title: Validate X.509 certificate against CA in Java
body: <p>Lets say I have something like this (client side code):</p>
  
  <pre><code>TrustManager[] trustAllCerts = new TrustManager[]{
      new X509TrustManager() {
  
          @Override
          public java.security.cert.X509Certificate[] getAcceptedIssuers() {
              return null;
          }
  
          @Override
          public void checkClientTrusted(
                  java.security.cert.X509Certificate[] certs, String authType) {
          }
  
          @Override
          public void checkServerTrusted(
                  java.security.cert.X509Certificate[] certs, String authType) {
          }
      }
  };
  
  SSLContext sslc = SSLContext.getInstance("TLS");
  sslc.init(null, trustAllCerts, null);
  
  SocketFactory sf = sslc.getSocketFactory();
  SSLSocket s = (SSLSocket) sf.createSocket("127.0.0.1", 9124);
  </code></pre>
  
  <p>This code is complete functional, but I really can not figure out, how to validate server's certificate against one concrete CA certificate that I have available in pem file. </p>
  
  <p>All certificates are signed by my self-signed CA, and it is the CA I need to validate against (only against this one).</p>
  
  <p>Every answer is appreciated. </p>
  
  <p>EDIT:</p>
  
  <p>In response to <strong>jglouie</strong> (thank you very much this way - can not vote up your answer).</p>
  
  <p>I founded the solution:</p>
  
  <pre><code>new X509TrustManager() {
  
          @Override
          public java.security.cert.X509Certificate[] getAcceptedIssuers() {
              return null;
          }
  
          @Override
          public void checkClientTrusted(
                  java.security.cert.X509Certificate[] certs, String authType) {
          }
  
          @Override
          public void checkServerTrusted(
                  java.security.cert.X509Certificate[] certs, String authType)
                  throws CertificateException {
              InputStream inStream = null;
              try {
                  // Loading the CA cert
                  URL u = getClass().getResource("tcp/cacert.pem");
                  inStream = new FileInputStream(u.getFile());
                  CertificateFactory cf = CertificateFactory.getInstance("X.509");
                  X509Certificate ca = (X509Certificate) cf.generateCertificate(inStream);
                  inStream.close();
  
                  for (X509Certificate cert : certs) {
                      // Verifing by public key
                      cert.verify(ca.getPublicKey());
                  }
              } catch (Exception ex) {
                  Logger.getLogger(Client.class.getName()).log(Level.SEVERE, null, ex);
              } finally {
                  try {
                      inStream.close();
                  } catch (IOException ex) {
                      Logger.getLogger(Client.class.getName()).log(Level.SEVERE, null, ex);
                  }
              }
  
          }
      }
  };
  </code></pre>