APIdia Launch Partner
Top Description Fields Constructors Methods
sun.security.provider.certpath

public final Class AlgorithmChecker

extends PKIXCertPathChecker
Class Inheritance
Imports
java.math.BigInteger, java.security.*, java.security.cert.*, .Certificate, .CertPathValidatorException.BasicReason, java.security.interfaces.DSAParams, .DSAPublicKey, java.security.spec.DSAPublicKeySpec, java.util.*, sun.security.util.Debug, .DisabledAlgorithmConstraints, .KeyUtil, sun.security.validator.Validator, sun.security.x509.AlgorithmId, .X509CertImpl
A PKIXCertPathChecker implementation to check whether a specified certificate contains the required algorithm constraints.

Certificate fields such as the subject public key, the signature algorithm, key usage, extended key usage, etc. need to conform to the specified algorithm constraints.

See Also
PKIXCertPathChecker, PKIXParameters

Field Summary

Modifier and TypeField and Description
private TrustAnchor
anchor

private final AlgorithmConstraints
constraints

private final Date
date

private static final Debug
debug

private static final Set<CryptoPrimitive>
KU_PRIMITIVE_SET

private PublicKey
prevPubKey

private static final Set<CryptoPrimitive>
SIGNATURE_PRIMITIVE_SET

private PublicKey
trustedPubKey

private final String
variant

Constructor Summary

AccessConstructor and Description
public
AlgorithmChecker(TrustAnchor
the trust anchor selected to validate the target certificate
anchor, String
the Validator variant of the operation. A null value passed will set it to Validator.GENERIC.
variant)

Create a new AlgorithmChecker with the given TrustAnchor and String variant.

public
AlgorithmChecker(AlgorithmConstraints
the algorithm constraints (or null)
constraints, String
the Validator variant of the operation. A null value passed will set it to Validator.GENERIC.
variant)

Create a new AlgorithmChecker with the given AlgorithmConstraints and String variant.

public
AlgorithmChecker(TrustAnchor
the trust anchor selected to validate the target certificate
anchor, AlgorithmConstraints
the algorithm constraints (or null)
constraints, Date
the date specified by the PKIXParameters date, or the timestamp if JAR files are being validated and the JAR is timestamped. May be null if no timestamp or PKIXParameter date is set.
date, String
the Validator variant of the operation. A null value passed will set it to Validator.GENERIC.
variant)

Create a new AlgorithmChecker with the given TrustAnchor, AlgorithmConstraints, Date, and String variant.

public
AlgorithmChecker(TrustAnchor
the trust anchor selected to validate the target certificate
anchor, Date
the date specified by the PKIXParameters date, or the timestamp if JAR files are being validated and the JAR is timestamped. May be null if no timestamp or PKIXParameter date is set.
date, String
the Validator variant of the operation. A null value passed will set it to Validator.GENERIC.
variant)

Create a new AlgorithmChecker with the given TrustAnchor, PKIXParameter date, and variant.

Method Summary

Modifier and TypeMethod and Description
public void
check(Certificate cert, Collection<String> unresolvedCritExts)

Implements abstract java.security.cert.PKIXCertPathChecker.check.

Performs the check(s) on the specified certificate using its internal state and removes any critical extensions that it processes from the specified collection of OID strings that represent the unresolved critical extensions.

pack-priv static void
check(PublicKey
the public key to verify the CRL signature
key, AlgorithmId
signature algorithm Algorithm ID
algorithmId, String
the Validator variant of the operation. A null value passed will set it to Validator.GENERIC.
variant, TrustAnchor
the trust anchor selected to validate the public key
anchor)

Check the signature algorithm with the specified public key.

public Set<String>
getSupportedExtensions()

Implements abstract java.security.cert.PKIXCertPathChecker.getSupportedExtensions.

Returns an immutable Set of X.509 certificate extensions that this PKIXCertPathChecker supports (i.e. recognizes, is able to process), or null if no extensions are supported.

public void
init(boolean forward)

Implements abstract java.security.cert.PKIXCertPathChecker.init.

Implements java.security.cert.CertPathChecker.init.

Initializes the internal state of this PKIXCertPathChecker.

public boolean
isForwardCheckingSupported()

Implements abstract java.security.cert.PKIXCertPathChecker.isForwardCheckingSupported.

Implements java.security.cert.CertPathChecker.isForwardCheckingSupported.

Indicates if forward checking is supported.

private void
setTrustAnchorAndKeys(TrustAnchor anchor)

Sets the anchor, trustedPubKey and prevPubKey fields based on the specified trust anchor.

pack-priv void
trySetTrustAnchor(TrustAnchor
the trust anchor selected to validate the target certificate
anchor)

Try to set the trust anchor of the checker.

Inherited from java.security.cert.PKIXCertPathChecker:
checkclone

Field Detail

anchorback to summary
private TrustAnchor anchor
constraintsback to summary
private final AlgorithmConstraints constraints
dateback to summary
private final Date date
debugback to summary
private static final Debug debug
KU_PRIMITIVE_SETback to summary
private static final Set<CryptoPrimitive> KU_PRIMITIVE_SET
prevPubKeyback to summary
private PublicKey prevPubKey
SIGNATURE_PRIMITIVE_SETback to summary
private static final Set<CryptoPrimitive> SIGNATURE_PRIMITIVE_SET
trustedPubKeyback to summary
private PublicKey trustedPubKey
variantback to summary
private final String variant

Constructor Detail

AlgorithmCheckerback to summary
public AlgorithmChecker(TrustAnchor anchor, String variant)

Create a new AlgorithmChecker with the given TrustAnchor and String variant.

