OpenJDK 27 · sun.security.provider.certpath.PolicyChecker

Modifier and Type	Field and Description
pack-priv static final String	ANY_POLICY
private final boolean	anyPolicyInhibited
private int	certIndex
private final int	certPathLen
private static final Debug	debug
private int	explicitPolicy
private final boolean	expPolicyRequired
private int	inhibitAnyPolicy
private final Set<String>	initPolicies
private int	policyMapping
private final boolean	polMappingInhibited
private final boolean	rejectPolicyQualifiers
private PolicyNodeImpl	rootNode
private Set<String>	supportedExts

Access	Constructor and Description
pack-priv	PolicyChecker(Set<String> Set of initial policies initialPolicies, int length of the certification path to be checked certPathLen, boolean true if explicit policy is required expPolicyRequired, boolean true if policy mapping is inhibited polMappingInhibited, boolean true if the ANY_POLICY OID should be inhibited anyPolicyInhibited, boolean true if pol qualifiers are to be rejected rejectPolicyQualifiers, PolicyNodeImpl the initial root node of the valid policy tree rootNode) Constructs a Policy Checker.

Method Summary

Modifier and Type	Method and Description
public void	check(Certificate the Certificate to be processed cert, Collection<String> the unresolved critical extensions unresCritExts) Implements abstract java.security.cert.PKIXCertPathChecker.check. Performs the policy processing checks on the certificate using its internal state.
private void	checkPolicy(X509Certificate the certificate to be processed currCert) Internal method to run through all the checks.
pack-priv PolicyNode	Returns: the root node of the valid policy tree, or null if the valid policy tree is null getPolicyTree() Gets the root node of the valid policy tree, or null if the valid policy tree is null.
public Set<String>	Returns: the Set of extensions supported by this PKIXCertPathChecker, or null if no extensions are supported getSupportedExtensions() Implements abstract java.security.cert.PKIXCertPathChecker.getSupportedExtensions. Gets an immutable Set of the OID strings for the extensions that the PKIXCertPathChecker supports (i.e. recognizes, is able to process), or null if no extensions are supported.
public void	init(boolean a boolean indicating whether this checker should be initialized capable of building in the forward direction forward) Implements abstract java.security.cert.PKIXCertPathChecker.init. Implements java.security.cert.CertPathChecker.init. Initializes the internal state of the checker from parameters specified in the constructor
public boolean	Returns: true if forward checking is supported, false otherwise isForwardCheckingSupported() Implements abstract java.security.cert.PKIXCertPathChecker.isForwardCheckingSupported. Implements java.security.cert.CertPathChecker.isForwardCheckingSupported. Checks if forward checking is supported.
pack-priv static int	Returns: returns the new explicitPolicy value mergeExplicitPolicy(int an integer which indicates if a non-null valid policy tree is required explicitPolicy, X509CertImpl the Certificate to be processed currCert, boolean a boolean indicating whether currCert is the final cert in the cert path finalCert) Merges the specified explicitPolicy value with the requireExplicitPolicy field of the `PolicyConstraints` extension obtained from the certificate.
pack-priv static int	Returns: returns the new inhibitAnyPolicy value mergeInhibitAnyPolicy(int an integer which indicates whether "any-policy" is considered a match inhibitAnyPolicy, X509CertImpl the Certificate to be processed currCert) Merges the specified inhibitAnyPolicy value with the SkipCerts value of the InhibitAnyPolicy extension obtained from the certificate.
pack-priv static int	Returns: returns the new policyMapping value mergePolicyMapping(int an integer which indicates if policy mapping is inhibited policyMapping, X509CertImpl the Certificate to be processed currCert) Merges the specified policyMapping value with the inhibitPolicyMapping field of the `PolicyConstraints` extension obtained from the certificate.
private static boolean	Returns: a boolean indicating whether a match was found processParents(int the index of the certificate whose policy is being processed certIndex, boolean a boolean indicating whether the certificate policies extension is critical policiesCritical, boolean a boolean indicating whether the user wants to reject policies that have qualifiers rejectPolicyQualifiers, PolicyNodeImpl the root node of the valid policy tree rootNode, String a String representing the policy being processed curPolicy, Set<PolicyQualifierInfo> the policy qualifiers of the policy being processed or an empty Set if there are no qualifiers pQuals, boolean a boolean indicating whether a value of ANY_POLICY in the expected policy set will be considered a match matchAny) Finds the policy nodes of depth (certIndex-1) where curPolicy is in the expected policy set and creates a new child node appropriately.
pack-priv static PolicyNodeImpl	Returns: the root node of the valid policy tree after modification processPolicies(int the index of the certificate certIndex, Set<String> the initial policies required by the user initPolicies, int an integer which indicates if a non-null valid policy tree is required explicitPolicy, int an integer which indicates if policy mapping is inhibited policyMapping, int an integer which indicates whether "any-policy" is considered a match inhibitAnyPolicy, boolean a boolean indicating whether the user wants to reject policies that have qualifiers rejectPolicyQualifiers, PolicyNodeImpl the root node of the valid policy tree origRootNode, X509CertImpl the Certificate to be processed currCert, boolean a boolean indicating whether currCert is the final cert in the cert path finalCert) Processes certificate policies in the certificate.
private static PolicyNodeImpl	Returns: the root node of the valid policy tree after modification processPolicyMappings(X509CertImpl the Certificate to be processed currCert, int the index of the current certificate certIndex, int an integer which indicates if policy mapping is inhibited policyMapping, PolicyNodeImpl the root node of the valid policy tree rootNode, boolean a boolean indicating if the certificate policies extension is critical policiesCritical, Set<PolicyQualifierInfo> the qualifiers associated with ANY-POLICY, or an empty Set if there are no qualifiers associated with ANY-POLICY anyQuals) Processes policy mappings in the certificate.
private static PolicyNodeImpl	Returns: the root node of the valid policy tree after modification removeInvalidNodes(PolicyNodeImpl the root node of the valid policy tree rootNode, int the index of the certificate being processed certIndex, Set<String> the Set of policies required by the user initPolicies, CertificatePoliciesExtension the CertificatePoliciesExtension of the certificate being processed currCertPolicies) Removes those nodes which do not intersect with the initial policies specified by the user.
private static PolicyNodeImpl	rewriteLeafNodes(int the depth of the tree certIndex, Set<String> Set of user specified initial policies initPolicies, PolicyNodeImpl the root of the policy tree rootNode) Rewrite leaf nodes at the end of validation as described in RFC 5280 section 6.1.5: Step (g)(iii).

