ssl

Type Members

class AlgorithmChecker extends PKIXCertPathChecker

Looks for disabled algorithms in the certificate.
Looks for disabled algorithms in the certificate. This is because some certificates are signed with forgable hashes such as MD2 or MD5, so we can't be certain of their authenticity.
This class is needed because the JDK 1.6 Algorithm checker doesn't give us any way to customize the list of disabled algorithms, and we need to be able to support that.
Also note that we need to check the trust anchor for disabled key sizes, and the CertPath explicitly removes the trust anchor from the chain of certificates. This means we need to check the trust anchor explicitly in the through the CompositeTrustManager.
case class AlgorithmConstraint(algorithm: String, constraint: Option[ExpressionSymbol] = None) extends Product with Serializable
class CompositeCertificateException extends CertificateException

A certificate exception that contains underlying exceptions.
class CompositeX509KeyManager extends X509ExtendedKeyManager

A keymanager that wraps other X509 key managers.
class CompositeX509TrustManager extends X509TrustManager

A trust manager that is a composite of several smaller trust managers.
A trust manager that is a composite of several smaller trust managers. It is responsible for verifying the credentials received from a peer.
class ConfigSSLContextBuilder extends SSLContextBuilder

Creates an SSL context builder from info objects.
class DefaultHostnameVerifier extends HostnameVerifier

Use the internal sun hostname checker as the hostname verifier.
Use the internal sun hostname checker as the hostname verifier. Thanks to Kevin Locke.

See also
http://kevinlocke.name/bits/2012/10/03/ssl-certificate-verification-in-dispatch-and-asynchttpclient/
sun.security.util.HostnameChecker
class DefaultKeyManagerFactoryWrapper extends KeyManagerFactoryWrapper
class DefaultTrustManagerFactoryWrapper extends TrustManagerFactoryWrapper
class DisabledComplainingHostnameVerifier extends HostnameVerifier

Add a disabled but complaining hostname verifier.
case class Equal(x: Int) extends ExpressionSymbol with Product with Serializable
sealed abstract class ExpressionSymbol extends AnyRef
class FileBasedKeyStoreBuilder extends KeyStoreBuilder

Builds a keystore from a file containing PEM encoded certificates, using CertificateFactory internally.
Builds a keystore from a file containing PEM encoded certificates, using CertificateFactory internally.

See also
java.security.cert.CertificateFactory
class JavaSecurityDebugBuilder extends AnyRef

See also
http://docs.oracle.com/javase/8/docs/technotes/guides/security/certpath/CertPathProgGuide.html
class JavaxNetDebugBuilder extends AnyRef

A builder for setting the system property options in "javax.net.debug" and in "java.security.debug' (in the case of "certpath").
A builder for setting the system property options in "javax.net.debug" and in "java.security.debug' (in the case of "certpath").

See also
http://docs.oracle.com/javase/8/docs/technotes/guides/security/jsse/ReadDebug.html
http://docs.oracle.com/javase/8/docs/technotes/guides/security/jsse/JSSERefGuide.html#Debug
case class KeyManagerConfig(algorithm: String = ..., keyStoreConfigs: Seq[KeyStoreConfig] = Nil) extends Product with Serializable

The key manager config.
The key manager config.
algorithm
The algoritm to use.
keyStoreConfigs
The key stores to use.
trait KeyManagerFactoryWrapper extends AnyRef
trait KeyStoreBuilder extends AnyRef
case class KeyStoreConfig(storeType: String = KeyStore.getDefaultType, filePath: Option[String] = None, data: Option[String] = None, password: Option[String] = None) extends Product with Serializable

