Package io.envoyproxy.envoy.api.v2.auth

Class CertificateValidationContext.Builder

    • Method Detail

      • getDescriptor

        public static final com.google.protobuf.Descriptors.Descriptor getDescriptor()

      • internalGetFieldAccessorTable

        protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable internalGetFieldAccessorTable()
        Specified by:
        internalGetFieldAccessorTable in class com.google.protobuf.GeneratedMessageV3.Builder<CertificateValidationContext.Builder>

      • getDescriptorForType

        public com.google.protobuf.Descriptors.Descriptor getDescriptorForType()
        Specified by:
        getDescriptorForType in interface com.google.protobuf.Message.Builder
        Specified by:
        getDescriptorForType in interface com.google.protobuf.MessageOrBuilder
        Overrides:
        getDescriptorForType in class com.google.protobuf.GeneratedMessageV3.Builder<CertificateValidationContext.Builder>

      • getDefaultInstanceForType

        public CertificateValidationContext getDefaultInstanceForType()
        Specified by:
        getDefaultInstanceForType in interface com.google.protobuf.MessageLiteOrBuilder
        Specified by:
        getDefaultInstanceForType in interface com.google.protobuf.MessageOrBuilder

      • build

        public CertificateValidationContext build()
        Specified by:
        build in interface com.google.protobuf.Message.Builder
        Specified by:
        build in interface com.google.protobuf.MessageLite.Builder

      • buildPartial

        public CertificateValidationContext buildPartial()
        Specified by:
        buildPartial in interface com.google.protobuf.Message.Builder
        Specified by:
        buildPartial in interface com.google.protobuf.MessageLite.Builder

      • isInitialized

        public final boolean isInitialized()
        Specified by:
        isInitialized in interface com.google.protobuf.MessageLiteOrBuilder
        Overrides:
        isInitialized in class com.google.protobuf.GeneratedMessageV3.Builder<CertificateValidationContext.Builder>

      • mergeFrom

        public CertificateValidationContext.Builder mergeFrom​(com.google.protobuf.CodedInputStream input,
                                                      com.google.protobuf.ExtensionRegistryLite extensionRegistry)
                                               throws IOException
        Specified by:
        mergeFrom in interface com.google.protobuf.Message.Builder
        Specified by:
        mergeFrom in interface com.google.protobuf.MessageLite.Builder
        Overrides:
        mergeFrom in class com.google.protobuf.AbstractMessage.Builder<CertificateValidationContext.Builder>
        Throws:
        IOException

      • hasTrustedCa

        public boolean hasTrustedCa()
         TLS certificate data containing certificate authority certificates to use in verifying
 a presented peer certificate (e.g. server certificate for clusters or client certificate
 for listeners). If not specified and a peer certificate is presented it will not be
 verified. By default, a client certificate is optional, unless one of the additional
 options (:ref:`require_client_certificate
 <envoy_api_field_auth.DownstreamTlsContext.require_client_certificate>`,
 :ref:`verify_certificate_spki
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_spki>`,
 :ref:`verify_certificate_hash
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>`, or
 :ref:`match_subject_alt_names
 <envoy_api_field_auth.CertificateValidationContext.match_subject_alt_names>`) is also
 specified.
 It can optionally contain certificate revocation lists, in which case Envoy will verify
 that the presented peer certificate has not been revoked by one of the included CRLs.
 See :ref:`the TLS overview <arch_overview_ssl_enabling_verification>` for a list of common
 system CA locations.
        .envoy.api.v2.core.DataSource trusted_ca = 1;
        Specified by:
        hasTrustedCa in interface CertificateValidationContextOrBuilder

      • getTrustedCa

        public DataSource getTrustedCa()
         TLS certificate data containing certificate authority certificates to use in verifying
 a presented peer certificate (e.g. server certificate for clusters or client certificate
 for listeners). If not specified and a peer certificate is presented it will not be
 verified. By default, a client certificate is optional, unless one of the additional
 options (:ref:`require_client_certificate
 <envoy_api_field_auth.DownstreamTlsContext.require_client_certificate>`,
 :ref:`verify_certificate_spki
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_spki>`,
 :ref:`verify_certificate_hash
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>`, or
 :ref:`match_subject_alt_names
 <envoy_api_field_auth.CertificateValidationContext.match_subject_alt_names>`) is also
 specified.
 It can optionally contain certificate revocation lists, in which case Envoy will verify
 that the presented peer certificate has not been revoked by one of the included CRLs.
 See :ref:`the TLS overview <arch_overview_ssl_enabling_verification>` for a list of common
 system CA locations.
        .envoy.api.v2.core.DataSource trusted_ca = 1;
        Specified by:
        getTrustedCa in interface CertificateValidationContextOrBuilder

      • setTrustedCa

        public CertificateValidationContext.Builder setTrustedCa​(DataSource value)
         TLS certificate data containing certificate authority certificates to use in verifying
 a presented peer certificate (e.g. server certificate for clusters or client certificate
 for listeners). If not specified and a peer certificate is presented it will not be
 verified. By default, a client certificate is optional, unless one of the additional
 options (:ref:`require_client_certificate
 <envoy_api_field_auth.DownstreamTlsContext.require_client_certificate>`,
 :ref:`verify_certificate_spki
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_spki>`,
 :ref:`verify_certificate_hash
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>`, or
 :ref:`match_subject_alt_names
 <envoy_api_field_auth.CertificateValidationContext.match_subject_alt_names>`) is also
 specified.
 It can optionally contain certificate revocation lists, in which case Envoy will verify
 that the presented peer certificate has not been revoked by one of the included CRLs.
 See :ref:`the TLS overview <arch_overview_ssl_enabling_verification>` for a list of common
 system CA locations.
        .envoy.api.v2.core.DataSource trusted_ca = 1;

      • setTrustedCa

        public CertificateValidationContext.Builder setTrustedCa​(DataSource.Builder builderForValue)
         TLS certificate data containing certificate authority certificates to use in verifying
 a presented peer certificate (e.g. server certificate for clusters or client certificate
 for listeners). If not specified and a peer certificate is presented it will not be
 verified. By default, a client certificate is optional, unless one of the additional
 options (:ref:`require_client_certificate
 <envoy_api_field_auth.DownstreamTlsContext.require_client_certificate>`,
 :ref:`verify_certificate_spki
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_spki>`,
 :ref:`verify_certificate_hash
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>`, or
 :ref:`match_subject_alt_names
 <envoy_api_field_auth.CertificateValidationContext.match_subject_alt_names>`) is also
 specified.
 It can optionally contain certificate revocation lists, in which case Envoy will verify
 that the presented peer certificate has not been revoked by one of the included CRLs.
 See :ref:`the TLS overview <arch_overview_ssl_enabling_verification>` for a list of common
 system CA locations.
        .envoy.api.v2.core.DataSource trusted_ca = 1;

      • mergeTrustedCa

        public CertificateValidationContext.Builder mergeTrustedCa​(DataSource value)
         TLS certificate data containing certificate authority certificates to use in verifying
 a presented peer certificate (e.g. server certificate for clusters or client certificate
 for listeners). If not specified and a peer certificate is presented it will not be
 verified. By default, a client certificate is optional, unless one of the additional
 options (:ref:`require_client_certificate
 <envoy_api_field_auth.DownstreamTlsContext.require_client_certificate>`,
 :ref:`verify_certificate_spki
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_spki>`,
 :ref:`verify_certificate_hash
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>`, or
 :ref:`match_subject_alt_names
 <envoy_api_field_auth.CertificateValidationContext.match_subject_alt_names>`) is also
 specified.
 It can optionally contain certificate revocation lists, in which case Envoy will verify
 that the presented peer certificate has not been revoked by one of the included CRLs.
 See :ref:`the TLS overview <arch_overview_ssl_enabling_verification>` for a list of common
 system CA locations.
        .envoy.api.v2.core.DataSource trusted_ca = 1;

      • clearTrustedCa

        public CertificateValidationContext.Builder clearTrustedCa()
         TLS certificate data containing certificate authority certificates to use in verifying
 a presented peer certificate (e.g. server certificate for clusters or client certificate
 for listeners). If not specified and a peer certificate is presented it will not be
 verified. By default, a client certificate is optional, unless one of the additional
 options (:ref:`require_client_certificate
 <envoy_api_field_auth.DownstreamTlsContext.require_client_certificate>`,
 :ref:`verify_certificate_spki
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_spki>`,
 :ref:`verify_certificate_hash
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>`, or
 :ref:`match_subject_alt_names
 <envoy_api_field_auth.CertificateValidationContext.match_subject_alt_names>`) is also
 specified.
 It can optionally contain certificate revocation lists, in which case Envoy will verify
 that the presented peer certificate has not been revoked by one of the included CRLs.
 See :ref:`the TLS overview <arch_overview_ssl_enabling_verification>` for a list of common
 system CA locations.
        .envoy.api.v2.core.DataSource trusted_ca = 1;

