Validate X.509 certificate against CA in Java

Question

Lets say I have something like this (client side code):

TrustManager[] trustAllCerts = new TrustManager[]{
    new X509TrustManager() {

        @Override
           


        

Answer 1

This code is completely functional

This code is completely dysfunctional. It is completely insecure, as well as not even conforming to its own specification. There is rarely a need to supply your own TrustManager, the default one works really well.

All you need to do is ensure that the CA certificate you have is present in your truststore, and then set the system property javax.net.ssl.trustStore to point to it if it isn't the default Java truststore file. You don't need to write any code at all beyond possibly System.setProperty(), if you don't set it via the command line -D option.

EDIT Your 'solution' certainly won't work in general. It assumes that every certificate in the chain is signed by your certificate. That can only be true for chains of length 1, or length 2 if the signing certificate = your certificate.