Modifier and Type	Class and Description
pack-priv static class	ForwardBuilder.PKIXCertComparator This inner class compares 2 PKIX certificates according to which should be tried first when building a path from the target.
private static class	ForwardBuilder.ThreadTrackerHolder

Modifier and Type	Field and Description
private AdaptableX509CertSelector	caSelector
private X509CertSelector	caTargetSelector
private static final Debug	debug Hides sun.security.provider.certpath.Builder.debug.
private X509CertSelector	eeSelector
private final boolean	searchAllCertStores
pack-priv TrustAnchor	trustAnchor
private final Set<TrustAnchor>	trustAnchors
private final Set<X509Certificate>	trustedCerts
private final Set<X500Principal>	trustedSubjectDNs

Access	Constructor and Description
pack-priv	ForwardBuilder(PKIX.BuilderParams buildParams, boolean searchAllCertStores) Initialize the builder with the input parameters.

Method Summary

Modifier and Type	Method and Description
pack-priv void	addCertToPath(X509Certificate the certificate to be added cert, LinkedList<X509Certificate> the certification path list certPathList) Implements abstract sun.security.provider.certpath.Builder.addCertToPath. Adds the certificate to the certPathList
private static int	Returns: the distance or -1 if no common ancestor or an attribute of the last RDN of the common ancestor is geographical distanceToCommonAncestor(X500Name the anchor's DN anchor, X500Name the issuer's DN issuer) Returns the distance (number of RDNs) from the issuer's DN to the common non-geographical ancestor of the trust anchor and issuer's DN.
private boolean	getCerts(AuthorityInfoAccessExtension aiaExt, Collection<X509Certificate> certs) Download certificates from the given AIA and add them to the specified Collection.
private void	getMatchingCACerts(ForwardState currentState, List<CertStore> certStores, Collection<X509Certificate> caCerts) Retrieves all CA certificates which satisfy constraints and requirements specified in the parameters and PKIX state.
pack-priv Collection<X509Certificate>	getMatchingCerts(State the current state. Must be an instance of `ForwardState` currentState, List<CertStore> list of CertStores certStores) Implements abstract sun.security.provider.certpath.Builder.getMatchingCerts. Retrieves all certs from the specified CertStores that satisfy the requirements specified in the parameters and the current PKIX state (name constraints, policy constraints, etc.).
private void	getMatchingEECerts(ForwardState currentState, List<CertStore> certStores, Collection<X509Certificate> eeCerts)
pack-priv boolean	Returns: a boolean value indicating whether the cert completes the path. isPathCompleted(X509Certificate the certificate to test cert) Implements abstract sun.security.provider.certpath.Builder.isPathCompleted. Verifies whether the input certificate completes the path.
pack-priv void	removeFinalCertFromPath(LinkedList<X509Certificate> the certification path list certPathList) Implements abstract sun.security.provider.certpath.Builder.removeFinalCertFromPath. Removes final certificate from the certPathList
pack-priv void	verifyCert(X509Certificate the certificate to be verified cert, State the current state against which the cert is verified currentState, List<X509Certificate> the certPathList generated thus far certPathList) Implements abstract sun.security.provider.certpath.Builder.verifyCert. Verifies a matching certificate.

Inherited from sun.security.provider.certpath.Builder:: addMatchingCerts getMatchingPolicies

Field Detail

caSelector	back to summary
private AdaptableX509CertSelector caSelector

caTargetSelector	back to summary
private X509CertSelector caTargetSelector

debug	back to summary
private static final Debug debug Hides sun.security.provider.certpath.Builder.debug.

eeSelector	back to summary
private X509CertSelector eeSelector

searchAllCertStores	back to summary
private final boolean searchAllCertStores

trustAnchor	back to summary
pack-priv TrustAnchor trustAnchor

trustAnchors	back to summary
private final Set<TrustAnchor> trustAnchors

trustedCerts	back to summary
private final Set<X509Certificate> trustedCerts

trustedSubjectDNs	back to summary
private final Set<X500Principal> trustedSubjectDNs

Constructor Detail

ForwardBuilder	back to summary
pack-priv ForwardBuilder(PKIX.BuilderParams buildParams, boolean searchAllCertStores) Initialize the builder with the input parameters.

Method Detail

addCertToPath	back to summary
pack-priv void addCertToPath(X509Certificate cert, LinkedList<X509Certificate> certPathList) Implements abstract sun.security.provider.certpath.Builder.addCertToPath. Adds the certificate to the certPathList Parameters cert:X509Certificate the certificate to be added certPathList:LinkedList<X509Certificate> the certification path list Annotations @Override

addCertToPath

back to summary

pack-priv void addCertToPath(X509Certificate cert, LinkedList<X509Certificate> certPathList)

Implements abstract sun.security.provider.certpath.Builder.addCertToPath.