Inherited from java.security.cert.PKIXCertPathChecker:: check clone

ANY_POLICY	back to summary
pack-priv static final String ANY_POLICY

anyPolicyInhibited	back to summary
private final boolean anyPolicyInhibited

certIndex	back to summary
private int certIndex

certPathLen	back to summary
private final int certPathLen

debug	back to summary
private static final Debug debug

explicitPolicy	back to summary
private int explicitPolicy

expPolicyRequired	back to summary
private final boolean expPolicyRequired

inhibitAnyPolicy	back to summary
private int inhibitAnyPolicy

initPolicies	back to summary
private final Set<String> initPolicies

policyMapping	back to summary
private int policyMapping

polMappingInhibited	back to summary
private final boolean polMappingInhibited

rejectPolicyQualifiers	back to summary
private final boolean rejectPolicyQualifiers

rootNode	back to summary
private PolicyNodeImpl rootNode

supportedExts	back to summary
private Set<String> supportedExts

PolicyChecker	back to summary
pack-priv PolicyChecker(Set<String> initialPolicies, int certPathLen, boolean expPolicyRequired, boolean polMappingInhibited, boolean anyPolicyInhibited, boolean rejectPolicyQualifiers, PolicyNodeImpl rootNode) Constructs a Policy Checker. Parameters initialPolicies:Set<String> Set of initial policies certPathLen:int length of the certification path to be checked expPolicyRequired:boolean true if explicit policy is required polMappingInhibited:boolean true if policy mapping is inhibited anyPolicyInhibited:boolean true if the ANY_POLICY OID should be inhibited rejectPolicyQualifiers:boolean true if pol qualifiers are to be rejected rootNode:PolicyNodeImpl the initial root node of the valid policy tree

Method Detail

check	back to summary
public void check(Certificate cert, Collection<String> unresCritExts) throws CertPathValidatorException Implements abstract java.security.cert.PKIXCertPathChecker.check. Performs the policy processing checks on the certificate using its internal state. Parameters cert:Certificate the Certificate to be processed unresCritExts:Collection<String> the unresolved critical extensions Annotations @Override Exceptions CertPathValidatorException: if the certificate does not verify

check

back to summary

public void check(Certificate cert, Collection<String> unresCritExts) throws CertPathValidatorException

Implements abstract java.security.cert.PKIXCertPathChecker.check.

