Modifier and Type	Class and Description
private static class	SSLServerCertStore.CS This class allows the SSLServerCertStore to be accessed as a CertStore.
private static class	SSLServerCertStore.GetChainTrustManager

Modifier and Type	Field and Description
private static final HostnameVerifier	hostnameVerifier
private static final SSLSocketFactory	socketFactory
private static final SSLServerCertStore.GetChainTrustManager	trustManager
private final URI	uri

Access	Constructor and Description
pack-priv	SSLServerCertStore(URI uri)

Modifier and Type	Method and Description
public Collection<X509Certificate>	engineGetCertificates(CertSelector selector) Implements abstract java.security.cert.CertStoreSpi.engineGetCertificates. Returns a `Collection` of `Certificate`s that match the specified selector.
public Collection<X509CRL>	engineGetCRLs(CRLSelector selector) Implements abstract java.security.cert.CertStoreSpi.engineGetCRLs. Returns a `Collection` of `CRL`s that match the specified selector.
public static CertStore	getInstance(URI uri)
private static List<X509Certificate>	getMatchingCerts(List<X509Certificate> certs, CertSelector selector)

hostnameVerifier	back to summary
private static final HostnameVerifier hostnameVerifier

socketFactory	back to summary
private static final SSLSocketFactory socketFactory

trustManager	back to summary
private static final SSLServerCertStore.GetChainTrustManager trustManager

uri	back to summary
private final URI uri

SSLServerCertStore	back to summary
pack-priv SSLServerCertStore(URI uri) throws InvalidAlgorithmParameterException

Method Detail

engineGetCertificates back to summary

engineGetCertificates	back to summary
public Collection<X509Certificate> engineGetCertificates(CertSelector selector) throws CertStoreException Implements abstract java.security.cert.CertStoreSpi.engineGetCertificates. Doc from java.security.cert.CertStoreSpi.engineGetCertificates. Returns a `Collection` of `Certificate`s that match the specified selector. If no `Certificate`s match the selector, an empty `Collection` will be returned. For some `CertStore` types, the resulting `Collection` may not contain all of the `Certificate`s that match the selector. For instance, an LDAP `CertStore` may not search all entries in the directory. Instead, it may just search entries that are likely to contain the `Certificate`s it is looking for. Some `CertStore` implementations (especially LDAP `CertStore`s) may throw a `CertStoreException` unless a non-null `CertSelector` is provided that includes specific criteria that can be used to find the certificates. Issuer and/or subject names are especially useful criteria. Exceptions CertStoreException: if an exception occurs

public Collection<X509Certificate> engineGetCertificates(CertSelector selector) throws CertStoreException

Implements abstract java.security.cert.CertStoreSpi.engineGetCertificates.

Doc from java.security.cert.CertStoreSpi.engineGetCertificates.

Returns a Collection of Certificates that match the specified selector. If no Certificates match the selector, an empty Collection will be returned.

For some CertStore types, the resulting Collection may not contain all of the Certificates that match the selector. For instance, an LDAP CertStore may not search all entries in the directory. Instead, it may just search entries that are likely to contain the Certificates it is looking for.

Some CertStore implementations (especially LDAP CertStores) may throw a CertStoreException unless a non-null CertSelector is provided that includes specific criteria that can be used to find the certificates. Issuer and/or subject names are especially useful criteria.

Exceptions

CertStoreException:: if an exception occurs

engineGetCRLs back to summary

engineGetCRLs	back to summary
public Collection<X509CRL> engineGetCRLs(CRLSelector selector) throws CertStoreException Implements abstract java.security.cert.CertStoreSpi.engineGetCRLs. Doc from java.security.cert.CertStoreSpi.engineGetCRLs. Returns a `Collection` of `CRL`s that match the specified selector. If no `CRL`s match the selector, an empty `Collection` will be returned. For some `CertStore` types, the resulting `Collection` may not contain all of the `CRL`s that match the selector. For instance, an LDAP `CertStore` may not search all entries in the directory. Instead, it may just search entries that are likely to contain the `CRL`s it is looking for. Some `CertStore` implementations (especially LDAP `CertStore`s) may throw a `CertStoreException` unless a non-null `CRLSelector` is provided that includes specific criteria that can be used to find the CRLs. Issuer names and/or the certificate to be checked are especially useful. Exceptions CertStoreException: if an exception occurs

public Collection<X509CRL> engineGetCRLs(CRLSelector selector) throws CertStoreException

Implements abstract java.security.cert.CertStoreSpi.engineGetCRLs.

