sbordet
commented
1 year ago The ConnectionFactory that drives the TLS handshake to the end for the ACME client challenge.
public class ACMETLS1ServerConnectionFactory extends AbstractConnectionFactory
{
public ACMETLS1ServerConnectionFactory()
{
super("acme-tls/1");
}
@Override
public Connection newConnection(Connector connector, EndPoint endPoint)
{
EndPoint current = endPoint;
SslConnection.DecryptedEndPoint sslEndPoint = null;
while (true)
{
if (current instanceof SslConnection.DecryptedEndPoint)
{
sslEndPoint = (SslConnection.DecryptedEndPoint)current;
break;
}
else if (current instanceof EndPoint.Wrapper)
{
current = ((EndPoint.Wrapper)endPoint).unwrap();
}
else
{
throw new IllegalArgumentException("Invalid ConnectionFactory configuration");
}
}
ACMETLS1ServerConnection connection = new ACMETLS1ServerConnection(connector, endPoint);
sslEndPoint.getSslConnection().addHandshakeListener(connection);
return configure(connection, connector, endPoint);
}
private static class ACMETLS1ServerConnection extends AbstractConnection implements SslHandshakeListener
{
private boolean handshakeComplete;
public ACMETLS1ServerConnection(Connector connector, EndPoint endPoint)
{
super(endPoint, connector.getExecutor());
}
@Override
public void onOpen()
{
super.onOpen();
fillInterested();
}
@Override
public void onFillable()
{
try
{
// Advance the TLS handshake until it's completed.
int filled = getEndPoint().fill(BufferUtil.EMPTY_BUFFER);
if (filled < 0)
close();
else if (!handshakeComplete)
fillInterested();
}
catch (IOException x)
{
getEndPoint().close(x);
}
}
@Override
public void handshakeSucceeded(Event event) throws SSLException
{
handshakeComplete = true;
// After the handshake is succeeded, the client has the
// ACME certificate and the connection can be closed.
close();
}
@Override
public void handshakeFailed(Event event, Throwable failure)
{
handshakeComplete = true;
getEndPoint().close(failure);
}
}
}
Maurice-Betzel
github-actions[bot]
cowwoc
Jetty version(s) 10+
Enhancement Description RFC 8737 describes a method to validate domain names via the
tls-alpn-01challenge.Upon the request for a new certificate, or renew of expired ones, for an origin server, an ACME client performs a challenge, by connecting to the origin server with
alpn=acme-tls/1. The server should reply with a specific certificate as defined in the RFC (this requires wrapping theKeyManagerto identify the right alias for the specific ALPN protocol). Once the client has the right certificate, it can contact the CA and download the CA-signed new, or renewed, certificate. The downloaded certificate can be stored in a KeyStore, and the existingKeyStoreScannerfunctionality can reload the KeyStore on-the-fly without having to restart the origin server.