      • getTrustedCaBuilder

        public DataSource.Builder getTrustedCaBuilder()
         TLS certificate data containing certificate authority certificates to use in verifying
 a presented peer certificate (e.g. server certificate for clusters or client certificate
 for listeners). If not specified and a peer certificate is presented it will not be
 verified. By default, a client certificate is optional, unless one of the additional
 options (:ref:`require_client_certificate
 <envoy_api_field_auth.DownstreamTlsContext.require_client_certificate>`,
 :ref:`verify_certificate_spki
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_spki>`,
 :ref:`verify_certificate_hash
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>`, or
 :ref:`match_subject_alt_names
 <envoy_api_field_auth.CertificateValidationContext.match_subject_alt_names>`) is also
 specified.
 It can optionally contain certificate revocation lists, in which case Envoy will verify
 that the presented peer certificate has not been revoked by one of the included CRLs.
 See :ref:`the TLS overview <arch_overview_ssl_enabling_verification>` for a list of common
 system CA locations.
        .envoy.api.v2.core.DataSource trusted_ca = 1;

      • getTrustedCaOrBuilder

        public DataSourceOrBuilder getTrustedCaOrBuilder()
         TLS certificate data containing certificate authority certificates to use in verifying
 a presented peer certificate (e.g. server certificate for clusters or client certificate
 for listeners). If not specified and a peer certificate is presented it will not be
 verified. By default, a client certificate is optional, unless one of the additional
 options (:ref:`require_client_certificate
 <envoy_api_field_auth.DownstreamTlsContext.require_client_certificate>`,
 :ref:`verify_certificate_spki
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_spki>`,
 :ref:`verify_certificate_hash
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>`, or
 :ref:`match_subject_alt_names
 <envoy_api_field_auth.CertificateValidationContext.match_subject_alt_names>`) is also
 specified.
 It can optionally contain certificate revocation lists, in which case Envoy will verify
 that the presented peer certificate has not been revoked by one of the included CRLs.
 See :ref:`the TLS overview <arch_overview_ssl_enabling_verification>` for a list of common
 system CA locations.
        .envoy.api.v2.core.DataSource trusted_ca = 1;
        Specified by:
        getTrustedCaOrBuilder in interface CertificateValidationContextOrBuilder

      • getVerifyCertificateSpkiList

        public com.google.protobuf.ProtocolStringList getVerifyCertificateSpkiList()
         An optional list of base64-encoded SHA-256 hashes. If specified, Envoy will verify that the
 SHA-256 of the DER-encoded Subject Public Key Information (SPKI) of the presented certificate
 matches one of the specified values.
 A base64-encoded SHA-256 of the Subject Public Key Information (SPKI) of the certificate
 can be generated with the following command:
 .. code-block:: bash
   $ openssl x509 -in path/to/client.crt -noout -pubkey
     | openssl pkey -pubin -outform DER
     | openssl dgst -sha256 -binary
     | openssl enc -base64
   NvqYIYSbgK2vCJpQhObf77vv+bQWtc5ek5RIOwPiC9A=
 This is the format used in HTTP Public Key Pinning.
 When both:
 :ref:`verify_certificate_hash
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>` and
 :ref:`verify_certificate_spki
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_spki>` are specified,
 a hash matching value from either of the lists will result in the certificate being accepted.
 .. attention::
   This option is preferred over :ref:`verify_certificate_hash
   <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>`,
   because SPKI is tied to a private key, so it doesn't change when the certificate
   is renewed using the same private key.
        repeated string verify_certificate_spki = 3 [(.validate.rules) = { ... }
        Specified by:
        getVerifyCertificateSpkiList in interface CertificateValidationContextOrBuilder

      • getVerifyCertificateSpkiCount

        public int getVerifyCertificateSpkiCount()
         An optional list of base64-encoded SHA-256 hashes. If specified, Envoy will verify that the
 SHA-256 of the DER-encoded Subject Public Key Information (SPKI) of the presented certificate
 matches one of the specified values.
 A base64-encoded SHA-256 of the Subject Public Key Information (SPKI) of the certificate
 can be generated with the following command:
 .. code-block:: bash
   $ openssl x509 -in path/to/client.crt -noout -pubkey
     | openssl pkey -pubin -outform DER
     | openssl dgst -sha256 -binary
     | openssl enc -base64
   NvqYIYSbgK2vCJpQhObf77vv+bQWtc5ek5RIOwPiC9A=
 This is the format used in HTTP Public Key Pinning.
 When both:
 :ref:`verify_certificate_hash
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>` and
 :ref:`verify_certificate_spki
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_spki>` are specified,
 a hash matching value from either of the lists will result in the certificate being accepted.
 .. attention::
   This option is preferred over :ref:`verify_certificate_hash
   <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>`,
   because SPKI is tied to a private key, so it doesn't change when the certificate
   is renewed using the same private key.
        repeated string verify_certificate_spki = 3 [(.validate.rules) = { ... }
        Specified by:
        getVerifyCertificateSpkiCount in interface CertificateValidationContextOrBuilder

      • getVerifyCertificateSpki

        public String getVerifyCertificateSpki​(int index)
         An optional list of base64-encoded SHA-256 hashes. If specified, Envoy will verify that the
 SHA-256 of the DER-encoded Subject Public Key Information (SPKI) of the presented certificate
 matches one of the specified values.
 A base64-encoded SHA-256 of the Subject Public Key Information (SPKI) of the certificate
 can be generated with the following command:
 .. code-block:: bash
   $ openssl x509 -in path/to/client.crt -noout -pubkey
     | openssl pkey -pubin -outform DER
     | openssl dgst -sha256 -binary
     | openssl enc -base64
   NvqYIYSbgK2vCJpQhObf77vv+bQWtc5ek5RIOwPiC9A=
 This is the format used in HTTP Public Key Pinning.
 When both:
 :ref:`verify_certificate_hash
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>` and
 :ref:`verify_certificate_spki
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_spki>` are specified,
 a hash matching value from either of the lists will result in the certificate being accepted.
 .. attention::
   This option is preferred over :ref:`verify_certificate_hash
   <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>`,
   because SPKI is tied to a private key, so it doesn't change when the certificate
   is renewed using the same private key.
        repeated string verify_certificate_spki = 3 [(.validate.rules) = { ... }
        Specified by:
        getVerifyCertificateSpki in interface CertificateValidationContextOrBuilder

      • getVerifyCertificateSpkiBytes

        public com.google.protobuf.ByteString getVerifyCertificateSpkiBytes​(int index)
         An optional list of base64-encoded SHA-256 hashes. If specified, Envoy will verify that the
 SHA-256 of the DER-encoded Subject Public Key Information (SPKI) of the presented certificate
 matches one of the specified values.
 A base64-encoded SHA-256 of the Subject Public Key Information (SPKI) of the certificate
 can be generated with the following command:
 .. code-block:: bash
   $ openssl x509 -in path/to/client.crt -noout -pubkey
     | openssl pkey -pubin -outform DER
     | openssl dgst -sha256 -binary
     | openssl enc -base64
   NvqYIYSbgK2vCJpQhObf77vv+bQWtc5ek5RIOwPiC9A=
 This is the format used in HTTP Public Key Pinning.
 When both:
 :ref:`verify_certificate_hash
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>` and
 :ref:`verify_certificate_spki
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_spki>` are specified,
 a hash matching value from either of the lists will result in the certificate being accepted.
 .. attention::
   This option is preferred over :ref:`verify_certificate_hash
   <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>`,
   because SPKI is tied to a private key, so it doesn't change when the certificate
   is renewed using the same private key.
        repeated string verify_certificate_spki = 3 [(.validate.rules) = { ... }
        Specified by:
        getVerifyCertificateSpkiBytes in interface CertificateValidationContextOrBuilder

