Package com.ongres.scram.common.util
Class TlsServerEndpoint
java.lang.Object
com.ongres.scram.common.util.TlsServerEndpoint
Utilitiy for extracting the
"tls-server-end-point"
channel binding data.-
Field Summary
FieldsModifier and TypeFieldDescriptionstatic final String
The "tls-server-end-point" Channel Binding Type. -
Constructor Summary
Constructors -
Method Summary
Modifier and TypeMethodDescriptionstatic byte @NotNull []
getChannelBindingData
(@NotNull X509Certificate serverCert) The hash of the TLS server's certificate [RFC5280] as it appears, octet for octet, in the server's Certificate message.private static MessageDigest
getDigestAlgorithm
(String signatureAlgorithm) Get the digest algorithm that would be used for a given signature algorithm name.
-
Field Details
-
TLS_SERVER_END_POINT
The "tls-server-end-point" Channel Binding Type.- See Also:
-
-
Constructor Details
-
TlsServerEndpoint
private TlsServerEndpoint()
-
-
Method Details
-
getDigestAlgorithm
Get the digest algorithm that would be used for a given signature algorithm name.The TLS server's certificate bytes need to be hashed with SHA-256 if its signature algorithm is MD5 or SHA-1 as per RFC 5929 (https://tools.ietf.org/html/rfc5929#section-4.1). If something else is used, the same hash as the signature algorithm is used.
- Parameters:
signatureAlgorithm
- the signature algorithm name for the certificate signature algorithm- Returns:
- the MessageDigest algorithm, or
null
if the name is not recognized - See Also:
-
getChannelBindingData
public static byte @NotNull [] getChannelBindingData(@NotNull @NotNull X509Certificate serverCert) throws CertificateEncodingException The hash of the TLS server's certificate [RFC5280] as it appears, octet for octet, in the server's Certificate message. Note that the Certificate message contains a certificate_list, in which the first element is the server's certificate.The TLS server's certificate bytes need to be hashed with SHA-256 if its signature algorithm is MD5 or SHA-1 as per RFC 5929 (https://tools.ietf.org/html/rfc5929#section-4.1). If something else is used, the same hash as the signature algorithm is used.
- Parameters:
serverCert
- the TLS server's peer certificate- Returns:
- the hash of the TLS server's peer certificate
- Throws:
CertificateEncodingException
- if an encoding error occurs.
-