SSL, by doug@mscs.mu.edu

SSL

Using SSL in Java

Code links

chain.cer
root.cer
src/Client.java
Listings

^ chain.cer
^ root.cer
^ src/Client.java
import java.net.Socket;
import java.io.InputStream;
import java.io.IOException;
import java.util.Collection;
import java.util.LinkedList;
import java.util.Date;
import java.security.Principal;
import java.security.PublicKey;
import java.security.GeneralSecurityException;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;

public
class Client
{
  public
  static
  void
  main(String [] arstring)
  {
    try
    {
      CertificateFactory certificatefactory = CertificateFactory.getInstance("X.509");
      InputStream inputstream = null;
      // Read certificate chain.
      inputstream = new java.io.FileInputStream(arstring[0]);
      inputstream = new java.io.BufferedInputStream(inputstream);
      LinkedList linkedlist = new LinkedList();
      while (true)
      {
        inputstream.mark(1);
        if (inputstream.read() < 0) break;
        inputstream.reset();
        linkedlist.add(certificatefactory.generateCertificate(inputstream));
      }
      inputstream.close();
      // Read root certificate.
      inputstream = new java.io.FileInputStream(arstring[1]);
      X509Certificate x509certificate = (X509Certificate)certificatefactory.generateCertificate(inputstream);
      // Read the target.
      String string = arstring[2];
      // Verify.
      verify(x509certificate, linkedlist, string);
    }
    catch (Exception exception)
    {
      exception.printStackTrace();
    }
  }

  public
  static
  boolean
  verify
  (
    X509Certificate x509certificateRoot,
    Collection collectionX509CertificateChain,
    String stringTarget
  )
  {
    int nSize = collectionX509CertificateChain.size();
    X509Certificate [] arx509certificate = new X509Certificate [nSize];
    collectionX509CertificateChain.toArray(arx509certificate);

    // Working down the chain, for every certificate in the chain,
    // verify that the subject of the certificate is the issuer of the
    // next certificate in the chain.
    Principal principalLast = null;
    for (int i = 0; i < nSize; i++)
    {
      X509Certificate x509certificate = arx509certificate[i];
      Principal principalIssuer = x509certificate.getIssuerDN();
      Principal principalSubject = x509certificate.getSubjectDN();
      if (principalLast != null)
      {
        if (principalIssuer.equals(principalLast))
        {
          try
          {
            PublicKey publickey = arx509certificate[i - 1].getPublicKey();
            arx509certificate[i].verify(publickey);
          }
          catch (GeneralSecurityException generalsecurityexception)
          {
            System.out.println("signature verification failed");
            return false;
          }
        }
        else
        {
          System.out.println("subject/issuer verification failed");
          return false;
        }
      }
      principalLast = principalSubject;
    }

    // Verify that the the first certificate in the chain was issued
    // by a third-party that the client trusts.
    try
    {
      PublicKey publickey = x509certificateRoot.getPublicKey();
      arx509certificate[0].verify(publickey);
    }
    catch (GeneralSecurityException generalsecurityexception)
    {
      System.out.println("signature verification failed");
      return false;
    }

    // Verify that the last certificate in the chain corresponds to
    // the server we desire to authenticate.
    Principal principalSubject = arx509certificate[nSize - 1].getSubjectDN();
    if (!stringTarget.equals(principalSubject.getName()))
    {
      System.out.println("target verification failed");
      return false;
    }

    // For every certificate in the chain, verify that the certificate
    // is valid at the current time.
    Date date = new Date();
    for (int i = 0; i < nSize; i++)
    {
      try
      {
        arx509certificate[i].checkValidity(date);
      }
      catch (GeneralSecurityException generalsecurityexception)
      {
        System.out.println("invalid date");
        return false;
      }
    }

    return true;
  }
}