Package org.apache.cassandra.security

Class PEMBasedSslContextFactory

  • All Implemented Interfaces:
    ISslContextFactory
    public final class PEMBasedSslContextFactory
extends FileBasedSslContextFactory
    SslContextFactory for the PEM standard encoded PKCS#8 private keys and X509 certificates/public-keys. It parses the key material based on the standard defined in the RFC 7468. It creates PKCS# 8 based private key and X509 certificate(s) for the public key to build the required keystore and the truststore managers that are used for the SSL context creation. Internally it builds Java KeyStore with PKCS# 12 store type to be used for keystore and the truststore managers.

    This factory also supports 'hot reloading' of the key material, the same way as defined by FileBasedSslContextFactory, if it is file based. This factory ignores the existing 'store_type' configuration used for other file based store types like JKS.

    You can configure this factory with either inline PEM data or with the files having the required PEM data as shown below, Configuration: PEM keys/certs defined inline (mind the spaces in the YAML!) 

         client/server_encryption_options:
      ssl_context_factory:
         class_name: org.apache.cassandra.security.PEMBasedSslContextFactory
         parameters:
             private_key: |
              -----BEGIN ENCRYPTED PRIVATE KEY----- OR -----BEGIN PRIVATE KEY-----
              
              -----END ENCRYPTED PRIVATE KEY----- OR -----END PRIVATE KEY-----
              -----BEGIN CERTIFICATE-----
              
              -----END CERTIFICATE-----

             private_key_password: ""

             trusted_certificates: |
               -----BEGIN CERTIFICATE-----
               
               -----END CERTIFICATE-----
    Configuration: PEM keys/certs defined in files 
         client/server_encryption_options:
      ssl_context_factory:
         class_name: org.apache.cassandra.security.PEMBasedSslContextFactory
      keystore: 
      keystore_password: ""
      truststore:

    • Field Detail

      • DEFAULT_TARGET_STORETYPE

        public static final java.lang.String DEFAULT_TARGET_STORETYPE
        See Also:
        Constant Field Values

    • Constructor Detail

      • PEMBasedSslContextFactory

        public PEMBasedSslContextFactory()

      • PEMBasedSslContextFactory

        public PEMBasedSslContextFactory​(java.util.Map<java.lang.String,​java.lang.Object> parameters)

    • Method Detail

      • hasKeystore

        public boolean hasKeystore()
        Decides if this factory has a keystore defined - key material specified in files or inline to the configuration.
        Specified by:
        hasKeystore in interface ISslContextFactory
        Overrides:
        hasKeystore in class FileBasedSslContextFactory
        Returns:
        true if there is a keystore defined; false otherwise

      • buildKeyManagerFactory

        protected javax.net.ssl.KeyManagerFactory buildKeyManagerFactory()
                                                          throws javax.net.ssl.SSLException
        Builds required KeyManagerFactory from the PEM based keystore. It also checks for the PrivateKey's certificate's expiry and logs warning for each expired PrivateKey's certitificate.
        Overrides:
        buildKeyManagerFactory in class FileBasedSslContextFactory
        Returns:
        KeyManagerFactory built from the PEM based keystore.
        Throws:
        javax.net.ssl.SSLException - if any issues encountered during the build process

      • buildTrustManagerFactory

        protected javax.net.ssl.TrustManagerFactory buildTrustManagerFactory()
                                                              throws javax.net.ssl.SSLException
        Builds TrustManagerFactory from the PEM based truststore.
        Overrides:
        buildTrustManagerFactory in class FileBasedSslContextFactory
        Returns:
        TrustManagerFactory from the PEM based truststore
        Throws:
        javax.net.ssl.SSLException - if any issues encountered during the build process