OpenJDK 27 · sun.security.provider.certpath.ConstraintsChecker

Modifier and Type	Field and Description
private final int	certPathLength
private static final Debug	debug
private int	i
private int	maxPathLength
private NameConstraintsExtension	prevNC
private Set<String>	supportedExts

Access	Constructor and Description
pack-priv	ConstraintsChecker(int the length of the certification path certPathLength) Creates a ConstraintsChecker.

Method Summary

Modifier and Type	Method and Description
public void	check(Certificate the `Certificate` to be checked cert, Collection<String> a `Collection` of OID strings representing the current set of unresolved critical extensions unresCritExts) Implements abstract java.security.cert.PKIXCertPathChecker.check. Performs the basic constraints and name constraints checks on the certificate using its internal state.
private void	checkBasicConstraints(X509Certificate currCert) Internal method to check that a given cert meets basic constraints.
public Set<String>	getSupportedExtensions() Implements abstract java.security.cert.PKIXCertPathChecker.getSupportedExtensions. Returns an immutable `Set` of X.509 certificate extensions that this `PKIXCertPathChecker` supports (i.e. recognizes, is able to process), or `null` if no extensions are supported.
public void	init(boolean forward) Implements abstract java.security.cert.PKIXCertPathChecker.init. Implements java.security.cert.CertPathChecker.init. Initializes the internal state of this `PKIXCertPathChecker`.
public boolean	isForwardCheckingSupported() Implements abstract java.security.cert.PKIXCertPathChecker.isForwardCheckingSupported. Implements java.security.cert.CertPathChecker.isForwardCheckingSupported. Indicates if forward checking is supported.
pack-priv static int	Returns: the new maximum path length constraint (-1 means no more certificates can follow, Integer.MAX_VALUE means path length is unconstrained) mergeBasicConstraints(X509Certificate the `X509Certificate` cert, int the previous maximum path length maxPathLength) Merges the specified maxPathLength with the pathLenConstraint obtained from the certificate.
pack-priv static NameConstraintsExtension	mergeNameConstraints(X509Certificate currCert, NameConstraintsExtension prevNC) Helper to fold sets of name constraints together
private void	verifyNameConstraints(X509Certificate currCert) Internal method to check the name constraints against a cert

Inherited from java.security.cert.PKIXCertPathChecker:: check clone

certPathLength	back to summary
private final int certPathLength

debug	back to summary
private static final Debug debug

i	back to summary
private int i

maxPathLength	back to summary
private int maxPathLength

prevNC	back to summary
private NameConstraintsExtension prevNC

supportedExts	back to summary
private Set<String> supportedExts

ConstraintsChecker	back to summary
pack-priv ConstraintsChecker(int certPathLength) Creates a ConstraintsChecker. Parameters certPathLength:int the length of the certification path

Method Detail

check back to summary

check	back to summary
public void check(Certificate cert, Collection<String> unresCritExts) throws CertPathValidatorException Implements abstract java.security.cert.PKIXCertPathChecker.check. Performs the basic constraints and name constraints checks on the certificate using its internal state. Parameters cert:Certificate the `Certificate` to be checked unresCritExts:Collection<String> a `Collection` of OID strings representing the current set of unresolved critical extensions Annotations @Override Exceptions CertPathValidatorException: if the specified certificate does not pass the check

public void check(Certificate cert, Collection<String> unresCritExts) throws CertPathValidatorException

Implements abstract java.security.cert.PKIXCertPathChecker.check.

Performs the basic constraints and name constraints checks on the certificate using its internal state.

Parameters

cert:Certificate: the Certificate to be checked
unresCritExts:Collection<String>: a Collection of OID strings representing the current set of unresolved critical extensions

Annotations

@Override

Exceptions

CertPathValidatorException:: if the specified certificate does not pass the check

checkBasicConstraints	back to summary
private void checkBasicConstraints(X509Certificate currCert) throws CertPathValidatorException Internal method to check that a given cert meets basic constraints.

getSupportedExtensions back to summary

getSupportedExtensions	back to summary
public Set<String> getSupportedExtensions() Implements abstract java.security.cert.PKIXCertPathChecker.getSupportedExtensions. Doc from java.security.cert.PKIXCertPathChecker.getSupportedExtensions. Returns an immutable `Set` of X.509 certificate extensions that this `PKIXCertPathChecker` supports (i.e. recognizes, is able to process), or `null` if no extensions are supported. Each element of the set is a `String` representing the Object Identifier (OID) of the X.509 extension that is supported. The OID is represented by a set of nonnegative integers separated by periods. All X.509 certificate extensions that a `PKIXCertPathChecker` might possibly be able to process should be included in the set. Annotations @Override

public Set<String> getSupportedExtensions()

Implements abstract java.security.cert.PKIXCertPathChecker.getSupportedExtensions.

