Java Code Examples for sun.security.x509.X500Name#findMostSpecificAttribute()

The following examples show how to use sun.security.x509.X500Name#findMostSpecificAttribute() . You can vote up the ones you like or vote down the ones you don't like, and go to the original project or source file by following the links above each example. You may check out the related API usage on the sidebar.
Example 1
Source File: HostnameChecker.java    From jdk8u60 with GNU General Public License v2.0 5 votes vote down vote up 
/**
 * Check if the certificate allows use of the given DNS name.
 *
 * From RFC2818:
 * If a subjectAltName extension of type dNSName is present, that MUST
 * be used as the identity. Otherwise, the (most specific) Common Name
 * field in the Subject field of the certificate MUST be used. Although
 * the use of the Common Name is existing practice, it is deprecated and
 * Certification Authorities are encouraged to use the dNSName instead.
 *
 * Matching is performed using the matching rules specified by
 * [RFC2459].  If more than one identity of a given type is present in
 * the certificate (e.g., more than one dNSName name, a match in any one
 * of the set is considered acceptable.)
 */
private void matchDNS(String expectedName, X509Certificate cert)
        throws CertificateException {
    Collection<List<?>> subjAltNames = cert.getSubjectAlternativeNames();
    if (subjAltNames != null) {
        boolean foundDNS = false;
        for ( List<?> next : subjAltNames) {
            if (((Integer)next.get(0)).intValue() == ALTNAME_DNS) {
                foundDNS = true;
                String dnsName = (String)next.get(1);
                if (isMatched(expectedName, dnsName)) {
                    return;
                }
            }
        }
        if (foundDNS) {
            // if certificate contains any subject alt names of type DNS
            // but none match, reject
            throw new CertificateException("No subject alternative DNS "
                    + "name matching " + expectedName + " found.");
        }
    }
    X500Name subjectName = getSubjectX500Name(cert);
    DerValue derValue = subjectName.findMostSpecificAttribute
                                                (X500Name.commonName_oid);
    if (derValue != null) {
        try {
            if (isMatched(expectedName, derValue.getAsString())) {
                return;
            }
        } catch (IOException e) {
            // ignore
        }
    }
    String msg = "No name matching " + expectedName + " found";
    throw new CertificateException(msg);
}
Example 2
Source File: HostnameChecker.java    From jdk8u-jdk with GNU General Public License v2.0 5 votes vote down vote up 
/**
 * Check if the certificate allows use of the given DNS name.
 *
 * From RFC2818:
 * If a subjectAltName extension of type dNSName is present, that MUST
 * be used as the identity. Otherwise, the (most specific) Common Name
 * field in the Subject field of the certificate MUST be used. Although
 * the use of the Common Name is existing practice, it is deprecated and
 * Certification Authorities are encouraged to use the dNSName instead.
 *
 * Matching is performed using the matching rules specified by
 * [RFC2459].  If more than one identity of a given type is present in
 * the certificate (e.g., more than one dNSName name, a match in any one
 * of the set is considered acceptable.)
 */
private void matchDNS(String expectedName, X509Certificate cert)
        throws CertificateException {
    Collection<List<?>> subjAltNames = cert.getSubjectAlternativeNames();
    if (subjAltNames != null) {
        boolean foundDNS = false;
        for ( List<?> next : subjAltNames) {
            if (((Integer)next.get(0)).intValue() == ALTNAME_DNS) {
                foundDNS = true;
                String dnsName = (String)next.get(1);
                if (isMatched(expectedName, dnsName)) {
                    return;
                }
            }
        }
        if (foundDNS) {
            // if certificate contains any subject alt names of type DNS
            // but none match, reject
            throw new CertificateException("No subject alternative DNS "
                    + "name matching " + expectedName + " found.");
        }
    }
    X500Name subjectName = getSubjectX500Name(cert);
    DerValue derValue = subjectName.findMostSpecificAttribute
                                                (X500Name.commonName_oid);
    if (derValue != null) {
        try {
            if (isMatched(expectedName, derValue.getAsString())) {
                return;
            }
        } catch (IOException e) {
            // ignore
        }
    }
    String msg = "No name matching " + expectedName + " found";
    throw new CertificateException(msg);
}
Example 3
Source File: HostnameChecker.java    From hottub with GNU General Public License v2.0 5 votes vote down vote up 
/**
 * Check if the certificate allows use of the given DNS name.
