Class ScepTransport

java.lang.Object

zeroecho.pki.server.http.ScepTransport

All Implemented Interfaces:

AutoCloseable

public final class ScepTransport
extends Object
implements AutoCloseable

Lifecycle owner for the optional SCEP RFC 8894 HTTPS listener.

SCEP does not require mutual TLS at the transport layer; authentication is carried inside the SCEP PKIMessage via the challenge password. The listener still requires HTTPS for confidentiality.

Usage: start(PkiServerConfiguration.ScepListener, ServerRealmContext, SecureRandom, ClassLoader, BooleanSupplier) returns a fully running transport; call shutdown(Duration) or close() to stop it.

Since:

1.0

Method Summary

Modifier and Type	Method	Description
InetSocketAddress	address()	Returns the actual listener address, including an allocated ephemeral port.
void	close()
void	quiesce()	Rejects new protocol work.
ScepService	service()	Returns the SCEP service for administrative endpoint management.
void	shutdown(Duration graceful)	Stops listener admission and the SCEP lane executors.
static ScepTransport	start(PkiServerConfiguration.ScepListener configuration, ServerRealmContext realm, SecureRandom random, ClassLoader loader, BooleanSupplier ready)	Starts one SCEP listener over the lifecycle-owned realm and PKI session.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

start

public static ScepTransport start(PkiServerConfiguration.ScepListener configuration,
 ServerRealmContext realm,
 SecureRandom random,
 ClassLoader loader,
 BooleanSupplier ready)

Starts one SCEP listener over the lifecycle-owned realm and PKI session.

Parameters:

configuration - validated SCEP listener configuration

realm - shared lifecycle-owned realm

random - cryptographically secure entropy source

loader - provider service class loader

ready - readiness predicate checked by request handlers

Returns:

started SCEP listener lifecycle owner

Throws:

IllegalStateException - if the listener cannot be initialized

address

public InetSocketAddress address()

Returns the actual listener address, including an allocated ephemeral port.

Returns:

bound listener address

service

public ScepService service()

Returns the SCEP service for administrative endpoint management.

Returns:

the SCEP service holding the endpoint registry

quiesce

public void quiesce()

Rejects new protocol work.

shutdown

public void shutdown(Duration graceful)

Stops listener admission and the SCEP lane executors.

Parameters:

graceful - maximum transport drain duration; whole seconds are passed to the listener

close

public void close()

Specified by:

close in interface AutoCloseable