Example usage for org.apache.http.conn.ssl SSLContextBuilder useSSL

Introduction

In this page you can find the example usage for org.apache.http.conn.ssl SSLContextBuilder useSSL.

Prototype

public SSLContextBuilder useSSL() 

Source Link

Usage

From source file:org.bonitasoft.connectors.rest.RESTConnector.java

/**
 * Set the request builder based on the request
 * /*  w  w  w  .  j  a v  a 2  s .c  om*/
 * @param ssl The request SSL options
 * @param httpClientBuilder The request builder
 * @throws Exception
 */
private void setSSL(final SSL ssl, final HttpClientBuilder httpClientBuilder) throws Exception {
    if (ssl != null) {
        final SSLContextBuilder sslContextBuilder = new SSLContextBuilder();

        if (ssl.getTrustStore() != null) {
            final KeyStore trustStore = ssl.getTrustStore().generateKeyStore();
            if (ssl.isUseSelfSignedCertificate()) {
                sslContextBuilder.loadTrustMaterial(trustStore, new TrustSelfSignedStrategy());
            } else {
                sslContextBuilder.loadTrustMaterial(trustStore);
            }
        }

        if (ssl.getKeyStore() != null) {
            final KeyStore keyStore = ssl.getKeyStore().generateKeyStore();
            final String keyStorePassword = ssl.getKeyStore().getPassword();
            sslContextBuilder.loadKeyMaterial(keyStore, keyStorePassword.toCharArray());
        }

        sslContextBuilder.setSecureRandom(null);

        if (ssl.isUseTLS()) {
            sslContextBuilder.useTLS();
        } else {
            sslContextBuilder.useSSL();
        }

        final SSLVerifier verifier = ssl.getSslVerifier();
        X509HostnameVerifier hostnameVerifier = SSLConnectionSocketFactory.STRICT_HOSTNAME_VERIFIER;
        switch (verifier) {
        case BROWSER:
            hostnameVerifier = SSLConnectionSocketFactory.BROWSER_COMPATIBLE_HOSTNAME_VERIFIER;
            break;
        case ALLOW:
            hostnameVerifier = SSLConnectionSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER;
            break;
        case STRICT:
            hostnameVerifier = SSLConnectionSocketFactory.STRICT_HOSTNAME_VERIFIER;
            break;
        default:
            hostnameVerifier = SSLConnectionSocketFactory.STRICT_HOSTNAME_VERIFIER;
            break;
        }

        final SSLConnectionSocketFactory socketFactory = new SSLConnectionSocketFactory(
                sslContextBuilder.build(), hostnameVerifier);
        httpClientBuilder.setSSLSocketFactory(socketFactory);
    }
}

---

From source file:org.openscore.content.httpclient.build.conn.SSLConnectionSocketFactoryBuilder.java

public SSLConnectionSocketFactory build() {
    if (!"true".equalsIgnoreCase(trustAllRootsStr) && !"false".equalsIgnoreCase(trustAllRootsStr)) {
        throw new IllegalArgumentException("'trustAllRoots' can only be 'true' or 'false'");
    }// w  w w .ja v  a 2  s  . c  o m
    boolean trustAllRoots = Boolean.parseBoolean(trustAllRootsStr);

    SSLContextBuilder sslContextBuilder = SSLContexts.custom();
    if (!trustAllRoots) {
        boolean useClientCert = !StringUtils.isEmpty(keystore);
        //validate SSL certificates sent by the server
        boolean useTrustCert = !StringUtils.isEmpty(trustKeystore);

        String javaKeystore = System.getProperty("java.home") + "/lib/security/cacerts";
        boolean storeExists = new File(javaKeystore).exists();

        if (!useClientCert && storeExists) {
            keystore = "file:" + javaKeystore;
            keystorePassword = (StringUtils.isEmpty(keystorePassword)) ? "changeit" : keystorePassword;
            useClientCert = true;
        } else if (useClientCert && !keystore.startsWith("http")) {
            keystore = "file:" + keystore;
        }

        if (!useTrustCert && storeExists) {
            trustKeystore = "file:" + javaKeystore;
            trustPassword = (StringUtils.isEmpty(trustPassword)) ? "changeit" : trustPassword;
            useTrustCert = true;
        } else if (useTrustCert && !trustKeystore.startsWith("http")) {
            trustKeystore = "file:" + trustKeystore;
        }
        createTrustKeystore(sslContextBuilder, useTrustCert);
        //todo client key authentication should not depend on 'trustAllRoots'
        createKeystore(sslContextBuilder, useClientCert);
    } else {
        try {
            //need to override isTrusted() method to accept CA certs because the Apache HTTP Client ver.4.3 will only accepts self-signed certificates
            sslContextBuilder.loadTrustMaterial(null, new TrustSelfSignedStrategy() {
                @Override
                public boolean isTrusted(X509Certificate[] chain, String authType) throws CertificateException {
                    return true;
                }
            });
        } catch (Exception e) {
            throw new IllegalArgumentException(e.getMessage() + ". " + TRUST_ALL_ROOTS_ERROR + trustAllRoots,
                    e);
        }
    }

    sslContextBuilder.useSSL();
    sslContextBuilder.useTLS();

