*
This method adds an SSL config to the SSLConfigManager map and list.

@param alias
@param sslConfig
@throws Exception
*
182039
public synchronized void clearSSLConfigMap() {
        if (TraceComponent.isAnyTracingEnabled() && tc.isEntryEnabled())
            Tr.entry(tc, "clearSSLConfigMap");

        sslConfigMap.clear();

        if (TraceComponent.isAnyTracingEnabled() && tc.isEntryEnabled())
            Tr.exit(tc, "clearSSLConfigMap");
    }
1189135
@Nullable
	private static SSLContext createInternalSSLContext(Configuration config) throws Exception {
		checkNotNull(config, "config");

		if (!isInternalSSLEnabled(config)) {
			return null;
		}
		String keystoreFilePath = getAndCheckOption(
				config, SecurityOptions.SSL_INTERNAL_KEYSTORE, SecurityOptions.SSL_KEYSTORE);

		String keystorePassword = getAndCheckOption(
				config, SecurityOptions.SSL_INTERNAL_KEYSTORE_PASSWORD, SecurityOptions.SSL_KEYSTORE_PASSWORD);

		String certPassword = getAndCheckOption(
				config, SecurityOptions.SSL_INTERNAL_KEY_PASSWORD, SecurityOptions.SSL_KEY_PASSWORD);

		String trustStoreFilePath = getAndCheckOption(
				config, SecurityOptions.SSL_INTERNAL_TRUSTSTORE, SecurityOptions.SSL_TRUSTSTORE);

		String trustStorePassword = getAndCheckOption(
				config, SecurityOptions.SSL_INTERNAL_TRUSTSTORE_PASSWORD, SecurityOptions.SSL_TRUSTSTORE_PASSWORD);

		String sslProtocolVersion = config.getString(SecurityOptions.SSL_PROTOCOL);
		int sessionCacheSize = config.getInteger(SecurityOptions.SSL_INTERNAL_SESSION_CACHE_SIZE);
		int sessionTimeoutMs = config.getInteger(SecurityOptions.SSL_INTERNAL_SESSION_TIMEOUT);

		KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
		try (InputStream keyStoreFile = Files.newInputStream(new File(keystoreFilePath).toPath())) {
			keyStore.load(keyStoreFile, keystorePassword.toCharArray());
		}

		KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
		try (InputStream trustStoreFile = Files.newInputStream(new File(trustStoreFilePath).toPath())) {
			trustStore.load(trustStoreFile, trustStorePassword.toCharArray());
		}

		KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
		kmf.init(keyStore, certPassword.toCharArray());

		TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
		tmf.init(trustStore);

		SSLContext sslContext = SSLContext.getInstance(sslProtocolVersion);
		sslContext.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);
		if (sessionCacheSize >= 0) {
			sslContext.getClientSessionContext().setSessionCacheSize(sessionCacheSize);
		}
		if (sessionTimeoutMs >= 0) {
			sslContext.getClientSessionContext().setSessionTimeout(sessionTimeoutMs / 1000);
		}

		return sslContext;
	}
656375
public static SslContextBuilder forServer(
      InputStream keyCertChain, InputStream key, String keyPassword) {
    return configure(SslContextBuilder.forServer(keyCertChain, key, keyPassword));
  }
524192
@Override
    public void start(BundleContext context) throws Exception {
        // The demo component is the application
        app = new HttpServerDemo();
        // Add preferences store
        app.attach(new PreferencesStore(app.channel(), HttpServerDemo.class));
        // Attach a general nio dispatcher
        app.attach(new NioDispatcher());

        // Network level unencrypted channel.
        Channel httpTransport = new NamedChannel("httpTransport");
        // Create a TCP server listening on port 8888
        // (may be overridden by preferences)
        app.attach(new TcpServer(httpTransport)
            .setServerAddress(new InetSocketAddress(8888))
            .setName("HttpServer"));

