| | |
| | | * |
| | | * Copyright 2008-2009 Sun Microsystems, Inc. |
| | | * Portions Copyright 2009 Parametric Technology Corporation (PTC) |
| | | * Portions Copyright 2011-2015 ForgeRock AS. |
| | | * Portions Copyright 2011-2016 ForgeRock AS. |
| | | */ |
| | | |
| | | package org.opends.admin.ads.util; |
| | | |
| | | import java.security.KeyStore; |
| | |
| | | * it cannot be retrieved this class will only accept the certificates |
| | | * explicitly accepted by the user (and specified by calling acceptCertificate). |
| | | * |
| | | * NOTE: this class is not aimed to be used when we have connections in |
| | | * parallel. |
| | | * NOTE: this class is not aimed to be used when we have connections in parallel. |
| | | */ |
| | | public class ApplicationTrustManager implements X509TrustManager |
| | | { |
| | |
| | | */ |
| | | public enum Cause |
| | | { |
| | | /** |
| | | * The certificate was not trusted. |
| | | */ |
| | | /** The certificate was not trusted. */ |
| | | NOT_TRUSTED, |
| | | /** |
| | | * The certificate's subject DN's value and the host name we tried to |
| | | * connect to do not match. |
| | | */ |
| | | /** The certificate's subject DN's value and the host name we tried to connect to do not match. */ |
| | | HOST_NAME_MISMATCH |
| | | } |
| | | private static final LocalizedLogger logger = LocalizedLogger.getLoggerForThisClass(); |
| | |
| | | |
| | | private String host; |
| | | |
| | | |
| | | /** |
| | | * The default constructor. |
| | | * |
| | |
| | | } |
| | | } |
| | | |
| | | /** {@inheritDoc} */ |
| | | @Override |
| | | public void checkClientTrusted(X509Certificate[] chain, String authType) |
| | | throws CertificateException |
| | | { |
| | |
| | | { |
| | | try |
| | | { |
| | | verifyHostName(chain, authType); |
| | | verifyHostName(chain); |
| | | } |
| | | catch (CertificateException ce) |
| | | { |
| | |
| | | } |
| | | } |
| | | |
| | | /** {@inheritDoc} */ |
| | | @Override |
| | | public void checkServerTrusted(X509Certificate[] chain, |
| | | String authType) throws CertificateException |
| | | { |
| | |
| | | { |
| | | try |
| | | { |
| | | verifyHostName(chain, authType); |
| | | verifyHostName(chain); |
| | | } |
| | | catch (CertificateException ce) |
| | | { |
| | |
| | | throw new OpendsCertificateException(chain, ce); |
| | | } |
| | | |
| | | /** {@inheritDoc} */ |
| | | @Override |
| | | public X509Certificate[] getAcceptedIssuers() |
| | | { |
| | | if (trustManager != null) |
| | |
| | | * @throws CertificateException if the subject DN of the certificate does |
| | | * not match with the host name specified with the method setHost. |
| | | */ |
| | | private void verifyHostName(X509Certificate[] chain, String authType) |
| | | throws CertificateException |
| | | private void verifyHostName(X509Certificate[] chain) throws CertificateException |
| | | { |
| | | if (host != null) |
| | | { |