private boolean setupPrivateKeyAndChain ( String algorithm ) { X509ExtendedKeyManager km = sslContext . getX509KeyManager ( ) ; String alias ; if ( conn != null ) { alias = km . chooseServerAlias ( algorithm , null , conn ) ; } else { alias = km . chooseEngineServerAlias ( algorithm , null , engine ) ; } if ( alias == null ) { return false ; } PrivateKey tempPrivateKey = km . getPrivateKey ( alias ) ; if ( tempPrivateKey == null ) { return false ; } X509Certificate [ ] tempCerts = km . getCertificateChain ( alias ) ; if ( ( tempCerts == null ) || ( tempCerts . length == 0 ) ) { return false ; } String keyAlgorithm = algorithm . split ( "_" ) [ 0 ] ; PublicKey publicKey = tempCerts [ 0 ] . getPublicKey ( ) ; if ( ( tempPrivateKey . getAlgorithm ( ) . equals ( keyAlgorithm ) == false ) || ( publicKey . getAlgorithm ( ) . equals ( keyAlgorithm ) == false ) ) { return false ; } // For ECC certs, check whether we support the EC domain parameters. // If the client sent a SupportedEllipticCurves ClientHello extension, // check against that too. if ( keyAlgorithm . equals ( "EC" ) ) { if ( publicKey instanceof ECPublicKey == false ) { return false ; } ECParameterSpec params = ( ( ECPublicKey ) publicKey ) . getParams ( ) ; int index = SupportedEllipticCurvesExtension . getCurveIndex ( params ) ; if ( SupportedEllipticCurvesExtension . isSupported ( index ) == false ) { return false ; } if ( ( supportedCurves != null ) && ! supportedCurves . contains ( index ) ) { return false ; } } this . privateKey = tempPrivateKey ; this . certs = tempCerts ; return true ; }
Retrieve the server key and certificate for the specified algorithm from the KeyManager and set the instance variables .