Class MariaDbX509DeferredIdentityTrustManager

java.lang.Object
org.mariadb.jdbc.client.tls.MariaDbX509DeferredIdentityTrustManager
All Implemented Interfaces:
TrustManager, X509TrustManager
public class MariaDbX509DeferredIdentityTrustManager extends Object implements X509TrustManager
TrustManager that defers server-identity validation to the authentication phase.

It delegates the standard certificate-chain check to a real X509TrustManager. When that check fails because the chain cannot be validated against the trust store, typically because the server presented a self-signed certificate it generated on the fly (MariaDB does this when TLS is enabled but no server certificate is configured), this manager does not reject the connection. Instead, it records the leaf certificate fingerprint and lets the handshake proceed, so the server's identity can be validated later, during authentication.

Identity is then proven cryptographically by the authentication plugin, which binds the session to this exact certificate (password + scramble + certificate fingerprint). A man-in-the-middle presenting a different certificate produces a different fingerprint, so authentication fails, the fingerprint is what actually validates the peer, not the (self-signed) certificate itself. A self-signed/ephemeral certificate is therefore only the usual trigger for this path, not the basis of the validation.

This only delays identity validation; it does not weaken it. Expired or not-yet-valid certificates are still rejected outright here, and this manager must only be used on connection paths that go on to perform fingerprint-based authentication.

A new instance is created per connection, wrapping a shared (cached) delegate, so the captured fingerprint is simply per-connection instance state, read afterward via getFingerprint().