        // Create TLS "converter"
        KeyStore serverStore = KeyStore.getInstance("JKS");
        try (InputStream keyFile
            = Files.newInputStream(Paths.get("demo-resources/localhost.jks"))) {
            serverStore.load(keyFile, "nopass".toCharArray());
        }
        KeyManagerFactory kmf = KeyManagerFactory.getInstance(
            KeyManagerFactory.getDefaultAlgorithm());
        kmf.init(serverStore, "nopass".toCharArray());
        SSLContext sslContext = SSLContext.getInstance("TLS");
        sslContext.init(kmf.getKeyManagers(), null, new SecureRandom());
        // Create a TCP server for SSL
        Channel securedNetwork = app.attach(
            new TcpServer().setServerAddress(new InetSocketAddress(4443))
                .setBacklog(3000).setConnectionLimiter(new PermitsPool(50))
                .setName("HttpsServer"));
        app.attach(new SslCodec(httpTransport, securedNetwork, sslContext));

        // Create an HTTP server as converter between transport and application
        // layer.
        app.attach(new HttpServer(app,
            httpTransport, Request.In.Get.class, Request.In.Post.class));

        // Build application layer
        app.attach(new InMemorySessionManager(app.channel()));
        app.attach(new LanguageSelector(app.channel()));
        app.attach(new FileStorage(app.channel(), 65536));
        app.attach(new StaticContentDispatcher(app.channel(),
            "/**", Paths.get("demo-resources/static-content").toUri()));
        app.attach(new StaticContentDispatcher(app.channel(),
            "/doc|**", Paths.get("../../jgrapes.gh-pages/javadoc").toUri()));
        app.attach(new FormProcessor(app.channel()));
        app.attach(new WsEchoServer(app.channel()));
        Components.start(app);
    }
767227
void setCertificateToTruststore(X509Certificate[] chain) throws Exception {
        if (TraceComponent.isAnyTracingEnabled() && tc.isEntryEnabled())
            Tr.entry(tc, "setCertificateToTruststore");

        try {

            WSKeyStore wsks = KeyStoreManager.getInstance().getKeyStore(tsCfgAlias);
            if (wsks == null)
                throw (new Exception("Keystore " + tsCfgAlias + " does not exist in the configuration."));
            if (wsks.getReadOnly()) {
                issueMessage("ssl.keystore.readonly.CWPKI0810I",
                             new Object[] { tsCfgAlias },
                             "The "
                                             + tsCfgAlias
                                             + " keystore is read only and the certificate will not be written to the keystore file.  Trust will be accepted only for this connection.");

            } else {
                for (int j = 0; j < chain.length; j++) {
                    String alias = chain[j].getSubjectDN().getName();
                    alias = alias.trim();

                    if (tc.isDebugEnabled())
                        Tr.debug(tc, "Adding alias \"" + alias + "\" to truststore \"" + tsFile + "\".");
                    wsks.setCertificateEntry(alias, chain[chain.length - 1]);
                    String shaDigest = KeyStoreManager.getInstance().generateDigest("SHA-1", chain[chain.length - 1]);

                    issueMessage("ssl.signer.add.to.local.truststore.CWPKI0308I", new Object[] { alias, tsFile, shaDigest }, "CWPKI0308I: Adding signer alias \"" + alias
                                                                                                                             + "\" to local keystore \"" + tsFile
                                                                                                                             + "\" with the following SHA digest: " + shaDigest);

                    //Certificate is set on the truststore now clear the caches, if the file monitor is on let it handle the change.
                    String trigger = wsks.getTrigger();
                    if (!trigger.equalsIgnoreCase("disabled"))
                        clearSSLCachesAndResetDefault();
                }
            }
        } catch (Exception e) {
            if (tc.isDebugEnabled())
                Tr.debug(tc, "Exception while trying to write certificate to the truststore. Exception is " + e.getMessage());
            throw e;
        }
        if (TraceComponent.isAnyTracingEnabled() && tc.isEntryEnabled())
            Tr.exit(tc, "setCertificateToTruststore");
    }
937690
@Override
    public SSLContext getSSLContextInstance(final SSLConfig config) throws SSLException {
        if (TraceComponent.isAnyTracingEnabled() && tc.isEntryEnabled())
            Tr.entry(tc, "getSSLContextInstance");

        if (config == null) {
            throw new IllegalArgumentException("SSL configuration is not specified.");
        }