Performs the policy processing checks on the certificate using its internal state.

Parameters

cert:Certificate: the Certificate to be processed
unresCritExts:Collection<String>: the unresolved critical extensions

Annotations

@Override

Exceptions

CertPathValidatorException:: if the certificate does not verify

checkPolicy	back to summary
private void checkPolicy(X509Certificate currCert) throws CertPathValidatorException Internal method to run through all the checks. Parameters currCert:X509Certificate the certificate to be processed Exceptions CertPathValidatorException: Exception thrown if the certificate does not verify

checkPolicy

back to summary

private void checkPolicy(X509Certificate currCert) throws CertPathValidatorException

Internal method to run through all the checks.

Parameters

currCert:X509Certificate: the certificate to be processed

Exceptions

CertPathValidatorException:: Exception thrown if the certificate does not verify

getPolicyTree	back to summary
pack-priv PolicyNode getPolicyTree() Gets the root node of the valid policy tree, or null if the valid policy tree is null. Marks each node of the returned tree immutable and thread-safe. Returns:PolicyNode the root node of the valid policy tree, or null if the valid policy tree is null

getPolicyTree

back to summary

pack-priv PolicyNode getPolicyTree()

Gets the root node of the valid policy tree, or null if the valid policy tree is null. Marks each node of the returned tree immutable and thread-safe.

Returns:PolicyNode: the root node of the valid policy tree, or null if the valid policy tree is null

getSupportedExtensions	back to summary
public Set<String> getSupportedExtensions() Implements abstract java.security.cert.PKIXCertPathChecker.getSupportedExtensions. Gets an immutable Set of the OID strings for the extensions that the PKIXCertPathChecker supports (i.e. recognizes, is able to process), or null if no extensions are supported. All OID strings that a PKIXCertPathChecker might possibly be able to process should be included. Returns:Set<String> the Set of extensions supported by this PKIXCertPathChecker, or null if no extensions are supported Annotations @Override

getSupportedExtensions

back to summary

public Set<String> getSupportedExtensions()

Implements abstract java.security.cert.PKIXCertPathChecker.getSupportedExtensions.

Gets an immutable Set of the OID strings for the extensions that the PKIXCertPathChecker supports (i.e. recognizes, is able to process), or null if no extensions are supported. All OID strings that a PKIXCertPathChecker might possibly be able to process should be included.

Returns:Set<String>

the Set of extensions supported by this PKIXCertPathChecker, or null if no extensions are supported

Annotations

@Override

init	back to summary
public void init(boolean forward) throws CertPathValidatorException Implements abstract java.security.cert.PKIXCertPathChecker.init. Implements java.security.cert.CertPathChecker.init. Initializes the internal state of the checker from parameters specified in the constructor Parameters forward:boolean a boolean indicating whether this checker should be initialized capable of building in the forward direction Annotations @Override Exceptions CertPathValidatorException: if user wants to enable forward checking and forward checking is not supported.

init

back to summary

public void init(boolean forward) throws CertPathValidatorException

Implements abstract java.security.cert.PKIXCertPathChecker.init.

Implements java.security.cert.CertPathChecker.init.

Initializes the internal state of the checker from parameters specified in the constructor

Parameters

forward:boolean: a boolean indicating whether this checker should be initialized capable of building in the forward direction

Annotations

@Override

Exceptions

CertPathValidatorException:: if user wants to enable forward checking and forward checking is not supported.

isForwardCheckingSupported	back to summary
public boolean isForwardCheckingSupported() Implements abstract java.security.cert.PKIXCertPathChecker.isForwardCheckingSupported. Implements java.security.cert.CertPathChecker.isForwardCheckingSupported. Checks if forward checking is supported. Forward checking refers to the ability of the PKIXCertPathChecker to perform its checks when presented with certificates in the forward direction (from target to anchor). Returns:boolean true if forward checking is supported, false otherwise Annotations @Override

isForwardCheckingSupported

back to summary

public boolean isForwardCheckingSupported()

Implements abstract java.security.cert.PKIXCertPathChecker.isForwardCheckingSupported.

Implements java.security.cert.CertPathChecker.isForwardCheckingSupported.

Checks if forward checking is supported. Forward checking refers to the ability of the PKIXCertPathChecker to perform its checks when presented with certificates in the forward direction (from target to anchor).

