android 证书管理,[转]Android 根证书管理与证书验证（3）

真正执行证书合法性验证的还不是 NetworkSecurityTrustManager，而是 TrustManagerImpl(位于 external/conscrypt/src/platform/java/org/conscrypt/TrustManagerImpl.java)，由 NetworkSecurityTrustManager 的定义(位于frameworks/base/core/java/android/security/net/config/NetworkSecurityTrustManager.java)不难看出这一点：

public NetworkSecurityTrustManager(NetworkSecurityConfig config) {

if (config == null) {

throw new NullPointerException("config must not be null");

}

mNetworkSecurityConfig = config;

try {

TrustedCertificateStoreAdapter certStore = new TrustedCertificateStoreAdapter(config);

// Provide an empty KeyStore since TrustManagerImpl doesn't support null KeyStores.

// TrustManagerImpl will use certStore to lookup certificates.

KeyStore store = KeyStore.getInstance(KeyStore.getDefaultType());

store.load(null);

mDelegate = new TrustManagerImpl(store, null, certStore);

} catch (GeneralSecurityException | IOException e) {

throw new RuntimeException(e);

}

}

. . . . . .

@Override

public void checkServerTrusted(X509Certificate[] certs, String authType)

throws CertificateException {

checkServerTrusted(certs, authType, (String) null);

}

@Override

public void checkServerTrusted(X509Certificate[] certs, String authType, Socket socket)

throws CertificateException {

List trustedChain =

mDelegate.getTrustedChainForServer(certs, authType, socket);

checkPins(trustedChain);

}

@Override

public void checkServerTrusted(X509Certificate[] certs, String authType, SSLEngine engine)

throws CertificateException {

List trustedChain =

mDelegate.getTrustedChainForServer(certs, authType, engine);

checkPins(trustedChain);

}

/**

* Hostname aware version of {@link #checkServerTrusted(X509Certificate[], String)}.

* This interface is used by conscrypt and android.net.http.X509TrustManagerExtensions do not

* modify without modifying those callers.

*/

public List checkServerTrusted(X509Certificate[] certs, String authType,

String host) throws CertificateException {

List trustedChain = mDelegate.checkServerTrusted(certs, authType, host);

checkPins(trustedChain);

return trustedChain;

}

private void checkPins(List chain) throws CertificateException {

PinSet pinSet = mNetworkSecurityConfig.getPins();

if (pinSet.pins.isEmpty()

|| System.currentTimeMillis() > pinSet.expirationTime

|| !isPinningEnforced(chain)) {

return;

}

Set pinAlgorithms = pinSet.getPinAlgorithms();

Map digestMap = new ArrayMap(

pinAlgorithms.size());

for (int i = chain.size() - 1; i >= 0 ; i--) {

X509Certificate cert = chain.get(i);

byte[] encodedSPKI = cert.getPublicKey().getEncoded();

for (String algorithm : pinAlgorithms) {

MessageDigest md = digestMap.get(algorithm);

if (md == null) {

try {

md = MessageDigest.getInstance(algorithm);

} catch (GeneralSecurityException e) {

throw new RuntimeException(e);

<