        // now generate a new SSLContext
        final String ctxtProvider = config.getProperty(Constants.SSLPROP_CONTEXT_PROVIDER);
        final String protocol = config.getProperty(Constants.SSLPROP_PROTOCOL);
        final String alias = config.getProperty(Constants.SSLPROP_ALIAS);
        final String configURL = config.getProperty(Constants.SSLPROP_CONFIGURL_LOADED_FROM);

        SSLContext sslContext = null;

        if (protocol == null) {
            throw new IllegalArgumentException("Protocol is not specified.");
        }

        try {
            sslContext = AccessController.doPrivileged(new PrivilegedExceptionAction<SSLContext>() {
                @Override
                public SSLContext run() throws NoSuchAlgorithmException, NoSuchProviderException {
                    if (ctxtProvider != null)
                        return SSLContext.getInstance(protocol, ctxtProvider);
                    return SSLContext.getInstance(protocol);
                }
            });
        } catch (PrivilegedActionException e) {
            Exception ex = e.getException();
            if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled())
                Tr.debug(tc, "Exception occurred getting SSL context.", new Object[] { ex });

            if (ex instanceof NoSuchAlgorithmException) {
                String message = TraceNLSHelper.getInstance().getFormattedMessage("ssl.no.such.algorithm.CWPKI0028E",
                                                                                  new Object[] { protocol, alias, configURL, ex.getMessage() },
                                                                                  "CWPKI0028E: SSL handshake protocol " + protocol
                                                                                                                                                + " is not valid.  This protocol is specified in the SSL configuration alias "
                                                                                                                                                + alias
                                                                                                                                                + " loaded from SSL configuration file "
                                                                                                                                                + configURL
                                                                                                                                                + ".  The extended error message is: "
                                                                                                                                                + ex.getMessage() + ".");
                Tr.error(tc, "ssl.no.such.algorithm.CWPKI0028E",
                         new Object[] { protocol, alias, configURL, ex.getMessage() });
                throw new SSLException(message, ex);
            } else if (ex instanceof NoSuchProviderException) {
                String message = TraceNLSHelper.getInstance().getFormattedMessage("ssl.invalid.context.provider.CWPKI0029E",
                                                                                  new Object[] { Constants.IBMJSSE2_NAME, alias, configURL, ex.getMessage() },
                                                                                  "CWPKI0029E: SSL context provider " + Constants.IBMJSSE2_NAME
                                                                                                                                                               + " is not valid.  This provider is specified in the SSL configuration alias "
                                                                                                                                                               + alias
                                                                                                                                                               + " loaded from SSL configuration file "
                                                                                                                                                               + configURL
                                                                                                                                                               + ".  The extended error message is: "
                                                                                                                                                               + ex.getMessage()
                                                                                                                                                               + ".");
                Tr.error(tc, "ssl.invalid.context.provider.CWPKI0029E",
                         new Object[] { Constants.IBMJSSE2_NAME, alias, configURL, ex.getMessage() });
                throw new SSLException(message, ex);
            } else {
                throw new SSLException(ex);
            }
        }

        if (TraceComponent.isAnyTracingEnabled() && tc.isEntryEnabled())
            Tr.exit(tc, "getSSLContextInstance");
        return sslContext;
    }
813275
public void bind(ServerSocketBar ss)
    throws IOException
  {
    Objects.requireNonNull(ss);

    _isBind.set(true);

    if (_protocol == null)
      throw new IllegalStateException(L.l("'{0}' must have a configured protocol before starting.", this));

    if (_throttle == null)
      _throttle = new ThrottleSocket();

    _serverSocket = ss;

    String scheme = _protocol.name();

    if (_address != null)
      log.info(scheme + " listening to " + _address + ":" + _port);
    else
      log.info(scheme + " listening to *:" + _port);

    if (_sslFactory != null) {
      try {
        _serverSocket = _sslFactory.bind(_serverSocket);
      } catch (RuntimeException e) {
        throw e;
      } catch (IOException e) {
        throw e;
      } catch (Exception e) {
        throw new IOException(e);
      }
    }
  }
454006
private void configureSsl(SocketChannel ch) {
        SslContext sslCtx = SslContextBuilder.build();
        ChannelPipeline pipeline = ch.pipeline();
        pipeline.addLast(sslCtx.newHandler(ch.alloc()));
        // We must wait for the handshake to finish and the protocol to be negotiated before configuring
        // the HTTP/2 components of the pipeline.
        pipeline.addLast(new ApplicationProtocolNegotiationHandler("") {
            @Override
            protected void configurePipeline(ChannelHandlerContext ctx, String protocol) {
                if (ApplicationProtocolNames.HTTP_2.equals(protocol)) {
                    ChannelPipeline p = ctx.pipeline();
                    p.addLast(connectionHandler);
                    configureEndOfPipeline(p);
                    return;
                }
                ctx.close();
                throw new IllegalStateException("unknown protocol: " + protocol);
            }
        });
    }
97226
private SSLConfig parseSSLConfig(Map<String, Object> properties, boolean reinitialize) throws Exception {
        if (TraceComponent.isAnyTracingEnabled() && tc.isEntryEnabled())
            Tr.entry(tc, "parseSSLConfig: " + properties.get(LibertyConstants.KEY_ID), properties);

        SSLConfig rc = parseSecureSocketLayer(properties, reinitialize);

        if (TraceComponent.isAnyTracingEnabled() && tc.isEntryEnabled())
            Tr.exit(tc, "parseSSLConfig");
        return rc;
    }
1166053
public void setClientAlias(String alias) throws Exception {
        if (TraceComponent.isAnyTracingEnabled() && tc.isEntryEnabled())
            Tr.entry(tc, "setClientAlias", new Object[] { alias });
        if (!ks.containsAlias(alias)) {
            String keyFileName = config.getProperty(Constants.SSLPROP_KEY_STORE);
            String tokenLibraryFile = config.getProperty(Constants.SSLPROP_TOKEN_LIBRARY);
            String location = keyFileName != null ? keyFileName : tokenLibraryFile;

            String message = TraceNLSHelper.getInstance().getFormattedMessage("ssl.client.alias.not.found.CWPKI0023E", new Object[] { alias, location },
                                                                              "Client alias " + alias + " not found in keystore.");
            Tr.error(tc, "ssl.client.alias.not.found.CWPKI0023E", new Object[] { alias, location });
            throw new IllegalArgumentException(message);
        }
        this.clientAlias = alias;

        if (customKM != null && customKM instanceof KeyManagerExtendedInfo)
            ((KeyManagerExtendedInfo) customKM).setKeyStoreClientAlias(alias);

        if (TraceComponent.isAnyTracingEnabled() && tc.isEntryEnabled())
            Tr.exit(tc, "setClientAlias");
    }
873131
public void setCertificateEntry(String alias, Certificate cert) throws KeyStoreException, KeyException {
        if (TraceComponent.isAnyTracingEnabled() && tc.isEntryEnabled()) {
            Tr.entry(this, tc, "setCertificateEntry", new Object[] { alias, cert });
        }
        if (Boolean.parseBoolean(getProperty(Constants.SSLPROP_KEY_STORE_READ_ONLY))) {
            if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
                Tr.debug(this, tc, "Unable to update readonly store");
            }
            throw new KeyStoreException("Unable to add to read-only store");
        }
        final KeyStoreManager mgr = KeyStoreManager.getInstance();

        try {
            KeyStore jKeyStore = getKeyStore(false, false);
            if (null == jKeyStore) {
                final String keyStoreLocation = getProperty(Constants.SSLPROP_KEY_STORE);
                if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
                    Tr.debug(tc, "Cannot load the Java keystore at location \"" + keyStoreLocation + "\"");
                }
                throw new KeyStoreException("Cannot load the Java keystore at location \"" + keyStoreLocation + "\"");
            }

            // store the cert... errors are thrown if conflicts or errors occur
            jKeyStore.setCertificateEntry(alias, cert);

            try {
                store();
            } catch (IOException e) {
                // Note: debug + ffdc in store() itself

