SSLParameters

See also:

• SSLSocket
• SSLEngine
• SSLContext

SSLParameters

public SSLParameters ()

Constructs SSLParameters.

The values of cipherSuites, protocols, cryptographic algorithm constraints, endpoint identification algorithm, server names and server name matchers are set to null, useCipherSuitesOrder, wantClientAuth and needClientAuth are set to false.

SSLParameters

public SSLParameters (String[] cipherSuites)

Constructs SSLParameters from the specified array of ciphersuites.

Calling this constructor is equivalent to calling the no-args constructor followed by setCipherSuites(cipherSuites);.

SSLParameters

public SSLParameters (String[] cipherSuites, 
                String[] protocols)

Constructs SSLParameters from the specified array of ciphersuites and protocols.

Calling this constructor is equivalent to calling the no-args constructor followed by setCipherSuites(cipherSuites); setProtocols(protocols);.

getAlgorithmConstraints

public AlgorithmConstraints getAlgorithmConstraints ()

Returns the cryptographic algorithm constraints.

getApplicationProtocols

public String[] getApplicationProtocols ()

Returns a prioritized array of application-layer protocol names that can be negotiated over the SSL/TLS protocols.

The array could be empty (zero-length), in which case protocol indications will not be used.

This method will return a new array each time it is invoked.

getCipherSuites

public String[] getCipherSuites ()

Returns a copy of the array of ciphersuites or null if none have been set.

getEndpointIdentificationAlgorithm

public String getEndpointIdentificationAlgorithm ()

Gets the endpoint identification algorithm.

getNamedGroups

public String[] getNamedGroups ()

Returns a prioritized array of key exchange named groups names that can be used over the SSL/TLS/DTLS protocols.

Note that the standard list of key exchange named groups are defined in the Named Groups section of the Java Security Standard Algorithm Names Specification. Providers may support named groups not defined in this list or may not use the recommended name for a certain named group.

The set of named groups that will be used over the SSL/TLS/DTLS connections is determined by the returned array of this method and the underlying provider-specific default named groups.

If the returned array is null, then the underlying provider-specific default named groups will be used over the SSL/TLS/DTLS connections.

If the returned array is empty (zero-length), then the named group negotiation mechanism is turned off for SSL/TLS/DTLS protocols, and the connections may not be able to be established if the negotiation mechanism is required by a certain SSL/TLS/DTLS protocol. This parameter will override the underlying provider-specific default name groups.

If the returned array is not null or empty (zero-length), then the named groups in the returned array will be used over the SSL/TLS/DTLS connections. This parameter will override the underlying provider-specific default named groups.

This method returns the most recent value passed to setNamedGroups(String) if that method has been called and otherwise returns the default named groups for connection populated objects, or null for pre-populated objects.

getNeedClientAuth

public boolean getNeedClientAuth ()

Returns whether client authentication should be required.

getProtocols

public String[] getProtocols ()

Returns a copy of the array of protocols or null if none have been set.

getSNIMatchers

public final Collection<SNIMatcher> getSNIMatchers ()

Returns a Collection containing all SNIMatchers of the Server Name Indication (SNI) parameter, or null if none has been set.

This method is only useful to SSLSockets or SSLEngines operating in server mode.

For better interoperability, providers generally will not define default matchers so that by default servers will ignore the SNI extension and continue the handshake.

getServerNames

public final List<SNIServerName> getServerNames ()

Returns a List containing all SNIServerNames of the Server Name Indication (SNI) parameter, or null if none has been set.

This method is only useful to SSLSockets or SSLEngines operating in client mode.

For SSL/TLS connections, the underlying SSL/TLS provider may specify a default value for a certain server name type. In client mode, it is recommended that, by default, providers should include the server name indication whenever the server can be located by a supported server name type.

It is recommended that providers initialize default Server Name Indications when creating SSLSocket/SSLEngines. In the following examples, the server name could be represented by an instance of SNIHostName which has been initialized with the hostname "www.example.com" and type StandardConstants.SNI_HOST_NAME.

     Socket socket =
         sslSocketFactory.createSocket("www.example.com", 443);
 

     SSLEngine engine =
         sslContext.createSSLEngine("www.example.com", 443);
 

getUseCipherSuitesOrder

public final boolean getUseCipherSuitesOrder ()

Returns whether the local cipher suites preference should be honored.

getWantClientAuth

public boolean getWantClientAuth ()

Returns whether client authentication should be requested.

setAlgorithmConstraints

public void setAlgorithmConstraints (AlgorithmConstraints constraints)

Sets the cryptographic algorithm constraints, which will be used in addition to any configured by the runtime environment.

If the constraints parameter is non-null, every cryptographic algorithm, key and algorithm parameters used in the SSL/TLS handshake must be permitted by the constraints.

setApplicationProtocols

public void setApplicationProtocols (String[] protocols)

Sets the prioritized array of application-layer protocol names that can be negotiated over the SSL/TLS protocols.

If application-layer protocols are supported by the underlying SSL/TLS implementation, this method configures which values can be negotiated by protocols such as RFC 7301 , the Application Layer Protocol Negotiation (ALPN).

If this end of the connection is expected to offer application protocol values, all protocols configured by this method will be sent to the peer.

If this end of the connection is expected to select the application protocol value, the protocols configured by this method are compared with those sent by the peer. The first matched value becomes the negotiated value. If none of the protocols were actually requested by the peer, the underlying protocol will determine what action to take. (For example, ALPN will send a "no_application_protocol" alert and terminate the connection.)

setCipherSuites

public void setCipherSuites (String[] cipherSuites)

Sets the array of ciphersuites.

setEndpointIdentificationAlgorithm

public void setEndpointIdentificationAlgorithm (String algorithm)

Sets the endpoint identification algorithm.

If the algorithm parameter is non-null or non-empty, the endpoint identification/verification procedures must be handled during SSL/TLS handshaking. This is to prevent on-path attacks.

setNamedGroups

public void setNamedGroups (String[] namedGroups)

Sets the prioritized array of key exchange named groups names that can be used over the SSL/TLS/DTLS protocols.

Note that the standard list of key exchange named groups are defined in the Named Groups section of the Java Security Standard Algorithm Names Specification. Providers may support named groups not defined in this list or may not use the recommended name for a certain named group.

The set of named groups that will be used over the SSL/TLS/DTLS connections is determined by the input parameter namedGroups array and the underlying provider-specific default named groups. See getNamedGroups() for specific details on how the parameters are used in SSL/TLS/DTLS connections.

setNeedClientAuth

public void setNeedClientAuth (boolean needClientAuth)

Sets whether client authentication should be required. Calling this method clears the wantClientAuth flag.

setProtocols

public void setProtocols (String[] protocols)

Sets the array of protocols.

setSNIMatchers

public final void setSNIMatchers (Collection<SNIMatcher> matchers)

Sets the SNIMatchers of the Server Name Indication (SNI) parameter.

This method is only useful to SSLSockets or SSLEngines operating in server mode.

Note that the matchers collection is cloned to protect against subsequent modification.

setServerNames

public final void setServerNames (List<SNIServerName> serverNames)

Sets the desired SNIServerNames of the Server Name Indication (SNI) parameter.

This method is only useful to SSLSockets or SSLEngines operating in client mode.

Note that the serverNames list is cloned to protect against subsequent modification.

setUseCipherSuitesOrder

public final void setUseCipherSuitesOrder (boolean honorOrder)

Sets whether the local cipher suites preference should be honored.

setWantClientAuth

public void setWantClientAuth (boolean wantClientAuth)

Sets whether client authentication should be requested. Calling this method clears the needClientAuth flag.