Easily buildable client `TrustManager`

In some cases, a user has to relax the verification of server certificates, e.g.

1. Accept a certificate regardless if it’s valid or not.
2. Accept a certificate even if the certificate’s CN does not match the server’s host name as long as the certificate chain’s signatures are valid.
3. Accept a certificate when its SHA-256 (or any digest algorithm) checksum matches.
4. Accept a certificate only when its CN matches the server’s host name AND the certificate chain’s signatures are valid.

… for all servers or a certain set of servers.

For now, we do (4) by default and a user can do (1) for all or specific hosts.

We could provide a simple way to build a client-side TrustManager that allows a user to implement all 4 actions for all or a certain set of servers.

The following is a hypothetical API I designed for it:

public final class ClientTrustManagers {
  // Does (1) for all hosts.
  public static TrustManager noVerify() { ... }
  // Does (2) for all hosts.
  public static TrustManager verifySignaturesOnly() { ... }
  // Does (3) for all hosts.
  public static TrustManager verifyFingerprintOnly(String algorithm, String... fingerprints) { ... }
  // Does (4) for all hosts. (default)
  public static TrustManager verifyAll() { ... }

  public static ClientTrustManagerBuilder builder() { ... }
}

// Examples
ClientTrustManagers
  .builder()
  .noVerify("a.com") // Do (1) if a.com.
  .reject("*.b.com") // Always reject if *.b.com.
  .verifySignaturesOnly("c.com") // (2) if c.com.
  .verifyFingerprintOnly("d.com", "SHA-256", "00:00:....", "01:01:...", ...) // (3) if d.com.
  .verifyAll("e.com") // (4) if "e.com"
  .action("f.com", (chain, authType, engine) -> { ... }) // Custom action if f.com.
  //.noVerifyByDefault()
  //.rejectByDefault()
  //.verifyFingerprintByDefault("SHA-256", "00:00:...", ...)
  //.verifySignaturesOnlyByDefault()
  //.verifyAllByDefault()
  .build()

public interface ClientTrustManagerAction {
  static ClientTrustManagerAction noVerify() { ... }
  static ClientTrustManagerAction reject() { ... }
  static ClientTrustManagerAction verifySignaturesOnly() { ... }
  static ClientTrustManagerAction verifyFingerprintsOnly(String algo, String fingerprint...) { ... }
  static ClientTrustManagerAction verifyAll() { ... }
  
  void checkServerTrusted(X509Certificate[] chain,
        String authType, SSLEngine engine) throws CertificateException;
}

Once this is implemented, we could:

• Deprecate some methods like tlsNoVerifyHosts().
• Add ClientFactory.tlsTrustManager(TrustManager) for convenience, because otherwise a user has to do:

  clientFactory.tlsCustomizer(sslCtxBuilder -> {
    sslCtxBuilder.trustManager(...);
  });
  

Some examples:

// Do not check endpoint identification.
ClientFactory
  .builder()
  .tlsTrustManager(ClientTrustManagers.verifySignaturesOnly())
  .build();

// Disable endpoint identification only for *.foo.com.
ClientFactory
  .builder()
  .tlsTrustManager(
    ClientTrustManagers
      .builder()
      .verifySignaturesOnly("*.foo.com")
      .build()
  )
  .build();

[amitvc]

@trustin @ikhoon Working on this starting Feb 07.

[amitvc]

Working on implementing a trie data structure in order to search ClientTrustManagerAction based on the hostname url pattern. We will support the following patterns

• Exact match (e.g hostname -> a.com)
• partial match (e.g hostname -> a..com or abc.) should match a.b.com or a.z.com or abc.com or abc.net