public class RootTrustManager extends X509ExtendedTrustManager
X509ExtendedTrustManager
based on an ApplicationConfig
.
This trust manager delegates to the specific trust manager for the hostname being used for
the connection (See ApplicationConfig.getConfigForHostname(String)
and
NetworkSecurityTrustManager
).
ApplicationConfig
has per-domain configurations the hostname aware
checkServerTrusted(X509Certificate[], String String)
must be used instead of the normal
non-aware call.Constructor and Description |
---|
RootTrustManager(ApplicationConfig config) |
Modifier and Type | Method and Description |
---|---|
void |
checkClientTrusted(X509Certificate[] chain,
String authType)
Given the partial or complete certificate chain provided by the
peer, build a certificate path to a trusted root and return if
it can be validated and is trusted for client SSL
authentication based on the authentication type.
|
void |
checkClientTrusted(X509Certificate[] certs,
String authType,
Socket socket)
Given the partial or complete certificate chain provided by the
peer, build and validate the certificate path based on the
authentication type and ssl parameters.
|
void |
checkClientTrusted(X509Certificate[] certs,
String authType,
SSLEngine engine)
Given the partial or complete certificate chain provided by the
peer, build and validate the certificate path based on the
authentication type and ssl parameters.
|
void |
checkServerTrusted(X509Certificate[] certs,
String authType)
Given the partial or complete certificate chain provided by the
peer, build a certificate path to a trusted root and return if
it can be validated and is trusted for server SSL
authentication based on the authentication type.
|
void |
checkServerTrusted(X509Certificate[] certs,
String authType,
Socket socket)
Given the partial or complete certificate chain provided by the
peer, build and validate the certificate path based on the
authentication type and ssl parameters.
|
void |
checkServerTrusted(X509Certificate[] certs,
String authType,
SSLEngine engine)
Given the partial or complete certificate chain provided by the
peer, build and validate the certificate path based on the
authentication type and ssl parameters.
|
List<X509Certificate> |
checkServerTrusted(X509Certificate[] certs,
String authType,
String hostname)
Hostname aware version of
checkServerTrusted(X509Certificate[], String) . |
X509Certificate[] |
getAcceptedIssuers()
Return an array of certificate authority certificates
which are trusted for authenticating peers.
|
boolean |
isSameTrustConfiguration(String hostname1,
String hostname2)
Returns
true if this trust manager uses the same trust configuration for the provided
hostnames. |
public RootTrustManager(ApplicationConfig config)
public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException
X509TrustManager
The authentication type is determined by the actual certificate used. For instance, if RSAPublicKey is used, the authType should be "RSA". Checking is case-sensitive.
chain
- the peer certificate chainauthType
- the authentication type based on the client certificateCertificateException
- if the certificate chain is not trusted
by this TrustManager.public void checkClientTrusted(X509Certificate[] certs, String authType, Socket socket) throws CertificateException
X509ExtendedTrustManager
The authentication type is determined by the actual certificate used. For instance, if RSAPublicKey is used, the authType should be "RSA". Checking is case-sensitive.
If the socket
parameter is an instance of
SSLSocket
, and the endpoint identification
algorithm of the SSLParameters
is non-empty, to prevent
man-in-the-middle attacks, the address that the socket
connected to should be checked against the peer's identity presented
in the end-entity X509 certificate, as specified in the endpoint
identification algorithm.
If the socket
parameter is an instance of
SSLSocket
, and the algorithm constraints of the
SSLParameters
is non-null, for every certificate in the
certification path, fields such as subject public key, the signature
algorithm, key usage, extended key usage, etc. need to conform to the
algorithm constraints in place on this socket.
checkClientTrusted
in class X509ExtendedTrustManager
certs
- the peer certificate chainauthType
- the key exchange algorithm usedsocket
- the socket used for this connection. This parameter
can be null, which indicates that implementations need not check
the ssl parametersCertificateException
- if the certificate chain is not trusted
by this TrustManagerSSLParameters.getEndpointIdentificationAlgorithm()
,
SSLParameters.setEndpointIdentificationAlgorithm(String)
,
SSLParameters.getAlgorithmConstraints()
,
SSLParameters.setAlgorithmConstraints(AlgorithmConstraints)
public void checkClientTrusted(X509Certificate[] certs, String authType, SSLEngine engine) throws CertificateException
X509ExtendedTrustManager
The authentication type is determined by the actual certificate used. For instance, if RSAPublicKey is used, the authType should be "RSA". Checking is case-sensitive.
If the engine
parameter is available, and the endpoint
identification algorithm of the SSLParameters
is
non-empty, to prevent man-in-the-middle attacks, the address that
the engine
connected to should be checked against
the peer's identity presented in the end-entity X509 certificate,
as specified in the endpoint identification algorithm.
