OpenJDK 27 · sun.security.ssl.X509TrustManagerImpl · APIdia, the JavaDoc alternative

Modifier and Type	Field and Description
private volatile Validator	clientValidator
private final PKIXBuilderParameters	pkixParams
private volatile Validator	serverValidator
private final Collection<X509Certificate>	trustedCerts The Set of trusted X509Certificates.
private final ReentrantLock	validatorLock
private final String	validatorType

Access	Constructor and Description
pack-priv	X509TrustManagerImpl(String validatorType, Collection<X509Certificate> trustedCerts)
pack-priv	X509TrustManagerImpl(String validatorType, PKIXBuilderParameters params)

Method Summary

Modifier and Type	Method and Description
public void	checkClientTrusted(X509Certificate[] chain, String authType) Implements javax.net.ssl.X509TrustManager.checkClientTrusted. Given the partial or complete certificate chain provided by the peer, build a certificate path to a trusted root and return if it can be validated and is trusted for client SSL authentication based on the authentication type.
public void	checkClientTrusted(X509Certificate[] chain, String authType, Socket socket) Implements abstract javax.net.ssl.X509ExtendedTrustManager.checkClientTrusted. Given the partial or complete certificate chain provided by the peer, build and validate the certificate path based on the authentication type and ssl parameters.
public void	checkClientTrusted(X509Certificate[] chain, String authType, SSLEngine engine) Implements abstract javax.net.ssl.X509ExtendedTrustManager.checkClientTrusted. Given the partial or complete certificate chain provided by the peer, build and validate the certificate path based on the authentication type and ssl parameters.
public void	checkClientTrusted(X509Certificate[] chain, String authType, QuicTLSEngineImpl quicTLSEngine)
pack-priv static void	checkIdentity(SSLSession session, X509Certificate[] trustedChain, String algorithm, boolean checkClientTrusted)
pack-priv static void	checkIdentity(String hostname, X509Certificate cert, String algorithm)
private static void	checkIdentity(String hostname, X509Certificate cert, String algorithm, boolean chainsToPublicCA)
public void	checkServerTrusted(X509Certificate[] chain, String authType) Implements javax.net.ssl.X509TrustManager.checkServerTrusted. Given the partial or complete certificate chain provided by the peer, build a certificate path to a trusted root and return if it can be validated and is trusted for server SSL authentication based on the authentication type.
public void	checkServerTrusted(X509Certificate[] chain, String authType, Socket socket) Implements abstract javax.net.ssl.X509ExtendedTrustManager.checkServerTrusted. Given the partial or complete certificate chain provided by the peer, build and validate the certificate path based on the authentication type and ssl parameters.
public void	checkServerTrusted(X509Certificate[] chain, String authType, SSLEngine engine) Implements abstract javax.net.ssl.X509ExtendedTrustManager.checkServerTrusted. Given the partial or complete certificate chain provided by the peer, build and validate the certificate path based on the authentication type and ssl parameters.
pack-priv void	checkServerTrusted(X509Certificate[] chain, String authType, QuicTLSEngineImpl quicTLSEngine)
private void	checkTrusted(X509Certificate[] chain, String authType, Socket socket, boolean checkClientTrusted)
private void	checkTrusted(X509Certificate[] chain, String authType, SSLEngine engine, boolean checkClientTrusted)
private void	checkTrusted(X509Certificate[] chain, String authType, QuicTLSEngineImpl quicTLSEngine, boolean checkClientTrusted)
private Validator	checkTrustedInit(X509Certificate[] chain, String authType, boolean checkClientTrusted)
private void	findTrustedCertificate(X509Certificate[] chain, String authType, SSLSession session, AlgorithmConstraints constraints, String identityAlg, boolean checkClientTrusted)
public X509Certificate[]	getAcceptedIssuers() Implements javax.net.ssl.X509TrustManager.getAcceptedIssuers. Return an array of certificate authority certificates which are trusted for authenticating peers.
private static String	getHostNameInSNI(List<SNIServerName> sniNames)
pack-priv static List<SNIServerName>	getRequestedServerNames(Socket socket)
pack-priv static List<SNIServerName>	getRequestedServerNames(SSLEngine engine)
pack-priv static List<SNIServerName>	getRequestedServerNames(QuicTLSEngineImpl engine)
private static List<SNIServerName>	getRequestedServerNames(SSLSession session)
private Validator	getValidator(String variant)

clientValidator	back to summary
private volatile Validator clientValidator

pkixParams	back to summary
private final PKIXBuilderParameters pkixParams

serverValidator	back to summary
private volatile Validator serverValidator

trustedCerts	back to summary
private final Collection<X509Certificate> trustedCerts The Set of trusted X509Certificates.

validatorLock	back to summary
private final ReentrantLock validatorLock

validatorType	back to summary
private final String validatorType

X509TrustManagerImpl	back to summary
pack-priv X509TrustManagerImpl(String validatorType, Collection<X509Certificate> trustedCerts)

X509TrustManagerImpl	back to summary
pack-priv X509TrustManagerImpl(String validatorType, PKIXBuilderParameters params)

Method Detail

checkClientTrusted	back to summary
public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException Implements javax.net.ssl.X509TrustManager.checkClientTrusted. Doc from javax.net.ssl.X509TrustManager.checkClientTrusted. Given the partial or complete certificate chain provided by the peer, build a certificate path to a trusted root and return if it can be validated and is trusted for client SSL authentication based on the authentication type. The authentication type is determined by the actual certificate used. For instance, if RSAPublicKey is used, the authType should be "RSA". Checking is case-sensitive. Annotations @Override Exceptions CertificateException: if the certificate chain is not trusted by this TrustManager.

checkClientTrusted

back to summary

public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException

Implements javax.net.ssl.X509TrustManager.checkClientTrusted.

Doc from javax.net.ssl.X509TrustManager.checkClientTrusted.

Given the partial or complete certificate chain provided by the peer, build a certificate path to a trusted root and return if it can be validated and is trusted for client SSL authentication based on the authentication type.

The authentication type is determined by the actual certificate used. For instance, if RSAPublicKey is used, the authType should be "RSA". Checking is case-sensitive.

Annotations

@Override

Exceptions

CertificateException:: if the certificate chain is not trusted by this TrustManager.

checkClientTrusted back to summary

checkClientTrusted	back to summary
public void checkClientTrusted(X509Certificate[] chain, String authType, Socket socket) throws CertificateException Implements abstract javax.net.ssl.X509ExtendedTrustManager.checkClientTrusted. Doc from javax.net.ssl.X509ExtendedTrustManager.checkClientTrusted. Given the partial or complete certificate chain provided by the peer, build and validate the certificate path based on the authentication type and ssl parameters. The authentication type is determined by the actual certificate used. For instance, if RSAPublicKey is used, the authType should be "RSA". Checking is case-sensitive. If the `socket` parameter is an instance of `javax.net.ssl.SSLSocket`, and the endpoint identification algorithm of the `SSLParameters` is non-empty, to prevent man-in-the-middle attacks, the address that the `socket` connected to should be checked against the peer's identity presented in the end-entity X509 certificate, as specified in the endpoint identification algorithm. If the `socket` parameter is an instance of `javax.net.ssl.SSLSocket`, and the algorithm constraints of the `SSLParameters` is non-null, for every certificate in the certification path, fields such as subject public key, the signature algorithm, key usage, extended key usage, etc. need to conform to the algorithm constraints in place on this socket. Annotations @Override Exceptions CertificateException: if the certificate chain is not trusted by this TrustManager

public void checkClientTrusted(X509Certificate[] chain, String authType, Socket socket) throws CertificateException

Implements abstract javax.net.ssl.X509ExtendedTrustManager.checkClientTrusted.

Doc from javax.net.ssl.X509ExtendedTrustManager.checkClientTrusted.

Given the partial or complete certificate chain provided by the peer, build and validate the certificate path based on the authentication type and ssl parameters.

The authentication type is determined by the actual certificate used. For instance, if RSAPublicKey is used, the authType should be "RSA". Checking is case-sensitive.