Adds the certificate to the certPathList

Parameters

cert:X509Certificate: the certificate to be added
certPathList:LinkedList<X509Certificate>: the certification path list

Annotations

@Override

distanceToCommonAncestor	back to summary
private static int distanceToCommonAncestor(X500Name anchor, X500Name issuer) Returns the distance (number of RDNs) from the issuer's DN to the common non-geographical ancestor of the trust anchor and issuer's DN. Parameters anchor:X500Name the anchor's DN issuer:X500Name the issuer's DN Returns:int the distance or -1 if no common ancestor or an attribute of the last RDN of the common ancestor is geographical

distanceToCommonAncestor

back to summary

private static int distanceToCommonAncestor(X500Name anchor, X500Name issuer)

Returns the distance (number of RDNs) from the issuer's DN to the common non-geographical ancestor of the trust anchor and issuer's DN.

Parameters

anchor:X500Name: the anchor's DN
issuer:X500Name: the issuer's DN

Returns:int

the distance or -1 if no common ancestor or an attribute of the last RDN of the common ancestor is geographical

getCerts	back to summary
private boolean getCerts(AuthorityInfoAccessExtension aiaExt, Collection<X509Certificate> certs) Download certificates from the given AIA and add them to the specified Collection. Annotations @SuppressWarnings:unchecked

getCerts

back to summary

private boolean getCerts(AuthorityInfoAccessExtension aiaExt, Collection<X509Certificate> certs)

Download certificates from the given AIA and add them to the specified Collection.

Annotations

@SuppressWarnings:unchecked

getMatchingCACerts	back to summary
private void getMatchingCACerts(ForwardState currentState, List<CertStore> certStores, Collection<X509Certificate> caCerts) throws IOException Retrieves all CA certificates which satisfy constraints and requirements specified in the parameters and PKIX state.

getMatchingCerts back to summary

getMatchingCerts	back to summary
pack-priv Collection<X509Certificate> getMatchingCerts(State currentState, List<CertStore> certStores) throws IOException Implements abstract sun.security.provider.certpath.Builder.getMatchingCerts. Retrieves all certs from the specified CertStores that satisfy the requirements specified in the parameters and the current PKIX state (name constraints, policy constraints, etc.). Parameters currentState:State the current state. Must be an instance of `ForwardState` certStores:List<CertStore> list of CertStores Annotations @Override

pack-priv Collection<X509Certificate> getMatchingCerts(State currentState, List<CertStore> certStores) throws IOException

Implements abstract sun.security.provider.certpath.Builder.getMatchingCerts.

Retrieves all certs from the specified CertStores that satisfy the requirements specified in the parameters and the current PKIX state (name constraints, policy constraints, etc.).

Parameters

currentState:State: the current state. Must be an instance of ForwardState
certStores:List<CertStore>: list of CertStores

Annotations

@Override

getMatchingEECerts	back to summary
private void getMatchingEECerts(ForwardState currentState, List<CertStore> certStores, Collection<X509Certificate> eeCerts) throws IOException

isPathCompleted	back to summary
pack-priv boolean isPathCompleted(X509Certificate cert) Implements abstract sun.security.provider.certpath.Builder.isPathCompleted. Verifies whether the input certificate completes the path. First checks the cert against each trust anchor that was specified, in order, and returns true if the cert matches the trust anchor specified as a certificate or has the same key and subject of an anchor specified as a trusted {pubkey, caname} pair. If no match has been found, does a second check of the cert against anchors specified as a trusted {pubkey, caname} pair to see if the cert was issued by that anchor. Returns false if none of the trust anchors are valid for this cert. Parameters cert:X509Certificate the certificate to test Returns:boolean a boolean value indicating whether the cert completes the path. Annotations @Override

isPathCompleted

back to summary

pack-priv boolean isPathCompleted(X509Certificate cert)

Implements abstract sun.security.provider.certpath.Builder.isPathCompleted.

Verifies whether the input certificate completes the path. First checks the cert against each trust anchor that was specified, in order, and returns true if the cert matches the trust anchor specified as a certificate or has the same key and subject of an anchor specified as a trusted {pubkey, caname} pair. If no match has been found, does a second check of the cert against anchors specified as a trusted {pubkey, caname} pair to see if the cert was issued by that anchor. Returns false if none of the trust anchors are valid for this cert.

