Java Code Examples for javax.net.ssl.X509TrustManager#checkServerTrusted()

@Override
public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {
    for(X509TrustManager tm : startServerTms) {
        try {
            tm.checkServerTrusted(chain, authType);
            return; // first found
        } catch(CertificateException e) {
            ; // proceed
        }
    }
    // last try
    if (finalServerTm == null) {
        throw new CertificateException("Cannot validate server certificate (no delegated trust managers for server check)");
    }
    finalServerTm.checkServerTrusted(chain, authType);
}
 

@Override
public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {
    String host = mServerHostname.get();
    DomainPinningPolicy serverConfig =
            TrustKit.getInstance().getConfiguration().getPolicyForHostname(host);
    X509TrustManager trustManager = TrustKit.getInstance().getTrustManager(host);

    //The first check is needed for compatibility with the Platform default's implementation of
    //the Trust Manager. For APIs 24 and greater, the Platform's default TrustManager states
    //that it requires usage of the hostname-aware version of checkServerTrusted for app's that
    //implement Android's network_security_config file. The 2nd check is to allow usage of the
    //X509TrustManagerExtensions class. Any API below will default to the baseline trust manager.
    if (serverConfig == null && Build.VERSION.SDK_INT >= Build.VERSION_CODES.JELLY_BEAN_MR1) {
        new X509TrustManagerExtensions(trustManager).checkServerTrusted(chain, authType, host);
    } else {
        trustManager.checkServerTrusted(chain, authType);
    }
}
 

@Override
public void checkServerTrusted(final X509Certificate[] chain, final String authType)
                throws CertificateException {

    CertificateException lastError = null;
    for (final X509TrustManager manager : managers) {
        try {
            manager.checkServerTrusted(chain, authType);
            return;
        } catch (final CertificateException e) {
            lastError = e;
        }
    }

    if (lastError != null) {
        throw lastError;
    }
}
 

@Override
public void checkServerTrusted(final X509Certificate[] chain, final String authType) throws CertificateException
{
    if (trustManagers.isEmpty()) {
        throw new CertificateException("No trust managers installed!");
    }

    CertificateException ce = null;
    for (X509TrustManager trustManager : trustManagers) {
        try {
            trustManager.checkServerTrusted(chain, authType);
            return;
        }
        catch (CertificateException trustCe) {
            ce = trustCe;
        }
    }

    throw ce;
}
 

@Override
public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {
    CertificateException lastError = null;
    for (X509TrustManager trustManager : children) {
        try {
            trustManager.checkServerTrusted(chain, authType);
            return;
        } catch (CertificateException ex) {
            lastError = ex;
        }
    }

    if (lastError != null) {
        throw lastError;
    }
}
 

@Override
public void checkServerTrusted(X509Certificate[] chain, String authType)
  throws CertificateException {
  X509TrustManager tm = trustManagerRef.get();
  if (tm != null) {
    tm.checkServerTrusted(chain, authType);
  } else {
    throw new CertificateException("Unknown server chain certificate: " +
                                   chain[0].toString());
  }
}
 

public void checkServerTrusted(X509Certificate[] chain, String authType)
        throws CertificateException {
    for (TrustManager manager : _defaultManagers) {
        if (manager instanceof X509TrustManager) {
            X509TrustManager x509Manager = (X509TrustManager) manager;
            x509Manager.checkServerTrusted(chain, authType);
        }
    }
}
 

public void checkServerTrusted(X509Certificate[] chain, String authType)
        throws CertificateException {
    for (TrustManager manager : _defaultManagers) {
        if (manager instanceof X509TrustManager) {
            X509TrustManager x509Manager = (X509TrustManager) manager;
            x509Manager.checkServerTrusted(chain, authType);
        }
    }
}
 

@Override
public void checkServerTrusted(X509Certificate[] chain, String authType)
  throws CertificateException {
  X509TrustManager tm = trustManagerRef.get();
  if (tm != null) {
    tm.checkServerTrusted(chain, authType);
  } else {
    throw new CertificateException("Unknown server chain certificate: " +
                                   chain[0].toString());
  }
}
 

@Override
public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {
	for (X509TrustManager trustManager : trustManagers) {
		try {
			trustManager.checkServerTrusted(chain, authType);
			return; // someone trusts them. success!
		} catch (CertificateException e) {
			// maybe someone else will trust them
		}
	}
	throw new CertificateException("None of the TrustManagers trust this certificate chain");
}
 