      • setVerifyCertificateSpki

        public CertificateValidationContext.Builder setVerifyCertificateSpki​(int index,
                                                                     String value)
         An optional list of base64-encoded SHA-256 hashes. If specified, Envoy will verify that the
 SHA-256 of the DER-encoded Subject Public Key Information (SPKI) of the presented certificate
 matches one of the specified values.
 A base64-encoded SHA-256 of the Subject Public Key Information (SPKI) of the certificate
 can be generated with the following command:
 .. code-block:: bash
   $ openssl x509 -in path/to/client.crt -noout -pubkey
     | openssl pkey -pubin -outform DER
     | openssl dgst -sha256 -binary
     | openssl enc -base64
   NvqYIYSbgK2vCJpQhObf77vv+bQWtc5ek5RIOwPiC9A=
 This is the format used in HTTP Public Key Pinning.
 When both:
 :ref:`verify_certificate_hash
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>` and
 :ref:`verify_certificate_spki
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_spki>` are specified,
 a hash matching value from either of the lists will result in the certificate being accepted.
 .. attention::
   This option is preferred over :ref:`verify_certificate_hash
   <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>`,
   because SPKI is tied to a private key, so it doesn't change when the certificate
   is renewed using the same private key.
        repeated string verify_certificate_spki = 3 [(.validate.rules) = { ... }

      • addVerifyCertificateSpki

        public CertificateValidationContext.Builder addVerifyCertificateSpki​(String value)
         An optional list of base64-encoded SHA-256 hashes. If specified, Envoy will verify that the
 SHA-256 of the DER-encoded Subject Public Key Information (SPKI) of the presented certificate
 matches one of the specified values.
 A base64-encoded SHA-256 of the Subject Public Key Information (SPKI) of the certificate
 can be generated with the following command:
 .. code-block:: bash
   $ openssl x509 -in path/to/client.crt -noout -pubkey
     | openssl pkey -pubin -outform DER
     | openssl dgst -sha256 -binary
     | openssl enc -base64
   NvqYIYSbgK2vCJpQhObf77vv+bQWtc5ek5RIOwPiC9A=
 This is the format used in HTTP Public Key Pinning.
 When both:
 :ref:`verify_certificate_hash
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>` and
 :ref:`verify_certificate_spki
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_spki>` are specified,
 a hash matching value from either of the lists will result in the certificate being accepted.
 .. attention::
   This option is preferred over :ref:`verify_certificate_hash
   <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>`,
   because SPKI is tied to a private key, so it doesn't change when the certificate
   is renewed using the same private key.
        repeated string verify_certificate_spki = 3 [(.validate.rules) = { ... }

      • addAllVerifyCertificateSpki

        public CertificateValidationContext.Builder addAllVerifyCertificateSpki​(Iterable<String> values)
         An optional list of base64-encoded SHA-256 hashes. If specified, Envoy will verify that the
 SHA-256 of the DER-encoded Subject Public Key Information (SPKI) of the presented certificate
 matches one of the specified values.
 A base64-encoded SHA-256 of the Subject Public Key Information (SPKI) of the certificate
 can be generated with the following command:
 .. code-block:: bash
   $ openssl x509 -in path/to/client.crt -noout -pubkey
     | openssl pkey -pubin -outform DER
     | openssl dgst -sha256 -binary
     | openssl enc -base64
   NvqYIYSbgK2vCJpQhObf77vv+bQWtc5ek5RIOwPiC9A=
 This is the format used in HTTP Public Key Pinning.
 When both:
 :ref:`verify_certificate_hash
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>` and
 :ref:`verify_certificate_spki
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_spki>` are specified,
 a hash matching value from either of the lists will result in the certificate being accepted.
 .. attention::
   This option is preferred over :ref:`verify_certificate_hash
   <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>`,
   because SPKI is tied to a private key, so it doesn't change when the certificate
   is renewed using the same private key.
        repeated string verify_certificate_spki = 3 [(.validate.rules) = { ... }

      • clearVerifyCertificateSpki

        public CertificateValidationContext.Builder clearVerifyCertificateSpki()
         An optional list of base64-encoded SHA-256 hashes. If specified, Envoy will verify that the
 SHA-256 of the DER-encoded Subject Public Key Information (SPKI) of the presented certificate
 matches one of the specified values.
 A base64-encoded SHA-256 of the Subject Public Key Information (SPKI) of the certificate
 can be generated with the following command:
 .. code-block:: bash
   $ openssl x509 -in path/to/client.crt -noout -pubkey
     | openssl pkey -pubin -outform DER
     | openssl dgst -sha256 -binary
     | openssl enc -base64
   NvqYIYSbgK2vCJpQhObf77vv+bQWtc5ek5RIOwPiC9A=
 This is the format used in HTTP Public Key Pinning.
 When both:
 :ref:`verify_certificate_hash
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>` and
 :ref:`verify_certificate_spki
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_spki>` are specified,
 a hash matching value from either of the lists will result in the certificate being accepted.
 .. attention::
   This option is preferred over :ref:`verify_certificate_hash
   <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>`,
   because SPKI is tied to a private key, so it doesn't change when the certificate
   is renewed using the same private key.
        repeated string verify_certificate_spki = 3 [(.validate.rules) = { ... }

      • addVerifyCertificateSpkiBytes

        public CertificateValidationContext.Builder addVerifyCertificateSpkiBytes​(com.google.protobuf.ByteString value)
         An optional list of base64-encoded SHA-256 hashes. If specified, Envoy will verify that the
 SHA-256 of the DER-encoded Subject Public Key Information (SPKI) of the presented certificate
 matches one of the specified values.
 A base64-encoded SHA-256 of the Subject Public Key Information (SPKI) of the certificate
 can be generated with the following command:
 .. code-block:: bash
   $ openssl x509 -in path/to/client.crt -noout -pubkey
     | openssl pkey -pubin -outform DER
     | openssl dgst -sha256 -binary
     | openssl enc -base64
   NvqYIYSbgK2vCJpQhObf77vv+bQWtc5ek5RIOwPiC9A=
 This is the format used in HTTP Public Key Pinning.
 When both:
 :ref:`verify_certificate_hash
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>` and
 :ref:`verify_certificate_spki
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_spki>` are specified,
 a hash matching value from either of the lists will result in the certificate being accepted.
 .. attention::
   This option is preferred over :ref:`verify_certificate_hash
   <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>`,
   because SPKI is tied to a private key, so it doesn't change when the certificate
   is renewed using the same private key.
        repeated string verify_certificate_spki = 3 [(.validate.rules) = { ... }

      • getVerifyCertificateHashList

        public com.google.protobuf.ProtocolStringList getVerifyCertificateHashList()
         An optional list of hex-encoded SHA-256 hashes. If specified, Envoy will verify that
 the SHA-256 of the DER-encoded presented certificate matches one of the specified values.
 A hex-encoded SHA-256 of the certificate can be generated with the following command:
 .. code-block:: bash
   $ openssl x509 -in path/to/client.crt -outform DER | openssl dgst -sha256 | cut -d" " -f2
   df6ff72fe9116521268f6f2dd4966f51df479883fe7037b39f75916ac3049d1a
 A long hex-encoded and colon-separated SHA-256 (a.k.a. "fingerprint") of the certificate
 can be generated with the following command:
 .. code-block:: bash
   $ openssl x509 -in path/to/client.crt -noout -fingerprint -sha256 | cut -d"=" -f2
   DF:6F:F7:2F:E9:11:65:21:26:8F:6F:2D:D4:96:6F:51:DF:47:98:83:FE:70:37:B3:9F:75:91:6A:C3:04:9D:1A
 Both of those formats are acceptable.
 When both:
 :ref:`verify_certificate_hash
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>` and
 :ref:`verify_certificate_spki
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_spki>` are specified,
 a hash matching value from either of the lists will result in the certificate being accepted.
        repeated string verify_certificate_hash = 2 [(.validate.rules) = { ... }
        Specified by:
        getVerifyCertificateHashList in interface CertificateValidationContextOrBuilder

      • getVerifyCertificateHashCount

        public int getVerifyCertificateHashCount()
         An optional list of hex-encoded SHA-256 hashes. If specified, Envoy will verify that
 the SHA-256 of the DER-encoded presented certificate matches one of the specified values.
 A hex-encoded SHA-256 of the certificate can be generated with the following command:
 .. code-block:: bash
   $ openssl x509 -in path/to/client.crt -outform DER | openssl dgst -sha256 | cut -d" " -f2
   df6ff72fe9116521268f6f2dd4966f51df479883fe7037b39f75916ac3049d1a
 A long hex-encoded and colon-separated SHA-256 (a.k.a. "fingerprint") of the certificate
 can be generated with the following command:
 .. code-block:: bash
   $ openssl x509 -in path/to/client.crt -noout -fingerprint -sha256 | cut -d"=" -f2
   DF:6F:F7:2F:E9:11:65:21:26:8F:6F:2D:D4:96:6F:51:DF:47:98:83:FE:70:37:B3:9F:75:91:6A:C3:04:9D:1A
 Both of those formats are acceptable.
 When both:
 :ref:`verify_certificate_hash
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>` and
 :ref:`verify_certificate_spki
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_spki>` are specified,
 a hash matching value from either of the lists will result in the certificate being accepted.
        repeated string verify_certificate_hash = 2 [(.validate.rules) = { ... }
        Specified by:
        getVerifyCertificateHashCount in interface CertificateValidationContextOrBuilder

