OpenJDK 27 · java.security.cert.PKIXCertPathChecker · APIdia, the JavaDoc alternative

An abstract class that performs one or more checks on an X509Certificate.

A concrete implementation of the PKIXCertPathChecker class can be created to extend the PKIX certification path validation algorithm. For example, an implementation may check for and process a critical private extension of each certificate in a certification path.

Instances of PKIXCertPathChecker are passed as parameters using the setCertPathCheckers or addCertPathChecker methods of the PKIXParameters and PKIXBuilderParameters class. Each of the PKIXCertPathCheckers check methods will be called, in turn, for each certificate processed by a PKIX CertPathValidator or CertPathBuilder implementation.

A PKIXCertPathChecker may be called multiple times on successive certificates in a certification path. Concrete subclasses are expected to maintain any internal state that may be necessary to check successive certificates. The init method is used to initialize the internal state of the checker so that the certificates of a new certification path may be checked. A stateful implementation must override the clone method if necessary in order to allow a PKIX CertPathBuilder to efficiently backtrack and try other paths. In these situations, the CertPathBuilder is able to restore prior path validation states by restoring the cloned PKIXCertPathCheckers.

The order in which the certificates are presented to the PKIXCertPathChecker may be either in the forward direction (from target to most-trusted CA) or in the reverse direction (from most-trusted CA to target). A PKIXCertPathChecker implementation must support reverse checking (the ability to perform its checks when it is presented with certificates in the reverse direction) and may support forward checking (the ability to perform its checks when it is presented with certificates in the forward direction). The isForwardCheckingSupported method indicates whether forward checking is supported.

Additional input parameters required for executing the check may be specified through constructors of concrete implementations of this class.

Concurrent Access

Unless otherwise specified, the methods defined in this class are not thread-safe. Multiple threads that need to access a single object concurrently should synchronize amongst themselves and provide the necessary locking. Multiple threads each manipulating separate objects need not synchronize.

Access	Constructor and Description
protected	PKIXCertPathChecker() Default constructor.

Method Summary

Modifier and Type	Method and Description
public abstract void	check(Certificate the `Certificate` to be checked cert, Collection<String> a `Collection` of OID strings representing the current set of unresolved critical extensions unresolvedCritExts) Performs the check(s) on the specified certificate using its internal state and removes any critical extensions that it processes from the specified collection of OID strings that represent the unresolved critical extensions.
public void	check(Certificate cert) Implements java.security.cert.CertPathChecker.check. Performs the check(s) on the specified certificate using its internal state.
public Object	Returns: a copy of this `PKIXCertPathChecker` clone() Overrides java.lang.Object.clone. Returns a clone of this object.
public abstract Set<String>	Returns: an immutable `Set` of X.509 extension OIDs (in `String` format) supported by this `PKIXCertPathChecker`, or `null` if no extensions are supported getSupportedExtensions() Returns an immutable `Set` of X.509 certificate extensions that this `PKIXCertPathChecker` supports (i.e. recognizes, is able to process), or `null` if no extensions are supported.
public abstract void	init(boolean the order that certificates are presented to the `check` method. If `true`, certificates are presented from target to most-trusted CA (forward); if `false`, from most-trusted CA to target (reverse). forward) Redeclares java.security.cert.CertPathChecker.init. Initializes the internal state of this `PKIXCertPathChecker`.
public abstract boolean	Returns: `true` if forward checking is supported, `false` otherwise isForwardCheckingSupported() Redeclares java.security.cert.CertPathChecker.isForwardCheckingSupported. Indicates if forward checking is supported.

Inherited from java.lang.Object:: equals finalize getClass hashCode notify notifyAll toString wait wait wait

Constructor Detail

PKIXCertPathChecker	back to summary
protected PKIXCertPathChecker() Default constructor.

Method Detail

check back to summary

check	back to summary
public abstract void check(Certificate cert, Collection<String> unresolvedCritExts) throws CertPathValidatorException Performs the check(s) on the specified certificate using its internal state and removes any critical extensions that it processes from the specified collection of OID strings that represent the unresolved critical extensions. The certificates are presented in the order specified by the `init` method. Parameters cert:Certificate the `Certificate` to be checked unresolvedCritExts:Collection<String> a `Collection` of OID strings representing the current set of unresolved critical extensions Exceptions CertPathValidatorException: if the specified certificate does not pass the check

public abstract void check(Certificate cert, Collection<String> unresolvedCritExts) throws CertPathValidatorException

Performs the check(s) on the specified certificate using its internal state and removes any critical extensions that it processes from the specified collection of OID strings that represent the unresolved critical extensions. The certificates are presented in the order specified by the init method.

