Java SSLSession.getPeerCertificateChain方法代码示例

import javax.net.ssl.SSLSession; //导入方法依赖的package包/类
/**
 * Verifies the certificate chain presented by the server to which
 * a secure Socket has just connected.  Specifically, the provided host
 * name is checked against the Common Name of the server certificate;
 * additional checks may or may not be performed.
 *
 * @param host the requested host name
 * @param session SSLSession used on the connection to host
 * @throws Exception if the certificate chain cannot be verified
 */
protected void verify(String host, SSLSession session) throws Exception {

    X509Certificate[] chain;
    X509Certificate   certificate;
    Principal         principal;
    PublicKey         publicKey;
    String            DN;
    String            CN;
    int               start;
    int               end;
    String            emsg;

    chain       = session.getPeerCertificateChain();
    certificate = chain[0];
    principal   = certificate.getSubjectDN();
    DN          = String.valueOf(principal);
    start       = DN.indexOf("CN=");

    if (start < 0) {
        throw new UnknownHostException(
            Error.getMessage(ErrorCode.M_SERVER_SECURE_VERIFY_1));
    }

    start += 3;
    end   = DN.indexOf(',', start);
    CN    = DN.substring(start, (end > -1) ? end
                                           : DN.length());

    if (CN.length() < 1) {
        throw new UnknownHostException(
            Error.getMessage(ErrorCode.M_SERVER_SECURE_VERIFY_2));
    }

    if (!CN.equalsIgnoreCase(host)) {

        // TLS_HOSTNAME_MISMATCH
        throw new UnknownHostException(
            Error.getMessage(
                ErrorCode.M_SERVER_SECURE_VERIFY_3, 0, new Object[] {
            CN, host
        }));
    }
}
 

import javax.net.ssl.SSLSession; //导入方法依赖的package包/类
/**
 * Verifyies the certificate chain presented by the server to which
 * a secure Socket has just connected.  Specifically, the provided host
 * name is checked against the Common Name of the server certificate;
 * additional checks may or may not be performed.
 *
 * @param host the requested host name
 * @param session SSLSession used on the connection to host
 * @throws Exception if the certificate chain cannot be verified
 */
protected void verify(String host, SSLSession session) throws Exception {

    X509Certificate[] chain;
    X509Certificate   certificate;
    Principal         principal;
    PublicKey         publicKey;
    String            DN;
    String            CN;
    int               start;
    int               end;
    String            emsg;

    chain       = session.getPeerCertificateChain();
    certificate = chain[0];
    principal   = certificate.getSubjectDN();
    DN          = String.valueOf(principal);
    start       = DN.indexOf("CN=");

    if (start < 0) {
        throw new UnknownHostException(
            Error.getMessage(ErrorCode.M_SERVER_SECURE_VERIFY_1));
    }

    start += 3;
    end   = DN.indexOf(',', start);
    CN    = DN.substring(start, (end > -1) ? end
                                           : DN.length());

    if (CN.length() < 1) {
        throw new UnknownHostException(
            Error.getMessage(ErrorCode.M_SERVER_SECURE_VERIFY_2));
    }

    if (!CN.equalsIgnoreCase(host)) {

        // TLS_HOSTNAME_MISMATCH
        throw new UnknownHostException(
            Error.getMessage(
                ErrorCode.M_SERVER_SECURE_VERIFY_3, 0, new Object[] {
            CN, host
        }));
    }
}
 

import javax.net.ssl.SSLSession; //导入方法依赖的package包/类
/**
 * Verifyies the certificate chain presented by the server to which
 * a secure Socket has just connected.  Specifically, the provided host
 * name is checked against the Common Name of the server certificate;
 * additional checks may or may not be performed.
 *
 * @param host the requested host name
 * @param session SSLSession used on the connection to host
 * @throws Exception if the certificate chain cannot be verified
 */
protected void verify(String host, SSLSession session) throws Exception {

    X509Certificate[] chain;
    X509Certificate   certificate;
    Principal         principal;
    PublicKey         publicKey;
    String            DN;
    String            CN;
    int               start;
    int               end;
    String            emsg;

    chain       = session.getPeerCertificateChain();
    certificate = chain[0];
    principal   = certificate.getSubjectDN();
    DN          = String.valueOf(principal);
    start       = DN.indexOf("CN=");

    if (start < 0) {
        throw new UnknownHostException(
            Trace.getMessage(Trace.HsqlSocketFactorySecure_verify));
    }

    start += 3;
    end   = DN.indexOf(',', start);
    CN    = DN.substring(start, (end > -1) ? end
                                           : DN.length());

    if (CN.length() < 1) {
        throw new UnknownHostException(
            Trace.getMessage(Trace.HsqlSocketFactorySecure_verify2));
    }

    if (!CN.equalsIgnoreCase(host)) {

        // TLS_HOSTNAME_MISMATCH
        throw new UnknownHostException(
            Trace.getMessage(
                Trace.HsqlSocketFactorySecure_verify3, true,
                new Object[] {
            CN, host
        }));
    }
}
 

import javax.net.ssl.SSLSession; //导入方法依赖的package包/类
/**
 * Describe <code>verifyHostname</code> method here.
 *
 * @param socket a <code>SSLSocket</code> value
 * @exception SSLPeerUnverifiedException  If there are problems obtaining
 * the server certificates from the SSL session, or the server host name 
 * does not match with the "Common Name" in the server certificates 
 * SubjectDN.
 * @exception UnknownHostException  If we are not able to resolve
 * the SSL sessions returned server host name. 
 */
private void verifyHostname(SSLSocket socket) 
    throws SSLPeerUnverifiedException, UnknownHostException {
    if (! verifyHostname) 
        return;

    SSLSession session = socket.getSession();
    String hostname = session.getPeerHost();
    try {
        InetAddress addr = InetAddress.getByName(hostname);
    } catch (UnknownHostException uhe) {
        throw new UnknownHostException("Could not resolve SSL sessions "
                                       + "server hostname: " + hostname);
    }
    
    X509Certificate[] certs = session.getPeerCertificateChain();
    if (certs == null || certs.length == 0) 
        throw new SSLPeerUnverifiedException("No server certificates found!");
    
    //get the servers DN in its string representation
    String dn = certs[0].getSubjectDN().getName();

    //might be useful to print out all certificates we receive from the
    //server, in case one has to debug a problem with the installed certs.
    if (LOG.isDebugEnabled()) {
        LOG.debug("Server certificate chain:");
        for (int i = 0; i < certs.length; i++) {
            LOG.debug("X509Certificate[" + i + "]=" + certs[i]);
        }
    }
    //get the common name from the first cert
    String cn = getCN(dn);
    if (hostname.equalsIgnoreCase(cn)) {
        if (LOG.isDebugEnabled()) {
            LOG.debug("Target hostname valid: " + cn);
        }
    } else {
        throw new SSLPeerUnverifiedException(
            "HTTPS hostname invalid: expected '" + hostname + "', received '" + cn + "'");
    }
}