Top Description Fields Constructors Methods
io.netty.internal.tcnative

public abstract Class CertificateVerifier

extends Object
Class Inheritance
Imports
java.util.Collections, .HashSet, .Set
Is called during handshake and hooked into openssl via SSL_CTX_set_cert_verify_callback.

Important Note

Implementations of this interface should be static as it is stored as a global reference via JNI. This means if you use an inner / anonymous class to implement this and also depend on the finalizer of the class to free up the SSLContext the finalizer will never run as the object is never GC, due the hard reference to the enclosing class. This will most likely result in a memory leak.

Field Summary

Modifier and TypeField and Description
private static final Set<Integer>
ERRORS

public static final int
X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH

public static final int
X509_V_ERR_AKID_SKID_MISMATCH

public static final int
X509_V_ERR_APPLICATION_VERIFICATION

public static final int
X509_V_ERR_CERT_CHAIN_TOO_LONG

public static final int
X509_V_ERR_CERT_HAS_EXPIRED

public static final int
X509_V_ERR_CERT_NOT_YET_VALID

public static final int
X509_V_ERR_CERT_REJECTED

public static final int
X509_V_ERR_CERT_REVOKED

public static final int
X509_V_ERR_CERT_SIGNATURE_FAILURE

public static final int
X509_V_ERR_CERT_UNTRUSTED

public static final int
X509_V_ERR_CRL_HAS_EXPIRED

public static final int
X509_V_ERR_CRL_NOT_YET_VALID

public static final int
X509_V_ERR_CRL_PATH_VALIDATION_ERROR

public static final int
X509_V_ERR_CRL_SIGNATURE_FAILURE

public static final int
X509_V_ERR_DANE_NO_MATCH

public static final int
X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT

public static final int
X509_V_ERR_DIFFERENT_CRL_SCOPE

public static final int
X509_V_ERR_EMAIL_MISMATCH

public static final int
X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD

public static final int
X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD

public static final int
X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD

public static final int
X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD

public static final int
X509_V_ERR_EXCLUDED_VIOLATION

public static final int
X509_V_ERR_HOSTNAME_MISMATCH

public static final int
X509_V_ERR_INVALID_CA

public static final int
X509_V_ERR_INVALID_EXTENSION

public static final int
X509_V_ERR_INVALID_NON_CA

public static final int
X509_V_ERR_INVALID_POLICY_EXTENSION

public static final int
X509_V_ERR_INVALID_PURPOSE

public static final int
X509_V_ERR_IP_ADDRESS_MISMATCH

public static final int
X509_V_ERR_KEYUSAGE_NO_CERTSIGN

public static final int
X509_V_ERR_KEYUSAGE_NO_CRL_SIGN

public static final int
X509_V_ERR_KEYUSAGE_NO_DIGITAL_SIGNATURE

public static final int
X509_V_ERR_NO_EXPLICIT_POLICY

public static final int
X509_V_ERR_OUT_OF_MEM

public static final int
X509_V_ERR_PATH_LENGTH_EXCEEDED

public static final int
X509_V_ERR_PATH_LOOP

public static final int
X509_V_ERR_PERMITTED_VIOLATION

public static final int
X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED

public static final int
X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED

public static final int
X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN

public static final int
X509_V_ERR_SUBJECT_ISSUER_MISMATCH

public static final int
X509_V_ERR_SUBTREE_MINMAX

public static final int
X509_V_ERR_SUITE_B_CANNOT_SIGN_P_384_WITH_P_256

public static final int
X509_V_ERR_SUITE_B_INVALID_ALGORITHM

public static final int
X509_V_ERR_SUITE_B_INVALID_CURVE

public static final int
X509_V_ERR_SUITE_B_INVALID_SIGNATURE_ALGORITHM

public static final int
X509_V_ERR_SUITE_B_INVALID_VERSION

public static final int
X509_V_ERR_SUITE_B_LOS_NOT_ALLOWED

public static final int
X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY

public static final int
X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE

public static final int
X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE

public static final int
X509_V_ERR_UNABLE_TO_GET_CRL

public static final int
X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER

public static final int
X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT

public static final int
X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY

public static final int
X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE

public static final int
X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION

public static final int
X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION

public static final int
X509_V_ERR_UNNESTED_RESOURCE

public static final int
X509_V_ERR_UNSPECIFIED

public static final int
X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX

public static final int
X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE

public static final int
X509_V_ERR_UNSUPPORTED_EXTENSION_FEATURE

public static final int
X509_V_ERR_UNSUPPORTED_NAME_SYNTAX

public static final int
X509_V_OK

Constructor Summary

AccessConstructor and Description
public
CertificateVerifier()

Method Summary

Modifier and TypeMethod and Description
public static boolean
isValid(int errorCode)

Returns true if the given errorCode is valid, false otherwise.

public abstract int

Returns:

verified true if verified successful, false otherwise
verify(long
the SSL instance
ssl, byte[][]
the X509 certificate chain
x509, String
the auth algorithm
authAlgorithm)

Returns true if the passed in certificate chain could be verified and so the handshake should be successful, false otherwise.

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

ERRORSback to summary
private static final Set<Integer> ERRORS
X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCHback to summary
public static final int X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH
X509_V_ERR_AKID_SKID_MISMATCHback to summary
public static final int X509_V_ERR_AKID_SKID_MISMATCH
X509_V_ERR_APPLICATION_VERIFICATIONback to summary
public static final int X509_V_ERR_APPLICATION_VERIFICATION
X509_V_ERR_CERT_CHAIN_TOO_LONGback to summary
public static final int X509_V_ERR_CERT_CHAIN_TOO_LONG
X509_V_ERR_CERT_HAS_EXPIREDback to summary
public static final int X509_V_ERR_CERT_HAS_EXPIRED
X509_V_ERR_CERT_NOT_YET_VALIDback to summary
public static final int X509_V_ERR_CERT_NOT_YET_VALID
X509_V_ERR_CERT_REJECTEDback to summary
public static final int X509_V_ERR_CERT_REJECTED
X509_V_ERR_CERT_REVOKEDback to summary
public static final int X509_V_ERR_CERT_REVOKED
X509_V_ERR_CERT_SIGNATURE_FAILUREback to summary
public static final int X509_V_ERR_CERT_SIGNATURE_FAILURE
X509_V_ERR_CERT_UNTRUSTEDback to summary
public static final int X509_V_ERR_CERT_UNTRUSTED
X509_V_ERR_CRL_HAS_EXPIREDback to summary
public static final int X509_V_ERR_CRL_HAS_EXPIRED
X509_V_ERR_CRL_NOT_YET_VALIDback to summary
public static final int X509_V_ERR_CRL_NOT_YET_VALID
X509_V_ERR_CRL_PATH_VALIDATION_ERRORback to summary
public static final int X509_V_ERR_CRL_PATH_VALIDATION_ERROR
X509_V_ERR_CRL_SIGNATURE_FAILUREback to summary
public static final int X509_V_ERR_CRL_SIGNATURE_FAILURE
X509_V_ERR_DANE_NO_MATCHback to summary
public static final int X509_V_ERR_DANE_NO_MATCH
X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERTback to summary
public static final int X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT
X509_V_ERR_DIFFERENT_CRL_SCOPEback to summary
public static final int X509_V_ERR_DIFFERENT_CRL_SCOPE
X509_V_ERR_EMAIL_MISMATCHback to summary
public static final int X509_V_ERR_EMAIL_MISMATCH
X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELDback to summary
public static final int X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD
X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELDback to summary
public static final int X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD
X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELDback to summary
public static final int X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD
X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELDback to summary
public static final int X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD
X509_V_ERR_EXCLUDED_VIOLATIONback to summary
public static final int X509_V_ERR_EXCLUDED_VIOLATION
X509_V_ERR_HOSTNAME_MISMATCHback to summary
public static final int X509_V_ERR_HOSTNAME_MISMATCH
X509_V_ERR_INVALID_CAback to summary
public static final int X509_V_ERR_INVALID_CA
X509_V_ERR_INVALID_EXTENSIONback to summary
public static final int X509_V_ERR_INVALID_EXTENSION
X509_V_ERR_INVALID_NON_CAback to summary
public static final int X509_V_ERR_INVALID_NON_CA
X509_V_ERR_INVALID_POLICY_EXTENSIONback to summary
public static final int X509_V_ERR_INVALID_POLICY_EXTENSION
X509_V_ERR_INVALID_PURPOSEback to summary
public static final int X509_V_ERR_INVALID_PURPOSE
X509_V_ERR_IP_ADDRESS_MISMATCHback to summary
public static final int X509_V_ERR_IP_ADDRESS_MISMATCH
X509_V_ERR_KEYUSAGE_NO_CERTSIGNback to summary
public static final int X509_V_ERR_KEYUSAGE_NO_CERTSIGN
X509_V_ERR_KEYUSAGE_NO_CRL_SIGNback to summary
public static final int X509_V_ERR_KEYUSAGE_NO_CRL_SIGN
X509_V_ERR_KEYUSAGE_NO_DIGITAL_SIGNATUREback to summary
public static final int X509_V_ERR_KEYUSAGE_NO_DIGITAL_SIGNATURE
X509_V_ERR_NO_EXPLICIT_POLICYback to summary
public static final int X509_V_ERR_NO_EXPLICIT_POLICY
X509_V_ERR_OUT_OF_MEMback to summary
public static final int X509_V_ERR_OUT_OF_MEM
X509_V_ERR_PATH_LENGTH_EXCEEDEDback to summary
public static final int X509_V_ERR_PATH_LENGTH_EXCEEDED
X509_V_ERR_PATH_LOOPback to summary
public static final int X509_V_ERR_PATH_LOOP
X509_V_ERR_PERMITTED_VIOLATIONback to summary
public static final int X509_V_ERR_PERMITTED_VIOLATION
