package com.pivotal.ssl;

import java.io.ByteArrayInputStream;
import java.io.DataInputStream;
import java.io.File;
import java.io.FileInputStream;
import java.io.InputStream;
import java.security.KeyFactory;
import java.security.KeyStore;
import java.security.PublicKey;
import java.security.cert.Certificate;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;
import java.security.spec.X509EncodedKeySpec;
import java.util.Enumeration;

/**
 * Hello world!
 *
 */
public class App {
    public static void main( String[] args ) throws Exception {
        CertificateFactory cf = CertificateFactory.getInstance("X.509");
        X509Certificate cert = (X509Certificate)cf.generateCertificate(App.class.getResourceAsStream("/cert.pem"));
        X509Certificate caCert = (X509Certificate)cf.generateCertificate(App.class.getResourceAsStream("/DigiCertCA.crt"));
        X509Certificate self = (X509Certificate)cf.generateCertificate(App.class.getResourceAsStream("/self/server.crt"));

        //yes, we can validate
        cert.verify(caCert.getPublicKey());

        //normal cacerts
        File file = new File("src/main/resources/cacerts");
        verifyStoreCerts("digiSignedCertOnDefaultCACERTS", file, cert);

        //digicertCA imported
        file = new File("src/main/resources/cacerts_and_digicert");
        verifyStoreCerts("digiSignedCertWithCAImported", file, cert);

        //the cert itself import
        file = new File("src/main/resources/cacerts_and_cert_installed");
        verifyStoreCerts("digiSignedCertWithCertImported", file, cert);

        //the self signed itself import
        file = new File("src/main/resources/cacerts_and_self_signed");
        verifyStoreCerts("SelfSignedCertWithCertImported", file, self);
    }


    public static boolean verifyStoreCerts(String name, File file, X509Certificate cert) throws Exception {
        InputStream is = new FileInputStream(file);
        KeyStore keystore = KeyStore.getInstance(KeyStore.getDefaultType());
        String password = "changeit";
        keystore.load(is, password.toCharArray());

        Enumeration enumeration = keystore.aliases();
        boolean validated = false;
        while(enumeration.hasMoreElements()) {
            String alias = (String)enumeration.nextElement();
            //System.out.println("alias name: " + alias);
            Certificate certificate = keystore.getCertificate(alias);
            //System.out.println(certificate.toString());
            try {
                cert.verify(certificate.getPublicKey());
                validated = true;
                System.out.println("VERIFIED["+name+"] with alias:"+alias);
                break;
            } catch (Exception x) {
                //System.err.println("Not verified[\"+name+\"] with alias:"+alias+" \n"+x.getMessage());
            }
        }
        return validated;
    }


}

@@ -34,64 +34,111 @@
 java
-.io.ByteArrayInputStream;%0Aimport java.io.DataInputStream
+x.net.ssl.TrustManager;%0Aimport javax.net.ssl.TrustManagerFactory;%0Aimport javax.net.ssl.X509TrustManager
 ;%0Aim
@@ -240,23 +240,21 @@
 rity.Key
-Factory
+Store
 ;%0Aimport
@@ -272,48 +272,24 @@
 ity.
-KeyStore;%0Aimport java.security.PublicKey
+cert.Certificate
 ;%0Aim
@@ -315,32 +315,41 @@
 cert.Certificate
+Exception
 ;%0Aimport java.se
@@ -427,54 +427,8 @@
 te;%0A
-import java.security.spec.X509EncodedKeySpec;%0A
 impo
@@ -1875,32 +1875,156 @@
 ows Exception %7B%0A
+        TrustManagerFactory tmf = TrustManagerFactory%0A            .getInstance(TrustManagerFactory.getDefaultAlgorithm());%0A%0A
         InputStr
@@ -2222,24 +2222,54 @@
 rArray());%0A%0A
+        tmf.init(keystore);%0A%0A%0A
         Enum
@@ -2326,16 +2326,19 @@
 boolean 
+key
 validate
@@ -2348,16 +2348,55 @@
  false;%0A
+        boolean servertrusted = false;%0A
         
@@ -2773,16 +2773,19 @@
         
+key
 validate
@@ -3058,24 +3058,25 @@
       %7D%0A
+%0A
         
 return v
@@ -3071,21 +3071,464 @@
     
-return valida
+for (TrustManager tm : tmf.getTrustManagers()) %7B%0A            X509TrustManager xtm = (X509TrustManager)tm;%0A            try %7B%0A                xtm.checkServerTrusted(new X509Certificate%5B%5D %7Bcert%7D, %22RSA%22);%0A                servertrusted = true;%0A                System.out.println(%22VERIFIED%5B%22+name+%22%5D is a trusted cert in keystore:%22+ file.getName());%0A            %7D catch (CertificateException e) %7B%0A%0A            %7D%0A        %7D%0A        return keyvalidated & servertrus
 ted;
@@ -3536,10 +3536,12 @@
     %7D%0A%0A%0A
+%0A%0A
 %7D%0A

Add checkServerTrusted