Configuration for a keystore.
Configuration for a keystore.
A key store must either provide a file path, or a data String.
storeType
The store type. Defaults to the platform default store type (ie, JKS).
filePath
The path of the key store file.
data
The data to load the key store file from.
password
The password to use to load the key store file, if the file is password protected.
case class LessThan(x: Int) extends ExpressionSymbol with Product with Serializable
case class LessThanOrEqual(x: Int) extends ExpressionSymbol with Product with Serializable
trait MonkeyPatcher extends AnyRef
case class MoreThan(x: Int) extends ExpressionSymbol with Product with Serializable
case class MoreThanOrEqual(x: Int) extends ExpressionSymbol with Product with Serializable
case class NotEqual(x: Int) extends ExpressionSymbol with Product with Serializable
case class SSLConfig(default: Boolean = false, protocol: String = "TLSv1.2", checkRevocation: Option[Boolean] = None, revocationLists: Option[Seq[URL]] = None, enabledCipherSuites: Option[Seq[String]] = None, enabledProtocols: Option[Seq[String]] = ..., disabledSignatureAlgorithms: Seq[String] = Seq("MD2", "MD4", "MD5"), disabledKeyAlgorithms: Seq[String] = ..., keyManagerConfig: KeyManagerConfig = KeyManagerConfig(), trustManagerConfig: TrustManagerConfig = TrustManagerConfig(), hostnameVerifierClass: Class[_ <: HostnameVerifier] = classOf[DefaultHostnameVerifier], secureRandom: Option[SecureRandom] = None, debug: SSLDebugConfig = SSLDebugConfig(), loose: SSLLooseConfig = SSLLooseConfig()) extends Product with Serializable

The SSL configuration.
The SSL configuration.
default
Whether we should use the default JVM SSL configuration or not.
protocol
The SSL protocol to use. Defaults to TLSv1.2.
checkRevocation
Whether revocation lists should be checked, if None, defaults to platform default setting.
revocationLists
The revocation lists to check.
enabledCipherSuites
If defined, override the platform default cipher suites.
enabledProtocols
If defined, override the platform default protocols.
disabledSignatureAlgorithms
The disabled signature algorithms.
disabledKeyAlgorithms
The disabled key algorithms.
keyManagerConfig
The key manager configuration.
trustManagerConfig
The trust manager configuration.
hostnameVerifierClass
The hostname verifier class.
secureRandom
The SecureRandom instance to use. Let the platform choose if None.
debug
The debug config.
loose
Loose configuratino parameters
class SSLConfigParser extends AnyRef
trait SSLContextBuilder extends AnyRef
case class SSLDebugConfig(all: Boolean = false, ssl: Boolean = false, certpath: Boolean = false, ocsp: Boolean = false, record: Option[SSLDebugRecordOptions] = None, handshake: Option[SSLDebugHandshakeOptions] = None, keygen: Boolean = false, session: Boolean = false, defaultctx: Boolean = false, sslctx: Boolean = false, sessioncache: Boolean = false, keymanager: Boolean = false, trustmanager: Boolean = false, pluggability: Boolean = false) extends Product with Serializable

SSL debug configuration.
case class SSLDebugHandshakeOptions(data: Boolean = false, verbose: Boolean = false) extends Product with Serializable

SSL handshake debugging options.
case class SSLDebugRecordOptions(plaintext: Boolean = false, packet: Boolean = false) extends Product with Serializable

SSL record debugging options.
case class SSLLooseConfig(allowWeakCiphers: Boolean = false, allowWeakProtocols: Boolean = false, allowLegacyHelloMessages: Option[Boolean] = None, allowUnsafeRenegotiation: Option[Boolean] = None, disableHostnameVerification: Boolean = false, acceptAnyCertificate: Boolean = false) extends Product with Serializable

Configuration for specifying loose (potentially dangerous) ssl config.
Configuration for specifying loose (potentially dangerous) ssl config.
allowWeakCiphers
Whether weak ciphers should be allowed or not.
allowWeakProtocols
Whether weak protocols should be allowed or not.
allowLegacyHelloMessages
Whether legacy hello messages should be allowed or not. If None, uses the platform default.
allowUnsafeRenegotiation
Whether unsafe renegotiation should be allowed or not. If None, uses the platform default.
disableHostnameVerification
Whether hostname verification should be disabled.
acceptAnyCertificate
Whether any X.509 certificate should be accepted or not.
class SimpleSSLContextBuilder extends SSLContextBuilder

A simple SSL context builder.
A simple SSL context builder. If the keyManagers or trustManagers are empty, then null is used in the init method. Likewise, if secureRandom is None then null is used.
class StringBasedKeyStoreBuilder extends KeyStoreBuilder

Builds a keystore from a string containing PEM encoded certificates, using CertificateFactory internally.
Builds a keystore from a string containing PEM encoded certificates, using CertificateFactory internally.

