Class EstTransport

java.lang.Object

zeroecho.pki.server.http.EstTransport

All Implemented Interfaces:

AutoCloseable

public final class EstTransport
extends Object
implements AutoCloseable

Lifecycle owner for the optional EST RFC 7030 HTTPS listener.

EST always requires mutual TLS: SSLParameters.setNeedClientAuth(boolean) is set to true unconditionally, unlike ACME which may operate behind a trusted proxy. The handler reads the client certificate from the SSL session after the handshake completes.

Usage: start(PkiServerConfiguration.EstListener, ServerRealmContext, SecureRandom, ClassLoader, BooleanSupplier) returns a fully running transport; call shutdown(Duration) or close() to stop it.

Since:

1.0

Method Summary

Modifier and Type	Method	Description
InetSocketAddress	address()	Returns the actual listener address, including an allocated ephemeral port.
void	close()
void	quiesce()	Rejects new protocol work.
EstService	service()	Returns the EST service for administrative endpoint management.
void	shutdown(Duration graceful)	Stops listener admission and the EST lane executors.
static EstTransport	start(PkiServerConfiguration.EstListener configuration, ServerRealmContext realm, SecureRandom random, ClassLoader loader, BooleanSupplier ready)	Starts one EST listener over the lifecycle-owned realm and PKI session.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

start

public static EstTransport start(PkiServerConfiguration.EstListener configuration,
 ServerRealmContext realm,
 SecureRandom random,
 ClassLoader loader,
 BooleanSupplier ready)

Starts one EST listener over the lifecycle-owned realm and PKI session.

Parameters:

configuration - validated EST listener configuration

realm - shared lifecycle-owned realm

random - cryptographically secure entropy source

loader - provider service class loader

ready - readiness predicate checked by request handlers

Returns:

started EST listener lifecycle owner

Throws:

IllegalStateException - if the listener cannot be initialized

address

public InetSocketAddress address()

Returns the actual listener address, including an allocated ephemeral port.

Returns:

bound listener address

service

public EstService service()

Returns the EST service for administrative endpoint management.

Returns:

the EST service holding the endpoint registry

quiesce

public void quiesce()

Rejects new protocol work.

shutdown

public void shutdown(Duration graceful)

Stops listener admission and the EST lane executors.

Parameters:

graceful - maximum transport drain duration; whole seconds are passed to the listener

close

public void close()

Specified by:

close in interface AutoCloseable