Package org.apache.solr.util

Class SSLTestConfig

java.lang.Object
org.apache.solr.util.SSLTestConfig
public class SSLTestConfig extends Object
An SSLConfig that provides SSLConfig for both clients and servers that supports reading key/trust store information directly from resource files provided with the Solr test-framework classes

  • Constructor Details

    • SSLTestConfig

      public SSLTestConfig()
      Creates an SSLTestConfig that does not use SSL or client authentication

    • SSLTestConfig

      public SSLTestConfig(boolean useSsl, boolean clientAuth)
      Create an SSLTestConfig based on a few caller specified options, implicitly assuming checkPeerName=false.

      As needed, keystore/truststore information will be pulled from a hardcoded resource file provided by the solr test-framework

      Parameters:
      useSsl - - whether SSL should be required.
      clientAuth - - whether client authentication should be required.

    • SSLTestConfig

      public SSLTestConfig(boolean useSsl, boolean clientAuth, boolean checkPeerName)
      Create an SSLTestConfig based on a few caller specified options. As needed, keystore/truststore information will be pulled from a hardcoded resource files provided by the solr test-framework based on the value of checkPeerName:
      • true - A keystore resource file will be used that specifies a CN of localhost and a SAN IP of 127.0.0.1, to ensure that all connections should be valid regardless of what machine runs the tests.
      • false - A keystore resource file will be used that specifies a bogus hostname in the CN and reserved IP as the SAN, since no (valid) tests using this SSLTestConfig should care what CN/SAN are.
      Parameters:
      useSsl - - whether SSL should be required.
      clientAuth - - whether client authentication should be required.
      checkPeerName - - whether the client should validate the 'peer name' of the SSL Certificate (and which testing Cert should be used)
      See Also:
      • SolrHttpConstants.SYS_PROP_CHECK_PEER_NAME

  • Method Details

    • getCheckPeerName

      public boolean getCheckPeerName()
      If true, then servers hostname/ip should be validated against the SSL Cert metadata

    • isSSLMode

      public boolean isSSLMode()
      All other settings on this object are ignored unless this is true

    • isClientAuthMode

      public boolean isClientAuthMode()

    • buildClientSSLContext

      public SSLContext buildClientSSLContext() throws KeyManagementException, UnrecoverableKeyException, NoSuchAlgorithmException, KeyStoreException
      Builds a new SSLContext for HTTP clients to use when communicating with servers which have been configured based on the settings of this object.

      NOTE: Uses a completely insecure SecureRandom instance to prevent tests from blocking due to lack of entropy, also explicitly allows the use of self-signed certificates (since that's what is almost always used during testing).

      Throws:
      KeyManagementException
      UnrecoverableKeyException
      NoSuchAlgorithmException
      KeyStoreException

    • buildClientSSLConfig

      public org.apache.solr.client.solrj.jetty.SSLConfig buildClientSSLConfig()

    • buildServerSSLConfig

      public org.apache.solr.client.solrj.jetty.SSLConfig buildServerSSLConfig()
      Builds a new SSLContext for jetty servers which have been configured based on the settings of this object.

      NOTE: Uses a completely insecure SecureRandom instance to prevent tests from blocking due to lack of entropy, also explicitly allows the use of self-signed certificates (since that's what is almost always used during testing).

    • defaultKeyStore

      public KeyStore defaultKeyStore()

    • defaultKeyStorePassword

      public String defaultKeyStorePassword()

    • notSecureSecureRandom

      public SecureRandom notSecureSecureRandom()