java - How to access TLS certificates in Jetty Websocket -

i have tls secured connection, on top of communication on web sockets performed. want check attributes contained in certificate used tls connection.

jetty used http communication, , protocol going run karaf component.

i tried dig layers deep possible. hoped find in websocketcomponentservlet. there servletupgraderequest @ least:

public class websocketcomponentservlet extends websocketservlet {     @override     public void configure(websocketservletfactory factory) {         factory.setcreator(new websocketcreator() {         @override         public object createwebsocket(servletupgraderequest req,    servletupgraderesponse resp)                          ... 

i tried dig httpsession or servletupgraderequest, not able find certificate information there. if go down further, websocketcomponent, contains @ least sslcontextparameters. besides key store password, correctly set, fields empty. heading in right direction or entirely missing point here?

edit: guess need more specific. answer below (thank that) points usual way of deploying , configuring jetty. try access certicate data inside of tests. included source code:

public class wssproducerconsumertest extends cameltestsupport {     protected static final string test_message = "hello world!";     protected static final int port = availableportfinder.getnextavailable();     protected server server;     private process tpm2dclient = null;     private process tpm2dserver = null;     private process ttp = null;     private file socketserver;     private file socketclient;     protected list<object> messages;     private static string pwd = "password";      public void starttestserver() throws exception {         // start simple websocket echo service         server = new server(port);         connector connector = new serverconnector(server);         server.addconnector(connector);          servletcontexthandler ctx = new servletcontexthandler();         ctx.setcontextpath("/");         ctx.addservlet(testservletfactory.class.getname(), "/*");          server.sethandler(ctx);          server.start();         asserttrue(server.isstarted());           }      public void stoptestserver() throws exception {         server.stop();         server.destroy();     }      @override     public void setup() throws exception {          classloader classloader = getclass().getclassloader();         url truststoreurl = classloader.getresource("jsse/client-truststore.jks");         system.setproperty("javax.net.ssl.truststore", truststoreurl.getfile());         system.setproperty("javax.net.ssl.truststorepassword", "password");         starttestserver();         super.setup();     }      @override     public void teardown() throws exception {         super.teardown();         stoptestserver();     }      @test     public void testtworoutes() throws exception {         mockendpoint mock = getmockendpoint("mock:result");         mock.expectedbodiesreceived(test_message);          template.sendbody("direct:input", test_message);          mock.assertissatisfied();     }       private static sslcontextparameters defineclientsslcontextclientparameters() {          keystoreparameters ksp = new keystoreparameters();         ksp.setresource(thread.currentthread().getcontextclassloader().getresource("jsse/client-keystore.jks").tostring());         ksp.setpassword(pwd);          keymanagersparameters kmp = new keymanagersparameters();         kmp.setkeypassword(pwd);         kmp.setkeystore(ksp);          keystoreparameters tsp = new keystoreparameters();         tsp.setresource(thread.currentthread().getcontextclassloader().getresource("jsse/client-truststore.jks").tostring());          tsp.setpassword(pwd);          trustmanagersparameters tmp = new trustmanagersparameters();         tmp.setkeystore(tsp);          sslcontextserverparameters scsp = new sslcontextserverparameters();         //scsp.setclientauthentication(clientauthentication.require.name());         scsp.setclientauthentication(clientauthentication.none.name());          sslcontextparameters sslcontextparameters = new sslcontextparameters();         sslcontextparameters.setkeymanagers(kmp);         sslcontextparameters.settrustmanagers(tmp);         sslcontextparameters.setserverparameters(scsp);           return sslcontextparameters;     }      private static sslcontextparameters defineserversslcontextparameters() {         keystoreparameters ksp = new keystoreparameters();         ksp.setresource(thread.currentthread().getcontextclassloader().getresource("jsse/server-keystore.jks").tostring());         ksp.setpassword(pwd);          keymanagersparameters kmp = new keymanagersparameters();         kmp.setkeypassword(pwd);         kmp.setkeystore(ksp);          keystoreparameters tsp = new keystoreparameters();         tsp.setresource(thread.currentthread().getcontextclassloader().getresource("jsse/server-truststore.jks").tostring());         tsp.setpassword(pwd);          trustmanagersparameters tmp = new trustmanagersparameters();         tmp.setkeystore(tsp);          sslcontextserverparameters scsp = new sslcontextserverparameters();         //scsp.setclientauthentication(clientauthentication.require.name());         scsp.setclientauthentication(clientauthentication.none.name());          sslcontextparameters sslcontextparameters = new sslcontextparameters();         sslcontextparameters.setkeymanagers(kmp);         sslcontextparameters.settrustmanagers(tmp);         sslcontextparameters.setserverparameters(scsp);          return sslcontextparameters;     }      @override     protected routebuilder[] createroutebuilders() throws exception {         routebuilder[] rbs = new routebuilder[2];          // ips consumer         rbs[0] = new routebuilder() {             public void configure() {                  // needed configure tls on client side                 wscomponent wscomponent = (wscomponent) context.getcomponent("ipsclient");                 wscomponent.setsslcontextparameters(defineclientsslcontextclientparameters());                  from("direct:input").routeid("foo")                     .log(">>> message direct websocket client : ${body}")                     .to("ipsclient://localhost:9292/echo")                     .log(">>> message websocket client server: ${body}");                 }         };          // ips provider         rbs[1] = new routebuilder() {             public void configure() {                      // needed configure tls on server side                     websocketcomponent websocketcomponent = (websocketcomponent) context.getcomponent("ipsserver");                     websocketcomponent.setsslcontextparameters(defineserversslcontextparameters());                      // route set use tls, referring parameters set above                     from("ipsserver:localhost:9292/echo")                     .log(">>> message websocket server mock: ${body}")                     .to("mock:result");             }         };         return rbs;     } } 

note: following answer work under following conditions

1. the serverconnector has https/ssl/tls support.
2. the serverconnector has appropriate httpconfiguration specifies traffic secure
3. the serverconnector has securerequestcustomizer added httpconfiguration (this things such populating httpservletrequest attributes various servlet spec details secure connection)
4. the request received on serverconnector
5. you terminate ssl/tls @ jetty (if terminate ssl/tls before jetty, jetty not have access certificate information)

you have few options in org.eclipse.jetty.websocket.servlet.servletupgraderequest

• getcertificates() returns x509certificate[] chain
• getservletattribute("javax.servlet.request.ssl_session_id") returns string representing sslsession id
• getservletattribute("javax.servlet.request.cipher_suite") returns string representing sslsession cipher suite
• getservletattribute("javax.servlet.request.key_size") returns integer representing cipher suite key length
• getservletattribute("javax.servlet.request.x509certificate") returns certificates chain in use