Package io.kroxylicious.proxy.tls

Interface ServerTlsCredentialSupplierContext

public interface ServerTlsCredentialSupplierContext

Runtime context provided to ServerTlsCredentialSupplier instances when TLS credentials are requested.

This context provides access to runtime information and a factory method for creating validated TlsCredentials instances from JDK cryptographic objects. The context is implemented by the Kroxylicious runtime and passed to the supplier's ServerTlsCredentialSupplier.tlsCredentials(ServerTlsCredentialSupplierContext) method.

Usage Example


 public class MyCredentialSupplier implements ServerTlsCredentialSupplier {
     private final PrivateKey defaultKey;
     private final X509Certificate[] defaultChain;

     @Override
     public CompletionStage<TlsCredentials> tlsCredentials(ServerTlsCredentialSupplierContext context) {
         TlsCredentials creds = context.tlsCredentials(defaultKey, defaultChain);
         return CompletableFuture.completedFuture(creds);
     }
 }

  • Method Details

    • clientTlsContext

      @NonNull Optional<ClientTlsContext> clientTlsContext()

      Returns TLS information about the client-to-proxy connection, if available.

      This provides access to the client's TLS certificate (if client authentication was performed) and the proxy's server certificate that was presented to the client. This information can be used to make credential selection decisions based on client identity or other TLS handshake data.

      Returns:
      Optional containing the client TLS context, or empty if TLS is not in use or if the handshake has not yet completed

    • tlsCredentials

      @NonNull TlsCredentials tlsCredentials(@NonNull PrivateKey key, @NonNull X509Certificate[] certificateChain)

      Creates a TlsCredentials instance from the given private key and certificate chain.

      This factory method validates the provided credentials before creating the TlsCredentials instance. The validation ensures that:

      • The certificate chain is structurally valid
      • The private key matches the leaf certificate's public key

      The plugin is responsible for loading and parsing the credentials from whatever source and format it uses (PEM files, PKCS12 keystores, HSMs, etc.).

      Parameters:
      key - The private key corresponding to the leaf certificate.
      certificateChain - The certificate chain, starting with the leaf certificate and including any intermediate certificates up to (but not including) the root CA.
      Returns:
      Validated TlsCredentials instance
      Throws:
      IllegalArgumentException - if the key does not match the certificate or the chain is invalid