Top Description Inners Fields Constructors Methods
org.conscrypt

public final Class TrustManagerImpl

extends X509ExtendedTrustManager
Class Inheritance
Annotations
@Internal
Imports
java.lang.reflect.InvocationTargetException, .Method, java.net.Socket, java.security.InvalidAlgorithmParameterException, .KeyStore, .KeyStoreException, java.security.cert.CertPath, .CertPathValidator, .CertPathValidatorException, .Certificate, .CertificateException, .CertificateFactory, .CertificateParsingException, .PKIXCertPathChecker, .PKIXParameters, .PKIXRevocationChecker, .PKIXRevocationChecker.Option, .TrustAnchor, .X509Certificate, java.util.ArrayList, .Arrays, .Collection, .Collections, .Comparator, .Enumeration, .HashSet, .List, .Set, java.util.logging.Logger, javax.net.ssl.HttpsURLConnection, .SSLEngine, .SSLParameters, .SSLSession, .SSLSocket, .X509ExtendedTrustManager, org.conscrypt.ct.CTLogStore, .CTPolicy, .CTVerificationResult, .CTVerifier
TrustManager implementation. The implementation is based on CertPathValidator PKIX and CertificateFactory X509 implementations. This implementations should be provided by some certification provider.
See Also
javax.net.ssl.X509ExtendedTrustManager

Nested and Inner Type Summary

Modifier and TypeClass and Description
private static class
TrustManagerImpl.ExtendedKeyUsagePKIXCertPathChecker

If an EKU extension is present in the end-entity certificate, it MUST contain an appropriate key usage.

private static class
TrustManagerImpl.TrustAnchorComparator

Comparator for sorting TrustAnchors using a CertificatePriorityComparator.

Field Summary

Modifier and TypeField and Description
private final X509Certificate[]
acceptedIssuers

This is lazily initialized in the AndroidCAStore case since it forces us to bring all the CAs into memory.

private final CertBlocklist
blocklist

private boolean
ctEnabledOverride

private CTPolicy
ctPolicy

private CTVerifier
ctVerifier

private static ConscryptHostnameVerifier
defaultHostnameVerifier

private final Exception
err

private final CertificateFactory
factory

private ConscryptHostnameVerifier
hostnameVerifier

private final TrustedCertificateIndex
intermediateIndex

An index of intermediate certificates that we've seen.

private static final Logger
logger

private CertPinManager
pinManager

The CertPinManager, which validates the chain against a host-to-pin mapping

private final KeyStore
rootKeyStore

The AndroidCAStore if non-null, null otherwise.

private static final TrustManagerImpl.TrustAnchorComparator
TRUST_ANCHOR_COMPARATOR

Comparator used for ordering trust anchors during certificate path building.

private final TrustedCertificateIndex
trustedCertificateIndex

An index of TrustAnchor instances that we've seen.

private final ConscryptCertStore
trustedCertificateStore

The backing store for the AndroidCAStore if non-null.

private final CertPathValidator
validator

Constructor Summary

AccessConstructor and Description
public
TrustManagerImpl(KeyStore keyStore)

Creates X509TrustManager based on a keystore

public
TrustManagerImpl(KeyStore keyStore, CertPinManager manager)

public
TrustManagerImpl(KeyStore keyStore, CertPinManager manager, ConscryptCertStore certStore)

public
TrustManagerImpl(KeyStore keyStore, CertPinManager manager, ConscryptCertStore certStore, CertBlocklist blocklist)

public
TrustManagerImpl(KeyStore keyStore, CertPinManager manager, ConscryptCertStore certStore, CertBlocklist blocklist, CTLogStore ctLogStore, CTVerifier ctVerifier, CTPolicy ctPolicy)

For testing only.

Method Summary

Modifier and TypeMethod and Description
private static X509Certificate[]
acceptedIssuers(KeyStore ks)

private void
checkBlocklist(X509Certificate cert)

public void
checkClientTrusted(X509Certificate[]
the peer certificate chain
chain, String
the authentication type based on the client certificate
authType)

Implements javax.net.ssl.X509TrustManager.checkClientTrusted.

Given the partial or complete certificate chain provided by the peer, build a certificate path to a trusted root and return if it can be validated and is trusted for client SSL authentication based on the authentication type.
public List<X509Certificate>
checkClientTrusted(X509Certificate[] chain, String authType, String hostname)

For backward compatibility with older Android API that used String for the hostname only.

public void
checkClientTrusted(X509Certificate[]
the peer certificate chain
chain, String
the key exchange algorithm used
authType, Socket
the socket used for this connection. This parameter can be null, which indicates that implementations need not check the ssl parameters
socket)

Implements abstract javax.net.ssl.X509ExtendedTrustManager.checkClientTrusted.

Given the partial or complete certificate chain provided by the peer, build and validate the certificate path based on the authentication type and ssl parameters.
public void
checkClientTrusted(X509Certificate[]
the peer certificate chain
chain, String
the key exchange algorithm used
authType, SSLEngine
the engine used for this connection. This parameter can be null, which indicates that implementations need not check the ssl parameters
engine)

Implements abstract javax.net.ssl.X509ExtendedTrustManager.checkClientTrusted.