    SSLConnectionSocketFactory sslsf;
    try {
        String x509HostnameVerifierStr = x509HostnameVerifier.toLowerCase();
        X509HostnameVerifier x509HostnameVerifier = null;
        switch (x509HostnameVerifierStr) {
        case "strict":
            x509HostnameVerifier = SSLConnectionSocketFactory.STRICT_HOSTNAME_VERIFIER;
            break;
        case "browser_compatible":
            x509HostnameVerifier = SSLConnectionSocketFactory.BROWSER_COMPATIBLE_HOSTNAME_VERIFIER;
            break;
        case "allow_all":
            x509HostnameVerifier = SSLConnectionSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER;
            break;
        default:
            x509HostnameVerifier = SSLConnectionSocketFactory.STRICT_HOSTNAME_VERIFIER;
        }

        sslsf = new SSLConnectionSocketFactory(sslContextBuilder.build(), x509HostnameVerifier);
    } catch (Exception e) {
        throw new RuntimeException(e.getMessage() + ". " + SSL_CONNECTION_ERROR, e);
    }
    return sslsf;
}

---

From source file:io.cloudslang.content.httpclient.build.conn.SSLConnectionSocketFactoryBuilder.java

public SSLConnectionSocketFactory build() {
    if (!"true".equalsIgnoreCase(trustAllRootsStr) && !"false".equalsIgnoreCase(trustAllRootsStr)) {
        throw new IllegalArgumentException("'trustAllRoots' can only be 'true' or 'false'");
    }/* w  ww.  j a  v a 2  s  .co m*/
    boolean trustAllRoots = Boolean.parseBoolean(trustAllRootsStr);

    SSLContextBuilder sslContextBuilder = SSLContexts.custom();
    if (!trustAllRoots) {
        boolean useClientCert = !StringUtils.isEmpty(keystore);
        //validate SSL certificates sent by the server
        boolean useTrustCert = !StringUtils.isEmpty(trustKeystore);

        String javaKeystore = System.getProperty("java.home") + "/lib/security/cacerts";
        boolean storeExists = new File(javaKeystore).exists();

        if (!useClientCert && storeExists) {
            keystore = "file:" + javaKeystore;
            keystorePassword = (StringUtils.isEmpty(keystorePassword)) ? "changeit" : keystorePassword;
            useClientCert = true;
        } else if (useClientCert && !keystore.startsWith("http")) {
            keystore = "file:" + keystore;
        }

        if (!useTrustCert && storeExists) {
            trustKeystore = "file:" + javaKeystore;
            trustPassword = (StringUtils.isEmpty(trustPassword)) ? "changeit" : trustPassword;
            useTrustCert = true;
        } else if (useTrustCert && !trustKeystore.startsWith("http")) {
            trustKeystore = "file:" + trustKeystore;
        }
        createTrustKeystore(sslContextBuilder, useTrustCert);
        //todo client key authentication should not depend on 'trustAllRoots'
        createKeystore(sslContextBuilder, useClientCert);
    } else {
        try {
            //need to override isTrusted() method to accept CA certs because the Apache HTTP Client ver.4.3 will only accepts self-signed certificates
            sslContextBuilder.loadTrustMaterial(null, new TrustSelfSignedStrategy() {
                @Override
                public boolean isTrusted(X509Certificate[] chain, String authType) throws CertificateException {
                    return true;
                }
            });
        } catch (Exception e) {
            throw new IllegalArgumentException(e.getMessage() + ". " + TRUST_ALL_ROOTS_ERROR + trustAllRoots,
                    e);
        }
    }

    sslContextBuilder.useSSL();
    sslContextBuilder.useTLS();

    SSLConnectionSocketFactory sslsf;
    try {
        String x509HostnameVerifierStr = x509HostnameVerifierInputValue.toLowerCase();
        X509HostnameVerifier x509HostnameVerifier;
        switch (x509HostnameVerifierStr) {
        case "strict":
            x509HostnameVerifier = SSLConnectionSocketFactory.STRICT_HOSTNAME_VERIFIER;
            break;
        case "browser_compatible":
            x509HostnameVerifier = SSLConnectionSocketFactory.BROWSER_COMPATIBLE_HOSTNAME_VERIFIER;
            break;
        case "allow_all":
            x509HostnameVerifier = SSLConnectionSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER;
            break;
        default:
            throw new IllegalArgumentException("Invalid value '" + x509HostnameVerifierInputValue
                    + "' for input 'x509HostnameVerifier'. Valid values: 'strict','browser_compatible','allow_all'.");
        }
        // Allow SSLv3, TLSv1, TLSv1.1 and TLSv1.2 protocols only. Client-server communication starts with TLSv1.2 and fallbacks to SSLv3 if needed.
        sslsf = new SSLConnectionSocketFactory(sslContextBuilder.build(), SUPPORTED_PROTOCOLS, null,
                x509HostnameVerifier);
    } catch (Exception e) {
        if (e instanceof IllegalArgumentException) {
            throw new IllegalArgumentException(e.getMessage());
        }
        throw new RuntimeException(e.getMessage() + ". " + SSL_CONNECTION_ERROR, e);
    }
    return sslsf;
}

---