Package net.sourceforge.jnlp.security

Class VariableX509TrustManager

  • public final class VariableX509TrustManager
extends java.lang.Object
    This class implements an X509 Trust Manager. The certificates it trusts are "variable", in the sense that it can dynamically, and temporarily support different certificates that are not in the keystore.

    • Constructor Summary

      Constructors 
      Constructor Description
      VariableX509TrustManager()
      Constructor initializes the system, user and custom stores

    • Method Summary

      All Methods Static Methods Instance Methods Concrete Methods 
      Modifier and Type Method Description
      private boolean askUser​(java.security.cert.X509Certificate[] chain, boolean isTrusted, boolean hostMatched, java.lang.String hostName)
      Ask user if the certificate should be trusted
      private void checkAllManagers​(java.security.cert.X509Certificate[] chain, java.lang.String authType, java.net.Socket socket, javax.net.ssl.SSLEngine engine)
      Check system, user and custom trust manager.
      void checkTrustClient​(java.security.cert.X509Certificate[] chain, java.lang.String authType, java.lang.String hostName)
      Check if client is trusted (no support for custom here, only system/user)
      void checkTrustServer​(java.security.cert.X509Certificate[] chain, java.lang.String authType, java.lang.String hostName, javax.net.ssl.SSLSocket socket, javax.net.ssl.SSLEngine engine)
      Check if the server is trusted.
      protected java.security.cert.X509Certificate[] getAcceptedIssuers()  
      static VariableX509TrustManager getInstance()
      Return an instance of this singleton
      private javax.net.ssl.TrustManagerFactory getTrustManagerFactory​(java.security.KeyStore keyStore)  
      private boolean isExplicitlyTrusted​(java.security.cert.X509Certificate[] chain, java.lang.String authType)
      Return if the user explicitly trusted this i.e.
      private boolean isTemporarilyUntrusted​(java.security.cert.Certificate c)
      Was this certificate explicitly untrusted by user?
      private void loadManagers​(java.util.List<java.security.KeyStore> keyStores, java.util.List<javax.net.ssl.X509TrustManager> managers)  
      static void main​(java.lang.String[] args)  
      private void temporarilyTrust​(java.security.cert.Certificate c)
      Temporarily trust the given cert (runtime)
      private void temporarilyUntrust​(java.security.cert.Certificate c)
      Temporarily untrust the given cert - do not ask the user to trust this certificate again

      • Methods inherited from class java.lang.Object

        clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    • Field Detail

      • LOG

        private static final Logger LOG

      • temporarilyTrusted

        private final java.util.List<java.security.cert.Certificate> temporarilyTrusted

      • temporarilyUntrusted

        private final java.util.List<java.security.cert.Certificate> temporarilyUntrusted

      • certTrustManagers

        private final java.util.List<javax.net.ssl.X509TrustManager> certTrustManagers

      • clientTrustManagers

        private final java.util.List<javax.net.ssl.X509TrustManager> clientTrustManagers

      • caTrustManagers

        private final java.util.List<javax.net.ssl.X509TrustManager> caTrustManagers

    • Constructor Detail

      • VariableX509TrustManager

        public VariableX509TrustManager()
        Constructor initializes the system, user and custom stores

    • Method Detail

      • main

        public static void main​(java.lang.String[] args)

      • loadManagers

        private void loadManagers​(java.util.List<java.security.KeyStore> keyStores,
                          java.util.List<javax.net.ssl.X509TrustManager> managers)

      • getTrustManagerFactory

        private javax.net.ssl.TrustManagerFactory getTrustManagerFactory​(java.security.KeyStore keyStore)

      • checkTrustClient

        public void checkTrustClient​(java.security.cert.X509Certificate[] chain,
                             java.lang.String authType,
                             java.lang.String hostName)
                      throws java.security.cert.CertificateException
        Check if client is trusted (no support for custom here, only system/user)
        Parameters:
        chain - certificate chain
        authType - type of authentication
        hostName - hostname
        Throws:
        java.security.cert.CertificateException - if certificate is wrong

      • checkTrustServer

        public void checkTrustServer​(java.security.cert.X509Certificate[] chain,
                             java.lang.String authType,
                             java.lang.String hostName,
                             javax.net.ssl.SSLSocket socket,
                             javax.net.ssl.SSLEngine engine)
                      throws java.security.cert.CertificateException
        Check if the server is trusted.

        First, existing stores are checked to see if the certificate is trusted. Next, if the certificate is not explicitly trusted by the user, a host name check is performed. The user is them prompted as needed.

        Parameters:
        chain - The cert chain
        authType - The auth type algorithm
        hostName - The expected hostName that the server should have
        socket - The SSLSocket in use (may be null)
        engine - The SSLEngine in use (may be null)
        Throws:
        java.security.cert.CertificateException - if certificate is wrong

      • checkAllManagers

        private void checkAllManagers​(java.security.cert.X509Certificate[] chain,
                              java.lang.String authType,
                              java.net.Socket socket,
                              javax.net.ssl.SSLEngine engine)
                       throws java.security.cert.CertificateException
        Check system, user and custom trust manager.

        This method is intended to work with both, JRE6 and JRE7. If socket and engine are null, it assumes that the call is for JRE6 (i.e. not javax.net.ssl.X509ExtendedTrustManager which is Java 7 specific). If either of those are not null, it will assume that the caTrustManagers are javax.net.ssl.X509ExtendedTrustManager instances and will invoke their check methods.

        Parameters:
        chain - The certificate chain
        authType - The authentication type
        socket - the SSLSocket being used for the connection
        engine - the SSLEngine being used for the connection
        Throws:
        java.security.cert.CertificateException

      • isExplicitlyTrusted

        private boolean isExplicitlyTrusted​(java.security.cert.X509Certificate[] chain,
                                    java.lang.String authType)
        Return if the user explicitly trusted this i.e. in userTrustManager or temporarilyTrusted

      • getAcceptedIssuers

        protected java.security.cert.X509Certificate[] getAcceptedIssuers()

      • temporarilyUntrust

        private void temporarilyUntrust​(java.security.cert.Certificate c)
        Temporarily untrust the given cert - do not ask the user to trust this certificate again
        Parameters:
        c - The certificate to trust

      • isTemporarilyUntrusted

        private boolean isTemporarilyUntrusted​(java.security.cert.Certificate c)
        Was this certificate explicitly untrusted by user?
        Parameters:
        c - the certificate
        Returns:
        true if the user was presented with this certificate and chose not to trust it

      • temporarilyTrust

        private void temporarilyTrust​(java.security.cert.Certificate c)
        Temporarily trust the given cert (runtime)
        Parameters:
        c - The certificate to trust

      • askUser

        private boolean askUser​(java.security.cert.X509Certificate[] chain,
                        boolean isTrusted,
                        boolean hostMatched,
                        java.lang.String hostName)
        Ask user if the certificate should be trusted
        Parameters:
        chain - The certificate chain
        Returns:
        user's response

      • getInstance

        public static VariableX509TrustManager getInstance()
        Return an instance of this singleton
        Returns:
        The instance