Doc from java.security.cert.CertStoreSpi.engineGetCRLs.

Returns a Collection of CRLs that match the specified selector. If no CRLs match the selector, an empty Collection will be returned.

For some CertStore types, the resulting Collection may not contain all of the CRLs that match the selector. For instance, an LDAP CertStore may not search all entries in the directory. Instead, it may just search entries that are likely to contain the CRLs it is looking for.

Some CertStore implementations (especially LDAP CertStores) may throw a CertStoreException unless a non-null CRLSelector is provided that includes specific criteria that can be used to find the CRLs. Issuer names and/or the certificate to be checked are especially useful.

Exceptions

CertStoreException:: if an exception occurs

getInstance	back to summary
public static CertStore getInstance(URI uri) throws InvalidAlgorithmParameterException

getMatchingCerts	back to summary
private static List<X509Certificate> getMatchingCerts(List<X509Certificate> certs, CertSelector selector)

Access	Constructor and Description
protected	CS(CertStoreSpi spi, Provider p, String type, CertStoreParameters params)

CS	back to summary
protected CS(CertStoreSpi spi, Provider p, String type, CertStoreParameters params)

sun.security.provider.certpath.ssl back to summary

private Class SSLServerCertStore.GetChainTrustManager

Class Inheritance

extends X509ExtendedTrustManager

java.lang.Object
javax.net.ssl.X509ExtendedTrustManager
sun.security.provider.certpath.ssl.SSLServerCertStore.GetChainTrustManager

Field Summary

Modifier and Type	Field and Description
private boolean	exchangedServerCerts
private List<X509Certificate>	serverChain

Constructor Summary

Access	Constructor and Description
private	GetChainTrustManager()

Method Summary

Modifier and Type	Method and Description
public void	checkClientTrusted(X509Certificate[] chain, String authType) Implements javax.net.ssl.X509TrustManager.checkClientTrusted. Given the partial or complete certificate chain provided by the peer, build a certificate path to a trusted root and return if it can be validated and is trusted for client SSL authentication based on the authentication type.
public void	checkClientTrusted(X509Certificate[] chain, String authType, Socket socket) Implements abstract javax.net.ssl.X509ExtendedTrustManager.checkClientTrusted. Given the partial or complete certificate chain provided by the peer, build and validate the certificate path based on the authentication type and ssl parameters.
public void	checkClientTrusted(X509Certificate[] chain, String authType, SSLEngine engine) Implements abstract javax.net.ssl.X509ExtendedTrustManager.checkClientTrusted. Given the partial or complete certificate chain provided by the peer, build and validate the certificate path based on the authentication type and ssl parameters.
public void	checkServerTrusted(X509Certificate[] chain, String authType) Implements javax.net.ssl.X509TrustManager.checkServerTrusted. Given the partial or complete certificate chain provided by the peer, build a certificate path to a trusted root and return if it can be validated and is trusted for server SSL authentication based on the authentication type.
public void	checkServerTrusted(X509Certificate[] chain, String authType, Socket socket) Implements abstract javax.net.ssl.X509ExtendedTrustManager.checkServerTrusted. Given the partial or complete certificate chain provided by the peer, build and validate the certificate path based on the authentication type and ssl parameters.
public void	checkServerTrusted(X509Certificate[] chain, String authType, SSLEngine engine) Implements abstract javax.net.ssl.X509ExtendedTrustManager.checkServerTrusted. Given the partial or complete certificate chain provided by the peer, build and validate the certificate path based on the authentication type and ssl parameters.
pack-priv void	cleanup()
public X509Certificate[]	getAcceptedIssuers() Implements javax.net.ssl.X509TrustManager.getAcceptedIssuers. Return an array of certificate authority certificates which are trusted for authenticating peers.

