Class CertificateVerificationManager
- java.lang.Object
-
- org.apache.synapse.transport.certificatevalidation.CertificateVerificationManager
-
public class CertificateVerificationManager extends Object
Manager class responsible for verifying certificates. This class will use the available verifiers according to a predefined policy.
-
-
Constructor Summary
Constructors Constructor Description CertificateVerificationManager(Integer cacheAllocatedSize, Integer cacheDelayMins)
CertificateVerificationManager(Integer cacheAllocatedSize, Integer cacheDelayMins, boolean isFullCertChainValidationEnabled, boolean isCertExpiryValidationEnabled)
-
Method Summary
All Methods Instance Methods Concrete Methods Modifier and Type Method Description X509Certificate
getPeerCertificate(X509Certificate[] convertedCertificates)
X509Certificate
getVerifiedIssuerCertOfPeerCert(X509Certificate peerCert, CertCache certCache)
boolean
isExpired(X509Certificate[] certificates)
Checks whether a provided certificate is expired or not at the time it is validated.boolean
isPeerCertVerified(X509Certificate peerCert, X509Certificate issuerCert)
void
verifyCertificateValidity(X509Certificate[] peerCertificates)
This method verifies the given certificate chain or given peer certificate for revocation based on the requirement of full certificate chain validation.
-
-
-
Method Detail
-
verifyCertificateValidity
public void verifyCertificateValidity(X509Certificate[] peerCertificates) throws CertificateVerificationException
This method verifies the given certificate chain or given peer certificate for revocation based on the requirement of full certificate chain validation. If full chain validation is enabled (default), the full certificate chain will be validated before checking the chain for revocation. If full chain validation is disabled, this method expects a single peer certificate, and it is validated with the immediate issuer certificate in the truststore (The truststore must contain the immediate issuer of the peer certificate). In both cases, OCSP and CRL verifiers are used for revocation verification. It first tries to verify using OCSP since OCSP verification is faster. If that fails it tries to do the verification using CRL.- Parameters:
peerCertificates
- javax.security.cert.X509Certificate[] array of peer certificate chain from peer/client.- Throws:
CertificateVerificationException
-
isExpired
public boolean isExpired(X509Certificate[] certificates)
Checks whether a provided certificate is expired or not at the time it is validated.- Parameters:
certificates
- certificates to be validated for expiry- Returns:
- true if one of the certs are expired, false otherwise
-
getPeerCertificate
public X509Certificate getPeerCertificate(X509Certificate[] convertedCertificates) throws CertificateVerificationException
- Throws:
CertificateVerificationException
-
getVerifiedIssuerCertOfPeerCert
public X509Certificate getVerifiedIssuerCertOfPeerCert(X509Certificate peerCert, CertCache certCache) throws CertificateVerificationException
- Throws:
CertificateVerificationException
-
isPeerCertVerified
public boolean isPeerCertVerified(X509Certificate peerCert, X509Certificate issuerCert)
-
-