      • getVerifyCertificateHash

        public String getVerifyCertificateHash​(int index)
         An optional list of hex-encoded SHA-256 hashes. If specified, Envoy will verify that
 the SHA-256 of the DER-encoded presented certificate matches one of the specified values.
 A hex-encoded SHA-256 of the certificate can be generated with the following command:
 .. code-block:: bash
   $ openssl x509 -in path/to/client.crt -outform DER | openssl dgst -sha256 | cut -d" " -f2
   df6ff72fe9116521268f6f2dd4966f51df479883fe7037b39f75916ac3049d1a
 A long hex-encoded and colon-separated SHA-256 (a.k.a. "fingerprint") of the certificate
 can be generated with the following command:
 .. code-block:: bash
   $ openssl x509 -in path/to/client.crt -noout -fingerprint -sha256 | cut -d"=" -f2
   DF:6F:F7:2F:E9:11:65:21:26:8F:6F:2D:D4:96:6F:51:DF:47:98:83:FE:70:37:B3:9F:75:91:6A:C3:04:9D:1A
 Both of those formats are acceptable.
 When both:
 :ref:`verify_certificate_hash
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>` and
 :ref:`verify_certificate_spki
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_spki>` are specified,
 a hash matching value from either of the lists will result in the certificate being accepted.
        repeated string verify_certificate_hash = 2 [(.validate.rules) = { ... }
        Specified by:
        getVerifyCertificateHash in interface CertificateValidationContextOrBuilder

      • getVerifyCertificateHashBytes

        public com.google.protobuf.ByteString getVerifyCertificateHashBytes​(int index)
         An optional list of hex-encoded SHA-256 hashes. If specified, Envoy will verify that
 the SHA-256 of the DER-encoded presented certificate matches one of the specified values.
 A hex-encoded SHA-256 of the certificate can be generated with the following command:
 .. code-block:: bash
   $ openssl x509 -in path/to/client.crt -outform DER | openssl dgst -sha256 | cut -d" " -f2
   df6ff72fe9116521268f6f2dd4966f51df479883fe7037b39f75916ac3049d1a
 A long hex-encoded and colon-separated SHA-256 (a.k.a. "fingerprint") of the certificate
 can be generated with the following command:
 .. code-block:: bash
   $ openssl x509 -in path/to/client.crt -noout -fingerprint -sha256 | cut -d"=" -f2
   DF:6F:F7:2F:E9:11:65:21:26:8F:6F:2D:D4:96:6F:51:DF:47:98:83:FE:70:37:B3:9F:75:91:6A:C3:04:9D:1A
 Both of those formats are acceptable.
 When both:
 :ref:`verify_certificate_hash
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>` and
 :ref:`verify_certificate_spki
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_spki>` are specified,
 a hash matching value from either of the lists will result in the certificate being accepted.
        repeated string verify_certificate_hash = 2 [(.validate.rules) = { ... }
        Specified by:
        getVerifyCertificateHashBytes in interface CertificateValidationContextOrBuilder

      • setVerifyCertificateHash

        public CertificateValidationContext.Builder setVerifyCertificateHash​(int index,
                                                                     String value)
         An optional list of hex-encoded SHA-256 hashes. If specified, Envoy will verify that
 the SHA-256 of the DER-encoded presented certificate matches one of the specified values.
 A hex-encoded SHA-256 of the certificate can be generated with the following command:
 .. code-block:: bash
   $ openssl x509 -in path/to/client.crt -outform DER | openssl dgst -sha256 | cut -d" " -f2
   df6ff72fe9116521268f6f2dd4966f51df479883fe7037b39f75916ac3049d1a
 A long hex-encoded and colon-separated SHA-256 (a.k.a. "fingerprint") of the certificate
 can be generated with the following command:
 .. code-block:: bash
   $ openssl x509 -in path/to/client.crt -noout -fingerprint -sha256 | cut -d"=" -f2
   DF:6F:F7:2F:E9:11:65:21:26:8F:6F:2D:D4:96:6F:51:DF:47:98:83:FE:70:37:B3:9F:75:91:6A:C3:04:9D:1A
 Both of those formats are acceptable.
 When both:
 :ref:`verify_certificate_hash
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>` and
 :ref:`verify_certificate_spki
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_spki>` are specified,
 a hash matching value from either of the lists will result in the certificate being accepted.
        repeated string verify_certificate_hash = 2 [(.validate.rules) = { ... }

      • addVerifyCertificateHash

        public CertificateValidationContext.Builder addVerifyCertificateHash​(String value)
         An optional list of hex-encoded SHA-256 hashes. If specified, Envoy will verify that
 the SHA-256 of the DER-encoded presented certificate matches one of the specified values.
 A hex-encoded SHA-256 of the certificate can be generated with the following command:
 .. code-block:: bash
   $ openssl x509 -in path/to/client.crt -outform DER | openssl dgst -sha256 | cut -d" " -f2
   df6ff72fe9116521268f6f2dd4966f51df479883fe7037b39f75916ac3049d1a
 A long hex-encoded and colon-separated SHA-256 (a.k.a. "fingerprint") of the certificate
 can be generated with the following command:
 .. code-block:: bash
   $ openssl x509 -in path/to/client.crt -noout -fingerprint -sha256 | cut -d"=" -f2
   DF:6F:F7:2F:E9:11:65:21:26:8F:6F:2D:D4:96:6F:51:DF:47:98:83:FE:70:37:B3:9F:75:91:6A:C3:04:9D:1A
 Both of those formats are acceptable.
 When both:
 :ref:`verify_certificate_hash
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>` and
 :ref:`verify_certificate_spki
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_spki>` are specified,
 a hash matching value from either of the lists will result in the certificate being accepted.
        repeated string verify_certificate_hash = 2 [(.validate.rules) = { ... }

      • addAllVerifyCertificateHash

        public CertificateValidationContext.Builder addAllVerifyCertificateHash​(Iterable<String> values)
         An optional list of hex-encoded SHA-256 hashes. If specified, Envoy will verify that
 the SHA-256 of the DER-encoded presented certificate matches one of the specified values.
 A hex-encoded SHA-256 of the certificate can be generated with the following command:
 .. code-block:: bash
   $ openssl x509 -in path/to/client.crt -outform DER | openssl dgst -sha256 | cut -d" " -f2
   df6ff72fe9116521268f6f2dd4966f51df479883fe7037b39f75916ac3049d1a
 A long hex-encoded and colon-separated SHA-256 (a.k.a. "fingerprint") of the certificate
 can be generated with the following command:
 .. code-block:: bash
   $ openssl x509 -in path/to/client.crt -noout -fingerprint -sha256 | cut -d"=" -f2
   DF:6F:F7:2F:E9:11:65:21:26:8F:6F:2D:D4:96:6F:51:DF:47:98:83:FE:70:37:B3:9F:75:91:6A:C3:04:9D:1A
 Both of those formats are acceptable.
 When both:
 :ref:`verify_certificate_hash
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>` and
 :ref:`verify_certificate_spki
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_spki>` are specified,
 a hash matching value from either of the lists will result in the certificate being accepted.
        repeated string verify_certificate_hash = 2 [(.validate.rules) = { ... }

      • clearVerifyCertificateHash

        public CertificateValidationContext.Builder clearVerifyCertificateHash()
         An optional list of hex-encoded SHA-256 hashes. If specified, Envoy will verify that
 the SHA-256 of the DER-encoded presented certificate matches one of the specified values.
 A hex-encoded SHA-256 of the certificate can be generated with the following command:
 .. code-block:: bash
   $ openssl x509 -in path/to/client.crt -outform DER | openssl dgst -sha256 | cut -d" " -f2
   df6ff72fe9116521268f6f2dd4966f51df479883fe7037b39f75916ac3049d1a
 A long hex-encoded and colon-separated SHA-256 (a.k.a. "fingerprint") of the certificate
 can be generated with the following command:
 .. code-block:: bash
   $ openssl x509 -in path/to/client.crt -noout -fingerprint -sha256 | cut -d"=" -f2
   DF:6F:F7:2F:E9:11:65:21:26:8F:6F:2D:D4:96:6F:51:DF:47:98:83:FE:70:37:B3:9F:75:91:6A:C3:04:9D:1A
 Both of those formats are acceptable.
 When both:
 :ref:`verify_certificate_hash
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>` and
 :ref:`verify_certificate_spki
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_spki>` are specified,
 a hash matching value from either of the lists will result in the certificate being accepted.
        repeated string verify_certificate_hash = 2 [(.validate.rules) = { ... }

      • addVerifyCertificateHashBytes

        public CertificateValidationContext.Builder addVerifyCertificateHashBytes​(com.google.protobuf.ByteString value)
         An optional list of hex-encoded SHA-256 hashes. If specified, Envoy will verify that
 the SHA-256 of the DER-encoded presented certificate matches one of the specified values.
 A hex-encoded SHA-256 of the certificate can be generated with the following command:
 .. code-block:: bash
   $ openssl x509 -in path/to/client.crt -outform DER | openssl dgst -sha256 | cut -d" " -f2
   df6ff72fe9116521268f6f2dd4966f51df479883fe7037b39f75916ac3049d1a
 A long hex-encoded and colon-separated SHA-256 (a.k.a. "fingerprint") of the certificate
 can be generated with the following command:
 .. code-block:: bash
   $ openssl x509 -in path/to/client.crt -noout -fingerprint -sha256 | cut -d"=" -f2
   DF:6F:F7:2F:E9:11:65:21:26:8F:6F:2D:D4:96:6F:51:DF:47:98:83:FE:70:37:B3:9F:75:91:6A:C3:04:9D:1A
 Both of those formats are acceptable.
 When both:
 :ref:`verify_certificate_hash
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>` and
 :ref:`verify_certificate_spki
 <envoy_api_field_auth.CertificateValidationContext.verify_certificate_spki>` are specified,
 a hash matching value from either of the lists will result in the certificate being accepted.
        repeated string verify_certificate_hash = 2 [(.validate.rules) = { ... }

      • getVerifySubjectAltNameList

        @Deprecated
public com.google.protobuf.ProtocolStringList getVerifySubjectAltNameList()
        Deprecated.
         An optional list of Subject Alternative Names. If specified, Envoy will verify that the
 Subject Alternative Name of the presented certificate matches one of the specified values.
 .. attention::
   Subject Alternative Names are easily spoofable and verifying only them is insecure,
   therefore this option must be used together with :ref:`trusted_ca
   <envoy_api_field_auth.CertificateValidationContext.trusted_ca>`.
        repeated string verify_subject_alt_name = 4 [deprecated = true];
        Specified by:
        getVerifySubjectAltNameList in interface CertificateValidationContextOrBuilder

      • getVerifySubjectAltNameCount

        @Deprecated
public int getVerifySubjectAltNameCount()
        Deprecated.
         An optional list of Subject Alternative Names. If specified, Envoy will verify that the
 Subject Alternative Name of the presented certificate matches one of the specified values.
 .. attention::
   Subject Alternative Names are easily spoofable and verifying only them is insecure,
   therefore this option must be used together with :ref:`trusted_ca
   <envoy_api_field_auth.CertificateValidationContext.trusted_ca>`.
        repeated string verify_subject_alt_name = 4 [deprecated = true];
        Specified by:
        getVerifySubjectAltNameCount in interface CertificateValidationContextOrBuilder

      • getVerifySubjectAltName

        @Deprecated
public String getVerifySubjectAltName​(int index)
        Deprecated.
         An optional list of Subject Alternative Names. If specified, Envoy will verify that the
 Subject Alternative Name of the presented certificate matches one of the specified values.
 .. attention::
   Subject Alternative Names are easily spoofable and verifying only them is insecure,
   therefore this option must be used together with :ref:`trusted_ca
   <envoy_api_field_auth.CertificateValidationContext.trusted_ca>`.
        repeated string verify_subject_alt_name = 4 [deprecated = true];
        Specified by:
        getVerifySubjectAltName in interface CertificateValidationContextOrBuilder

      • getVerifySubjectAltNameBytes

        @Deprecated
public com.google.protobuf.ByteString getVerifySubjectAltNameBytes​(int index)
        Deprecated.
         An optional list of Subject Alternative Names. If specified, Envoy will verify that the
 Subject Alternative Name of the presented certificate matches one of the specified values.
 .. attention::
   Subject Alternative Names are easily spoofable and verifying only them is insecure,
   therefore this option must be used together with :ref:`trusted_ca
   <envoy_api_field_auth.CertificateValidationContext.trusted_ca>`.
        repeated string verify_subject_alt_name = 4 [deprecated = true];
        Specified by:
        getVerifySubjectAltNameBytes in interface CertificateValidationContextOrBuilder

      • setVerifySubjectAltName

        @Deprecated
public CertificateValidationContext.Builder setVerifySubjectAltName​(int index,
                                                                    String value)
        Deprecated.
         An optional list of Subject Alternative Names. If specified, Envoy will verify that the
 Subject Alternative Name of the presented certificate matches one of the specified values.
 .. attention::
   Subject Alternative Names are easily spoofable and verifying only them is insecure,
   therefore this option must be used together with :ref:`trusted_ca
   <envoy_api_field_auth.CertificateValidationContext.trusted_ca>`.
        repeated string verify_subject_alt_name = 4 [deprecated = true];

      • addVerifySubjectAltName

        @Deprecated
public CertificateValidationContext.Builder addVerifySubjectAltName​(String value)
        Deprecated.
         An optional list of Subject Alternative Names. If specified, Envoy will verify that the
 Subject Alternative Name of the presented certificate matches one of the specified values.
 .. attention::
   Subject Alternative Names are easily spoofable and verifying only them is insecure,
   therefore this option must be used together with :ref:`trusted_ca
   <envoy_api_field_auth.CertificateValidationContext.trusted_ca>`.
        repeated string verify_subject_alt_name = 4 [deprecated = true];

      • addAllVerifySubjectAltName

        @Deprecated
public CertificateValidationContext.Builder addAllVerifySubjectAltName​(Iterable<String> values)
        Deprecated.
         An optional list of Subject Alternative Names. If specified, Envoy will verify that the
 Subject Alternative Name of the presented certificate matches one of the specified values.
 .. attention::
   Subject Alternative Names are easily spoofable and verifying only them is insecure,
   therefore this option must be used together with :ref:`trusted_ca
   <envoy_api_field_auth.CertificateValidationContext.trusted_ca>`.
        repeated string verify_subject_alt_name = 4 [deprecated = true];

      • clearVerifySubjectAltName

        @Deprecated
public CertificateValidationContext.Builder clearVerifySubjectAltName()
        Deprecated.
         An optional list of Subject Alternative Names. If specified, Envoy will verify that the
 Subject Alternative Name of the presented certificate matches one of the specified values.
 .. attention::
   Subject Alternative Names are easily spoofable and verifying only them is insecure,
   therefore this option must be used together with :ref:`trusted_ca
   <envoy_api_field_auth.CertificateValidationContext.trusted_ca>`.
        repeated string verify_subject_alt_name = 4 [deprecated = true];

      • addVerifySubjectAltNameBytes

        @Deprecated
public CertificateValidationContext.Builder addVerifySubjectAltNameBytes​(com.google.protobuf.ByteString value)
        Deprecated.
         An optional list of Subject Alternative Names. If specified, Envoy will verify that the
 Subject Alternative Name of the presented certificate matches one of the specified values.
 .. attention::
   Subject Alternative Names are easily spoofable and verifying only them is insecure,
   therefore this option must be used together with :ref:`trusted_ca
   <envoy_api_field_auth.CertificateValidationContext.trusted_ca>`.
        repeated string verify_subject_alt_name = 4 [deprecated = true];

      • getMatchSubjectAltNamesList

        public List<StringMatcher> getMatchSubjectAltNamesList()
         An optional list of Subject Alternative name matchers. Envoy will verify that the
 Subject Alternative Name of the presented certificate matches one of the specified matches.
 When a certificate has wildcard DNS SAN entries, to match a specific client, it should be
 configured with exact match type in the :ref:`string matcher <envoy_api_msg_type.matcher.StringMatcher>`.
 For example if the certificate has "\*.example.com" as DNS SAN entry, to allow only "api.example.com",
 it should be configured as shown below.
 .. code-block:: yaml
  match_subject_alt_names:
    exact: "api.example.com"
 .. attention::
   Subject Alternative Names are easily spoofable and verifying only them is insecure,
   therefore this option must be used together with :ref:`trusted_ca
   <envoy_api_field_auth.CertificateValidationContext.trusted_ca>`.
        repeated .envoy.type.matcher.StringMatcher match_subject_alt_names = 9;
        Specified by:
        getMatchSubjectAltNamesList in interface CertificateValidationContextOrBuilder

