org.jsslutils.extra.gsi
Class GsiWrappingTrustManager

java.lang.Object
  org.jsslutils.extra.gsi.GsiWrappingTrustManager

All Implemented Interfaces:

TrustManager, X509TrustManager

public class GsiWrappingTrustManager
extends Object
implements X509TrustManager

TrustManager that accepts GSI proxy certificates (clients).

Author:

Bruno Harbulot.

Nested Class Summary

static class	GsiWrappingTrustManager.CertificateCriticalExtensionsNotSupported
static class	GsiWrappingTrustManager.Wrapper Wrapper factory class that wraps existing X509TrustManagers into GsiWrappingTrustManagers.

Field Summary

static String	KEY_USAGE_EXTENSION_OID_STRING
static String	PRERFC_EXTENSION_OID_STRING
static String	RFC3820_EXTENSION_OID_STRING

Constructor Summary

GsiWrappingTrustManager(X509TrustManager trustManager, boolean allowLegacy, boolean allowPreRfc, boolean allowRfc3820)
Creates a new instance from an existing X509TrustManager.

Method Summary

void	checkClientTrusted(X509Certificate[] chain, String authType) Checks that the client is trusted; the aim is to follow RFC 3820.
void	checkServerTrusted(X509Certificate[] chain, String authType) Checks that the server is trusted; in this case, it delegates this check to the trust manager it wraps.
X509Certificate[]	getAcceptedIssuers() Returns the accepted issuers; in this case, it delegates this to the trust manager it wraps.
static CertificateException	verifyLegacyProxyCertificate(X509Certificate[] chain, int eecCertIndex, Date date)
static CertificateException	verifyPreRfcProxyCertificate(X509Certificate[] chain, int eecCertIndex, Date date)
static CertificateException	verifyProxyCertificate(X509Certificate[] chain, int eecCertIndex, boolean allowLegacy, boolean allowPreRfc, boolean allowRfc3820, Date date)
static CertificateException	verifyProxyCertificate(X509Certificate[] chain, int eecCertIndex, Date date)
static CertificateException	verifyRfc3820ProxyCertificate(X509Certificate[] chain, int eecCertIndex, Date date)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

PRERFC_EXTENSION_OID_STRING

public static final String PRERFC_EXTENSION_OID_STRING

See Also:

Constant Field Values

RFC3820_EXTENSION_OID_STRING

public static final String RFC3820_EXTENSION_OID_STRING

See Also:

Constant Field Values

KEY_USAGE_EXTENSION_OID_STRING

public static final String KEY_USAGE_EXTENSION_OID_STRING

See Also:

Constant Field Values

Constructor Detail

GsiWrappingTrustManager

public GsiWrappingTrustManager(X509TrustManager trustManager,
                               boolean allowLegacy,
                               boolean allowPreRfc,
                               boolean allowRfc3820)

Creates a new instance from an existing X509TrustManager.

Parameters:

trustManager - X509TrustManager to wrap.

Method Detail

checkClientTrusted

public void checkClientTrusted(X509Certificate[] chain,
                               String authType)
                        throws CertificateException

Checks that the client is trusted; the aim is to follow RFC 3820.

Specified by:

checkClientTrusted in interface X509TrustManager

Throws:

CertificateException

checkServerTrusted

public void checkServerTrusted(X509Certificate[] chain,
                               String authType)
                        throws CertificateException

Checks that the server is trusted; in this case, it delegates this check to the trust manager it wraps.

Specified by:

checkServerTrusted in interface X509TrustManager

Throws:

CertificateException

getAcceptedIssuers

public X509Certificate[] getAcceptedIssuers()

Returns the accepted issuers; in this case, it delegates this to the trust manager it wraps.

Specified by:

getAcceptedIssuers in interface X509TrustManager

verifyProxyCertificate

public static CertificateException verifyProxyCertificate(X509Certificate[] chain,
                                                          int eecCertIndex,
                                                          Date date)

verifyProxyCertificate

public static CertificateException verifyProxyCertificate(X509Certificate[] chain,
                                                          int eecCertIndex,
                                                          boolean allowLegacy,
                                                          boolean allowPreRfc,
                                                          boolean allowRfc3820,
                                                          Date date)

verifyLegacyProxyCertificate

public static CertificateException verifyLegacyProxyCertificate(X509Certificate[] chain,
                                                                int eecCertIndex,
                                                                Date date)

verifyPreRfcProxyCertificate

public static CertificateException verifyPreRfcProxyCertificate(X509Certificate[] chain,
                                                                int eecCertIndex,
                                                                Date date)

verifyRfc3820ProxyCertificate

public static CertificateException verifyRfc3820ProxyCertificate(X509Certificate[] chain,
                                                                 int eecCertIndex,
                                                                 Date date)