExchange ) { case K_RSA : if ( setupPrivateKeyAndChain ( "RSA" ) == false ) { return false ; } break ; case K_RSA_EXPORT : if ( setupPrivateKeyAndChain ( "RSA" ) == false ) { return false ; } try { if ( JsseJce . getRSAKeyLength ( certs [ 0 ] . getPublicKey ( ) ) > 512 ) { if ( ! setupEphemeralRSAKeys ( suite . exportable ) ) { return false ; } } } catch ( RuntimeException e ) { return false ; } break ; case K_DHE_RSA : if ( setupPrivateKeyAndChain ( "RSA" ) == false ) { return false ; } if ( protocolVersion . v >= ProtocolVersion . TLS12 . v ) { preferableSignatureAlgorithm = SignatureAndHashAlgorithm . getPreferableAlgorithm ( supportedSignAlgs , "RSA" , privateKey ) ; if ( preferableSignatureAlgorithm == null ) { return false ; } } setupEphemeralDHKeys ( suite . exportable ) ; break ; case K_ECDHE_RSA : if ( setupPrivateKeyAndChain ( "RSA" ) == false ) { return false ; } if ( protocolVersion . v >= ProtocolVersion . TLS12 . v ) { preferableSignatureAlgorithm = SignatureAndHashAlgorithm . getPreferableAlgorithm ( supportedSignAlgs , "RSA" , privateKey ) ; if ( preferableSignatureAlgorithm == null ) { return false ; } } if ( setupEphemeralECDHKeys ( ) == false ) { return false ; } break ; case K_DHE_DSS : if ( protocolVersion . v >= ProtocolVersion . TLS12 . v ) { preferableSignatureAlgorithm = SignatureAndHashAlgorithm . getPreferableAlgorithm ( supportedSignAlgs , "DSA" ) ; if ( preferableSignatureAlgorithm == null ) { return false ; } } if ( setupPrivateKeyAndChain ( "DSA" ) == false ) { return false ; } setupEphemeralDHKeys ( suite . exportable ) ; break ; case K_ECDHE_ECDSA : if ( protocolVersion . v >= ProtocolVersion . TLS12 . v ) { preferableSignatureAlgorithm = SignatureAndHashAlgorithm . getPreferableAlgorithm ( supportedSignAlgs , "ECDSA" ) ; if ( preferableSignatureAlgorithm == null ) { return false ; } } if ( setupPrivateKeyAndChain ( "EC_EC" ) == false ) { return false ; } if ( setupEphemeralECDHKeys ( ) == false ) { return false ; } break ; case K_ECDH_RSA : if ( setupPrivateKeyAndChain ( "EC_RSA" ) == false ) { return false ; } setupStaticECDHKeys ( ) ; break ; case K_ECDH_ECDSA : if ( setupPrivateKeyAndChain ( "EC_EC" ) == false ) { return false ; } setupStaticECDHKeys ( ) ; break ; case K_KRB5 : case K_KRB5_EXPORT : if ( ! setupKerberosKeys ( ) ) { return false ; } break ; case K_DH_ANON : setupEphemeralDHKeys ( suite . exportable ) ; break ; case K_ECDH_ANON : if ( setupEphemeralECDHKeys ( ) == false ) { return false ; } break ; default : throw new RuntimeException ( "Unrecognized cipherSuite: " + suite ) ; } setCipherSuite ( suite ) ; if ( protocolVersion . v >= ProtocolVersion . TLS12 . v ) { if ( peerSupportedSignAlgs == null ) { setPeerSupportedSignAlgs ( supportedSignAlgs ) ; } } return true ; }
Set the given CipherSuite, if possible. Return the result.
The call succeeds if the CipherSuite is available and we have
the necessary certificates to complete the handshake. We don't
check if the CipherSuite is actually enabled.

If successful, this method also generates ephemeral keys if
required for this ciphersuite. This may take some time, so this
method should only be called if you really want to use the
CipherSuite.

This method is called from chooseCipherSuite() in this class.