Field Detail

exchangedServerCerts	back to summary
private boolean exchangedServerCerts

serverChain	back to summary
private List<X509Certificate> serverChain

Constructor Detail

GetChainTrustManager	back to summary
private GetChainTrustManager()

Method Detail

checkClientTrusted	back to summary
public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException Implements javax.net.ssl.X509TrustManager.checkClientTrusted. Doc from javax.net.ssl.X509TrustManager.checkClientTrusted. Given the partial or complete certificate chain provided by the peer, build a certificate path to a trusted root and return if it can be validated and is trusted for client SSL authentication based on the authentication type. The authentication type is determined by the actual certificate used. For instance, if RSAPublicKey is used, the authType should be "RSA". Checking is case-sensitive. Annotations @Override Exceptions CertificateException: if the certificate chain is not trusted by this TrustManager.

checkClientTrusted

back to summary

public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException

Implements javax.net.ssl.X509TrustManager.checkClientTrusted.

Doc from javax.net.ssl.X509TrustManager.checkClientTrusted.

Given the partial or complete certificate chain provided by the peer, build a certificate path to a trusted root and return if it can be validated and is trusted for client SSL authentication based on the authentication type.

The authentication type is determined by the actual certificate used. For instance, if RSAPublicKey is used, the authType should be "RSA". Checking is case-sensitive.

Annotations

@Override

Exceptions

CertificateException:: if the certificate chain is not trusted by this TrustManager.

checkClientTrusted back to summary

checkClientTrusted	back to summary
public void checkClientTrusted(X509Certificate[] chain, String authType, Socket socket) throws CertificateException Implements abstract javax.net.ssl.X509ExtendedTrustManager.checkClientTrusted. Doc from javax.net.ssl.X509ExtendedTrustManager.checkClientTrusted. Given the partial or complete certificate chain provided by the peer, build and validate the certificate path based on the authentication type and ssl parameters. The authentication type is determined by the actual certificate used. For instance, if RSAPublicKey is used, the authType should be "RSA". Checking is case-sensitive. If the `socket` parameter is an instance of `javax.net.ssl.SSLSocket`, and the endpoint identification algorithm of the `SSLParameters` is non-empty, to prevent man-in-the-middle attacks, the address that the `socket` connected to should be checked against the peer's identity presented in the end-entity X509 certificate, as specified in the endpoint identification algorithm. If the `socket` parameter is an instance of `javax.net.ssl.SSLSocket`, and the algorithm constraints of the `SSLParameters` is non-null, for every certificate in the certification path, fields such as subject public key, the signature algorithm, key usage, extended key usage, etc. need to conform to the algorithm constraints in place on this socket. Annotations @Override Exceptions CertificateException: if the certificate chain is not trusted by this TrustManager

public void checkClientTrusted(X509Certificate[] chain, String authType, Socket socket) throws CertificateException

Implements abstract javax.net.ssl.X509ExtendedTrustManager.checkClientTrusted.

Doc from javax.net.ssl.X509ExtendedTrustManager.checkClientTrusted.

Given the partial or complete certificate chain provided by the peer, build and validate the certificate path based on the authentication type and ssl parameters.

The authentication type is determined by the actual certificate used. For instance, if RSAPublicKey is used, the authType should be "RSA". Checking is case-sensitive.

If the socket parameter is an instance of javax.net.ssl.SSLSocket, and the endpoint identification algorithm of the SSLParameters is non-empty, to prevent man-in-the-middle attacks, the address that the socket connected to should be checked against the peer's identity presented in the end-entity X509 certificate, as specified in the endpoint identification algorithm.

If the socket parameter is an instance of javax.net.ssl.SSLSocket, and the algorithm constraints of the SSLParameters is non-null, for every certificate in the certification path, fields such as subject public key, the signature algorithm, key usage, extended key usage, etc. need to conform to the algorithm constraints in place on this socket.

Annotations

@Override

Exceptions

CertificateException:: if the certificate chain is not trusted by this TrustManager

checkClientTrusted back to summary

checkClientTrusted	back to summary
public void checkClientTrusted(X509Certificate[] chain, String authType, SSLEngine engine) throws CertificateException Implements abstract javax.net.ssl.X509ExtendedTrustManager.checkClientTrusted. Doc from javax.net.ssl.X509ExtendedTrustManager.checkClientTrusted. Given the partial or complete certificate chain provided by the peer, build and validate the certificate path based on the authentication type and ssl parameters. The authentication type is determined by the actual certificate used. For instance, if RSAPublicKey is used, the authType should be "RSA". Checking is case-sensitive. If the `engine` parameter is available, and the endpoint identification algorithm of the `SSLParameters` is non-empty, to prevent man-in-the-middle attacks, the address that the `engine` connected to should be checked against the peer's identity presented in the end-entity X509 certificate, as specified in the endpoint identification algorithm. If the `engine` parameter is available, and the algorithm constraints of the `SSLParameters` is non-null, for every certificate in the certification path, fields such as subject public key, the signature algorithm, key usage, extended key usage, etc. need to conform to the algorithm constraints in place on this engine. Annotations @Override Exceptions CertificateException: if the certificate chain is not trusted by this TrustManager

public void checkClientTrusted(X509Certificate[] chain, String authType, SSLEngine engine) throws CertificateException

Implements abstract javax.net.ssl.X509ExtendedTrustManager.checkClientTrusted.

