envoy.api.v2.auth

Class Cert.CertificateValidationContext.Builder

java.lang.Object

com.google.protobuf.AbstractMessageLite.Builder

com.google.protobuf.AbstractMessage.Builder<BuilderType>

com.google.protobuf.GeneratedMessageV3.Builder<Cert.CertificateValidationContext.Builder>

envoy.api.v2.auth.Cert.CertificateValidationContext.Builder

All Implemented Interfaces:

com.google.protobuf.Message.Builder, com.google.protobuf.MessageLite.Builder, com.google.protobuf.MessageLiteOrBuilder, com.google.protobuf.MessageOrBuilder, Cert.CertificateValidationContextOrBuilder, Cloneable

Enclosing class:

Cert.CertificateValidationContext

public static final class Cert.CertificateValidationContext.Builder
extends com.google.protobuf.GeneratedMessageV3.Builder<Cert.CertificateValidationContext.Builder>
implements Cert.CertificateValidationContextOrBuilder

Protobuf type envoy.api.v2.auth.CertificateValidationContext

Method Summary

Modifier and Type	Method and Description
Cert.CertificateValidationContext.Builder	addAllVerifyCertificateHash(Iterable<String> values) If specified, Envoy will verify (pin) the hex-encoded SHA-256 fingerprint of the presented certificate.
Cert.CertificateValidationContext.Builder	addAllVerifySpkiSha256(Iterable<String> values) If specified, Envoy will verify (pin) base64-encoded SHA-256 hash of the Subject Public Key Information (SPKI) of the presented certificate.
Cert.CertificateValidationContext.Builder	addAllVerifySubjectAltName(Iterable<String> values) An optional list of subject alternative names.
Cert.CertificateValidationContext.Builder	addRepeatedField(com.google.protobuf.Descriptors.FieldDescriptor field, Object value)
Cert.CertificateValidationContext.Builder	addVerifyCertificateHash(String value) If specified, Envoy will verify (pin) the hex-encoded SHA-256 fingerprint of the presented certificate.
Cert.CertificateValidationContext.Builder	addVerifyCertificateHashBytes(com.google.protobuf.ByteString value) If specified, Envoy will verify (pin) the hex-encoded SHA-256 fingerprint of the presented certificate.
Cert.CertificateValidationContext.Builder	addVerifySpkiSha256(String value) If specified, Envoy will verify (pin) base64-encoded SHA-256 hash of the Subject Public Key Information (SPKI) of the presented certificate.
Cert.CertificateValidationContext.Builder	addVerifySpkiSha256Bytes(com.google.protobuf.ByteString value) If specified, Envoy will verify (pin) base64-encoded SHA-256 hash of the Subject Public Key Information (SPKI) of the presented certificate.
Cert.CertificateValidationContext.Builder	addVerifySubjectAltName(String value) An optional list of subject alternative names.
Cert.CertificateValidationContext.Builder	addVerifySubjectAltNameBytes(com.google.protobuf.ByteString value) An optional list of subject alternative names.
Cert.CertificateValidationContext	build()
Cert.CertificateValidationContext	buildPartial()
Cert.CertificateValidationContext.Builder	clear()
Cert.CertificateValidationContext.Builder	clearCrl() An optional `certificate revocation list <http://https://en.wikipedia.org/wiki/Certificate_revocation_list>`_ (in PEM format).
Cert.CertificateValidationContext.Builder	clearField(com.google.protobuf.Descriptors.FieldDescriptor field)
Cert.CertificateValidationContext.Builder	clearOneof(com.google.protobuf.Descriptors.OneofDescriptor oneof)
Cert.CertificateValidationContext.Builder	clearRequireOcspStaple() [#not-implemented-hide:] Must present a signed time-stamped OCSP response.
Cert.CertificateValidationContext.Builder	clearRequireSignedCertificateTimestamp() [#not-implemented-hide:] Must present signed certificate time-stamp.
Cert.CertificateValidationContext.Builder	clearTrustedCa() TLS certificate data containing certificate authority certificates to use in verifying a presented peer certificate (e.g. server certificate for clusters or client certificate for listeners).
Cert.CertificateValidationContext.Builder	clearVerifyCertificateHash() If specified, Envoy will verify (pin) the hex-encoded SHA-256 fingerprint of the presented certificate.
Cert.CertificateValidationContext.Builder	clearVerifySpkiSha256() If specified, Envoy will verify (pin) base64-encoded SHA-256 hash of the Subject Public Key Information (SPKI) of the presented certificate.
Cert.CertificateValidationContext.Builder	clearVerifySubjectAltName() An optional list of subject alternative names.
Cert.CertificateValidationContext.Builder	clone()
Base.DataSource	getCrl() An optional `certificate revocation list <http://https://en.wikipedia.org/wiki/Certificate_revocation_list>`_ (in PEM format).
Base.DataSource.Builder	getCrlBuilder() An optional `certificate revocation list <http://https://en.wikipedia.org/wiki/Certificate_revocation_list>`_ (in PEM format).
Base.DataSourceOrBuilder	getCrlOrBuilder() An optional `certificate revocation list <http://https://en.wikipedia.org/wiki/Certificate_revocation_list>`_ (in PEM format).
Cert.CertificateValidationContext	getDefaultInstanceForType()
static com.google.protobuf.Descriptors.Descriptor	getDescriptor()
com.google.protobuf.Descriptors.Descriptor	getDescriptorForType()
com.google.protobuf.BoolValue	getRequireOcspStaple() [#not-implemented-hide:] Must present a signed time-stamped OCSP response.
com.google.protobuf.BoolValue.Builder	getRequireOcspStapleBuilder() [#not-implemented-hide:] Must present a signed time-stamped OCSP response.
com.google.protobuf.BoolValueOrBuilder	getRequireOcspStapleOrBuilder() [#not-implemented-hide:] Must present a signed time-stamped OCSP response.
com.google.protobuf.BoolValue	getRequireSignedCertificateTimestamp() [#not-implemented-hide:] Must present signed certificate time-stamp.
com.google.protobuf.BoolValue.Builder	getRequireSignedCertificateTimestampBuilder() [#not-implemented-hide:] Must present signed certificate time-stamp.
com.google.protobuf.BoolValueOrBuilder	getRequireSignedCertificateTimestampOrBuilder() [#not-implemented-hide:] Must present signed certificate time-stamp.
Base.DataSource	getTrustedCa() TLS certificate data containing certificate authority certificates to use in verifying a presented peer certificate (e.g. server certificate for clusters or client certificate for listeners).
Base.DataSource.Builder	getTrustedCaBuilder() TLS certificate data containing certificate authority certificates to use in verifying a presented peer certificate (e.g. server certificate for clusters or client certificate for listeners).