See also
java.security.cert.CertificateFactory
class SystemConfiguration extends AnyRef

Configures global system properties on the JSSE implementation, if defined.
Configures global system properties on the JSSE implementation, if defined.
WARNING: This class sets system properties to configure JSSE code which typically uses static initialization on load. Because of this, if classes are loaded in BEFORE this code has a chance to operate, you may find that this code works inconsistently. The solution is to set the system properties on the command line explicitly (or in the case of "ocsp.enable", in the security property file).
case class TrustManagerConfig(algorithm: String = ..., trustStoreConfigs: Seq[TrustStoreConfig] = Nil) extends Product with Serializable

The trust manager config.
The trust manager config.
algorithm
The algorithm to use.
trustStoreConfigs
The trust stores to use.
trait TrustManagerFactoryWrapper extends AnyRef
case class TrustStoreConfig(storeType: String = KeyStore.getDefaultType, filePath: Option[String], data: Option[String]) extends Product with Serializable

Configuration for a trust store.
Configuration for a trust store.
A trust store must either provide a file path, or a data String.
storeType
The store type. Defaults to the platform default store type (ie, JKS).
filePath
The path of the key store file.
data
The data to load the key store file from.

Value Members

object AlgorithmConstraintsParser extends RegexParsers

Parser based on the jdk.certpath.disabledAlgorithm BNF.
Parser based on the jdk.certpath.disabledAlgorithm BNF.

See also
http://sim.ivi.co/2011/07/java-se-7-release-security-enhancements.html
object Algorithms

This singleton object provides the code needed to check for minimum standards of an X.509 certificate.
This singleton object provides the code needed to check for minimum standards of an X.509 certificate. Over 95% of trusted leaf certificates and 95% of trusted signing certificates use NIST recommended key sizes. Play supports Java 1.6, which does not have built in certificate strength checking, so we roll our own here.
The default settings here are based off NIST SP 800-57, using Dates for Phasing out MD5-based signatures and 1024-bit moduli as a practical guide.
Note that the key sizes are checked on root CA certificates in the trust store. As the Mozilla document says:
The other concern that needs to be addressed is that of RSA1024 being too small a modulus to be robust against faster computers. Unlike a signature algorithm, where only intermediate and end-entity certificates are impacted, fast math means we have to disable or remove all instances of 1024-bit moduli, including the root certificates.
Relevant key sizes:
According to NIST SP 800-57 the recommended algorithms and minimum key sizes are as follows: Through 2010 (minimum of 80 bits of strength) FFC (e.g., DSA, D-H) Minimum: L=1024; N=160 IFC (e.g., RSA) Minimum: k=1024 ECC (e.g. ECDSA) Minimum: f=160 Through 2030 (minimum of 112 bits of strength) FFC (e.g., DSA, D-H) Minimum: L=2048; N=224 IFC (e.g., RSA) Minimum: k=2048 ECC (e.g. ECDSA) Minimum: f=224 Beyond 2030 (minimum of 128 bits of strength) FFC (e.g., DSA, D-H) Minimum: L=3072; N=256 IFC (e.g., RSA) Minimum: k=3072 ECC (e.g. ECDSA) Minimum: f=256
Relevant signature algorithms:
The known weak signature algorithms are "MD2, MD4, MD5".
SHA-1 is considered too weak for new certificates, but is still allowed for verifying old certificates in the chain. The TLS and NIST'S Policy on Hash Functions blog post by one of the JSSE authors has more details, in particular the "Put it into practice" section.
object CertificateGenerator

Used for testing only.
Used for testing only. This relies on internal sun.security packages, so cannot be used in OpenJDK.
object Ciphers

This class contains sets of recommended and deprecated TLS cipher suites.
This class contains sets of recommended and deprecated TLS cipher suites.
The JSSE list of cipher suites is different from the RFC defined list, with some cipher suites prefixed with "SSL_" instead of "TLS_". A full list is available from the SunJSSE provider list
Please see https://www.playframework.com/documentation/current/CipherSuites for more details.
object CompositeCertificateException extends Serializable
object KeystoreFormats
object Protocols
object SSLConfigFactory