Doc from javax.net.ssl.X509ExtendedTrustManager.checkClientTrusted.

Given the partial or complete certificate chain provided by the peer, build and validate the certificate path based on the authentication type and ssl parameters.

The authentication type is determined by the actual certificate used. For instance, if RSAPublicKey is used, the authType should be "RSA". Checking is case-sensitive.

If the engine parameter is available, and the endpoint identification algorithm of the SSLParameters is non-empty, to prevent man-in-the-middle attacks, the address that the engine connected to should be checked against the peer's identity presented in the end-entity X509 certificate, as specified in the endpoint identification algorithm.

If the engine parameter is available, and the algorithm constraints of the SSLParameters is non-null, for every certificate in the certification path, fields such as subject public key, the signature algorithm, key usage, extended key usage, etc. need to conform to the algorithm constraints in place on this engine.

Annotations

@Override

Exceptions

CertificateException:: if the certificate chain is not trusted by this TrustManager

checkServerTrusted	back to summary
public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException Implements javax.net.ssl.X509TrustManager.checkServerTrusted. Doc from javax.net.ssl.X509TrustManager.checkServerTrusted. Given the partial or complete certificate chain provided by the peer, build a certificate path to a trusted root and return if it can be validated and is trusted for server SSL authentication based on the authentication type. The authentication type is the key exchange algorithm portion of the cipher suites represented as a String, such as "RSA", "DHE_DSS". Note for some exportable cipher suites, the key exchange algorithm is determined at run time during the handshake. For instance, for TLS_RSA_EXPORT_WITH_RC4_40_MD5, the authType should be RSA_EXPORT when an ephemeral RSA key is used for the key exchange, and RSA when the key from the server certificate is used. Checking is case-sensitive. Annotations @Override Exceptions CertificateException: if the certificate chain is not trusted by this TrustManager.

checkServerTrusted

back to summary

public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException

Implements javax.net.ssl.X509TrustManager.checkServerTrusted.

Doc from javax.net.ssl.X509TrustManager.checkServerTrusted.

Given the partial or complete certificate chain provided by the peer, build a certificate path to a trusted root and return if it can be validated and is trusted for server SSL authentication based on the authentication type.

The authentication type is the key exchange algorithm portion of the cipher suites represented as a String, such as "RSA", "DHE_DSS".

Note

for some exportable cipher suites, the key exchange algorithm is determined at run time during the handshake. For instance, for TLS_RSA_EXPORT_WITH_RC4_40_MD5, the authType should be RSA_EXPORT when an ephemeral RSA key is used for the key exchange, and RSA when the key from the server certificate is used. Checking is case-sensitive.

Annotations

@Override

Exceptions

CertificateException:: if the certificate chain is not trusted by this TrustManager.

checkServerTrusted back to summary

checkServerTrusted	back to summary
public void checkServerTrusted(X509Certificate[] chain, String authType, Socket socket) throws CertificateException Implements abstract javax.net.ssl.X509ExtendedTrustManager.checkServerTrusted. Doc from javax.net.ssl.X509ExtendedTrustManager.checkServerTrusted. Given the partial or complete certificate chain provided by the peer, build and validate the certificate path based on the authentication type and ssl parameters. The authentication type is the key exchange algorithm portion of the cipher suites represented as a String, such as "RSA", "DHE_DSS". Note for some exportable cipher suites, the key exchange algorithm is determined at run time during the handshake. For instance, for TLS_RSA_EXPORT_WITH_RC4_40_MD5, the authType should be RSA_EXPORT when an ephemeral RSA key is used for the key exchange, and RSA when the key from the server certificate is used. Checking is case-sensitive. If the `socket` parameter is an instance of `javax.net.ssl.SSLSocket`, and the endpoint identification algorithm of the `SSLParameters` is non-empty, to prevent man-in-the-middle attacks, the address that the `socket` connected to should be checked against the peer's identity presented in the end-entity X509 certificate, as specified in the endpoint identification algorithm. If the `socket` parameter is an instance of `javax.net.ssl.SSLSocket`, and the algorithm constraints of the `SSLParameters` is non-null, for every certificate in the certification path, fields such as subject public key, the signature algorithm, key usage, extended key usage, etc. need to conform to the algorithm constraints in place on this socket. Annotations @Override Exceptions CertificateException: if the certificate chain is not trusted by this TrustManager

