Interface KeyLogCallback


  • public interface KeyLogCallback
    Callback hooked into SSL_CTX_set_keylog_callback.

    It is supported by BoringSSL, AWS-LC and OpenSSL 1.1.1 or later, but not by LibreSSL.

    Each line uses the NSS Key Log Format (the format of SSLKEYLOGFILE). This is intended for TLS debugging with tools like Wireshark. For instance, a valid SSLKEYLOGFILE implementation could look like this:

    {@code
             final PrintStream out = new PrintStream("~/tls.sslkeylog_file");
             SSLContext.setKeyLogCallback(ctxPtr, new KeyLogCallback() {
    See Also:
    SSLContext.setKeyLogCallback(long, KeyLogCallback), BoringSSL, OpenSSL
    • Method Detail

      • handle

        void handle​(long ssl,
                    byte[] line)
        Called when a new key log line is emitted.

        Warning: The log output will contain secret key material, and can be used to decrypt TLS sessions! The log output should be handled with the same care given to the private keys.

        This method is expected to never throw any Throwable: anything it throws is cleared and ignored.

        Parameters:
        ssl - the native SSL* pointer of the connection the line belongs to.
        line - a single line in the NSS Key Log Format, without a trailing newline.