Package org.mariadb.jdbc.client.tls

Class MariaDbX509DeferredIdentityTrustManager

  • All Implemented Interfaces:
    javax.net.ssl.TrustManager, javax.net.ssl.X509TrustManager
    public class MariaDbX509DeferredIdentityTrustManager
extends java.lang.Object
implements javax.net.ssl.X509TrustManager
    TrustManager that defers server-identity validation to the authentication phase.

    It delegates the standard certificate-chain check to a real X509TrustManager. When that check fails because the chain cannot be validated against the trust store, typically because the server presented a self-signed certificate it generated on the fly (MariaDB does this when TLS is enabled but no server certificate is configured), this manager does not reject the connection. Instead, it records the leaf certificate fingerprint and lets the handshake proceed, so the server's identity can be validated later, during authentication.

    Identity is then proven cryptographically by the authentication plugin, which binds the session to this exact certificate (password + scramble + certificate fingerprint). A man-in-the-middle presenting a different certificate produces a different fingerprint, so authentication fails, the fingerprint is what actually validates the peer, not the (self-signed) certificate itself. A self-signed/ephemeral certificate is therefore only the usual trigger for this path, not the basis of the validation.

    This only delays identity validation; it does not weaken it. Expired or not-yet-valid certificates are still rejected outright here, and this manager must only be used on connection paths that go on to perform fingerprint-based authentication.

    A new instance is created per connection, wrapping a shared (cached) delegate, so the captured fingerprint is simply per-connection instance state, read afterward via getFingerprint().

    • Field Summary

      Fields 
      Modifier and Type Field Description
      private byte[] fingerprint  
      private javax.net.ssl.X509TrustManager internal  

    • Constructor Summary

      Constructors 
      Constructor Description
      MariaDbX509DeferredIdentityTrustManager​(javax.net.ssl.X509TrustManager javaTrustManager)
      Wraps a standard X509TrustManager, capturing the server certificate fingerprint when the chain cannot be validated normally so that identity can be verified later, during authentication.

    • Method Summary

      All Methods Static Methods Instance Methods Concrete Methods 
      Modifier and Type Method Description
      void checkClientTrusted​(java.security.cert.X509Certificate[] x509Certificates, java.lang.String authType)  
      void checkServerTrusted​(java.security.cert.X509Certificate[] x509Certificates, java.lang.String authType)  
      java.security.cert.X509Certificate[] getAcceptedIssuers()  
      byte[] getFingerprint()
      Fingerprint of the server's leaf certificate, captured when the certificate could not be validated against the trust store and its identity must instead be verified during authentication.
      private static byte[] getThumbprint​(java.security.cert.X509Certificate cert)  

      • Methods inherited from class java.lang.Object

        clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    • Field Detail

      • internal

        private final javax.net.ssl.X509TrustManager internal

      • fingerprint

        private byte[] fingerprint

    • Constructor Detail

      • MariaDbX509DeferredIdentityTrustManager

        public MariaDbX509DeferredIdentityTrustManager​(javax.net.ssl.X509TrustManager javaTrustManager)
        Wraps a standard X509TrustManager, capturing the server certificate fingerprint when the chain cannot be validated normally so that identity can be verified later, during authentication.
        Parameters:
        javaTrustManager - real trust manager

    • Method Detail

      • getThumbprint

        private static byte[] getThumbprint​(java.security.cert.X509Certificate cert)
                             throws java.security.NoSuchAlgorithmException,
                                    java.security.cert.CertificateEncodingException
        Throws:
        java.security.NoSuchAlgorithmException
        java.security.cert.CertificateEncodingException

      • checkClientTrusted

        public void checkClientTrusted​(java.security.cert.X509Certificate[] x509Certificates,
                               java.lang.String authType)
                        throws java.security.cert.CertificateException
        Specified by:
        checkClientTrusted in interface javax.net.ssl.X509TrustManager
        Throws:
        java.security.cert.CertificateException

      • checkServerTrusted

        public void checkServerTrusted​(java.security.cert.X509Certificate[] x509Certificates,
                               java.lang.String authType)
                        throws java.security.cert.CertificateException
        Specified by:
        checkServerTrusted in interface javax.net.ssl.X509TrustManager
        Throws:
        java.security.cert.CertificateException

      • getFingerprint

        public byte[] getFingerprint()
        Fingerprint of the server's leaf certificate, captured when the certificate could not be validated against the trust store and its identity must instead be verified during authentication. Returns null when the certificate validated normally, so no deferred fingerprint check is needed.
        Returns:
        captured fingerprint, or null

      • getAcceptedIssuers

        public java.security.cert.X509Certificate[] getAcceptedIssuers()
        Specified by:
        getAcceptedIssuers in interface javax.net.ssl.X509TrustManager