public class DefaultHostnameVerifier extends java.lang.Object implements javax.net.ssl.HostnameVerifier, CertificateHostnameVerifier
| Modifier and Type | Class and Description |
|---|---|
private static class |
DefaultHostnameVerifier.SubjectAltNameType
Enum for subject alt name types.
|
| Modifier and Type | Field and Description |
|---|---|
protected org.slf4j.Logger |
logger
Logger for this class.
|
| Constructor and Description |
|---|
DefaultHostnameVerifier() |
| Modifier and Type | Method and Description |
|---|---|
private java.lang.String[] |
getCNs(java.security.cert.X509Certificate cert)
Returns the CNs from the supplied certificate.
|
private java.lang.String[] |
getSubjectAltNames(java.security.cert.X509Certificate cert,
DefaultHostnameVerifier.SubjectAltNameType type)
Returns the subject alternative names matching the supplied name type from the supplied certificate.
|
private boolean |
isMatch(java.lang.String hostname,
java.lang.String certName)
Determines if the supplied hostname matches a name derived from the certificate.
|
boolean |
verify(java.lang.String hostname,
javax.net.ssl.SSLSession session) |
boolean |
verify(java.lang.String hostname,
java.security.cert.X509Certificate cert)
Verify if the hostname is an IP address using
LdapUtils.isIPAddress(String). |
protected boolean |
verifyDNS(java.lang.String hostname,
java.security.cert.X509Certificate cert)
Verify the certificate allows use of the supplied DNS name.
|
protected boolean |
verifyIP(java.lang.String ip,
java.security.cert.X509Certificate cert)
Verify the certificate allows use of the supplied IP address.
|
public boolean verify(java.lang.String hostname,
javax.net.ssl.SSLSession session)
verify in interface javax.net.ssl.HostnameVerifierpublic boolean verify(java.lang.String hostname,
java.security.cert.X509Certificate cert)
LdapUtils.isIPAddress(String). Delegates to verifyIP(String, X509Certificate) and verifyDNS(String, X509Certificate) accordingly.verify in interface CertificateHostnameVerifierhostname - to verifycert - to verify hostname againstprotected boolean verifyIP(java.lang.String ip,
java.security.cert.X509Certificate cert)
From RFC2818: In some cases, the URI is specified as an IP address rather than a hostname. In this case, the iPAddress subjectAltName must be present in the certificate and must exactly match the IP in the URI.
ip - address to match in the certificatecert - to inspect for the IP addressprotected boolean verifyDNS(java.lang.String hostname,
java.security.cert.X509Certificate cert)
From RFC2818: If a subjectAltName extension of type dNSName is present, that MUST be used as the identity. Otherwise, the (most specific) Common Name field in the Subject field of the certificate MUST be used. Although the use of the Common Name is existing practice, it is deprecated and Certification Authorities are encouraged to use the dNSName instead.
Matching is performed using the matching rules specified by [RFC2459]. If more than one identity of a given type is present in the certificate (e.g., more than one dNSName name, a match in any one of the set is considered acceptable.)
hostname - to match in the certificatecert - to inspect for the hostnameprivate java.lang.String[] getSubjectAltNames(java.security.cert.X509Certificate cert,
DefaultHostnameVerifier.SubjectAltNameType type)
cert - to get subject alt names fromtype - subject alt name typeprivate java.lang.String[] getCNs(java.security.cert.X509Certificate cert)
cert - to get CNs fromprivate boolean isMatch(java.lang.String hostname,
java.lang.String certName)
hostname - to matchcertName - to match