io.netty.handler.ssl.util

类 FingerprintTrustManagerFactory

java.lang.Object

javax.net.ssl.TrustManagerFactory

io.netty.handler.ssl.util.SimpleTrustManagerFactory

io.netty.handler.ssl.util.FingerprintTrustManagerFactory

public final class FingerprintTrustManagerFactory
extends SimpleTrustManagerFactory

An TrustManagerFactory that trusts an X.509 certificate whose SHA1 checksum matches.

NOTE: It is recommended to verify certificates and their chain to prevent Man-in-the-middle attacks. This TrustManagerFactory will only verify that the fingerprint of certificates match one of the given fingerprints. This procedure is called certificate pinning and is an effective protection. For maximum security one should verify that the whole certificate chain is as expected. It is worth mentioning that certain firewalls, proxies or other appliances found in corporate environments, actually perform Man-in-the-middle attacks and thus present a different certificate fingerprint.

The SHA1 checksum of an X.509 certificate is calculated from its DER encoded format. You can get the fingerprint of an X.509 certificate using the openssl command. For example:

 $ openssl x509 -fingerprint -sha1 -in my_certificate.crt
 SHA1 Fingerprint=4E:85:10:55:BC:7B:12:08:D1:EA:0A:12:C9:72:EE:F3:AA:B2:C7:CB
 -----BEGIN CERTIFICATE-----
 MIIBqjCCAROgAwIBAgIJALiT3Nvp0kvmMA0GCSqGSIb3DQEBBQUAMBYxFDASBgNV
 BAMTC2V4YW1wbGUuY29tMCAXDTcwMDEwMTAwMDAwMFoYDzk5OTkxMjMxMjM1OTU5
 WjAWMRQwEgYDVQQDEwtleGFtcGxlLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAw
 gYkCgYEAnadvODG0QCiHhaFZlLHtr5gLIkDQS8ErZ//KfqeCHTC/KJsl3xYFk0zG
 aCv2FcmkOlokm77qV8qOW2DZdND7WuYzX6nLVuLb+GYxZ7b45iMAbAajvGh8jc9U
 o07fUIahGqTDAIAGCWsoLUOQ9nMzO/8GRHcXJAeQ2MGY2VpCcv0CAwEAATANBgkq
 hkiG9w0BAQUFAAOBgQBpRCnmjmNM0D7yrpkUJpBTNiqinhKLbeOvPWm+YmdInUUs
 LoMu0mZ1IANemLwqbwJJ76fknngeB+YuVAj46SurvVCV6ekwHcbgpW1u063IRwKk
 tQhOBO0HQxldUS4+4MYv/kuvnKkbjfgh5qfWw89Kx4kD+cycpP4yPtgDGk8ZMA==
 -----END CERTIFICATE-----
 

构造器概要

构造器

构造器和说明
FingerprintTrustManagerFactory(byte[]... fingerprints) Creates a new instance.
FingerprintTrustManagerFactory(java.lang.Iterable<java.lang.String> fingerprints) Creates a new instance.
FingerprintTrustManagerFactory(java.lang.String... fingerprints) Creates a new instance.

方法概要

方法

限定符和类型	方法和说明
protected javax.net.ssl.TrustManager[]	engineGetTrustManagers() Returns one trust manager for each type of trust material.
protected void	engineInit(java.security.KeyStore keyStore) Initializes this factory with a source of certificate authorities and related trust material.
protected void	engineInit(javax.net.ssl.ManagerFactoryParameters managerFactoryParameters) Initializes this factory with a source of provider-specific key material.

从类继承的方法 javax.net.ssl.TrustManagerFactory

getAlgorithm, getDefaultAlgorithm, getInstance, getInstance, getInstance, getProvider, getTrustManagers, init, init

从类继承的方法 java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

构造器详细资料

FingerprintTrustManagerFactory

public FingerprintTrustManagerFactory(java.lang.Iterable<java.lang.String> fingerprints)

Creates a new instance.

参数:

fingerprints - a list of SHA1 fingerprints in hexadecimal form

FingerprintTrustManagerFactory

public FingerprintTrustManagerFactory(java.lang.String... fingerprints)

Creates a new instance.

参数:

fingerprints - a list of SHA1 fingerprints in hexadecimal form

FingerprintTrustManagerFactory

public FingerprintTrustManagerFactory(byte[]... fingerprints)

Creates a new instance.

参数:

fingerprints - a list of SHA1 fingerprints

方法详细资料

engineInit

protected void engineInit(java.security.KeyStore keyStore)
                   throws java.lang.Exception

从类复制的说明: SimpleTrustManagerFactory

Initializes this factory with a source of certificate authorities and related trust material.

指定者:

engineInit 在类中 SimpleTrustManagerFactory

抛出:

java.lang.Exception

另请参阅:

TrustManagerFactorySpi.engineInit(KeyStore)

engineInit

protected void engineInit(javax.net.ssl.ManagerFactoryParameters managerFactoryParameters)
                   throws java.lang.Exception

从类复制的说明: SimpleTrustManagerFactory

Initializes this factory with a source of provider-specific key material.

指定者:

engineInit 在类中 SimpleTrustManagerFactory

抛出:

java.lang.Exception

另请参阅:

TrustManagerFactorySpi.engineInit(ManagerFactoryParameters)

engineGetTrustManagers

protected javax.net.ssl.TrustManager[] engineGetTrustManagers()

从类复制的说明: SimpleTrustManagerFactory

Returns one trust manager for each type of trust material.

指定者:

engineGetTrustManagers 在类中 SimpleTrustManagerFactory

另请参阅:

TrustManagerFactorySpi.engineGetTrustManagers()