Class CertificateUtil

java.lang.Object
com.hypixel.hytale.server.core.auth.CertificateUtil
public class CertificateUtil extends Object
Utility methods for X.509 certificate handling and validation.

  • Constructor Details

    • CertificateUtil

      public CertificateUtil()

  • Method Details

    • computeCertificateFingerprint

      @Nullable public static String computeCertificateFingerprint(@Nonnull X509Certificate certificate)
      Computes the SHA-256 fingerprint of an X.509 certificate in base64url format (RFC 7515). This format is used in the JWT cnf.x5t#S256 claim for certificate binding.
      Parameters:
      certificate - The X.509 certificate
      Returns:
      The base64url-encoded SHA-256 fingerprint, or null if computation fails

    • validateCertificateBinding

      public static boolean validateCertificateBinding(@Nullable String jwtFingerprint, @Nullable X509Certificate clientCert)
      Validates that a JWT's certificate binding (cnf.x5t#S256 claim) matches the actual client certificate. Per RFC 8705 - OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens.
      Parameters:
      jwtFingerprint - The fingerprint from the JWT cnf.x5t#S256 claim
      clientCert - The actual client certificate from the mTLS connection
      Returns:
      true if fingerprints match, false otherwise

    • timingSafeEquals

      public static boolean timingSafeEquals(String a, String b)
      Performs a timing-safe string comparison to prevent timing attacks. Unlike String.equals(), this always compares all characters regardless of where differences occur.
      Parameters:
      a - First string
      b - Second string
      Returns:
      true if strings are equal, false otherwise