Determines if a specified certificate type indicates a GSI-2 proxy
certificate.

@param certType the certificate type to check.
@return true if certType is a GSI-2 proxy, false otherwise.
773834
public static boolean isGsi2Proxy(GSIConstants.CertificateType certType) {
        return certType == GSIConstants.CertificateType.GSI_2_PROXY
                || certType == GSIConstants.CertificateType.GSI_2_LIMITED_PROXY;
    }
1242700
public X509Certificate createCertificate(InputStream certRequestInputStream, X509Certificate cert,
        PrivateKey privateKey, int lifetime, GSIConstants.CertificateType certType) throws IOException,
        GeneralSecurityException {
        return createCertificate(certRequestInputStream, cert, privateKey, lifetime, certType, (X509ExtensionSet) null,
            null);
    }
235357
public boolean isTypeGenerifiedBy(String type) {
        if (typeGenericName.length > 2 && typeGenericName[2].equals(type)) {
            return true;
        }
        if (typeGenericName.length > 1 && typeGenericName[1].equals(type)) {
            return true;
        }
        if (typeGenericName.length > 0 && typeGenericName[0].equals(type)) {
            return true;
        }
        return false;
    }
234415
public void checkServerTrusted( X509Certificate[] chain, String authType )
            throws CertificateException
    {
        X509Certificate certificate = chain[0];

        String cert = fingerprint( certificate );

        if ( this.fingerprint == null )
        {
            try
            {
                saveTrustedHost( cert );
            }
            catch ( IOException e )
            {
                throw new CertificateException( format(
                        "Failed to save the server ID and the certificate received from the server to file %s.\n" +
                        "Server ID: %s\nReceived cert:\n%s",
                        knownHosts.getAbsolutePath(), serverId, X509CertToString( cert ) ), e );
            }
        }
        else
        {
            if ( !this.fingerprint.equals( cert ) )
            {
                throw new CertificateException( format(
                        "Unable to connect to neo4j at `%s`, because the certificate the server uses has changed. " +
                        "This is a security feature to protect against man-in-the-middle attacks.\n" +
                        "If you trust the certificate the server uses now, simply remove the line that starts with " +
                        "`%s` " +
                        "in the file `%s`.\n" +
                        "The old certificate saved in file is:\n%sThe New certificate received is:\n%s",
                        serverId, serverId, knownHosts.getAbsolutePath(),
                        X509CertToString( this.fingerprint ), X509CertToString( cert ) ) );
            }
        }
    }
175515
protected boolean isProducerTypeCheck() {
        if (TraceComponent.isAnyTracingEnabled() && tc.isEntryEnabled())
            SibTr.entry(this, tc, "isProducerTypeCheck");
        boolean checking = true;

        // We can carry out checking if there is no FRP, or the FRP has 0 size.
        StringArrayWrapper frp = (StringArrayWrapper) properties.get(FORWARD_ROUTING_PATH);
        if (frp != null) {
            List totalPath = frp.getMsgForwardRoutingPath();
            if ((totalPath != null) && (totalPath.size() > 0))
                checking = false;
        }

        if (TraceComponent.isAnyTracingEnabled() && tc.isEntryEnabled())
            SibTr.exit(this, tc, "isProducerTypeCheck", checking);
        return checking;
    }
511608
public void verify() throws Exception {

        Map<String, ProxyPolicyHandler> handlers = null;
        if (proxyCertInfo != null) {
            String oid = proxyCertInfo.getProxyPolicy().getPolicyLanguage().getId();
            handlers = new HashMap<String,ProxyPolicyHandler>();
            handlers.put(oid, new ProxyPolicyHandler() {
                public void validate(ProxyCertInfo proxyCertInfo,
                         CertPath certPath,
                         int index)
                throws CertPathValidatorException {
                // ignore policy - this is just for proxy init case
                System.out.println("Proxy verify: Ignoring proxy policy");
                if (debug) {
                    String policy =
                    new String(proxyCertInfo.getProxyPolicy().getPolicy());
                    System.out.println("Policy:");
                    System.out.println(policy);
                }
              }
            });
        }

