Package org.postgresql.ssl

Class Pk8OrPemKeyManager

java.lang.Object

org.postgresql.ssl.Pk8OrPemKeyManager

All Implemented Interfaces:

KeyManager, X509KeyManager

public class Pk8OrPemKeyManager
extends Object
implements X509KeyManager

A key manager that selects PEM when its header is found within the first 64 KiB of the key file, and PK8/DER otherwise. This preserves libpq's preference for PEM before DER, while using a bounded marker scan rather than parsing the key during format detection.

The delegate is resolved lazily on the first call to any X509KeyManager method, so this works regardless of which method the TLS engine calls first.

Constructor Summary

Constructors

Constructor	Description
Pk8OrPemKeyManager(String keyFilePath, PEMKeyManager pem, LazyKeyManager pk8)

Method Summary

Modifier and Type	Method	Description
@Nullable String	chooseClientAlias(String[] keyType, Principal @Nullable [] issuers, @Nullable Socket socket)
@Nullable String	chooseServerAlias(String keyType, Principal @Nullable [] issuers, @Nullable Socket socket)
X509Certificate @Nullable []	getCertificateChain(String alias)
String @Nullable []	getClientAliases(String keyType, Principal @Nullable [] issuers)
@Nullable PrivateKey	getPrivateKey(String alias)
String @Nullable []	getServerAliases(String keyType, Principal @Nullable [] issuers)
void	throwKeyManagerException()	Propagates any exception from the resolved delegate key manager, including an insecure-permission error detected while probing the key file.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

Pk8OrPemKeyManager

public Pk8OrPemKeyManager(String keyFilePath,
 PEMKeyManager pem,
 LazyKeyManager pk8)

Method Details

getClientAliases

public String @Nullable [] getClientAliases(String keyType,
 Principal @Nullable [] issuers)

Specified by:

getClientAliases in interface X509KeyManager

chooseClientAlias

public @Nullable String chooseClientAlias(String[] keyType,
 Principal @Nullable [] issuers,
 @Nullable Socket socket)

Specified by:

chooseClientAlias in interface X509KeyManager

getServerAliases

public String @Nullable [] getServerAliases(String keyType,
 Principal @Nullable [] issuers)

Specified by:

getServerAliases in interface X509KeyManager

chooseServerAlias

public @Nullable String chooseServerAlias(String keyType,
 Principal @Nullable [] issuers,
 @Nullable Socket socket)

Specified by:

chooseServerAlias in interface X509KeyManager

getCertificateChain

public X509Certificate @Nullable [] getCertificateChain(String alias)

Specified by:

getCertificateChain in interface X509KeyManager

getPrivateKey

public @Nullable PrivateKey getPrivateKey(String alias)

Specified by:

getPrivateKey in interface X509KeyManager

throwKeyManagerException

public void throwKeyManagerException()
                              throws PSQLException

Propagates any exception from the resolved delegate key manager, including an insecure-permission error detected while probing the key file.

Throws:

PSQLException - if the delegate key manager has a stored exception