Factory for creating SSL config (for use from Java).
implicit def arrayCertsToListCerts(chain: Array[Certificate]): List[Certificate]
implicit def certResult2PKIXResult(result: CertPathValidatorResult): PKIXCertPathValidatorResult
implicit def certificate2X509Certificate(cert: Certificate): X509Certificate
package debug
def debugChain(chain: Array[X509Certificate]): Seq[String]
def foldRuntime[T](older: ⇒ T, newer: ⇒ T): T
def foldVersion[T](run16: ⇒ T, runHigher: ⇒ T): T
def isOpenJdk: Boolean

package ssl

Type Members

class AlgorithmChecker extends PKIXCertPathChecker

case class AlgorithmConstraint(algorithm: String, constraint: Option[ExpressionSymbol] = None) extends Product with Serializable

class CompositeCertificateException extends CertificateException

class CompositeX509KeyManager extends X509ExtendedKeyManager

class CompositeX509TrustManager extends X509TrustManager

class ConfigSSLContextBuilder extends SSLContextBuilder

class DefaultHostnameVerifier extends HostnameVerifier

class DefaultKeyManagerFactoryWrapper extends KeyManagerFactoryWrapper

class DefaultTrustManagerFactoryWrapper extends TrustManagerFactoryWrapper

class DisabledComplainingHostnameVerifier extends HostnameVerifier

case class Equal(x: Int) extends ExpressionSymbol with Product with Serializable

sealed abstract class ExpressionSymbol extends AnyRef

class FileBasedKeyStoreBuilder extends KeyStoreBuilder

class JavaSecurityDebugBuilder extends AnyRef

class JavaxNetDebugBuilder extends AnyRef

case class KeyManagerConfig(algorithm: String = ..., keyStoreConfigs: Seq[KeyStoreConfig] = Nil) extends Product with Serializable

trait KeyManagerFactoryWrapper extends AnyRef

trait KeyStoreBuilder extends AnyRef

case class KeyStoreConfig(storeType: String = KeyStore.getDefaultType, filePath: Option[String] = None, data: Option[String] = None, password: Option[String] = None) extends Product with Serializable

case class LessThan(x: Int) extends ExpressionSymbol with Product with Serializable

case class LessThanOrEqual(x: Int) extends ExpressionSymbol with Product with Serializable

trait MonkeyPatcher extends AnyRef

case class MoreThan(x: Int) extends ExpressionSymbol with Product with Serializable

case class MoreThanOrEqual(x: Int) extends ExpressionSymbol with Product with Serializable

case class NotEqual(x: Int) extends ExpressionSymbol with Product with Serializable

class SSLConfigParser extends AnyRef

trait SSLContextBuilder extends AnyRef

case class SSLDebugHandshakeOptions(data: Boolean = false, verbose: Boolean = false) extends Product with Serializable

case class SSLDebugRecordOptions(plaintext: Boolean = false, packet: Boolean = false) extends Product with Serializable

class SimpleSSLContextBuilder extends SSLContextBuilder

class StringBasedKeyStoreBuilder extends KeyStoreBuilder

class SystemConfiguration extends AnyRef

case class TrustManagerConfig(algorithm: String = ..., trustStoreConfigs: Seq[TrustStoreConfig] = Nil) extends Product with Serializable

trait TrustManagerFactoryWrapper extends AnyRef

case class TrustStoreConfig(storeType: String = KeyStore.getDefaultType, filePath: Option[String], data: Option[String]) extends Product with Serializable

Value Members

object AlgorithmConstraintsParser extends RegexParsers

object Algorithms

object CertificateGenerator

object Ciphers

object CompositeCertificateException extends Serializable

object KeystoreFormats

object Protocols

object SSLConfigFactory

implicit def arrayCertsToListCerts(chain: Array[Certificate]): List[Certificate]

implicit def certResult2PKIXResult(result: CertPathValidatorResult): PKIXCertPathValidatorResult

implicit def certificate2X509Certificate(cert: Certificate): X509Certificate

package debug

def debugChain(chain: Array[X509Certificate]): Seq[String]

def foldRuntime[T](older: ⇒ T, newer: ⇒ T): T

def foldVersion[T](run16: ⇒ T, runHigher: ⇒ T): T

def isOpenJdk: Boolean

Inherited from AnyRef

Inherited from Any

Ungrouped