com.goldencode.p2j.security

Class SecurityManager.CertificateSecurityManager

java.lang.Object

com.goldencode.p2j.security.SecurityManager.CertificateSecurityManager

Enclosing class:

SecurityManager

public class SecurityManager.CertificateSecurityManager
extends java.lang.Object

Wrapper class for certificate / encryption related logic.

Constructor Summary

Constructors

Constructor and Description
CertificateSecurityManager()

Method Summary

Modifier and Type	Method and Description
private java.util.List<java.lang.String>	fetchAltNames(java.security.cert.X509Certificate x509, int altNameType) Parses a X.509 certificate and returns a list of alternative names of a specified type.
SecurityManager.EncryptedKeyStoreFunction	getEncryptedKeyStore() Get a function worker to resolve an encrypted key store with the SSL private key.
private byte[]	getEncryptedKeyStoreWorker(java.lang.String alias, java.lang.String ksPassword, java.lang.String kePassword, ServerKeyStore.Store type) Get an encrypted key store with the SSL private key.
byte[]	getEncryptedTrustStore(java.lang.String password) Get an encrypted key store with the trusted certificates.
(package private) java.lang.String	getSubjectCommonName(java.security.cert.X509Certificate x509) Parses a X.509 certificate and returns the CN component of the subject's distinctive name.
private TransportSecurity	getTransportSecurity(BootstrapConfig config) Creates an instance of TransportSecurity class that serves the client or server end of secured TLS connections, as needed.
private boolean	needsServerValidation(BootstrapConfig config) Detects if server certificate validation is required.
private boolean	validateServer(javax.net.ssl.SSLSession locSess, BootstrapConfig config) Validate the server's certificate if this was specified in the bootstrap configuration.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

CertificateSecurityManager

public CertificateSecurityManager()

Method Detail

getSubjectCommonName

java.lang.String getSubjectCommonName(java.security.cert.X509Certificate x509)
                               throws java.security.cert.CertificateParsingException

Parses a X.509 certificate and returns the CN component of the subject's distinctive name.

Parameters:

x509 - certificate to parse

Returns:

commonName part of the subject's distinctive name. May be empty.

Throws:

java.security.cert.CertificateParsingException - if DN is malformed or no CN was found in DN

getEncryptedTrustStore

public byte[] getEncryptedTrustStore(java.lang.String password)

Get an encrypted key store with the trusted certificates.

Parameters:

password - The password used to encrypt the store.

Returns:

The encrypted key store or null if the store could not be generated.

getEncryptedKeyStore

public SecurityManager.EncryptedKeyStoreFunction getEncryptedKeyStore()

Get a function worker to resolve an encrypted key store with the SSL private key.

Returns:

A function reference to getEncryptedKeyStoreWorker(java.lang.String, java.lang.String, java.lang.String, com.goldencode.p2j.main.ServerKeyStore.Store) or null if the thread doesn't have a server context.

getEncryptedKeyStoreWorker

private byte[] getEncryptedKeyStoreWorker(java.lang.String alias,
                                          java.lang.String ksPassword,
                                          java.lang.String kePassword,
                                          ServerKeyStore.Store type)

Get an encrypted key store with the SSL private key. The key store and key entry are encrypted using the specified passwords.

Parameters:

alias - The alias.

ksPassword - Password used to encrypt the key store.

kePassword - Password used to encrypt the key entry within the store.

type - The key store type

Returns:

The encrypted key store or null if the alias does not exist or the store could not be generated.

needsServerValidation

private boolean needsServerValidation(BootstrapConfig config)

Detects if server certificate validation is required.

Parameters:

config - BootstrapConfig instance which should override the security manager's version; null to use default config.

Returns:

true if server certificate validation is required.

validateServer

private boolean validateServer(javax.net.ssl.SSLSession locSess,
                               BootstrapConfig config)

Validate the server's certificate if this was specified in the bootstrap configuration.

Parameters:

locSess - The local SSL session to validate.

config - BootstrapConfig instance which should override the security manager's version; null to use default config.

getTransportSecurity

private TransportSecurity getTransportSecurity(BootstrapConfig config)
                                        throws java.security.NoSuchAlgorithmException,
                                               java.security.KeyStoreException,
                                               java.security.UnrecoverableKeyException,
                                               ConfigurationException

Creates an instance of TransportSecurity class that serves the client or server end of secured TLS connections, as needed. The newly created instance is a singleton within the domain of this instance of SecurityManager. Thus, repeatable calls return the same reference.

Returns:

The instance that configures the SSL environment with custom key stores and trust stores.

Throws:

java.security.NoSuchAlgorithmException

java.security.KeyStoreException

java.security.UnrecoverableKeyException

ConfigurationException

fetchAltNames

private java.util.List<java.lang.String> fetchAltNames(java.security.cert.X509Certificate x509,
                                                       int altNameType)
                                                throws java.security.cert.CertificateParsingException

Parses a X.509 certificate and returns a list of alternative names of a specified type. The list may be empty if no such names are found.

Parameters:

x509 - certificate to parse

altNameType - integer type of alternative name to look for

Returns:

List of found names as Strings. May be empty.

Throws:

java.security.cert.CertificateParsingException