Top Description Fields Constructors Methods
io.netty.handler.ssl.util

public final Class FingerprintTrustManagerFactory

extends SimpleTrustManagerFactory
Class Inheritance
Imports
io.netty.buffer.ByteBufUtil, .Unpooled, io.netty.util.concurrent.FastThreadLocal, io.netty.util.internal.EmptyArrays, .ObjectUtil, .StringUtil, javax.net.ssl.ManagerFactoryParameters, .TrustManager, .TrustManagerFactory, .X509TrustManager, java.security.KeyStore, .MessageDigest, .NoSuchAlgorithmException, java.security.cert.CertificateEncodingException, .CertificateException, .X509Certificate, java.util.ArrayList, .Arrays, .List, java.util.regex.Pattern
An TrustManagerFactory that trusts an X.509 certificate whose hash matches.

Note

It is recommended to verify certificates and their chain to prevent Man-in-the-middle attacks. This TrustManagerFactory will only verify that the fingerprint of certificates match one of the given fingerprints. This procedure is called certificate pinning and is an effective protection. For maximum security one should verify that the whole certificate chain is as expected. It is worth mentioning that certain firewalls, proxies or other appliances found in corporate environments, actually perform Man-in-the-middle attacks and thus present a different certificate fingerprint.

The hash of an X.509 certificate is calculated from its DER encoded format. You can get the fingerprint of an X.509 certificate using the openssl command. For example: 

$ openssl x509 -fingerprint -sha256 -in my_certificate.crt
SHA256 Fingerprint=1C:53:0E:6B:FF:93:F0:DE:C2:E6:E7:9D:10:53:58:FF:DD:8E:68:CD:82:D9:C9:36:9B:43:EE:B3:DC:13:68:FB
-----BEGIN CERTIFICATE-----
MIIC/jCCAeagAwIBAgIIIMONxElm0AIwDQYJKoZIhvcNAQELBQAwPjE8MDoGA1UE
AwwzZThhYzAyZmEwZDY1YTg0MjE5MDE2MDQ1ZGI4YjA1YzQ4NWI0ZWNkZi5uZXR0
eS50ZXN0MCAXDTEzMDgwMjA3NTEzNloYDzk5OTkxMjMxMjM1OTU5WjA+MTwwOgYD
VQQDDDNlOGFjMDJmYTBkNjVhODQyMTkwMTYwNDVkYjhiMDVjNDg1YjRlY2RmLm5l
dHR5LnRlc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDb+HBO3C0U
RBKvDUgJHbhIlBye8X/cbNH3lDq3XOOFBz7L4XZKLDIXS+FeQqSAUMo2otmU+Vkj
0KorshMjbUXfE1KkTijTMJlaga2M2xVVt21fRIkJNWbIL0dWFLWyRq7OXdygyFkI
iW9b2/LYaePBgET22kbtHSCAEj+BlSf265+1rNxyAXBGGGccCKzEbcqASBKHOgVp
6pLqlQAfuSy6g/OzGzces3zXRrGu1N3pBIzAIwCW429n52ZlYfYR0nr+REKDnRrP
IIDsWASmEHhBezTD+v0qCJRyLz2usFgWY+7agUJE2yHHI2mTu2RAFngBilJXlMCt
VwT0xGuQxkbHAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAEv8N7Xm8qaY2FgrOc6P
a1GTgA+AOb3aU33TGwAR86f+nLf6BSPaohcQfOeJid7FkFuYInuXl+oqs+RqM/j8
R0E5BuGYY2wOKpL/PbFi1yf/Kyvft7KVh8e1IUUec/i1DdYTDB0lNWvXXxjfMKGL
ct3GMbEHKvLfHx42Iwz/+fva6LUrO4u2TDfv0ycHuR7UZEuC1DJ4xtFhbpq/QRAj
CyfNx3cDc7L2EtJWnCmivTFA9l8MF1ZPMDSVd4ecQ7B0xZIFQ5cSSFt7WGaJCsGM
zYkU4Fp4IykQcWxdlNX7wJZRwQ2TZJFFglpTiFZdeq6I6Ad9An1Encpz5W8UJ4tv
hmw=
-----END CERTIFICATE-----

Field Summary

Modifier and TypeField and Description
private static final Pattern
FINGERPRINT_PATTERN

private static final Pattern
FINGERPRINT_STRIP_PATTERN

private final byte[][]
fingerprints

private final FastThreadLocal<MessageDigest>
tlmd

private final TrustManager
tm

Constructor Summary

AccessConstructor and Description
public
FingerprintTrustManagerFactory(Iterable<String>
a list of SHA1 fingerprints in hexadecimal form
fingerprints)

Deprecated This deprecated constructor uses SHA-1 that is considered insecure.
Creates a new instance.
public
FingerprintTrustManagerFactory(String...
a list of SHA1 fingerprints in hexadecimal form
fingerprints)

Deprecated This deprecated constructor uses SHA-1 that is considered insecure.
Creates a new instance.
public
FingerprintTrustManagerFactory(byte[]...
a list of SHA1 fingerprints
fingerprints)

Deprecated This deprecated constructor uses SHA-1 that is considered insecure.
Creates a new instance.
pack-priv
FingerprintTrustManagerFactory(final String
a hash algorithm
algorithm, byte[][]
a list of fingerprints
fingerprints)

Creates a new instance.

