okhttp3.tls

Class HandshakeCertificates.Builder

java.lang.Object

okhttp3.tls.HandshakeCertificates.Builder

Enclosing class:

HandshakeCertificates

public static final class HandshakeCertificates.Builder
extends Object

Constructor Summary

Constructors

Constructor and Description
Builder()

Method Summary

Modifier and Type	Method and Description
HandshakeCertificates.Builder	addPlatformTrustedCertificates() Add all of the host platform's trusted root certificates.
HandshakeCertificates.Builder	addTrustedCertificate(X509Certificate certificate) Add a trusted root certificate to use when authenticating a peer.
HandshakeCertificates	build()
HandshakeCertificates.Builder	heldCertificate(HeldCertificate heldCertificate, X509Certificate... intermediates) Configure the certificate chain to use when being authenticated.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

Builder

public Builder()

Method Detail

heldCertificate

public HandshakeCertificates.Builder heldCertificate(HeldCertificate heldCertificate,
                                                     X509Certificate... intermediates)

Configure the certificate chain to use when being authenticated. The first certificate is the held certificate, further certificates are included in the handshake so the peer can build a trusted path to a trusted root certificate.

The chain should include all intermediate certificates but does not need the root certificate that we expect to be known by the remote peer. The peer already has that certificate so transmitting it is unnecessary.

addTrustedCertificate

public HandshakeCertificates.Builder addTrustedCertificate(X509Certificate certificate)

Add a trusted root certificate to use when authenticating a peer. Peers must provide a chain of certificates whose root is one of these.

addPlatformTrustedCertificates

public HandshakeCertificates.Builder addPlatformTrustedCertificates()

Add all of the host platform's trusted root certificates. This set varies by platform (Android vs. Java), by platform release (Android 4.4 vs. Android 9), and with user customizations.

Most TLS clients that connect to hosts on the public Internet should call this method. Otherwise it is necessary to manually prepare a comprehensive set of trusted roots.

If the host platform is compromised or misconfigured this may contain untrustworthy root certificates. Applications that connect to a known set of servers may be able to mitigate this problem with certificate pinning.

build

public HandshakeCertificates build()