Package org.apache.cassandra.security

Class FileBasedSslContextFactory

java.lang.Object
org.apache.cassandra.security.AbstractSslContextFactory
org.apache.cassandra.security.FileBasedSslContextFactory
All Implemented Interfaces:
ISslContextFactory
Direct Known Subclasses:
DefaultSslContextFactory, PEMBasedSslContextFactory
public abstract class FileBasedSslContextFactory extends AbstractSslContextFactory
Abstract implementation for ISslContextFactory using file based, standard keystore format with the ability to hot-reload the files upon file changes (detected by the last modified timestamp).

CAUTION: While this is a useful abstraction, please be careful if you need to modify this class given possible custom implementations out there!

  • Field Details

  • Constructor Details

    • FileBasedSslContextFactory

      public FileBasedSslContextFactory()

    • FileBasedSslContextFactory

      public FileBasedSslContextFactory(Map<String,Object> parameters)

  • Method Details

    • shouldReload

      public boolean shouldReload()
      Description copied from interface: ISslContextFactory
      Returns if any changes require the reloading of the SSL context returned by this factory. This will be called by Cassandra's periodic polling for any potential changes that will reload the SSL context. However only newer connections established after the reload will use the reloaded SSL context.
      Returns:
      true if SSL Context needs to be reload; false otherwise

    • hasKeystore

      public boolean hasKeystore()
      Description copied from interface: ISslContextFactory
      Returns if this factory uses private keystore.
      Returns:
      true by default unless the implementation overrides this

    • hasOutboundKeystore

      public boolean hasOutboundKeystore()
      Description copied from interface: ISslContextFactory
      Returns if this factory uses outbound keystore.
      Returns:
      true by default unless the implementation overrides this

    • initHotReloading

      public void initHotReloading()
      Description copied from interface: ISslContextFactory
      Initializes hot reloading of the security keys/certs. The implementation must guarantee this to be thread safe.

    • validatePassword

      protected void validatePassword(boolean isOutboundKeystore, String password)
      Validates the given keystore password.
      Parameters:
      isOutboundKeystore - true for the outbound_keystore_password;false otherwise
      password - value
      Throws:
      IllegalArgumentException - if the password is null

    • buildKeyManagerFactory

      protected KeyManagerFactory buildKeyManagerFactory() throws SSLException
      Builds required KeyManagerFactory from the file based keystore. It also checks for the PrivateKey's certificate's expiry and logs warning for each expired PrivateKey's certitificate.
      Specified by:
      buildKeyManagerFactory in class AbstractSslContextFactory
      Returns:
      KeyManagerFactory built from the file based keystore.
      Throws:
      SSLException - if any issues encountered during the build process
      IllegalArgumentException - if the validation for the keystore_password fails
      See Also:

    • buildOutboundKeyManagerFactory

      protected KeyManagerFactory buildOutboundKeyManagerFactory() throws SSLException
      Description copied from class: AbstractSslContextFactory
      Create a KeyManagerFactory for outbound connections. It provides a seperate keystore for internode mTLS outbound connections.
      Specified by:
      buildOutboundKeyManagerFactory in class AbstractSslContextFactory
      Returns:
      KeyManagerFactory
      Throws:
      SSLException

    • buildTrustManagerFactory

      protected TrustManagerFactory buildTrustManagerFactory() throws SSLException
      Builds TrustManagerFactory from the file based truststore.
      Specified by:
      buildTrustManagerFactory in class AbstractSslContextFactory
      Returns:
      TrustManagerFactory from the file based truststore
      Throws:
      SSLException - if any issues encountered during the build process

    • checkExpiredCerts

      protected boolean checkExpiredCerts(KeyStore ks) throws KeyStoreException
      Throws:
      KeyStoreException