software.amazon.awssdk.crt.io

Class TlsContextOptions

java.lang.Object

software.amazon.awssdk.crt.CrtResource

software.amazon.awssdk.crt.io.TlsContextOptions

All Implemented Interfaces:

AutoCloseable

public final class TlsContextOptions
extends CrtResource

This class wraps the aws_tls_connection_options from aws-c-io to provide access to TLS configuration contexts in the AWS Common Runtime.

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	TlsContextOptions.TlsVersions

Constructor Summary

Constructors

Constructor and Description
TlsContextOptions() Creates a new set of options that can be used to create a TlsContext

Method Summary

Modifier and Type	Method and Description
void	close() Frees the native resources associated with this instance
static TlsContextOptions	createDefaultClient() Helper which creates a default set of TLS options for the current platform
static TlsContextOptions	createWithMTLS(String certificatePath, String privateKeyPath) Helper which creates TLS options using a certificate and private key
static TlsContextOptions	createWithMTLSPkcs12(String pkcs12Path, String pkcs12Password) OSX only - Helper which creates TLS options using PKCS12
void	initMTLSFromPath(String certificatePath, String privateKeyPath) Sets the path to the certificate that identifies this TLS host.
void	initMTLSPkcs12(String pkcs12Path, String pkcs12Password) OSX only - Initializes MTLS with PKCS12 file and password
static boolean	isAlpnSupported() Returns whether or not ALPN is supported on the current platform
void	overrideDefaultTrustStore(String caPath, String caFile) Helper function to provide a TlsContext-local trust store
void	setAlpnList(String alpn) Sets the ALPN protocol list that will be provided when a TLS connection starts
void	setMinimumTlsVersion(TlsContextOptions.TlsVersions version) Sets the minimum acceptable TLS version that the TlsContext will allow
void	setVerifyPeer(boolean verify) Set whether or not the peer should be verified.

Methods inherited from class software.amazon.awssdk.crt.CrtResource

acquire, getAllocatedNativeResourceCount, getAllocatedNativeResources, isNull, native_ptr, own, release

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

TlsContextOptions

public TlsContextOptions()
                  throws CrtRuntimeException

Creates a new set of options that can be used to create a TlsContext

Throws:

CrtRuntimeException - If the system is not able to allocate space for a native tls context options structure

Method Detail

close

public void close()

Frees the native resources associated with this instance

Specified by:

close in interface AutoCloseable

Overrides:

close in class CrtResource

setMinimumTlsVersion

public void setMinimumTlsVersion(TlsContextOptions.TlsVersions version)

Sets the minimum acceptable TLS version that the TlsContext will allow

Parameters:

version - Select from TlsVersions, a good default is TlsVersions.TLS_VER_SYS_DEFAULTS as this will update if the OS TLS is updated

setAlpnList

public void setAlpnList(String alpn)

Sets the ALPN protocol list that will be provided when a TLS connection starts

Parameters:

alpn - The ALPN protocol to use, e.g. "x-amzn-mqtt-ca"

initMTLSFromPath

public void initMTLSFromPath(String certificatePath,
                             String privateKeyPath)

Sets the path to the certificate that identifies this TLS host. Must be in PEM format.

Parameters:

certificatePath - Path to PEM format certificate

privateKeyPath - Path to PEM format private key

initMTLSPkcs12

public void initMTLSPkcs12(String pkcs12Path,
                           String pkcs12Password)

OSX only - Initializes MTLS with PKCS12 file and password

Parameters:

pkcs12Path - Path to PKCS12 file

pkcs12Password - PKCS12 password

setVerifyPeer

public void setVerifyPeer(boolean verify)

Set whether or not the peer should be verified. Default is true for clients, and false for servers. If you are in a development or debugging environment, you can disable this to avoid or diagnose trust store issues. This should always be true on clients in the wild. If you set this to true on a server, it will validate every client connection.

Parameters:

verify - true to verify peers, false to skip verification

isAlpnSupported

public static boolean isAlpnSupported()

Returns whether or not ALPN is supported on the current platform

Returns:

true if ALPN is supported, false otherwise

overrideDefaultTrustStore

public void overrideDefaultTrustStore(String caPath,
                                      String caFile)

Helper function to provide a TlsContext-local trust store

Parameters:

caPath - Path to the local trust store. Can be null.

caFile - Path to the root certificate. Must be in PEM format.

createDefaultClient

public static TlsContextOptions createDefaultClient()
                                             throws CrtRuntimeException

Helper which creates a default set of TLS options for the current platform

Returns:

A default configured set of options for a TLS client connection

Throws:

CrtRuntimeException - @see TlsContextOptions.TlsContextOptions()

createWithMTLS

public static TlsContextOptions createWithMTLS(String certificatePath,
                                               String privateKeyPath)
                                        throws CrtRuntimeException

Helper which creates TLS options using a certificate and private key

Parameters:

certificatePath - Path to a PEM format certificate

privateKeyPath - Path to a PEM format private key

Returns:

A set of options for setting up an MTLS connection

Throws:

CrtRuntimeException - @see #constructor()

createWithMTLSPkcs12

public static TlsContextOptions createWithMTLSPkcs12(String pkcs12Path,
                                                     String pkcs12Password)
                                              throws CrtRuntimeException

OSX only - Helper which creates TLS options using PKCS12

Parameters:

pkcs12Path - The path to a PKCS12 file @see #setPkcs12Path(String)

pkcs12Password - The PKCS12 password @see #setPkcs12Password(String)

Returns:

A set of options for creating a PKCS12 TLS connection

Throws:

CrtRuntimeException - @see #constructor()