public void checkServerTrusted(X509Certificate[] chain, String authType, Socket socket) throws CertificateException

Implements abstract javax.net.ssl.X509ExtendedTrustManager.checkServerTrusted.

Doc from javax.net.ssl.X509ExtendedTrustManager.checkServerTrusted.

Given the partial or complete certificate chain provided by the peer, build and validate the certificate path based on the authentication type and ssl parameters.

The authentication type is the key exchange algorithm portion of the cipher suites represented as a String, such as "RSA", "DHE_DSS".

Note

Annotations

@Override

Exceptions

CertificateException:: if the certificate chain is not trusted by this TrustManager

checkServerTrusted back to summary

checkServerTrusted	back to summary
public void checkServerTrusted(X509Certificate[] chain, String authType, SSLEngine engine) throws CertificateException Implements abstract javax.net.ssl.X509ExtendedTrustManager.checkServerTrusted. Doc from javax.net.ssl.X509ExtendedTrustManager.checkServerTrusted. Given the partial or complete certificate chain provided by the peer, build and validate the certificate path based on the authentication type and ssl parameters. The authentication type is the key exchange algorithm portion of the cipher suites represented as a String, such as "RSA", "DHE_DSS". Note for some exportable cipher suites, the key exchange algorithm is determined at run time during the handshake. For instance, for TLS_RSA_EXPORT_WITH_RC4_40_MD5, the authType should be RSA_EXPORT when an ephemeral RSA key is used for the key exchange, and RSA when the key from the server certificate is used. Checking is case-sensitive. If the `engine` parameter is available, and the endpoint identification algorithm of the `SSLParameters` is non-empty, to prevent man-in-the-middle attacks, the address that the `engine` connected to should be checked against the peer's identity presented in the end-entity X509 certificate, as specified in the endpoint identification algorithm. If the `engine` parameter is available, and the algorithm constraints of the `SSLParameters` is non-null, for every certificate in the certification path, fields such as subject public key, the signature algorithm, key usage, extended key usage, etc. need to conform to the algorithm constraints in place on this engine. Annotations @Override Exceptions CertificateException: if the certificate chain is not trusted by this TrustManager

public void checkServerTrusted(X509Certificate[] chain, String authType, SSLEngine engine) throws CertificateException

Implements abstract javax.net.ssl.X509ExtendedTrustManager.checkServerTrusted.

Doc from javax.net.ssl.X509ExtendedTrustManager.checkServerTrusted.

Given the partial or complete certificate chain provided by the peer, build and validate the certificate path based on the authentication type and ssl parameters.

The authentication type is the key exchange algorithm portion of the cipher suites represented as a String, such as "RSA", "DHE_DSS".

Note

Annotations

@Override

Exceptions

CertificateException:: if the certificate chain is not trusted by this TrustManager

cleanup	back to summary
pack-priv void cleanup()

getAcceptedIssuers	back to summary
public X509Certificate[] getAcceptedIssuers() Implements javax.net.ssl.X509TrustManager.getAcceptedIssuers. Doc from javax.net.ssl.X509TrustManager.getAcceptedIssuers. Return an array of certificate authority certificates which are trusted for authenticating peers. Annotations @Override

getAcceptedIssuers

back to summary

public X509Certificate[] getAcceptedIssuers()

Implements javax.net.ssl.X509TrustManager.getAcceptedIssuers.

Doc from javax.net.ssl.X509TrustManager.getAcceptedIssuers.

Return an array of certificate authority certificates which are trusted for authenticating peers.

Annotations

@Override

public final Class SSLServerCertStore

Nested and Inner Type Summary

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail

private Class SSLServerCertStore.CS

Constructor Summary

Method Summary

Constructor Detail

private Class SSLServerCertStore.GetChainTrustManager

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail