Top Fields Constructors Methods
org.conscrypt.ct

public Class CTVerifier

extends Object
Class Inheritance
Annotations
@Internal
Imports
java.security.cert.CertificateEncodingException, .CertificateException, .X509Certificate, java.util.ArrayList, .Collections, .List, org.conscrypt.Internal, .NativeCrypto, .OpenSSLX509Certificate

Field Summary

Modifier and TypeField and Description
private final CTLogStore
store

Constructor Summary

AccessConstructor and Description
public
CTVerifier(CTLogStore store)

Method Summary

Modifier and TypeMethod and Description
private List<SignedCertificateTimestamp>
getSCTsFromOCSPResponse(byte[]
contents of the OCSP response
data, OpenSSLX509Certificate[]
certificate chain for which to get SCTs. Must contain at least the leaf and it's issuer in order to identify the relevant SingleResponse from the OCSP response, or an empty list is returned
chain)

Extract a list of SignedCertificateTimestamp contained in an OCSP response.

private static List<SignedCertificateTimestamp>
getSCTsFromSCTList(byte[] data, SignedCertificateTimestamp.Origin
used to create the SignedCertificateTimestamp instances.
origin)

Parse an encoded SignedCertificateTimestampList into a list of SignedCertificateTimestamp instances, as described by RFC6962.

private List<SignedCertificateTimestamp>
getSCTsFromTLSExtension(byte[]
contents of the TLS extension to be decoded
data)

Extract a list of SignedCertificateTimestamp from a TLS "signed_certificate_timestamp" extension as described by RFC6962.

private List<SignedCertificateTimestamp>
getSCTsFromX509Extension(OpenSSLX509Certificate leaf)

Extract a list of SignedCertificateTimestamp embedded in an X509 certificate.

private void
markSCTsAsInvalid(List<SignedCertificateTimestamp> scts, CTVerificationResult result)

Add every SCT in scts to result with INVALID_SCT as status

private void
verifyEmbeddedSCTs(List<SignedCertificateTimestamp> scts, OpenSSLX509Certificate[] chain, CTVerificationResult result)

Verify a list of SCTs which were embedded from an X509 certificate.

private void
verifyExternalSCTs(List<SignedCertificateTimestamp> scts, OpenSSLX509Certificate leaf, CTVerificationResult result)

Verify a list of SCTs which were not embedded in an X509 certificate, that is received through the TLS or OCSP extensions.

public CTVerificationResult
verifySignedCertificateTimestamps(List<X509Certificate> chain, byte[] tlsData, byte[] ocspData)

public CTVerificationResult
verifySignedCertificateTimestamps(OpenSSLX509Certificate[] chain, byte[] tlsData, byte[] ocspData)

Verify a certificate chain for transparency.

private VerifiedSCT.Status
verifySingleSCT(SignedCertificateTimestamp sct, CertificateEntry certEntry)

Verify a single SCT for the given Certificate Entry

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

storeback to summary
private final CTLogStore store

Constructor Detail

CTVerifierback to summary
public CTVerifier(CTLogStore store)

Method Detail

getSCTsFromOCSPResponseback to summary
private List<SignedCertificateTimestamp> getSCTsFromOCSPResponse(byte[] data, OpenSSLX509Certificate[] chain)

Extract a list of SignedCertificateTimestamp contained in an OCSP response. If the data is null, or parsing the OCSP response fails, an empty list is returned. Individual SCTs which fail to be parsed are skipped.

Parameters
data:byte[]

contents of the OCSP response

chain:OpenSSLX509Certificate[]

certificate chain for which to get SCTs. Must contain at least the leaf and it's issuer in order to identify the relevant SingleResponse from the OCSP response, or an empty list is returned

getSCTsFromSCTListback to summary
private static List<SignedCertificateTimestamp> getSCTsFromSCTList(byte[] data, SignedCertificateTimestamp.Origin origin)

Parse an encoded SignedCertificateTimestampList into a list of SignedCertificateTimestamp instances, as described by RFC6962. Individual SCTs which fail to be parsed are skipped. If the data is null, or the encompassing list fails to be parsed, an empty list is returned.

Parameters
origin:SignedCertificateTimestamp.Origin

used to create the SignedCertificateTimestamp instances.

Annotations
@SuppressWarnings:MixedMutabilityReturnType
getSCTsFromTLSExtensionback to summary
private List<SignedCertificateTimestamp> getSCTsFromTLSExtension(byte[] data)

Extract a list of SignedCertificateTimestamp from a TLS "signed_certificate_timestamp" extension as described by RFC6962. Individual SCTs which fail to be parsed are skipped. If the data is null, or the encompassing list fails to be parsed, an empty list is returned.

Parameters
data:byte[]

contents of the TLS extension to be decoded

getSCTsFromX509Extensionback to summary
private List<SignedCertificateTimestamp> getSCTsFromX509Extension(OpenSSLX509Certificate leaf)

Extract a list of SignedCertificateTimestamp embedded in an X509 certificate. If the certificate does not contain any SCT extension, or the encompassing encoded list fails to be parsed, an empty list is returned. Individual SCTs which fail to be parsed are ignored.

markSCTsAsInvalidback to summary
private void markSCTsAsInvalid(List<SignedCertificateTimestamp> scts, CTVerificationResult result)

Add every SCT in scts to result with INVALID_SCT as status

verifyEmbeddedSCTsback to summary
private void verifyEmbeddedSCTs(List<SignedCertificateTimestamp> scts, OpenSSLX509Certificate[] chain, CTVerificationResult result)

Verify a list of SCTs which were embedded from an X509 certificate. The result of the verification for each sct is added to result.

verifyExternalSCTsback to summary
private void verifyExternalSCTs(List<SignedCertificateTimestamp> scts, OpenSSLX509Certificate leaf, CTVerificationResult result)

Verify a list of SCTs which were not embedded in an X509 certificate, that is received through the TLS or OCSP extensions. The result of the verification for each sct is added to result.

verifySignedCertificateTimestampsback to summary
public CTVerificationResult verifySignedCertificateTimestamps(List<X509Certificate> chain, byte[] tlsData, byte[] ocspData) throws CertificateEncodingException
verifySignedCertificateTimestampsback to summary
public CTVerificationResult verifySignedCertificateTimestamps(OpenSSLX509Certificate[] chain, byte[] tlsData, byte[] ocspData) throws CertificateEncodingException

Verify a certificate chain for transparency. Signed timestamps are extracted from the leaf certificate, TLS extension, and stapled ocsp response, and verified against the list of known logs.

Exceptions
IllegalArgumentException:
if the chain is empty
verifySingleSCTback to summary
private VerifiedSCT.Status verifySingleSCT(SignedCertificateTimestamp sct, CertificateEntry certEntry)

Verify a single SCT for the given Certificate Entry