public Certificate getMatchingCert ( TLSARecord tlsaRecord , List < Certificate > certs ) { for ( Certificate cert : certs ) { byte [ ] digestMatch = new byte [ 0 ] ; byte [ ] selectorData = new byte [ 0 ] ; try { // Get Selector Value switch ( tlsaRecord . getSelector ( ) ) { case TLSARecord . Selector . FULL_CERTIFICATE : selectorData = cert . getEncoded ( ) ; break ; case TLSARecord . Selector . SUBJECT_PUBLIC_KEY_INFO : selectorData = cert . getPublicKey ( ) . getEncoded ( ) ; break ; } // Validate Matching Type switch ( tlsaRecord . getMatchingType ( ) ) { case TLSARecord . MatchingType . EXACT : digestMatch = selectorData ; break ; case TLSARecord . MatchingType . SHA256 : digestMatch = MessageDigest . getInstance ( "SHA-256" ) . digest ( selectorData ) ; break ; case TLSARecord . MatchingType . SHA512 : digestMatch = MessageDigest . getInstance ( "SHA-512" ) . digest ( selectorData ) ; break ; } } catch ( Exception e ) { e . printStackTrace ( ) ; } if ( Arrays . equals ( digestMatch , tlsaRecord . getCertificateAssociationData ( ) ) ) { return cert ; } } return null ; }
Returns the certificate matching the TLSA record from the given certs