@Override
public void checkServerTrusted(X509Certificate[] certificates, String authType) throws CertificateException {
    CertificateException catchException = null;
    for (X509TrustManager tm : trustManagers) {
        try {
            tm.checkServerTrusted(certificates, authType);
            return;
        } catch (CertificateException e) {
            catchException = e;
        }
    }
    throw catchException;
}
 

/**
 * Determine if server certificate is to be trusted.
 *
 * @param x509Chain
 * @param authNType
 * @throws CertificateException
 */
public synchronized void checkServerTrusted( final X509Certificate[] x509Chain, final String authNType ) throws
    CertificateException
{
    for ( final X509TrustManager trustManager : getTrustManagers( x509Chain ) )
    {
        trustManager.checkServerTrusted( x509Chain, authNType );
    }
}
 

/**
 * Determine if server certificate is to be trusted.
 *
 * @param x509Chain The certificate chain
 * @param authNType The key exchange algorithm being used
 * @throws CertificateException If the trustManager cannot be found 
 */
public synchronized void checkServerTrusted( X509Certificate[] x509Chain, String authNType ) throws
    CertificateException
{
    for ( X509TrustManager trustManager : getTrustManagers( x509Chain ) )
    {
        trustManager.checkServerTrusted( x509Chain, authNType );
    }
}
 

@Override
public void checkServerTrusted(final X509Certificate[] chain, final String authType) throws CertificateException {
    for (final X509TrustManager trustManager : trustManagers) {
        try {
            trustManager.checkServerTrusted(chain, authType);
            return;
        } catch (final CertificateException e) {
            LOGGER.debug(e.getMessage(), e);
        }
    }
    throw new CertificateException("None of the TrustManagers trust this certificate chain");
}
 

@Override
public void checkServerTrusted(X509Certificate[] serverCertificates, String authType) throws CertificateException {
    for (TrustManager trustManager : trustManagers) {
        try {
            final X509TrustManager x509TrustManager = (X509TrustManager) trustManager;
            x509TrustManager.checkServerTrusted(serverCertificates, authType);
            return;
        }
        catch (CertificateException ex) {
            //Ignore and move on to the next trust manager
        }
    }
    throw new CertificateException("Certificate is not trusted by any of the trust managers");
}
 

/**
 *
 * @param caResources
 *            an array of paths to CA Certificates in PEM format to load
 *            from the classpath (relative to this class).
 * @param eecResources
 *            an array of paths to Server Certificates in PEM format in to
 *            load from the classpath (relative to this class).
 * @param expectations
 *            an array of expecting results for each EEC Server Certificate
 *            (the array is expected to have the same length the previous
 *            argument, and be arrange in matching order: true means
 *            expected to be valid, false otherwise.
 */
private static void runTests(String[] caResources, String[] eecResources,
        boolean[] expectations) throws Exception {
    X509TrustManager tm = getTrustManager(caResources);

    X509Certificate[] eecCerts = loadCertCollection(eecResources);

    for (int i = 0; i < eecResources.length; i++) {
        X509Certificate eecCert = eecCerts[i];
        assertNotNull("Cannot use cert " + eecResources[i], eecCert);
        try {
            tm.checkServerTrusted(new X509Certificate[] { eecCert }, "RSA");
            if (!expectations[i]) {
                fail(String.format(
                        "Certificate %s was expected not to be valid when using CAs %s, but its "
                                + "verification passed.", eecResources[i],
                        Arrays.asList(caResources)));
            }
        } catch (CertificateException e) {
            if (expectations[i]) {
                fail(String.format(
                        "Certificate %s was expected to be valid when using CAs %s, but its "
                                + "verification failed.", eecResources[i],
                        Arrays.asList(caResources)));
            }
        }
    }
}
 

@Test(expectedExceptions = IllegalArgumentException.class)
public void testCheckServerTrustedEnableTM() throws Exception {

    try {
        System.setProperty(VALIDATE_SERVER_CERT, "true");
        X509TrustManager celleryTrustManager = new CelleryTrustManager();
        celleryTrustManager.checkServerTrusted(null, null);
    } finally {
        System.getProperties().remove(VALIDATE_SERVER_CERT);
    }

