Package eu.emi.security.authn.x509.helpers.trust

Class LazyOpensslTrustAnchorStoreImpl

  • All Implemented Interfaces:
    OpensslTrustAnchorStore, TrustAnchorStore
    public class LazyOpensslTrustAnchorStoreImpl
extends AbstractTrustAnchorStore
implements OpensslTrustAnchorStore
    Implementation of the truststore which uses CA certificates from a single directory in OpenSSL format. Each certificate should be stored in a file named HASH.NUM, where HASH is an 8 digit hex number. The NUM must be a number, starting from 0. The hash can be either of openssl pre 1.0.0 version (with 8 least significant digits of the MD5 hash of the certificate subject in DER format) or in openssl 1.0.0 and above format (SHA1 hash of specially normalized DN). The class is configured to use one or another, never both.

    This class (contrary to the OpensslTrustAnchorStoreImpl) doesn't extend DirectoryTrustAnchorStore and therefore certificates (and all corresponding files) are not loaded at startup and kept in memory. The files are loaded on-demand and are only cached in memory for no longer then the updateInterval is.

    Author:
    K. Benedyczak

    • Constructor Detail

      • LazyOpensslTrustAnchorStoreImpl

        public LazyOpensslTrustAnchorStoreImpl​(java.lang.String basePath,
                                       long updateInterval,
                                       ObserversHandler observers,
                                       boolean openssl1Mode)

    • Method Detail

      • tryLoadCertInternal

        protected java.security.cert.X509Certificate tryLoadCertInternal​(java.io.File file)

      • tryLoadCert

        protected void tryLoadCert​(java.io.File file,
                           java.util.Set<TrustAnchorExt> set)

      • getTrustAnchorsFor

        public java.util.Set<java.security.cert.TrustAnchor> getTrustAnchorsFor​(java.security.cert.X509Certificate[] certChain)
        Algorithm is as follows: for each certificate subject in chain, and for the issuer of the last certificate in chain, it is tried to load a trust anchor defined for such subject. If successful then also it is tried recursively to load all parent trust anchors for the loaded one.
        Parameters:
        certChain - certificate chain
        Returns:
        set of trust anchors for a given certificate chain