public static class SecurityConfig.Builder extends Object
Constructor and Description |
---|
Builder() |
Modifier and Type | Method and Description |
---|---|
SecurityConfig |
build()
Builds the
SecurityConfig out of this builder. |
SecurityConfig.Builder |
ciphers(List<String> ciphers)
Allows to customize the list of ciphers that is negotiated with the cluster.
|
SecurityConfig.Builder |
enableCertificateVerification(boolean certificateVerificationEnabled)
Pass false to bypass all TLS certificate verification checks.
|
SecurityConfig.Builder |
enableHostnameVerification(boolean hostnameVerificationEnabled)
Allows to enable or disable hostname verification (enabled by default).
|
SecurityConfig.Builder |
enableNativeTls(boolean nativeTlsEnabled)
Enables/disables native TLS (enabled by default).
|
SecurityConfig.Builder |
enableTls(boolean tlsEnabled)
Enables TLS for all client/server communication (disabled by default).
|
SecurityConfig.Builder |
trustCertificate(Path certificatePath)
Loads X.509 certificates from the file at the given path into the trust store.
|
SecurityConfig.Builder |
trustCertificates(List<X509Certificate> certificates)
Loads the given list of X.509 certificates into the trust store.
|
SecurityConfig.Builder |
trustManagerFactory(TrustManagerFactory trustManagerFactory)
Allows to provide a trust manager factory directly for maximum flexibility.
|
SecurityConfig.Builder |
trustStore(KeyStore trustStore)
Initializes the
TrustManagerFactory with the given trust store. |
SecurityConfig.Builder |
trustStore(Path trustStorePath,
String trustStorePassword,
Optional<String> trustStoreType)
Loads a trust store from a file path and password and initializes the
TrustManagerFactory . |
public SecurityConfig build()
SecurityConfig
out of this builder.public SecurityConfig.Builder enableTls(boolean tlsEnabled)
tlsEnabled
- true if enabled, false otherwise.SecurityConfig.Builder
for chaining purposes.public SecurityConfig.Builder enableHostnameVerification(boolean hostnameVerificationEnabled)
Note that disabling hostname verification will cause the TLS connection to not verify that the hostname/ip is actually part of the certificate and as a result not detect certain kinds of attacks. Only disable if you understand the impact and risks!
hostnameVerificationEnabled
- set to true if it should be enabled, false for disabled.SecurityConfig.Builder
for chaining purposes.@Stability.Volatile public SecurityConfig.Builder enableCertificateVerification(boolean certificateVerificationEnabled)
trustManagerFactory(TrustManagerFactory)
with an argument of InsecureTrustManagerFactory.INSTANCE
.
Certificate verification is enabled by default.
Certificate verification must never be disabled in a production environment, and should be disabled in
development only if there is no better solution. The better solution is almost always to specify
the CA certificate(s) to trust, by calling trustCertificate(Path)
or some variant.
See also enableHostnameVerification(boolean)
, which can selectively disable just hostname verification.
certificateVerificationEnabled
- Pass false to set the trust manager factory to InsecureTrustManagerFactory.INSTANCE
,
and bypass all TLS certificate verification checks.SecurityConfig.Builder
for chaining purposes.public SecurityConfig.Builder enableNativeTls(boolean nativeTlsEnabled)
nativeTlsEnabled
- true if it should be enabled, false otherwise.SecurityConfig.Builder
for chaining purposes.public SecurityConfig.Builder trustCertificates(List<X509Certificate> certificates)
certificates
- the list of certificates to load.SecurityConfig.Builder
for chaining purposes.public SecurityConfig.Builder trustCertificate(Path certificatePath)
TIP: If you have multiple certificate files in PEM format (for example, "cert1.pem" and "cert2.pem"), and you want to create a single PEM file containing all the certificates, concatenate the PEM files using this shell command:
$ cat cert1.pem cert2.pem > both-certs.pemThen, when configuring the SDK, call this method with the path to `both-certs.pem` as the argument.
certificatePath
- the file to load the certificates from.SecurityConfig.Builder
for chaining purposes.public SecurityConfig.Builder trustManagerFactory(TrustManagerFactory trustManagerFactory)
While providing the most flexibility, most users will find the other overloads more convenient, like passing
in a trustStore(KeyStore)
directly or via filepath trustStore(Path, String, Optional)
.
trustManagerFactory
- the trust manager factory to use.SecurityConfig.Builder
for chaining purposes.public SecurityConfig.Builder trustStore(KeyStore trustStore)
TrustManagerFactory
with the given trust store.trustStore
- the loaded trust store to use.SecurityConfig.Builder
for chaining purposes.public SecurityConfig.Builder trustStore(Path trustStorePath, String trustStorePassword, Optional<String> trustStoreType)
TrustManagerFactory
.trustStorePath
- the path to the truststore.trustStorePassword
- the password (can be null if not password protected).trustStoreType
- the type of the trust store. If empty, the KeyStore.getDefaultType()
will be used.SecurityConfig.Builder
for chaining purposes.public SecurityConfig.Builder ciphers(List<String> ciphers)
Note that this method is considered advanced API, please only customize the cipher list if you know what you are doing (for example if you want to shrink the cipher list down to a very specific subset for security or compliance reasons).
If no custom ciphers are configured, the default set will be used.
If you wish to add additional ciphers instead of providing an exclusive list, you can use the static
SecurityConfig.defaultCiphers(boolean)
method to load the default list first, add your own ciphers and then
pass it into this method.
ciphers
- the custom list of ciphers to use.SecurityConfig.Builder
for chaining purposes.Copyright © 2024 Couchbase, Inc.. All rights reserved.