|
||||||||||
PREV CLASS NEXT CLASS | FRAMES NO FRAMES | |||||||||
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD |
java.lang.Objecteu.emi.security.authn.x509.helpers.pkipath.AbstractValidator
eu.emi.security.authn.x509.impl.OpensslCertChainValidator
public class OpensslCertChainValidator
The certificate validator which uses OpenSSL directory as a truststore. The validator can work in two modes: the default lazy mode when the truststore contents is loaded on-demand and in a classic mode, when the whole truststore is loaded to the memory at startup. The latter mode can be useful for server-side as allows to get an information about truststore problems (as expired certificates or invalid files) at startup. Also the performance characteristic is better: validation can be faster and operation time more stable. Unfortunately both advantages are at the cost of a longer initialization time and bigger memory footprint. Therefore the lazy mode is strongly suggested for client tools, where this is a concern.
Field Summary | |
---|---|
protected static Timer |
timer
|
Fields inherited from class eu.emi.security.authn.x509.helpers.pkipath.AbstractValidator |
---|
disposed, listeners, observers, validator |
Constructor Summary | |
---|---|
OpensslCertChainValidator(String directory)
Constructs a new validator instance using the default settings: CRLs are used if present, proxy certificates are supported and directory is rescanned every 10mins. |
|
OpensslCertChainValidator(String directory,
boolean openssl1Mode,
NamespaceCheckingMode namespaceMode,
long updateInterval,
ValidatorParams params)
Constructs a new validator instance. |
|
OpensslCertChainValidator(String directory,
boolean openssl1Mode,
NamespaceCheckingMode namespaceMode,
long updateInterval,
ValidatorParams params,
boolean lazyMode)
Constructs a new validator instance. |
|
OpensslCertChainValidator(String directory,
NamespaceCheckingMode namespaceMode,
long updateInterval)
Constructs a new validator instance with default additional settings (see ValidatorParams.ValidatorParams() ). |
|
OpensslCertChainValidator(String directory,
NamespaceCheckingMode namespaceMode,
long updateInterval,
ValidatorParams params)
Constructs a new validator instance. |
Method Summary | |
---|---|
void |
dispose()
Disposes resources used by this Validator, like threads. |
NamespaceCheckingMode |
getNamespaceCheckingMode()
Returns the namespace checking mode. |
String |
getTruststorePath()
Returns the trusted certificates directory path |
long |
getUpdateInterval()
Returns the interval between subsequent checks of the trusted certificates directory. |
void |
setUpdateInterval(long updateInterval)
Sets a new interval between subsequent checks of the trusted certificates directory. |
ValidationResult |
validate(X509Certificate[] certChain)
Performs validation of a provided certificate chain. |
Methods inherited from class eu.emi.security.authn.x509.helpers.pkipath.AbstractValidator |
---|
addUpdateListener, addValidationListener, getProxySupport, getRevocationCheckingMode, getTrustedIssuers, init, notifyListeners, processErrorList, removeUpdateListener, removeValidationListener, validate, validate |
Methods inherited from class java.lang.Object |
---|
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
Field Detail |
---|
protected static final Timer timer
Constructor Detail |
---|
public OpensslCertChainValidator(String directory, NamespaceCheckingMode namespaceMode, long updateInterval, ValidatorParams params)
OpensslCertChainValidator(String, boolean, NamespaceCheckingMode, long, ValidatorParams, boolean)
with the legacy (pre 1.0) format of the truststore and the lazy mode turned on.
directory
- path where trusted certificates are stored.namespaceMode
- specifies how certificate namespaces should be handledupdateInterval
- specifies in miliseconds how often the directory should be
checked for updates. The files are reloaded only if their modification timestamp
was changed since last load. Use a <= 0 value to disable automatic updates.params
- common validator settings (revocation, initial listeners, proxy support, ...)public OpensslCertChainValidator(String directory, boolean openssl1Mode, NamespaceCheckingMode namespaceMode, long updateInterval, ValidatorParams params)
OpensslCertChainValidator(String, boolean, NamespaceCheckingMode, long, ValidatorParams, boolean)
for details.
directory
- path where trusted certificates are stored.openssl1Mode
- if true then truststore is with hashes in openssl 1+ format. Otherwise
the openssl 0.x format is used.namespaceMode
- specifies how certificate namespaces should be handledupdateInterval
- specifies in miliseconds how often the directory should be
checked for updates. The files are reloaded only if their modification timestamp
was changed since last load. Use a <= 0 value to disable automatic updates.params
- common validator settings (revocation, initial listeners, proxy support, ...)public OpensslCertChainValidator(String directory, boolean openssl1Mode, NamespaceCheckingMode namespaceMode, long updateInterval, ValidatorParams params, boolean lazyMode)
directory
- path where trusted certificates are stored.openssl1Mode
- if true then truststore is with hashes in openssl 1+ format. Otherwise
the openssl 0.x format is used.namespaceMode
- specifies how certificate namespaces should be handledupdateInterval
- specifies in miliseconds how often the directory should be
checked for updates. The files are reloaded only if their modification timestamp
was changed since last load. Use a <= 0 value to disable automatic updates.params
- common validator settings (revocation, initial listeners, proxy support, ...)lazyMode
- if true then certificates, CRLs and namespace definitions are loaded on-demand
(with in-memory caching). If false then the whole truststore contents is loaded at startup and kept in memory.public OpensslCertChainValidator(String directory, NamespaceCheckingMode namespaceMode, long updateInterval)
ValidatorParams.ValidatorParams()
).
The legacy, pre openssl 1.0 format of the truststore is used as well as the lazy loading mode.
directory
- path where trusted certificates are stored.namespaceMode
- specifies how certificate namespaces should be handledupdateInterval
- specifies in miliseconds how often the directory should be
checked for updates. The files are reloaded only if their modification timestamp
was changed since last load.public OpensslCertChainValidator(String directory)
directory
- path where trusted certificates are stored.Method Detail |
---|
public String getTruststorePath()
public NamespaceCheckingMode getNamespaceCheckingMode()
public long getUpdateInterval()
public void setUpdateInterval(long updateInterval)
updateInterval
- the new interval to be set in millisecondspublic void dispose()
AbstractValidator
dispose
in interface X509CertChainValidatorExt
dispose
in class AbstractValidator
public ValidationResult validate(X509Certificate[] certChain)
validate
in interface X509CertChainValidator
validate
in class AbstractValidator
certChain
- to be validated
|
||||||||||
PREV CLASS NEXT CLASS | FRAMES NO FRAMES | |||||||||
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD |