public class

CertPathValidatorUtilities

extends Object
java.lang.Object
   ↳ org.bouncycastle.jce.provider.CertPathValidatorUtilities
Known Direct Subclasses

Summary

Constants
String ANY_POLICY
int CRL_SIGN
int KEY_CERT_SIGN
Fields
protected static final String AUTHORITY_KEY_IDENTIFIER
protected static final String BASIC_CONSTRAINTS
protected static final String CERTIFICATE_POLICIES
protected static final String CRL_DISTRIBUTION_POINTS
protected static final String CRL_NUMBER
protected static final PKIXCRLUtil CRL_UTIL
protected static final String DELTA_CRL_INDICATOR
protected static final String FRESHEST_CRL
protected static final String INHIBIT_ANY_POLICY
protected static final String ISSUING_DISTRIBUTION_POINT
protected static final String KEY_USAGE
protected static final String NAME_CONSTRAINTS
protected static final String POLICY_CONSTRAINTS
protected static final String POLICY_MAPPINGS
protected static final String SUBJECT_ALTERNATIVE_NAME
protected static final String[] crlReasons
Public Constructors
CertPathValidatorUtilities()
Protected Methods
static void addAdditionalStoreFromLocation(String location, ExtendedPKIXParameters pkixParams)
static void addAdditionalStoresFromAltNames(X509Certificate cert, ExtendedPKIXParameters pkixParams)
static void addAdditionalStoresFromCRLDistributionPoint(CRLDistPoint crldp, ExtendedPKIXParameters pkixParams)
static Collection findCertificates(X509CertStoreSelector certSelect, List certStores)
Return a Collection of all certificates or attribute certificates found in the X509Store's that are matching the certSelect criteriums.
static Collection findCertificates(X509AttributeCertStoreSelector certSelect, List certStores)
static Collection findIssuerCerts(X509Certificate cert, ExtendedPKIXBuilderParameters pkixParams)
Find the issuer certificates of a given certificate.
static TrustAnchor findTrustAnchor(X509Certificate cert, Set trustAnchors)
Search the given Set of TrustAnchor's for one that is the issuer of the given X509 certificate.
static TrustAnchor findTrustAnchor(X509Certificate cert, Set trustAnchors, String sigProvider)
Search the given Set of TrustAnchor's for one that is the issuer of the given X509 certificate.
static AlgorithmIdentifier getAlgorithmIdentifier(PublicKey key)
static void getCRLIssuersFromDistributionPoint(DistributionPoint dp, Collection issuerPrincipals, X509CRLSelector selector, ExtendedPKIXParameters pkixParams)
Add the CRL issuers from the cRLIssuer field of the distribution point or from the certificate if not given to the issuer criterion of the selector.
static void getCertStatus(Date validDate, X509CRL crl, Object cert, CertStatus certStatus)
static Set getCompleteCRLs(DistributionPoint dp, Object cert, Date currentDate, ExtendedPKIXParameters paramsPKIX)
Fetches complete CRLs according to RFC 3280.
static Set getDeltaCRLs(Date currentDate, ExtendedPKIXParameters paramsPKIX, X509CRL completeCRL)
Fetches delta CRLs according to RFC 3280 section 5.2.4.
static X500Principal getEncodedIssuerPrincipal(Object cert)
Returns the issuer of an attribute certificate or certificate.
static DERObject getExtensionValue(X509Extension ext, String oid)
Extract the value of the given extension, if it exists.
static X500Principal getIssuerPrincipal(X509CRL crl)
static PublicKey getNextWorkingKey(List certs, int index)
Return the next working key inheriting DSA parameters if necessary.
final static Set getQualifierSet(ASN1Sequence qualifiers)
static X500Principal getSubjectPrincipal(X509Certificate cert)
static Date getValidCertDateFromValidityModel(ExtendedPKIXParameters paramsPKIX, CertPath certPath, int index)
static Date getValidDate(PKIXParameters paramsPKIX)
static boolean isAnyPolicy(Set policySet)
static boolean isSelfIssued(X509Certificate cert)
static void prepareNextCertB1(int i, List[] policyNodes, String id_p, Map m_idp, X509Certificate cert)
static PKIXPolicyNode prepareNextCertB2(int i, List[] policyNodes, String id_p, PKIXPolicyNode validPolicyTree)
static boolean processCertD1i(int index, List[] policyNodes, DERObjectIdentifier pOid, Set pq)
static void processCertD1ii(int index, List[] policyNodes, DERObjectIdentifier _poid, Set _pq)
static PKIXPolicyNode removePolicyNode(PKIXPolicyNode validPolicyTree, List[] policyNodes, PKIXPolicyNode _node)
static void verifyX509Certificate(X509Certificate cert, PublicKey publicKey, String sigProvider)
[Expand]
Inherited Methods
From class java.lang.Object

