TrustManager Arayüzü

Giriş
Şu satırı dahil ederiz.

import javax.net.ssl.TrustManager;

Bu sınıf bir kaç amaç için kullanılır. Açıklaması şöyle.

The check* methods of the trust manager throw a CertificateException when something has failed. It also checks the date validity.

The trust managers can be used to initialize an SSLContext, which can then be used to initialize an SSLSocket (via the factory) or SSLEngine. By default, SSLSocketFactory uses the default SSLContext, itself initialized with a number of default values.

You can also create your own TrustManager if you need to check further extensions for your application and/or relax certain rules.

Bu sınıf SSLContext sınıfını ilklendirmek için kullanılır. SSLContext bir SSLSocketFactory nesnesi oluşturur. SSLSocketFactory nesnesi ise SSLSocket'i oluşturur. SSL bağlantısı açılırken hangi sertifikalara güvenileceği sorgulanır. Bu sınıf güvenilecek sertifikaları belirtmek için kullanılır.

1. Sertifika Doğrulama
Sertifikayı doğrularken şu yollar izlenebilir.

When the client is verifying a certificate, there are three possibilities:

* The certificate is signed by a CA that the client already trusts (and for which it knows the public key). In this case the client treats the certificate as valid.

* The certificate is signed by a CA about which the client has no knowledge at all. In this case the client treats the certificate as invalid (and the browser will likely display a warning message instead of loading the page).

* The certificate is signed by a CA that the client doesn't know, but which has a certificate that is signed by a CA that the client does know. (In this case the server must usually send both its own certificate, and the certificate of the CA - called the "intermediate CA" - that signed its certificate). Since the intermediate CA's certificate is signed by a CA that the client already trusts, it knows can trust it, and since the server's certificate is signed by the intermediate CA, the client knows it can trust it too.

Note that CA certificates are "special" - just because you have a certificate signed by a trusted CA, that doesn't mean you can then sign other certificates and have clients trust them - unless your certificate is marked as being valid for signing other certificates.

Örnek
Tüm sertifikalara güvenmek için şöyle yaparız.

TrustManager tm = new X509TrustManager() {
 public void checkClientTrusted(X509Certificate[] chain, String authType) 
 throws CertificateException {
 }

 public void checkServerTrusted(X509Certificate[] chain, String authType) 
 throws CertificateException {
 }

 public X509Certificate[] getAcceptedIssuers() {
   return null;
 }
};