Parameters

cert:Certificate: the Certificate to be checked
unresolvedCritExts:Collection<String>: a Collection of OID strings representing the current set of unresolved critical extensions

Exceptions

CertPathValidatorException:: if the specified certificate does not pass the check

check back to summary

check	back to summary
public void check(Certificate cert) throws CertPathValidatorException Implements java.security.cert.CertPathChecker.check. Doc from java.security.cert.CertPathChecker.check. Performs the check(s) on the specified certificate using its internal state. The certificates are presented in the order specified by the `init` method. This implementation calls `check(cert, java.util.Collections.<String>emptySet())`. Annotations @Override Exceptions CertPathValidatorException: if the specified certificate does not pass the check

public void check(Certificate cert) throws CertPathValidatorException

Implements java.security.cert.CertPathChecker.check.

Doc from java.security.cert.CertPathChecker.check.

Performs the check(s) on the specified certificate using its internal state. The certificates are presented in the order specified by the init method.

This implementation calls check(cert, java.util.Collections.<String>emptySet()).

Annotations

@Override

Exceptions

CertPathValidatorException:: if the specified certificate does not pass the check

clone back to summary

clone	back to summary
public Object clone() Overrides java.lang.Object.clone. Returns a clone of this object. Calls the `Object.clone()` method. All subclasses which maintain state must support and override this method, if necessary. Returns:Object a copy of this `PKIXCertPathChecker` Annotations @Override

public Object clone()

Overrides java.lang.Object.clone.

Returns a clone of this object. Calls the Object.clone() method. All subclasses which maintain state must support and override this method, if necessary.

Returns:Object

a copy of this PKIXCertPathChecker

Annotations

@Override

getSupportedExtensions back to summary

getSupportedExtensions	back to summary
public abstract Set<String> getSupportedExtensions() Returns an immutable `Set` of X.509 certificate extensions that this `PKIXCertPathChecker` supports (i.e. recognizes, is able to process), or `null` if no extensions are supported. Each element of the set is a `String` representing the Object Identifier (OID) of the X.509 extension that is supported. The OID is represented by a set of nonnegative integers separated by periods. All X.509 certificate extensions that a `PKIXCertPathChecker` might possibly be able to process should be included in the set. Returns:Set<String> an immutable `Set` of X.509 extension OIDs (in `String` format) supported by this `PKIXCertPathChecker`, or `null` if no extensions are supported

public abstract Set<String> getSupportedExtensions()

Returns an immutable Set of X.509 certificate extensions that this PKIXCertPathChecker supports (i.e. recognizes, is able to process), or null if no extensions are supported.

Each element of the set is a String representing the Object Identifier (OID) of the X.509 extension that is supported. The OID is represented by a set of nonnegative integers separated by periods.

All X.509 certificate extensions that a PKIXCertPathChecker might possibly be able to process should be included in the set.

Returns:Set<String>: an immutable Set of X.509 extension OIDs (in String format) supported by this PKIXCertPathChecker, or null if no extensions are supported

init back to summary

init	back to summary
public abstract void init(boolean forward) throws CertPathValidatorException Redeclares java.security.cert.CertPathChecker.init. Initializes the internal state of this `PKIXCertPathChecker`. The `forward` flag specifies the order that certificates will be passed to the `check` method (forward or reverse). A `PKIXCertPathChecker` must support reverse checking and may support forward checking. Parameters forward:boolean the order that certificates are presented to the `check` method. If `true`, certificates are presented from target to most-trusted CA (forward); if `false`, from most-trusted CA to target (reverse). Annotations @Override Exceptions CertPathValidatorException: if this `PKIXCertPathChecker` is unable to check certificates in the specified order; it should never be thrown if the forward flag is false since reverse checking must be supported

public abstract void init(boolean forward) throws CertPathValidatorException

Redeclares java.security.cert.CertPathChecker.init.

Initializes the internal state of this PKIXCertPathChecker.

The forward flag specifies the order that certificates will be passed to the check method (forward or reverse). A PKIXCertPathChecker must support reverse checking and may support forward checking.

Parameters

forward:boolean: the order that certificates are presented to the check method. If true, certificates are presented from target to most-trusted CA (forward); if false, from most-trusted CA to target (reverse).

Annotations

@Override

Exceptions

CertPathValidatorException:: if this PKIXCertPathChecker is unable to check certificates in the specified order; it should never be thrown if the forward flag is false since reverse checking must be supported

isForwardCheckingSupported back to summary

isForwardCheckingSupported	back to summary
public abstract boolean isForwardCheckingSupported() Redeclares java.security.cert.CertPathChecker.isForwardCheckingSupported. Indicates if forward checking is supported. Forward checking refers to the ability of the `PKIXCertPathChecker` to perform its checks when certificates are presented to the `check` method in the forward direction (from target to most-trusted CA). Returns:boolean `true` if forward checking is supported, `false` otherwise Annotations @Override

public abstract boolean isForwardCheckingSupported()

Redeclares java.security.cert.CertPathChecker.isForwardCheckingSupported.

Indicates if forward checking is supported. Forward checking refers to the ability of the PKIXCertPathChecker to perform its checks when certificates are presented to the check method in the forward direction (from target to most-trusted CA).

Returns:boolean

true if forward checking is supported, false otherwise

Annotations

@Override

public abstract Class PKIXCertPathChecker

Constructor Summary

Method Summary

Constructor Detail

Method Detail