Class SecurityFrameworkUtil

java.lang.Object
org.jetbrains.nativecerts.mac.SecurityFrameworkUtil
public class SecurityFrameworkUtil extends Object
Get trusted certificates stored in corresponding keychains via Security frameworks APIs. for the other implementations, see root_cgo_darwin.go in Go and trust_store_mac.cc in Chromium

In the future it would be better to implement X509TrustManager on SecTrustEvaluateWithError instead of getting the trust chain manually. It's not yet investigated whether it is possible at all to integrate it into the SSL framework of JVM.

Native objects are opaque pointers (MemorySegment); see SecurityFramework and CoreFoundationExt for the bindings and CoreFoundationExtUtil for type-checked accessors.

  • Method Details

    • getTrustedRoots

      public static List<X509Certificate> getTrustedRoots()
      Get trusted roots installed on admin and user level (domain)

    • getSystemTrustedRoots

      public static List<X509Certificate> getSystemTrustedRoots()
      Get trusted roots backed into macOS (system domain)

    • getTrustedCertificates

      @NotNull public static @NotNull List<X509Certificate> getTrustedCertificates(boolean systemDomain)
      Enumerates certificates via SecItemCopyMatching.
      Parameters:
      systemDomain - true: certificates from the immutable system roots keychain (all implicitly trusted); false: certificates from the default keychain search list (login + System keychains), filtered by isTrustedRoot(MemorySegment)

    • isTrustedRoot

      public static boolean isTrustedRoot(@NotNull @NotNull MemorySegment certificateRef)
      Decides whether a certificate from the user/admin keychains is a trusted root for our purposes: either it has explicit trust settings that we understand and that say "trust as root for SSL", or it has no trust settings and the Security framework validates it against the trusted roots.
      Parameters:
      certificateRef - SecCertificateRef (borrowed)