Get trusted X509 certificate for Java SSLSocket
Jesse Wilson
I can establish a TLS connection to https://google.com/ . The remote service returns a chain of 3 certificates:
CN=www.google.com, O=Google Inc, L=Mountain View, ST=California, C=USCN=Google Internet Authority G2, O=Google Inc, C=USCN=GeoTrust Global CA, O=GeoTrust Inc., C=US
These certificates can be retrieved like this:
Certificate[] certificates = sslSocket.getSession().getPeerCertificates();
Unfortunately, this is not complete. A fourth certificate is installed in the TrustManager of my local SSL context. It looks like this:
OU=Equifax Secure Certificate Authority, O=Equifax, C=US
Retrieving its name is simple:
String equifax = ((X509Certificate) peerCertificates[2]).getIssuerDN().getName();
What I want is the X509Certificateinstance. How to get trusted CA certificate used during SSLSockethandshake ?
Note that I use the system TrustManagerby creating an SSL context like this:
SSLContext sslContext = SSLContext.getInstance("TLS");
sslContext.init(null, null, null);
Frantisek Hartman
You are almost there, just use the JVM default trust manager:
public static void main(String[] args) throws Exception{
SSLSocketFactory factory = (SSLSocketFactory) SSLSocketFactory.getDefault();
SSLSocket socket = (SSLSocket)factory.createSocket("www.google.com", 443);
X509Certificate[] chain = socket.getSession().getPeerCertificateChain();
String equifax = chain[2].getIssuerDN().getName();
// JVM Default Trust Managers
TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
trustManagerFactory.init((KeyStore) null);
TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();
X509TrustManager manager = (X509TrustManager) trustManagers[0];
for (java.security.cert.X509Certificate x509Certificate : manager.getAcceptedIssuers()) {
if (equifax.equals(x509Certificate.getSubjectDN().getName())) {
System.out.println(x509Certificate);
}
}
}