Constants

protected static final String ANY_POLICY

Constant Value: "2.5.29.32.0"

protected static final int CRL_SIGN

Constant Value: 6 (0x00000006)

protected static final int KEY_CERT_SIGN

Constant Value: 5 (0x00000005)

Fields

protected static final String AUTHORITY_KEY_IDENTIFIER

protected static final String BASIC_CONSTRAINTS

protected static final String CERTIFICATE_POLICIES

protected static final String CRL_DISTRIBUTION_POINTS

protected static final String CRL_NUMBER

protected static final PKIXCRLUtil CRL_UTIL

protected static final String DELTA_CRL_INDICATOR

protected static final String FRESHEST_CRL

protected static final String INHIBIT_ANY_POLICY

protected static final String ISSUING_DISTRIBUTION_POINT

protected static final String KEY_USAGE

protected static final String NAME_CONSTRAINTS

protected static final String POLICY_CONSTRAINTS

protected static final String POLICY_MAPPINGS

protected static final String SUBJECT_ALTERNATIVE_NAME

protected static final String[] crlReasons

Public Constructors

public CertPathValidatorUtilities ()

Protected Methods

protected static void addAdditionalStoreFromLocation (String location, ExtendedPKIXParameters pkixParams)

protected static void addAdditionalStoresFromAltNames (X509Certificate cert, ExtendedPKIXParameters pkixParams)

Throws
CertificateParsingException

protected static void addAdditionalStoresFromCRLDistributionPoint (CRLDistPoint crldp, ExtendedPKIXParameters pkixParams)

Throws
AnnotatedException

protected static Collection findCertificates (X509CertStoreSelector certSelect, List certStores)

Return a Collection of all certificates or attribute certificates found in the X509Store's that are matching the certSelect criteriums.

Parameters
certSelect a Selector object that will be used to select the certificates
certStores a List containing only X509Store objects. These are used to search for certificates.
Returns
Throws
AnnotatedException

protected static Collection findCertificates (X509AttributeCertStoreSelector certSelect, List certStores)

Throws
AnnotatedException

protected static Collection findIssuerCerts (X509Certificate cert, ExtendedPKIXBuilderParameters pkixParams)

Find the issuer certificates of a given certificate.

Parameters
cert The certificate for which an issuer should be found.
Returns
  • A Collection object containing the issuer X509Certificates. Never null.
Throws
AnnotatedException if an error occurs.

protected static TrustAnchor findTrustAnchor (X509Certificate cert, Set trustAnchors)

Search the given Set of TrustAnchor's for one that is the issuer of the given X509 certificate. Uses the default provider for signature verification.

Parameters
cert the X509 certificate
trustAnchors a Set of TrustAnchor's
Returns
  • the TrustAnchor object if found or null if not.
Throws
AnnotatedException if a TrustAnchor was found but the signature verification on the given certificate has thrown an exception.

protected static TrustAnchor findTrustAnchor (X509Certificate cert, Set trustAnchors, String sigProvider)

Search the given Set of TrustAnchor's for one that is the issuer of the given X509 certificate. Uses the specified provider for signature verification, or the default provider if null.

Parameters
cert the X509 certificate
trustAnchors a Set of TrustAnchor's
sigProvider the provider to use for signature verification
Returns
  • the TrustAnchor object if found or null if not.
Throws
AnnotatedException if a TrustAnchor was found but the signature verification on the given certificate has thrown an exception.

protected static AlgorithmIdentifier getAlgorithmIdentifier (PublicKey key)

Throws
CertPathValidatorException

protected static void getCRLIssuersFromDistributionPoint (DistributionPoint dp, Collection issuerPrincipals, X509CRLSelector selector, ExtendedPKIXParameters pkixParams)

Add the CRL issuers from the cRLIssuer field of the distribution point or from the certificate if not given to the issuer criterion of the selector.