 *
 * From RFC2818:
 * If a subjectAltName extension of type dNSName is present, that MUST
 * be used as the identity. Otherwise, the (most specific) Common Name
 * field in the Subject field of the certificate MUST be used. Although
 * the use of the Common Name is existing practice, it is deprecated and
 * Certification Authorities are encouraged to use the dNSName instead.
 *
 * Matching is performed using the matching rules specified by
 * [RFC2459].  If more than one identity of a given type is present in
 * the certificate (e.g., more than one dNSName name, a match in any one
 * of the set is considered acceptable.)
 */
private void matchDNS(String expectedName, X509Certificate cert)
        throws CertificateException {
    Collection<List<?>> subjAltNames = cert.getSubjectAlternativeNames();
    if (subjAltNames != null) {
        boolean foundDNS = false;
        for ( List<?> next : subjAltNames) {
            if (((Integer)next.get(0)).intValue() == ALTNAME_DNS) {
                foundDNS = true;
                String dnsName = (String)next.get(1);
                if (isMatched(expectedName, dnsName)) {
                    return;
                }
            }
        }
        if (foundDNS) {
            // if certificate contains any subject alt names of type DNS
            // but none match, reject
            throw new CertificateException("No subject alternative DNS "
                    + "name matching " + expectedName + " found.");
        }
    }
    X500Name subjectName = getSubjectX500Name(cert);
    DerValue derValue = subjectName.findMostSpecificAttribute
                                                (X500Name.commonName_oid);
    if (derValue != null) {
        try {
            if (isMatched(expectedName, derValue.getAsString())) {
                return;
            }
        } catch (IOException e) {
            // ignore
        }
    }
    String msg = "No name matching " + expectedName + " found";
    throw new CertificateException(msg);
}
Example 4
Source File: HostnameChecker.java    From openjdk-8-source with GNU General Public License v2.0 5 votes vote down vote up 
/**
 * Check if the certificate allows use of the given DNS name.
 *
 * From RFC2818:
 * If a subjectAltName extension of type dNSName is present, that MUST
 * be used as the identity. Otherwise, the (most specific) Common Name
 * field in the Subject field of the certificate MUST be used. Although
 * the use of the Common Name is existing practice, it is deprecated and
 * Certification Authorities are encouraged to use the dNSName instead.
 *
 * Matching is performed using the matching rules specified by
 * [RFC2459].  If more than one identity of a given type is present in
 * the certificate (e.g., more than one dNSName name, a match in any one
 * of the set is considered acceptable.)
 */
private void matchDNS(String expectedName, X509Certificate cert)
        throws CertificateException {
    Collection<List<?>> subjAltNames = cert.getSubjectAlternativeNames();
    if (subjAltNames != null) {
        boolean foundDNS = false;
        for ( List<?> next : subjAltNames) {
            if (((Integer)next.get(0)).intValue() == ALTNAME_DNS) {
                foundDNS = true;
                String dnsName = (String)next.get(1);
                if (isMatched(expectedName, dnsName)) {
                    return;
                }
            }
        }
        if (foundDNS) {
            // if certificate contains any subject alt names of type DNS
            // but none match, reject
            throw new CertificateException("No subject alternative DNS "
                    + "name matching " + expectedName + " found.");
        }
    }
    X500Name subjectName = getSubjectX500Name(cert);
    DerValue derValue = subjectName.findMostSpecificAttribute
                                                (X500Name.commonName_oid);
    if (derValue != null) {
        try {
            if (isMatched(expectedName, derValue.getAsString())) {
                return;
            }
        } catch (IOException e) {
            // ignore
        }
    }
    String msg = "No name matching " + expectedName + " found";
    throw new CertificateException(msg);
}
Example 5
Source File: HostnameChecker.java    From openjdk-8 with GNU General Public License v2.0 5 votes vote down vote up 
/**
 * Check if the certificate allows use of the given DNS name.
