Class SecurityConfig
public class SecurityConfig extends Object
SecurityConfig
allows to enable transport encryption between the client and the servers.-
Nested Class Summary
Nested Classes Modifier and Type Class Description static class
SecurityConfig.Builder
This builder allows to customize the default security configuration.static class
SecurityConfig.Defaults
-
Method Summary
Modifier and Type Method Description static SecurityConfig.Builder
builder()
Creates a builder to customize theSecurityConfig
configuration.List<String>
ciphers()
Returns the custom list of ciphers.static SecurityConfig.Builder
ciphers(List<String> ciphers)
Allows to customize the list of ciphers that is negotiated with the cluster.static SecurityConfig
create()
Creates aSecurityConfig
with the default configuration.static List<X509Certificate>
decodeCertificates(List<String> certificates)
Helper method to decode string-encoded certificates into their x.509 format.static List<String>
defaultCiphers(boolean nativeTlsEnabled)
Lists the default ciphers used for this platform.static SecurityConfig.Builder
enableHostnameVerification(boolean hostnameVerificationEnabled)
Allows to enable or disable hostname verification (enabled by default).static SecurityConfig.Builder
enableNativeTls(boolean nativeTlsEnabled)
Enables/disables native TLS (enabled by default).static SecurityConfig.Builder
enableTls(boolean tlsEnabled)
Enables TLS for all client/server communication (disabled by default).boolean
hostnameVerificationEnabled()
True if TLS hostname verification is enabled, false otherwise.boolean
nativeTlsEnabled()
Returns whether native TLS is enabled.boolean
tlsEnabled()
True if TLS is enabled, false otherwise.static SecurityConfig.Builder
trustCertificate(Path certificatePath)
Loads a X.509 trust certificate from the given path and uses it.List<X509Certificate>
trustCertificates()
The list of trust certificates that should be used, if present.static SecurityConfig.Builder
trustCertificates(List<X509Certificate> certificates)
Loads the given list of X.509 certificates into the trust store.TrustManagerFactory
trustManagerFactory()
The currently configured trust manager factory, if present.static SecurityConfig.Builder
trustManagerFactory(TrustManagerFactory trustManagerFactory)
Allows to provide a trust manager factory directly for maximum flexibility.static SecurityConfig.Builder
trustStore(Path trustStorePath, String trustStorePassword, Optional<String> trustStoreType)
Loads a trust store from a file path and password and initializes theTrustManagerFactory
.static SecurityConfig.Builder
trustStore(KeyStore trustStore)
Initializes theTrustManagerFactory
with the given trust store.
-
Method Details
-
builder
Creates a builder to customize theSecurityConfig
configuration.- Returns:
- the builder to customize.
-
create
Creates aSecurityConfig
with the default configuration.- Returns:
- the default security config.
-
enableTls
Enables TLS for all client/server communication (disabled by default).- Parameters:
tlsEnabled
- true if enabled, false otherwise.- Returns:
- this
SecurityConfig.Builder
for chaining purposes.
-
enableHostnameVerification
public static SecurityConfig.Builder enableHostnameVerification(boolean hostnameVerificationEnabled)Allows to enable or disable hostname verification (enabled by default).Note that disabling hostname verification will cause the TLS connection to not verify that the hostname/ip is actually part of the certificate and as a result not detect certain kinds of attacks. Only disable if you understand the impact and risks!
- Parameters:
hostnameVerificationEnabled
- set to true if it should be enabled, false for disabled.- Returns:
- this
SecurityConfig.Builder
for chaining purposes.
-
enableNativeTls
Enables/disables native TLS (enabled by default).- Parameters:
nativeTlsEnabled
- true if it should be enabled, false otherwise.- Returns:
- this
SecurityConfig.Builder
for chaining purposes.
-
trustCertificates
Loads the given list of X.509 certificates into the trust store.- Parameters:
certificates
- the list of certificates to load.- Returns:
- this
SecurityConfig.Builder
for chaining purposes.
-
trustCertificate
Loads a X.509 trust certificate from the given path and uses it.- Parameters:
certificatePath
- the path to load the certificate from.- Returns:
- this
SecurityConfig.Builder
for chaining purposes.
-
trustStore
Initializes theTrustManagerFactory
with the given trust store.- Parameters:
trustStore
- the loaded trust store to use.- Returns:
- this
SecurityConfig.Builder
for chaining purposes.
-
trustStore
public static SecurityConfig.Builder trustStore(Path trustStorePath, String trustStorePassword, Optional<String> trustStoreType)Loads a trust store from a file path and password and initializes theTrustManagerFactory
.- Parameters:
trustStorePath
- the path to the truststore.trustStorePassword
- the password (can be null if not password protected).trustStoreType
- the type of the trust store. If empty, theKeyStore.getDefaultType()
will be used.- Returns:
- this
SecurityConfig.Builder
for chaining purposes.
-
trustManagerFactory
Allows to provide a trust manager factory directly for maximum flexibility.While providing the most flexibility, most users will find the other overloads more convenient, like passing in a
trustStore(KeyStore)
directly or via filepathtrustStore(Path, String, Optional)
.- Parameters:
trustManagerFactory
- the trust manager factory to use.- Returns:
- this
SecurityConfig.Builder
for chaining purposes.
-
ciphers
Allows to customize the list of ciphers that is negotiated with the cluster.Note that this method is considered advanced API, please only customize the cipher list if you know what you are doing (for example if you want to shrink the cipher list down to a very specific subset for security or compliance reasons).
If no custom ciphers are configured, the default set will be used.
- Parameters:
ciphers
- the custom list of ciphers to use.- Returns:
- this
SecurityConfig.Builder
for chaining purposes.
-
tlsEnabled
public boolean tlsEnabled()True if TLS is enabled, false otherwise.- Returns:
- a boolean if tls/transport encryption is enabled.
-
hostnameVerificationEnabled
public boolean hostnameVerificationEnabled()True if TLS hostname verification is enabled, false otherwise. -
trustCertificates
The list of trust certificates that should be used, if present.- Returns:
- the list of certificates.
-
trustManagerFactory
The currently configured trust manager factory, if present.- Returns:
- the trust manager factory.
-
nativeTlsEnabled
public boolean nativeTlsEnabled()Returns whether native TLS is enabled.- Returns:
- true if enabled, false otherwise.
-
ciphers
Returns the custom list of ciphers.- Returns:
- the custom list of ciphers.
-
decodeCertificates
Helper method to decode string-encoded certificates into their x.509 format.- Parameters:
certificates
- the string-encoded certificates.- Returns:
- the decoded certs in x.509 format.
-
defaultCiphers
Lists the default ciphers used for this platform.Note that the list of ciphers can differ whether native TLS is enabled or not, so the parameter should reflect the actual security configuration used. Native TLS is enabled by default on the configuration, so if it is not overridden it should be set to true here as well.
- Parameters:
nativeTlsEnabled
- if native TLS is enabled on the security configuration (defaults to yes there).- Returns:
- the list of default ciphers.
-