Parameters

cert:X509Certificate: the certificate to test

Returns:boolean

a boolean value indicating whether the cert completes the path.

Annotations

@Override

removeFinalCertFromPath	back to summary
pack-priv void removeFinalCertFromPath(LinkedList<X509Certificate> certPathList) Implements abstract sun.security.provider.certpath.Builder.removeFinalCertFromPath. Removes final certificate from the certPathList Parameters certPathList:LinkedList<X509Certificate> the certification path list Annotations @Override

removeFinalCertFromPath

back to summary

pack-priv void removeFinalCertFromPath(LinkedList<X509Certificate> certPathList)

Implements abstract sun.security.provider.certpath.Builder.removeFinalCertFromPath.

Removes final certificate from the certPathList

Parameters

certPathList:LinkedList<X509Certificate>: the certification path list

Annotations

@Override

verifyCert	back to summary
pack-priv void verifyCert(X509Certificate cert, State currentState, List<X509Certificate> certPathList) throws GeneralSecurityException Implements abstract sun.security.provider.certpath.Builder.verifyCert. Verifies a matching certificate. This method executes the validation steps in the PKIX path validation algorithm, RFC 5280, which were not satisfied by the selection criteria used by getCertificates() to find the certs and only the steps that can be executed in a forward direction (target to trust anchor). Those steps that can only be executed in a reverse direction are deferred until the complete path has been built. Trust anchor certs are not validated. If the last certificate is being verified (the one whose subject matches the target subject) then steps in 6.1.4 of the PKIX Certification Path Validation algorithm are NOT executed, regardless of whether the last cert is an end-entity cert or not. This allows callers to certify CA certs as well as EE certs. Parameters cert:X509Certificate the certificate to be verified currentState:State the current state against which the cert is verified certPathList:List<X509Certificate> the certPathList generated thus far Annotations @Override

verifyCert

back to summary

pack-priv void verifyCert(X509Certificate cert, State currentState, List<X509Certificate> certPathList) throws GeneralSecurityException

Implements abstract sun.security.provider.certpath.Builder.verifyCert.

Verifies a matching certificate. This method executes the validation steps in the PKIX path validation algorithm, RFC 5280, which were not satisfied by the selection criteria used by getCertificates() to find the certs and only the steps that can be executed in a forward direction (target to trust anchor). Those steps that can only be executed in a reverse direction are deferred until the complete path has been built. Trust anchor certs are not validated. If the last certificate is being verified (the one whose subject matches the target subject) then steps in 6.1.4 of the PKIX Certification Path Validation algorithm are NOT executed, regardless of whether the last cert is an end-entity cert or not. This allows callers to certify CA certs as well as EE certs.

Parameters

cert:X509Certificate: the certificate to be verified
currentState:State: the current state against which the cert is verified
certPathList:List<X509Certificate>: the certPathList generated thus far

Annotations

@Override

sun.security.provider.certpath back to summary

pack-priv Class ForwardBuilder.PKIXCertComparator

Class Inheritance

extends Object
implements Comparator<X509Certificate>

java.lang.Object
sun.security.provider.certpath.ForwardBuilder.PKIXCertComparator

All Implemented Interfaces

java.util.Comparator

This inner class compares 2 PKIX certificates according to which should be tried first when building a path from the target. The preference order is as follows: Given trusted certificate(s): Subject:ou=D,ou=C,o=B,c=A Preference order for current cert: 1) The key identifier of an AKID extension (if present) in the previous certificate matches the key identifier in the SKID extension 2) Issuer matches a trusted subject Issuer: ou=D,ou=C,o=B,c=A 3) Issuer is in the same namespace as a trusted subject (in order of number of links to the trusted subject). If the last RDN of the common ancestor is geographical, then it is skipped and the next trusted certificate is checked. a) Issuer: ou=G,ou=C,o=B,c=A [links=2] b) Issuer: ou=H,o=B,c=A [links=3] c) Issuer: ou=H,o=D,c=A [skipped, only geographical c=A is same] 4) Any other certificates

Field Summary

Modifier and Type	Field and Description
private final X509CertSelector	certSkidSelector
pack-priv static final String	METHOD_NME
private final Set<X500Principal>	trustedSubjectDNs

Constructor Summary

Access	Constructor and Description
pack-priv	PKIXCertComparator(Set<X500Principal> trustedSubjectDNs, X509CertImpl previousCert)

Method Summary

Modifier and Type	Method and Description
public int	Returns: -1 if oCert1 is preferable to oCert2, or if oCert1 and oCert2 are equally preferable (in this case it doesn't matter which is preferable, but we don't return 0 because the comparator would behave strangely when used in a SortedSet). 1 if oCert2 is preferable to oCert1 0 if oCert1.equals(oCert2). We only return 0 if the certs are equal so that this comparator behaves correctly when used in a SortedSet. compare(X509Certificate first X509Certificate to be compared oCert1, X509Certificate second X509Certificate to be compared oCert2) Implements java.util.Comparator.compare. Compares its two arguments for order.
private X509CertSelector	getSelector(X509CertImpl previousCert) Returns an X509CertSelector for matching on the authority key identifier, or null if not applicable.

