Module org.eclipse.milo.opcua.stack.core
Package org.eclipse.milo.opcua.stack.core.util.validation

Class CertificateValidationUtil

java.lang.Object
org.eclipse.milo.opcua.stack.core.util.validation.CertificateValidationUtil
public class CertificateValidationUtil extends Object

  • Constructor Details

    • CertificateValidationUtil

      public CertificateValidationUtil()

  • Method Details

    • buildTrustedCertPath

      public static PKIXCertPathBuilderResult buildTrustedCertPath(List<X509Certificate> certificateChain, Collection<X509Certificate> trustedCertificates, Collection<X509Certificate> issuerCertificates) throws UaException
      Given a possibly partial certificate chain with at least one certificate in it, builds a path to a trust anchor using a collection of trusted and issuer certificates as possible intermediate and root CAs, and then ensures that at least one certificate in the resulting path is in the trusted collection.

      Each certificate has its signature and subject/issuer chaining checked. Revocation and other more detailed checks are not done at this stage.

      The CertPath and TrustAnchor from the result is meant to be further validated by validateTrustedCertPath(CertPath, TrustAnchor, Collection, Set, boolean), which can return more detailed failure StatusCodes in its exceptions because it is dealing with a known trusted path.

      Parameters:
      certificateChain - a possibly partial certificate chain to build a trusted path from.
      trustedCertificates - a collection of known trusted certificates.
      issuerCertificates - a collection of known CAs that can be used in path building but are not considered "trusted" when it comes to determining if the resulting path is "trusted".
      Returns:
      a PKIXCertPathBuilderResult with a TrustAnchor and CertPath, which combined make up the full trusted path.
      Throws:
      UaException - if a trusted path cannot be built.

    • validateTrustedCertPath

      public static void validateTrustedCertPath(CertPath certPath, TrustAnchor trustAnchor, Collection<X509CRL> crls, Set<ValidationCheck> validationChecks, boolean endEntityIsClient) throws UaException
      Validates the trusted certificate path represented by a TrustAnchor and a CertPath that may or may not be empty, depending on the length of the path.

      Each certificate is checked for validity, key usage, and revocation status. Whether a failed check ultimately results in a thrown exception depends on the set of ValidationChecks.

      The function is meant to be used in conjunction with buildTrustedCertPath(List, Collection, Collection), the result of which contains a CertPath and TrustAnchor that form a trusted certificate path.

      Parameters:
      certPath - a CertPath containing 0 or more certificates leading to the trust anchor.
      trustAnchor - a TrustAnchor containing the root of trust for the path being validated.
      crls - a collection of X509CRLs. Every CA certificate in the trusted path except the leaf should have a CRL, though whether that's enforced or not depends on ValidationCheck.REVOCATION_LISTS being present.
      validationChecks - the set of ValidationChecks to enforce.
      endEntityIsClient - true if the end-entity is a client, false if it is a server.
      Throws:
      UaException - if a check from the set of ValidationChecks failed.

    • checkValidity

      public static void checkValidity(X509Certificate certificate, boolean endEntity) throws UaException
      Check that certificate is valid (the current date and time are within the validity period).
      Parameters:
      certificate - the X509Certificate to check.
      endEntity - true if the certificate is the end entity, false if it's an issuer.
      Throws:
      UaException - if the certificate is not valid.

    • checkHostnameOrIpAddress

      public static void checkHostnameOrIpAddress(X509Certificate certificate, String... hostNames) throws UaException
      Validate that one of hostNames matches a SubjectAltName DNSName or IPAddress entry in the certificate.
      Parameters:
      certificate - the certificate to validate against.
      hostNames - the host names or ip addresses to look for.
      Throws:
      UaException - if there is no matching DNSName or IPAddress entry.

    • checkEndEntityKeyUsage

      public static void checkEndEntityKeyUsage(X509Certificate certificate) throws UaException
      Throws:
      UaException

    • checkEndEntityExtendedKeyUsage

      public static void checkEndEntityExtendedKeyUsage(X509Certificate certificate, boolean endEntityIsClient) throws UaException
      Throws:
      UaException

    • checkApplicationUri

      public static void checkApplicationUri(X509Certificate certificate, String applicationUri) throws UaException
      Validate that the application URI matches the SubjectAltName URI in the given certificate.
      Parameters:
      certificate - the certificate to validate against.
      applicationUri - the URI to validate.
      Throws:
      UaException - if the certificate is invalid, does not contain a uri, or contains a uri that does not match.

    • getSubjectAltNameUri

      public static String getSubjectAltNameUri(X509Certificate certificate) throws UaException
      Throws:
      UaException