        KeyStore keyStore = Stores.getDefaultTrustStore();
        CertStore crlStore = Stores.getDefaultCRLStore();
        ResourceSigningPolicyStore sigPolStore = Stores.getDefaultSigningPolicyStore();
        X509ProxyCertPathParameters parameters = new X509ProxyCertPathParameters(keyStore, crlStore, sigPolStore, false, handlers);
        X509ProxyCertPathValidator validator = new X509ProxyCertPathValidator();
        validator.engineValidate(CertificateUtil.getCertPath(proxy.getCertificateChain()), parameters);
    }
117205
private function _hasEqualSubject(Certificate $cert): bool
    {
        $dn1 = $this->_tbsCertificate->subject();
        $dn2 = $cert->_tbsCertificate->subject();
        return $dn1->equals($dn2);
    }
428754
private void checkIdentity(SSLSession session, X509Certificate cert) throws CertificateException {
		if (session == null) {
			throw new CertificateException("No handshake session");
		}

		if (EndpointIdentificationAlgorithm.HTTPS == identityAlg) {
			String hostname = session.getPeerHost();
			APINameChecker.verifyAndThrow(hostname, cert);
		}
	}
248737
public void checkServerTrusted(X509Certificate[] chain, String authType)
                 throws CertificateException {
         try {
             pkixTrustManager.checkServerTrusted(chain, authType);
         } catch (CertificateException excep) {
             /*
              * Possibly pop up a dialog box asking whether to trust the
              * cert chain.
              */
         }
     }
1036395
private void verifyHostname(X509Certificate cer) {
        try {
            hostnameVerifier.verify(expectedCertCommonName, cer);
        } catch (SSLException e) {
            throw new SdkClientException("Certificate does not match expected common name: " + expectedCertCommonName, e);
        }
    }
415184
@Override
    public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {
        if (TraceComponent.isAnyTracingEnabled() && tc.isEntryEnabled())
            Tr.entry(tc, "checkServerTrusted");

        Map<String, Object> currentConnectionInfo = ThreadManager.getInstance().getOutboundConnectionInfoInternal();
        if (currentConnectionInfo != null) {
            if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
                Tr.debug(tc, "original peerHost: " + peerHost);
                Tr.debug(tc, "currentConnectionInfo: " + currentConnectionInfo);
            }
            peerHost = (String) currentConnectionInfo.get(Constants.CONNECTION_INFO_REMOTE_HOST);
            if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled())
                Tr.debug(tc, "current peerHost: " + peerHost);
        } else {
            currentConnectionInfo = extendedInfo;
            if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled())
                Tr.debug(tc, "currentConnectionInfo from extendedInfo: " + currentConnectionInfo);
        }

        extendedInfo = JSSEHelper.getInstance().getOutboundConnectionInfo();
        if (extendedInfo != null)
            peerHost = (String) extendedInfo.get(Constants.CONNECTION_INFO_REMOTE_HOST);

        // if we do not have host and port just go ahead and default it to unknown
        // to avoid null's
        if (peerHost == null || 0 == peerHost.length()) {
            peerHost = "unknown";
        }

        if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
            Tr.debug(tc, "Target host: " + peerHost);
            for (int j = 0; j < chain.length; j++) {
                Tr.debug(tc, "Certificate information:");
                Tr.debug(tc, "  Subject DN: " + chain[j].getSubjectDN());
                Tr.debug(tc, "  Issuer DN: " + chain[j].getIssuerDN());
                Tr.debug(tc, "  Serial number: " + chain[j].getSerialNumber());
            }
        }

        for (int i = 0; i < tm.length; i++) {
            if (tm[i] != null && tm[i] instanceof X509TrustManager) {
                // skip the default trust manager if configured to do so.
                try {
                    if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled())
                        Tr.debug(tc, "Delegating to X509TrustManager: " + tm[i].getClass().getName());
                    ((X509TrustManager) tm[i]).checkServerTrusted(chain, authType);
                } catch (CertificateException e) {
                    if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled())
                        Tr.debug(tc, "Certificate Exception occurred: " + e.getMessage());

                    // if the reason for the CertificateException is due to
                    // an expired date, don't accept it.
                    boolean dateValid = checkIfExpiredBeforeOrAfter(chain);
                    if (!dateValid) {
                        throw e;
                    }

                    try {
                        // If this is a client process then we may prompt the user to accept the signer certificate
                        if (!isServer) {
                            if (!autoAccept) {
                                // prompt user
                                if (userAcceptedPrompt(chain)) {
                                    if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled())
                                        Tr.debug(tc, "prompt user - adding certificate to the truststore.");
                                    setCertificateToTruststore(chain);
                                } else {
                                    printClientHandshakeError(config, tsFile, e, chain);
                                    throw e;
                                }

