Class S2SUtil

java.lang.Object
io.confluent.kafka.server.plugins.ssl.S2SUtil
public final class S2SUtil extends Object
Utility methods for service-to-service (S2S) / SPIFFE certificate handling that can be shared across components (trust managers, principal builders, request handlers, etc.) rather than being re-implemented in each one.

  • Method Details

    • extractSpiffeId

      public static Optional<String> extractSpiffeId(X509Certificate[] chain)
      Extracts the SPIFFE ID from the leaf certificate of the chain, if present.
      Parameters:
      chain - the certificate chain (leaf first)
      Returns:
      the SPIFFE ID URI if the leaf certificate carries one, otherwise empty
      See Also:

    • extractSpiffeId

      public static Optional<String> extractSpiffeId(X509Certificate certificate)
      Extracts the SPIFFE ID from a single certificate, if present.

      Following the SPIFFE X.509-SVID specification, a certificate is treated as a SPIFFE certificate only when it carries exactly one URI-type Subject Alternative Name and that URI is a valid SPIFFE ID. Certificates with no URI SAN, multiple URI SANs, or a URI SAN that is not a valid SPIFFE ID are not considered SPIFFE certificates.

      Parameters:
      certificate - the certificate to inspect
      Returns:
      the SPIFFE ID URI if the certificate carries exactly one valid one, otherwise empty
      See Also: