Class TLSTMUtil

java.lang.Object
org.snmp4j.transport.tls.TLSTMUtil
public class TLSTMUtil extends Object
The TLSTMUtil class implements common functions for TLSTM and DTLSTM.
Since:
3.0
Version:
3.6.0
Author:
Frank Fock

  • Field Details

    • DEFAULT_CRL_FETCH_TIMEOUT_MILLIS

      public static final int DEFAULT_CRL_FETCH_TIMEOUT_MILLIS
      The default connect and read timeout in milliseconds for retrieving a certificate revocation list.
      Since:
      3.13.0
      See Also:

  • Method Details

    • getFingerprint

      public static OctetString getFingerprint(X509Certificate cert)

    • digest

      public static OctetString digest(X509Certificate cert, String algorithm)
      Computes the hash (message digest) of the DER encoding of the provided certificate.
      Parameters:
      cert - a X.509 certificate.
      algorithm - the MessageDigest algorithm name to be used, for example SHA-256.
      Returns:
      the hash value or null if the digest could not be computed.
      Since:
      3.13.0

    • getHashAlgorithmName

      public static String getHashAlgorithmName(int hashAlgorithmID)
      Returns the MessageDigest algorithm name for a hash algorithm identifier of the IANA TLS HashAlgorithm registry (see RFC 5246). Such an identifier forms the first octet of a SnmpTLSFingerprint value as defined by RFC 6353.
      Parameters:
      hashAlgorithmID - a hash algorithm identifier of the IANA TLS HashAlgorithm registry.
      Returns:
      the corresponding MessageDigest algorithm name or null if the identifier does not denote a hash algorithm that can be used to compute a certificate fingerprint (i.e. none(0), intrinsic(7), and unassigned or private use values).
      Since:
      3.13.0

    • getFingerprint

      public static OctetString getFingerprint(X509Certificate cert, int hashAlgorithmID)
      Computes the SnmpTLSFingerprint value (see RFC 6353) of the provided certificate for the given hash algorithm. The returned value is composed of the one octet hash algorithm identifier followed by the hash value of the DER encoded certificate.
      Parameters:
      cert - a X.509 certificate.
      hashAlgorithmID - a hash algorithm identifier of the IANA TLS HashAlgorithm registry (see RFC 5246), for example 4 for SHA-256.
      Returns:
      the SnmpTLSFingerprint value of cert or null if the fingerprint could not be computed, because the hash algorithm is not supported.
      Since:
      3.13.0

    • isMatchingFingerprint

      public static boolean isMatchingFingerprint(X509Certificate cert, OctetString fingerprint)
      Checks whether the provided certificate matches the given SnmpTLSFingerprint value (see RFC 6353). The hash algorithm to be used is taken from the first octet of the fingerprint value as defined by the SnmpTLSFingerprint textual convention.

      For backwards compatibility, a fingerprint that does not contain the hash algorithm identifier octet required by RFC 6353 is matched against the hash of the certificate that is computed with the algorithm of the certificate's signature algorithm (this was the only fingerprint format supported by SNMP4J before version 3.13.0).

      Parameters:
      cert - a X.509 certificate.
      fingerprint - a SnmpTLSFingerprint value.
      Returns:
      true if fingerprint identifies cert, false otherwise. In particular, false is returned if cert or fingerprint is null or if fingerprint is a zero length value, because then a matching cannot be performed.
      Since:
      3.13.0

    • isMatchingFingerprint

      public static boolean isMatchingFingerprint(X509Certificate[] x509Certificates, OctetString fingerprint, boolean useClientMode, CounterSupport tlstmCounters, LogAdapter logger, Object eventSource) throws CertificateException
      Checks if any of the certificates in the provided array matches the given fingerprint. If the fingerprint to match is null or zero length, false will be returned, because a matching cannot be performed.
      Parameters:
      x509Certificates - the certificates to match.
      fingerprint - the searched fingerprint
      useClientMode - defines if server or client mode is active to emit the right counter events.
      tlstmCounters - the counters to increase on matching
      logger - where to log
      eventSource - the source object for events emitted by the matching.
      Returns:
      true if there is a match, false if matching could not be performed due to null or zero length fingerprint
      Throws:
      CertificateException - if there is no matching, but fingerprint is non-null and has a length greater than zero.