If the socket parameter is an instance of javax.net.ssl.SSLSocket, and the endpoint identification algorithm of the SSLParameters is non-empty, to prevent man-in-the-middle attacks, the address that the socket connected to should be checked against the peer's identity presented in the end-entity X509 certificate, as specified in the endpoint identification algorithm.

If the socket parameter is an instance of javax.net.ssl.SSLSocket, and the algorithm constraints of the SSLParameters is non-null, for every certificate in the certification path, fields such as subject public key, the signature algorithm, key usage, extended key usage, etc. need to conform to the algorithm constraints in place on this socket.

Annotations

@Override

Exceptions

CertificateException:: if the certificate chain is not trusted by this TrustManager

checkClientTrusted back to summary

checkClientTrusted	back to summary
public void checkClientTrusted(X509Certificate[] chain, String authType, SSLEngine engine) throws CertificateException Implements abstract javax.net.ssl.X509ExtendedTrustManager.checkClientTrusted. Doc from javax.net.ssl.X509ExtendedTrustManager.checkClientTrusted. Given the partial or complete certificate chain provided by the peer, build and validate the certificate path based on the authentication type and ssl parameters. The authentication type is determined by the actual certificate used. For instance, if RSAPublicKey is used, the authType should be "RSA". Checking is case-sensitive. If the `engine` parameter is available, and the endpoint identification algorithm of the `SSLParameters` is non-empty, to prevent man-in-the-middle attacks, the address that the `engine` connected to should be checked against the peer's identity presented in the end-entity X509 certificate, as specified in the endpoint identification algorithm. If the `engine` parameter is available, and the algorithm constraints of the `SSLParameters` is non-null, for every certificate in the certification path, fields such as subject public key, the signature algorithm, key usage, extended key usage, etc. need to conform to the algorithm constraints in place on this engine. Annotations @Override Exceptions CertificateException: if the certificate chain is not trusted by this TrustManager

public void checkClientTrusted(X509Certificate[] chain, String authType, SSLEngine engine) throws CertificateException

Implements abstract javax.net.ssl.X509ExtendedTrustManager.checkClientTrusted.

Doc from javax.net.ssl.X509ExtendedTrustManager.checkClientTrusted.

Given the partial or complete certificate chain provided by the peer, build and validate the certificate path based on the authentication type and ssl parameters.

The authentication type is determined by the actual certificate used. For instance, if RSAPublicKey is used, the authType should be "RSA". Checking is case-sensitive.

If the engine parameter is available, and the endpoint identification algorithm of the SSLParameters is non-empty, to prevent man-in-the-middle attacks, the address that the engine connected to should be checked against the peer's identity presented in the end-entity X509 certificate, as specified in the endpoint identification algorithm.

If the engine parameter is available, and the algorithm constraints of the SSLParameters is non-null, for every certificate in the certification path, fields such as subject public key, the signature algorithm, key usage, extended key usage, etc. need to conform to the algorithm constraints in place on this engine.

Annotations

@Override

Exceptions

CertificateException:: if the certificate chain is not trusted by this TrustManager

checkClientTrusted	back to summary
public void checkClientTrusted(X509Certificate[] chain, String authType, QuicTLSEngineImpl quicTLSEngine) throws CertificateException

checkIdentity	back to summary
pack-priv static void checkIdentity(SSLSession session, X509Certificate[] trustedChain, String algorithm, boolean checkClientTrusted) throws CertificateException

checkIdentity	back to summary
pack-priv static void checkIdentity(String hostname, X509Certificate cert, String algorithm) throws CertificateException

checkIdentity	back to summary
private static void checkIdentity(String hostname, X509Certificate cert, String algorithm, boolean chainsToPublicCA) throws CertificateException

checkServerTrusted	back to summary
public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException Implements javax.net.ssl.X509TrustManager.checkServerTrusted. Doc from javax.net.ssl.X509TrustManager.checkServerTrusted. Given the partial or complete certificate chain provided by the peer, build a certificate path to a trusted root and return if it can be validated and is trusted for server SSL authentication based on the authentication type. The authentication type is the key exchange algorithm portion of the cipher suites represented as a String, such as "RSA", "DHE_DSS". Note for some exportable cipher suites, the key exchange algorithm is determined at run time during the handshake. For instance, for TLS_RSA_EXPORT_WITH_RC4_40_MD5, the authType should be RSA_EXPORT when an ephemeral RSA key is used for the key exchange, and RSA when the key from the server certificate is used. Checking is case-sensitive. Annotations @Override Exceptions CertificateException: if the certificate chain is not trusted by this TrustManager.

checkServerTrusted

back to summary

public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException

Implements javax.net.ssl.X509TrustManager.checkServerTrusted.

