Examples with CertificateValidationContext io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext used on opensource projects

Example 36 with CertificateValidationContext

use of io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext in project grpc-java by grpc.

the class SdsX509TrustManagerTest method oneSanInPeerCerts_suffixIgnoreCase.

@Test
public void oneSanInPeerCerts_suffixIgnoreCase() throws CertificateException, IOException {
    StringMatcher stringMatcher = StringMatcher.newBuilder().setSuffix(".GooGle.BE").setIgnoreCase(true).build();
    CertificateValidationContext certContext = CertificateValidationContext.newBuilder().addMatchSubjectAltNames(stringMatcher).build();
    trustManager = new SdsX509TrustManager(certContext, mockDelegate);
    X509Certificate[] certs = CertificateUtils.toX509Certificates(TestUtils.loadCert(SERVER_1_PEM_FILE));
    trustManager.verifySubjectAltNameInChain(certs);
}

Example 37 with CertificateValidationContext

use of io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext in project grpc-java by grpc.

the class CommonTlsContextTestsUtil method addCertificateValidationContext.

@SuppressWarnings("deprecation")
private static CommonTlsContext.Builder addCertificateValidationContext(CommonTlsContext.Builder builder, String rootInstanceName, String rootCertName, CertificateValidationContext staticCertValidationContext) {
    if (rootInstanceName != null) {
        CertificateProviderInstance providerInstance = CertificateProviderInstance.newBuilder().setInstanceName(rootInstanceName).setCertificateName(rootCertName).build();
        if (staticCertValidationContext != null) {
            CombinedCertificateValidationContext combined = CombinedCertificateValidationContext.newBuilder().setDefaultValidationContext(staticCertValidationContext).setValidationContextCertificateProviderInstance(providerInstance).build();
            return builder.setCombinedValidationContext(combined);
        }
        builder = builder.setValidationContextCertificateProviderInstance(providerInstance);
    }
    return builder;
}

Example 38 with CertificateValidationContext

use of io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext in project grpc-java by grpc.

the class SdsTrustManagerFactoryTest method constructor_fromRootCert.

@Test
public void constructor_fromRootCert() throws CertificateException, IOException, CertStoreException {
    X509Certificate x509Cert = TestUtils.loadX509Cert(CA_PEM_FILE);
    CertificateValidationContext staticValidationContext = buildStaticValidationContext("san1", "san2");
    SdsTrustManagerFactory factory = new SdsTrustManagerFactory(new X509Certificate[] { x509Cert }, staticValidationContext);
    assertThat(factory).isNotNull();
    TrustManager[] tms = factory.getTrustManagers();
    assertThat(tms).isNotNull();
    assertThat(tms).hasLength(1);
    TrustManager myTm = tms[0];
    assertThat(myTm).isInstanceOf(SdsX509TrustManager.class);
    SdsX509TrustManager sdsX509TrustManager = (SdsX509TrustManager) myTm;
    X509Certificate[] acceptedIssuers = sdsX509TrustManager.getAcceptedIssuers();
    assertThat(acceptedIssuers).isNotNull();
    assertThat(acceptedIssuers).hasLength(1);
    X509Certificate caCert = acceptedIssuers[0];
    assertThat(caCert).isEqualTo(CertificateUtils.toX509Certificates(TestUtils.loadCert(CA_PEM_FILE))[0]);
}

Example 39 with CertificateValidationContext

use of io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext in project grpc-java by grpc.

the class SdsTrustManagerFactoryTest method constructorRootCert_checkServerTrusted_throwsException.

@Test
public void constructorRootCert_checkServerTrusted_throwsException() throws CertificateException, IOException, CertStoreException {
    X509Certificate x509Cert = TestUtils.loadX509Cert(CA_PEM_FILE);
    CertificateValidationContext staticValidationContext = buildStaticValidationContext("san1", "san2");
    SdsTrustManagerFactory factory = new SdsTrustManagerFactory(new X509Certificate[] { x509Cert }, staticValidationContext);
    SdsX509TrustManager sdsX509TrustManager = (SdsX509TrustManager) factory.getTrustManagers()[0];
    X509Certificate[] serverChain = CertificateUtils.toX509Certificates(TestUtils.loadCert(SERVER_1_PEM_FILE));
    try {
        sdsX509TrustManager.checkServerTrusted(serverChain, "RSA");
        Assert.fail("no exception thrown");
    } catch (CertificateException expected) {
        assertThat(expected).hasMessageThat().contains("Peer certificate SAN check failed");
    }
}

Example 40 with CertificateValidationContext

use of io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext in project grpc-java by grpc.

the class SdsTrustManagerFactoryTest method constructorRootCert_checkServerTrusted.

@Test
public void constructorRootCert_checkServerTrusted() throws CertificateException, IOException, CertStoreException {
    X509Certificate x509Cert = TestUtils.loadX509Cert(CA_PEM_FILE);
    CertificateValidationContext staticValidationContext = buildStaticValidationContext("san1", "waterzooi.test.google.be");
    SdsTrustManagerFactory factory = new SdsTrustManagerFactory(new X509Certificate[] { x509Cert }, staticValidationContext);
    SdsX509TrustManager sdsX509TrustManager = (SdsX509TrustManager) factory.getTrustManagers()[0];
    X509Certificate[] serverChain = CertificateUtils.toX509Certificates(TestUtils.loadCert(SERVER_1_PEM_FILE));
    sdsX509TrustManager.checkServerTrusted(serverChain, "RSA");
}