01 /*
02 * Copyright 1999-2005 Sun Microsystems, Inc. All Rights Reserved.
03 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
04 *
05 * This code is free software; you can redistribute it and/or modify it
06 * under the terms of the GNU General Public License version 2 only, as
07 * published by the Free Software Foundation. Sun designates this
08 * particular file as subject to the "Classpath" exception as provided
09 * by Sun in the LICENSE file that accompanied this code.
10 *
11 * This code is distributed in the hope that it will be useful, but WITHOUT
12 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14 * version 2 for more details (a copy is included in the LICENSE file that
15 * accompanied this code).
16 *
17 * You should have received a copy of the GNU General Public License version
18 * 2 along with this work; if not, write to the Free Software Foundation,
19 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20 *
21 * Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa Clara,
22 * CA 95054 USA or visit www.sun.com if you need additional information or
23 * have any questions.
24 */
25
26 package javax.net.ssl;
27
28 import java.security.cert.*;
29
30 /**
31 * Instance of this interface manage which X509 certificates
32 * may be used to authenticate the remote side of a secure
33 * socket. Decisions may be based on trusted certificate
34 * authorities, certificate revocation lists, online
35 * status checking or other means.
36 *
37 * @since 1.4
38 * @version 1.18
39 */
40 public interface X509TrustManager extends TrustManager {
41 /**
42 * Given the partial or complete certificate chain provided by the
43 * peer, build a certificate path to a trusted root and return if
44 * it can be validated and is trusted for client SSL
45 * authentication based on the authentication type.
46 * <p>
47 * The authentication type is determined by the actual certificate
48 * used. For instance, if RSAPublicKey is used, the authType
49 * should be "RSA". Checking is case-sensitive.
50 *
51 * @param chain the peer certificate chain
52 * @param authType the authentication type based on the client certificate
53 * @throws IllegalArgumentException if null or zero-length chain
54 * is passed in for the chain parameter or if null or zero-length
55 * string is passed in for the authType parameter
56 * @throws CertificateException if the certificate chain is not trusted
57 * by this TrustManager.
58 */
59 public void checkClientTrusted(X509Certificate[] chain,
60 String authType) throws CertificateException;
61
62 /**
63 * Given the partial or complete certificate chain provided by the
64 * peer, build a certificate path to a trusted root and return if
65 * it can be validated and is trusted for server SSL
66 * authentication based on the authentication type.
67 * <p>
68 * The authentication type is the key exchange algorithm portion
69 * of the cipher suites represented as a String, such as "RSA",
70 * "DHE_DSS". Note: for some exportable cipher suites, the key
71 * exchange algorithm is determined at run time during the
72 * handshake. For instance, for TLS_RSA_EXPORT_WITH_RC4_40_MD5,
73 * the authType should be RSA_EXPORT when an ephemeral RSA key is
74 * used for the key exchange, and RSA when the key from the server
75 * certificate is used. Checking is case-sensitive.
76 *
77 * @param chain the peer certificate chain
78 * @param authType the key exchange algorithm used
79 * @throws IllegalArgumentException if null or zero-length chain
80 * is passed in for the chain parameter or if null or zero-length
81 * string is passed in for the authType parameter
82 * @throws CertificateException if the certificate chain is not trusted
83 * by this TrustManager.
84 */
85 public void checkServerTrusted(X509Certificate[] chain,
86 String authType) throws CertificateException;
87
88 /**
89 * Return an array of certificate authority certificates
90 * which are trusted for authenticating peers.
91 *
92 * @return a non-null (possibly empty) array of acceptable
93 * CA issuer certificates.
94 */
95 public X509Certificate[] getAcceptedIssuers();
96 }
|