                // on z/OS we have an issue where the certificate may be stored but the
                // alias
                // already exists in RACF so the keystore API will through an
                // IOException
                // we need to catch this condition on z/OS and if the certs is in the
                // keystore
                // prior after adding the certificate then we know the cert was actually
                // added and its not
                // a true failure. If the cert was not added then we need to rethrow the
                // exception.
                final String ksType = getProperty(Constants.SSLPROP_KEY_STORE_TYPE);
                if ((ksType.equals(Constants.KEYSTORE_TYPE_JCERACFKS) || ksType.equals(Constants.KEYSTORE_TYPE_JCECCARACFKS)
                     || ksType.equals(Constants.KEYSTORE_TYPE_JCEHYBRIDRACFKS))) {
                    KeyStore ks = getKeyStore(true, false);

                    if (mgr.checkIfSignerAlreadyExistsInTrustStore((X509Certificate) cert, ks)) {
                        if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
                            Tr.debug(tc, "Certificate already exists in RACF: " + e.getMessage());
                        }
                    } else {
                        throw new KeyException(e.getMessage(), e);
                    }
                } else {
                    throw new KeyException(e.getMessage(), e);
                }
            }
        } catch (KeyStoreException kse) {
            throw kse;
        } catch (KeyException ke) {
            throw ke;
        } catch (Exception e) {
            throw new KeyException(e.getMessage(), e);
        }

        // after adding the certificate, clear the keystore and SSL caches so it
        // reloads it.
        AbstractJSSEProvider.clearSSLContextCache();
        mgr.clearJavaKeyStoresFromKeyStoreMap();

        if (TraceComponent.isAnyTracingEnabled() && tc.isEntryEnabled()) {
            Tr.exit(this, tc, "setCertificateEntry");
        }
    }
49986
public synchronized SSLConfig getSSLConfig(String alias) throws IllegalArgumentException {
        if (TraceComponent.isAnyTracingEnabled() && tc.isEntryEnabled())
            Tr.entry(tc, "getSSLConfig: " + alias);

        SSLConfig rc = null;
        if (alias == null || alias.equals("")) {
            rc = getDefaultSSLConfig();
        } else {
            // sslConfigMap is not yet populated!!!
            rc = sslConfigMap.get(alias);
        }

        if (TraceComponent.isAnyTracingEnabled() && tc.isEntryEnabled())
            Tr.exit(tc, "getSSLConfig", rc);
        return rc;
    }
478514
protected void setSsl(ServiceReference<Object> reference) {
        sslConfigurationRef.setReference(reference);
        if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
            Tr.debug(this, tc, "sslRef set to " + reference.getProperty(CONFIG_DISPLAY_ID));
        }
    }
1122191
public void addSslListener(InetSocketAddress addr, Configuration sslConf,
      boolean needClientAuth) throws IOException {
    if (webServer.isStarted()) {
      throw new IOException("Failed to add ssl listener");
    }
    if (needClientAuth) {
      // setting up SSL truststore for authenticating clients
      System.setProperty("javax.net.ssl.trustStore", sslConf.get(
          "ssl.server.truststore.location", ""));
      System.setProperty("javax.net.ssl.trustStorePassword", sslConf.get(
          "ssl.server.truststore.password", ""));
      System.setProperty("javax.net.ssl.trustStoreType", sslConf.get(
          "ssl.server.truststore.type", "jks"));
    }
    SslSocketConnector sslListener = new SslSocketConnector();
    sslListener.setHost(addr.getAddress().getHostAddress());
    sslListener.setPort(addr.getPort());
    sslListener.setKeystore(sslConf.get("ssl.server.keystore.location"));
    sslListener.setPassword(sslConf.get("ssl.server.keystore.password", ""));
    sslListener.setKeyPassword(sslConf.get("ssl.server.keystore.keypassword", ""));
    sslListener.setKeystoreType(sslConf.get("ssl.server.keystore.type", "jks"));
    sslListener.setNeedClientAuth(needClientAuth);
    webServer.addConnector(sslListener);
  }
459969
public static SSLHandlerFactory createInternalServerSSLEngineFactory(final Configuration config) throws Exception {
		SSLContext sslContext = createInternalSSLContext(config);
		if (sslContext == null) {
			throw new IllegalConfigurationException("SSL is not enabled for internal communication.");
		}

