okhttp3.internal.tls

Class CertificateChainCleaner

java.lang.Object

okhttp3.internal.tls.CertificateChainCleaner

Direct Known Subclasses:

BasicCertificateChainCleaner

public abstract class CertificateChainCleaner
extends Object

Computes the effective certificate chain from the raw array returned by Java's built in TLS APIs. Cleaning a chain returns a list of certificates where the first element is chain[0], each certificate is signed by the certificate that follows, and the last certificate is a trusted CA certificate.

Use of the chain cleaner is necessary to omit unexpected certificates that aren't relevant to the TLS handshake and to extract the trusted CA certificate for the benefit of certificate pinning.

Constructor Summary

Constructors

Constructor and Description
CertificateChainCleaner()

Method Summary

Modifier and Type	Method and Description
abstract List<Certificate>	clean(List<Certificate> chain, String hostname)
static CertificateChainCleaner	get(X509Certificate... caCerts)
static CertificateChainCleaner	get(X509TrustManager trustManager)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

CertificateChainCleaner

public CertificateChainCleaner()

Method Detail

clean

public abstract List<Certificate> clean(List<Certificate> chain,
                                        String hostname)
                                 throws SSLPeerUnverifiedException

Throws:

SSLPeerUnverifiedException

get

public static CertificateChainCleaner get(X509TrustManager trustManager)

get

public static CertificateChainCleaner get(X509Certificate... caCerts)