Package org.miaixz.bus.http.secure

Class CertificatePinner

java.lang.Object

org.miaixz.bus.http.secure.CertificatePinner

public class CertificatePinner
extends Object

限制哪些证书受信任。将证书固定起来可以防御对证书颁发机构的攻击。 它还可以防止通过应用程序用户知道或不知道的中间人证书颁发机构进行连接 固定证书限制了服务器团队更新其TLS证书的能力。通过固定证书， 您将承担额外的操作复杂性，并限制您在证书颁发机构之间迁移的能力。 未经服务器的TLS管理员许可，请勿使用证书固定! 如果TrustManager不接受自签名证书, 则CertificatePinner不能用于pin自签名证书

Since:

Java 17+

Author:

Kimi Liu

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static class	CertificatePinner.Builder	构建已配置的证书

Field Summary

Fields

Modifier and Type	Field	Description
static final CertificatePinner	DEFAULT

Method Summary

Modifier and Type	Method	Description
void	check(String hostname, Certificate... peerCertificates)	Deprecated. replaced with check(String, List).
void	check(String hostname, List<Certificate> peerCertificates)	确认hostname所固定的证书中至少有一个位于peerCertificates中。
boolean	equals(Object other)
int	hashCode()
static String	pin(Certificate certificate)	Returns the SHA-256 of certificate's public key.
CertificatePinner	withCertificateChainCleaner(CertificateChainCleaner certificateChainCleaner)	Returns a certificate pinner that uses certificateChainCleaner.

Methods inherited from class java.lang.Object

clone, finalize, getClass, notify, notifyAll, toString, wait, wait, wait

Field Details

DEFAULT

public static final CertificatePinner DEFAULT

Method Details

pin

public static String pin(Certificate certificate)

Returns the SHA-256 of certificate's public key. In Http and earlier, this returned a SHA-1 hash of the public key. Both types are supported, but SHA-256 is preferred.

equals

public boolean equals(Object other)

Overrides:

equals in class Object

hashCode

public int hashCode()

Overrides:

hashCode in class Object

check

public void check(String hostname,
 List<Certificate> peerCertificates)
           throws SSLPeerUnverifiedException

确认hostname所固定的证书中至少有一个位于peerCertificates中。 如果没有为hostname指定证书，则不执行任何操作。Httpd在成功的TLS握手之后调用它，但是在使用连接之前.

Parameters:

hostname - 主机名

peerCertificates - 证书信息

Throws:

SSLPeerUnverifiedException - 如果peerCertificates 与hostname所固定的证书不匹配

check

public void check(String hostname,
 Certificate... peerCertificates)
           throws SSLPeerUnverifiedException

Deprecated.

replaced with check(String, List).

Throws:

SSLPeerUnverifiedException

withCertificateChainCleaner

public CertificatePinner withCertificateChainCleaner(CertificateChainCleaner certificateChainCleaner)

Returns a certificate pinner that uses certificateChainCleaner.