Package org.apache.synapse.transport.certificatevalidation

## Class CertificateVerificationManager

- java.lang.Object
- - org.apache.synapse.transport.certificatevalidation.CertificateVerificationManager

-     public class CertificateVerificationManager
      extends Object

  Manager class responsible for verifying certificates. This class will use the available verifiers according to a predefined policy.

- - ### Constructor Summary

    Constructors
    Constructor | Description
    --- | ---
    `CertificateVerificationManager​(Integer cacheAllocatedSize, Integer cacheDelayMins)` |
    `CertificateVerificationManager​(Integer cacheAllocatedSize, Integer cacheDelayMins, boolean isFullCertChainValidationEnabled, boolean isCertExpiryValidationEnabled)` |

  - ### Method Summary

    All Methods Instance Methods Concrete Methods
    Modifier and Type | Method | Description
    --- | --- | ---
    `boolean` | `isExpired​(X509Certificate[] certificates)` | Checks whether a provided certificate is expired or not at the time it is validated.
    `void` | `verifyCertificateValidity​(X509Certificate[] peerCertificates)` | This method verifies the given certificate chain or given peer certificate for revocation based on the requirement of full certificate chain validation.

    - ### Methods inherited from class java.lang.Object

      `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

- - ### Constructor Detail

    - #### CertificateVerificationManager

          public CertificateVerificationManager​(Integer cacheAllocatedSize,
                                                Integer cacheDelayMins)

    - #### CertificateVerificationManager

          public CertificateVerificationManager​(Integer cacheAllocatedSize,
                                                Integer cacheDelayMins,
                                                boolean isFullCertChainValidationEnabled,
                                                boolean isCertExpiryValidationEnabled)

  - ### Method Detail

    - #### verifyCertificateValidity

          public void verifyCertificateValidity​(X509Certificate[] peerCertificates)
                                         throws CertificateVerificationException

      This method verifies the given certificate chain or given peer certificate for revocation based on the requirement of full certificate chain validation. If full chain validation is enabled (default), the full certificate chain will be validated before checking the chain for revocation. If full chain validation is disabled, this method expects a single peer certificate, and it is validated with the immediate issuer certificate in the truststore (The truststore must contain the immediate issuer of the peer certificate). In both cases, OCSP and CRL verifiers are used for revocation verification. It first tries to verify using OCSP since OCSP verification is faster. If that fails it tries to do the verification using CRL.
      Parameters:
        `peerCertificates` - javax.security.cert.X509Certificate[] array of peer certificate chain from peer/client.
      Throws:
        `CertificateVerificationException`

    - #### isExpired

          public boolean isExpired​(X509Certificate[] certificates)

      Checks whether a provided certificate is expired or not at the time it is validated.
      Parameters:
        `certificates` - certificates to be validated for expiry
      Returns:
        true if one of the certs are expired, false otherwise