Returns:boolean

true if forward checking is supported, false otherwise

Annotations

@Override

mergeExplicitPolicy back to summary

mergeExplicitPolicy	back to summary
pack-priv static int mergeExplicitPolicy(int explicitPolicy, X509CertImpl currCert, boolean finalCert) throws CertPathValidatorException Merges the specified explicitPolicy value with the requireExplicitPolicy field of the `PolicyConstraints` extension obtained from the certificate. An explicitPolicy value of -1 implies no constraint. Parameters explicitPolicy:int an integer which indicates if a non-null valid policy tree is required currCert:X509CertImpl the Certificate to be processed finalCert:boolean a boolean indicating whether currCert is the final cert in the cert path Returns:int returns the new explicitPolicy value Exceptions CertPathValidatorException: Exception thrown if an error occurs

pack-priv static int mergeExplicitPolicy(int explicitPolicy, X509CertImpl currCert, boolean finalCert) throws CertPathValidatorException

Merges the specified explicitPolicy value with the requireExplicitPolicy field of the PolicyConstraints extension obtained from the certificate. An explicitPolicy value of -1 implies no constraint.

Parameters

explicitPolicy:int: an integer which indicates if a non-null valid policy tree is required
currCert:X509CertImpl: the Certificate to be processed
finalCert:boolean: a boolean indicating whether currCert is the final cert in the cert path

Returns:int

returns the new explicitPolicy value

Exceptions

CertPathValidatorException:: Exception thrown if an error occurs

mergeInhibitAnyPolicy	back to summary
pack-priv static int mergeInhibitAnyPolicy(int inhibitAnyPolicy, X509CertImpl currCert) throws CertPathValidatorException Merges the specified inhibitAnyPolicy value with the SkipCerts value of the InhibitAnyPolicy extension obtained from the certificate. Parameters inhibitAnyPolicy:int an integer which indicates whether "any-policy" is considered a match currCert:X509CertImpl the Certificate to be processed Returns:int returns the new inhibitAnyPolicy value Exceptions CertPathValidatorException: Exception thrown if an error occurs

mergeInhibitAnyPolicy

back to summary

pack-priv static int mergeInhibitAnyPolicy(int inhibitAnyPolicy, X509CertImpl currCert) throws CertPathValidatorException

Merges the specified inhibitAnyPolicy value with the SkipCerts value of the InhibitAnyPolicy extension obtained from the certificate.

Parameters

inhibitAnyPolicy:int: an integer which indicates whether "any-policy" is considered a match
currCert:X509CertImpl: the Certificate to be processed

Returns:int

returns the new inhibitAnyPolicy value

Exceptions

CertPathValidatorException:: Exception thrown if an error occurs

mergePolicyMapping back to summary

mergePolicyMapping	back to summary
pack-priv static int mergePolicyMapping(int policyMapping, X509CertImpl currCert) throws CertPathValidatorException Merges the specified policyMapping value with the inhibitPolicyMapping field of the `PolicyConstraints` extension obtained from the certificate. A policyMapping value of -1 implies no constraint. Parameters policyMapping:int an integer which indicates if policy mapping is inhibited currCert:X509CertImpl the Certificate to be processed Returns:int returns the new policyMapping value Exceptions CertPathValidatorException: Exception thrown if an error occurs

pack-priv static int mergePolicyMapping(int policyMapping, X509CertImpl currCert) throws CertPathValidatorException

Merges the specified policyMapping value with the inhibitPolicyMapping field of the PolicyConstraints extension obtained from the certificate. A policyMapping value of -1 implies no constraint.

Parameters

policyMapping:int: an integer which indicates if policy mapping is inhibited
currCert:X509CertImpl: the Certificate to be processed

Returns:int

returns the new policyMapping value

Exceptions

CertPathValidatorException:: Exception thrown if an error occurs

processParents	back to summary
private static boolean processParents(int certIndex, boolean policiesCritical, boolean rejectPolicyQualifiers, PolicyNodeImpl rootNode, String curPolicy, Set<PolicyQualifierInfo> pQuals, boolean matchAny) Finds the policy nodes of depth (certIndex-1) where curPolicy is in the expected policy set and creates a new child node appropriately. If matchAny is true, then a value of ANY_POLICY in the expected policy set will match any curPolicy. If matchAny is false, then the expected policy set must exactly contain the curPolicy to be considered a match. This method returns a boolean value indicating whether a match was found. Parameters certIndex:int the index of the certificate whose policy is being processed policiesCritical:boolean a boolean indicating whether the certificate policies extension is critical rejectPolicyQualifiers:boolean a boolean indicating whether the user wants to reject policies that have qualifiers rootNode:PolicyNodeImpl the root node of the valid policy tree curPolicy:String a String representing the policy being processed pQuals:Set<PolicyQualifierInfo> the policy qualifiers of the policy being processed or an empty Set if there are no qualifiers matchAny:boolean a boolean indicating whether a value of ANY_POLICY in the expected policy set will be considered a match Returns:boolean a boolean indicating whether a match was found