Base.DataSourceOrBuilder	getTrustedCaOrBuilder() TLS certificate data containing certificate authority certificates to use in verifying a presented peer certificate (e.g. server certificate for clusters or client certificate for listeners).
String	getVerifyCertificateHash(int index) If specified, Envoy will verify (pin) the hex-encoded SHA-256 fingerprint of the presented certificate.
com.google.protobuf.ByteString	getVerifyCertificateHashBytes(int index) If specified, Envoy will verify (pin) the hex-encoded SHA-256 fingerprint of the presented certificate.
int	getVerifyCertificateHashCount() If specified, Envoy will verify (pin) the hex-encoded SHA-256 fingerprint of the presented certificate.
com.google.protobuf.ProtocolStringList	getVerifyCertificateHashList() If specified, Envoy will verify (pin) the hex-encoded SHA-256 fingerprint of the presented certificate.
String	getVerifySpkiSha256(int index) If specified, Envoy will verify (pin) base64-encoded SHA-256 hash of the Subject Public Key Information (SPKI) of the presented certificate.
com.google.protobuf.ByteString	getVerifySpkiSha256Bytes(int index) If specified, Envoy will verify (pin) base64-encoded SHA-256 hash of the Subject Public Key Information (SPKI) of the presented certificate.
int	getVerifySpkiSha256Count() If specified, Envoy will verify (pin) base64-encoded SHA-256 hash of the Subject Public Key Information (SPKI) of the presented certificate.
com.google.protobuf.ProtocolStringList	getVerifySpkiSha256List() If specified, Envoy will verify (pin) base64-encoded SHA-256 hash of the Subject Public Key Information (SPKI) of the presented certificate.
String	getVerifySubjectAltName(int index) An optional list of subject alternative names.
com.google.protobuf.ByteString	getVerifySubjectAltNameBytes(int index) An optional list of subject alternative names.
int	getVerifySubjectAltNameCount() An optional list of subject alternative names.
com.google.protobuf.ProtocolStringList	getVerifySubjectAltNameList() An optional list of subject alternative names.
boolean	hasCrl() An optional `certificate revocation list <http://https://en.wikipedia.org/wiki/Certificate_revocation_list>`_ (in PEM format).
boolean	hasRequireOcspStaple() [#not-implemented-hide:] Must present a signed time-stamped OCSP response.
boolean	hasRequireSignedCertificateTimestamp() [#not-implemented-hide:] Must present signed certificate time-stamp.
boolean	hasTrustedCa() TLS certificate data containing certificate authority certificates to use in verifying a presented peer certificate (e.g. server certificate for clusters or client certificate for listeners).
protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable	internalGetFieldAccessorTable()
boolean	isInitialized()
Cert.CertificateValidationContext.Builder	mergeCrl(Base.DataSource value) An optional `certificate revocation list <http://https://en.wikipedia.org/wiki/Certificate_revocation_list>`_ (in PEM format).
Cert.CertificateValidationContext.Builder	mergeFrom(Cert.CertificateValidationContext other)
Cert.CertificateValidationContext.Builder	mergeFrom(com.google.protobuf.CodedInputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
Cert.CertificateValidationContext.Builder	mergeFrom(com.google.protobuf.Message other)
Cert.CertificateValidationContext.Builder	mergeRequireOcspStaple(com.google.protobuf.BoolValue value) [#not-implemented-hide:] Must present a signed time-stamped OCSP response.
Cert.CertificateValidationContext.Builder	mergeRequireSignedCertificateTimestamp(com.google.protobuf.BoolValue value) [#not-implemented-hide:] Must present signed certificate time-stamp.
Cert.CertificateValidationContext.Builder	mergeTrustedCa(Base.DataSource value) TLS certificate data containing certificate authority certificates to use in verifying a presented peer certificate (e.g. server certificate for clusters or client certificate for listeners).
Cert.CertificateValidationContext.Builder	mergeUnknownFields(com.google.protobuf.UnknownFieldSet unknownFields)
Cert.CertificateValidationContext.Builder	setCrl(Base.DataSource.Builder builderForValue) An optional `certificate revocation list <http://https://en.wikipedia.org/wiki/Certificate_revocation_list>`_ (in PEM format).
Cert.CertificateValidationContext.Builder	setCrl(Base.DataSource value) An optional `certificate revocation list <http://https://en.wikipedia.org/wiki/Certificate_revocation_list>`_ (in PEM format).
Cert.CertificateValidationContext.Builder	setField(com.google.protobuf.Descriptors.FieldDescriptor field, Object value)
Cert.CertificateValidationContext.Builder	setRepeatedField(com.google.protobuf.Descriptors.FieldDescriptor field, int index, Object value)
Cert.CertificateValidationContext.Builder	setRequireOcspStaple(com.google.protobuf.BoolValue.Builder builderForValue) [#not-implemented-hide:] Must present a signed time-stamped OCSP response.
Cert.CertificateValidationContext.Builder	setRequireOcspStaple(com.google.protobuf.BoolValue value) [#not-implemented-hide:] Must present a signed time-stamped OCSP response.
Cert.CertificateValidationContext.Builder	setRequireSignedCertificateTimestamp(com.google.protobuf.BoolValue.Builder builderForValue) [#not-implemented-hide:] Must present signed certificate time-stamp.
Cert.CertificateValidationContext.Builder	setRequireSignedCertificateTimestamp(com.google.protobuf.BoolValue value) [#not-implemented-hide:] Must present signed certificate time-stamp.
Cert.CertificateValidationContext.Builder	setTrustedCa(Base.DataSource.Builder builderForValue) TLS certificate data containing certificate authority certificates to use in verifying a presented peer certificate (e.g. server certificate for clusters or client certificate for listeners).
Cert.CertificateValidationContext.Builder	setTrustedCa(Base.DataSource value) TLS certificate data containing certificate authority certificates to use in verifying a presented peer certificate (e.g. server certificate for clusters or client certificate for listeners).
Cert.CertificateValidationContext.Builder	setUnknownFields(com.google.protobuf.UnknownFieldSet unknownFields)
Cert.CertificateValidationContext.Builder	setVerifyCertificateHash(int index, String value) If specified, Envoy will verify (pin) the hex-encoded SHA-256 fingerprint of the presented certificate.
Cert.CertificateValidationContext.Builder	setVerifySpkiSha256(int index, String value) If specified, Envoy will verify (pin) base64-encoded SHA-256 hash of the Subject Public Key Information (SPKI) of the presented certificate.
Cert.CertificateValidationContext.Builder	setVerifySubjectAltName(int index, String value) An optional list of subject alternative names.