 *
 * From RFC2818:
 * If a subjectAltName extension of type dNSName is present, that MUST
 * be used as the identity. Otherwise, the (most specific) Common Name
 * field in the Subject field of the certificate MUST be used. Although
 * the use of the Common Name is existing practice, it is deprecated and
 * Certification Authorities are encouraged to use the dNSName instead.
 *
 * Matching is performed using the matching rules specified by
 * [RFC2459].  If more than one identity of a given type is present in
 * the certificate (e.g., more than one dNSName name, a match in any one
 * of the set is considered acceptable.)
 */
private void matchDNS(String expectedName, X509Certificate cert)
        throws CertificateException {
    Collection<List<?>> subjAltNames = cert.getSubjectAlternativeNames();
    if (subjAltNames != null) {
        boolean foundDNS = false;
        for ( List<?> next : subjAltNames) {
            if (((Integer)next.get(0)).intValue() == ALTNAME_DNS) {
                foundDNS = true;
                String dnsName = (String)next.get(1);
                if (isMatched(expectedName, dnsName)) {
                    return;
                }
            }
        }
        if (foundDNS) {
            // if certificate contains any subject alt names of type DNS
            // but none match, reject
            throw new CertificateException("No subject alternative DNS "
                    + "name matching " + expectedName + " found.");
        }
    }
    X500Name subjectName = getSubjectX500Name(cert);
    DerValue derValue = subjectName.findMostSpecificAttribute
                                                (X500Name.commonName_oid);
    if (derValue != null) {
        try {
            if (isMatched(expectedName, derValue.getAsString())) {
                return;
            }
        } catch (IOException e) {
            // ignore
        }
    }
    String msg = "No name matching " + expectedName + " found";
    throw new CertificateException(msg);
}
Example 6
Source File: HostnameChecker.java    From jdk8u-jdk with GNU General Public License v2.0 5 votes vote down vote up 
/**
 * Check if the certificate allows use of the given DNS name.
 *
 * From RFC2818:
 * If a subjectAltName extension of type dNSName is present, that MUST
 * be used as the identity. Otherwise, the (most specific) Common Name
 * field in the Subject field of the certificate MUST be used. Although
 * the use of the Common Name is existing practice, it is deprecated and
 * Certification Authorities are encouraged to use the dNSName instead.
 *
 * Matching is performed using the matching rules specified by
 * [RFC2459].  If more than one identity of a given type is present in
 * the certificate (e.g., more than one dNSName name, a match in any one
 * of the set is considered acceptable.)
 */
private void matchDNS(String expectedName, X509Certificate cert)
        throws CertificateException {
    Collection<List<?>> subjAltNames = cert.getSubjectAlternativeNames();
    if (subjAltNames != null) {
        boolean foundDNS = false;
        for ( List<?> next : subjAltNames) {
            if (((Integer)next.get(0)).intValue() == ALTNAME_DNS) {
                foundDNS = true;
                String dnsName = (String)next.get(1);
                if (isMatched(expectedName, dnsName)) {
                    return;
                }
            }
        }
        if (foundDNS) {
            // if certificate contains any subject alt names of type DNS
            // but none match, reject
            throw new CertificateException("No subject alternative DNS "
                    + "name matching " + expectedName + " found.");
        }
    }
    X500Name subjectName = getSubjectX500Name(cert);
    DerValue derValue = subjectName.findMostSpecificAttribute
                                                (X500Name.commonName_oid);
    if (derValue != null) {
        try {
            if (isMatched(expectedName, derValue.getAsString())) {
                return;
            }
        } catch (IOException e) {
            // ignore
        }
    }
    String msg = "No name matching " + expectedName + " found";
    throw new CertificateException(msg);
}
Example 7
Source File: HostnameChecker.java    From jdk8u-dev-jdk with GNU General Public License v2.0 5 votes vote down vote up 
/**
 * Check if the certificate allows use of the given DNS name.
