Interface CertifiedIdentity

All Known Implementing Classes:
CertifiedTarget, TlsX509CertifiedTarget
public interface CertifiedIdentity
The CertifiedIdentity interface describes an identity that is associated with a client certificate fingerprint and a server certificate fingerprint.
Since:
2.0
Version:
3.13.0
Author:
Frank Fock

  • Method Details

    • getServerFingerprint

      OctetString getServerFingerprint()
      Gets the server certificate fingerprint.
      Returns:
      the server certificate fingerprint or null if no fingerprint has been configured.

    • getClientFingerprint

      OctetString getClientFingerprint()
      Gets the client certificate fingerprint.
      Returns:
      the client certificate fingerprint or null if no fingerprint has been configured.

    • getIdentity

      OctetString getIdentity()
      Gets the identity that the peer is expected to prove with its certificate. This is not the security name (the tmSecurityName used for access control), although an implementation may return the security name if no separate identity has been configured. The identity is matched against the dNSName and iPAddress subject alternative names of the peer certificate and thus corresponds to snmpTlstmAddrServerIdentity of RFC 6353.
      Returns:
      the expected peer identity or null (or an empty OctetString) if no identity comparison should be performed.

    • getConfiguredIdentity

      default OctetString getConfiguredIdentity()
      Gets the expected peer identity that has been configured explicitly, without any fallback to a value that serves another purpose - the security name in particular. Whereas getIdentity() may return such a fallback, this method returns null whenever no identity has been configured deliberately.

      RFC 6353 ยง5.3.1 verification of a server certificate is based on this method, so that the verification is only performed for a target whose identity has been configured on purpose. The default implementation returns getIdentity(), which keeps the behavior of implementations written before version 3.13.0.

      Returns:
      the explicitly configured expected peer identity or null if none has been configured.
      Since:
      3.13.0