Class DefaultTrustManagerFactory

java.lang.Object
ghidra.net.DefaultTrustManagerFactory
public class DefaultTrustManagerFactory extends Object
DefaultTrustManagerFactory provides the ability to establish acceptable certificate authorities to be used with the default SSLContext as established by DefaultSSLContextInitializer.

All SSL connections which leverage this factory will perform peer authentication against the established certificate authorities. If an error occurs while reading a specified CA certs file, a "closed" trust policy is adopted and all peer authentication will fail.

An application X.509 CA certificates file path may optionally be specified via the system property ghidra.cacerts. The file may be in a standard form (*.pem, *.crt, *.cer, *.der) or may be in a Java JKS form (*.jks). The application may choose to set this property automatically based upon the presence of a cacerts file at a predetermined location prior to trust manager initialization.

When the ghidra.cacerts property has been specified that trust store is used exclusively and the OS and Java default trust stores are ignored. This applies to both client and server use, allowing a deployment to restrict trust to its own authorities. When the property has not been specified the OS trust store and the Java default trust store are used.

A server reached over a loopback connection is authenticated in the same way as any other. Setting the client property ghidra.disable.loopback.server.authentication to true waives that authentication for loopback connections only, which permits such a server to present a self-signed certificate. It should be used only where every local account is trusted: a loopback connection is not inherently authentic, and any local process able to bind the port ahead of the intended server would be accepted in its place - along with any credential subsequently sent to it.

NOTE: Since SslRMIClientSocketFactory and SSLServerSocketFactory employ a static cache of a default SSLSocketFactory, with its default SSLContext, we must utilize a wrapped implementation of the associated X509TrustManager so that any changes are used by the existing default SSLSocketFactory.

  • Field Details

    • GHIDRA_CACERTS_PATH_PROPERTY

      public static final String GHIDRA_CACERTS_PATH_PROPERTY
      The VM property name to be used when specifying the application trust store X509 'cacerts' file path.
      See Also:

    • GHIDRA_DISABLE_LOOPBACK_SERVER_AUTH_PROPERTY

      public static final String GHIDRA_DISABLE_LOOPBACK_SERVER_AUTH_PROPERTY
      The VM property name which may be used to disable authentication of a server certificate presented over a loopback connection. Loopback server authentication is performed by default; specifying this property as true waives it, permitting a server reached over loopback to present a self-signed (or otherwise untrusted) certificate.
      See Also:

  • Method Details

    • getTrustManagers

      public static TrustManager[] getTrustManagers()
      Get trust manager after performing any necessary initialization.
      Returns:
      trust managers

    • getTrustedIssuers

      public static X500Principal[] getTrustedIssuers() throws CertificateException
      Returns a list of trusted issuers (i.e., CA certificates) as established by the DefaultTrustManagerFactory.
      Returns:
      array of trusted Certificate Authorities
      Throws:
      CertificateException - if failed to properly initialize trust manager due to CA certificate error(s).

    • validateClient

      public static void validateClient(X509Certificate[] certChain, String authType) throws CertificateException
      Validate a client certificate ensuring that it is not expired and is trusted based upon the active trust managers.
      Parameters:
      certChain - X509 certificate chain with the client identity first, followed by its issuing CAs; the root certificate may be omitted
      authType - authentication type (i.e., "RSA")
      Throws:
      CertificateException - if certificate validation fails