}
 

public static void main(String[] args) throws Exception {
    if (initSecmod() == false) {
        return;
    }

    if ("sparc".equals(System.getProperty("os.arch")) == false) {
        // we have not updated other platforms with the proper NSS libraries yet
        System.out.println("Test currently works only on solaris-sparc, skipping");
        return;
    }

    String configName = BASE + SEP + "fips.cfg";
    Provider p = getSunPKCS11(configName);

    System.out.println(p);
    Security.addProvider(p);

    Security.removeProvider("SunJSSE");
    Provider jsse = new com.sun.net.ssl.internal.ssl.Provider(p);
    Security.addProvider(jsse);
    System.out.println(jsse.getInfo());

    KeyStore ks = KeyStore.getInstance("PKCS11", p);
    ks.load(null, "test12".toCharArray());

    X509Certificate server = loadCertificate("certs/server.cer");
    X509Certificate ca = loadCertificate("certs/ca.cer");
    X509Certificate anchor = loadCertificate("certs/anchor.cer");

    if (args.length > 1 && "sm".equals(args[0])) {
        Policy.setPolicy(Policy.getInstance("JavaPolicy",
                new URIParameter(new File(BASE, args[1]).toURI())));
        System.setSecurityManager(new SecurityManager());
    }

    KeyStore trustStore = KeyStore.getInstance("JKS");
    trustStore.load(null, null);
    trustStore.setCertificateEntry("anchor", anchor);

    TrustManagerFactory tmf = TrustManagerFactory.getInstance("PKIX");
    tmf.init(trustStore);

    X509TrustManager tm = (X509TrustManager)tmf.getTrustManagers()[0];

    X509Certificate[] chain = {server, ca, anchor};

    tm.checkServerTrusted(chain, "RSA");

    System.out.println("OK");
}
 

public void checkServerTrusted(X509Certificate[] chain, String type)
		throws CertificateException {
	try {
		for (int i = 0; i < userTrustManagers.length; i++) {
			if (userTrustManagers[i] instanceof X509TrustManager) {
				X509TrustManager trustManager = (X509TrustManager) userTrustManagers[i];
				X509Certificate[] calist = trustManager
						.getAcceptedIssuers();
				if (calist.length > 0) {
					trustManager.checkServerTrusted(chain, type);
				} else {
					throw new CertificateException(
							"Empty list of accepted issuers (a.k.a. root CA list).");
				}
			}
		}
		return;
	} catch (CertificateException ce) {
		X509Certificate cert = chain[0];
		String certInfo = "Version: " + cert.getVersion() + "\n";
		certInfo = certInfo.concat("Serial Number: "
				+ cert.getSerialNumber() + "\n");
		certInfo = certInfo.concat("Signature Algorithm: "
				+ cert.getSigAlgName() + "\n");
		certInfo = certInfo.concat("Issuer: "
				+ cert.getIssuerDN().getName() + "\n");
		certInfo = certInfo.concat("Valid From: " + cert.getNotBefore()
				+ "\n");
		certInfo = certInfo
				.concat("Valid To: " + cert.getNotAfter() + "\n");
		certInfo = certInfo.concat("Subject DN: "
				+ cert.getSubjectDN().getName() + "\n");
		certInfo = certInfo.concat("Public Key: "
				+ cert.getPublicKey().getFormat() + "\n");

		int accept = JOptionPane
				.showConfirmDialog(null, certInfo, "Unknown Certificate - Do you accept it?",
						javax.swing.JOptionPane.YES_NO_OPTION);
		if (accept != JOptionPane.YES_OPTION) {
			throw new java.security.cert.CertificateException(
					"Certificate Rejected");
		}

		int save = JOptionPane.showConfirmDialog(null,
				"Remember this certificate?", "Save Certificate",
				javax.swing.JOptionPane.YES_NO_OPTION);

		if (save == JOptionPane.YES_OPTION) {
			try {
				userks.setCertificateEntry(cert.getSubjectDN().getName(),
						cert);
				userks.store(new FileOutputStream(userKsPath),
						userksPassword);
			} catch (Exception e) {
				logger.error("Error saving certificate [" + e.getMessage()
						+ "]");
				e.printStackTrace();
			}
		}
	}

}
 

@Test
public void testCheckServerTrustedWithoutEnableTM() throws Exception {

    X509TrustManager celleryTrustManager = new CelleryTrustManager();
    celleryTrustManager.checkServerTrusted(null, null);
}