      • getMatchSubjectAltNamesCount

        public int getMatchSubjectAltNamesCount()
         An optional list of Subject Alternative name matchers. Envoy will verify that the
 Subject Alternative Name of the presented certificate matches one of the specified matches.
 When a certificate has wildcard DNS SAN entries, to match a specific client, it should be
 configured with exact match type in the :ref:`string matcher <envoy_api_msg_type.matcher.StringMatcher>`.
 For example if the certificate has "\*.example.com" as DNS SAN entry, to allow only "api.example.com",
 it should be configured as shown below.
 .. code-block:: yaml
  match_subject_alt_names:
    exact: "api.example.com"
 .. attention::
   Subject Alternative Names are easily spoofable and verifying only them is insecure,
   therefore this option must be used together with :ref:`trusted_ca
   <envoy_api_field_auth.CertificateValidationContext.trusted_ca>`.
        repeated .envoy.type.matcher.StringMatcher match_subject_alt_names = 9;
        Specified by:
        getMatchSubjectAltNamesCount in interface CertificateValidationContextOrBuilder

      • getMatchSubjectAltNames

        public StringMatcher getMatchSubjectAltNames​(int index)
         An optional list of Subject Alternative name matchers. Envoy will verify that the
 Subject Alternative Name of the presented certificate matches one of the specified matches.
 When a certificate has wildcard DNS SAN entries, to match a specific client, it should be
 configured with exact match type in the :ref:`string matcher <envoy_api_msg_type.matcher.StringMatcher>`.
 For example if the certificate has "\*.example.com" as DNS SAN entry, to allow only "api.example.com",
 it should be configured as shown below.
 .. code-block:: yaml
  match_subject_alt_names:
    exact: "api.example.com"
 .. attention::
   Subject Alternative Names are easily spoofable and verifying only them is insecure,
   therefore this option must be used together with :ref:`trusted_ca
   <envoy_api_field_auth.CertificateValidationContext.trusted_ca>`.
        repeated .envoy.type.matcher.StringMatcher match_subject_alt_names = 9;
        Specified by:
        getMatchSubjectAltNames in interface CertificateValidationContextOrBuilder

      • setMatchSubjectAltNames

        public CertificateValidationContext.Builder setMatchSubjectAltNames​(int index,
                                                                    StringMatcher value)
         An optional list of Subject Alternative name matchers. Envoy will verify that the
 Subject Alternative Name of the presented certificate matches one of the specified matches.
 When a certificate has wildcard DNS SAN entries, to match a specific client, it should be
 configured with exact match type in the :ref:`string matcher <envoy_api_msg_type.matcher.StringMatcher>`.
 For example if the certificate has "\*.example.com" as DNS SAN entry, to allow only "api.example.com",
 it should be configured as shown below.
 .. code-block:: yaml
  match_subject_alt_names:
    exact: "api.example.com"
 .. attention::
   Subject Alternative Names are easily spoofable and verifying only them is insecure,
   therefore this option must be used together with :ref:`trusted_ca
   <envoy_api_field_auth.CertificateValidationContext.trusted_ca>`.
        repeated .envoy.type.matcher.StringMatcher match_subject_alt_names = 9;

      • setMatchSubjectAltNames

        public CertificateValidationContext.Builder setMatchSubjectAltNames​(int index,
                                                                    StringMatcher.Builder builderForValue)
         An optional list of Subject Alternative name matchers. Envoy will verify that the
 Subject Alternative Name of the presented certificate matches one of the specified matches.
 When a certificate has wildcard DNS SAN entries, to match a specific client, it should be
 configured with exact match type in the :ref:`string matcher <envoy_api_msg_type.matcher.StringMatcher>`.
 For example if the certificate has "\*.example.com" as DNS SAN entry, to allow only "api.example.com",
 it should be configured as shown below.
 .. code-block:: yaml
  match_subject_alt_names:
    exact: "api.example.com"
 .. attention::
   Subject Alternative Names are easily spoofable and verifying only them is insecure,
   therefore this option must be used together with :ref:`trusted_ca
   <envoy_api_field_auth.CertificateValidationContext.trusted_ca>`.
        repeated .envoy.type.matcher.StringMatcher match_subject_alt_names = 9;

      • addMatchSubjectAltNames

        public CertificateValidationContext.Builder addMatchSubjectAltNames​(StringMatcher value)
         An optional list of Subject Alternative name matchers. Envoy will verify that the
 Subject Alternative Name of the presented certificate matches one of the specified matches.
 When a certificate has wildcard DNS SAN entries, to match a specific client, it should be
 configured with exact match type in the :ref:`string matcher <envoy_api_msg_type.matcher.StringMatcher>`.
 For example if the certificate has "\*.example.com" as DNS SAN entry, to allow only "api.example.com",
 it should be configured as shown below.
 .. code-block:: yaml
  match_subject_alt_names:
    exact: "api.example.com"
 .. attention::
   Subject Alternative Names are easily spoofable and verifying only them is insecure,
   therefore this option must be used together with :ref:`trusted_ca
   <envoy_api_field_auth.CertificateValidationContext.trusted_ca>`.
        repeated .envoy.type.matcher.StringMatcher match_subject_alt_names = 9;

      • addMatchSubjectAltNames

        public CertificateValidationContext.Builder addMatchSubjectAltNames​(int index,
                                                                    StringMatcher value)
         An optional list of Subject Alternative name matchers. Envoy will verify that the
 Subject Alternative Name of the presented certificate matches one of the specified matches.
 When a certificate has wildcard DNS SAN entries, to match a specific client, it should be
 configured with exact match type in the :ref:`string matcher <envoy_api_msg_type.matcher.StringMatcher>`.
 For example if the certificate has "\*.example.com" as DNS SAN entry, to allow only "api.example.com",
 it should be configured as shown below.
 .. code-block:: yaml
  match_subject_alt_names:
    exact: "api.example.com"
 .. attention::
   Subject Alternative Names are easily spoofable and verifying only them is insecure,
   therefore this option must be used together with :ref:`trusted_ca
   <envoy_api_field_auth.CertificateValidationContext.trusted_ca>`.
        repeated .envoy.type.matcher.StringMatcher match_subject_alt_names = 9;

      • addMatchSubjectAltNames

        public CertificateValidationContext.Builder addMatchSubjectAltNames​(StringMatcher.Builder builderForValue)
         An optional list of Subject Alternative name matchers. Envoy will verify that the
 Subject Alternative Name of the presented certificate matches one of the specified matches.
 When a certificate has wildcard DNS SAN entries, to match a specific client, it should be
 configured with exact match type in the :ref:`string matcher <envoy_api_msg_type.matcher.StringMatcher>`.
 For example if the certificate has "\*.example.com" as DNS SAN entry, to allow only "api.example.com",
 it should be configured as shown below.
 .. code-block:: yaml
  match_subject_alt_names:
    exact: "api.example.com"
 .. attention::
   Subject Alternative Names are easily spoofable and verifying only them is insecure,
   therefore this option must be used together with :ref:`trusted_ca
   <envoy_api_field_auth.CertificateValidationContext.trusted_ca>`.
        repeated .envoy.type.matcher.StringMatcher match_subject_alt_names = 9;

      • addMatchSubjectAltNames

        public CertificateValidationContext.Builder addMatchSubjectAltNames​(int index,
                                                                    StringMatcher.Builder builderForValue)
         An optional list of Subject Alternative name matchers. Envoy will verify that the
 Subject Alternative Name of the presented certificate matches one of the specified matches.
 When a certificate has wildcard DNS SAN entries, to match a specific client, it should be
 configured with exact match type in the :ref:`string matcher <envoy_api_msg_type.matcher.StringMatcher>`.
 For example if the certificate has "\*.example.com" as DNS SAN entry, to allow only "api.example.com",
 it should be configured as shown below.
 .. code-block:: yaml
  match_subject_alt_names:
    exact: "api.example.com"
 .. attention::
   Subject Alternative Names are easily spoofable and verifying only them is insecure,
   therefore this option must be used together with :ref:`trusted_ca
   <envoy_api_field_auth.CertificateValidationContext.trusted_ca>`.
        repeated .envoy.type.matcher.StringMatcher match_subject_alt_names = 9;

      • addAllMatchSubjectAltNames

        public CertificateValidationContext.Builder addAllMatchSubjectAltNames​(Iterable<? extends StringMatcher> values)
         An optional list of Subject Alternative name matchers. Envoy will verify that the
 Subject Alternative Name of the presented certificate matches one of the specified matches.
 When a certificate has wildcard DNS SAN entries, to match a specific client, it should be
 configured with exact match type in the :ref:`string matcher <envoy_api_msg_type.matcher.StringMatcher>`.
 For example if the certificate has "\*.example.com" as DNS SAN entry, to allow only "api.example.com",
 it should be configured as shown below.
 .. code-block:: yaml
  match_subject_alt_names:
    exact: "api.example.com"
 .. attention::
   Subject Alternative Names are easily spoofable and verifying only them is insecure,
   therefore this option must be used together with :ref:`trusted_ca
   <envoy_api_field_auth.CertificateValidationContext.trusted_ca>`.
        repeated .envoy.type.matcher.StringMatcher match_subject_alt_names = 9;

