APIdia Launch Partner
Top Description Fields Constructors Methods
sun.security.provider.certpath

public Class IndexedCollectionCertStore

extends CertStoreSpi
Class Inheritance
Imports
java.util.*, java.security.InvalidAlgorithmParameterException, java.security.cert.*, javax.security.auth.x500.X500Principal
A CertStore that retrieves Certificates and CRLs from a Collection.

This implementation is functionally equivalent to CollectionCertStore with two differences:

  1. Upon construction, the elements in the specified Collection are partially indexed. X509Certificates are indexed by subject, X509CRLs by issuer, non-X509 Certificates and CRLs are copied without indexing, other objects are ignored. This increases CertStore construction time but allows significant speedups for searches which specify the indexed attributes, in particular for large Collections (reduction from linear time to effectively constant time). Searches for non-indexed queries are as fast (or marginally faster) than for the standard CollectionCertStore. Certificate subjects and CRL issuers were found to be specified in most searches used internally by the CertPath provider. Additional attributes could be indexed if there are queries that justify the effort.
  2. Changes to the specified Collection after construction time are not detected and ignored. This is because there is no way to efficiently detect if a Collection has been modified, a full traversal would be required. That would degrade lookup performance to linear time and eliminated the benefit of indexing. We may fix this via the introduction of new public APIs in the future.

Before calling the engineGetCertificates or engineGetCRLs methods, the CollectionCertStore(CertStoreParameters) constructor is called to create the CertStore and establish the Collection from which Certificates and CRLs will be retrieved. If the specified Collection contains an object that is not a Certificate or CRL, that object will be ignored.

Concurrent Access

As described in the javadoc for CertStoreSpi, the engineGetCertificates and engineGetCRLs methods must be thread-safe. That is, multiple threads may concurrently invoke these methods on a single CollectionCertStore object (or more than one) with no ill effects.

This is achieved by requiring that the Collection passed to the CollectionCertStore(CertStoreParameters) constructor (via the CollectionCertStoreParameters object) must have fail-fast iterators. Simultaneous modifications to the Collection can thus be detected and certificate or CRL retrieval can be retried. The fact that Certificates and CRLs must be thread-safe is also essential.

Author
Andreas Sterbenz
See Also
java.security.cert.CertStore, CollectionCertStore

Field Summary

Modifier and TypeField and Description
private Map<X500Principal, Object>
certSubjects

Map X500Principal(subject) -> X509Certificate | List of X509Certificate

private Map<X500Principal, Object>
crlIssuers

Map X500Principal(issuer) -> X509CRL | List of X509CRL

private Set<Certificate>
otherCertificates

Sets of non-X509 certificates and CRLs

private Set<CRL>
otherCRLs

Constructor Summary

AccessConstructor and Description
public
IndexedCollectionCertStore(CertStoreParameters
the algorithm parameters
params)

Creates a CertStore with the specified parameters.

Method Summary

Modifier and TypeMethod and Description
private void
buildIndex(Collection<?> coll)

Index the specified Collection copying all references to Certificates and CRLs.

public Collection<? extends Certificate>

Returns:

a Collection of Certificates that match the specified selector
engineGetCertificates(CertSelector
a CertSelector used to select which Certificates should be returned. Specify null to return all Certificates.
selector)

Implements abstract java.security.cert.CertStoreSpi.engineGetCertificates.

Returns a Collection of Certificates that match the specified selector.

public Collection<CRL>

Returns:

a Collection of CRLs that match the specified selector
engineGetCRLs(CRLSelector
a CRLSelector used to select which CRLs should be returned. Specify null to return all CRLs.
selector)

Implements abstract java.security.cert.CertStoreSpi.engineGetCRLs.

Returns a Collection of CRLs that match the specified selector.

private void
indexCertificate(X509Certificate cert)

Add an X509Certificate to the index.

private void
indexCRL(X509CRL crl)

Add an X509CRL to the index.

private void
matchX509Certs(CertSelector selector, Collection<Certificate> matches)

Iterate through all the X509Certificates and add matches to the collection.

private void
matchX509CRLs(CRLSelector selector, Collection<CRL> matches)

Iterate through all the X509CRLs and add matches to the collection.

Field Detail

certSubjectsback to summary
private Map<X500Principal, Object> certSubjects

Map X500Principal(subject) -> X509Certificate | List of X509Certificate

crlIssuersback to summary
private Map<X500Principal, Object> crlIssuers

Map X500Principal(issuer) -> X509CRL | List of X509CRL

otherCertificatesback to summary
private Set<Certificate> otherCertificates

Sets of non-X509 certificates and CRLs

otherCRLsback to summary
private Set<CRL> otherCRLs

Constructor Detail

IndexedCollectionCertStoreback to summary
public IndexedCollectionCertStore(CertStoreParameters params) throws InvalidAlgorithmParameterException

Creates a CertStore with the specified parameters. For this class, the parameters object must be an instance of CollectionCertStoreParameters.

Parameters
params:CertStoreParameters

the algorithm parameters

Exceptions
InvalidAlgorithmParameterException:
if params is not an instance of CollectionCertStoreParameters

Method Detail

buildIndexback to summary
private void buildIndex(Collection<?> coll)

Index the specified Collection copying all references to Certificates and CRLs.

engineGetCertificatesback to summary
public Collection<? extends Certificate> engineGetCertificates(CertSelector selector) throws CertStoreException

Implements abstract java.security.cert.CertStoreSpi.engineGetCertificates.

Returns a Collection of Certificates that match the specified selector. If no Certificates match the selector, an empty Collection will be returned.

Parameters
selector:CertSelector

a CertSelector used to select which Certificates should be returned. Specify null to return all Certificates.

Returns:Collection<? extends Certificate>

a Collection of Certificates that match the specified selector

Annotations
@Override
Exceptions
CertStoreException:
if an exception occurs
engineGetCRLsback to summary
public Collection<CRL> engineGetCRLs(CRLSelector selector) throws CertStoreException

Implements abstract java.security.cert.CertStoreSpi.engineGetCRLs.

Returns a Collection of CRLs that match the specified selector. If no CRLs match the selector, an empty Collection will be returned.

Parameters
selector:CRLSelector

a CRLSelector used to select which CRLs should be returned. Specify null to return all CRLs.

Returns:Collection<CRL>

a Collection of CRLs that match the specified selector

Annotations
@Override
Exceptions
CertStoreException:
if an exception occurs
indexCertificateback to summary
private void indexCertificate(X509Certificate cert)

Add an X509Certificate to the index.

indexCRLback to summary
private void indexCRL(X509CRL crl)

Add an X509CRL to the index.

matchX509Certsback to summary
private void matchX509Certs(CertSelector selector, Collection<Certificate> matches)

Iterate through all the X509Certificates and add matches to the collection.

matchX509CRLsback to summary
private void matchX509CRLs(CRLSelector selector, Collection<CRL> matches)

Iterate through all the X509CRLs and add matches to the collection.