The issuerPrincipals are a collection with a single X500Principal for X509Certificates. For X509AttributeCertificates the issuer may contain more than one X500Principal.

Parameters
dp The distribution point.
issuerPrincipals The issuers of the certificate or attribute certificate which contains the distribution point.
selector The CRL selector.
pkixParams The PKIX parameters containing the cert stores.
Throws
AnnotatedException if an exception occurs while processing.
ClassCastException if issuerPrincipals does not contain only X500Principals.

protected static void getCertStatus (Date validDate, X509CRL crl, Object cert, CertStatus certStatus)

Throws
AnnotatedException

protected static Set getCompleteCRLs (DistributionPoint dp, Object cert, Date currentDate, ExtendedPKIXParameters paramsPKIX)

Fetches complete CRLs according to RFC 3280.

Parameters
dp The distribution point for which the complete CRL
cert The X509Certificate or X509AttributeCertificate for which the CRL should be searched.
currentDate The date for which the delta CRLs must be valid.
paramsPKIX The extended PKIX parameters.
Returns
  • A Set of X509CRLs with complete CRLs.
Throws
AnnotatedException if an exception occurs while picking the CRLs or no CRLs are found.

protected static Set getDeltaCRLs (Date currentDate, ExtendedPKIXParameters paramsPKIX, X509CRL completeCRL)

Fetches delta CRLs according to RFC 3280 section 5.2.4.

Parameters
currentDate The date for which the delta CRLs must be valid.
paramsPKIX The extended PKIX parameters.
completeCRL The complete CRL the delta CRL is for.
Returns
  • A Set of X509CRLs with delta CRLs.
Throws
AnnotatedException if an exception occurs while picking the delta CRLs.

protected static X500Principal getEncodedIssuerPrincipal (Object cert)

Returns the issuer of an attribute certificate or certificate.

Parameters
cert The attribute certificate or certificate.
Returns
  • The issuer as X500Principal.

protected static DERObject getExtensionValue (X509Extension ext, String oid)

Extract the value of the given extension, if it exists.

Parameters
ext The extension object.
oid The object identifier to obtain.
Throws
AnnotatedException if the extension cannot be read.

protected static X500Principal getIssuerPrincipal (X509CRL crl)

protected static PublicKey getNextWorkingKey (List certs, int index)

Return the next working key inheriting DSA parameters if necessary.

This methods inherits DSA parameters from the indexed certificate or previous certificates in the certificate chain to the returned PublicKey. The list is searched upwards, meaning the end certificate is at position 0 and previous certificates are following.

If the indexed certificate does not contain a DSA key this method simply returns the public key. If the DSA key already contains DSA parameters the key is also only returned.

Parameters
certs The certification path.
index The index of the certificate which contains the public key which should be extended with DSA parameters.
Returns
  • The public key of the certificate in list position index extended with DSA parameters if applicable.
Throws
AnnotatedException if DSA parameters cannot be inherited.
CertPathValidatorException

protected static final Set getQualifierSet (ASN1Sequence qualifiers)

Throws
CertPathValidatorException

protected static X500Principal getSubjectPrincipal (X509Certificate cert)

protected static Date getValidCertDateFromValidityModel (ExtendedPKIXParameters paramsPKIX, CertPath certPath, int index)

Throws
AnnotatedException

protected static Date getValidDate (PKIXParameters paramsPKIX)

protected static boolean isAnyPolicy (Set policySet)

protected static boolean isSelfIssued (X509Certificate cert)

protected static void prepareNextCertB1 (int i, List[] policyNodes, String id_p, Map m_idp, X509Certificate cert)

Throws
AnnotatedException
CertPathValidatorException

protected static PKIXPolicyNode prepareNextCertB2 (int i, List[] policyNodes, String id_p, PKIXPolicyNode validPolicyTree)

protected static boolean processCertD1i (int index, List[] policyNodes, DERObjectIdentifier pOid, Set pq)

protected static void processCertD1ii (int index, List[] policyNodes, DERObjectIdentifier _poid, Set _pq)

protected static PKIXPolicyNode removePolicyNode (PKIXPolicyNode validPolicyTree, List[] policyNodes, PKIXPolicyNode _node)

protected static void verifyX509Certificate (X509Certificate cert, PublicKey publicKey, String sigProvider)

Throws
GeneralSecurityException