Re: How to perform SSL certificate validation ?

[Jason <security () brvenik com>]

paseidon76 () yahoo com wrote:
> If you are using Java then IAIK library provides excellent support
> for everything you need to do with certificate validation. 
> http://jcewww.iaik.tu-graz.ac.at/

Why wouldn't one use the native capabilities of Java?

I know less than a little about java but these _should_ be all you need...

import java.security.KeyStore;
import java.security.cert.Certificate;
import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.TrustManagerFactory;
import javax.net.ssl.SSLContext;

> In addition to building a chain to a trusted root CA (which will need
> a trusted root store and all the intermediate CA certificates) you
> may want to verify if the CA's cert was revoked by the root. This can
> be done by OCSP request/ reply.

yup

> -------------------------------------------------------------------------
>  Sponsored by: Watchfire
>
> Cross-Site Scripting (XSS) is one of the most common
> application-level attacks that hackers use to sneak into web
> applications today. This whitepaper will discuss how traditional CSS
> attacks are performed, how to secure your site against these attacks
> and check if your site is protected. Cross-Site Scripting Explained -
> Download this whitepaper today!
>
> https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008Vmr
>  
> --------------------------------------------------------------------------

-------------------------------------------------------------------------
Sponsored by: Watchfire

Cross-Site Scripting (XSS) is one of the most common application-level 
attacks that hackers use to sneak into web applications today. This 
whitepaper will discuss how traditional CSS attacks are performed, how to 
secure your site against these attacks and check if your site is protected. 
Cross-Site Scripting Explained - Download this whitepaper today!

https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008Vmr
--------------------------------------------------------------------------