Class TlsUtils

java.lang.Object

com.rabbitmq.client.impl.TlsUtils

public class TlsUtils
extends Object

Utility to extract information from X509 certificates.

Since:

5.7.0

Field Summary

Fields

Modifier and Type	Field	Description
private static final Map<String,String>	EXTENDED_KEY_USAGE
private static final Map<String, BiFunction<byte[], X509Certificate, String>>	EXTENSIONS
private static final List<String>	KEY_USAGE
private static final org.slf4j.Logger	LOGGER
private static String	PARSING_ERROR

Constructor Summary

Constructors

Constructor	Description
TlsUtils()

Method Summary

Modifier and Type	Method	Description
private static String	authorityKeyIdentifier(byte[] derOctetString)
private static String	basicConstraints(byte[] derOctetString)
private static String	extendedKeyUsage(byte[] derOctetString, X509Certificate certificate)
static String	extensionPrettyPrint(String oid, byte[] derOctetString, X509Certificate certificate)	Human-readable representation of an X509 certificate extension.
private static String	extensions(X509Certificate certificate)
private static String	hexDump(int start, byte[] derOctetString)
private static String	keyUsageBitString(boolean[] keyUsage, byte[] derOctetString)
static void	logPeerCertificateInfo(SSLSession session)	Log details on peer certificate and certification chain.
private static String	octetStringHexDump(byte[] derOctetString)
static String	peerCertificateInfo(Certificate certificate, String prefix)	Get a string representation of certificate info.
private static String	sans(X509Certificate c, String separator)
static String	stripCRLF(String value)	Strips carriage return (CR) and line feed (LF) characters to mitigate CWE-117.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

LOGGER

private static final org.slf4j.Logger LOGGER

KEY_USAGE

private static final List<String> KEY_USAGE

EXTENDED_KEY_USAGE

private static final Map<String,String> EXTENDED_KEY_USAGE

PARSING_ERROR

private static String PARSING_ERROR

EXTENSIONS

private static final Map<String, BiFunction<byte[], X509Certificate, String>> EXTENSIONS

Constructor Details

TlsUtils

public TlsUtils()

Method Details

logPeerCertificateInfo

public static void logPeerCertificateInfo(SSLSession session)

Log details on peer certificate and certification chain.

The log level is debug. Common X509 extensions are displayed in a best-effort fashion, a hexadecimal dump is made for less commonly used extensions.

Parameters:

session - the SSLSession to extract the certificates from

peerCertificateInfo

public static String peerCertificateInfo(Certificate certificate,
 String prefix)

Get a string representation of certificate info.

Parameters:

certificate - the certificate to analyze

prefix - the line prefix

Returns:

information about the certificate

sans

private static String sans(X509Certificate c,
 String separator)
                    throws CertificateParsingException

Throws:

CertificateParsingException

extensionPrettyPrint

public static String extensionPrettyPrint(String oid,
 byte[] derOctetString,
 X509Certificate certificate)

Human-readable representation of an X509 certificate extension.

Common extensions are supported in a best-effort fashion, less commonly used extensions are displayed as an hexadecimal dump.

Extensions come encoded as a DER Octet String, which itself can contain other DER-encoded objects, making a comprehensive support in this utility impossible.

Parameters:

oid - extension OID

derOctetString - the extension value as a DER octet string

certificate - the certificate

Returns:

the OID and the value

See Also:

• A Layman's Guide to a Subset of ASN.1, BER, and DER
• DER Encoding of ASN.1 Types

stripCRLF

public static String stripCRLF(String value)

Strips carriage return (CR) and line feed (LF) characters to mitigate CWE-117.

Returns:

sanitised string value

extensions

private static String extensions(X509Certificate certificate)

octetStringHexDump

private static String octetStringHexDump(byte[] derOctetString)

hexDump

private static String hexDump(int start,
 byte[] derOctetString)

keyUsageBitString

private static String keyUsageBitString(boolean[] keyUsage,
 byte[] derOctetString)

basicConstraints

private static String basicConstraints(byte[] derOctetString)

authorityKeyIdentifier

private static String authorityKeyIdentifier(byte[] derOctetString)

extendedKeyUsage

private static String extendedKeyUsage(byte[] derOctetString,
 X509Certificate certificate)