org.eclipse.milo.opcua.stack.core.util.validation

Class CertificateValidationUtil

java.lang.Object

org.eclipse.milo.opcua.stack.core.util.validation.CertificateValidationUtil

public class CertificateValidationUtil
extends Object

Constructor Summary

Constructors

Constructor and Description
CertificateValidationUtil()

Method Summary

Modifier and Type	Method and Description
static PKIXCertPathBuilderResult	buildTrustedCertPath(List<X509Certificate> certificateChain, Collection<X509Certificate> trustedCertificates, Collection<X509Certificate> issuerCertificates) Given a possibly partial certificate chain with at least one certificate in it, builds a path to a trust anchor using a collection of trusted and issuer certificates as possible intermediate and root CAs, and then ensures that at least one certificate in the resulting path is in the trusted collection.
static void	checkApplicationUri(X509Certificate certificate, String applicationUri) Validate that the application URI matches the SubjectAltName URI in the given certificate.
static void	checkEndEntityExtendedKeyUsage(X509Certificate certificate, boolean endEntityIsClient)
static void	checkEndEntityKeyUsage(X509Certificate certificate)
static void	checkHostnameOrIpAddress(X509Certificate certificate, String... hostNames) Validate that one of hostNames matches a SubjectAltName DNSName or IPAddress entry in the certificate.
static void	checkValidity(X509Certificate certificate, boolean endEntity) Check that certificate is valid (the current date and time are within the validity period).
static String	getSubjectAltNameUri(X509Certificate certificate)
static void	validateTrustedCertPath(CertPath certPath, TrustAnchor trustAnchor, Collection<X509CRL> crls, Set<ValidationCheck> validationChecks, boolean endEntityIsClient) Validates the trusted certificate path represented by a TrustAnchor and a CertPath that may or may not be empty, depending on the length of the path.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

CertificateValidationUtil

public CertificateValidationUtil()

Method Detail

buildTrustedCertPath

public static PKIXCertPathBuilderResult buildTrustedCertPath(List<X509Certificate> certificateChain,
                                                             Collection<X509Certificate> trustedCertificates,
                                                             Collection<X509Certificate> issuerCertificates)
                                                      throws UaException

Given a possibly partial certificate chain with at least one certificate in it, builds a path to a trust anchor using a collection of trusted and issuer certificates as possible intermediate and root CAs, and then ensures that at least one certificate in the resulting path is in the trusted collection.

Each certificate has its signature and subject/issuer chaining checked. Revocation and other more detailed checks are not done at this stage.

The CertPath and TrustAnchor from the result is meant to be further validated by validateTrustedCertPath(CertPath, TrustAnchor, Collection, Set, boolean), which can return more detailed failure StatusCodes in its exceptions because it is dealing with a known trusted path.

Parameters:

certificateChain - a possibly partial certificate chain to build a trusted path from.

trustedCertificates - a collection of known trusted certificates.

issuerCertificates - a collection of known CAs that can be used in path building but are not considered "trusted" when it comes to determining if the resulting path is "trusted".

Returns:

a PKIXCertPathBuilderResult with a TrustAnchor and CertPath, which combined make up the full trusted path.

Throws:

UaException - if a trusted path cannot be built.

validateTrustedCertPath

public static void validateTrustedCertPath(CertPath certPath,
                                           TrustAnchor trustAnchor,
                                           Collection<X509CRL> crls,
                                           Set<ValidationCheck> validationChecks,
                                           boolean endEntityIsClient)
                                    throws UaException

Validates the trusted certificate path represented by a TrustAnchor and a CertPath that may or may not be empty, depending on the length of the path.

Each certificate is checked for validity, key usage, and revocation status. Whether a failed check ultimately results in a thrown exception depends on the set of ValidationChecks.

The function is meant to be used in conjunction with buildTrustedCertPath(List, Collection, Collection), the result of which contains a CertPath and TrustAnchor that form a trusted certificate path.

Parameters:

certPath - a CertPath containing 0 or more certificates leading to the trust anchor.

trustAnchor - a TrustAnchor containing the root of trust for the path being validated.

crls - a collection of X509CRLs. Every CA certificate in the trusted path except the leaf should have a CRL, though whether that's enforced or not depends on ValidationCheck.REVOCATION_LISTS being present.

validationChecks - the set of ValidationChecks to enforce.

endEntityIsClient - true if the end-entity is a client, false if it is a server.

Throws:

UaException - if a check from the set of ValidationChecks failed.

checkValidity

public static void checkValidity(X509Certificate certificate,
                                 boolean endEntity)
                          throws UaException

Check that certificate is valid (the current date and time are within the validity period).

Parameters:

certificate - the X509Certificate to check.

endEntity - true if the certificate is the end entity, false if it's an issuer.

Throws:

UaException - if the certificate is not valid.

checkHostnameOrIpAddress

public static void checkHostnameOrIpAddress(X509Certificate certificate,
                                            String... hostNames)
                                     throws UaException

Validate that one of hostNames matches a SubjectAltName DNSName or IPAddress entry in the certificate.

Parameters:

certificate - the certificate to validate against.

hostNames - the host names or ip addresses to look for.

Throws:

UaException - if there is no matching DNSName or IPAddress entry.

checkEndEntityKeyUsage

public static void checkEndEntityKeyUsage(X509Certificate certificate)
                                   throws UaException

Throws:

UaException

checkEndEntityExtendedKeyUsage

public static void checkEndEntityExtendedKeyUsage(X509Certificate certificate,
                                                  boolean endEntityIsClient)
                                           throws UaException

Throws:

UaException

checkApplicationUri

public static void checkApplicationUri(X509Certificate certificate,
                                       String applicationUri)
                                throws UaException

Validate that the application URI matches the SubjectAltName URI in the given certificate.

Parameters:

certificate - the certificate to validate against.

applicationUri - the URI to validate.

Throws:

UaException - if the certificate is invalid, does not contain a uri, or contains a uri that does not match.

getSubjectAltNameUri

public static String getSubjectAltNameUri(X509Certificate certificate)
                                   throws UaException

Throws:

UaException