X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWEDback to summary
public static final int X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED
X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDEDback to summary
public static final int X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED
X509_V_ERR_SELF_SIGNED_CERT_IN_CHAINback to summary
public static final int X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN
X509_V_ERR_SUBJECT_ISSUER_MISMATCHback to summary
public static final int X509_V_ERR_SUBJECT_ISSUER_MISMATCH
X509_V_ERR_SUBTREE_MINMAXback to summary
public static final int X509_V_ERR_SUBTREE_MINMAX
X509_V_ERR_SUITE_B_CANNOT_SIGN_P_384_WITH_P_256back to summary
public static final int X509_V_ERR_SUITE_B_CANNOT_SIGN_P_384_WITH_P_256
X509_V_ERR_SUITE_B_INVALID_ALGORITHMback to summary
public static final int X509_V_ERR_SUITE_B_INVALID_ALGORITHM
X509_V_ERR_SUITE_B_INVALID_CURVEback to summary
public static final int X509_V_ERR_SUITE_B_INVALID_CURVE
X509_V_ERR_SUITE_B_INVALID_SIGNATURE_ALGORITHMback to summary
public static final int X509_V_ERR_SUITE_B_INVALID_SIGNATURE_ALGORITHM
X509_V_ERR_SUITE_B_INVALID_VERSIONback to summary
public static final int X509_V_ERR_SUITE_B_INVALID_VERSION
X509_V_ERR_SUITE_B_LOS_NOT_ALLOWEDback to summary
public static final int X509_V_ERR_SUITE_B_LOS_NOT_ALLOWED
X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEYback to summary
public static final int X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY
X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATUREback to summary
public static final int X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE
X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATUREback to summary
public static final int X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE
X509_V_ERR_UNABLE_TO_GET_CRLback to summary
public static final int X509_V_ERR_UNABLE_TO_GET_CRL
X509_V_ERR_UNABLE_TO_GET_CRL_ISSUERback to summary
public static final int X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER
X509_V_ERR_UNABLE_TO_GET_ISSUER_CERTback to summary
public static final int X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT
X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLYback to summary
public static final int X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY
X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATUREback to summary
public static final int X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE
X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSIONback to summary
public static final int X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION
X509_V_ERR_UNHANDLED_CRITICAL_EXTENSIONback to summary
public static final int X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION
X509_V_ERR_UNNESTED_RESOURCEback to summary
public static final int X509_V_ERR_UNNESTED_RESOURCE
X509_V_ERR_UNSPECIFIEDback to summary
public static final int X509_V_ERR_UNSPECIFIED
X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAXback to summary
public static final int X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX
X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPEback to summary
public static final int X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE
X509_V_ERR_UNSUPPORTED_EXTENSION_FEATUREback to summary
public static final int X509_V_ERR_UNSUPPORTED_EXTENSION_FEATURE
X509_V_ERR_UNSUPPORTED_NAME_SYNTAXback to summary
public static final int X509_V_ERR_UNSUPPORTED_NAME_SYNTAX
X509_V_OKback to summary
public static final int X509_V_OK

Constructor Detail

CertificateVerifierback to summary
public CertificateVerifier()

Method Detail

isValidback to summary
public static boolean isValid(int errorCode)

Returns true if the given errorCode is valid, false otherwise.

verifyback to summary
public abstract int verify(long ssl, byte[][] x509, String authAlgorithm)

Returns true if the passed in certificate chain could be verified and so the handshake should be successful, false otherwise.

Parameters
ssl:long

the SSL instance

x509:byte[][]

the X509 certificate chain

authAlgorithm:String

the auth algorithm

Returns:int

verified true if verified successful, false otherwise