                            } else {
                                if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled())
                                    Tr.debug(tc, "autoacceptsigner - adding certificate to the truststore.");
                                setCertificateToTruststore(chain);
                            }
                        } else {
                            // IBM JDK will throw the exception in obfuscated code, get the cause
                            Exception excpt = e;
                            if (excpt.getClass().toString().startsWith("class com.ibm.jsse2")) {
                                excpt = (Exception) excpt.getCause();
                            }

                            // This the server print a message and rethrow the exception
                            FFDCFilter.processException(excpt, getClass().getName(), "checkServerTrusted", this, new Object[] { chain, authType });
                            printClientHandshakeError(config, tsFile, e, chain);
                            throw excpt;
                        }
                    } catch (Exception ex)
                    {
                        throw new CertificateException(ex.getMessage());
                    }
                }
            }
        }

        if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled())
            Tr.debug(tc, "Server is trusted by all X509TrustManagers.");
        if (TraceComponent.isAnyTracingEnabled() && tc.isEntryEnabled())
            Tr.exit(tc, "checkServerTrusted");
    }
1095863
protected static io.grpc.netty.NegotiationType of(final NegotiationType negotiationType) {
        switch (negotiationType) {
            case PLAINTEXT:
                return io.grpc.netty.NegotiationType.PLAINTEXT;
            case PLAINTEXT_UPGRADE:
                return io.grpc.netty.NegotiationType.PLAINTEXT_UPGRADE;
            case TLS:
                return io.grpc.netty.NegotiationType.TLS;
            default:
                throw new IllegalArgumentException("Unsupported NegotiationType: " + negotiationType);
        }
    }
20793
private void verifyNameChaining(X509Certificate cert)
        throws CertPathValidatorException
    {
        if (prevSubject != null) {

            String msg = "subject/issuer name chaining";
            if (debug != null)
                debug.println("---checking " + msg + "...");

            X500Principal currIssuer = cert.getIssuerX500Principal();

            // reject null or empty issuer DNs
            if (X500Name.asX500Name(currIssuer).isEmpty()) {
                throw new CertPathValidatorException
                    (msg + " check failed: " +
                     "empty/null issuer DN in certificate is invalid", null,
                     null, -1, PKIXReason.NAME_CHAINING);
            }

            if (!(currIssuer.equals(prevSubject))) {
                throw new CertPathValidatorException
                    (msg + " check failed", null, null, -1,
                     PKIXReason.NAME_CHAINING);
            }

            if (debug != null)
                debug.println(msg + " verified.");
        }
    }
1149358
private function _hasEqualPublicKey(Certificate $cert): bool
    {
        $kid1 = $this->_tbsCertificate->subjectPublicKeyInfo()->keyIdentifier();
        $kid2 = $cert->_tbsCertificate->subjectPublicKeyInfo()->keyIdentifier();
        return $kid1 == $kid2;
    }
793934
public static boolean verifyTimestampCertificates(TimeStampToken ts, KeyStore keystore, String provider) {
        if (provider == null)
            provider = "BC";
        try {
            for (Enumeration aliases = keystore.aliases(); aliases.hasMoreElements();) {
                try {
                    String alias = (String)aliases.nextElement();
                    if (!keystore.isCertificateEntry(alias))
                        continue;
                    X509Certificate certStoreX509 = (X509Certificate)keystore.getCertificate(alias);
                    SignerInformationVerifier siv = new JcaSimpleSignerInfoVerifierBuilder().setProvider(provider).build(certStoreX509);
                    ts.validate(siv);
                    return true;
                }
                catch (Exception ex) {
                }
            }
        }
        catch (Exception e) {
        }
        return false;
    }
522053
private boolean requireSigningPolicyCheck(GSIConstants.CertificateType certType) {

        return !ProxyCertificateUtil.isProxy(certType) && certType != GSIConstants.CertificateType.CA;
    }
336639
public X509Credential createCredential(X509Certificate[] certs, PrivateKey privateKey, int bits, int lifetime,
        GSIConstants.CertificateType certType) throws GeneralSecurityException {
        return createCredential(certs, privateKey, bits, lifetime, certType, (X509ExtensionSet) null, null);
    }