SSLSupport.java 文件源码

private static TrustManager[] loadTrustManager(final String trustStoreProvider,
                                               final String trustStorePath,
                                               final String trustStorePassword,
                                               final boolean trustAll,
                                               final String crlPath) throws Exception {
   if (trustAll) {
      //This is useful for testing but not should be used outside of that purpose
      return InsecureTrustManagerFactory.INSTANCE.getTrustManagers();
   } else if (trustStorePath == null && (trustStoreProvider == null || !"PKCS11".equals(trustStoreProvider.toUpperCase()))) {
      return null;
   } else {
      TrustManagerFactory trustMgrFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
      KeyStore trustStore = SSLSupport.loadKeystore(trustStoreProvider, trustStorePath, trustStorePassword);
      boolean ocsp = Boolean.valueOf(Security.getProperty("ocsp.enable"));

      boolean initialized = false;
      if ((ocsp || crlPath != null) && TrustManagerFactory.getDefaultAlgorithm().equalsIgnoreCase("PKIX")) {
         PKIXBuilderParameters pkixParams = new PKIXBuilderParameters(trustStore, new X509CertSelector());
         if (crlPath != null) {
            pkixParams.setRevocationEnabled(true);
            Collection<? extends CRL> crlList = loadCRL(crlPath);
            if (crlList != null) {
               pkixParams.addCertStore(CertStore.getInstance("Collection", new CollectionCertStoreParameters(crlList)));
            }
         }
         trustMgrFactory.init(new CertPathTrustManagerParameters(pkixParams));
         initialized = true;
      }

      if (!initialized) {
         trustMgrFactory.init(trustStore);
      }

      return trustMgrFactory.getTrustManagers();

   }
}