APIdia Launch Partner
Top Description Fields Constructors Methods
sun.security.provider.certpath

pack-priv Class AdaptableX509CertSelector

extends X509CertSelector
Class Inheritance
Imports
java.io.IOException, java.math.BigInteger, java.security.cert.Certificate, .X509Certificate, .X509CertSelector, .CertificateException, java.util.Arrays, .Date, sun.security.util.Debug, .DerInputStream, .KnownOIDs, sun.security.x509.SerialNumber, .AuthorityKeyIdentifierExtension
An adaptable X509 certificate selector for forward certification path building. This selector overrides the default X509CertSelector matching rules for the subjectKeyIdentifier and serialNumber criteria, and adds additional rules for certificate validity.
Since
1.7

Field Summary

Modifier and TypeField and Description
private static final Debug
debug

Hides java.security.cert.X509CertSelector.debug.

private Date
endDate

private BigInteger
serial

private byte[]
ski

private Date
startDate

Constructor Summary

AccessConstructor and Description
pack-priv
AdaptableX509CertSelector()

Method Summary

Modifier and TypeMethod and Description
public Object
clone()

Overrides java.security.cert.X509CertSelector.clone.

Implements java.security.cert.CertSelector.clone.

Returns a copy of this object.

public boolean
match(Certificate cert)

Overrides java.security.cert.X509CertSelector.match.

Implements java.security.cert.CertSelector.match.

Decides whether a Certificate should be selected.

private boolean
matchSubjectKeyID(X509Certificate xcert)

Hides java.security.cert.X509CertSelector.matchSubjectKeyID.

public void
setSerialNumber(BigInteger serial)

Overrides java.security.cert.X509CertSelector.setSerialNumber.

This selector overrides the serialNumber matching rules of X509CertSelector, so it throws IllegalArgumentException if this method is ever called.

pack-priv void
setSkiAndSerialNumber(AuthorityKeyIdentifierExtension
the authorityKeyIdentifier extension
ext)

Sets the subjectKeyIdentifier and serialNumber criteria from the authority key identifier extension.

public void
setSubjectKeyIdentifier(byte[] subjectKeyID)

Overrides java.security.cert.X509CertSelector.setSubjectKeyIdentifier.

This selector overrides the subjectKeyIdentifier matching rules of X509CertSelector, so it throws IllegalArgumentException if this method is ever called.

pack-priv void
setValidityPeriod(Date
the start date of a validity period that must fall within the certificate validity period for the X509Certificate
startDate, Date
the end date of a validity period that must fall within the certificate validity period for the X509Certificate
endDate)

Sets the criterion of the X509Certificate validity period.

Inherited from java.security.cert.X509CertSelector:
addPathToNameaddPathToNameaddSubjectAlternativeNameaddSubjectAlternativeNamegetAuthorityKeyIdentifiergetBasicConstraintsgetCertificategetCertificateValidgetExtendedKeyUsagegetIssuergetIssuerAsBytesgetIssuerAsStringgetKeyUsagegetMatchAllSubjectAltNamesgetNameConstraintsgetPathToNamesgetPolicygetPrivateKeyValidgetSerialNumbergetSubjectgetSubjectAlternativeNamesgetSubjectAsBytesgetSubjectAsStringgetSubjectKeyIdentifiergetSubjectPublicKeygetSubjectPublicKeyAlgIDsetAuthorityKeyIdentifiersetBasicConstraintssetCertificatesetCertificateValidsetExtendedKeyUsagesetIssuersetIssuersetIssuersetKeyUsagesetMatchAllSubjectAltNamessetNameConstraintssetPathToNamessetPolicysetPrivateKeyValidsetSubjectsetSubjectsetSubjectsetSubjectAlternativeNamessetSubjectPublicKeysetSubjectPublicKeysetSubjectPublicKeyAlgIDtoString

Field Detail

debugback to summary
private static final Debug debug

Hides java.security.cert.X509CertSelector.debug.

endDateback to summary
private Date endDate
serialback to summary
private BigInteger serial
skiback to summary
private byte[] ski
startDateback to summary
private Date startDate

Constructor Detail

AdaptableX509CertSelectorback to summary
pack-priv AdaptableX509CertSelector()

Method Detail

cloneback to summary
public Object clone()

Overrides java.security.cert.X509CertSelector.clone.

Implements java.security.cert.CertSelector.clone.

Doc from java.security.cert.X509CertSelector.clone.

Returns a copy of this object.

Annotations
@Override
matchback to summary
public boolean match(Certificate cert)

Overrides java.security.cert.X509CertSelector.match.

Implements java.security.cert.CertSelector.match.

Decides whether a Certificate should be selected. This method overrides the matching rules for the subjectKeyIdentifier and serialNumber criteria and adds additional rules for certificate validity. For the purpose of compatibility, when a certificate is of version 1 and version 2, or the certificate does not include a subject key identifier extension, the selection criterion of subjectKeyIdentifier will be disabled.

Annotations
@Override
matchSubjectKeyIDback to summary
private boolean matchSubjectKeyID(X509Certificate xcert)

Hides java.security.cert.X509CertSelector.matchSubjectKeyID.

setSerialNumberback to summary
public void setSerialNumber(BigInteger serial)

Overrides java.security.cert.X509CertSelector.setSerialNumber.

This selector overrides the serialNumber matching rules of X509CertSelector, so it throws IllegalArgumentException if this method is ever called.

Annotations
@Override
setSkiAndSerialNumberback to summary
pack-priv void setSkiAndSerialNumber(AuthorityKeyIdentifierExtension ext) throws IOException

Sets the subjectKeyIdentifier and serialNumber criteria from the authority key identifier extension. The subjectKeyIdentifier criterion is set to the keyIdentifier field of the extension, or null if it is empty. The serialNumber criterion is set to the authorityCertSerialNumber field, or null if it is empty. Note that we do not set the subject criterion to the authorityCertIssuer field of the extension. The caller MUST set the subject criterion before calling match().

Parameters
ext:AuthorityKeyIdentifierExtension

the authorityKeyIdentifier extension

Exceptions
IOException:
if there is an error parsing the extension
setSubjectKeyIdentifierback to summary
public void setSubjectKeyIdentifier(byte[] subjectKeyID)

Overrides java.security.cert.X509CertSelector.setSubjectKeyIdentifier.

This selector overrides the subjectKeyIdentifier matching rules of X509CertSelector, so it throws IllegalArgumentException if this method is ever called.

Annotations
@Override
setValidityPeriodback to summary
pack-priv void setValidityPeriod(Date startDate, Date endDate)

Sets the criterion of the X509Certificate validity period. Normally, we may not have to check that a certificate validity period must fall within its issuer's certificate validity period. However, when we face root CA key updates for version 1 certificates, according to scheme of RFC 4210 or 2510, the validity periods should be checked to determine the right issuer's certificate. Conservatively, we will only check the validity periods for version 1 and version 2 certificates. For version 3 certificates, we can determine the right issuer by authority and subject key identifier extensions.

Parameters
startDate:Date

the start date of a validity period that must fall within the certificate validity period for the X509Certificate

endDate:Date

the end date of a validity period that must fall within the certificate validity period for the X509Certificate