processParents

back to summary

private static boolean processParents(int certIndex, boolean policiesCritical, boolean rejectPolicyQualifiers, PolicyNodeImpl rootNode, String curPolicy, Set<PolicyQualifierInfo> pQuals, boolean matchAny)

Finds the policy nodes of depth (certIndex-1) where curPolicy is in the expected policy set and creates a new child node appropriately. If matchAny is true, then a value of ANY_POLICY in the expected policy set will match any curPolicy. If matchAny is false, then the expected policy set must exactly contain the curPolicy to be considered a match. This method returns a boolean value indicating whether a match was found.

Parameters

certIndex:int: the index of the certificate whose policy is being processed
policiesCritical:boolean: a boolean indicating whether the certificate policies extension is critical
rejectPolicyQualifiers:boolean: a boolean indicating whether the user wants to reject policies that have qualifiers
rootNode:PolicyNodeImpl: the root node of the valid policy tree
curPolicy:String: a String representing the policy being processed
pQuals:Set<PolicyQualifierInfo>: the policy qualifiers of the policy being processed or an empty Set if there are no qualifiers
matchAny:boolean: a boolean indicating whether a value of ANY_POLICY in the expected policy set will be considered a match

Returns:boolean

a boolean indicating whether a match was found

processPolicies	back to summary
pack-priv static PolicyNodeImpl processPolicies(int certIndex, Set<String> initPolicies, int explicitPolicy, int policyMapping, int inhibitAnyPolicy, boolean rejectPolicyQualifiers, PolicyNodeImpl origRootNode, X509CertImpl currCert, boolean finalCert) throws CertPathValidatorException Processes certificate policies in the certificate. Parameters certIndex:int the index of the certificate initPolicies:Set<String> the initial policies required by the user explicitPolicy:int an integer which indicates if a non-null valid policy tree is required policyMapping:int an integer which indicates if policy mapping is inhibited inhibitAnyPolicy:int an integer which indicates whether "any-policy" is considered a match rejectPolicyQualifiers:boolean a boolean indicating whether the user wants to reject policies that have qualifiers origRootNode:PolicyNodeImpl the root node of the valid policy tree currCert:X509CertImpl the Certificate to be processed finalCert:boolean a boolean indicating whether currCert is the final cert in the cert path Returns:PolicyNodeImpl the root node of the valid policy tree after modification Exceptions CertPathValidatorException: Exception thrown if an error occurs while processing policies.

processPolicies

back to summary

pack-priv static PolicyNodeImpl processPolicies(int certIndex, Set<String> initPolicies, int explicitPolicy, int policyMapping, int inhibitAnyPolicy, boolean rejectPolicyQualifiers, PolicyNodeImpl origRootNode, X509CertImpl currCert, boolean finalCert) throws CertPathValidatorException

Processes certificate policies in the certificate.

Parameters

certIndex:int: the index of the certificate
initPolicies:Set<String>: the initial policies required by the user
explicitPolicy:int: an integer which indicates if a non-null valid policy tree is required
policyMapping:int: an integer which indicates if policy mapping is inhibited
inhibitAnyPolicy:int: an integer which indicates whether "any-policy" is considered a match
rejectPolicyQualifiers:boolean: a boolean indicating whether the user wants to reject policies that have qualifiers
origRootNode:PolicyNodeImpl: the root node of the valid policy tree
currCert:X509CertImpl: the Certificate to be processed
finalCert:boolean: a boolean indicating whether currCert is the final cert in the cert path

Returns:PolicyNodeImpl

the root node of the valid policy tree after modification

Exceptions

CertPathValidatorException:: Exception thrown if an error occurs while processing policies.

