CertificateChainVerificationUtil { public static boolean verifyCertificateChain(X509Certificate theCertificate,Set<X509Certificate> chainCertificates) throws CertificateException, NoSuchAlgorithmException, NoSuchProviderException, InvalidAlgorithmParameterException { if (isSelfSigned(theCertificate)) { LOG.error("Certificate is self-signed - no trust chain can be established with provided truststore"); return false; } if (chainCertificates.size()<2) { LOG.error("One needs at least three certificates (including certificate used for signing to establish a trust chain. Please check that you included them"); return false; } HashSet<X509Certificate> rootCertificates = new HashSet<>(); HashSet<X509Certificate> subCertificates = new HashSet<>(); subCertificates.add(theCertificate); for (X509Certificate currentCertificate: chainCertificates) { if (CertificateChainVerificationUtil.isSelfSigned(currentCertificate)) { LOG.debug("Root: "+currentCertificate.getSubjectDN().getName()); rootCertificates.add(currentCertificate); } else { LOG.debug("Sub: "+currentCertificate.getSubjectDN().getName()); subCertificates.add(currentCertificate); } } X509CertSelector selector = new X509CertSelector(); selector.setCertificate(theCertificate); CertPathBuilder builder = CertPathBuilder.getInstance("PKIX", "BC"); HashSet<TrustAnchor> trustAnchors = new HashSet<>(); for (X509Certificate currentCertificate: rootCertificates) { trustAnchors.add(new TrustAnchor(currentCertificate,null)); } PKIXBuilderParameters builderParams = new PKIXBuilderParameters(trustAnchors,selector); CertStore subCertStore = CertStore.getInstance("Collection", new CollectionCertStoreParameters(subCertificates), "BC"); builderParams.addCertStore(subCertStore); try { PKIXCertPathBuilderResult result = (PKIXCertPathBuilderResult) builder.build(builderParams); return true; } catch (CertPathBuilderException e) { LOG.error("Exception: ",e); LOG.error("Cannot verify certification chain for "+theCertificate.getSubjectX500Principal()); } return false; }  static boolean verifyCertificateChain(X509Certificate theCertificate,Set<X509Certificate> chainCertificates);  }
@Disabled("We need to update the test certificate with certificate revocation lists (CRL)") @Test public void verifyCertificationChainPositive() throws IOException, UnrecoverableKeyException, KeyStoreException, NoSuchAlgorithmException, CertificateException, InvalidAlgorithmParameterException, NoSuchProviderException { Configuration conf = new Configuration(defaultConf); ClassLoader classLoader = getClass().getClassLoader(); String fileName="testsigningCA.pfx"; String fileNameKeyStore=classLoader.getResource(fileName).getFile(); Path file = new Path(fileNameKeyStore); HadoopKeyStoreManager hksm = new HadoopKeyStoreManager(conf); hksm.openKeyStore(file, "PKCS12", "changeit"); Key privateKey = hksm.getPrivateKey("testalias", "changeit"); assertNotNull(privateKey,"Private key could be loaded"); Certificate certificate = hksm.getCertificate("testalias"); assertNotNull(certificate,"Certificate for private key could be loaded"); classLoader = getClass().getClassLoader(); String fileNameTS="signingtruststore.jks"; String fileNameTrustStore=classLoader.getResource(fileNameTS).getFile(); Path fileTS = new Path(fileNameTrustStore); HadoopKeyStoreManager hksmTS = new HadoopKeyStoreManager(conf); hksmTS.openKeyStore(fileTS, "JKS", "changeit"); assertFalse(CertificateChainVerificationUtil.verifyCertificateChain((X509Certificate)certificate, hksmTS.getAllX509Certificates()), "Certification chain can be verified successfully"); }