Package org.forgerock.secrets

Class SecretsTrustManager

java.lang.Object

javax.net.ssl.X509ExtendedTrustManager

org.forgerock.secrets.SecretsTrustManager

All Implemented Interfaces:

TrustManager, X509TrustManager

public class SecretsTrustManager
extends X509ExtendedTrustManager

Provides an implementation of a standard Java TLS X509ExtendedTrustManager that will retrieve trusted certificates from the Secrets API. This allows trusted certificates to be managed using any backend that the Secrets API supports.

Field Summary

Fields

Modifier and Type	Field	Description
static final Option<Boolean>	ENABLE_REVOCATION_CHECKING	Whether the trust manager should perform recovation checking or not.
static final Option<EnumSet<PKIXRevocationChecker.Option>>	REVOCATION_OPTIONS	The options to pass to the revocation checker, if revocation checking is enabled.
static final Option<String>	TRUST_MANAGER_ALGORITHM	Algorithm to use for looking up the underlying X509ExtendedTrustManager.

Method Summary

Modifier and Type	Method	Description
void	checkClientTrusted(X509Certificate[] chain, String authType)
void	checkClientTrusted(X509Certificate[] chain, String authType, Socket socket)
void	checkClientTrusted(X509Certificate[] chain, String authType, SSLEngine engine)
void	checkServerTrusted(X509Certificate[] chain, String authType)
void	checkServerTrusted(X509Certificate[] chain, String authType, Socket socket)
void	checkServerTrusted(X509Certificate[] chain, String authType, SSLEngine engine)
X509Certificate[]	getAcceptedIssuers()

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

ENABLE_REVOCATION_CHECKING

public static final Option<Boolean> ENABLE_REVOCATION_CHECKING

Whether the trust manager should perform recovation checking or not. Defaults to true.

TRUST_MANAGER_ALGORITHM

public static final Option<String> TRUST_MANAGER_ALGORITHM

Algorithm to use for looking up the underlying X509ExtendedTrustManager. Defaults to PKIX.

REVOCATION_OPTIONS

public static final Option<EnumSet<PKIXRevocationChecker.Option>> REVOCATION_OPTIONS

The options to pass to the revocation checker, if revocation checking is enabled. Defaults to SOFT_FAIL, which means that any failure to check the revocation status of a certificate will assume that the certificate is not revoked. This is usually the only feasible option for public certificates as public CA revocation checking is unreliable and/or misconfigured in a lot of cases.

Method Details

checkClientTrusted

public void checkClientTrusted(X509Certificate[] chain,
 String authType,
 Socket socket)
                        throws CertificateException

Specified by:

checkClientTrusted in class X509ExtendedTrustManager

Throws:

CertificateException

checkServerTrusted

public void checkServerTrusted(X509Certificate[] chain,
 String authType,
 Socket socket)
                        throws CertificateException

Specified by:

checkServerTrusted in class X509ExtendedTrustManager

Throws:

CertificateException

checkClientTrusted

public void checkClientTrusted(X509Certificate[] chain,
 String authType,
 SSLEngine engine)
                        throws CertificateException

Specified by:

checkClientTrusted in class X509ExtendedTrustManager

Throws:

CertificateException

checkServerTrusted

public void checkServerTrusted(X509Certificate[] chain,
 String authType,
 SSLEngine engine)
                        throws CertificateException

Specified by:

checkServerTrusted in class X509ExtendedTrustManager

Throws:

CertificateException

checkClientTrusted

public void checkClientTrusted(X509Certificate[] chain,
 String authType)
                        throws CertificateException

Throws:

CertificateException

checkServerTrusted

public void checkServerTrusted(X509Certificate[] chain,
 String authType)
                        throws CertificateException

Throws:

CertificateException

getAcceptedIssuers

public X509Certificate[] getAcceptedIssuers()