static X509TrustManager createTrustManager(String trustStoreLocation, char[] trustStorePassword,
    String trustStoreType, boolean crlEnabled, boolean ocspEnabled, boolean verifyHostName,
    boolean allowReverseDnsLookup) throws TrustManagerException {

    if (trustStorePassword == null) {
      trustStorePassword = EMPTY_CHAR_ARRAY;
    }

    try {
      KeyStoreFileType storeFileType =
        KeyStoreFileType.fromPropertyValueOrFileName(trustStoreType, trustStoreLocation);
      KeyStore ts = FileKeyStoreLoaderBuilderProvider.getBuilderForKeyStoreFileType(storeFileType)
        .setTrustStorePath(trustStoreLocation).setTrustStorePassword(trustStorePassword).build()
        .loadTrustStore();

      PKIXBuilderParameters pbParams = new PKIXBuilderParameters(ts, new X509CertSelector());
      if (crlEnabled || ocspEnabled) {
        pbParams.setRevocationEnabled(true);
        System.setProperty("com.sun.net.ssl.checkRevocation", "true");
        if (crlEnabled) {
          System.setProperty("com.sun.security.enableCRLDP", "true");
        }
        if (ocspEnabled) {
          Security.setProperty("ocsp.enable", "true");
        }
      } else {
        pbParams.setRevocationEnabled(false);
      }

      // Revocation checking is only supported with the PKIX algorithm
      TrustManagerFactory tmf = TrustManagerFactory.getInstance("PKIX");
      tmf.init(new CertPathTrustManagerParameters(pbParams));

      for (final TrustManager tm : tmf.getTrustManagers()) {
        if (tm instanceof X509ExtendedTrustManager) {
          return new HBaseTrustManager((X509ExtendedTrustManager) tm, verifyHostName,
            allowReverseDnsLookup);
        }
      }
      throw new TrustManagerException("Couldn't find X509TrustManager");
    } catch (IOException | GeneralSecurityException | IllegalArgumentException e) {
      throw new TrustManagerException(e);
    }
  }
Creates a trust manager by loading the trust store from the given file of the given type,
optionally decrypting it using the given password.
@param trustStoreLocation    the location of the trust store file.
@param trustStorePassword    optional password to decrypt the trust store (only applies to JKS
                             trust stores). If empty, assumes the trust store is not encrypted.
@param trustStoreType        must be JKS, PEM, PKCS12, BCFKS or null. If null, attempts to
                             autodetect the trust store type from the file extension (e.g. .jks
                             / .pem).
@param crlEnabled            enable CRL (certificate revocation list) checks.
@param ocspEnabled           enable OCSP (online certificate status protocol) checks.
@param verifyHostName        if true, ssl peer hostname must match name in certificate
@param allowReverseDnsLookup if true, allow falling back to reverse dns lookup in verifying
                             hostname
@return the trust manager.
@throws TrustManagerException if something goes wrong.
hbase-common/src/main/java/org/apache/hadoop/hbase/io/crypto/tls/X509Util.java