package org.jscep.client.verification;

import java.security.MessageDigest;
import java.security.cert.CertificateEncodingException;
import java.security.cert.X509Certificate;
import java.util.Arrays;

import org.apache.commons.lang.ArrayUtils;

/**
 * This <tt>CertificateVerifier</tt> uses a pre-provisioned message digest to
 * verify the certificate.
 * <p>
 * Typically, we expect the hash to be provided out of band, often as a
 * hexadecimal string.
 * 
 * <pre>
 * MessageDigest digest = MessageDigest.getInstance(&quot;MD5&quot;);
 * byte[] expected = Hex.decode(&quot;835f179febba96f32a47610a679de400&quot;.toCharArray());
 * 
 * new MessageDigestCertificateVerifier(digest, expected);
 * </pre>
 */
public final class MessageDigestCertificateVerifier implements
        CertificateVerifier {
    /**
     * The digest to use.
     */
    private final MessageDigest digest;
    /**
     * The expected digest outcome.
     */
    private final byte[] expected;

    /**
     * Creates a new instance with a digest algorithm, and the expected digest
     * result.
     * 
     * @param digest
     *            the digest algorithm to for verification.
     * @param expected
     *            the digest result
     */
    public MessageDigestCertificateVerifier(final MessageDigest digest,
            final byte[] expected) {
        this.digest = digest;
        this.expected = ArrayUtils.clone(expected);
    }

    /**
     * {@inheritDoc}
     */
    @Override
    public boolean verify(final X509Certificate cert) {
        byte[] actual;
        try {
            digest.reset();
            actual = digest.digest(cert.getEncoded());
            if(Arrays.equals(actual, expected))
            {
                return true;
            }

            // the following code is for backwards compatibility
            actual = digest.digest(cert.getTBSCertificate());
        } catch (CertificateEncodingException e) {
            return false;
        }

        return Arrays.equals(actual, expected);
    }
}

@@ -236,16 +236,73 @@
 ayUtils;
+%0Aimport org.slf4j.Logger;%0Aimport org.slf4j.LoggerFactory;
 %0A%0A/**%0A *
@@ -852,16 +852,136 @@
 ifier %7B%0A
+    private static final Logger LOGGER = LoggerFactory%0A            .getLogger(MessageDigestCertificateVerifier.class);%0A%0A
     /**%0A
@@ -1709,31 +1709,8 @@
 ) %7B%0A
-        byte%5B%5D actual;%0A
     
@@ -1750,32 +1750,39 @@
 t();%0A           
+ byte%5B%5D
  actual = digest
@@ -2038,24 +2038,368 @@
 ificate());%0A
+            if(Arrays.equals(actual, expected))%0A            %7B%0A                LOGGER.warn(%22MessageDigest over the Certificate.tbsCertificate is configured, %22%0A                        + %22but it should be over the DER encoded Certificate%22);%0A                return true;%0A            %7D else%0A            %7B%0A                return false;%0A            %7D%0A
         %7D ca
@@ -2455,32 +2455,32 @@
   return false;%0A
+
         %7D%0A%0A     
@@ -2476,57 +2476,8 @@
    %7D
-%0A%0A        return Arrays.equals(actual, expected);
 %0A   

Add log entry in level WARN if the fingerprint of certificate is computed over the Certificate.tbsCertificate instead of the DER encoded Certificate.