SSLUtils { public static SSLContext createSSLServerContext(Configuration sslConfig) throws Exception { Preconditions.checkNotNull(sslConfig); SSLContext serverSSLContext = null; if (getSSLEnabled(sslConfig)) { LOG.debug("Creating server SSL context from configuration"); String keystoreFilePath = sslConfig.getString(SecurityOptions.SSL_KEYSTORE); String keystorePassword = sslConfig.getString(SecurityOptions.SSL_KEYSTORE_PASSWORD); String certPassword = sslConfig.getString(SecurityOptions.SSL_KEY_PASSWORD); String sslProtocolVersion = sslConfig.getString(SecurityOptions.SSL_PROTOCOL); Preconditions.checkNotNull(keystoreFilePath, SecurityOptions.SSL_KEYSTORE.key() + " was not configured."); Preconditions.checkNotNull(keystorePassword, SecurityOptions.SSL_KEYSTORE_PASSWORD.key() + " was not configured."); Preconditions.checkNotNull(certPassword, SecurityOptions.SSL_KEY_PASSWORD.key() + " was not configured."); KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType()); FileInputStream keyStoreFile = null; try { keyStoreFile = new FileInputStream(new File(keystoreFilePath)); ks.load(keyStoreFile, keystorePassword.toCharArray()); } finally { if (keyStoreFile != null) { keyStoreFile.close(); } } KeyManagerFactory kmf = KeyManagerFactory.getInstance( KeyManagerFactory.getDefaultAlgorithm()); kmf.init(ks, certPassword.toCharArray()); serverSSLContext = SSLContext.getInstance(sslProtocolVersion); serverSSLContext.init(kmf.getKeyManagers(), null, null); } return serverSSLContext; }  static boolean getSSLEnabled(Configuration sslConfig); static void setSSLVerAndCipherSuites(ServerSocket socket, Configuration config); static void setSSLVerAndCipherSuites(SSLEngine engine, Configuration config); static void setSSLVerifyHostname(Configuration sslConfig, SSLParameters sslParams); static SSLContext createSSLClientContext(Configuration sslConfig); static SSLContext createSSLServerContext(Configuration sslConfig);  }
@Test public void testCreateSSLServerContext() throws Exception { Configuration serverConfig = new Configuration(); serverConfig.setBoolean(SecurityOptions.SSL_ENABLED, true); serverConfig.setString(SecurityOptions.SSL_KEYSTORE, "src/test/resources/local127.keystore"); serverConfig.setString(SecurityOptions.SSL_KEYSTORE_PASSWORD, "password"); serverConfig.setString(SecurityOptions.SSL_KEY_PASSWORD, "password"); SSLContext serverContext = SSLUtils.createSSLServerContext(serverConfig); Assert.assertNotNull(serverContext); }
@Test public void testCreateSSLServerContextWithSSLDisabled() throws Exception { Configuration serverConfig = new Configuration(); serverConfig.setBoolean(SecurityOptions.SSL_ENABLED, false); SSLContext serverContext = SSLUtils.createSSLServerContext(serverConfig); Assert.assertNull(serverContext); }
@Test public void testCreateSSLServerContextMisconfiguration() { Configuration serverConfig = new Configuration(); serverConfig.setBoolean(SecurityOptions.SSL_ENABLED, true); serverConfig.setString(SecurityOptions.SSL_KEYSTORE, "src/test/resources/local127.keystore"); serverConfig.setString(SecurityOptions.SSL_KEYSTORE_PASSWORD, "badpassword"); serverConfig.setString(SecurityOptions.SSL_KEY_PASSWORD, "badpassword"); try { SSLContext serverContext = SSLUtils.createSSLServerContext(serverConfig); Assert.fail("SSL server context created even with bad SSL configuration "); } catch (Exception e) { } }
@Test public void testCreateSSLServerContextWithMultiProtocols() { Configuration serverConfig = new Configuration(); serverConfig.setBoolean(SecurityOptions.SSL_ENABLED, true); serverConfig.setString(SecurityOptions.SSL_KEYSTORE, "src/test/resources/local127.keystore"); serverConfig.setString(SecurityOptions.SSL_KEYSTORE_PASSWORD, "password"); serverConfig.setString(SecurityOptions.SSL_KEY_PASSWORD, "password"); serverConfig.setString(SecurityOptions.SSL_PROTOCOL, "TLSv1,TLSv1.2"); try { SSLContext serverContext = SSLUtils.createSSLServerContext(serverConfig); Assert.fail("SSL server context created even with multiple protocols set "); } catch (Exception e) { } }