Methods inherited from class com.google.protobuf.GeneratedMessageV3.Builder

getAllFields, getField, getFieldBuilder, getOneofFieldDescriptor, getParentForChildren, getRepeatedField, getRepeatedFieldBuilder, getRepeatedFieldCount, getUnknownFields, hasField, hasOneof, internalGetMapField, internalGetMutableMapField, isClean, markClean, newBuilderForField, onBuilt, onChanged, setUnknownFieldsProto3

Methods inherited from class com.google.protobuf.AbstractMessage.Builder

findInitializationErrors, getInitializationErrorString, internalMergeFrom, mergeDelimitedFrom, mergeDelimitedFrom, mergeFrom, mergeFrom, mergeFrom, mergeFrom, mergeFrom, mergeFrom, mergeFrom, mergeFrom, mergeFrom, newUninitializedMessageException, toString

Methods inherited from class com.google.protobuf.AbstractMessageLite.Builder

addAll, addAll, mergeFrom, newUninitializedMessageException

Methods inherited from class java.lang.Object

equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Methods inherited from interface com.google.protobuf.MessageOrBuilder

findInitializationErrors, getAllFields, getField, getInitializationErrorString, getOneofFieldDescriptor, getRepeatedField, getRepeatedFieldCount, getUnknownFields, hasField, hasOneof

Methods inherited from interface com.google.protobuf.MessageLite.Builder

mergeFrom

Method Detail

getDescriptor

public static final com.google.protobuf.Descriptors.Descriptor getDescriptor()

internalGetFieldAccessorTable

protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable internalGetFieldAccessorTable()

Specified by:

internalGetFieldAccessorTable in class com.google.protobuf.GeneratedMessageV3.Builder<Cert.CertificateValidationContext.Builder>

clear

public Cert.CertificateValidationContext.Builder clear()

Specified by:

clear in interface com.google.protobuf.Message.Builder

Specified by:

clear in interface com.google.protobuf.MessageLite.Builder

Overrides:

clear in class com.google.protobuf.GeneratedMessageV3.Builder<Cert.CertificateValidationContext.Builder>

getDescriptorForType

public com.google.protobuf.Descriptors.Descriptor getDescriptorForType()

Specified by:

getDescriptorForType in interface com.google.protobuf.Message.Builder

Specified by:

getDescriptorForType in interface com.google.protobuf.MessageOrBuilder

Overrides:

getDescriptorForType in class com.google.protobuf.GeneratedMessageV3.Builder<Cert.CertificateValidationContext.Builder>

getDefaultInstanceForType

public Cert.CertificateValidationContext getDefaultInstanceForType()

Specified by:

getDefaultInstanceForType in interface com.google.protobuf.MessageLiteOrBuilder

Specified by:

getDefaultInstanceForType in interface com.google.protobuf.MessageOrBuilder

build

public Cert.CertificateValidationContext build()

Specified by:

build in interface com.google.protobuf.Message.Builder

Specified by:

build in interface com.google.protobuf.MessageLite.Builder

buildPartial

public Cert.CertificateValidationContext buildPartial()

Specified by:

buildPartial in interface com.google.protobuf.Message.Builder

Specified by:

buildPartial in interface com.google.protobuf.MessageLite.Builder

clone

public Cert.CertificateValidationContext.Builder clone()

Specified by:

clone in interface com.google.protobuf.Message.Builder

Specified by:

clone in interface com.google.protobuf.MessageLite.Builder

Overrides:

clone in class com.google.protobuf.GeneratedMessageV3.Builder<Cert.CertificateValidationContext.Builder>

setField

public Cert.CertificateValidationContext.Builder setField(com.google.protobuf.Descriptors.FieldDescriptor field,
                                                          Object value)

Specified by:

setField in interface com.google.protobuf.Message.Builder

Overrides:

setField in class com.google.protobuf.GeneratedMessageV3.Builder<Cert.CertificateValidationContext.Builder>

clearField

public Cert.CertificateValidationContext.Builder clearField(com.google.protobuf.Descriptors.FieldDescriptor field)

Specified by:

clearField in interface com.google.protobuf.Message.Builder

Overrides:

clearField in class com.google.protobuf.GeneratedMessageV3.Builder<Cert.CertificateValidationContext.Builder>

clearOneof

public Cert.CertificateValidationContext.Builder clearOneof(com.google.protobuf.Descriptors.OneofDescriptor oneof)

Specified by:

clearOneof in interface com.google.protobuf.Message.Builder

Overrides:

clearOneof in class com.google.protobuf.GeneratedMessageV3.Builder<Cert.CertificateValidationContext.Builder>

setRepeatedField

public Cert.CertificateValidationContext.Builder setRepeatedField(com.google.protobuf.Descriptors.FieldDescriptor field,
                                                                  int index,
                                                                  Object value)

Specified by:

setRepeatedField in interface com.google.protobuf.Message.Builder

Overrides:

setRepeatedField in class com.google.protobuf.GeneratedMessageV3.Builder<Cert.CertificateValidationContext.Builder>

addRepeatedField

public Cert.CertificateValidationContext.Builder addRepeatedField(com.google.protobuf.Descriptors.FieldDescriptor field,
                                                                  Object value)

