com.solace.messaging.config

Class TransportSecurityStrategy.TLS

java.lang.Object

com.solace.messaging.config.TransportSecurityStrategy.TLS

All Implemented Interfaces:

TransportSecurityStrategy, TypedConfiguration

Enclosing interface:

TransportSecurityStrategy

@ProviderType
public static final class TransportSecurityStrategy.TLS
extends Object
implements TransportSecurityStrategy

A class that implements basic user name/password authentication configuration.

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	TransportSecurityStrategy.TLS.SecureProtocols

Nested classes/interfaces inherited from interface com.solace.messaging.config.TransportSecurityStrategy

TransportSecurityStrategy.TLS

Method Summary

Modifier and Type	Method and Description
static TransportSecurityStrategy.TLS	create() Creates a new transport layer security instance.
TransportSecurityStrategy.TLS	downgradable() Configures Secure Socket Layer (SSL) so that session connections are downgraded to a plain-text after client authentication completes.
TypedProperties	getSecurityConfiguration()
TransportSecurityStrategy.TLS	withCertificateHostValidation() Configures transport layer security (TLS) to validate host against one from a server certificate.
TransportSecurityStrategy.TLS	withCertificateValidation(String trustStorePassword, boolean ignoreExpiration) Configures transport-layer security (TLS) to use default JDK/JRE truststore 'jssecacerts' or 'cacerts' and to reject or not to reject expired certificates.
TransportSecurityStrategy.TLS	withCertificateValidation(String trustStorePassword, boolean ignoreExpiration, SecureStoreFormat format, String trustStoreFilePath) Configures transport-layer security (TLS) validation on certificates.
TransportSecurityStrategy.TLS	withCertificateValidation(String trustStorePassword, boolean ignoreExpiration, SecureStoreFormat format, String trustStoreFilePath, String trustedCommonNameList) Configures TLS validation on certificates.
TransportSecurityStrategy.TLS	withCipherSuites(String cipherSuitesList) Deprecated. Best left unset. Effectively disables TLSv1.3. Use JDK facilities, e.g. the jdk.tls.client.cipherSuites system property instead if necessary.
TransportSecurityStrategy.TLS	withExcludedProtocols(TransportSecurityStrategy.TLS.SecureProtocols... excludedProtocols) Specifies the list of Secure Socket Layer (SSL) protocols to not use.
TransportSecurityStrategy.TLS	withoutCertificateHostValidation() Configures transport layer security (TLS) to not validate host against one from a server certificate.
TransportSecurityStrategy.TLS	withoutCertificateValidation() Configures transport layer security (TLS) to not validate server certificates.

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface com.solace.messaging.config.TypedConfiguration

getConfiguration

Method Detail

create

public static TransportSecurityStrategy.TLS create()

Creates a new transport layer security instance.

Returns:

a TLS instance

Since:

1.0

getSecurityConfiguration

public TypedProperties getSecurityConfiguration()

withExcludedProtocols

public TransportSecurityStrategy.TLS withExcludedProtocols(TransportSecurityStrategy.TLS.SecureProtocols... excludedProtocols)

Specifies the list of Secure Socket Layer (SSL) protocols to not use.

Parameters:

excludedProtocols - the list of SSL protocols to not use

Returns:

an instance of itself

Since:

1.0

downgradable

public TransportSecurityStrategy.TLS downgradable()

Configures Secure Socket Layer (SSL) so that session connections are downgraded to a plain-text after client authentication completes.

Warning: Downgrading of SSL to plain-text after client authentication occurs exposes a client and the data being sent to high-security risks.

Returns:

an instance of itself

Since:

1.0

withoutCertificateValidation

public TransportSecurityStrategy.TLS withoutCertificateValidation()

Configures transport layer security (TLS) to not validate server certificates.

Warning: Disabling certificate validation exposes a client and the data being sent to high-security risks.

Returns:

instance of itself

Since:

1.0

withCertificateValidation

public TransportSecurityStrategy.TLS withCertificateValidation(String trustStorePassword,
                                                               boolean ignoreExpiration,
                                                               SecureStoreFormat format,
                                                               String trustStoreFilePath,
                                                               String trustedCommonNameList)

Configures TLS validation on certificates. By default, validation is performed.

Warning: Disabling of certificate expiration validation exposes a client and the data being sent to high-security risks.

Parameters:

trustStorePassword - the trust store password

ignoreExpiration - indicate whether to ignore expired certificates; if set to true, expired certificates are accepted

Warning: Ignoring expired certificates exposes a client and data being sent to a high security risks.

format - the format of the truststore file; usually JKS is specified

trustStoreFilePath - the location of the truststore file

trustedCommonNameList - a comma separated list of acceptable common names for matching with server certificates; the API performs a case in-sensitive comparison of the common names provided in this property with the common name in the server certificate.

Note: Leading and trailing whitespaces are considered to be part of the common names and are not ignored.

Returns:

an instance of itself

Since:

1.0

withCertificateValidation

public TransportSecurityStrategy.TLS withCertificateValidation(String trustStorePassword,
                                                               boolean ignoreExpiration,
                                                               SecureStoreFormat format,
                                                               String trustStoreFilePath)

Configures transport-layer security (TLS) validation on certificates. By default, validation is performed.

Warning: Disabling certificate expiration validation exposes a client and the data being sent to high-security risks.

Parameters:

trustStorePassword - the truststore password

ignoreExpiration - indicate whether to ignore expired certificates; if set to true, expired certificates are accepted

Warning: Ignoring expired certificates exposes a client and data being sent to a high security risks.

format - the format of the truststore file; usually JKS is specified

trustStoreFilePath - the location of the truststore file

Returns:

an instance of itself

Since:

1.0

withCertificateValidation

public TransportSecurityStrategy.TLS withCertificateValidation(String trustStorePassword,
                                                               boolean ignoreExpiration)

Configures transport-layer security (TLS) to use default JDK/JRE truststore 'jssecacerts' or 'cacerts' and to reject or not to reject expired certificates. It also specifies the truststore password to access certificate store. By default expired certificates are rejected.

Parameters:

trustStorePassword - the truststore password

ignoreExpiration - indicate whether to ignore expired certificates; if set to true, expired certificates are accepted

Warning: Ignoring expired certificates exposes a client and data being sent to a high security risks.

Returns:

an instance of itself

Since:

1.0

withCipherSuites

@Deprecated
public TransportSecurityStrategy.TLS withCipherSuites(String cipherSuitesList)

Deprecated. Best left unset. Effectively disables TLSv1.3. Use JDK facilities, e.g. the jdk.tls.client.cipherSuites system property instead if necessary.

Parameters:

cipherSuitesList - the list of ciphers that may be used in the secure connection.

Returns:

instance of itself

Since:

1.0

withoutCertificateHostValidation

public TransportSecurityStrategy.TLS withoutCertificateHostValidation()

Configures transport layer security (TLS) to not validate host against one from a server certificate.

Usage of this method IS NOT RECOMMENDED

Returns:

instance of itself

Since:

1.1

withCertificateHostValidation

public TransportSecurityStrategy.TLS withCertificateHostValidation()

Configures transport layer security (TLS) to validate host against one from a server certificate.

This Method can be used to re-enable host verification when it was disabled using properties.

Host verification is enabled by default when client certificate validation is enabled

Returns:

instance of itself

Since:

1.1