    • getSubjAltName

      public static Object getSubjAltName(Collection<List<?>> subjAltNames, int type)

    • getIpAddressFromSubjAltName

      public static OctetString getIpAddressFromSubjAltName(Collection<List<?>> altNames)

    • formatIpAddressForTmSecurityName

      public static OctetString formatIpAddressForTmSecurityName(String ipAddress)
      Converts the textual representation of an IP address of a certificate's subjectAltName iPAddress field into the tmSecurityName representation defined by RFC 6353 for the snmpTlstmCertSANIpAddress mapping type: an IPv4 address is represented as decimal-dotted quad address and an IPv6 address as 32 character all lowercase hexadecimal string without any colon separators.
      Parameters:
      ipAddress - the textual representation of an IPv4 or IPv6 address.
      Returns:
      the tmSecurityName representation of ipAddress or null if ipAddress is not a valid IP address.
      Since:
      3.13.0

    • createSSLContext

      public static SSLContext createSSLContext(String protocol, String keyStore, String keyStorePassword, String trustStore, String trustStorePassword, TransportStateReference transportStateReference, TLSTMTrustManagerFactory trustManagerFactory, boolean useClientMode, TlsTmSecurityCallback<X509Certificate> securityCallback, String localCertificateAlias, PKIXRevocationChecker pkixRevocationChecker, String crlURI) throws GeneralSecurityException
      Throws:
      GeneralSecurityException

    • clearKeyStoreCache

      public static void clearKeyStoreCache()
      Clears the key store and trust store content cache used by createSSLContext(String, String, String, String, String, TransportStateReference, TLSTMTrustManagerFactory, boolean, TlsTmSecurityCallback, String, PKIXRevocationChecker, String). The cache detects modified files by their modification time and size; use this method to force a reload if that is not sufficient.
      Since:
      3.13.0

    • createDefaultPKIXRevocationChecker

      public static PKIXRevocationChecker createDefaultPKIXRevocationChecker()
      Creates a default revocation checker with CRL check only (no OCSP) and check is limited to end entity only.
      Returns:
      a simple revocation checker to be used with TLSTM.setPKIXRevocationChecker(PKIXRevocationChecker).
      Since:
      3.6.0

    • addCRLCertStore

      protected static void addCRLCertStore(String crlFilePath, PKIXBuilderParameters pkixBuilderParameters) throws GeneralSecurityException
      Return the initialization parameters for a TrustManager for doing cert path validation with CRL revocation based on a CRL file. Currently, only the default PKIX is supported.
      Parameters:
      crlFilePath - the path to the CRL file that provides the CRL collection for checking revocation.
      pkixBuilderParameters - the PKIXBuilderParameters to modify.
      Throws:
      GeneralSecurityException
      Since:
      3.6.0

    • getCrlFetchTimeoutMillis

      public static int getCrlFetchTimeoutMillis()
      Gets the connect and read timeout in milliseconds used to retrieve a certificate revocation list from a remote URI.
      Returns:
      the timeout in milliseconds.
      Since:
      3.13.0

    • setCrlFetchTimeoutMillis

      public static void setCrlFetchTimeoutMillis(int crlFetchTimeoutMillis)
      Sets the connect and read timeout in milliseconds used to retrieve a certificate revocation list from a remote URI. Without a timeout, an unresponsive CRL distribution point stalls the thread that creates the SSL context, which for DTLS is the single listen thread of the transport mapping.
      Parameters:
      crlFetchTimeoutMillis - the timeout in milliseconds, must be greater than zero.
      Since:
      3.13.0