net.shibboleth.metadata.validate.x509

Class X509RSAKeyLengthValidator

java.lang.Object

net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

net.shibboleth.utilities.java.support.component.AbstractIdentifiedInitializableComponent

net.shibboleth.utilities.java.support.component.AbstractIdentifiableInitializableComponent

net.shibboleth.metadata.validate.BaseValidator

net.shibboleth.metadata.validate.x509.AbstractX509Validator

net.shibboleth.metadata.validate.x509.X509RSAKeyLengthValidator

All Implemented Interfaces:

Validator<X509Certificate>, net.shibboleth.utilities.java.support.component.Component, net.shibboleth.utilities.java.support.component.DestructableComponent, net.shibboleth.utilities.java.support.component.IdentifiableComponent, net.shibboleth.utilities.java.support.component.IdentifiedComponent, net.shibboleth.utilities.java.support.component.InitializableComponent

@ThreadSafe
public class X509RSAKeyLengthValidator
extends AbstractX509Validator

Validator class to check RSA key lengths in X.509 certificates. An instance of the class can be configured to have both a warning boundary and an error boundary. The default is to give an error for any key smaller than 2048 bits, with no provision for warnings. This seems the right long term default. During the transition to 2048-bit keys, it may be appropriate to set the warning boundary to 2048 bits and the error boundary to 1024 bits.

Nested Class Summary

Nested classes/interfaces inherited from interface net.shibboleth.metadata.validate.Validator

Validator.Action

Field Summary

Fields

Modifier and Type	Field and Description
private int	errorBoundary The RSA key length below which an error should result.
private int	warningBoundary The RSA key length below which a warning should result.

Constructor Summary

Constructors

Constructor and Description
X509RSAKeyLengthValidator() Constructor.

Method Summary

Methods

Modifier and Type	Method and Description
void	doValidate(X509Certificate cert, Item<?> item, String stageId) Apply the validator to the object in the given Item context.
int	getErrorBoundary() Get the RSA key length below which an error will result.
int	getWarningBoundary() Get the RSA key length below which a warning will result.
void	setErrorBoundary(int length) Set the RSA key length below which an error should result.
void	setWarningBoundary(int length) Set the RSA key length below which a warning should result.

Methods inherited from class net.shibboleth.metadata.validate.x509.AbstractX509Validator

validate

Methods inherited from class net.shibboleth.metadata.validate.BaseValidator

addError, addStatus, addWarning

Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractIdentifiableInitializableComponent

setId

Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractIdentifiedInitializableComponent

doInitialize, getId

Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

destroy, doDestroy, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.utilities.java.support.component.DestructableComponent

destroy, isDestroyed

Methods inherited from interface net.shibboleth.utilities.java.support.component.IdentifiableComponent

setId

Methods inherited from interface net.shibboleth.utilities.java.support.component.IdentifiedComponent

getId

Methods inherited from interface net.shibboleth.utilities.java.support.component.InitializableComponent

initialize, isInitialized

Field Detail

errorBoundary

private int errorBoundary

The RSA key length below which an error should result. Default: 2048.

warningBoundary

private int warningBoundary

The RSA key length below which a warning should result. Default: 0 (disabled).

Constructor Detail

X509RSAKeyLengthValidator

public X509RSAKeyLengthValidator()

Constructor.

Method Detail

getErrorBoundary

public int getErrorBoundary()

Get the RSA key length below which an error will result.

Returns:

the RSA key length below which an error will result.

setErrorBoundary

public void setErrorBoundary(int length)

Set the RSA key length below which an error should result.

Parameters:

length - the RSA key length below which an error should result

getWarningBoundary

public int getWarningBoundary()

Get the RSA key length below which a warning will result.

Returns:

the RSA key length below which a warning will result.

setWarningBoundary

public void setWarningBoundary(int length)

Set the RSA key length below which a warning should result.

Parameters:

length - the RSA key length below which a warning should result

doValidate

public void doValidate(@Nonnull
              X509Certificate cert,
              @Nonnull
              Item<?> item,
              @Nonnull
              String stageId)

Apply the validator to the object in the given Item context. The validator influences future processing by adding item metadata to the Item.

Specified by:

doValidate in class AbstractX509Validator

Parameters:

cert - the certificate to be validated

item - the Item context for the validation

stageId - the identifier for the stage that is requesting the validation, for inclusion in status metadata