Examples with CertificateVerifier org.openecard.crypto.tls.CertificateVerifier used on opensource projects

Example 1 with CertificateVerifier

use of org.openecard.crypto.tls.CertificateVerifier in project open-ecard by ecsec.

the class DefaultTlsClientImpl method getAuthentication.

@Override
public TlsAuthentication getAuthentication() throws IOException {
    return new TlsAuthentication() {

        @Override
        public void notifyServerCertificate(TlsServerCertificate crtfct) throws IOException {
            JavaSecVerifier v = new JavaSecVerifier();
            CertificateVerifier cv = new CertificateVerifierBuilder().and(new HostnameVerifier()).and(v).and(new KeyLengthVerifier()).build();
            cv.isValid(crtfct, serverNames.get(0).toString());
        }

        @Override
        public TlsCredentials getClientCredentials(CertificateRequest cr) throws IOException {
            throw new UnsupportedOperationException("Not supported yet.");
        }
    };
}

Example 2 with CertificateVerifier

use of org.openecard.crypto.tls.CertificateVerifier in project open-ecard by ecsec.

the class HttpConnectProxy method connectSocket.

private Socket connectSocket() throws IOException {
    // Socket object connecting to proxy
    Socket sock = new Socket();
    SocketAddress addr = new InetSocketAddress(proxyHost, proxyPort);
    sock.setKeepAlive(true);
    // this is pretty much, but not a problem, as this only shifts the responsibility to the server
    sock.setSoTimeout(5 * 60 * 1000);
    sock.connect(addr, 60 * 1000);
    // evaluate scheme
    if ("HTTPS".equals(proxyScheme)) {
        TlsCrypto crypto = new BcTlsCrypto(ReusableSecureRandom.getInstance());
        ClientCertDefaultTlsClient tlsClient = new ClientCertDefaultTlsClient(crypto, proxyHost, true);
        DynamicAuthentication tlsAuth = new DynamicAuthentication(proxyHost);
        if (proxyValidate) {
            CertificateVerifier cv = new CertificateVerifierBuilder().and(new HostnameVerifier()).and(new KeyLengthVerifier()).and(new JavaSecVerifier()).build();
            tlsAuth.setCertificateVerifier(cv);
        }
        tlsClient.setAuthentication(tlsAuth);
        TlsClientProtocol proto = new TlsClientProtocol(sock.getInputStream(), sock.getOutputStream());
        proto.connect(tlsClient);
        // wrap socket
        Socket tlsSock = new SocketWrapper(sock, proto.getInputStream(), proto.getOutputStream());
        return tlsSock;
    } else {
        return sock;
    }
}

Example 3 with CertificateVerifier

use of org.openecard.crypto.tls.CertificateVerifier in project open-ecard by ecsec.

the class CertificateVerifierBuilder method buildInternal.

private CertificateVerifier buildInternal() {
    // copy and elements so that further modification of the builder does not affect the validation
    final Collection<CertificateVerifier> andCopy = Collections.unmodifiableCollection(andList);
    // convert OR builder to verifier
    final ArrayList<CertificateVerifier> orCopy = new ArrayList<>(orChilds.size());
    for (CertificateVerifierBuilder next : orChilds) {
        orCopy.add(next.buildInternal());
    }
    return new CertificateVerifier() {

        @Override
        public void isValid(TlsServerCertificate chain, String hostname) throws CertificateVerificationException {
            if (!andCopy.isEmpty()) {
                // process each AND check and pass if none failed
                for (CertificateVerifier cv : andCopy) {
                    cv.isValid(chain, hostname);
                }
            } else if (!orCopy.isEmpty()) {
                // process all OR values and fail if none passed
                boolean noSuccess = true;
                for (CertificateVerifier cv : orCopy) {
                    try {
                        cv.isValid(chain, hostname);
                        // a successful outcome means we passed, so break the loop
                        break;
                    } catch (CertificateVerificationException ex) {
                        noSuccess = false;
                    }
                }
                if (noSuccess) {
                    String msg = "None of the possible validation paths succeeded.";
                    throw new CertificateVerificationException(msg);
                }
            }
        }
    };
}