Class DefaultSSLEngineConfiguration

java.lang.Object
org.snmp4j.transport.tls.DefaultSSLEngineConfiguration
All Implemented Interfaces:
SSLEngineConfigurator
public class DefaultSSLEngineConfiguration extends Object implements SSLEngineConfigurator
The DefaultSSLEngineConfiguration implements the SSL engine configuration based on X509Certificate trust management.
Since:
3.6.0
Author:
Frank Fock

  • Field Details

    • DEFAULT_ENDPOINT_IDENTIFICATION_ALGORITHM

      public static final String DEFAULT_ENDPOINT_IDENTIFICATION_ALGORITHM
      The endpoint identification algorithm used for client mode SSL engines by default, which makes JSSE verify that the certificate of the (D)TLS server matches the host name or IP address of the target as required by RFC 6353 §5.3.1.
      Since:
      3.13.0
      See Also:

  • Constructor Details

  • Method Details

    • getDefaultProtocolVersion

      public String getDefaultProtocolVersion()

    • getTlsTransportMappingConfig

      public TlsTransportMappingConfig<X509Certificate> getTlsTransportMappingConfig()

    • getTrustManagerFactory

      public TLSTMTrustManagerFactory getTrustManagerFactory()

    • isClientAuthenticationRequired

      public boolean isClientAuthenticationRequired()
      Indicates whether an accepted (D)TLS client has to authenticate itself with a certificate.
      Returns:
      true if client authentication is required, which is the default as mandated by RFC 6353 §5.3.2.
      Since:
      3.13.0

    • setClientAuthenticationRequired

      public void setClientAuthenticationRequired(boolean clientAuthenticationRequired)
      Sets whether an accepted (D)TLS client has to authenticate itself with a certificate. RFC 6353 §5.3.2 requires that the server "MUST request and expect a certificate from the client and MUST NOT accept SNMP messages over the (D)TLS connection until the client has sent a certificate and it has been authenticated". Setting this to false restores the pre 3.13.0 behavior where a client that sent no certificate could complete the handshake.
      Parameters:
      clientAuthenticationRequired - false to make client authentication optional.
      Since:
      3.13.0

    • getEndpointIdentificationAlgorithm

      public String getEndpointIdentificationAlgorithm()
      Gets the endpoint identification algorithm applied to client mode SSL engines.
      Returns:
      the endpoint identification algorithm or null if no endpoint identification is performed by JSSE. The default is DEFAULT_ENDPOINT_IDENTIFICATION_ALGORITHM.
      Since:
      3.13.0

    • setEndpointIdentificationAlgorithm

      public void setEndpointIdentificationAlgorithm(String endpointIdentificationAlgorithm)
      Sets the endpoint identification algorithm applied to client mode SSL engines. Set this to null to disable JSSE based endpoint identification, for example for fingerprint pinned targets whose device certificates do not contain a matching subject alternative name.
      Parameters:
      endpointIdentificationAlgorithm - the endpoint identification algorithm, for example "HTTPS", or null.
      Since:
      3.13.0

    • configure

      public void configure(SSLEngine sslEngine, TransportStateReference tmStateReference)
      Description copied from interface: SSLEngineConfigurator
      Configure the supplied SSLEngine for TLS on behalf of the given transport state reference, which provides the target of the connection and thus its expected identity and certificate fingerprints. The default implementation ignores the transport state reference and calls SSLEngineConfigurator.configure(SSLEngine).
      Specified by:
      configure in interface SSLEngineConfigurator
      Parameters:
      sslEngine - a SSLEngine to configure.
      tmStateReference - the transport state reference of the connection to configure, or null for an accepted connection.

    • configure

      public void configure(SSLEngine sslEngine)
      Description copied from interface: SSLEngineConfigurator
      Configure the supplied SSLEngine for TLS. Configuration includes enabled protocol(s), cipher codes, etc.
      Specified by:
      configure in interface SSLEngineConfigurator
      Parameters:
      sslEngine - a SSLEngine to configure.

    • getSSLContext

      public SSLContext getSSLContext(boolean useClientMode, TransportStateReference transportStateReference) throws GeneralSecurityException
      Description copied from interface: SSLEngineConfigurator
      Gets the SSLContext for this SSL connection.
      Specified by:
      getSSLContext in interface SSLEngineConfigurator
      Parameters:
      useClientMode - true if the connection is established in client mode.
      transportStateReference - the transportStateReference with additional security information for the SSL connection to establish.
      Returns:
      the SSLContext.
      Throws:
      GeneralSecurityException - if the TLS context initialization failed because of configuration errors.