Class TlsServerEndpoint

java.lang.Object
com.ongres.scram.common.util.TlsServerEndpoint

public final class TlsServerEndpoint extends Object
Utilitiy for extracting the "tls-server-end-point" channel binding data.
  • Field Details

    • TLS_SERVER_END_POINT

      public static final String TLS_SERVER_END_POINT
      The "tls-server-end-point" Channel Binding Type.
      See Also:
  • Constructor Details

    • TlsServerEndpoint

      private TlsServerEndpoint()
  • Method Details

    • getDigestAlgorithm

      private static MessageDigest getDigestAlgorithm(String signatureAlgorithm)
      Get the digest algorithm that would be used for a given signature algorithm name.

      The TLS server's certificate bytes need to be hashed with SHA-256 if its signature algorithm is MD5 or SHA-1 as per RFC 5929 (https://tools.ietf.org/html/rfc5929#section-4.1). If something else is used, the same hash as the signature algorithm is used.

      Parameters:
      signatureAlgorithm - the signature algorithm name for the certificate signature algorithm
      Returns:
      the MessageDigest algorithm, or null if the name is not recognized
      See Also:
    • getChannelBindingData

      public static byte[] getChannelBindingData(X509Certificate serverCert) throws CertificateEncodingException
      The hash of the TLS server's certificate [RFC5280] as it appears, octet for octet, in the server's Certificate message. Note that the Certificate message contains a certificate_list, in which the first element is the server's certificate.

      The TLS server's certificate bytes need to be hashed with SHA-256 if its signature algorithm is MD5 or SHA-1 as per RFC 5929 (https://tools.ietf.org/html/rfc5929#section-4.1). If something else is used, the same hash as the signature algorithm is used.

      Parameters:
      serverCert - the TLS server's peer certificate
      Returns:
      the hash of the TLS server's peer certificate
      Throws:
      CertificateEncodingException - if an encoding error occurs.