Specified by:

addRepeatedField in interface com.google.protobuf.Message.Builder

Overrides:

addRepeatedField in class com.google.protobuf.GeneratedMessageV3.Builder<Cert.CertificateValidationContext.Builder>

mergeFrom

public Cert.CertificateValidationContext.Builder mergeFrom(com.google.protobuf.Message other)

Specified by:

mergeFrom in interface com.google.protobuf.Message.Builder

Overrides:

mergeFrom in class com.google.protobuf.AbstractMessage.Builder<Cert.CertificateValidationContext.Builder>

mergeFrom

public Cert.CertificateValidationContext.Builder mergeFrom(Cert.CertificateValidationContext other)

isInitialized

public final boolean isInitialized()

Specified by:

isInitialized in interface com.google.protobuf.MessageLiteOrBuilder

Overrides:

isInitialized in class com.google.protobuf.GeneratedMessageV3.Builder<Cert.CertificateValidationContext.Builder>

mergeFrom

public Cert.CertificateValidationContext.Builder mergeFrom(com.google.protobuf.CodedInputStream input,
                                                           com.google.protobuf.ExtensionRegistryLite extensionRegistry)
                                                    throws IOException

Specified by:

mergeFrom in interface com.google.protobuf.Message.Builder

Specified by:

mergeFrom in interface com.google.protobuf.MessageLite.Builder

Overrides:

mergeFrom in class com.google.protobuf.AbstractMessage.Builder<Cert.CertificateValidationContext.Builder>

Throws:

IOException

hasTrustedCa

public boolean hasTrustedCa()

 TLS certificate data containing certificate authority certificates to use in verifying
 a presented peer certificate (e.g. server certificate for clusters or client certificate
 for listeners). If not specified and a peer certificate is presented it will not be
 verified. By default, a client certificate is optional, unless one of the additional
 options (:ref:`require_client_certificate
 <envoy_api_field_auth.DownstreamTlsContext.require_client_certificate>`,
 :ref:`verify_certificate_hash
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>`, or
 :ref:`verify_subject_alt_name
 <envoy_api_field_auth.CertificateValidationContext.verify_subject_alt_name>`) is also
 specified.
 See :ref:`the TLS overview <arch_overview_ssl_enabling_verification>` for a list of common
 system CA locations.
 

.envoy.api.v2.core.DataSource trusted_ca = 1;

Specified by:

hasTrustedCa in interface Cert.CertificateValidationContextOrBuilder

getTrustedCa

public Base.DataSource getTrustedCa()

 TLS certificate data containing certificate authority certificates to use in verifying
 a presented peer certificate (e.g. server certificate for clusters or client certificate
 for listeners). If not specified and a peer certificate is presented it will not be
 verified. By default, a client certificate is optional, unless one of the additional
 options (:ref:`require_client_certificate
 <envoy_api_field_auth.DownstreamTlsContext.require_client_certificate>`,
 :ref:`verify_certificate_hash
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>`, or
 :ref:`verify_subject_alt_name
 <envoy_api_field_auth.CertificateValidationContext.verify_subject_alt_name>`) is also
 specified.
 See :ref:`the TLS overview <arch_overview_ssl_enabling_verification>` for a list of common
 system CA locations.
 

.envoy.api.v2.core.DataSource trusted_ca = 1;

Specified by:

getTrustedCa in interface Cert.CertificateValidationContextOrBuilder

setTrustedCa

public Cert.CertificateValidationContext.Builder setTrustedCa(Base.DataSource value)

 TLS certificate data containing certificate authority certificates to use in verifying
 a presented peer certificate (e.g. server certificate for clusters or client certificate
 for listeners). If not specified and a peer certificate is presented it will not be
 verified. By default, a client certificate is optional, unless one of the additional
 options (:ref:`require_client_certificate
 <envoy_api_field_auth.DownstreamTlsContext.require_client_certificate>`,
 :ref:`verify_certificate_hash
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>`, or
 :ref:`verify_subject_alt_name
 <envoy_api_field_auth.CertificateValidationContext.verify_subject_alt_name>`) is also
 specified.
 See :ref:`the TLS overview <arch_overview_ssl_enabling_verification>` for a list of common
 system CA locations.
 

.envoy.api.v2.core.DataSource trusted_ca = 1;

setTrustedCa

public Cert.CertificateValidationContext.Builder setTrustedCa(Base.DataSource.Builder builderForValue)

 TLS certificate data containing certificate authority certificates to use in verifying
 a presented peer certificate (e.g. server certificate for clusters or client certificate
 for listeners). If not specified and a peer certificate is presented it will not be
 verified. By default, a client certificate is optional, unless one of the additional
 options (:ref:`require_client_certificate
 <envoy_api_field_auth.DownstreamTlsContext.require_client_certificate>`,
 :ref:`verify_certificate_hash
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>`, or
 :ref:`verify_subject_alt_name
 <envoy_api_field_auth.CertificateValidationContext.verify_subject_alt_name>`) is also
 specified.
 See :ref:`the TLS overview <arch_overview_ssl_enabling_verification>` for a list of common
 system CA locations.
 

.envoy.api.v2.core.DataSource trusted_ca = 1;

mergeTrustedCa

public Cert.CertificateValidationContext.Builder mergeTrustedCa(Base.DataSource value)

 TLS certificate data containing certificate authority certificates to use in verifying
 a presented peer certificate (e.g. server certificate for clusters or client certificate
 for listeners). If not specified and a peer certificate is presented it will not be
 verified. By default, a client certificate is optional, unless one of the additional
 options (:ref:`require_client_certificate
 <envoy_api_field_auth.DownstreamTlsContext.require_client_certificate>`,
 :ref:`verify_certificate_hash
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>`, or
 :ref:`verify_subject_alt_name
 <envoy_api_field_auth.CertificateValidationContext.verify_subject_alt_name>`) is also
 specified.
 See :ref:`the TLS overview <arch_overview_ssl_enabling_verification>` for a list of common
 system CA locations.
 

