ssl - Validate X.509 certificate agains concrete CA Java -

ssl - Validate X.509 certificate agains concrete CA Java -

lets have (client side code):

trustmanager[] trustallcerts = new trustmanager[]{ new x509trustmanager() { @override public java.security.cert.x509certificate[] getacceptedissuers() { homecoming null; } @override public void checkclienttrusted( java.security.cert.x509certificate[] certs, string authtype) { } @override public void checkservertrusted( java.security.cert.x509certificate[] certs, string authtype) { } } }; sslcontext sslc = sslcontext.getinstance("tls"); sslc.init(null, trustallcerts, null); socketfactory sf = sslc.getsocketfactory(); sslsocket s = (sslsocket) sf.createsocket("127.0.0.1", 9124);

this code finish functional, can not figure out, how validate server's certificate against 1 concrete ca certificate have available in pem file.

all certificates signed self-signed ca, , ca need validate against (only against one).

every reply appreciated.

edit:

in response jglouie (thank much way - can not vote answer).

i founded solution:

new x509trustmanager() { @override public java.security.cert.x509certificate[] getacceptedissuers() { homecoming null; } @override public void checkclienttrusted( java.security.cert.x509certificate[] certs, string authtype) { } @override public void checkservertrusted( java.security.cert.x509certificate[] certs, string authtype) throws certificateexception { inputstream instream = null; seek { // loading ca cert url u = getclass().getresource("tcp/cacert.pem"); instream = new fileinputstream(u.getfile()); certificatefactory cf = certificatefactory.getinstance("x.509"); x509certificate ca = (x509certificate) cf.generatecertificate(instream); instream.close(); (x509certificate cert : certs) { // verifing public key cert.verify(ca.getpublickey()); } } grab (exception ex) { logger.getlogger(client.class.getname()).log(level.severe, null, ex); } { seek { instream.close(); } grab (ioexception ex) { logger.getlogger(client.class.getname()).log(level.severe, null, ex); } } } } };

i assume self-signed certificate of ca loaded follows:

certificatefactory cf = certificatefactory.getinstance("x.509"); fileinputstream finstream = new fileinputstream("cacertificate.pem"); x509certificate cacertificate = (x509certificate)cf.generatecertificate(finstream);

then in method check certificate:

@override public void checkservertrusted(java.security.cert.x509certificate[] certs, string authtype) throws certificateexception { if (certs == null || certs.length == 0) { throw new illegalargumentexception("null or zero-length certificate chain"); } if (authtype == null || authtype.length() == 0) { throw new illegalargumentexception("null or zero-length authentication type"); } //check if certificate send ca's if(!certs[0].equals(cacertificate)){ seek { //not ca's. check if has been signed ca certs[0].verify(cacertificate.getpublickey()) } catch(exception e){ throw new certificateexception("certificate not trusted",e); } } //if end here certificate trusted. check if has expired. try{ certs[0].checkvalidity(); } catch(exception e){ throw new certificateexception("certificate not trusted. has expired",e); } }

disclaimer: have not atempted compile code

java ssl x509certificate x509