		return new SSLHandlerFactory(
				sslContext,
				getEnabledProtocols(config),
				getEnabledCipherSuites(config),
				false,
				true,
				config.getInteger(SecurityOptions.SSL_INTERNAL_HANDSHAKE_TIMEOUT),
				config.getInteger(SecurityOptions.SSL_INTERNAL_CLOSE_NOTIFY_FLUSH_TIMEOUT));
	}
400898
private static void setupSsl(Configuration conf) {
    Configuration sslConf = new Configuration(false);
    sslConf.addResource(conf.get("dfs.https.client.keystore.resource",
        "ssl-client.xml"));
    System.setProperty("javax.net.ssl.trustStore", sslConf.get(
        "ssl.client.truststore.location", ""));
    System.setProperty("javax.net.ssl.trustStorePassword", sslConf.get(
        "ssl.client.truststore.password", ""));
    System.setProperty("javax.net.ssl.trustStoreType", sslConf.get(
        "ssl.client.truststore.type", "jks"));
    System.setProperty("javax.net.ssl.keyStore", sslConf.get(
        "ssl.client.keystore.location", ""));
    System.setProperty("javax.net.ssl.keyStorePassword", sslConf.get(
        "ssl.client.keystore.password", ""));
    System.setProperty("javax.net.ssl.keyPassword", sslConf.get(
        "ssl.client.keystore.keypassword", ""));
    System.setProperty("javax.net.ssl.keyStoreType", sslConf.get(
        "ssl.client.keystore.type", "jks"));
  }
1208114
@Override
    public SSLContext getSSLContext(Map<String, Object> connectionInfo, SSLConfig sslConfig) throws Exception {
        if (TraceComponent.isAnyTracingEnabled() && tc.isEntryEnabled())
            Tr.entry(tc, "getSSLContext", new Object[] { connectionInfo });

        // first try to get the SSLContext from the cache.
        SSLContext sslContext = sslContextCacheJAVAX.get(sslConfig);

        setOutboundConnectionInfoInternal(connectionInfo);

        if (sslContext != null) {
            if (TraceComponent.isAnyTracingEnabled() && tc.isEntryEnabled())
                Tr.exit(tc, "getSSLContext -> (from cache)");
            return sslContext;
        }

        // Create the SSL context needed by the JSSE.
        sslContext = getSSLContextInstance(sslConfig);

        List<KeyManager> keyMgrs = new ArrayList<KeyManager>();
        List<TrustManager> trustMgrs = new ArrayList<TrustManager>();
        getKeyTrustManagers(connectionInfo, sslConfig, keyMgrs, trustMgrs);

        if (!keyMgrs.isEmpty() && !trustMgrs.isEmpty()) {
            KeyManager[] keyManagers = keyMgrs.toArray(new KeyManager[keyMgrs.size()]);
            TrustManager[] trustManagers = trustMgrs.toArray(new TrustManager[trustMgrs.size()]);
            // use default SecureRandom
            sslContext.init(keyManagers, trustManagers, null);
        } else if (keyMgrs.isEmpty() && !trustMgrs.isEmpty()) {
            TrustManager[] trustManagers = trustMgrs.toArray(new TrustManager[trustMgrs.size()]);
            // use default SecureRandom
            sslContext.init(null, trustManagers, null);
        } else {
            throw new SSLException("Null trust and key managers.");
        }

        // this may need to be made configurable at some point.
        if (sslContextCacheJAVAX.size() > 100) {
            // instead of clearing the entry cache, grab a few to delete
            Iterator<SSLConfig> keys = sslContextCacheJAVAX.keySet().iterator();
            SSLConfig[] victims = new SSLConfig[] { keys.next(), keys.next(), keys.next(), keys.next(), keys.next() };
            // delete the victim entries after using the iterator (not while)
            for (SSLConfig victim : victims) {
                sslContextCacheJAVAX.remove(victim);
            }
        }

        sslContextCacheJAVAX.put(sslConfig, sslContext);
        if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled())
            Tr.debug(tc, "SSLContext cache size: " + sslContextCacheJAVAX.size());

        if (TraceComponent.isAnyTracingEnabled() && tc.isEntryEnabled())
            Tr.exit(tc, "getSSLContext -> (new)");
        return sslContext;
    }