ssl.context.factory.class

_context_factory:
        class_name: org.apache.cassandra.security.YourSslContextFactoryImpl
        parameters:
          key1: "value1"
          key2: "value2"
          key3: "value3"

package org.apache.cassandra.security;

import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLException;

import io.netty.handler.ssl.CipherSuiteFilter;
import io.netty.handler.ssl.SslContext;
import org.apache.cassandra.config.EncryptionOptions;

/**
 * The purpose of this interface is to provide pluggable mechanism for creating custom JSSE and Netty SSLContext
* objects.
 * Please use the Cassandra configuration key {@code ssl._context._factory.class} and provide a custom class-name
 * implementing this interface with parameters to be used to plugin a your own way to load the SSLContext.
*
* Implementation of this interface must have a constructor with argument of type {@code Map<String,String>} to allow
*
  custom parameters to be passed from the Cassandra yaml configuration.
*
* Since on top of Netty, Cassandra is internally using JSSE SSLContext also for certain use-cases- this interface
 * has methods for both.
 */
public interface SslContextFactory
{
    /**

* Below is an example of how to configure a custom implementation with parameters
* <pre>
* ssl_context_factory:
*   class_name: org.apache.cassandra.security.YourSslContextFactoryImpl
*   parameters:
*     key1: "value1"
*    Creates JSSE SSLContext.
key2: "value2"
*     key3: "value3"
* </pre>
*/
public interface ISslContextFactory
{
/**
* Creates JSSE SSLContext.
*
* @param options EncryptionOptions that could be used for the SSL context creation
     * @param buildTruststore {@code true} if the caller requires Truststore; {@code false} otherwise
* @return
* @throws SSLException in case *the @return
Ssl Context creation fails for some reason
*/
    SSLContext createJSSESslContext(EncryptionOptions options, boolean buildTruststore) throws SSLException;

    /**
     * Creates Netty's SslContext object.
     *
     * @param options EncryptionOptions that could be used for the SSL context creation
     * @param buildTruststore {@code true} if the caller requires Truststore; {@code false} otherwise
     * @param socketType {@link SocketType} for Netty's Inbound or Outbound channels
* @param useOpenSsl {@code true} if openSsl is enabled;{@code false} otherwise
* @param cipherFilter to allow Netty's cipher suite filtering, e.g.
     * {@link io.netty.handler.ssl.SslContextBuilder#ciphers(Iterable, CipherSuiteFilter)}
* @return
* @throws SSLException in case the *Ssl @return
Context creation fails for some reason
*/
    SslContext createNettySslContext(EncryptionOptions options, boolean buildTruststore, SocketType socketType,
 boolean useOpenSsl, CipherSuiteFilter cipherFilter) throws SSLException;

/**
* Initializes hot reloading of the security keys/certs. The implementation must guarantee this to be thread safe.
* @param serverOpts Server encryption options (Internode)
* @param clientOpts Client encryption options (Native Protocol)
* @throws CipherSuiteFilter cipherFilter);

    SSLException
*/
void initHotReloading(EncryptionOptions.ServerEncryptionOptions serverOpts, EncryptionOptions clientOpts) throws SSLException;
/**
     * Returns if any changes require the reloading of the SSL context returned by this factory.
     * This will be called by Cassandra's periodic polling for any potential changes that will reload the SSL context
     * . However only newer connections established after the reload will use the reloaded SSL context.
     * @return
     */
    boolean shouldReload();

    /**
* Indicates if the process *holds SocketTypethe toinbound/listening differentiateend Serverof andthe Client. This is primarily used for Netty's Inbound and Outbound channels.
     */
    socket ({@link SSLFactory.SocketType#SERVER})), or the
* outbound side ({@link SSLFactory.SocketType#CLIENT}).
*/
enum SocketType {
        SERVER, CLIENT;
    }
}