Remove redundant certificate logic in TrustManager

Now subsumed by other checks.

src/java/org/jivesoftware/openfire/net/ServerTrustManager.java

@@ -98,116 +98,7 @@ public class ServerTrustManager implements X509TrustManager {
      */
     public void checkServerTrusted(X509Certificate[] x509Certificates, String string)
             throws CertificateException {
-
-        // Flag that indicates if certificates of the remote server should be validated. Disabling
-        // certificate validation is not recommended for production environments.
-        boolean verify = JiveGlobals.getBooleanProperty(ConnectionSettings.Server.TLS_CERTIFICATE_VERIFY, true);
-        if (verify) {
-            int nSize = x509Certificates.length;
-            if (Log.isDebugEnabled()) {
-                Log.debug("Certificate chain:");
-                for (int i=1; i<= nSize; i++) {
-                    Log.debug("Certificate " + i + ": " + x509Certificates[i-1].toString());
-                }
-            }
-
-            List<String> peerIdentities = CertificateManager.getPeerIdentities(x509Certificates[0]);
-
-            if (JiveGlobals.getBooleanProperty(ConnectionSettings.Server.TLS_CERTIFICATE_CHAIN_VERIFY, true)) {
-                Log.debug("Verifying certificate chain...");
-
-                // Working down the chain, for every certificate in the chain,
-                // verify that the subject of the certificate is the issuer of the
-                // next certificate in the chain.
-                Principal principalLast = null;
-                for (int i = nSize -1; i >= 0 ; i--) {
-                    X509Certificate x509certificate = x509Certificates[i];
-                    Principal principalIssuer = x509certificate.getIssuerDN();
-                    Principal principalSubject = x509certificate.getSubjectDN();
-                    Log.debug("Certificate " + (i+1) + " issuer: '" + principalIssuer + "' subject: '" + principalSubject + "'");
-                    if (principalLast != null) {
-                        if (principalIssuer.equals(principalLast)) {
-                            try {
-                                PublicKey publickey =
-                                        x509Certificates[i + 1].getPublicKey();
-                                x509Certificates[i].verify(publickey);
-                            }
-                            catch (GeneralSecurityException generalsecurityexception) {
-                                throw new CertificateException(
-                                        "signature verification failed of " + peerIdentities, generalsecurityexception);
-                            }
-                        }
-                        else {
-                            throw new CertificateException(
-                                    "subject/issuer verification failed of " + peerIdentities + ". In certificate "
-                                     + (i+1) + " of the chain, I expected the issuer to be '" + principalLast
-                                     +"' but was '"+principalIssuer+"'.");
-                        }
-                    }
-                    principalLast = principalSubject;
-                }
-            }
-
-            if (JiveGlobals.getBooleanProperty(ConnectionSettings.Server.TLS_CERTIFICATE_ROOT_VERIFY, true)) {
-                Log.debug("Verifying certificate chain root certificate...");
-                // Verify that the the last certificate in the chain was issued
-                // by a third-party that the client trusts.
-                boolean trusted = false;
-                try {
-                    trusted = trustStore.getCertificateAlias(x509Certificates[nSize - 1]) != null;
-                    // Keep track if the other peer presented a self-signed certificate
-                    connection.setUsingSelfSignedCertificate(!trusted && nSize == 1);
-                    if (!trusted && nSize == 1 && JiveGlobals
-                            .getBooleanProperty(ConnectionSettings.Server.TLS_ACCEPT_SELFSIGNED_CERTS, false))
-                    {
-                        Log.warn("Accepting self-signed certificate of remote server: " +
-                                peerIdentities);
-                        trusted = true;
-                    }
-                }
-                catch (KeyStoreException e) {
-                    Log.error(e.getMessage(), e);
-                }
-                if (!trusted) {
-                    throw new CertificateException("Root certificate (subject: "+x509Certificates[nSize - 1].getSubjectX500Principal()
-                    		+ ") of " + peerIdentities + " not trusted.");
-                }
-            }
-
-            // Verify that the server either matches an identity from the chain, or
-            // a wildcard.
-            Boolean found = false;
-            for (String identity : peerIdentities) {
-                // Verify that either the identity is the same as the hostname, or for wildcarded
-                // identities that the hostname ends with .domainspecified or -is- domainspecified.
-                if ((identity.startsWith("*.")
-                        && (server.endsWith(identity.replace("*.", "."))
-                        || server.equals(identity.replace("*.", ""))))
-                        || server.equals(identity)) {
-                    found = true;
-                    break;
-                }
-            }
-
-            if (!found) {
-                throw new CertificateException("target verification failed of " + peerIdentities);
-            }
-
-            if (JiveGlobals.getBooleanProperty(ConnectionSettings.Server.TLS_CERTIFICATE_VERIFY_VALIDITY, true)) {
-                Log.debug("Verifying certificate chain validity (by date)...");
-
-                // For every certificate in the chain, verify that the certificate
-                // is valid at the current time.
-                Date date = new Date();
-                for (X509Certificate x509Certificate : x509Certificates) {
-                    try {
-                        x509Certificate.checkValidity(date);
-                    } catch (GeneralSecurityException generalsecurityexception) {
-                        throw new CertificateException("invalid date of " + peerIdentities);
-                    }
-                }
-            }
-        }
+        // Do nothing here. As before, the certificate will be validated when the remote server authenticates.
     }
 
     public X509Certificate[] getAcceptedIssuers() {