If the engine
parameter is available, and the algorithm
constraints of the SSLParameters
is non-null, for every
certificate in the certification path, fields such as subject public
key, the signature algorithm, key usage, extended key usage, etc.
need to conform to the algorithm constraints in place on this engine.
checkClientTrusted
in class X509ExtendedTrustManager
certs
- the peer certificate chainauthType
- the key exchange algorithm usedengine
- the engine used for this connection. This parameter
can be null, which indicates that implementations need not check
the ssl parametersCertificateException
- if the certificate chain is not trusted
by this TrustManagerSSLParameters.getEndpointIdentificationAlgorithm()
,
SSLParameters.setEndpointIdentificationAlgorithm(String)
,
SSLParameters.getAlgorithmConstraints()
,
SSLParameters.setAlgorithmConstraints(AlgorithmConstraints)
public void checkServerTrusted(X509Certificate[] certs, String authType, Socket socket) throws CertificateException
X509ExtendedTrustManager
The authentication type is the key exchange algorithm portion of the cipher suites represented as a String, such as "RSA", "DHE_DSS". Note: for some exportable cipher suites, the key exchange algorithm is determined at run time during the handshake. For instance, for TLS_RSA_EXPORT_WITH_RC4_40_MD5, the authType should be RSA_EXPORT when an ephemeral RSA key is used for the key exchange, and RSA when the key from the server certificate is used. Checking is case-sensitive.
If the socket
parameter is an instance of
SSLSocket
, and the endpoint identification
algorithm of the SSLParameters
is non-empty, to prevent
man-in-the-middle attacks, the address that the socket
connected to should be checked against the peer's identity presented
in the end-entity X509 certificate, as specified in the endpoint
identification algorithm.
If the socket
parameter is an instance of
SSLSocket
, and the algorithm constraints of the
SSLParameters
is non-null, for every certificate in the
certification path, fields such as subject public key, the signature
algorithm, key usage, extended key usage, etc. need to conform to the
algorithm constraints in place on this socket.
checkServerTrusted
in class X509ExtendedTrustManager
certs
- the peer certificate chainauthType
- the key exchange algorithm usedsocket
- the socket used for this connection. This parameter
can be null, which indicates that implementations need not check
the ssl parametersCertificateException
- if the certificate chain is not trusted
by this TrustManagerSSLParameters.getEndpointIdentificationAlgorithm()
,
SSLParameters.setEndpointIdentificationAlgorithm(String)
,
SSLParameters.getAlgorithmConstraints()
,
SSLParameters.setAlgorithmConstraints(AlgorithmConstraints)
public void checkServerTrusted(X509Certificate[] certs, String authType, SSLEngine engine) throws CertificateException
X509ExtendedTrustManager
The authentication type is the key exchange algorithm portion of the cipher suites represented as a String, such as "RSA", "DHE_DSS". Note: for some exportable cipher suites, the key exchange algorithm is determined at run time during the handshake. For instance, for TLS_RSA_EXPORT_WITH_RC4_40_MD5, the authType should be RSA_EXPORT when an ephemeral RSA key is used for the key exchange, and RSA when the key from the server certificate is used. Checking is case-sensitive.
If the engine
parameter is available, and the endpoint
identification algorithm of the SSLParameters
is
non-empty, to prevent man-in-the-middle attacks, the address that
the engine
connected to should be checked against
the peer's identity presented in the end-entity X509 certificate,
as specified in the endpoint identification algorithm.
If the engine
parameter is available, and the algorithm
constraints of the SSLParameters
is non-null, for every
certificate in the certification path, fields such as subject public
key, the signature algorithm, key usage, extended key usage, etc.
need to conform to the algorithm constraints in place on this engine.
checkServerTrusted
in class X509ExtendedTrustManager
certs
- the peer certificate chainauthType
- the key exchange algorithm usedengine
- the engine used for this connection. This parameter
can be null, which indicates that implementations need not check
the ssl parametersCertificateException
- if the certificate chain is not trusted
by this TrustManagerSSLParameters.getEndpointIdentificationAlgorithm()
,
SSLParameters.setEndpointIdentificationAlgorithm(String)
,
SSLParameters.getAlgorithmConstraints()
,
SSLParameters.setAlgorithmConstraints(AlgorithmConstraints)
public void checkServerTrusted(X509Certificate[] certs, String authType) throws CertificateException
X509TrustManager
The authentication type is the key exchange algorithm portion of the cipher suites represented as a String, such as "RSA", "DHE_DSS". Note: for some exportable cipher suites, the key exchange algorithm is determined at run time during the handshake. For instance, for TLS_RSA_EXPORT_WITH_RC4_40_MD5, the authType should be RSA_EXPORT when an ephemeral RSA key is used for the key exchange, and RSA when the key from the server certificate is used. Checking is case-sensitive.
certs
- the peer certificate chainauthType
- the key exchange algorithm usedCertificateException
- if the certificate chain is not trusted
by this TrustManager.public List<X509Certificate> checkServerTrusted(X509Certificate[] certs, String authType, String hostname) throws CertificateException
checkServerTrusted(X509Certificate[], String)
.
This interface is used by conscrypt and android.net.http.X509TrustManagerExtensions do not
modify without modifying those callers.CertificateException
public X509Certificate[] getAcceptedIssuers()
X509TrustManager