 *
 * From RFC2818:
 * If a subjectAltName extension of type dNSName is present, that MUST
 * be used as the identity. Otherwise, the (most specific) Common Name
 * field in the Subject field of the certificate MUST be used. Although
 * the use of the Common Name is existing practice, it is deprecated and
 * Certification Authorities are encouraged to use the dNSName instead.
 *
 * Matching is performed using the matching rules specified by
 * [RFC2459].  If more than one identity of a given type is present in
 * the certificate (e.g., more than one dNSName name, a match in any one
 * of the set is considered acceptable.)
 */
private void matchDNS(String expectedName, X509Certificate cert)
        throws CertificateException {
    Collection<List<?>> subjAltNames = cert.getSubjectAlternativeNames();
    if (subjAltNames != null) {
        boolean foundDNS = false;
        for ( List<?> next : subjAltNames) {
            if (((Integer)next.get(0)).intValue() == ALTNAME_DNS) {
                foundDNS = true;
                String dnsName = (String)next.get(1);
                if (isMatched(expectedName, dnsName)) {
                    return;
                }
            }
        }
        if (foundDNS) {
            // if certificate contains any subject alt names of type DNS
            // but none match, reject
            throw new CertificateException("No subject alternative DNS "
                    + "name matching " + expectedName + " found.");
        }
    }
    X500Name subjectName = getSubjectX500Name(cert);
    DerValue derValue = subjectName.findMostSpecificAttribute
                                                (X500Name.commonName_oid);
    if (derValue != null) {
        try {
            if (isMatched(expectedName, derValue.getAsString())) {
                return;
            }
        } catch (IOException e) {
            // ignore
        }
    }
    String msg = "No name matching " + expectedName + " found";
    throw new CertificateException(msg);
}
Example 8
Source File: HostnameChecker.java    From openjsse with GNU General Public License v2.0 4 votes vote down vote up 
/**
 * Check if the certificate allows use of the given DNS name.
 *
 * From RFC2818:
 * If a subjectAltName extension of type dNSName is present, that MUST
 * be used as the identity. Otherwise, the (most specific) Common Name
 * field in the Subject field of the certificate MUST be used. Although
 * the use of the Common Name is existing practice, it is deprecated and
 * Certification Authorities are encouraged to use the dNSName instead.
 *
 * Matching is performed using the matching rules specified by
 * [RFC5280].  If more than one identity of a given type is present in
 * the certificate (e.g., more than one dNSName name, a match in any one
 * of the set is considered acceptable.)
 */
private void matchDNS(String expectedName, X509Certificate cert,
                      boolean chainsToPublicCA)
        throws CertificateException {
    // Check that the expected name is a valid domain name.
    try {
        // Using the checking implemented in SNIHostName
        SNIHostName sni = new SNIHostName(expectedName);
    } catch (IllegalArgumentException iae) {
        throw new CertificateException(
            "Illegal given domain name: " + expectedName, iae);
    }

    Collection<List<?>> subjAltNames = cert.getSubjectAlternativeNames();
    if (subjAltNames != null) {
        boolean foundDNS = false;
        for (List<?> next : subjAltNames) {
            if (((Integer)next.get(0)).intValue() == ALTNAME_DNS) {
                foundDNS = true;
                String dnsName = (String)next.get(1);
                if (isMatched(expectedName, dnsName, chainsToPublicCA)) {
                    return;
                }
            }
        }
        if (foundDNS) {
            // if certificate contains any subject alt names of type DNS
            // but none match, reject
            throw new CertificateException("No subject alternative DNS "
                    + "name matching " + expectedName + " found.");
        }
    }
    X500Name subjectName = getSubjectX500Name(cert);
    DerValue derValue = subjectName.findMostSpecificAttribute
                                                (X500Name.commonName_oid);
    if (derValue != null) {
        try {
            if (isMatched(expectedName, derValue.getAsString(),
                          chainsToPublicCA)) {
                return;
            }
        } catch (IOException e) {
            // ignore
        }
    }
    String msg = "No name matching " + expectedName + " found";
    throw new CertificateException(msg);
}
Example 9
Source File: HostnameChecker.java    From dragonwell8_jdk with GNU General Public License v2.0 4 votes vote down vote up 
/**
 * Check if the certificate allows use of the given DNS name.