Given the partial or complete certificate chain provided by the peer, build and validate the certificate path based on the authentication type and ssl parameters.
private void
checkCT(String host, List<X509Certificate> chain, byte[] ocspData, byte[] tlsData)

public void
checkServerTrusted(X509Certificate[]
the peer certificate chain
chain, String
the key exchange algorithm used
authType)

Implements javax.net.ssl.X509TrustManager.checkServerTrusted.

Given the partial or complete certificate chain provided by the peer, build a certificate path to a trusted root and return if it can be validated and is trusted for server SSL authentication based on the authentication type.
public List<X509Certificate>
checkServerTrusted(X509Certificate[] chain, String authType, String hostname)

For backward compatibility with older Android API that used String for the hostname only.

public void
checkServerTrusted(X509Certificate[]
the peer certificate chain
chain, String
the key exchange algorithm used
authType, Socket
the socket used for this connection. This parameter can be null, which indicates that implementations need not check the ssl parameters
socket)

Implements abstract javax.net.ssl.X509ExtendedTrustManager.checkServerTrusted.

Given the partial or complete certificate chain provided by the peer, build and validate the certificate path based on the authentication type and ssl parameters.
public void
checkServerTrusted(X509Certificate[]
the peer certificate chain
chain, String
the key exchange algorithm used
authType, SSLEngine
the engine used for this connection. This parameter can be null, which indicates that implementations need not check the ssl parameters
engine)

Implements abstract javax.net.ssl.X509ExtendedTrustManager.checkServerTrusted.

Given the partial or complete certificate chain provided by the peer, build and validate the certificate path based on the authentication type and ssl parameters.
public List<X509Certificate>
checkServerTrusted(X509Certificate[] chain, String authType, SSLSession session)

Validates whether a server is trusted.

private List<X509Certificate>
checkTrusted(X509Certificate[] certs, String authType, SSLSession session, SSLParameters parameters, boolean clientAuth)

private List<X509Certificate>
checkTrusted(X509Certificate[] certs, byte[] ocspData, byte[] tlsSctData, String authType, String host, boolean clientAuth)

private List<X509Certificate>

Returns:

The entire valid chain starting with the leaf certificate. This is the concatenation of untrustedChain and trustAnchorChain.
checkTrustedRecursive(X509Certificate[]
the bag of certs provided by the peer. No order is assumed.
certs, byte[] ocspData, byte[] tlsSctData, String
the host being connected to.
host, boolean
if a client is being authorized instead of a server.
clientAuth, ArrayList<X509Certificate>
the untrusted section of the chain built so far. Must be mutable.
untrustedChain, ArrayList<TrustAnchor>
the trusted section of the chain built so far. Must be mutable.
trustAnchorChain, Set<X509Certificate>
the set certificates used so far in path building. Must be mutable.
used)

Recursively build certificate chains until a valid chain is found or all possible paths are exhausted.

private Set<TrustAnchor>
findAllTrustAnchorsByIssuerAndSignature(X509Certificate cert)

Find all possible issuing trust anchors of cert.

private TrustAnchor
findTrustAnchorBySubjectAndPublicKey(X509Certificate cert)

Check the trustedCertificateIndex for the cert to see if it is already trusted and failing that check the KeyStore if it is available.

public X509Certificate[]
getAcceptedIssuers()

Implements javax.net.ssl.X509TrustManager.getAcceptedIssuers.

Return an array of certificate authority certificates which are trusted for authenticating peers.
pack-priv static synchronized ConscryptHostnameVerifier
getDefaultHostnameVerifier()

Returns the currently-set default hostname verifier.

private static SSLSession
getHandshakeSessionOrThrow(SSLSocket sslSocket)

pack-priv ConscryptHostnameVerifier
getHostnameVerifier()

Returns the currently-set hostname verifier for this instance.

private ConscryptHostnameVerifier
getHttpsVerifier()

private static byte[]
getOcspDataFromSession(SSLSession session)

private byte[]
getTlsSctDataFromSession(SSLSession session)

public List<X509Certificate>
getTrustedChainForServer(X509Certificate[] certs, String authType, Socket socket)

Returns the full trusted certificate chain found from certs.

public List<X509Certificate>
getTrustedChainForServer(X509Certificate[] certs, String authType, SSLEngine engine)

Returns the full trusted certificate chain found from certs.

public void
handleTrustStorageUpdate()

public void
setCTEnabledOverride(boolean enabled)

public void
setCTPolicy(CTPolicy policy)

public void
setCTVerifier(CTVerifier verifier)

pack-priv static synchronized void
setDefaultHostnameVerifier(ConscryptHostnameVerifier verifier)

Set the default hostname verifier that will be used for HTTPS endpoint identification.

pack-priv void
setHostnameVerifier(ConscryptHostnameVerifier verifier)

Set the hostname verifier that will be used for HTTPS endpoint identification.

private void
setOcspResponses(PKIXParameters params, X509Certificate cert, byte[] ocspData)

Sets the OCSP response data that was possibly stapled to the TLS response.

private static Collection<TrustAnchor>
sortPotentialAnchors(Set<TrustAnchor> anchors)

Sort potential anchors so that the most preferred for use come first.

private static Set<TrustAnchor>
trustAnchors(X509Certificate[] certs)

private List<X509Certificate>
verifyChain(List<X509Certificate> untrustedChain, List<TrustAnchor> trustAnchorChain, String host, boolean clientAuth, byte[] ocspData, byte[] tlsSctData)