ProxyCA { private HostnameVerifier createHostnameVerifier() { HostnameVerifier defaultHostnameVerifier = new DefaultHostnameVerifier(PublicSuffixMatcherLoader.getDefault()); return new HostnameVerifier() { @Override public boolean verify(String host, SSLSession sslSession) { try { Certificate[] certs = sslSession.getPeerCertificates(); if (certs.length == 2) { certs[0].verify(caKeyPair.getPublic()); LOG.debug("Verified certificate signed by RM CA, " + "skipping hostname verification"); return true; } } catch (SSLPeerUnverifiedException e) { return false; } catch (CertificateException | NoSuchAlgorithmException | InvalidKeyException | SignatureException | NoSuchProviderException e) { LOG.debug("Could not verify certificate with RM CA, " + "falling back to default hostname verification", e); } return defaultHostnameVerifier.verify(host, sslSession); } }; } ProxyCA(); void init(); void init(X509Certificate caCert, PrivateKey caPrivateKey); byte[] createChildKeyStore(ApplicationId appId, String ksPassword); byte[] getChildTrustStore(String password); String generateKeyStorePassword(); SSLContext createSSLContext(ApplicationId appId); HostnameVerifier getHostnameVerifier(); @VisibleForTesting X509Certificate getCaCert(); @VisibleForTesting KeyPair getCaKeyPair();  }
@Test public void testCreateHostnameVerifier() throws Exception { ProxyCA proxyCA = new ProxyCA(); proxyCA.init(); HostnameVerifier verifier = proxyCA.getHostnameVerifier(); SSLSession sslSession = Mockito.mock(SSLSession.class); Mockito.when(sslSession.getPeerCertificates()).thenReturn( KeyStoreTestUtil.bytesToKeyStore( proxyCA.createChildKeyStore( ApplicationId.newInstance(System.currentTimeMillis(), 1), "password"), "password").getCertificateChain("server")); Assert.assertTrue(verifier.verify("foo", sslSession)); }