CODEWITHSUNDEEP
javassltrustmanagersslcontext
Natan
Natan

Reputation: 2858

Partial chain verification on Java SSL TrustManager

I have a requirement where one can provide an intermediate CA to trust but not the CA(s) that have signed it. And using that as the trust store, I'd like to be able to trust an SSL server that has a certificate that's signed by this intermediate CA. The default implementation is to expect to build the whole chain until a trusted self-signed root CA is found. I believe that's how the whole X509 platform is based on. But for certain reasons, I can only provide the intermediate CA.

The code is the usual SSLContext creation:

    // keystore part is pseudocode to make a point
    KeyStore keyStore = someWayToGenerateKeyStore;
    keyStore.add(intermediateCa);
    //keyStore.add(rootCaThatSignedTheIntermediateCaAbove); it will work if I add this. But I don't want to for reasons.

    TrustManagerFactory tmf = TrustManagerFactory.getInstance("SunX509");
    tmf.init(keyStore);
    SSLContext ctx = SSLContext.getInstance("TLSv1.2");
    ctx.init(new KeyManager[], tmf.getTrustManagers(), new SecureRandom());
    SslContextFactory sslContextFactory = new SslContextFactory();
    sslContextFactory.setSslContext(ctx);
    client = new WebSocketClient(sslContextFactory);

OpenSSL has a parameter for this that seems to work. So I guess it's not a completely unorthodox approach.

openssl verify -CApath /dev/null -partial_chain -trusted g1 g0

There are two reasons for the requirement to only have the intermediate CA in the truststore.

Upvotes: 1

Views: 1943

Answers (1)

user207421
user207421

Reputation: 310979

The default implementation is to expect to build the whole chain until a trusted self-signed root CA is found

No it isn't. It is to verify the whole chain until a trusted signing certificate is found in your truststore. 'Self-signed' has nothing to do with it, and 'trusted ... root CA' means nothing more than that it is present in your truststore.

So all you need to do is to add that certificate to your truststore. You don't need to write any code at all.

But why you want to trust an intermediate signer without trusting the root signer is a mystery.

Upvotes: 0

Related Questions