Using CN: Common Name and OU: Organization Unit for Certificate Validation

[lxjoyner]

I have a need to use CN and OU in certificate validation using spring. Currently using spring to connect using SSL but need to add certificate validation to only allow certificates with specific CN and OU. Can I use the one in this comment below and just add the OU. If so what is the pattern syntax for parsing the OU from the certificate.

AdditionalCertificateValidationsAspect.java
Added CN validator based on AOP

[Hakky54]

Hi @lxjoyner

You can reuse the code snippet which is present in the AdditionalCertificateValidationsAspect.java

I would suggest the following refactored snippet:

public class AdditionalCertificateValidationsAspect {

    private static final Pattern COMMON_NAME_PATTERN = Pattern.compile("(?<=CN=)(.*?)(?=,)");
    private static final Pattern ORGANISATION_UNIT_PATTERN = Pattern.compile("(?<=OU=)(.*?)(?=,)");

    // other methods can be found in the original source code

    private Optional<String> getCommonName(String subjectDistinguishedName) {
        return getSubfield(COMMON_NAME_PATTERN, subjectDistinguishedName);
    }

    private Optional<String> getOrganizationUnit(String subjectDistinguishedName) {
        return getSubfield(ORGANISATION_UNIT_PATTERN, subjectDistinguishedName);
    }

    private Optional<String> getSubfield(Pattern pattern, String subjectDistinguishedName) {
        var matcher = pattern.matcher(subjectDistinguishedName);

        if (matcher.find()) {
            return Optional.of(matcher.group());
        } else {
            return Optional.empty();
        }
    }

}

[Hakky54]

@lxjoyner Did it work for you?