Doc from javax.net.ssl.X509TrustManager.checkServerTrusted.

Given the partial or complete certificate chain provided by the peer, build a certificate path to a trusted root and return if it can be validated and is trusted for server SSL authentication based on the authentication type.

The authentication type is the key exchange algorithm portion of the cipher suites represented as a String, such as "RSA", "DHE_DSS".

Note

for some exportable cipher suites, the key exchange algorithm is determined at run time during the handshake. For instance, for TLS_RSA_EXPORT_WITH_RC4_40_MD5, the authType should be RSA_EXPORT when an ephemeral RSA key is used for the key exchange, and RSA when the key from the server certificate is used. Checking is case-sensitive.

Annotations

@Override

Exceptions

CertificateException:: if the certificate chain is not trusted by this TrustManager.

checkServerTrusted back to summary

checkServerTrusted	back to summary
public void checkServerTrusted(X509Certificate[] chain, String authType, Socket socket) throws CertificateException Implements abstract javax.net.ssl.X509ExtendedTrustManager.checkServerTrusted. Doc from javax.net.ssl.X509ExtendedTrustManager.checkServerTrusted. Given the partial or complete certificate chain provided by the peer, build and validate the certificate path based on the authentication type and ssl parameters. The authentication type is the key exchange algorithm portion of the cipher suites represented as a String, such as "RSA", "DHE_DSS". Note for some exportable cipher suites, the key exchange algorithm is determined at run time during the handshake. For instance, for TLS_RSA_EXPORT_WITH_RC4_40_MD5, the authType should be RSA_EXPORT when an ephemeral RSA key is used for the key exchange, and RSA when the key from the server certificate is used. Checking is case-sensitive. If the `socket` parameter is an instance of `javax.net.ssl.SSLSocket`, and the endpoint identification algorithm of the `SSLParameters` is non-empty, to prevent man-in-the-middle attacks, the address that the `socket` connected to should be checked against the peer's identity presented in the end-entity X509 certificate, as specified in the endpoint identification algorithm. If the `socket` parameter is an instance of `javax.net.ssl.SSLSocket`, and the algorithm constraints of the `SSLParameters` is non-null, for every certificate in the certification path, fields such as subject public key, the signature algorithm, key usage, extended key usage, etc. need to conform to the algorithm constraints in place on this socket. Annotations @Override Exceptions CertificateException: if the certificate chain is not trusted by this TrustManager

public void checkServerTrusted(X509Certificate[] chain, String authType, Socket socket) throws CertificateException

Implements abstract javax.net.ssl.X509ExtendedTrustManager.checkServerTrusted.

Doc from javax.net.ssl.X509ExtendedTrustManager.checkServerTrusted.

Given the partial or complete certificate chain provided by the peer, build and validate the certificate path based on the authentication type and ssl parameters.

The authentication type is the key exchange algorithm portion of the cipher suites represented as a String, such as "RSA", "DHE_DSS".

Note

Annotations

@Override

Exceptions

CertificateException:: if the certificate chain is not trusted by this TrustManager

checkServerTrusted back to summary

checkServerTrusted	back to summary
public void checkServerTrusted(X509Certificate[] chain, String authType, SSLEngine engine) throws CertificateException Implements abstract javax.net.ssl.X509ExtendedTrustManager.checkServerTrusted. Doc from javax.net.ssl.X509ExtendedTrustManager.checkServerTrusted. Given the partial or complete certificate chain provided by the peer, build and validate the certificate path based on the authentication type and ssl parameters. The authentication type is the key exchange algorithm portion of the cipher suites represented as a String, such as "RSA", "DHE_DSS". Note for some exportable cipher suites, the key exchange algorithm is determined at run time during the handshake. For instance, for TLS_RSA_EXPORT_WITH_RC4_40_MD5, the authType should be RSA_EXPORT when an ephemeral RSA key is used for the key exchange, and RSA when the key from the server certificate is used. Checking is case-sensitive. If the `engine` parameter is available, and the endpoint identification algorithm of the `SSLParameters` is non-empty, to prevent man-in-the-middle attacks, the address that the `engine` connected to should be checked against the peer's identity presented in the end-entity X509 certificate, as specified in the endpoint identification algorithm. If the `engine` parameter is available, and the algorithm constraints of the `SSLParameters` is non-null, for every certificate in the certification path, fields such as subject public key, the signature algorithm, key usage, extended key usage, etc. need to conform to the algorithm constraints in place on this engine. Annotations @Override Exceptions CertificateException: if the certificate chain is not trusted by this TrustManager

public void checkServerTrusted(X509Certificate[] chain, String authType, SSLEngine engine) throws CertificateException

Implements abstract javax.net.ssl.X509ExtendedTrustManager.checkServerTrusted.

Doc from javax.net.ssl.X509ExtendedTrustManager.checkServerTrusted.

Given the partial or complete certificate chain provided by the peer, build and validate the certificate path based on the authentication type and ssl parameters.

The authentication type is the key exchange algorithm portion of the cipher suites represented as a String, such as "RSA", "DHE_DSS".

Note

Annotations

@Override

Exceptions

CertificateException:: if the certificate chain is not trusted by this TrustManager

checkServerTrusted	back to summary
pack-priv void checkServerTrusted(X509Certificate[] chain, String authType, QuicTLSEngineImpl quicTLSEngine) throws CertificateException

checkTrusted	back to summary
private void checkTrusted(X509Certificate[] chain, String authType, Socket socket, boolean checkClientTrusted) throws CertificateException

checkTrusted	back to summary
private void checkTrusted(X509Certificate[] chain, String authType, SSLEngine engine, boolean checkClientTrusted) throws CertificateException

checkTrusted	back to summary
private void checkTrusted(X509Certificate[] chain, String authType, QuicTLSEngineImpl quicTLSEngine, boolean checkClientTrusted) throws CertificateException

checkTrustedInit	back to summary
private Validator checkTrustedInit(X509Certificate[] chain, String authType, boolean checkClientTrusted)

findTrustedCertificate	back to summary
private void findTrustedCertificate(X509Certificate[] chain, String authType, SSLSession session, AlgorithmConstraints constraints, String identityAlg, boolean checkClientTrusted) throws CertificateException

getAcceptedIssuers	back to summary
public X509Certificate[] getAcceptedIssuers() Implements javax.net.ssl.X509TrustManager.getAcceptedIssuers. Doc from javax.net.ssl.X509TrustManager.getAcceptedIssuers. Return an array of certificate authority certificates which are trusted for authenticating peers. Annotations @Override

getAcceptedIssuers

back to summary

public X509Certificate[] getAcceptedIssuers()

Implements javax.net.ssl.X509TrustManager.getAcceptedIssuers.

Doc from javax.net.ssl.X509TrustManager.getAcceptedIssuers.

Return an array of certificate authority certificates which are trusted for authenticating peers.

Annotations

@Override

getHostNameInSNI	back to summary
private static String getHostNameInSNI(List<SNIServerName> sniNames)

getRequestedServerNames	back to summary
pack-priv static List<SNIServerName> getRequestedServerNames(Socket socket)

getRequestedServerNames	back to summary
pack-priv static List<SNIServerName> getRequestedServerNames(SSLEngine engine)

getRequestedServerNames	back to summary
pack-priv static List<SNIServerName> getRequestedServerNames(QuicTLSEngineImpl engine)

getRequestedServerNames	back to summary
private static List<SNIServerName> getRequestedServerNames(SSLSession session)

getValidator	back to summary
private Validator getValidator(String variant)

pack-priv final Class X509TrustManagerImpl

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail