public final class CertificateChainCleaner extends Object
chain[0]
, each
certificate is signed by the certificate that follows, and the last certificate is a trusted CA
certificate.
Use of the chain cleaner is necessary to omit unexpected certificates that aren't relevant to the TLS handshake and to extract the trusted CA certificate for the benefit of certificate pinning.
This class includes code from Conscrypt's TrustManagerImpl
and TrustedCertificateIndex
.
Constructor and Description |
---|
CertificateChainCleaner(TrustRootIndex trustRootIndex) |
Modifier and Type | Method and Description |
---|---|
List<Certificate> |
clean(List<Certificate> chain)
Returns a cleaned chain for
chain . |
public CertificateChainCleaner(TrustRootIndex trustRootIndex)
public List<Certificate> clean(List<Certificate> chain) throws SSLPeerUnverifiedException
chain
.
This method throws if the complete chain to a trusted CA certificate cannot be constructed.
This is unexpected unless the trust root index in this class has a different trust manager than
what was used to establish chain
.
SSLPeerUnverifiedException
Copyright © 2016. All rights reserved.