      • clearMatchSubjectAltNames

        public CertificateValidationContext.Builder clearMatchSubjectAltNames()
         An optional list of Subject Alternative name matchers. Envoy will verify that the
 Subject Alternative Name of the presented certificate matches one of the specified matches.
 When a certificate has wildcard DNS SAN entries, to match a specific client, it should be
 configured with exact match type in the :ref:`string matcher <envoy_api_msg_type.matcher.StringMatcher>`.
 For example if the certificate has "\*.example.com" as DNS SAN entry, to allow only "api.example.com",
 it should be configured as shown below.
 .. code-block:: yaml
  match_subject_alt_names:
    exact: "api.example.com"
 .. attention::
   Subject Alternative Names are easily spoofable and verifying only them is insecure,
   therefore this option must be used together with :ref:`trusted_ca
   <envoy_api_field_auth.CertificateValidationContext.trusted_ca>`.
        repeated .envoy.type.matcher.StringMatcher match_subject_alt_names = 9;

      • removeMatchSubjectAltNames

        public CertificateValidationContext.Builder removeMatchSubjectAltNames​(int index)
         An optional list of Subject Alternative name matchers. Envoy will verify that the
 Subject Alternative Name of the presented certificate matches one of the specified matches.
 When a certificate has wildcard DNS SAN entries, to match a specific client, it should be
 configured with exact match type in the :ref:`string matcher <envoy_api_msg_type.matcher.StringMatcher>`.
 For example if the certificate has "\*.example.com" as DNS SAN entry, to allow only "api.example.com",
 it should be configured as shown below.
 .. code-block:: yaml
  match_subject_alt_names:
    exact: "api.example.com"
 .. attention::
   Subject Alternative Names are easily spoofable and verifying only them is insecure,
   therefore this option must be used together with :ref:`trusted_ca
   <envoy_api_field_auth.CertificateValidationContext.trusted_ca>`.
        repeated .envoy.type.matcher.StringMatcher match_subject_alt_names = 9;

      • getMatchSubjectAltNamesBuilder

        public StringMatcher.Builder getMatchSubjectAltNamesBuilder​(int index)
         An optional list of Subject Alternative name matchers. Envoy will verify that the
 Subject Alternative Name of the presented certificate matches one of the specified matches.
 When a certificate has wildcard DNS SAN entries, to match a specific client, it should be
 configured with exact match type in the :ref:`string matcher <envoy_api_msg_type.matcher.StringMatcher>`.
 For example if the certificate has "\*.example.com" as DNS SAN entry, to allow only "api.example.com",
 it should be configured as shown below.
 .. code-block:: yaml
  match_subject_alt_names:
    exact: "api.example.com"
 .. attention::
   Subject Alternative Names are easily spoofable and verifying only them is insecure,
   therefore this option must be used together with :ref:`trusted_ca
   <envoy_api_field_auth.CertificateValidationContext.trusted_ca>`.
        repeated .envoy.type.matcher.StringMatcher match_subject_alt_names = 9;

      • getMatchSubjectAltNamesOrBuilder

        public StringMatcherOrBuilder getMatchSubjectAltNamesOrBuilder​(int index)
         An optional list of Subject Alternative name matchers. Envoy will verify that the
 Subject Alternative Name of the presented certificate matches one of the specified matches.
 When a certificate has wildcard DNS SAN entries, to match a specific client, it should be
 configured with exact match type in the :ref:`string matcher <envoy_api_msg_type.matcher.StringMatcher>`.
 For example if the certificate has "\*.example.com" as DNS SAN entry, to allow only "api.example.com",
 it should be configured as shown below.
 .. code-block:: yaml
  match_subject_alt_names:
    exact: "api.example.com"
 .. attention::
   Subject Alternative Names are easily spoofable and verifying only them is insecure,
   therefore this option must be used together with :ref:`trusted_ca
   <envoy_api_field_auth.CertificateValidationContext.trusted_ca>`.
        repeated .envoy.type.matcher.StringMatcher match_subject_alt_names = 9;
        Specified by:
        getMatchSubjectAltNamesOrBuilder in interface CertificateValidationContextOrBuilder

      • getMatchSubjectAltNamesOrBuilderList

        public List<? extends StringMatcherOrBuilder> getMatchSubjectAltNamesOrBuilderList()
         An optional list of Subject Alternative name matchers. Envoy will verify that the
 Subject Alternative Name of the presented certificate matches one of the specified matches.
 When a certificate has wildcard DNS SAN entries, to match a specific client, it should be
 configured with exact match type in the :ref:`string matcher <envoy_api_msg_type.matcher.StringMatcher>`.
 For example if the certificate has "\*.example.com" as DNS SAN entry, to allow only "api.example.com",
 it should be configured as shown below.
 .. code-block:: yaml
  match_subject_alt_names:
    exact: "api.example.com"
 .. attention::
   Subject Alternative Names are easily spoofable and verifying only them is insecure,
   therefore this option must be used together with :ref:`trusted_ca
   <envoy_api_field_auth.CertificateValidationContext.trusted_ca>`.
        repeated .envoy.type.matcher.StringMatcher match_subject_alt_names = 9;
        Specified by:
        getMatchSubjectAltNamesOrBuilderList in interface CertificateValidationContextOrBuilder

      • addMatchSubjectAltNamesBuilder

        public StringMatcher.Builder addMatchSubjectAltNamesBuilder()
         An optional list of Subject Alternative name matchers. Envoy will verify that the
 Subject Alternative Name of the presented certificate matches one of the specified matches.
 When a certificate has wildcard DNS SAN entries, to match a specific client, it should be
 configured with exact match type in the :ref:`string matcher <envoy_api_msg_type.matcher.StringMatcher>`.
 For example if the certificate has "\*.example.com" as DNS SAN entry, to allow only "api.example.com",
 it should be configured as shown below.
 .. code-block:: yaml
  match_subject_alt_names:
    exact: "api.example.com"
 .. attention::
   Subject Alternative Names are easily spoofable and verifying only them is insecure,
   therefore this option must be used together with :ref:`trusted_ca
   <envoy_api_field_auth.CertificateValidationContext.trusted_ca>`.
        repeated .envoy.type.matcher.StringMatcher match_subject_alt_names = 9;

      • addMatchSubjectAltNamesBuilder

        public StringMatcher.Builder addMatchSubjectAltNamesBuilder​(int index)
         An optional list of Subject Alternative name matchers. Envoy will verify that the
 Subject Alternative Name of the presented certificate matches one of the specified matches.
 When a certificate has wildcard DNS SAN entries, to match a specific client, it should be
 configured with exact match type in the :ref:`string matcher <envoy_api_msg_type.matcher.StringMatcher>`.
 For example if the certificate has "\*.example.com" as DNS SAN entry, to allow only "api.example.com",
 it should be configured as shown below.
 .. code-block:: yaml
  match_subject_alt_names:
    exact: "api.example.com"
 .. attention::
   Subject Alternative Names are easily spoofable and verifying only them is insecure,
   therefore this option must be used together with :ref:`trusted_ca
   <envoy_api_field_auth.CertificateValidationContext.trusted_ca>`.
        repeated .envoy.type.matcher.StringMatcher match_subject_alt_names = 9;

      • getMatchSubjectAltNamesBuilderList

        public List<StringMatcher.Builder> getMatchSubjectAltNamesBuilderList()
         An optional list of Subject Alternative name matchers. Envoy will verify that the
 Subject Alternative Name of the presented certificate matches one of the specified matches.
 When a certificate has wildcard DNS SAN entries, to match a specific client, it should be
 configured with exact match type in the :ref:`string matcher <envoy_api_msg_type.matcher.StringMatcher>`.
 For example if the certificate has "\*.example.com" as DNS SAN entry, to allow only "api.example.com",
 it should be configured as shown below.
 .. code-block:: yaml
  match_subject_alt_names:
    exact: "api.example.com"
 .. attention::
   Subject Alternative Names are easily spoofable and verifying only them is insecure,
   therefore this option must be used together with :ref:`trusted_ca
   <envoy_api_field_auth.CertificateValidationContext.trusted_ca>`.
        repeated .envoy.type.matcher.StringMatcher match_subject_alt_names = 9;

      • getRequireOcspStaple

        public com.google.protobuf.BoolValue getRequireOcspStaple()
         [#not-implemented-hide:] Must present a signed time-stamped OCSP response.
        .google.protobuf.BoolValue require_ocsp_staple = 5;
        Specified by:
        getRequireOcspStaple in interface CertificateValidationContextOrBuilder

      • setRequireOcspStaple

        public CertificateValidationContext.Builder setRequireOcspStaple​(com.google.protobuf.BoolValue value)
         [#not-implemented-hide:] Must present a signed time-stamped OCSP response.
        .google.protobuf.BoolValue require_ocsp_staple = 5;

      • setRequireOcspStaple

        public CertificateValidationContext.Builder setRequireOcspStaple​(com.google.protobuf.BoolValue.Builder builderForValue)
         [#not-implemented-hide:] Must present a signed time-stamped OCSP response.
        .google.protobuf.BoolValue require_ocsp_staple = 5;

      • mergeRequireOcspStaple

        public CertificateValidationContext.Builder mergeRequireOcspStaple​(com.google.protobuf.BoolValue value)
         [#not-implemented-hide:] Must present a signed time-stamped OCSP response.
        .google.protobuf.BoolValue require_ocsp_staple = 5;

      • clearRequireOcspStaple

        public CertificateValidationContext.Builder clearRequireOcspStaple()
         [#not-implemented-hide:] Must present a signed time-stamped OCSP response.
        .google.protobuf.BoolValue require_ocsp_staple = 5;

      • getRequireOcspStapleBuilder

        public com.google.protobuf.BoolValue.Builder getRequireOcspStapleBuilder()
         [#not-implemented-hide:] Must present a signed time-stamped OCSP response.
        .google.protobuf.BoolValue require_ocsp_staple = 5;

      • getRequireOcspStapleOrBuilder

        public com.google.protobuf.BoolValueOrBuilder getRequireOcspStapleOrBuilder()
         [#not-implemented-hide:] Must present a signed time-stamped OCSP response.
        .google.protobuf.BoolValue require_ocsp_staple = 5;
        Specified by:
        getRequireOcspStapleOrBuilder in interface CertificateValidationContextOrBuilder

      • setRequireSignedCertificateTimestamp

        public CertificateValidationContext.Builder setRequireSignedCertificateTimestamp​(com.google.protobuf.BoolValue value)
         [#not-implemented-hide:] Must present signed certificate time-stamp.
        .google.protobuf.BoolValue require_signed_certificate_timestamp = 6;

      • setRequireSignedCertificateTimestamp

        public CertificateValidationContext.Builder setRequireSignedCertificateTimestamp​(com.google.protobuf.BoolValue.Builder builderForValue)
         [#not-implemented-hide:] Must present signed certificate time-stamp.
        .google.protobuf.BoolValue require_signed_certificate_timestamp = 6;

      • mergeRequireSignedCertificateTimestamp

        public CertificateValidationContext.Builder mergeRequireSignedCertificateTimestamp​(com.google.protobuf.BoolValue value)
         [#not-implemented-hide:] Must present signed certificate time-stamp.
        .google.protobuf.BoolValue require_signed_certificate_timestamp = 6;

      • clearRequireSignedCertificateTimestamp

        public CertificateValidationContext.Builder clearRequireSignedCertificateTimestamp()
         [#not-implemented-hide:] Must present signed certificate time-stamp.
        .google.protobuf.BoolValue require_signed_certificate_timestamp = 6;

      • getRequireSignedCertificateTimestampBuilder

        public com.google.protobuf.BoolValue.Builder getRequireSignedCertificateTimestampBuilder()
         [#not-implemented-hide:] Must present signed certificate time-stamp.
        .google.protobuf.BoolValue require_signed_certificate_timestamp = 6;

      • hasCrl

        public boolean hasCrl()
         An optional `certificate revocation list
 <https://en.wikipedia.org/wiki/Certificate_revocation_list>`_
 (in PEM format). If specified, Envoy will verify that the presented peer
 certificate has not been revoked by this CRL. If this DataSource contains
 multiple CRLs, all of them will be used.
        .envoy.api.v2.core.DataSource crl = 7;
        Specified by:
        hasCrl in interface CertificateValidationContextOrBuilder

      • getCrl

        public DataSource getCrl()
         An optional `certificate revocation list
 <https://en.wikipedia.org/wiki/Certificate_revocation_list>`_
 (in PEM format). If specified, Envoy will verify that the presented peer
 certificate has not been revoked by this CRL. If this DataSource contains
 multiple CRLs, all of them will be used.
        .envoy.api.v2.core.DataSource crl = 7;
        Specified by:
        getCrl in interface CertificateValidationContextOrBuilder

      • setCrl

        public CertificateValidationContext.Builder setCrl​(DataSource value)
         An optional `certificate revocation list
 <https://en.wikipedia.org/wiki/Certificate_revocation_list>`_
 (in PEM format). If specified, Envoy will verify that the presented peer
 certificate has not been revoked by this CRL. If this DataSource contains
 multiple CRLs, all of them will be used.
        .envoy.api.v2.core.DataSource crl = 7;

      • setCrl

        public CertificateValidationContext.Builder setCrl​(DataSource.Builder builderForValue)
         An optional `certificate revocation list
 <https://en.wikipedia.org/wiki/Certificate_revocation_list>`_
 (in PEM format). If specified, Envoy will verify that the presented peer
 certificate has not been revoked by this CRL. If this DataSource contains
 multiple CRLs, all of them will be used.
        .envoy.api.v2.core.DataSource crl = 7;

      • mergeCrl

        public CertificateValidationContext.Builder mergeCrl​(DataSource value)
         An optional `certificate revocation list
 <https://en.wikipedia.org/wiki/Certificate_revocation_list>`_
 (in PEM format). If specified, Envoy will verify that the presented peer
 certificate has not been revoked by this CRL. If this DataSource contains
 multiple CRLs, all of them will be used.
        .envoy.api.v2.core.DataSource crl = 7;

      • clearCrl

        public CertificateValidationContext.Builder clearCrl()
         An optional `certificate revocation list
 <https://en.wikipedia.org/wiki/Certificate_revocation_list>`_
 (in PEM format). If specified, Envoy will verify that the presented peer
 certificate has not been revoked by this CRL. If this DataSource contains
 multiple CRLs, all of them will be used.
        .envoy.api.v2.core.DataSource crl = 7;

      • getCrlBuilder

        public DataSource.Builder getCrlBuilder()
         An optional `certificate revocation list
 <https://en.wikipedia.org/wiki/Certificate_revocation_list>`_
 (in PEM format). If specified, Envoy will verify that the presented peer
 certificate has not been revoked by this CRL. If this DataSource contains
 multiple CRLs, all of them will be used.
        .envoy.api.v2.core.DataSource crl = 7;

      • getCrlOrBuilder

        public DataSourceOrBuilder getCrlOrBuilder()
         An optional `certificate revocation list
 <https://en.wikipedia.org/wiki/Certificate_revocation_list>`_
 (in PEM format). If specified, Envoy will verify that the presented peer
 certificate has not been revoked by this CRL. If this DataSource contains
 multiple CRLs, all of them will be used.
        .envoy.api.v2.core.DataSource crl = 7;
        Specified by:
        getCrlOrBuilder in interface CertificateValidationContextOrBuilder

      • setAllowExpiredCertificate

        public CertificateValidationContext.Builder setAllowExpiredCertificate​(boolean value)
         If specified, Envoy will not reject expired certificates.
        bool allow_expired_certificate = 8;

      • clearAllowExpiredCertificate

        public CertificateValidationContext.Builder clearAllowExpiredCertificate()
         If specified, Envoy will not reject expired certificates.
        bool allow_expired_certificate = 8;

      • getTrustChainVerificationValue

        public int getTrustChainVerificationValue()
         Certificate trust chain verification mode.
        .envoy.api.v2.auth.CertificateValidationContext.TrustChainVerification trust_chain_verification = 10 [(.validate.rules) = { ... }
        Specified by:
        getTrustChainVerificationValue in interface CertificateValidationContextOrBuilder

      • setTrustChainVerificationValue

        public CertificateValidationContext.Builder setTrustChainVerificationValue​(int value)
         Certificate trust chain verification mode.
        .envoy.api.v2.auth.CertificateValidationContext.TrustChainVerification trust_chain_verification = 10 [(.validate.rules) = { ... }

      • clearTrustChainVerification

        public CertificateValidationContext.Builder clearTrustChainVerification()
         Certificate trust chain verification mode.
        .envoy.api.v2.auth.CertificateValidationContext.TrustChainVerification trust_chain_verification = 10 [(.validate.rules) = { ... }