Package org.mozilla.jss
Class InitializationValues
- java.lang.Object
-
- org.mozilla.jss.InitializationValues
-
public final class InitializationValues extends java.lang.Object
The various options that can be used to initialize CryptoManager.
-
-
Nested Class Summary
Nested Classes Modifier and Type Class Description static class
InitializationValues.FIPSMode
This class enumerates the possible modes for FIPS compliance.
-
Field Summary
Fields Modifier and Type Field Description java.lang.String
certPrefix
java.lang.String
configDir
boolean
cooperate
Sets 4 recommended options for applications that use both NSS and the Java SunPKCS11 provider.InitializationValues.FIPSMode
fipsMode
The FIPS mode of the security library.boolean
forceOpen
Continue to force initializations even if the databases cannot be opened.boolean
initializeContext
boolean
initializeJavaOnly
Iftrue
, none of the underlying NSS components will be initialized.boolean
installJSSProvider
Install the JSS crypto provider.boolean
installJSSProviderFirst
Whether or not to initialize the JSS provider first.java.lang.String
keyPrefix
int
LIBRARY_LENGTH
Library description must be this length exactly.int
MANUFACTURER_LENGTH
ManufacturerID must be this length exactly.boolean
noCertDB
Don't open the cert DB and key DB's, just initialize the volatile certdb.boolean
noModDB
Don't open the security module DB, just initialize the PKCS #11 module.boolean
noPK11Finalize
never call C_Finalize on any PKCS#11 module.boolean
noRootInit
Don't try to look for the root certs module automatically.boolean
ocspCheckingEnabled
To have NSS check the OCSP responder for when verifying certificates, set this flags to true.java.lang.String
ocspResponderCertNickname
The nickname of the cert to trust (expected) to sign the OCSP responses.java.lang.String
ocspResponderURL
Specify the location and cert of the responder.boolean
optimizeSpace
Use smaller tables and caches.PasswordCallback
passwordCallback
The password callback to be used by JSS whenever a password is needed.boolean
PK11Reload
Init PK11Reload to ignore the CKR_CRYPTOKI_ALREADY_INITIALIZED error when loading PKCS#11 modules.boolean
PK11ThreadSafe
only load PKCS#11 modules that are thread-safe, ie. that support locking - either OS locking or NSS-provided locks .boolean
PKIXVerify
Enable PKIX verify rather than the old cert library, to verify certificates.boolean
readOnly
To open the databases in read-only mode, set this flag totrue
.boolean
removeSunProvider
Remove the Sun crypto provider.java.lang.String
secmodName
int
SLOT_LENGTH
Slot names must be this length exactly.int
TOKEN_LENGTH
Token names must be this length exactly.
-
Constructor Summary
Constructors Modifier Constructor Description protected
InitializationValues()
InitializationValues(java.lang.String configDir)
Default constructor taking only the path to the NSS DB directory.InitializationValues(java.lang.String configDir, java.lang.String certPrefix, java.lang.String keyPrefix, java.lang.String secmodName)
Optional constructor taking the path to the NSS DB directory, the prefix of the cert database, the prefix of the key database, and the name of the secmod/pkcs11 database.
-
Method Summary
All Methods Instance Methods Concrete Methods Modifier and Type Method Description java.lang.String
getFIPSKeyStorageSlotDescription()
Returns the description of the internal PKCS #11 FIPS Key Storage slot.java.lang.String
getFIPSSlotDescription()
Returns the description of the internal PKCS #11 FIPS slot.boolean
getInitializeContext()
Returns boolean value of initializeContext.java.lang.String
getInternalKeyStorageSlotDescription()
Returns the description of the internal PKCS #11 key storage slot.java.lang.String
getInternalKeyStorageTokenDescription()
Returns the description of the internal PKCS #11 key storage token.java.lang.String
getInternalSlotDescription()
Returns the description of the internal PKCS #11 slot.java.lang.String
getInternalTokenDescription()
Returns the description of the internal PKCS #11 token.java.lang.String
getLibraryDescription()
Returns the description of the internal PKCS #11 module.java.lang.String
getManufacturerID()
Returns the Manufacturer ID of the internal PKCS #11 module.void
setFIPSKeyStorageSlotDescription(java.lang.String s)
Sets the description of the internal PKCS #11 FIPS Key Storage slot.void
setFIPSSlotDescription(java.lang.String s)
Sets the description of the internal PKCS #11 FIPS slot.void
setInitializeContext(boolean value)
Sets boolean value of initializeContext.void
setInternalKeyStorageSlotDescription(java.lang.String s)
Sets the description of the internal PKCS #11 key storage slot.void
setInternalKeyStorageTokenDescription(java.lang.String s)
Sets the description of the internal PKCS #11 key storage token.void
setInternalSlotDescription(java.lang.String s)
Sets the description of the internal PKCS #11 slot.void
setInternalTokenDescription(java.lang.String s)
Sets the description of the internal PKCS #11 token.void
setLibraryDescription(java.lang.String s)
Sets the description of the internal PKCS #11 module.void
setManufacturerID(java.lang.String s)
Sets the Manufacturer ID of the internal PKCS #11 module.
-
-
-
Field Detail
-
TOKEN_LENGTH
public final int TOKEN_LENGTH
Token names must be this length exactly.- See Also:
- Constant Field Values
-
SLOT_LENGTH
public final int SLOT_LENGTH
Slot names must be this length exactly.- See Also:
- Constant Field Values
-
MANUFACTURER_LENGTH
public final int MANUFACTURER_LENGTH
ManufacturerID must be this length exactly.- See Also:
- Constant Field Values
-
LIBRARY_LENGTH
public final int LIBRARY_LENGTH
Library description must be this length exactly.- See Also:
- Constant Field Values
-
configDir
public java.lang.String configDir
-
certPrefix
public java.lang.String certPrefix
-
keyPrefix
public java.lang.String keyPrefix
-
secmodName
public java.lang.String secmodName
-
passwordCallback
public PasswordCallback passwordCallback
The password callback to be used by JSS whenever a password is needed. May be NULL, in which the library will immediately fail to get a password if it tries to login automatically while performing a cryptographic operation. It will still work if the token has been manually logged in withCryptoToken.login
.The default is a
ConsolePasswordCallback
.
-
fipsMode
public InitializationValues.FIPSMode fipsMode
The FIPS mode of the security library. Servers should useFIPSMode.UNCHANGED
, since only Admin Server is supposed to alter this value.The default is
FIPSMode.UNCHANGED
.
-
readOnly
public boolean readOnly
To open the databases in read-only mode, set this flag totrue
. The default isfalse
, meaning the databases are opened in read-write mode.
-
initializeContext
public boolean initializeContext
-
ocspCheckingEnabled
public boolean ocspCheckingEnabled
To have NSS check the OCSP responder for when verifying certificates, set this flags to true. It is false by default.
-
ocspResponderURL
public java.lang.String ocspResponderURL
Specify the location and cert of the responder. If OCSP checking is enabled *and* this variable is set to some URL, all OCSP checking will be done via this URL. If this variable is null, the OCSP responder URL will be obtained from the AIA extension in the certificate being queried. If this is set, you must also set ocspResponderCertNickname
-
ocspResponderCertNickname
public java.lang.String ocspResponderCertNickname
The nickname of the cert to trust (expected) to sign the OCSP responses. Only checked when the OCSPResponder value is set.
-
installJSSProvider
public boolean installJSSProvider
Install the JSS crypto provider. Default is true.
-
removeSunProvider
public boolean removeSunProvider
Remove the Sun crypto provider. Default is false.
-
installJSSProviderFirst
public boolean installJSSProviderFirst
Whether or not to initialize the JSS provider first. Default is true.
-
initializeJavaOnly
public boolean initializeJavaOnly
Iftrue
, none of the underlying NSS components will be initialized. Only the Java portions of JSS will be initialized. This should only be used if NSS has been initialized elsewhere.Specifically, the following components will not be configured by
CryptoManager.initialize
if this flag is set:- The NSS databases.
- OCSP checking.
- The NSS password callback.
- The internal PKCS #11 software token's identifier labels: slot, token, module, and manufacturer.
- The minimum PIN length for the software token.
- The frequency with which the user must login to the software token.
- The cipher strength policy (export/domestic).
The default is
false
.
-
PKIXVerify
public boolean PKIXVerify
Enable PKIX verify rather than the old cert library, to verify certificates. Default is false.
-
noCertDB
public boolean noCertDB
Don't open the cert DB and key DB's, just initialize the volatile certdb. Default is false.
-
noModDB
public boolean noModDB
Don't open the security module DB, just initialize the PKCS #11 module. Default is false.
-
forceOpen
public boolean forceOpen
Continue to force initializations even if the databases cannot be opened. Default is false.
-
noRootInit
public boolean noRootInit
Don't try to look for the root certs module automatically. Default is false.
-
optimizeSpace
public boolean optimizeSpace
Use smaller tables and caches. Default is false.
-
PK11ThreadSafe
public boolean PK11ThreadSafe
only load PKCS#11 modules that are thread-safe, ie. that support locking - either OS locking or NSS-provided locks . If a PKCS#11 module isn't thread-safe, don't serialize its calls; just don't load it instead. This is necessary if another piece of code is using the same PKCS#11 modules that NSS is accessing without going through NSS, for example the Java SunPKCS11 provider. Default is false.
-
PK11Reload
public boolean PK11Reload
Init PK11Reload to ignore the CKR_CRYPTOKI_ALREADY_INITIALIZED error when loading PKCS#11 modules. This is necessary if another piece of code is using the same PKCS#11 modules that NSS is accessing without going through NSS, for example Java SunPKCS11 provider. Default is false.
-
noPK11Finalize
public boolean noPK11Finalize
never call C_Finalize on any PKCS#11 module. This may be necessary in order to ensure continuous operation and proper shutdown sequence if another piece of code is using the same PKCS#11 modules that NSS is accessing without going through NSS, for example Java SunPKCS11 provider. The following limitation applies when this is set : SECMOD_WaitForAnyTokenEvent will not use C_WaitForSlotEvent, in order to prevent the need for C_Finalize. This call will be emulated instead. Default is false.
-
cooperate
public boolean cooperate
Sets 4 recommended options for applications that use both NSS and the Java SunPKCS11 provider. Default is false.
-
-
Constructor Detail
-
InitializationValues
protected InitializationValues()
-
InitializationValues
public InitializationValues(java.lang.String configDir)
Default constructor taking only the path to the NSS DB directory.
-
InitializationValues
public InitializationValues(java.lang.String configDir, java.lang.String certPrefix, java.lang.String keyPrefix, java.lang.String secmodName)
Optional constructor taking the path to the NSS DB directory, the prefix of the cert database, the prefix of the key database, and the name of the secmod/pkcs11 database.
-
-
Method Detail
-
getInitializeContext
public boolean getInitializeContext()
Returns boolean value of initializeContext.The default is
"false "
.- Returns:
- initializeContext.
-
setInitializeContext
public void setInitializeContext(boolean value)
Sets boolean value of initializeContext.- Parameters:
value
- of initializeContext.
-
getManufacturerID
public java.lang.String getManufacturerID()
Returns the Manufacturer ID of the internal PKCS #11 module.The default is
"mozilla.org "
.- Returns:
- Manufacturer ID.
-
setManufacturerID
public void setManufacturerID(java.lang.String s) throws InvalidLengthException
Sets the Manufacturer ID of the internal PKCS #11 module. This value must be exactlyMANUFACTURER_LENGTH
characters long.- Parameters:
s
- Manufacturer ID.- Throws:
InvalidLengthException
- Ifs.length()
is not exactlyMANUFACTURER_LENGTH
.
-
getLibraryDescription
public java.lang.String getLibraryDescription()
Returns the description of the internal PKCS #11 module.The default is
"Internal Crypto Services "
.- Returns:
- Library description.
-
setLibraryDescription
public void setLibraryDescription(java.lang.String s) throws InvalidLengthException
Sets the description of the internal PKCS #11 module. This value must be exactlyLIBRARY_LENGTH
characters long.- Parameters:
s
- Library description.- Throws:
InvalidLengthException
- Ifs.length()
is not exactlyLIBRARY_LENGTH
.
-
getInternalTokenDescription
public java.lang.String getInternalTokenDescription()
Returns the description of the internal PKCS #11 token.The default is
"Internal Crypto Services Token "
.- Returns:
- Description of internal PKCS #11 token.
-
setInternalTokenDescription
public void setInternalTokenDescription(java.lang.String s) throws InvalidLengthException
Sets the description of the internal PKCS #11 token. This value must be exactlyTOKEN_LENGTH
characters long.- Parameters:
s
- Description of internal PKCS #11 token.- Throws:
InvalidLengthException
- Ifs.length()
is not exactlyTOKEN_LENGTH
.
-
getInternalKeyStorageTokenDescription
public java.lang.String getInternalKeyStorageTokenDescription()
Returns the description of the internal PKCS #11 key storage token.The default is
"Internal Key Storage Token "
.- Returns:
- Description of internal PKCS #11 key storage token.
-
setInternalKeyStorageTokenDescription
public void setInternalKeyStorageTokenDescription(java.lang.String s) throws InvalidLengthException
Sets the description of the internal PKCS #11 key storage token. This value must be exactlyTOKEN_LENGTH
characters long.- Parameters:
s
- Description of internal PKCS #11 key storage token.- Throws:
InvalidLengthException
- Ifs.length()
is not exactlyTOKEN_LENGTH
.
-
getInternalSlotDescription
public java.lang.String getInternalSlotDescription()
Returns the description of the internal PKCS #11 slot.The default is
"NSS Internal Cryptographic Services "
.- Returns:
- Description of internal PKCS #11 slot.
-
setInternalSlotDescription
public void setInternalSlotDescription(java.lang.String s) throws InvalidLengthException
Sets the description of the internal PKCS #11 slot. This value must be exactlySLOT_LENGTH
characters long.- Parameters:
s
- Description of internal PKCS #11 slot.- Throws:
InvalidLengthException
- Ifs.length()
is not exactlySLOT_LENGTH
.
-
getInternalKeyStorageSlotDescription
public java.lang.String getInternalKeyStorageSlotDescription()
Returns the description of the internal PKCS #11 key storage slot.The default is
"NSS Internal Private Key and Certificate Storage "
.- Returns:
- Description of internal PKCS #11 key storage slot.
-
setInternalKeyStorageSlotDescription
public void setInternalKeyStorageSlotDescription(java.lang.String s) throws InvalidLengthException
Sets the description of the internal PKCS #11 key storage slot. This value must be exactlySLOT_LENGTH
characters long.- Parameters:
s
- Description of internal PKCS #11 key storage slot.- Throws:
InvalidLengthException
- Ifs.length()
is not exactlySLOT_LENGTH
.
-
getFIPSSlotDescription
public java.lang.String getFIPSSlotDescription()
Returns the description of the internal PKCS #11 FIPS slot.The default is
"NSS FIPS 140-2 User Private Key Services"
.- Returns:
- Description of internal PKCS #11 FIPS slot.
-
setFIPSSlotDescription
public void setFIPSSlotDescription(java.lang.String s) throws InvalidLengthException
Sets the description of the internal PKCS #11 FIPS slot. This value must be exactlySLOT_LENGTH
characters long.- Parameters:
s
- Description of internal PKCS #11 FIPS slot.- Throws:
InvalidLengthException
- Ifs.length()
is not exactlySLOT_LENGTH
.
-
getFIPSKeyStorageSlotDescription
public java.lang.String getFIPSKeyStorageSlotDescription()
Returns the description of the internal PKCS #11 FIPS Key Storage slot.The default is
"NSS FIPS 140-2 User Private Key Services"
.- Returns:
- Description of internal PKCS #11 FIPS key storage slot.
-
setFIPSKeyStorageSlotDescription
public void setFIPSKeyStorageSlotDescription(java.lang.String s) throws InvalidLengthException
Sets the description of the internal PKCS #11 FIPS Key Storage slot. This value must be exactlySLOT_LENGTH
characters long.- Parameters:
s
- Description of internal PKCS #11 FIPS key storage slot.- Throws:
InvalidLengthException
- Ifs.length()
is not exactlySLOT_LENGTH
.
-
-