Method Summary

Modifier and TypeMethod and Description
public static FingerprintTrustManagerFactoryBuilder

Returns:

a builder
builder(String
a hash algorithm
algorithm)

Creates a builder for FingerprintTrustManagerFactory.

protected TrustManager[]
engineGetTrustManagers()

Implements abstract io.netty.handler.ssl.util.SimpleTrustManagerFactory.engineGetTrustManagers.

Returns one trust manager for each type of trust material.
protected void
engineInit(KeyStore keyStore)

Implements abstract io.netty.handler.ssl.util.SimpleTrustManagerFactory.engineInit.

Initializes this factory with a source of certificate authorities and related trust material.
protected void
engineInit(ManagerFactoryParameters managerFactoryParameters)

Implements abstract io.netty.handler.ssl.util.SimpleTrustManagerFactory.engineInit.

Initializes this factory with a source of provider-specific key material.
pack-priv static byte[][]
toFingerprintArray(Iterable<String> fingerprints)

Field Detail

FINGERPRINT_PATTERNback to summary
private static final Pattern FINGERPRINT_PATTERN
FINGERPRINT_STRIP_PATTERNback to summary
private static final Pattern FINGERPRINT_STRIP_PATTERN
fingerprintsback to summary
private final byte[][] fingerprints
tlmdback to summary
private final FastThreadLocal<MessageDigest> tlmd
tmback to summary
private final TrustManager tm

Constructor Detail

FingerprintTrustManagerFactoryback to summary
public FingerprintTrustManagerFactory(Iterable<String> fingerprints)

Deprecated

This deprecated constructor uses SHA-1 that is considered insecure. It is recommended to specify a stronger hash algorithm, such as SHA-256, by calling FingerprintTrustManagerFactory#builder(String) method.

Creates a new instance.

Parameters
fingerprints:Iterable<String>

a list of SHA1 fingerprints in hexadecimal form

Annotations
@Deprecated
FingerprintTrustManagerFactoryback to summary
public FingerprintTrustManagerFactory(String... fingerprints)

Deprecated

This deprecated constructor uses SHA-1 that is considered insecure. It is recommended to specify a stronger hash algorithm, such as SHA-256, by calling FingerprintTrustManagerFactory#builder(String) method.

Creates a new instance.

Parameters
fingerprints:String[]

a list of SHA1 fingerprints in hexadecimal form

Annotations
@Deprecated
FingerprintTrustManagerFactoryback to summary
public FingerprintTrustManagerFactory(byte[]... fingerprints)

Deprecated

This deprecated constructor uses SHA-1 that is considered insecure. It is recommended to specify a stronger hash algorithm, such as SHA-256, by calling FingerprintTrustManagerFactory#builder(String) method.

Creates a new instance.

Parameters
fingerprints:byte[][]

a list of SHA1 fingerprints

Annotations
@Deprecated
FingerprintTrustManagerFactoryback to summary
pack-priv FingerprintTrustManagerFactory(final String algorithm, byte[][] fingerprints)

Creates a new instance.

Parameters
algorithm:String

a hash algorithm

fingerprints:byte[][]

a list of fingerprints

Method Detail

builderback to summary
public static FingerprintTrustManagerFactoryBuilder builder(String algorithm)

Creates a builder for FingerprintTrustManagerFactory.

Parameters
algorithm:String

a hash algorithm

Returns:FingerprintTrustManagerFactoryBuilder

a builder

engineGetTrustManagersback to summary
protected TrustManager[] engineGetTrustManagers()

Implements abstract io.netty.handler.ssl.util.SimpleTrustManagerFactory.engineGetTrustManagers.

Doc from io.netty.handler.ssl.util.SimpleTrustManagerFactory.engineGetTrustManagers.

Returns one trust manager for each type of trust material.

Annotations
@Override
engineInitback to summary
protected void engineInit(KeyStore keyStore) throws Exception

Implements abstract io.netty.handler.ssl.util.SimpleTrustManagerFactory.engineInit.

Doc from io.netty.handler.ssl.util.SimpleTrustManagerFactory.engineInit.

Initializes this factory with a source of certificate authorities and related trust material.

Annotations
@Override
engineInitback to summary
protected void engineInit(ManagerFactoryParameters managerFactoryParameters) throws Exception

Implements abstract io.netty.handler.ssl.util.SimpleTrustManagerFactory.engineInit.

Doc from io.netty.handler.ssl.util.SimpleTrustManagerFactory.engineInit.

Initializes this factory with a source of provider-specific key material.

Annotations
@Override
toFingerprintArrayback to summary
pack-priv static byte[][] toFingerprintArray(Iterable<String> fingerprints)