.envoy.api.v2.core.DataSource trusted_ca = 1;

clearTrustedCa

public Cert.CertificateValidationContext.Builder clearTrustedCa()

 TLS certificate data containing certificate authority certificates to use in verifying
 a presented peer certificate (e.g. server certificate for clusters or client certificate
 for listeners). If not specified and a peer certificate is presented it will not be
 verified. By default, a client certificate is optional, unless one of the additional
 options (:ref:`require_client_certificate
 <envoy_api_field_auth.DownstreamTlsContext.require_client_certificate>`,
 :ref:`verify_certificate_hash
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>`, or
 :ref:`verify_subject_alt_name
 <envoy_api_field_auth.CertificateValidationContext.verify_subject_alt_name>`) is also
 specified.
 See :ref:`the TLS overview <arch_overview_ssl_enabling_verification>` for a list of common
 system CA locations.
 

.envoy.api.v2.core.DataSource trusted_ca = 1;

getTrustedCaBuilder

public Base.DataSource.Builder getTrustedCaBuilder()

 TLS certificate data containing certificate authority certificates to use in verifying
 a presented peer certificate (e.g. server certificate for clusters or client certificate
 for listeners). If not specified and a peer certificate is presented it will not be
 verified. By default, a client certificate is optional, unless one of the additional
 options (:ref:`require_client_certificate
 <envoy_api_field_auth.DownstreamTlsContext.require_client_certificate>`,
 :ref:`verify_certificate_hash
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>`, or
 :ref:`verify_subject_alt_name
 <envoy_api_field_auth.CertificateValidationContext.verify_subject_alt_name>`) is also
 specified.
 See :ref:`the TLS overview <arch_overview_ssl_enabling_verification>` for a list of common
 system CA locations.
 

.envoy.api.v2.core.DataSource trusted_ca = 1;

getTrustedCaOrBuilder

public Base.DataSourceOrBuilder getTrustedCaOrBuilder()

 TLS certificate data containing certificate authority certificates to use in verifying
 a presented peer certificate (e.g. server certificate for clusters or client certificate
 for listeners). If not specified and a peer certificate is presented it will not be
 verified. By default, a client certificate is optional, unless one of the additional
 options (:ref:`require_client_certificate
 <envoy_api_field_auth.DownstreamTlsContext.require_client_certificate>`,
 :ref:`verify_certificate_hash
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>`, or
 :ref:`verify_subject_alt_name
 <envoy_api_field_auth.CertificateValidationContext.verify_subject_alt_name>`) is also
 specified.
 See :ref:`the TLS overview <arch_overview_ssl_enabling_verification>` for a list of common
 system CA locations.
 

.envoy.api.v2.core.DataSource trusted_ca = 1;

Specified by:

getTrustedCaOrBuilder in interface Cert.CertificateValidationContextOrBuilder

getVerifyCertificateHashList

public com.google.protobuf.ProtocolStringList getVerifyCertificateHashList()

 If specified, Envoy will verify (pin) the hex-encoded SHA-256 fingerprint of
 the presented certificate.
 For example, ``openssl`` can produce a SHA-256 fingerprint of an x509 certificate
 with the following command:
 .. code-block:: bash
   $ openssl x509 -in path/to/client.crt -noout -fingerprint -sha256
 

repeated string verify_certificate_hash = 2;

Specified by:

getVerifyCertificateHashList in interface Cert.CertificateValidationContextOrBuilder

getVerifyCertificateHashCount

public int getVerifyCertificateHashCount()

 If specified, Envoy will verify (pin) the hex-encoded SHA-256 fingerprint of
 the presented certificate.
 For example, ``openssl`` can produce a SHA-256 fingerprint of an x509 certificate
 with the following command:
 .. code-block:: bash
   $ openssl x509 -in path/to/client.crt -noout -fingerprint -sha256
 

repeated string verify_certificate_hash = 2;

Specified by:

getVerifyCertificateHashCount in interface Cert.CertificateValidationContextOrBuilder

getVerifyCertificateHash

public String getVerifyCertificateHash(int index)

 If specified, Envoy will verify (pin) the hex-encoded SHA-256 fingerprint of
 the presented certificate.
 For example, ``openssl`` can produce a SHA-256 fingerprint of an x509 certificate
 with the following command:
 .. code-block:: bash
   $ openssl x509 -in path/to/client.crt -noout -fingerprint -sha256
 

repeated string verify_certificate_hash = 2;

Specified by:

getVerifyCertificateHash in interface Cert.CertificateValidationContextOrBuilder

getVerifyCertificateHashBytes

public com.google.protobuf.ByteString getVerifyCertificateHashBytes(int index)

 If specified, Envoy will verify (pin) the hex-encoded SHA-256 fingerprint of
 the presented certificate.
 For example, ``openssl`` can produce a SHA-256 fingerprint of an x509 certificate
 with the following command:
 .. code-block:: bash
   $ openssl x509 -in path/to/client.crt -noout -fingerprint -sha256
 

repeated string verify_certificate_hash = 2;

Specified by:

getVerifyCertificateHashBytes in interface Cert.CertificateValidationContextOrBuilder

setVerifyCertificateHash

public Cert.CertificateValidationContext.Builder setVerifyCertificateHash(int index,
                                                                          String value)

 If specified, Envoy will verify (pin) the hex-encoded SHA-256 fingerprint of
 the presented certificate.
 For example, ``openssl`` can produce a SHA-256 fingerprint of an x509 certificate
 with the following command:
 .. code-block:: bash
   $ openssl x509 -in path/to/client.crt -noout -fingerprint -sha256
 

repeated string verify_certificate_hash = 2;

addVerifyCertificateHash

public Cert.CertificateValidationContext.Builder addVerifyCertificateHash(String value)

 If specified, Envoy will verify (pin) the hex-encoded SHA-256 fingerprint of
 the presented certificate.
 For example, ``openssl`` can produce a SHA-256 fingerprint of an x509 certificate
 with the following command:
 .. code-block:: bash
   $ openssl x509 -in path/to/client.crt -noout -fingerprint -sha256
 

repeated string verify_certificate_hash = 2;

addAllVerifyCertificateHash

public Cert.CertificateValidationContext.Builder addAllVerifyCertificateHash(Iterable<String> values)

 If specified, Envoy will verify (pin) the hex-encoded SHA-256 fingerprint of
 the presented certificate.
 For example, ``openssl`` can produce a SHA-256 fingerprint of an x509 certificate
 with the following command:
 .. code-block:: bash
   $ openssl x509 -in path/to/client.crt -noout -fingerprint -sha256
 

repeated string verify_certificate_hash = 2;

clearVerifyCertificateHash

public Cert.CertificateValidationContext.Builder clearVerifyCertificateHash()

 If specified, Envoy will verify (pin) the hex-encoded SHA-256 fingerprint of
 the presented certificate.
 For example, ``openssl`` can produce a SHA-256 fingerprint of an x509 certificate
 with the following command:
 .. code-block:: bash
   $ openssl x509 -in path/to/client.crt -noout -fingerprint -sha256
 

repeated string verify_certificate_hash = 2;

addVerifyCertificateHashBytes

public Cert.CertificateValidationContext.Builder addVerifyCertificateHashBytes(com.google.protobuf.ByteString value)

 If specified, Envoy will verify (pin) the hex-encoded SHA-256 fingerprint of
 the presented certificate.
 For example, ``openssl`` can produce a SHA-256 fingerprint of an x509 certificate
 with the following command:
 .. code-block:: bash
   $ openssl x509 -in path/to/client.crt -noout -fingerprint -sha256
 

repeated string verify_certificate_hash = 2;

getVerifySpkiSha256List

public com.google.protobuf.ProtocolStringList getVerifySpkiSha256List()

 If specified, Envoy will verify (pin) base64-encoded SHA-256 hash of
 the Subject Public Key Information (SPKI) of the presented certificate.
 This is the same format as used in HTTP Public Key Pinning.
 [#not-implemented-hide:]
 

repeated string verify_spki_sha256 = 3;

Specified by:

getVerifySpkiSha256List in interface Cert.CertificateValidationContextOrBuilder

getVerifySpkiSha256Count

public int getVerifySpkiSha256Count()

 If specified, Envoy will verify (pin) base64-encoded SHA-256 hash of
 the Subject Public Key Information (SPKI) of the presented certificate.
 This is the same format as used in HTTP Public Key Pinning.
 [#not-implemented-hide:]
 

repeated string verify_spki_sha256 = 3;

Specified by:

getVerifySpkiSha256Count in interface Cert.CertificateValidationContextOrBuilder

getVerifySpkiSha256

public String getVerifySpkiSha256(int index)

 If specified, Envoy will verify (pin) base64-encoded SHA-256 hash of
 the Subject Public Key Information (SPKI) of the presented certificate.
 This is the same format as used in HTTP Public Key Pinning.
 [#not-implemented-hide:]
 

repeated string verify_spki_sha256 = 3;

Specified by:

getVerifySpkiSha256 in interface Cert.CertificateValidationContextOrBuilder

getVerifySpkiSha256Bytes

public com.google.protobuf.ByteString getVerifySpkiSha256Bytes(int index)

 If specified, Envoy will verify (pin) base64-encoded SHA-256 hash of
 the Subject Public Key Information (SPKI) of the presented certificate.
 This is the same format as used in HTTP Public Key Pinning.
 [#not-implemented-hide:]
 

repeated string verify_spki_sha256 = 3;

Specified by:

getVerifySpkiSha256Bytes in interface Cert.CertificateValidationContextOrBuilder

setVerifySpkiSha256

public Cert.CertificateValidationContext.Builder setVerifySpkiSha256(int index,
                                                                     String value)

 If specified, Envoy will verify (pin) base64-encoded SHA-256 hash of
 the Subject Public Key Information (SPKI) of the presented certificate.
 This is the same format as used in HTTP Public Key Pinning.
 [#not-implemented-hide:]
 

repeated string verify_spki_sha256 = 3;

addVerifySpkiSha256

public Cert.CertificateValidationContext.Builder addVerifySpkiSha256(String value)

 If specified, Envoy will verify (pin) base64-encoded SHA-256 hash of
 the Subject Public Key Information (SPKI) of the presented certificate.
 This is the same format as used in HTTP Public Key Pinning.
 [#not-implemented-hide:]
 

repeated string verify_spki_sha256 = 3;

addAllVerifySpkiSha256

public Cert.CertificateValidationContext.Builder addAllVerifySpkiSha256(Iterable<String> values)

 If specified, Envoy will verify (pin) base64-encoded SHA-256 hash of
 the Subject Public Key Information (SPKI) of the presented certificate.
 This is the same format as used in HTTP Public Key Pinning.
 [#not-implemented-hide:]
 

repeated string verify_spki_sha256 = 3;

clearVerifySpkiSha256

public Cert.CertificateValidationContext.Builder clearVerifySpkiSha256()

 If specified, Envoy will verify (pin) base64-encoded SHA-256 hash of
 the Subject Public Key Information (SPKI) of the presented certificate.
 This is the same format as used in HTTP Public Key Pinning.
 [#not-implemented-hide:]
 

repeated string verify_spki_sha256 = 3;

addVerifySpkiSha256Bytes

public Cert.CertificateValidationContext.Builder addVerifySpkiSha256Bytes(com.google.protobuf.ByteString value)

 If specified, Envoy will verify (pin) base64-encoded SHA-256 hash of
 the Subject Public Key Information (SPKI) of the presented certificate.
 This is the same format as used in HTTP Public Key Pinning.
 [#not-implemented-hide:]
 

repeated string verify_spki_sha256 = 3;

getVerifySubjectAltNameList

public com.google.protobuf.ProtocolStringList getVerifySubjectAltNameList()

 An optional list of subject alternative names. If specified, Envoy will verify that
 the certificate’s subject alternative name matches one of the specified values.
 

repeated string verify_subject_alt_name = 4;

Specified by:

getVerifySubjectAltNameList in interface Cert.CertificateValidationContextOrBuilder

getVerifySubjectAltNameCount

public int getVerifySubjectAltNameCount()

 An optional list of subject alternative names. If specified, Envoy will verify that
 the certificate’s subject alternative name matches one of the specified values.
 

