|
| 1 | +# SSL/TLS Configuration |
| 2 | +[](https://mvnrepository.com/artifact/io.avaje/avaje-jex-ssl) |
| 3 | +[](https://javadoc.io/doc/io.avaje/avaje-jex-ssl) |
| 4 | + |
| 5 | +SSL plugin for configuring HTTPS with support for loading key stores, PEM certificates, and mutual TLS (mTLS). |
| 6 | + |
| 7 | +## Installation |
| 8 | + |
| 9 | +Add the SSL dependency to your project: |
| 10 | +```xml |
| 11 | +<dependency> |
| 12 | + <groupId>io.avaje</groupId> |
| 13 | + <artifactId>avaje-jex-ssl</artifactId> |
| 14 | + <version>${avaje.jex.version}</version> |
| 15 | +</dependency> |
| 16 | +``` |
| 17 | + |
| 18 | +## SSL Plugin |
| 19 | + |
| 20 | +The `SslPlugin` can be configured using a fluent configuration API: |
| 21 | +```java |
| 22 | +var sslPlugin = SslPlugin.create(config -> |
| 23 | + config.keystoreFromClasspath("keystore.p12", "password")); |
| 24 | + |
| 25 | +Jex.create() |
| 26 | + .plugin(sslPlugin) |
| 27 | + .get("/", ctx -> ctx.text("Hello Secure World")) |
| 28 | + .port(8443) |
| 29 | + .start(); |
| 30 | +``` |
| 31 | + |
| 32 | +## Key Store Configuration |
| 33 | + |
| 34 | +The SSL configuration supports loading key stores from multiple sources with optional separate identity passwords: |
| 35 | +```java |
| 36 | +var sslPlugin = SslPlugin.create(config -> { |
| 37 | + // From file system |
| 38 | + config.keystoreFromPath("/path/to/keystore.p12", "keystorePassword", "identityPassword"); |
| 39 | + |
| 40 | + // From classpath |
| 41 | + config.keystoreFromClasspath("ssl/keystore.jks", "password"); |
| 42 | + |
| 43 | + // From input stream |
| 44 | + config.keystoreFromInputStream(inputStream, "password"); |
| 45 | +}); |
| 46 | +``` |
| 47 | + |
| 48 | +## PEM Certificate Configuration |
| 49 | + |
| 50 | +For PEM-formatted certificates and private keys, the plugin supports various sources and optional private key passwords: |
| 51 | +```java |
| 52 | +var sslPlugin = SslPlugin.create(config -> { |
| 53 | + // From file system |
| 54 | + config.pemFromPath("/path/to/cert.pem", "/path/to/private-key.pem", "keyPassword"); |
| 55 | + |
| 56 | + // From classpath |
| 57 | + config.pemFromClasspath("ssl/certificate.pem", "ssl/private-key.pem"); |
| 58 | + |
| 59 | + // From strings (useful for environment variables or external config) |
| 60 | + config.pemFromString(certPemString, privateKeyPemString); |
| 61 | + |
| 62 | + // From input streams |
| 63 | + config.pemFromInputStream(certInputStream, keyInputStream, "password"); |
| 64 | +}); |
| 65 | +``` |
| 66 | + |
| 67 | +## Mutual TLS (mTLS) Configuration |
| 68 | + |
| 69 | +For client certificate authentication, configure trust settings using the `TrustConfig` interface: |
| 70 | +```java |
| 71 | +var sslPlugin = SslPlugin.create(config -> { |
| 72 | + // Configure server identity |
| 73 | + config.keystoreFromClasspath("server-keystore.p12", "serverPassword"); |
| 74 | + |
| 75 | + // Configure client certificate trust |
| 76 | + config.withTrustConfig(trust -> { |
| 77 | + // Trust specific client certificates |
| 78 | + trust.certificateFromClasspath("client-cert.pem") |
| 79 | + .certificateFromPath("/path/to/another-client-cert.crt"); |
| 80 | + |
| 81 | + // Or use a trust store |
| 82 | + trust.trustStoreFromClasspath("truststore.jks", "trustPassword"); |
| 83 | + |
| 84 | + // Mix different certificate formats |
| 85 | + trust.certificateFromString(pemCertString) |
| 86 | + .certificateFromInputStream(certInputStream); |
| 87 | + }); |
| 88 | +}); |
| 89 | +``` |
0 commit comments