Package dev.relism.flash.tls

Class TlsConfig

java.lang.Object
dev.relism.flash.tls.TlsConfig
public final class TlsConfig extends Object
Declarative TLS configuration for a FlashConfiguration.Listener.

Two ways in

  • keystore(Path, String) — Flash builds the SSLContext from a PKCS12/JKS keystore. A keystore holding more than one certificate entry gets SNI-based selection for free (see SniKeyManager) — no per-hostname config needed. Flash also pins TLSv1.2/TLSv1.3 as the enabled protocols; cipher suites are left at the JDK's own curated default, which each JDK security release keeps current — Flash does not maintain its own suite allow-list.
  • ofContext(SSLContext) — escape hatch. The given SSLContext is used exactly as built: Flash never calls setSSLParameters on this path unless you explicitly call applicationProtocols or clientAuth yourself, so anything else you configured on it is 100% authoritative.

clientAuth(ClientAuth) and applicationProtocols(String...) apply on either path — they are explicit instructions through this API, not Flash-chosen defaults, so each is only ever applied when called. Neither has a value by default, on either path.

ALPN (e.g. TLS-ALPN-01 / RFC 8737)

applicationProtocols(String...) sets the listener's negotiable protocol list via SSLParameters.setApplicationProtocols(java.lang.String[]), inherited by every accepted socket exactly like ClientAuth — no per-connection code needed. ALPN is resolved during ClientHello processing/ServerHello production, which always precedes Certificate production — so a custom X509ExtendedKeyManager deciding which certificate to serve can read the client's negotiated protocol via engine.getHandshakeApplicationProtocol() (or ((SSLSocket) socket).getHandshakeApplicationProtocol()) inside chooseEngineServerAlias/chooseServerAlias and it is already resolved by then.

  • Method Details

    • keystore

      public static TlsConfig keystore(Path path, String password)
      Builds an SSLContext from a PKCS12/JKS keystore — type is guessed from the file extension (.jks means JKS, anything else PKCS12). The private-key password is assumed equal to the store password, the common case for PKCS12.

    • ofContext

      public static TlsConfig ofContext(SSLContext context)
      Escape hatch — see class Javadoc. Flash applies nothing to the socket beyond what you explicitly call (clientAuth/applicationProtocols) on this instance.

    • clientAuth

      public TlsConfig clientAuth(ClientAuth mode)
      Client-certificate requirement. Applies on either construction path — see class Javadoc.

    • applicationProtocols

      public TlsConfig applicationProtocols(String... protocols)
      ALPN protocols this listener negotiates, in preference order (e.g. "acme-tls/1", "http/1.1"). Applies on either construction path — see class Javadoc for how a custom KeyManager observes the negotiated value.

    • enableHttp2Alpn

      public TlsConfig enableHttp2Alpn()
      Returns this TLS configuration with HTTP/2 enabled and HTTP/1.1 retained as fallback.

    • serverSocketFactory

      public SSLServerSocketFactory serverSocketFactory()

    • applyTo

      public void applyTo(SSLServerSocket socket)

    • negotiatesH2

      public boolean negotiatesH2()
      Whether this listener's configured ALPN protocol list (applicationProtocols) includes "h2". Lets a caller (the connection runner, for logging; applyTo(javax.net.ssl.SSLServerSocket) duplicating the offered-protocols check.