 *
 * From RFC2818:
 * If a subjectAltName extension of type dNSName is present, that MUST
 * be used as the identity. Otherwise, the (most specific) Common Name
 * field in the Subject field of the certificate MUST be used. Although
 * the use of the Common Name is existing practice, it is deprecated and
 * Certification Authorities are encouraged to use the dNSName instead.
 *
 * Matching is performed using the matching rules specified by
 * [RFC2459].  If more than one identity of a given type is present in
 * the certificate (e.g., more than one dNSName name, a match in any one
 * of the set is considered acceptable.)
 */
private void matchDNS(String expectedName, X509Certificate cert)
        throws CertificateException {
    // Check that the expected name is a valid domain name.
    try {
        // Using the checking implemented in SNIHostName
        SNIHostName sni = new SNIHostName(expectedName);
    } catch (IllegalArgumentException iae) {
        throw new CertificateException(
            "Illegal given domain name: " + expectedName, iae);
    }

    Collection<List<?>> subjAltNames = cert.getSubjectAlternativeNames();
    if (subjAltNames != null) {
        boolean foundDNS = false;
        for ( List<?> next : subjAltNames) {
            if (((Integer)next.get(0)).intValue() == ALTNAME_DNS) {
                foundDNS = true;
                String dnsName = (String)next.get(1);
                if (isMatched(expectedName, dnsName)) {
                    return;
                }
            }
        }
        if (foundDNS) {
            // if certificate contains any subject alt names of type DNS
            // but none match, reject
            throw new CertificateException("No subject alternative DNS "
                    + "name matching " + expectedName + " found.");
        }
    }
    X500Name subjectName = getSubjectX500Name(cert);
    DerValue derValue = subjectName.findMostSpecificAttribute
                                                (X500Name.commonName_oid);
    if (derValue != null) {
        try {
            if (isMatched(expectedName, derValue.getAsString())) {
                return;
            }
        } catch (IOException e) {
            // ignore
        }
    }
    String msg = "No name matching " + expectedName + " found";
    throw new CertificateException(msg);
}
Example 10
Source File: HostnameChecker.java    From TencentKona-8 with GNU General Public License v2.0 4 votes vote down vote up 
/**
 * Check if the certificate allows use of the given DNS name.
 *
 * From RFC2818:
 * If a subjectAltName extension of type dNSName is present, that MUST
 * be used as the identity. Otherwise, the (most specific) Common Name
 * field in the Subject field of the certificate MUST be used. Although
 * the use of the Common Name is existing practice, it is deprecated and
 * Certification Authorities are encouraged to use the dNSName instead.
 *
 * Matching is performed using the matching rules specified by
 * [RFC2459].  If more than one identity of a given type is present in
 * the certificate (e.g., more than one dNSName name, a match in any one
 * of the set is considered acceptable.)
 */
private void matchDNS(String expectedName, X509Certificate cert)
        throws CertificateException {
    // Check that the expected name is a valid domain name.
    try {
        // Using the checking implemented in SNIHostName
        SNIHostName sni = new SNIHostName(expectedName);
    } catch (IllegalArgumentException iae) {
        throw new CertificateException(
            "Illegal given domain name: " + expectedName, iae);
    }

    Collection<List<?>> subjAltNames = cert.getSubjectAlternativeNames();
    if (subjAltNames != null) {
        boolean foundDNS = false;
        for ( List<?> next : subjAltNames) {
            if (((Integer)next.get(0)).intValue() == ALTNAME_DNS) {
                foundDNS = true;
                String dnsName = (String)next.get(1);
                if (isMatched(expectedName, dnsName)) {
                    return;
                }
            }
        }
        if (foundDNS) {
            // if certificate contains any subject alt names of type DNS
            // but none match, reject
            throw new CertificateException("No subject alternative DNS "
                    + "name matching " + expectedName + " found.");
        }
    }
    X500Name subjectName = getSubjectX500Name(cert);
    DerValue derValue = subjectName.findMostSpecificAttribute
                                                (X500Name.commonName_oid);
    if (derValue != null) {
        try {
            if (isMatched(expectedName, derValue.getAsString())) {
                return;
            }
        } catch (IOException e) {
            // ignore
        }
    }
    String msg = "No name matching " + expectedName + " found";
    throw new CertificateException(msg);
}
Example 11
Source File: HostnameChecker.java    From openjdk-jdk8u with GNU General Public License v2.0 4 votes vote down vote up 
/**
 * Check if the certificate allows use of the given DNS name.
 *
 * From RFC2818:
 * If a subjectAltName extension of type dNSName is present, that MUST
 * be used as the identity. Otherwise, the (most specific) Common Name
 * field in the Subject field of the certificate MUST be used. Although
 * the use of the Common Name is existing practice, it is deprecated and
 * Certification Authorities are encouraged to use the dNSName instead.
 *
 * Matching is performed using the matching rules specified by
 * [RFC2459].  If more than one identity of a given type is present in
 * the certificate (e.g., more than one dNSName name, a match in any one
 * of the set is considered acceptable.)
 */
private void matchDNS(String expectedName, X509Certificate cert)
        throws CertificateException {
    // Check that the expected name is a valid domain name.
    try {
        // Using the checking implemented in SNIHostName
        SNIHostName sni = new SNIHostName(expectedName);
    } catch (IllegalArgumentException iae) {
        throw new CertificateException(
            "Illegal given domain name: " + expectedName, iae);
    }

    Collection<List<?>> subjAltNames = cert.getSubjectAlternativeNames();
    if (subjAltNames != null) {
        boolean foundDNS = false;
        for ( List<?> next : subjAltNames) {
            if (((Integer)next.get(0)).intValue() == ALTNAME_DNS) {
                foundDNS = true;
                String dnsName = (String)next.get(1);
                if (isMatched(expectedName, dnsName)) {
                    return;
                }
            }
        }
        if (foundDNS) {
            // if certificate contains any subject alt names of type DNS
            // but none match, reject
            throw new CertificateException("No subject alternative DNS "
                    + "name matching " + expectedName + " found.");
        }
    }
    X500Name subjectName = getSubjectX500Name(cert);
    DerValue derValue = subjectName.findMostSpecificAttribute
                                                (X500Name.commonName_oid);
    if (derValue != null) {
        try {
            if (isMatched(expectedName, derValue.getAsString())) {
                return;
            }
        } catch (IOException e) {
            // ignore
        }
    }
    String msg = "No name matching " + expectedName + " found";
    throw new CertificateException(msg);
}
Example 12
Source File: HostnameChecker.java    From openjdk-jdk8u-backup with GNU General Public License v2.0 4 votes vote down vote up 
/**
 * Check if the certificate allows use of the given DNS name.
 *
 * From RFC2818:
 * If a subjectAltName extension of type dNSName is present, that MUST
 * be used as the identity. Otherwise, the (most specific) Common Name
 * field in the Subject field of the certificate MUST be used. Although
 * the use of the Common Name is existing practice, it is deprecated and
 * Certification Authorities are encouraged to use the dNSName instead.
 *
 * Matching is performed using the matching rules specified by
 * [RFC2459].  If more than one identity of a given type is present in
 * the certificate (e.g., more than one dNSName name, a match in any one
 * of the set is considered acceptable.)
