Package org.microproxy.tls

Class CertificateAuthorityMitmManager

java.lang.Object
org.microproxy.tls.CertificateAuthorityMitmManager
All Implemented Interfaces:
MitmManager
public class CertificateAuthorityMitmManager extends Object implements MitmManager
A MitmManager that impersonates servers with certificates issued on demand by a CertificateAuthority. Each certificate covers the CONNECT host plus the DNS names and IP addresses in the real server's certificate. Certificates are cached per host in a bounded LRU cache and re-issued after a day, well before they expire.

  • Constructor Details

    • CertificateAuthorityMitmManager

      public CertificateAuthorityMitmManager(CertificateAuthority authority)
      Intercepts with authority, validating real servers against the JDK trust store.
      Parameters:
      authority - the CA used to issue interception certificates

    • CertificateAuthorityMitmManager

      public CertificateAuthorityMitmManager(CertificateAuthority authority, SSLContext upstreamContext)
      Creates an interception manager using this CA and upstream TLS context.
      Parameters:
      authority - the CA used to issue interception certificates
      upstreamContext - how real servers are validated, e.g. SslContexts.trustAll() to accept any server

    • CertificateAuthorityMitmManager

      public CertificateAuthorityMitmManager(CertificateAuthority authority, SSLContext upstreamContext, int maxCachedHosts)
      Creates an interception manager using this CA and upstream TLS context.
      Parameters:
      authority - the CA used to issue interception certificates
      upstreamContext - the TLS context used to validate real servers
      maxCachedHosts - how many hosts' certificates to keep (least recently used are dropped)

  • Method Details

    • keyMaterialFor

      public KeyMaterial keyMaterialFor(String host)
      A certificate for host issued by this manager's CA, with its private key: what the HTTP/3 listener of a reverse proxy presents (HttpProxyServerBootstrap.withHttp3(boolean)) when the proxy has no TLS listener of its own. Cached per host like the interception certificates, and re-issued after a day.
      Parameters:
      host - the DNS name or IP literal the certificate is for
      Returns:
      the certificate, followed by the CA's, and its key

    • cachedHostCount

      public int cachedHostCount()
      Returns number of hosts with a cached certificate.
      Returns:
      number of hosts with a cached certificate

    • getCertificateAuthority

      public CertificateAuthority getCertificateAuthority()
      Returns the authority used to issue interception certificates.
      Returns:
      the authority used to issue interception certificates

    • serverSslContext

      public SSLContext serverSslContext(String peerHost, int peerPort)
      Description copied from interface: MitmManager
      TLS configuration for the proxy's connection to the real server (proxy is TLS client).
      Specified by:
      serverSslContext in interface MitmManager
      Parameters:
      peerHost - the real server host name
      peerPort - the real server port
      Returns:
      the TLS context used towards the real server

    • clientSslContextFor

      public SSLContext clientSslContextFor(HttpRequest connectRequest, SSLSession serverSslSession)
      Description copied from interface: MitmManager
      TLS configuration presented to the client (proxy is TLS server), typically holding a certificate for the requested host signed by a CA the client trusts.
      Specified by:
      clientSslContextFor in interface MitmManager
      Parameters:
      connectRequest - the client's CONNECT request
      serverSslSession - the established session with the real server
      Returns:
      the TLS context presented to the client