repeated string verify_subject_alt_name = 4;

Specified by:

getVerifySubjectAltNameCount in interface Cert.CertificateValidationContextOrBuilder

getVerifySubjectAltName

public String getVerifySubjectAltName(int index)

 An optional list of subject alternative names. If specified, Envoy will verify that
 the certificate’s subject alternative name matches one of the specified values.
 

repeated string verify_subject_alt_name = 4;

Specified by:

getVerifySubjectAltName in interface Cert.CertificateValidationContextOrBuilder

getVerifySubjectAltNameBytes

public com.google.protobuf.ByteString getVerifySubjectAltNameBytes(int index)

 An optional list of subject alternative names. If specified, Envoy will verify that
 the certificate’s subject alternative name matches one of the specified values.
 

repeated string verify_subject_alt_name = 4;

Specified by:

getVerifySubjectAltNameBytes in interface Cert.CertificateValidationContextOrBuilder

setVerifySubjectAltName

public Cert.CertificateValidationContext.Builder setVerifySubjectAltName(int index,
                                                                         String value)

 An optional list of subject alternative names. If specified, Envoy will verify that
 the certificate’s subject alternative name matches one of the specified values.
 

repeated string verify_subject_alt_name = 4;

addVerifySubjectAltName

public Cert.CertificateValidationContext.Builder addVerifySubjectAltName(String value)

 An optional list of subject alternative names. If specified, Envoy will verify that
 the certificate’s subject alternative name matches one of the specified values.
 

repeated string verify_subject_alt_name = 4;

addAllVerifySubjectAltName

public Cert.CertificateValidationContext.Builder addAllVerifySubjectAltName(Iterable<String> values)

 An optional list of subject alternative names. If specified, Envoy will verify that
 the certificate’s subject alternative name matches one of the specified values.
 

repeated string verify_subject_alt_name = 4;

clearVerifySubjectAltName

public Cert.CertificateValidationContext.Builder clearVerifySubjectAltName()

 An optional list of subject alternative names. If specified, Envoy will verify that
 the certificate’s subject alternative name matches one of the specified values.
 

repeated string verify_subject_alt_name = 4;

addVerifySubjectAltNameBytes

public Cert.CertificateValidationContext.Builder addVerifySubjectAltNameBytes(com.google.protobuf.ByteString value)

 An optional list of subject alternative names. If specified, Envoy will verify that
 the certificate’s subject alternative name matches one of the specified values.
 

repeated string verify_subject_alt_name = 4;

hasRequireOcspStaple

public boolean hasRequireOcspStaple()

 [#not-implemented-hide:] Must present a signed time-stamped OCSP response.
 

.google.protobuf.BoolValue require_ocsp_staple = 5;

Specified by:

hasRequireOcspStaple in interface Cert.CertificateValidationContextOrBuilder

getRequireOcspStaple

public com.google.protobuf.BoolValue getRequireOcspStaple()

 [#not-implemented-hide:] Must present a signed time-stamped OCSP response.
 

.google.protobuf.BoolValue require_ocsp_staple = 5;

Specified by:

getRequireOcspStaple in interface Cert.CertificateValidationContextOrBuilder

setRequireOcspStaple

public Cert.CertificateValidationContext.Builder setRequireOcspStaple(com.google.protobuf.BoolValue value)

 [#not-implemented-hide:] Must present a signed time-stamped OCSP response.
 

.google.protobuf.BoolValue require_ocsp_staple = 5;

setRequireOcspStaple

public Cert.CertificateValidationContext.Builder setRequireOcspStaple(com.google.protobuf.BoolValue.Builder builderForValue)

 [#not-implemented-hide:] Must present a signed time-stamped OCSP response.
 

.google.protobuf.BoolValue require_ocsp_staple = 5;

mergeRequireOcspStaple

public Cert.CertificateValidationContext.Builder mergeRequireOcspStaple(com.google.protobuf.BoolValue value)

 [#not-implemented-hide:] Must present a signed time-stamped OCSP response.
 

.google.protobuf.BoolValue require_ocsp_staple = 5;

clearRequireOcspStaple

public Cert.CertificateValidationContext.Builder clearRequireOcspStaple()

 [#not-implemented-hide:] Must present a signed time-stamped OCSP response.
 

.google.protobuf.BoolValue require_ocsp_staple = 5;

getRequireOcspStapleBuilder

public com.google.protobuf.BoolValue.Builder getRequireOcspStapleBuilder()

 [#not-implemented-hide:] Must present a signed time-stamped OCSP response.
 

.google.protobuf.BoolValue require_ocsp_staple = 5;

getRequireOcspStapleOrBuilder

public com.google.protobuf.BoolValueOrBuilder getRequireOcspStapleOrBuilder()

 [#not-implemented-hide:] Must present a signed time-stamped OCSP response.
 

.google.protobuf.BoolValue require_ocsp_staple = 5;

Specified by:

getRequireOcspStapleOrBuilder in interface Cert.CertificateValidationContextOrBuilder

hasRequireSignedCertificateTimestamp

public boolean hasRequireSignedCertificateTimestamp()

 [#not-implemented-hide:] Must present signed certificate time-stamp.
 

.google.protobuf.BoolValue require_signed_certificate_timestamp = 6;

Specified by:

hasRequireSignedCertificateTimestamp in interface Cert.CertificateValidationContextOrBuilder

getRequireSignedCertificateTimestamp

public com.google.protobuf.BoolValue getRequireSignedCertificateTimestamp()

 [#not-implemented-hide:] Must present signed certificate time-stamp.
 

.google.protobuf.BoolValue require_signed_certificate_timestamp = 6;

Specified by:

getRequireSignedCertificateTimestamp in interface Cert.CertificateValidationContextOrBuilder

setRequireSignedCertificateTimestamp

public Cert.CertificateValidationContext.Builder setRequireSignedCertificateTimestamp(com.google.protobuf.BoolValue value)

 [#not-implemented-hide:] Must present signed certificate time-stamp.
 

