Class HostnameToCertificateChecker
java.lang.Object
eu.emi.security.authn.x509.helpers.ssl.HostnameToCertificateChecker
Verifies if a peer's host name matches a DN of its certificate. It is useful on client side
when connecting to a server.
By default the implementation checks the certificate's Subject Alternative Name and Common Name, following the server identity part of RFC 2818. Additionally the 'service/hostname' syntax is supported (the service prefix is simply ignored).
If there is a name mismatch the nameMismatch() method is called. User of this class must extend it and provide the application specific reaction in this method.
Note that this class should be used only on SSL connections which are authenticated with X.509 certificates.
- Author:
- Joni Hahkala, K. Benedyczak
-
Nested Class Summary
Nested ClassesModifier and TypeClassDescriptionprotected static class -
Constructor Summary
Constructors -
Method Summary
Modifier and TypeMethodDescriptionprotected booleancheckAltNameMatching(HostnameToCertificateChecker.ResultWrapper result, String hostname, X509Certificate certificate) protected booleancheckCNMatching(String hostname, X509Certificate certificate) booleancheckMatching(String hostname, X509Certificate certificate) static StringmakeRegexpHostWildcard(String pattern) Converts hostname wildcard string to Java regexp, ensuring that literal sequences are correctly escaped.static booleanmatchesDNS(String hostname, String pattern) protected boolean
-
Constructor Details
-
HostnameToCertificateChecker
public HostnameToCertificateChecker()
-
-
Method Details
-
checkMatching
public boolean checkMatching(String hostname, X509Certificate certificate) throws CertificateParsingException, UnknownHostException -
checkAltNameMatching
protected boolean checkAltNameMatching(HostnameToCertificateChecker.ResultWrapper result, String hostname, X509Certificate certificate) throws CertificateParsingException, UnknownHostException - Parameters:
result- resulthostname- hostnamecertificate- certificate- Returns:
- true iff a dNSName in altName was found (not if the matching was successful) RFC is unclear whether IP AltName presence is also taking the precedence over CN so we are not enforcing such a rule.
- Throws:
CertificateParsingException- certificate parsing exceptionUnknownHostException- unknown host exception
-
checkCNMatching
- Parameters:
hostname- hostnamecertificate- certificate- Returns:
- true if a CN was found and the matching was successful ;-)
-
matchesDNS
-
makeRegexpHostWildcard
Converts hostname wildcard string to Java regexp, ensuring that literal sequences are correctly escaped.- Parameters:
pattern- hostname wildcard- Returns:
- Java regular expression
-
matchesIP
- Throws:
UnknownHostException
-
getMostSpecificCN
-