JarCastingCertificate validator for X.509 certificates
This validator is not a single validator, it is set of rules to build the certificate validator (using X.509 certificates) fitting the needs of your business case.
A lot of sensible defaults is used to make it easy to get started using this library. Use a proper IDE to customize to your needs.
Getting started
Include dependency in your pom.xml:
<dependency>
<groupId>no.difi.commons</groupId>
<artifactId>commons-certvalidator</artifactId>
<version>2.1.1</version>
</dependency>
Create your own validator(s):
// Generic validator
Validator validator = ValidatorBuilder.newInstance()
.addRule(new ExpirationRule())
.addRule(new SigningRule())
.addRule(new CRLRule())
.addRule(new OCSPRule())
.build();
// Accept only non-expired self-signed certificates
Validator validator = ValidatorBuilder.newInstance()
.addRule(new ExpirationRule())
.addRule(SigningRule.SelfSignedOnly())
.build();
// Is the certificate expiring in less than 7 days?
Validator validator = ValidatorBuilder.newInstance()
.addRule(new ExpirationSoonRule(7 * 24 * 60 * 60 * 1000))
.build();
// Validate your certificate (throws exception on error)
validator.validate(...);
// Validate your certificate (returns boolean)
validator.isValid(...);
Please note the Validator accepts InputStream, byte[] and X509Certificate as input for validation.
Validators may not only be used to judge a given certificate when in situation to trust or not to trust a certificate. A validator instance may be used to implement logic helping users to handle certificates in a better manner (ie. give a warning before certificate expires).
Available building blocks
- ChainRule - Validates chain of trust of certificate given access to root certificates and intermediate certificates.
- CriticalExtensionRule - Validates required or recognized extensions.
- CRLRule - Use information regarding Certificate Revocation List (CRL) in certificate to validate certificate.
- DummyRule - Very simple implementation potentially interesting to use in testing.
- ExpirationSoonRule
- ExpirationRule
- OCSPRule - Use information regarding Online Certificate Status Protocol (OCSP) in certificate to validate certificate.
- PrincipalNameRule
- SigningRule
Structure
- Junction - Combine multiple validators into one validator using 'and', 'or' and 'xor'.
Extras
- NorwegianOrganizationNumberRule (extends PrincipalNameRule) - Implements logic to fetch a norwegian organization number from a certificate given standardization is used.
Exceptions
- CertificateValidatorException - This is thrown if anything around validation of certificate results in problems.
- FailedValidationException (extends CertificateValidatorException) - This is thrown when certificate is validated to not be valid.
- CertificateBucketException (extends CertificateValidatorException) - This is thrown when there are problems regarding certificate buckets.
Creating new rules
All new validation rules must implement the very simple ValidatorRule interface to be included in a chain of rules.