Modifier and Type

Method and Description

public int

Returns:

-1 if oCert1 is preferable to oCert2, or if oCert1 and oCert2 are equally preferable (in this case it doesn't matter which is preferable, but we don't return 0 because the comparator would behave strangely when used in a SortedSet). 1 if oCert2 is preferable to oCert1 0 if oCert1.equals(oCert2). We only return 0 if the certs are equal so that this comparator behaves correctly when used in a SortedSet.

compare(X509Certificate

first X509Certificate to be compared

oCert1, X509Certificate

second X509Certificate to be compared

oCert2)

Implements java.util.Comparator.compare.

Compares its two arguments for order.

private X509CertSelector

getSelector(X509CertImpl previousCert)

Returns an X509CertSelector for matching on the authority key identifier, or null if not applicable.

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

Field Detail

certSkidSelector	back to summary
private final X509CertSelector certSkidSelector

METHOD_NME	back to summary
pack-priv static final String METHOD_NME

trustedSubjectDNs	back to summary
private final Set<X500Principal> trustedSubjectDNs

Constructor Detail

PKIXCertComparator	back to summary
pack-priv PKIXCertComparator(Set<X500Principal> trustedSubjectDNs, X509CertImpl previousCert) throws IOException

Method Detail

compare back to summary

compare	back to summary
public int compare(X509Certificate oCert1, X509Certificate oCert2) Implements java.util.Comparator.compare. Doc from java.util.Comparator.compare. Compares its two arguments for order. Returns a negative integer, zero, or a positive integer as the first argument is less than, equal to, or greater than the second. The implementor must ensure that `signum(compare(x, y)) == -signum(compare(y, x))` for all `x` and `y`. (This implies that `compare(x, y)` must throw an exception if and only if `compare(y, x)` throws an exception.) The implementor must also ensure that the relation is transitive: `((compare(x, y)>0) && (compare(y, z)>0))` implies `compare(x, z)>0`. Finally, the implementor must ensure that `compare(x, y)==0` implies that `signum(compare(x, z))==signum(compare(y, z))` for all `z`. Parameters oCert1:X509Certificate first X509Certificate to be compared oCert2:X509Certificate second X509Certificate to be compared Returns:int -1 if oCert1 is preferable to oCert2, or if oCert1 and oCert2 are equally preferable (in this case it doesn't matter which is preferable, but we don't return 0 because the comparator would behave strangely when used in a SortedSet). 1 if oCert2 is preferable to oCert1 0 if oCert1.equals(oCert2). We only return 0 if the certs are equal so that this comparator behaves correctly when used in a SortedSet. Annotations @Override

public int compare(X509Certificate oCert1, X509Certificate oCert2)

Implements java.util.Comparator.compare.

Doc from java.util.Comparator.compare.

Compares its two arguments for order. Returns a negative integer, zero, or a positive integer as the first argument is less than, equal to, or greater than the second.

The implementor must ensure that signum(compare(x, y)) == -signum(compare(y, x)) for all x and y. (This implies that compare(x, y) must throw an exception if and only if compare(y, x) throws an exception.)

The implementor must also ensure that the relation is transitive: ((compare(x, y)>0) && (compare(y, z)>0)) implies compare(x, z)>0.

Finally, the implementor must ensure that compare(x, y)==0 implies that signum(compare(x, z))==signum(compare(y, z)) for all z.

Parameters

oCert1:X509Certificate: first X509Certificate to be compared
oCert2:X509Certificate: second X509Certificate to be compared

Returns:int

Annotations

@Override

getSelector	back to summary
private X509CertSelector getSelector(X509CertImpl previousCert) throws IOException Returns an X509CertSelector for matching on the authority key identifier, or null if not applicable.

public final Class ForwardBuilder

Nested and Inner Type Summary

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail

pack-priv Class ForwardBuilder.PKIXCertComparator

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail

private Class ForwardBuilder.ThreadTrackerHolder

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail