depends.org.apache.http.conn.ssl

类 SSLSocketFactory

java.lang.Object

depends.org.apache.http.conn.ssl.SSLSocketFactory

所有已实现的接口:

LayeredSchemeSocketFactory, LayeredSocketFactory, SchemeLayeredSocketFactory, SchemeSocketFactory, SocketFactory

@ThreadSafe
public class SSLSocketFactory
extends java.lang.Object
implements SchemeLayeredSocketFactory, LayeredSchemeSocketFactory, LayeredSocketFactory

Layered socket factory for TLS/SSL connections.

SSLSocketFactory can be used to validate the identity of the HTTPS server against a list of trusted certificates and to authenticate to the HTTPS server using a private key.

SSLSocketFactory will enable server authentication when supplied with a trust-store file containing one or several trusted certificates. The client secure socket will reject the connection during the SSL session handshake if the target HTTPS server attempts to authenticate itself with a non-trusted certificate.

Use JDK keytool utility to import a trusted certificate and generate a trust-store file:

     keytool -import -alias "my server cert" -file server.crt -keystore my.truststore
    

In special cases the standard trust verification process can be bypassed by using a custom TrustStrategy. This interface is primarily intended for allowing self-signed certificates to be accepted as trusted without having to add them to the trust-store file.

The following parameters can be used to customize the behavior of this class:

• CoreConnectionPNames.CONNECTION_TIMEOUT
• CoreConnectionPNames.SO_TIMEOUT
• CoreConnectionPNames.SO_REUSEADDR

SSLSocketFactory will enable client authentication when supplied with a key-store file containing a private key/public certificate pair. The client secure socket will use the private key to authenticate itself to the target HTTPS server during the SSL session handshake if requested to do so by the server. The target HTTPS server will in its turn verify the certificate presented by the client in order to establish client's authenticity

Use the following sequence of actions to generate a key-store file

• Use JDK keytool utility to generate a new key

  keytool -genkey -v -alias "my client key" -validity 365 -keystore my.keystore

  For simplicity use the same password for the key as that of the key-store

• Issue a certificate signing request (CSR)

  keytool -certreq -alias "my client key" -file mycertreq.csr -keystore my.keystore

• Send the certificate request to the trusted Certificate Authority for signature. One may choose to act as her own CA and sign the certificate request using a PKI tool, such as OpenSSL.

• Import the trusted CA root certificate

  keytool -import -alias "my trusted ca" -file caroot.crt -keystore my.keystore

• Import the PKCS#7 file containg the complete certificate chain

  keytool -import -alias "my client key" -file mycert.p7 -keystore my.keystore

• Verify the content the resultant keystore file

  keytool -list -v -keystore my.keystore

从以下版本开始:

4.0

字段概要

字段

限定符和类型	字段和说明
static X509HostnameVerifier	ALLOW_ALL_HOSTNAME_VERIFIER
static X509HostnameVerifier	BROWSER_COMPATIBLE_HOSTNAME_VERIFIER
static java.lang.String	SSL
static java.lang.String	SSLV2
static X509HostnameVerifier	STRICT_HOSTNAME_VERIFIER
static java.lang.String	TLS

构造器概要

构造器

构造器和说明
SSLSocketFactory(java.security.KeyStore truststore)
SSLSocketFactory(java.security.KeyStore keystore, java.lang.String keystorePassword)
SSLSocketFactory(java.security.KeyStore keystore, java.lang.String keystorePassword, java.security.KeyStore truststore)
SSLSocketFactory(javax.net.ssl.SSLContext sslContext)
SSLSocketFactory(javax.net.ssl.SSLContext sslContext, HostNameResolver nameResolver) 已过时。 Use SSLSocketFactory(SSLContext)
SSLSocketFactory(javax.net.ssl.SSLContext sslContext, X509HostnameVerifier hostnameVerifier)
SSLSocketFactory(javax.net.ssl.SSLSocketFactory socketfactory, X509HostnameVerifier hostnameVerifier)
SSLSocketFactory(java.lang.String algorithm, java.security.KeyStore keystore, java.lang.String keystorePassword, java.security.KeyStore truststore, java.security.SecureRandom random, HostNameResolver nameResolver) 已过时。 Use SSLSocketFactory(String, KeyStore, String, KeyStore, SecureRandom, X509HostnameVerifier)
SSLSocketFactory(java.lang.String algorithm, java.security.KeyStore keystore, java.lang.String keystorePassword, java.security.KeyStore truststore, java.security.SecureRandom random, TrustStrategy trustStrategy, X509HostnameVerifier hostnameVerifier)
SSLSocketFactory(java.lang.String algorithm, java.security.KeyStore keystore, java.lang.String keystorePassword, java.security.KeyStore truststore, java.security.SecureRandom random, X509HostnameVerifier hostnameVerifier)
SSLSocketFactory(TrustStrategy trustStrategy)
SSLSocketFactory(TrustStrategy trustStrategy, X509HostnameVerifier hostnameVerifier)

方法概要

方法

限定符和类型	方法和说明
java.net.Socket	connectSocket(java.net.Socket socket, java.net.InetSocketAddress remoteAddress, java.net.InetSocketAddress localAddress, HttpParams params) Connects a socket to the target host with the given remote address.
java.net.Socket	connectSocket(java.net.Socket socket, java.lang.String host, int port, java.net.InetAddress localAddress, int localPort, HttpParams params) 已过时。 Use connectSocket(Socket, InetSocketAddress, InetSocketAddress, HttpParams)
java.net.Socket	createLayeredSocket(java.net.Socket socket, java.lang.String host, int port, boolean autoClose) 已过时。 use createLayeredSocket(Socket, String, int, HttpParams)
java.net.Socket	createLayeredSocket(java.net.Socket socket, java.lang.String host, int port, HttpParams params) Returns a socket connected to the given host that is layered over an existing socket.
java.net.Socket	createSocket() 已过时。
java.net.Socket	createSocket(HttpParams params) Creates a new, unconnected socket.
java.net.Socket	createSocket(java.net.Socket socket, java.lang.String host, int port, boolean autoClose) 已过时。 Use createLayeredSocket(Socket, String, int, boolean)
X509HostnameVerifier	getHostnameVerifier()
static SSLSocketFactory	getSocketFactory() Gets the default factory, which uses the default JSSE settings for initializing the SSL context.
static SSLSocketFactory	getSystemSocketFactory() Gets the default factory, which uses system properties for initializing the SSL context as described in "JavaTM Secure Socket Extension (JSSE) Reference Guide for the JavaTM 2 Platform Standard Edition 5 The following system properties are taken into account by this method: ssl.TrustManagerFactory.algorithm javax.net.ssl.trustStoreType javax.net.ssl.trustStore javax.net.ssl.trustStoreProvider javax.net.ssl.trustStorePassword java.home ssl.KeyManagerFactory.algorithm javax.net.ssl.keyStoreType javax.net.ssl.keyStore javax.net.ssl.keyStoreProvider javax.net.ssl.keyStorePassword
boolean	isSecure(java.net.Socket sock) Checks whether a socket connection is secure.
protected void	prepareSocket(javax.net.ssl.SSLSocket socket) Performs any custom initialization for a newly created SSLSocket (before the SSL handshake happens).
void	setHostnameVerifier(X509HostnameVerifier hostnameVerifier) 已过时。

从类继承的方法 java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

字段详细资料

TLS

public static final java.lang.String TLS

另请参阅:

常量字段值

SSL

public static final java.lang.String SSL

另请参阅:

常量字段值

SSLV2

public static final java.lang.String SSLV2

另请参阅:

常量字段值

ALLOW_ALL_HOSTNAME_VERIFIER

public static final X509HostnameVerifier ALLOW_ALL_HOSTNAME_VERIFIER

BROWSER_COMPATIBLE_HOSTNAME_VERIFIER

public static final X509HostnameVerifier BROWSER_COMPATIBLE_HOSTNAME_VERIFIER

STRICT_HOSTNAME_VERIFIER

public static final X509HostnameVerifier STRICT_HOSTNAME_VERIFIER

构造器详细资料

SSLSocketFactory

@Deprecated
public SSLSocketFactory(java.lang.String algorithm,
                           java.security.KeyStore keystore,
                           java.lang.String keystorePassword,
                           java.security.KeyStore truststore,
                           java.security.SecureRandom random,
                           HostNameResolver nameResolver)
                 throws java.security.NoSuchAlgorithmException,
                        java.security.KeyManagementException,
                        java.security.KeyStoreException,
                        java.security.UnrecoverableKeyException

已过时。 Use SSLSocketFactory(String, KeyStore, String, KeyStore, SecureRandom, X509HostnameVerifier)

抛出:

java.security.NoSuchAlgorithmException

java.security.KeyManagementException

java.security.KeyStoreException

java.security.UnrecoverableKeyException

SSLSocketFactory

public SSLSocketFactory(java.lang.String algorithm,
                java.security.KeyStore keystore,
                java.lang.String keystorePassword,
                java.security.KeyStore truststore,
                java.security.SecureRandom random,
                X509HostnameVerifier hostnameVerifier)
                 throws java.security.NoSuchAlgorithmException,
                        java.security.KeyManagementException,
                        java.security.KeyStoreException,
                        java.security.UnrecoverableKeyException

抛出:

java.security.NoSuchAlgorithmException

java.security.KeyManagementException

java.security.KeyStoreException

java.security.UnrecoverableKeyException

从以下版本开始:

4.1

SSLSocketFactory

public SSLSocketFactory(java.lang.String algorithm,
                java.security.KeyStore keystore,
                java.lang.String keystorePassword,
                java.security.KeyStore truststore,
                java.security.SecureRandom random,
                TrustStrategy trustStrategy,
                X509HostnameVerifier hostnameVerifier)
                 throws java.security.NoSuchAlgorithmException,
                        java.security.KeyManagementException,
                        java.security.KeyStoreException,
                        java.security.UnrecoverableKeyException

抛出:

java.security.NoSuchAlgorithmException

java.security.KeyManagementException

java.security.KeyStoreException

java.security.UnrecoverableKeyException

从以下版本开始:

4.1

SSLSocketFactory

public SSLSocketFactory(java.security.KeyStore keystore,
                java.lang.String keystorePassword,
                java.security.KeyStore truststore)
                 throws java.security.NoSuchAlgorithmException,
                        java.security.KeyManagementException,
                        java.security.KeyStoreException,
                        java.security.UnrecoverableKeyException

抛出:

java.security.NoSuchAlgorithmException

java.security.KeyManagementException

java.security.KeyStoreException

java.security.UnrecoverableKeyException

SSLSocketFactory

public SSLSocketFactory(java.security.KeyStore keystore,
                java.lang.String keystorePassword)
                 throws java.security.NoSuchAlgorithmException,
                        java.security.KeyManagementException,
                        java.security.KeyStoreException,
                        java.security.UnrecoverableKeyException

抛出:

java.security.NoSuchAlgorithmException

java.security.KeyManagementException

java.security.KeyStoreException

java.security.UnrecoverableKeyException

SSLSocketFactory

public SSLSocketFactory(java.security.KeyStore truststore)
                 throws java.security.NoSuchAlgorithmException,
                        java.security.KeyManagementException,
                        java.security.KeyStoreException,
                        java.security.UnrecoverableKeyException

抛出:

java.security.NoSuchAlgorithmException

java.security.KeyManagementException

java.security.KeyStoreException

java.security.UnrecoverableKeyException

SSLSocketFactory

public SSLSocketFactory(TrustStrategy trustStrategy,
                X509HostnameVerifier hostnameVerifier)
                 throws java.security.NoSuchAlgorithmException,
                        java.security.KeyManagementException,
                        java.security.KeyStoreException,
                        java.security.UnrecoverableKeyException

抛出:

java.security.NoSuchAlgorithmException

java.security.KeyManagementException

java.security.KeyStoreException

java.security.UnrecoverableKeyException

从以下版本开始:

4.1

SSLSocketFactory

public SSLSocketFactory(TrustStrategy trustStrategy)
                 throws java.security.NoSuchAlgorithmException,
                        java.security.KeyManagementException,
                        java.security.KeyStoreException,
                        java.security.UnrecoverableKeyException

抛出:

java.security.NoSuchAlgorithmException

java.security.KeyManagementException

java.security.KeyStoreException

java.security.UnrecoverableKeyException

从以下版本开始:

4.1

SSLSocketFactory

public SSLSocketFactory(javax.net.ssl.SSLContext sslContext)

SSLSocketFactory

@Deprecated
public SSLSocketFactory(javax.net.ssl.SSLContext sslContext,
                           HostNameResolver nameResolver)

已过时。 Use SSLSocketFactory(SSLContext)

SSLSocketFactory

public SSLSocketFactory(javax.net.ssl.SSLContext sslContext,
                X509HostnameVerifier hostnameVerifier)

从以下版本开始:

4.1

SSLSocketFactory

public SSLSocketFactory(javax.net.ssl.SSLSocketFactory socketfactory,
                X509HostnameVerifier hostnameVerifier)

从以下版本开始:

4.2

方法详细资料

getSocketFactory

public static SSLSocketFactory getSocketFactory()
                                         throws SSLInitializationException

Gets the default factory, which uses the default JSSE settings for initializing the SSL context.

返回:

the default SSL socket factory

抛出:

SSLInitializationException

getSystemSocketFactory

public static SSLSocketFactory getSystemSocketFactory()
                                               throws SSLInitializationException

Gets the default factory, which uses system properties for initializing the SSL context as described in "JavaTM Secure Socket Extension (JSSE) Reference Guide for the JavaTM 2 Platform Standard Edition 5

The following system properties are taken into account by this method:

• ssl.TrustManagerFactory.algorithm
• javax.net.ssl.trustStoreType
• javax.net.ssl.trustStore
• javax.net.ssl.trustStoreProvider
• javax.net.ssl.trustStorePassword
• java.home
• ssl.KeyManagerFactory.algorithm
• javax.net.ssl.keyStoreType
• javax.net.ssl.keyStore
• javax.net.ssl.keyStoreProvider
• javax.net.ssl.keyStorePassword

返回:

the system SSL socket factory

抛出:

SSLInitializationException

createSocket

public java.net.Socket createSocket(HttpParams params)
                             throws java.io.IOException

从接口复制的说明: SchemeSocketFactory

Creates a new, unconnected socket. The socket should subsequently be passed to SchemeSocketFactory.connectSocket(Socket, InetSocketAddress, InetSocketAddress, HttpParams).

指定者:

createSocket 在接口中 SchemeSocketFactory

参数:

params - Optional parameters. Parameters passed to this method will have no effect. This method will create a unconnected instance of Socket class.

返回:

a new socket

抛出:

java.io.IOException - if an I/O error occurs while creating the socket

从以下版本开始:

4.1

createSocket

@Deprecated
public java.net.Socket createSocket()
                             throws java.io.IOException

已过时。

从接口复制的说明: SocketFactory

Creates a new, unconnected socket. The socket should subsequently be passed to connectSocket.

指定者:

createSocket 在接口中 SocketFactory

返回:

a new socket

抛出:

java.io.IOException - if an I/O error occurs while creating the socket

connectSocket

public java.net.Socket connectSocket(java.net.Socket socket,
                            java.net.InetSocketAddress remoteAddress,
                            java.net.InetSocketAddress localAddress,
                            HttpParams params)
                              throws java.io.IOException,
                                     java.net.UnknownHostException,
                                     ConnectTimeoutException

从接口复制的说明: SchemeSocketFactory

Connects a socket to the target host with the given remote address.

Please note that HttpInetSocketAddress class should be used in order to pass the target remote address along with the original HttpHost value used to resolve the address. The use of HttpInetSocketAddress can also ensure that no reverse DNS lookup will be performed if the target remote address was specified as an IP address.

指定者:

connectSocket 在接口中 SchemeSocketFactory

参数:

socket - the socket to connect, as obtained from createSocket. null indicates that a new socket should be created and connected.

remoteAddress - the remote address to connect to.

localAddress - the local address to bind the socket to, or null for any

params - additional parameters for connecting

返回:

the connected socket. The returned object may be different from the sock argument if this factory supports a layered protocol.

抛出:

java.io.IOException - if an I/O error occurs

java.net.UnknownHostException - if the IP address of the target host can not be determined

ConnectTimeoutException - if the socket cannot be connected within the time limit defined in the params

从以下版本开始:

4.1

另请参阅:

HttpInetSocketAddress

isSecure

public boolean isSecure(java.net.Socket sock)
                 throws java.lang.IllegalArgumentException

Checks whether a socket connection is secure. This factory creates TLS/SSL socket connections which, by default, are considered secure.
Derived classes may override this method to perform runtime checks, for example based on the cypher suite.

指定者:

isSecure 在接口中 SchemeSocketFactory

指定者:

isSecure 在接口中 SocketFactory

参数:

sock - the connected socket

返回:

true

抛出:

java.lang.IllegalArgumentException - if the argument is invalid

createLayeredSocket

public java.net.Socket createLayeredSocket(java.net.Socket socket,
                                  java.lang.String host,
                                  int port,
                                  HttpParams params)
                                    throws java.io.IOException,
                                           java.net.UnknownHostException

从接口复制的说明: SchemeLayeredSocketFactory

Returns a socket connected to the given host that is layered over an existing socket. Used primarily for creating secure sockets through proxies.

指定者:

createLayeredSocket 在接口中 SchemeLayeredSocketFactory

参数:

socket - the existing socket

host - the name of the target host.

port - the port to connect to on the target host

params - HTTP parameters

返回:

Socket a new socket

抛出:

java.io.IOException - if an I/O error occurs while creating the socket

java.net.UnknownHostException - if the IP address of the host cannot be determined

从以下版本开始:

4.2

createLayeredSocket

public java.net.Socket createLayeredSocket(java.net.Socket socket,
                                  java.lang.String host,
                                  int port,
                                  boolean autoClose)
                                    throws java.io.IOException,
                                           java.net.UnknownHostException

已过时。 use createLayeredSocket(Socket, String, int, HttpParams)

从接口复制的说明: LayeredSchemeSocketFactory

Returns a socket connected to the given host that is layered over an existing socket. Used primarily for creating secure sockets through proxies.

指定者:

createLayeredSocket 在接口中 LayeredSchemeSocketFactory

参数:

socket - the existing socket

host - the name of the target host.

port - the port to connect to on the target host

autoClose - a flag for closing the underling socket when the created socket is closed

返回:

Socket a new socket

抛出:

java.io.IOException - if an I/O error occurs while creating the socket

java.net.UnknownHostException - if the IP address of the host cannot be determined

setHostnameVerifier

@Deprecated
public void setHostnameVerifier(X509HostnameVerifier hostnameVerifier)

已过时。

getHostnameVerifier

public X509HostnameVerifier getHostnameVerifier()

connectSocket

@Deprecated
public java.net.Socket connectSocket(java.net.Socket socket,
                                       java.lang.String host,
                                       int port,
                                       java.net.InetAddress localAddress,
                                       int localPort,
                                       HttpParams params)
                              throws java.io.IOException,
                                     java.net.UnknownHostException,
                                     ConnectTimeoutException

已过时。 Use connectSocket(Socket, InetSocketAddress, InetSocketAddress, HttpParams)

从接口复制的说明: SocketFactory

Connects a socket to the given host.

指定者:

connectSocket 在接口中 SocketFactory

参数:

socket - the socket to connect, as obtained from createSocket. null indicates that a new socket should be created and connected.

host - the host to connect to

port - the port to connect to on the host

localAddress - the local address to bind the socket to, or null for any

localPort - the port on the local machine, 0 or a negative number for any

params - additional parameters for connecting

返回:

the connected socket. The returned object may be different from the sock argument if this factory supports a layered protocol.

抛出:

java.io.IOException - if an I/O error occurs

java.net.UnknownHostException - if the IP address of the target host can not be determined

ConnectTimeoutException - if the socket cannot be connected within the time limit defined in the params

createSocket

@Deprecated
public java.net.Socket createSocket(java.net.Socket socket,
                                      java.lang.String host,
                                      int port,
                                      boolean autoClose)
                             throws java.io.IOException,
                                    java.net.UnknownHostException

已过时。 Use createLayeredSocket(Socket, String, int, boolean)

从接口复制的说明: LayeredSocketFactory

Returns a socket connected to the given host that is layered over an existing socket. Used primarily for creating secure sockets through proxies.

指定者:

createSocket 在接口中 LayeredSocketFactory

参数:

socket - the existing socket

host - the host name/IP

port - the port on the host

autoClose - a flag for closing the underling socket when the created socket is closed

返回:

Socket a new socket

抛出:

java.io.IOException - if an I/O error occurs while creating the socket

java.net.UnknownHostException - if the IP address of the host cannot be determined

prepareSocket

protected void prepareSocket(javax.net.ssl.SSLSocket socket)
                      throws java.io.IOException

Performs any custom initialization for a newly created SSLSocket (before the SSL handshake happens). The default implementation is a no-op, but could be overriden to, e.g., call SSLSocket.setEnabledCipherSuites(java.lang.String[]).

抛出:

java.io.IOException

从以下版本开始:

4.2