org.eclipse.californium.scandium.dtls.x509

Class StaticNewAdvancedCertificateVerifier

java.lang.Object

org.eclipse.californium.scandium.dtls.x509.StaticNewAdvancedCertificateVerifier

All Implemented Interfaces:

NewAdvancedCertificateVerifier

Direct Known Subclasses:

AsyncNewAdvancedCertificateVerifier

public class StaticNewAdvancedCertificateVerifier
extends Object
implements NewAdvancedCertificateVerifier

New advanced certificate verifier based on collections of trusted x509 certificates and RPKs.

Since:

2.5

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	StaticNewAdvancedCertificateVerifier.Builder

Field Summary

Fields

Modifier and Type	Field and Description
protected org.slf4j.Logger	LOGGER

Constructor Summary

Constructors

Constructor and Description
StaticNewAdvancedCertificateVerifier(X509Certificate[] trustedCertificates, org.eclipse.californium.elements.auth.RawPublicKeyIdentity[] trustedRPKs, List<CertificateType> supportedCertificateTypes) Create delegating certificate verifier for x509 and RPK.

Method Summary

Methods

Modifier and Type	Method and Description
static StaticNewAdvancedCertificateVerifier.Builder	builder()
List<X500Principal>	getAcceptedIssuers() Return an list of certificate authorities which are trusted for authenticating peers.
List<CertificateType>	getSupportedCertificateType() Get the list of supported certificate types in order of preference.
void	setResultHandler(HandshakeResultHandler resultHandler) Set the handler for asynchronous handshake results.
CertificateVerificationResult	verifyCertificate(ConnectionId cid, ServerNames serverName, Boolean clientUsage, boolean truncateCertificatePath, CertificateMessage message, DTLSSession session) Validates the X.509 certificate chain provided by the the peer as part of the certificate message.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

LOGGER

protected final org.slf4j.Logger LOGGER

Constructor Detail

StaticNewAdvancedCertificateVerifier

public StaticNewAdvancedCertificateVerifier(X509Certificate[] trustedCertificates,
                                    org.eclipse.californium.elements.auth.RawPublicKeyIdentity[] trustedRPKs,
                                    List<CertificateType> supportedCertificateTypes)

Create delegating certificate verifier for x509 and RPK.

Parameters:

trustedCertificates - trusted x509 certificates. null not support x.509, empty, to trust all.

trustedRPKs - trusted RPK identities. null not support RPK, empty, to trust all.

supportedCertificateTypes - list of supported certificate type in order of preference.

Throws:

IllegalArgumentException - if both verifier are null.

NullPointerException - if the list of supported certificate types is null

Method Detail

getSupportedCertificateType

public List<CertificateType> getSupportedCertificateType()

Description copied from interface: NewAdvancedCertificateVerifier

Get the list of supported certificate types in order of preference.

Specified by:

getSupportedCertificateType in interface NewAdvancedCertificateVerifier

Returns:

the list of supported certificate types.

verifyCertificate

public CertificateVerificationResult verifyCertificate(ConnectionId cid,
                                              ServerNames serverName,
                                              Boolean clientUsage,
                                              boolean truncateCertificatePath,
                                              CertificateMessage message,
                                              DTLSSession session)

Description copied from interface: NewAdvancedCertificateVerifier

Validates the X.509 certificate chain provided by the the peer as part of the certificate message.

Specified by:

verifyCertificate in interface NewAdvancedCertificateVerifier

Parameters:

cid - connection ID

serverName - indicated server names.

clientUsage - indicator to check certificate usage. null don't check key usage, true, check key usage for client, false for server.

truncateCertificatePath - true truncate certificate path at a trusted certificate before validation.

message - certificate message to be validated

session - dtls session to be used for validation

Returns:

certificate verification result, or null, if result is provided asynchronous.

getAcceptedIssuers

public List<X500Principal> getAcceptedIssuers()

Description copied from interface: NewAdvancedCertificateVerifier

Return an list of certificate authorities which are trusted for authenticating peers.

Specified by:

getAcceptedIssuers in interface NewAdvancedCertificateVerifier

Returns:

a non-null (possibly empty) list of accepted CA issuers.

setResultHandler

public void setResultHandler(HandshakeResultHandler resultHandler)

Description copied from interface: NewAdvancedCertificateVerifier

Set the handler for asynchronous handshake results. Called during initialization of the DTLSConnector. Synchronous implementations may just ignore this using an empty implementation.

Specified by:

setResultHandler in interface NewAdvancedCertificateVerifier

Parameters:

resultHandler - handler for asynchronous master secret results. This handler MUST NOT be called from the thread calling NewAdvancedCertificateVerifier.verifyCertificate(ConnectionId, ServerNames, Boolean, boolean, CertificateMessage, DTLSSession), instead just return the result there.

builder

public static StaticNewAdvancedCertificateVerifier.Builder builder()