Doc from java.security.cert.PKIXCertPathChecker.getSupportedExtensions.

Returns an immutable Set of X.509 certificate extensions that this PKIXCertPathChecker supports (i.e. recognizes, is able to process), or null if no extensions are supported.

Each element of the set is a String representing the Object Identifier (OID) of the X.509 extension that is supported. The OID is represented by a set of nonnegative integers separated by periods.

All X.509 certificate extensions that a PKIXCertPathChecker might possibly be able to process should be included in the set.

Annotations

@Override

init back to summary

init	back to summary
public void init(boolean forward) throws CertPathValidatorException Implements abstract java.security.cert.PKIXCertPathChecker.init. Implements java.security.cert.CertPathChecker.init. Doc from java.security.cert.PKIXCertPathChecker.init. Initializes the internal state of this `PKIXCertPathChecker`. The `forward` flag specifies the order that certificates will be passed to the `check` method (forward or reverse). A `PKIXCertPathChecker` must support reverse checking and may support forward checking. Annotations @Override Exceptions CertPathValidatorException: if this `PKIXCertPathChecker` is unable to check certificates in the specified order; it should never be thrown if the forward flag is false since reverse checking must be supported

public void init(boolean forward) throws CertPathValidatorException

Implements abstract java.security.cert.PKIXCertPathChecker.init.

Implements java.security.cert.CertPathChecker.init.

Doc from java.security.cert.PKIXCertPathChecker.init.

Initializes the internal state of this PKIXCertPathChecker.

The forward flag specifies the order that certificates will be passed to the check method (forward or reverse). A PKIXCertPathChecker must support reverse checking and may support forward checking.

Annotations

@Override

Exceptions

CertPathValidatorException:: if this PKIXCertPathChecker is unable to check certificates in the specified order; it should never be thrown if the forward flag is false since reverse checking must be supported

isForwardCheckingSupported back to summary

isForwardCheckingSupported	back to summary
public boolean isForwardCheckingSupported() Implements abstract java.security.cert.PKIXCertPathChecker.isForwardCheckingSupported. Implements java.security.cert.CertPathChecker.isForwardCheckingSupported. Doc from java.security.cert.PKIXCertPathChecker.isForwardCheckingSupported. Indicates if forward checking is supported. Forward checking refers to the ability of the `PKIXCertPathChecker` to perform its checks when certificates are presented to the `check` method in the forward direction (from target to most-trusted CA). Annotations @Override

public boolean isForwardCheckingSupported()

Implements abstract java.security.cert.PKIXCertPathChecker.isForwardCheckingSupported.

Implements java.security.cert.CertPathChecker.isForwardCheckingSupported.

Doc from java.security.cert.PKIXCertPathChecker.isForwardCheckingSupported.

Indicates if forward checking is supported. Forward checking refers to the ability of the PKIXCertPathChecker to perform its checks when certificates are presented to the check method in the forward direction (from target to most-trusted CA).

Annotations

@Override

mergeBasicConstraints back to summary

mergeBasicConstraints	back to summary
pack-priv static int mergeBasicConstraints(X509Certificate cert, int maxPathLength) Merges the specified maxPathLength with the pathLenConstraint obtained from the certificate. Parameters cert:X509Certificate the `X509Certificate` maxPathLength:int the previous maximum path length Returns:int the new maximum path length constraint (-1 means no more certificates can follow, Integer.MAX_VALUE means path length is unconstrained)

pack-priv static int mergeBasicConstraints(X509Certificate cert, int maxPathLength)

Merges the specified maxPathLength with the pathLenConstraint obtained from the certificate.

Parameters

cert:X509Certificate: the X509Certificate
maxPathLength:int: the previous maximum path length

Returns:int

the new maximum path length constraint (-1 means no more certificates can follow, Integer.MAX_VALUE means path length is unconstrained)

mergeNameConstraints	back to summary
pack-priv static NameConstraintsExtension mergeNameConstraints(X509Certificate currCert, NameConstraintsExtension prevNC) throws CertPathValidatorException Helper to fold sets of name constraints together

verifyNameConstraints	back to summary
private void verifyNameConstraints(X509Certificate currCert) throws CertPathValidatorException Internal method to check the name constraints against a cert

pack-priv Class ConstraintsChecker

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail