com.unboundid.util.ssl

Class VerifyChainSignaturesTrustManager

java.lang.Object

com.unboundid.util.ssl.VerifyChainSignaturesTrustManager

All Implemented Interfaces:

java.io.Serializable, javax.net.ssl.TrustManager, javax.net.ssl.X509TrustManager

@NotMutable
 @ThreadSafety(level=COMPLETELY_THREADSAFE)
public final class VerifyChainSignaturesTrustManager
extends java.lang.Object
implements javax.net.ssl.X509TrustManager, java.io.Serializable

This class provides an X.509 trust manager implementation that can be used to verify signatures in a certificate chain. It will verify that self-signed certificates have valid signatures, and that if multiple certificates are provided, they form a valid chain in which each subsequent certificate has signed the previous certificate. This implementation is somewhat lenient when it comes to certificate order: the first certificate must be the end-entity certificate, but subsequent certificates can appear in any order. Further, if the chain includes duplicate certificates, then the duplicates will be ignored so that only one instance of each certificate will be examined.

Note that this trust manager should not be used on its own, since it only validates the certificate chain that was actually presented by the peer. If the presented chain is incomplete (which is acceptable if there is reason to expect that the peer can complete the chain using its own set of trusted issuers), then this trust manager will not attempt to verify that the last certificate presented by the peer was actually signed by one of those trusted issuers. And even in the case where the full chain is presented, this trust manager only attempts to verify that each subsequent certificate is the one used to sign the previous one, and does not attempt to make any determination about whether any of the end-entity or issuer certificates are trustworthy.

See Also:

Serialized Form

Method Summary

Modifier and Type	Method	Description
void	checkClientTrusted(java.security.cert.X509Certificate[] chain, java.lang.String authType)	Checks to determine whether the provided client certificate chain should be trusted.
void	checkServerTrusted(java.security.cert.X509Certificate[] chain, java.lang.String authType)	Checks to determine whether the provided server certificate chain should be trusted.
java.security.cert.X509Certificate[]	getAcceptedIssuers()	Retrieves the accepted issuer certificates for this trust manager.
static VerifyChainSignaturesTrustManager	getInstance()	Retrieves a singleton instance of this issuer chain trust manager.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Detail

getInstance

@NotNull
public static VerifyChainSignaturesTrustManager getInstance()

Retrieves a singleton instance of this issuer chain trust manager.

Returns:

A singleton instance of this issuer chain trust manager.

checkClientTrusted

public void checkClientTrusted(@NotNull
                               java.security.cert.X509Certificate[] chain,
                               @NotNull
                               java.lang.String authType)
                        throws java.security.cert.CertificateException

Checks to determine whether the provided client certificate chain should be trusted.

Specified by:

checkClientTrusted in interface javax.net.ssl.X509TrustManager

Parameters:

chain - The client certificate chain for which to make the determination.

authType - The authentication type based on the client certificate.

Throws:

java.security.cert.CertificateException - If the provided client certificate chain should not be trusted.

checkServerTrusted

public void checkServerTrusted(@NotNull
                               java.security.cert.X509Certificate[] chain,
                               @NotNull
                               java.lang.String authType)
                        throws java.security.cert.CertificateException

Checks to determine whether the provided server certificate chain should be trusted.

Specified by:

checkServerTrusted in interface javax.net.ssl.X509TrustManager

Parameters:

chain - The server certificate chain for which to make the determination.

authType - The key exchange algorithm used.

Throws:

java.security.cert.CertificateException - If the provided server certificate chain should not be trusted.

getAcceptedIssuers

@NotNull
public java.security.cert.X509Certificate[] getAcceptedIssuers()

Retrieves the accepted issuer certificates for this trust manager. This will always return an empty array.

Specified by:

getAcceptedIssuers in interface javax.net.ssl.X509TrustManager

Returns:

The accepted issuer certificates for this trust manager.