Provides a SSLSocketFactory that authenticates the remote server against an explicit pre-shared SSL certificate. This is more secure than using the NonValidatingFactory as it prevents "man in the middle" attacks. It is also more secure than relying on a central CA signing your server's certificate as it pins the server's certificate.
This class requires a single String parameter specified by setting the connection property
sslfactoryarg. The value of this property is the PEM-encoded remote server's SSL
certificate.
Where the certificate is loaded from is based upon the prefix of the sslfactoryarg property.
The following table lists the valid set of prefixes.
| Prefix | Example | Explanation |
|---|---|---|
classpath: |
classpath:ssl/server.crt |
Loaded from the classpath. |
file: |
file:/foo/bar/server.crt |
Loaded from the filesystem. |
env: |
env:mydb_cert |
Loaded from string value of the mydb_cert environment variable. |
sys: |
sys:mydb_cert |
Loaded from string value of the mydb_cert system property. |
-----BEGIN CERTIFICATE------ |
-----BEGIN CERTIFICATE-----
MIIDQzCCAqygAwIBAgIJAOd1tlfiGoEoMA0GCSqGSIb3DQEBBQUAMHUxCzAJBgNV
[... truncated ...]
UCmmYqgiVkAGWRETVo+byOSDZ4swb10=
-----END CERTIFICATE-----
|
Loaded from string value of the argument. |
| Modifier and Type | Class and Description |
|---|---|
| public static class |
| Modifier and Type | Field and Description |
|---|---|
| private static final String | |
| private static final String | |
| private static final String | |
| private static final String |
| Access | Constructor and Description |
|---|---|
| public |
| CLASSPATH_PREFIX | back to summary |
|---|---|
| private static final String CLASSPATH_PREFIX | |
| ENV_PREFIX | back to summary |
|---|---|
| private static final String ENV_PREFIX | |
| FILE_PREFIX | back to summary |
|---|---|
| private static final String FILE_PREFIX | |
| SYS_PROP_PREFIX | back to summary |
|---|---|
| private static final String SYS_PROP_PREFIX | |
| SingleCertValidatingFactory | back to summary |
|---|---|
| public SingleCertValidatingFactory(String sslFactoryArg) throws GeneralSecurityException | |
| Modifier and Type | Field and Description |
|---|---|
| pack-priv X509Certificate | |
| pack-priv X509TrustManager |
| Access | Constructor and Description |
|---|---|
| public |
| Modifier and Type | Method and Description |
|---|---|
| public void | checkClientTrusted(X509Certificate[]
the peer certificate chain chain, String the authentication type based on the client certificate authType)Implements javax. Given the partial or complete certificate chain provided by the peer, build a certificate path to a trusted root and return if it can be validated and is trusted for client SSL authentication based on the authentication type. |
| public void | checkServerTrusted(X509Certificate[]
the peer certificate chain chain, String the key exchange algorithm used authType)Implements javax. Given the partial or complete certificate chain provided by the peer, build a certificate path to a trusted root and return if it can be validated and is trusted for server SSL authentication based on the authentication type. |
| public X509Certificate[] | getAcceptedIssuers()
Implements javax. Return an array of certificate authority certificates which are trusted for authenticating peers. |
| cert | back to summary |
|---|---|
| pack-priv X509Certificate cert | |
| trustManager | back to summary |
|---|---|
| pack-priv X509TrustManager trustManager | |
| SingleCertTrustManager | back to summary |
|---|---|
| public SingleCertTrustManager(InputStream in) throws IOException, GeneralSecurityException | |
| checkClientTrusted | back to summary |
|---|---|
| public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException Implements javax. Doc from javax. Given the partial or complete certificate chain provided by the peer, build a certificate path to a trusted root and return if it can be validated and is trusted for client SSL authentication based on the authentication type. The authentication type is determined by the actual certificate used. For instance, if RSAPublicKey is used, the authType should be "RSA". Checking is case-sensitive.
| |
| checkServerTrusted | back to summary |
|---|---|
| public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException Implements javax. Doc from javax. Given the partial or complete certificate chain provided by the peer, build a certificate path to a trusted root and return if it can be validated and is trusted for server SSL authentication based on the authentication type. The authentication type is the key exchange algorithm portion of the cipher suites represented as a String, such as "RSA", "DHE_DSS". Note for some exportable cipher suites, the key exchange algorithm is determined at run time during the handshake. For instance, for TLS_RSA_EXPORT_WITH_RC4_40_MD5, the authType should be RSA_EXPORT when an ephemeral RSA key is used for the key exchange, and RSA when the key from the server certificate is used. Checking is case-sensitive.
| |
| getAcceptedIssuers | back to summary |
|---|---|
| public X509Certificate[] getAcceptedIssuers() Implements javax. Doc from javax. Return an array of certificate authority certificates which are trusted for authenticating peers.
| |