 */
private void matchDNS(String expectedName, X509Certificate cert)
        throws CertificateException {
    // Check that the expected name is a valid domain name.
    try {
        // Using the checking implemented in SNIHostName
        SNIHostName sni = new SNIHostName(expectedName);
    } catch (IllegalArgumentException iae) {
        throw new CertificateException(
            "Illegal given domain name: " + expectedName, iae);
    }

    Collection<List<?>> subjAltNames = cert.getSubjectAlternativeNames();
    if (subjAltNames != null) {
        boolean foundDNS = false;
        for ( List<?> next : subjAltNames) {
            if (((Integer)next.get(0)).intValue() == ALTNAME_DNS) {
                foundDNS = true;
                String dnsName = (String)next.get(1);
                if (isMatched(expectedName, dnsName)) {
                    return;
                }
            }
        }
        if (foundDNS) {
            // if certificate contains any subject alt names of type DNS
            // but none match, reject
            throw new CertificateException("No subject alternative DNS "
                    + "name matching " + expectedName + " found.");
        }
    }
    X500Name subjectName = getSubjectX500Name(cert);
    DerValue derValue = subjectName.findMostSpecificAttribute
                                                (X500Name.commonName_oid);
    if (derValue != null) {
        try {
            if (isMatched(expectedName, derValue.getAsString())) {
                return;
            }
        } catch (IOException e) {
            // ignore
        }
    }
    String msg = "No name matching " + expectedName + " found";
    throw new CertificateException(msg);
}
Example 13
Source File: HostnameChecker.java    From Bytecoder with Apache License 2.0 4 votes vote down vote up 
/**
 * Check if the certificate allows use of the given DNS name.
 *
 * From RFC2818:
 * If a subjectAltName extension of type dNSName is present, that MUST
 * be used as the identity. Otherwise, the (most specific) Common Name
 * field in the Subject field of the certificate MUST be used. Although
 * the use of the Common Name is existing practice, it is deprecated and
 * Certification Authorities are encouraged to use the dNSName instead.
 *
 * Matching is performed using the matching rules specified by
 * [RFC5280].  If more than one identity of a given type is present in
 * the certificate (e.g., more than one dNSName name, a match in any one
 * of the set is considered acceptable.)
 */
private void matchDNS(String expectedName, X509Certificate cert,
                      boolean chainsToPublicCA)
        throws CertificateException {
    // Check that the expected name is a valid domain name.
    try {
        // Using the checking implemented in SNIHostName
        SNIHostName sni = new SNIHostName(expectedName);
    } catch (IllegalArgumentException iae) {
        throw new CertificateException(
            "Illegal given domain name: " + expectedName, iae);
    }

    Collection<List<?>> subjAltNames = cert.getSubjectAlternativeNames();
    if (subjAltNames != null) {
        boolean foundDNS = false;
        for (List<?> next : subjAltNames) {
            if (((Integer)next.get(0)).intValue() == ALTNAME_DNS) {
                foundDNS = true;
                String dnsName = (String)next.get(1);
                if (isMatched(expectedName, dnsName, chainsToPublicCA)) {
                    return;
                }
            }
        }
        if (foundDNS) {
            // if certificate contains any subject alt names of type DNS
            // but none match, reject
            throw new CertificateException("No subject alternative DNS "
                    + "name matching " + expectedName + " found.");
        }
    }
    X500Name subjectName = getSubjectX500Name(cert);
    DerValue derValue = subjectName.findMostSpecificAttribute
                                                (X500Name.commonName_oid);
    if (derValue != null) {
        try {
            if (isMatched(expectedName, derValue.getAsString(),
                          chainsToPublicCA)) {
                return;
            }
        } catch (IOException e) {
            // ignore
        }
    }
    String msg = "No name matching " + expectedName + " found";
    throw new CertificateException(msg);
}
Example 14
Source File: HostnameChecker.java    From openjdk-jdk9 with GNU General Public License v2.0 4 votes vote down vote up 
/**
 * Check if the certificate allows use of the given DNS name.
 *
 * From RFC2818:
 * If a subjectAltName extension of type dNSName is present, that MUST
 * be used as the identity. Otherwise, the (most specific) Common Name
 * field in the Subject field of the certificate MUST be used. Although
 * the use of the Common Name is existing practice, it is deprecated and
 * Certification Authorities are encouraged to use the dNSName instead.