Parameters
anchor:TrustAnchor

the trust anchor selected to validate the target certificate

variant:String

the Validator variant of the operation. A null value passed will set it to Validator.GENERIC.

AlgorithmCheckerback to summary
public AlgorithmChecker(AlgorithmConstraints constraints, String variant)

Create a new AlgorithmChecker with the given AlgorithmConstraints and String variant. Note that this constructor can initialize a variation of situations where the AlgorithmConstraints or Variant maybe known.

Parameters
constraints:AlgorithmConstraints

the algorithm constraints (or null)

variant:String

the Validator variant of the operation. A null value passed will set it to Validator.GENERIC.

AlgorithmCheckerback to summary
public AlgorithmChecker(TrustAnchor anchor, AlgorithmConstraints constraints, Date date, String variant)

Create a new AlgorithmChecker with the given TrustAnchor, AlgorithmConstraints, Date, and String variant.

Parameters
anchor:TrustAnchor

the trust anchor selected to validate the target certificate

constraints:AlgorithmConstraints

the algorithm constraints (or null)

date:Date

the date specified by the PKIXParameters date, or the timestamp if JAR files are being validated and the JAR is timestamped. May be null if no timestamp or PKIXParameter date is set.

variant:String

the Validator variant of the operation. A null value passed will set it to Validator.GENERIC.

AlgorithmCheckerback to summary
public AlgorithmChecker(TrustAnchor anchor, Date date, String variant)

Create a new AlgorithmChecker with the given TrustAnchor, PKIXParameter date, and variant.

Parameters
anchor:TrustAnchor

the trust anchor selected to validate the target certificate

date:Date

the date specified by the PKIXParameters date, or the timestamp if JAR files are being validated and the JAR is timestamped. May be null if no timestamp or PKIXParameter date is set.

variant:String

the Validator variant of the operation. A null value passed will set it to Validator.GENERIC.

Method Detail

checkback to summary
public void check(Certificate cert, Collection<String> unresolvedCritExts) throws CertPathValidatorException

Implements abstract java.security.cert.PKIXCertPathChecker.check.

Doc from java.security.cert.PKIXCertPathChecker.check.

Performs the check(s) on the specified certificate using its internal state and removes any critical extensions that it processes from the specified collection of OID strings that represent the unresolved critical extensions. The certificates are presented in the order specified by the init method.

Annotations
@Override
Exceptions
CertPathValidatorException:
if the specified certificate does not pass the check
checkback to summary
pack-priv static void check(PublicKey key, AlgorithmId algorithmId, String variant, TrustAnchor anchor) throws CertPathValidatorException

Check the signature algorithm with the specified public key.

Parameters
key:PublicKey

the public key to verify the CRL signature

algorithmId:AlgorithmId

signature algorithm Algorithm ID

variant:String

the Validator variant of the operation. A null value passed will set it to Validator.GENERIC.

anchor:TrustAnchor

the trust anchor selected to validate the public key

getSupportedExtensionsback to summary
public Set<String> getSupportedExtensions()

Implements abstract java.security.cert.PKIXCertPathChecker.getSupportedExtensions.

Doc from java.security.cert.PKIXCertPathChecker.getSupportedExtensions.

Returns an immutable Set of X.509 certificate extensions that this PKIXCertPathChecker supports (i.e. recognizes, is able to process), or null if no extensions are supported.

Each element of the set is a String representing the Object Identifier (OID) of the X.509 extension that is supported. The OID is represented by a set of nonnegative integers separated by periods.

All X.509 certificate extensions that a PKIXCertPathChecker might possibly be able to process should be included in the set.

Annotations
@Override
initback to summary
public void init(boolean forward) throws CertPathValidatorException

Implements abstract java.security.cert.PKIXCertPathChecker.init.

Implements java.security.cert.CertPathChecker.init.

Doc from java.security.cert.PKIXCertPathChecker.init.

Initializes the internal state of this PKIXCertPathChecker.

The forward flag specifies the order that certificates will be passed to the check method (forward or reverse). A PKIXCertPathChecker must support reverse checking and may support forward checking.

Annotations
@Override
Exceptions
CertPathValidatorException:
if this PKIXCertPathChecker is unable to check certificates in the specified order; it should never be thrown if the forward flag is false since reverse checking must be supported
isForwardCheckingSupportedback to summary
public boolean isForwardCheckingSupported()

Implements abstract java.security.cert.PKIXCertPathChecker.isForwardCheckingSupported.

Implements java.security.cert.CertPathChecker.isForwardCheckingSupported.

Doc from java.security.cert.PKIXCertPathChecker.isForwardCheckingSupported.

Indicates if forward checking is supported. Forward checking refers to the ability of the PKIXCertPathChecker to perform its checks when certificates are presented to the check method in the forward direction (from target to most-trusted CA).

Annotations
@Override
setTrustAnchorAndKeysback to summary
private void setTrustAnchorAndKeys(TrustAnchor anchor)

Sets the anchor, trustedPubKey and prevPubKey fields based on the specified trust anchor.

trySetTrustAnchorback to summary
pack-priv void trySetTrustAnchor(TrustAnchor anchor)

Try to set the trust anchor of the checker.

If there is no trust anchor specified and the checker has not started, set the trust anchor.

Parameters
anchor:TrustAnchor

the trust anchor selected to validate the target certificate