Class CertificateVerificationManager


  • public class CertificateVerificationManager
    extends Object
    Manager class responsible for verifying certificates. This class will use the available verifiers according to a predefined policy.
    • Constructor Detail

      • CertificateVerificationManager

        public CertificateVerificationManager​(Integer cacheAllocatedSize,
                                              Integer cacheDelayMins)
      • CertificateVerificationManager

        public CertificateVerificationManager​(Integer cacheAllocatedSize,
                                              Integer cacheDelayMins,
                                              boolean isFullCertChainValidationEnabled,
                                              boolean isCertExpiryValidationEnabled)
    • Method Detail

      • verifyCertificateValidity

        public void verifyCertificateValidity​(X509Certificate[] peerCertificates)
                                       throws CertificateVerificationException
        This method verifies the given certificate chain or given peer certificate for revocation based on the requirement of full certificate chain validation. If full chain validation is enabled (default), the full certificate chain will be validated before checking the chain for revocation. If full chain validation is disabled, this method expects a single peer certificate, and it is validated with the immediate issuer certificate in the truststore (The truststore must contain the immediate issuer of the peer certificate). In both cases, OCSP and CRL verifiers are used for revocation verification. It first tries to verify using OCSP since OCSP verification is faster. If that fails it tries to do the verification using CRL.
        Parameters:
        peerCertificates - javax.security.cert.X509Certificate[] array of peer certificate chain from peer/client.
        Throws:
        CertificateVerificationException
      • isExpired

        public boolean isExpired​(X509Certificate[] certificates)
        Checks whether a provided certificate is expired or not at the time it is validated.
        Parameters:
        certificates - certificates to be validated for expiry
        Returns:
        true if one of the certs are expired, false otherwise