processPolicyMappings	back to summary
private static PolicyNodeImpl processPolicyMappings(X509CertImpl currCert, int certIndex, int policyMapping, PolicyNodeImpl rootNode, boolean policiesCritical, Set<PolicyQualifierInfo> anyQuals) throws CertPathValidatorException Processes policy mappings in the certificate. Parameters currCert:X509CertImpl the Certificate to be processed certIndex:int the index of the current certificate policyMapping:int an integer which indicates if policy mapping is inhibited rootNode:PolicyNodeImpl the root node of the valid policy tree policiesCritical:boolean a boolean indicating if the certificate policies extension is critical anyQuals:Set<PolicyQualifierInfo> the qualifiers associated with ANY-POLICY, or an empty Set if there are no qualifiers associated with ANY-POLICY Returns:PolicyNodeImpl the root node of the valid policy tree after modification Exceptions CertPathValidatorException: exception thrown if an error occurs while processing policy mappings

processPolicyMappings

back to summary

private static PolicyNodeImpl processPolicyMappings(X509CertImpl currCert, int certIndex, int policyMapping, PolicyNodeImpl rootNode, boolean policiesCritical, Set<PolicyQualifierInfo> anyQuals) throws CertPathValidatorException

Processes policy mappings in the certificate.

Parameters

currCert:X509CertImpl: the Certificate to be processed
certIndex:int: the index of the current certificate
policyMapping:int: an integer which indicates if policy mapping is inhibited
rootNode:PolicyNodeImpl: the root node of the valid policy tree
policiesCritical:boolean: a boolean indicating if the certificate policies extension is critical
anyQuals:Set<PolicyQualifierInfo>: the qualifiers associated with ANY-POLICY, or an empty Set if there are no qualifiers associated with ANY-POLICY

Returns:PolicyNodeImpl

the root node of the valid policy tree after modification

Exceptions

CertPathValidatorException:: exception thrown if an error occurs while processing policy mappings

removeInvalidNodes	back to summary
private static PolicyNodeImpl removeInvalidNodes(PolicyNodeImpl rootNode, int certIndex, Set<String> initPolicies, CertificatePoliciesExtension currCertPolicies) throws CertPathValidatorException Removes those nodes which do not intersect with the initial policies specified by the user. Parameters rootNode:PolicyNodeImpl the root node of the valid policy tree certIndex:int the index of the certificate being processed initPolicies:Set<String> the Set of policies required by the user currCertPolicies:CertificatePoliciesExtension the CertificatePoliciesExtension of the certificate being processed Returns:PolicyNodeImpl the root node of the valid policy tree after modification Exceptions CertPathValidatorException: Exception thrown if error occurs.

removeInvalidNodes

back to summary

private static PolicyNodeImpl removeInvalidNodes(PolicyNodeImpl rootNode, int certIndex, Set<String> initPolicies, CertificatePoliciesExtension currCertPolicies) throws CertPathValidatorException

Removes those nodes which do not intersect with the initial policies specified by the user.

Parameters

rootNode:PolicyNodeImpl: the root node of the valid policy tree
certIndex:int: the index of the certificate being processed
initPolicies:Set<String>: the Set of policies required by the user
currCertPolicies:CertificatePoliciesExtension: the CertificatePoliciesExtension of the certificate being processed

Returns:PolicyNodeImpl

the root node of the valid policy tree after modification

Exceptions

CertPathValidatorException:: Exception thrown if error occurs.

rewriteLeafNodes	back to summary
private static PolicyNodeImpl rewriteLeafNodes(int certIndex, Set<String> initPolicies, PolicyNodeImpl rootNode) Rewrite leaf nodes at the end of validation as described in RFC 5280 section 6.1.5: Step (g)(iii). Leaf nodes with anyPolicy are replaced by nodes explicitly representing initial policies not already represented by leaf nodes. This method should only be called when processing the final cert and if the policy tree is not null and initial policies is not anyPolicy. Parameters certIndex:int the depth of the tree initPolicies:Set<String> Set of user specified initial policies rootNode:PolicyNodeImpl the root of the policy tree

rewriteLeafNodes

back to summary

private static PolicyNodeImpl rewriteLeafNodes(int certIndex, Set<String> initPolicies, PolicyNodeImpl rootNode)

Rewrite leaf nodes at the end of validation as described in RFC 5280 section 6.1.5: Step (g)(iii). Leaf nodes with anyPolicy are replaced by nodes explicitly representing initial policies not already represented by leaf nodes. This method should only be called when processing the final cert and if the policy tree is not null and initial policies is not anyPolicy.

Parameters

certIndex:int: the depth of the tree
initPolicies:Set<String>: Set of user specified initial policies
rootNode:PolicyNodeImpl: the root of the policy tree

pack-priv Class PolicyChecker

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail