Class PkiHttpsServer

java.lang.Object

zeroecho.pki.server.PkiHttpsServer

All Implemented Interfaces:

AutoCloseable

public final class PkiHttpsServer
extends Object
implements AutoCloseable

Lifecycle owner for one bounded administrative mutual-TLS HTTPS server.

One instance owns one long-lived ServerRealmContext and therefore one long-lived PKI session. It is thread-safe for lifecycle inspection and idempotent close. HTTP handlers never construct sessions or execute operations outside ServerOperationGateway.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static enum	PkiHttpsServer.State	Closed process lifecycle.

Method Summary

Modifier and Type	Method	Description
Optional<InetSocketAddress>	acmeAddress()	Returns the actual ACME listener address when enabled.
InetSocketAddress	address()	Returns the actual bound administrative address, including an allocated ephemeral port.
void	close()	Quiesces admission, terminates the listener and bounded executors, then closes realm and authentication resources.
Optional<InetSocketAddress>	cmpAddress()	Returns the actual CMP listener address when enabled.
Optional<InetSocketAddress>	estAddress()	Returns the actual EST listener address when enabled.
void	installShutdownHook()	Installs the sole finite process-shutdown bridge for the packaged launcher.
Optional<InetSocketAddress>	publicAddress()	Returns the actual public listener address when the repository listener is enabled.
ServerRealmContext	realm()	Returns the one lifecycle-owned realm context.
Optional<InetSocketAddress>	scepAddress()	Returns the actual SCEP listener address when enabled.
static PkiHttpsServer	start(PkiServerConfiguration configuration, PkiSessionRuntimeDependencies runtimeDependencies)	Starts one production HTTPS server using explicitly configured capabilities.
static PkiHttpsServer	start(PkiServerConfiguration configuration, PkiSessionRuntimeDependencies runtimeDependencies, Optional<BackupTransferConfiguration> transfer)	Starts the server with optional, explicitly budgeted backup transfer.
static PkiHttpsServer	start(PkiServerConfiguration configuration, PkiSessionRuntimeDependencies runtimeDependencies, Optional<BackupTransferConfiguration> transfer, Optional<EnrollmentRuntimeConfiguration> enrollment)	Starts a server with explicit independent backup and enrollment capabilities.
PkiHttpsServer.State	state()	Returns the current lifecycle state.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

start

public static PkiHttpsServer start(PkiServerConfiguration configuration,
 PkiSessionRuntimeDependencies runtimeDependencies)

Starts one production HTTPS server using explicitly configured capabilities.

Parameters:

configuration - validated server configuration

runtimeDependencies - process-local PKI capabilities

Returns:

fully ready lifecycle owner

start

public static PkiHttpsServer start(PkiServerConfiguration configuration,
 PkiSessionRuntimeDependencies runtimeDependencies,
 Optional<BackupTransferConfiguration> transfer)

Starts the server with optional, explicitly budgeted backup transfer.

Parameters:

configuration - validated schema-8 server settings

runtimeDependencies - process-local PKI capabilities

transfer - optional separately validated transfer settings

Returns:

fully ready server lifecycle owner

start

public static PkiHttpsServer start(PkiServerConfiguration configuration,
 PkiSessionRuntimeDependencies runtimeDependencies,
 Optional<BackupTransferConfiguration> transfer,
 Optional<EnrollmentRuntimeConfiguration> enrollment)

Starts a server with explicit independent backup and enrollment capabilities.

Parameters:

configuration - schema-8 server settings

runtimeDependencies - process-local unlock and runtime capabilities

transfer - optional backup transfer budgets

enrollment - mandatory companion for enabled enrollment listeners

Returns:

fully ready server owning all opened resources

state

public PkiHttpsServer.State state()

Returns the current lifecycle state.

Returns:

current state

address

public InetSocketAddress address()

Returns the actual bound administrative address, including an allocated ephemeral port.

Returns:

administrative listener address

Throws:

IllegalStateException - if the server is terminated

publicAddress

public Optional<InetSocketAddress> publicAddress()

Returns the actual public listener address when the repository listener is enabled.

Returns:

bound public address, or empty when disabled

Throws:

IllegalStateException - if the server is terminated

acmeAddress

public Optional<InetSocketAddress> acmeAddress()

Returns the actual ACME listener address when enabled.

Returns:

bound ACME address, or empty when disabled

Throws:

IllegalStateException - if the server is terminated

estAddress

public Optional<InetSocketAddress> estAddress()

Returns the actual EST listener address when enabled.

Returns:

bound EST address, or empty when disabled

Throws:

IllegalStateException - if the server is terminated

scepAddress

public Optional<InetSocketAddress> scepAddress()

Returns the actual SCEP listener address when enabled.

Returns:

bound SCEP address, or empty when disabled

Throws:

IllegalStateException - if the server is terminated

cmpAddress

public Optional<InetSocketAddress> cmpAddress()

Returns the actual CMP listener address when enabled.

Returns:

bound CMP address, or empty when disabled

Throws:

IllegalStateException - if the server is terminated

realm

public ServerRealmContext realm()

Returns the one lifecycle-owned realm context.

Returns:

the open realm context

Throws:

IllegalStateException - unless the server is ready

installShutdownHook

public void installShutdownHook()

Installs the sole finite process-shutdown bridge for the packaged launcher. Tests and embedded integrations may instead close the server directly.

close

public void close()
           throws IOException

Quiesces admission, terminates the listener and bounded executors, then closes realm and authentication resources. Repeated calls are harmless. Concurrent callers share one attempt's failure. Other checked failures are translated to I/O failures with their original cause and suppression graph; interruption is restored for every caller. A failed worker join keeps dependent realm resources open for a later external retry.

Specified by:

close in interface AutoCloseable

Throws:

IOException - if checked shutdown or resource closure fails