X509Util implements Closeable, AutoCloseable { public static X509TrustManager createTrustManager( String trustStoreLocation, String trustStorePassword, String trustStoreTypeProp, boolean crlEnabled, boolean ocspEnabled, final boolean serverHostnameVerificationEnabled, final boolean clientHostnameVerificationEnabled) throws TrustManagerException { if (trustStorePassword == null) { trustStorePassword = ""; } try { KeyStoreFileType storeFileType = KeyStoreFileType.fromPropertyValueOrFileName( trustStoreTypeProp, trustStoreLocation); KeyStore ts = FileKeyStoreLoaderBuilderProvider .getBuilderForKeyStoreFileType(storeFileType) .setTrustStorePath(trustStoreLocation) .setTrustStorePassword(trustStorePassword) .build() .loadTrustStore(); PKIXBuilderParameters pbParams = new PKIXBuilderParameters(ts, new X509CertSelector()); if (crlEnabled || ocspEnabled) { pbParams.setRevocationEnabled(true); System.setProperty("com.sun.net.ssl.checkRevocation", "true"); System.setProperty("com.sun.security.enableCRLDP", "true"); if (ocspEnabled) { Security.setProperty("ocsp.enable", "true"); } } else { pbParams.setRevocationEnabled(false); } TrustManagerFactory tmf = TrustManagerFactory.getInstance("PKIX"); tmf.init(new CertPathTrustManagerParameters(pbParams)); for (final TrustManager tm : tmf.getTrustManagers()) { if (tm instanceof X509ExtendedTrustManager) { return new ZKTrustManager((X509ExtendedTrustManager) tm, serverHostnameVerificationEnabled, clientHostnameVerificationEnabled); } } throw new TrustManagerException("Couldn't find X509TrustManager"); } catch (IOException | GeneralSecurityException | IllegalArgumentException e) { throw new TrustManagerException(e); } } X509Util();  X509Util(ZKConfig zkConfig); String getSslProtocolProperty(); String getSslEnabledProtocolsProperty(); String getCipherSuitesProperty(); String getSslKeystoreLocationProperty(); String getSslCipherSuitesProperty(); String getSslKeystorePasswdProperty(); String getSslKeystoreTypeProperty(); String getSslTruststoreLocationProperty(); String getSslTruststorePasswdProperty(); String getSslTruststoreTypeProperty(); String getSslHostnameVerificationEnabledProperty(); String getSslCrlEnabledProperty(); String getSslOcspEnabledProperty(); String getSslClientAuthProperty(); String getSslHandshakeDetectionTimeoutMillisProperty(); SSLContext getDefaultSSLContext(); SSLContext createSSLContext(ZKConfig config); SSLContextAndOptions getDefaultSSLContextAndOptions(); int getSslHandshakeTimeoutMillis(); SSLContextAndOptions createSSLContextAndOptions(ZKConfig config); static X509KeyManager createKeyManager(
            String keyStoreLocation,
            String keyStorePassword,
            String keyStoreTypeProp); static X509TrustManager createTrustManager(
            String trustStoreLocation,
            String trustStorePassword,
            String trustStoreTypeProp,
            boolean crlEnabled,
            boolean ocspEnabled,
            final boolean serverHostnameVerificationEnabled,
            final boolean clientHostnameVerificationEnabled); SSLSocket createSSLSocket(); SSLSocket createSSLSocket(Socket socket, byte[] pushbackBytes); SSLServerSocket createSSLServerSocket(); SSLServerSocket createSSLServerSocket(int port); void enableCertFileReloading(); @Override void close(); static final int DEFAULT_HANDSHAKE_DETECTION_TIMEOUT_MILLIS; }
@Test public void testLoadPEMTrustStore() throws Exception { X509TrustManager tm = X509Util.createTrustManager( x509TestContext.getTrustStoreFile(KeyStoreFileType.PEM).getAbsolutePath(), x509TestContext.getTrustStorePassword(), KeyStoreFileType.PEM.getPropertyValue(), false, false, true, true); }
@Test public void testLoadPEMTrustStoreNullPassword() throws Exception { if (!x509TestContext.getTrustStorePassword().isEmpty()) { return; } X509TrustManager tm = X509Util.createTrustManager( x509TestContext.getTrustStoreFile(KeyStoreFileType.PEM).getAbsolutePath(), null, KeyStoreFileType.PEM.getPropertyValue(), false, false, true, true); }
@Test public void testLoadPEMTrustStoreAutodetectStoreFileType() throws Exception { X509TrustManager tm = X509Util.createTrustManager( x509TestContext.getTrustStoreFile(KeyStoreFileType.PEM).getAbsolutePath(), x509TestContext.getTrustStorePassword(), null, false, false, true, true); }
@Test public void testLoadJKSTrustStore() throws Exception { X509TrustManager tm = X509Util.createTrustManager( x509TestContext.getTrustStoreFile(KeyStoreFileType.JKS).getAbsolutePath(), x509TestContext.getTrustStorePassword(), KeyStoreFileType.JKS.getPropertyValue(), true, true, true, true); }
@Test public void testLoadJKSTrustStoreNullPassword() throws Exception { if (!x509TestContext.getTrustStorePassword().isEmpty()) { return; } X509TrustManager tm = X509Util.createTrustManager( x509TestContext.getTrustStoreFile(KeyStoreFileType.JKS).getAbsolutePath(), null, KeyStoreFileType.JKS.getPropertyValue(), false, false, true, true); }
@Test public void testLoadJKSTrustStoreAutodetectStoreFileType() throws Exception { X509TrustManager tm = X509Util.createTrustManager( x509TestContext.getTrustStoreFile(KeyStoreFileType.JKS).getAbsolutePath(), x509TestContext.getTrustStorePassword(), null, true, true, true, true); }
@Test(expected = X509Exception.TrustManagerException.class) public void testLoadJKSTrustStoreWithWrongPassword() throws Exception { X509TrustManager tm = X509Util.createTrustManager( x509TestContext.getTrustStoreFile(KeyStoreFileType.JKS).getAbsolutePath(), "wrong password", KeyStoreFileType.JKS.getPropertyValue(), true, true, true, true); }
@Test public void testLoadPKCS12TrustStore() throws Exception { X509TrustManager tm = X509Util.createTrustManager( x509TestContext.getTrustStoreFile(KeyStoreFileType.PKCS12).getAbsolutePath(), x509TestContext.getTrustStorePassword(), KeyStoreFileType.PKCS12.getPropertyValue(), true, true, true, true); }
@Test public void testLoadPKCS12TrustStoreNullPassword() throws Exception { if (!x509TestContext.getTrustStorePassword().isEmpty()) { return; } X509TrustManager tm = X509Util.createTrustManager( x509TestContext.getTrustStoreFile(KeyStoreFileType.PKCS12).getAbsolutePath(), null, KeyStoreFileType.PKCS12.getPropertyValue(), false, false, true, true); }
@Test public void testLoadPKCS12TrustStoreAutodetectStoreFileType() throws Exception { X509TrustManager tm = X509Util.createTrustManager( x509TestContext.getTrustStoreFile(KeyStoreFileType.PKCS12).getAbsolutePath(), x509TestContext.getTrustStorePassword(), null, true, true, true, true); }
@Test(expected = X509Exception.TrustManagerException.class) public void testLoadPKCS12TrustStoreWithWrongPassword() throws Exception { X509TrustManager tm = X509Util.createTrustManager( x509TestContext.getTrustStoreFile(KeyStoreFileType.PKCS12).getAbsolutePath(), "wrong password", KeyStoreFileType.PKCS12.getPropertyValue(), true, true, true, true); }