1 /*
2 * ====================================================================
3 * Licensed to the Apache Software Foundation (ASF) under one
4 * or more contributor license agreements. See the NOTICE file
5 * distributed with this work for additional information
6 * regarding copyright ownership. The ASF licenses this file
7 * to you under the Apache License, Version 2.0 (the
8 * "License"); you may not use this file except in compliance
9 * with the License. You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing,
14 * software distributed under the License is distributed on an
15 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
16 * KIND, either express or implied. See the License for the
17 * specific language governing permissions and limitations
18 * under the License.
19 * ====================================================================
20 *
21 * This software consists of voluntary contributions made by many
22 * individuals on behalf of the Apache Software Foundation. For more
23 * information on the Apache Software Foundation, please see
24 * <http://www.apache.org/>.
25 *
26 */
27
28 package org.apache.http.conn.ssl;
29
30 import java.io.IOException;
31 import java.security.cert.X509Certificate;
32
33 import javax.net.ssl.HostnameVerifier;
34 import javax.net.ssl.SSLException;
35 import javax.net.ssl.SSLSocket;
36
37 /**
38 * Interface for checking if a hostname matches the names stored inside the
39 * server's X.509 certificate. This interface extends
40 * {@link javax.net.ssl.HostnameVerifier}, but it is recommended to use
41 * methods added by X509HostnameVerifier.
42 *
43 * @since 4.0
44 */
45 public interface X509HostnameVerifier extends HostnameVerifier {
46
47 /**
48 * Verifies that the host name is an acceptable match with the server's
49 * authentication scheme based on the given {@link SSLSocket}.
50 *
51 * @param host the host.
52 * @param ssl the SSL socket.
53 * @throws IOException if an I/O error occurs or the verification process
54 * fails.
55 */
56 void verify(String host, SSLSocket ssl) throws IOException;
57
58 /**
59 * Verifies that the host name is an acceptable match with the server's
60 * authentication scheme based on the given {@link X509Certificate}.
61 *
62 * @param host the host.
63 * @param cert the certificate.
64 * @throws SSLException if the verification process fails.
65 */
66 void verify(String host, X509Certificate cert) throws SSLException;
67
68 /**
69 * Checks to see if the supplied hostname matches any of the supplied CNs
70 * or "DNS" Subject-Alts. Most implementations only look at the first CN,
71 * and ignore any additional CNs. Most implementations do look at all of
72 * the "DNS" Subject-Alts. The CNs or Subject-Alts may contain wildcards
73 * according to RFC 2818.
74 *
75 * @param cns CN fields, in order, as extracted from the X.509
76 * certificate.
77 * @param subjectAlts Subject-Alt fields of type 2 ("DNS"), as extracted
78 * from the X.509 certificate.
79 * @param host The hostname to verify.
80 * @throws SSLException if the verification process fails.
81 */
82 void verify(String host, String[] cns, String[] subjectAlts)
83 throws SSLException;
84
85 }