 *
 * Matching is performed using the matching rules specified by
 * [RFC5280].  If more than one identity of a given type is present in
 * the certificate (e.g., more than one dNSName name, a match in any one
 * of the set is considered acceptable.)
 */
private void matchDNS(String expectedName, X509Certificate cert,
                      boolean chainsToPublicCA)
        throws CertificateException {
    // Check that the expected name is a valid domain name.
    try {
        // Using the checking implemented in SNIHostName
        SNIHostName sni = new SNIHostName(expectedName);
    } catch (IllegalArgumentException iae) {
        throw new CertificateException(
            "Illegal given domain name: " + expectedName, iae);
    }

    Collection<List<?>> subjAltNames = cert.getSubjectAlternativeNames();
    if (subjAltNames != null) {
        boolean foundDNS = false;
        for (List<?> next : subjAltNames) {
            if (((Integer)next.get(0)).intValue() == ALTNAME_DNS) {
                foundDNS = true;
                String dnsName = (String)next.get(1);
                if (isMatched(expectedName, dnsName, chainsToPublicCA)) {
                    return;
                }
            }
        }
        if (foundDNS) {
            // if certificate contains any subject alt names of type DNS
            // but none match, reject
            throw new CertificateException("No subject alternative DNS "
                    + "name matching " + expectedName + " found.");
        }
    }
    X500Name subjectName = getSubjectX500Name(cert);
    DerValue derValue = subjectName.findMostSpecificAttribute
                                                (X500Name.commonName_oid);
    if (derValue != null) {
        try {
            if (isMatched(expectedName, derValue.getAsString(),
                          chainsToPublicCA)) {
                return;
            }
        } catch (IOException e) {
            // ignore
        }
    }
    String msg = "No name matching " + expectedName + " found";
    throw new CertificateException(msg);
}
Example 15
Source File: HostnameChecker.java    From jdk8u_jdk with GNU General Public License v2.0 4 votes vote down vote up 
/**
 * Check if the certificate allows use of the given DNS name.
 *
 * From RFC2818:
 * If a subjectAltName extension of type dNSName is present, that MUST
 * be used as the identity. Otherwise, the (most specific) Common Name
 * field in the Subject field of the certificate MUST be used. Although
 * the use of the Common Name is existing practice, it is deprecated and
 * Certification Authorities are encouraged to use the dNSName instead.
 *
 * Matching is performed using the matching rules specified by
 * [RFC2459].  If more than one identity of a given type is present in
 * the certificate (e.g., more than one dNSName name, a match in any one
 * of the set is considered acceptable.)
 */
private void matchDNS(String expectedName, X509Certificate cert)
        throws CertificateException {
    // Check that the expected name is a valid domain name.
    try {
        // Using the checking implemented in SNIHostName
        SNIHostName sni = new SNIHostName(expectedName);
    } catch (IllegalArgumentException iae) {
        throw new CertificateException(
            "Illegal given domain name: " + expectedName, iae);
    }

    Collection<List<?>> subjAltNames = cert.getSubjectAlternativeNames();
    if (subjAltNames != null) {
        boolean foundDNS = false;
        for ( List<?> next : subjAltNames) {
            if (((Integer)next.get(0)).intValue() == ALTNAME_DNS) {
                foundDNS = true;
                String dnsName = (String)next.get(1);
                if (isMatched(expectedName, dnsName)) {
                    return;
                }
            }
        }
        if (foundDNS) {
            // if certificate contains any subject alt names of type DNS
            // but none match, reject
            throw new CertificateException("No subject alternative DNS "
                    + "name matching " + expectedName + " found.");
        }
    }
    X500Name subjectName = getSubjectX500Name(cert);
    DerValue derValue = subjectName.findMostSpecificAttribute
                                                (X500Name.commonName_oid);
    if (derValue != null) {
        try {
            if (isMatched(expectedName, derValue.getAsString())) {
                return;
            }
        } catch (IOException e) {
            // ignore
        }
    }
    String msg = "No name matching " + expectedName + " found";
    throw new CertificateException(msg);
}