.google.protobuf.BoolValue require_signed_certificate_timestamp = 6;

setRequireSignedCertificateTimestamp

public Cert.CertificateValidationContext.Builder setRequireSignedCertificateTimestamp(com.google.protobuf.BoolValue.Builder builderForValue)

 [#not-implemented-hide:] Must present signed certificate time-stamp.
 

.google.protobuf.BoolValue require_signed_certificate_timestamp = 6;

mergeRequireSignedCertificateTimestamp

public Cert.CertificateValidationContext.Builder mergeRequireSignedCertificateTimestamp(com.google.protobuf.BoolValue value)

 [#not-implemented-hide:] Must present signed certificate time-stamp.
 

.google.protobuf.BoolValue require_signed_certificate_timestamp = 6;

clearRequireSignedCertificateTimestamp

public Cert.CertificateValidationContext.Builder clearRequireSignedCertificateTimestamp()

 [#not-implemented-hide:] Must present signed certificate time-stamp.
 

.google.protobuf.BoolValue require_signed_certificate_timestamp = 6;

getRequireSignedCertificateTimestampBuilder

public com.google.protobuf.BoolValue.Builder getRequireSignedCertificateTimestampBuilder()

 [#not-implemented-hide:] Must present signed certificate time-stamp.
 

.google.protobuf.BoolValue require_signed_certificate_timestamp = 6;

getRequireSignedCertificateTimestampOrBuilder

public com.google.protobuf.BoolValueOrBuilder getRequireSignedCertificateTimestampOrBuilder()

 [#not-implemented-hide:] Must present signed certificate time-stamp.
 

.google.protobuf.BoolValue require_signed_certificate_timestamp = 6;

Specified by:

getRequireSignedCertificateTimestampOrBuilder in interface Cert.CertificateValidationContextOrBuilder

hasCrl

public boolean hasCrl()

 An optional `certificate revocation list
 <http://https://en.wikipedia.org/wiki/Certificate_revocation_list>`_
 (in PEM format). If specified, Envoy will verify that the presented peer
 certificate has not been revoked by this CRL. If this DataSource contains
 multiple CRLs, all of them will be used.
 

.envoy.api.v2.core.DataSource crl = 7;

Specified by:

hasCrl in interface Cert.CertificateValidationContextOrBuilder

getCrl

public Base.DataSource getCrl()

 An optional `certificate revocation list
 <http://https://en.wikipedia.org/wiki/Certificate_revocation_list>`_
 (in PEM format). If specified, Envoy will verify that the presented peer
 certificate has not been revoked by this CRL. If this DataSource contains
 multiple CRLs, all of them will be used.
 

.envoy.api.v2.core.DataSource crl = 7;

Specified by:

getCrl in interface Cert.CertificateValidationContextOrBuilder

setCrl

public Cert.CertificateValidationContext.Builder setCrl(Base.DataSource value)

 An optional `certificate revocation list
 <http://https://en.wikipedia.org/wiki/Certificate_revocation_list>`_
 (in PEM format). If specified, Envoy will verify that the presented peer
 certificate has not been revoked by this CRL. If this DataSource contains
 multiple CRLs, all of them will be used.
 

.envoy.api.v2.core.DataSource crl = 7;

setCrl

public Cert.CertificateValidationContext.Builder setCrl(Base.DataSource.Builder builderForValue)

 An optional `certificate revocation list
 <http://https://en.wikipedia.org/wiki/Certificate_revocation_list>`_
 (in PEM format). If specified, Envoy will verify that the presented peer
 certificate has not been revoked by this CRL. If this DataSource contains
 multiple CRLs, all of them will be used.
 

.envoy.api.v2.core.DataSource crl = 7;

mergeCrl

public Cert.CertificateValidationContext.Builder mergeCrl(Base.DataSource value)

 An optional `certificate revocation list
 <http://https://en.wikipedia.org/wiki/Certificate_revocation_list>`_
 (in PEM format). If specified, Envoy will verify that the presented peer
 certificate has not been revoked by this CRL. If this DataSource contains
 multiple CRLs, all of them will be used.
 

.envoy.api.v2.core.DataSource crl = 7;

clearCrl

public Cert.CertificateValidationContext.Builder clearCrl()

 An optional `certificate revocation list
 <http://https://en.wikipedia.org/wiki/Certificate_revocation_list>`_
 (in PEM format). If specified, Envoy will verify that the presented peer
 certificate has not been revoked by this CRL. If this DataSource contains
 multiple CRLs, all of them will be used.
 

.envoy.api.v2.core.DataSource crl = 7;

getCrlBuilder

public Base.DataSource.Builder getCrlBuilder()

 An optional `certificate revocation list
 <http://https://en.wikipedia.org/wiki/Certificate_revocation_list>`_
 (in PEM format). If specified, Envoy will verify that the presented peer
 certificate has not been revoked by this CRL. If this DataSource contains
 multiple CRLs, all of them will be used.
 

.envoy.api.v2.core.DataSource crl = 7;

getCrlOrBuilder

public Base.DataSourceOrBuilder getCrlOrBuilder()

 An optional `certificate revocation list
 <http://https://en.wikipedia.org/wiki/Certificate_revocation_list>`_
 (in PEM format). If specified, Envoy will verify that the presented peer
 certificate has not been revoked by this CRL. If this DataSource contains
 multiple CRLs, all of them will be used.
 

.envoy.api.v2.core.DataSource crl = 7;

Specified by:

getCrlOrBuilder in interface Cert.CertificateValidationContextOrBuilder

setUnknownFields

public final Cert.CertificateValidationContext.Builder setUnknownFields(com.google.protobuf.UnknownFieldSet unknownFields)

Specified by:

setUnknownFields in interface com.google.protobuf.Message.Builder

Overrides:

setUnknownFields in class com.google.protobuf.GeneratedMessageV3.Builder<Cert.CertificateValidationContext.Builder>

mergeUnknownFields

public final Cert.CertificateValidationContext.Builder mergeUnknownFields(com.google.protobuf.UnknownFieldSet unknownFields)

Specified by:

mergeUnknownFields in interface com.google.protobuf.Message.Builder

Overrides:

mergeUnknownFields in class com.google.protobuf.GeneratedMessageV3.Builder<Cert.CertificateValidationContext.Builder>