OpenJDK 27 · sun.security.validator.EndEntityChecker

Class to check if an end entity cert is suitable for use in some context.

This class is used internally by the validator. Currently, seven variants are supported defined as VAR_XXX constants in the Validator class:

Generic. No additional requirements, all certificates are ok.
TLS server. Requires that a String parameter is passed to validate that specifies the name of the TLS key exchange algorithm in use. See the JSSE X509TrustManager spec for details.
TLS client.
Code signing.
JCE code signing. Some early JCE code signing certs issued to providers had incorrect extensions. In this mode the checks are relaxed compared to standard code signing checks in order to allow these certificates to pass.
TSA Server (see RFC 3161, section 2.3).

Field Summary

Modifier and Type	Field and Description
private static final int	KU_KEY_AGREEMENT
private static final int	KU_KEY_ENCIPHERMENT
private static final int	KU_NON_REPUDIATION
private static final Collection<String>	KU_SERVER_ENCRYPTION
private static final Collection<String>	KU_SERVER_KEY_AGREEMENT
private static final Collection<String>	KU_SERVER_SIGNATURE
private static final int	KU_SIGNATURE
private static final String	NSCT_CODE_SIGNING
private static final String	NSCT_SSL_CLIENT
private static final String	NSCT_SSL_SERVER
private static final String	OID_EKU_ANY_USAGE
private static final String	OID_EKU_CODE_SIGNING
private static final String	OID_EKU_MS_SGC
private static final String	OID_EKU_NS_SGC
private static final String	OID_EKU_TIME_STAMPING
private static final String	OID_EKU_TLS_CLIENT
private static final String	OID_EKU_TLS_SERVER
private static final String	OID_EXTENDED_KEY_USAGE
private static final String	OID_SUBJECT_ALT_NAME
private final String	type
private final String	variant

Constructor Summary

Access	Constructor and Description
private	EndEntityChecker(String type, String variant)

Method Summary

Modifier and Type	Method and Description
pack-priv void	check(X509Certificate[] chain, Object parameter, boolean checkUnresolvedCritExts)
private void	checkCodeSigning(X509Certificate cert, Set<String> exts) Check whether this certificate can be used for code signing.
private boolean	checkEKU(X509Certificate cert, Set<String> exts, String expectedEKU) Utility method checking if the extended key usage extension in certificate cert allows use for expectedEKU.
private boolean	checkKeyUsage(X509Certificate cert, int bit) Utility method checking if bit 'bit' is set in this certificates key usage extension.
private void	checkRemainingExtensions(Set<String> exts) Utility method checking if there are any unresolved critical extensions.
private void	checkTLSClient(X509Certificate cert, Set<String> exts) Check whether this certificate can be used for TLS client authentication.
private void	checkTLSServer(X509Certificate cert, String parameter, Set<String> exts) Check whether this certificate can be used for TLS server authentication using the specified authentication type parameter.
private void	checkTSAServer(X509Certificate cert, Set<String> exts) Check whether this certificate can be used by a time stamping authority server (see RFC 3161, section 2.3).
private Set<String>	getCriticalExtensions(X509Certificate cert) Utility method returning the Set of critical extensions for certificate cert (never null).
pack-priv static EndEntityChecker	getInstance(String type, String variant)

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

Field Detail

KU_KEY_AGREEMENT	back to summary
private static final int KU_KEY_AGREEMENT

KU_KEY_ENCIPHERMENT	back to summary
private static final int KU_KEY_ENCIPHERMENT

KU_NON_REPUDIATION	back to summary
private static final int KU_NON_REPUDIATION

KU_SERVER_ENCRYPTION	back to summary
private static final Collection<String> KU_SERVER_ENCRYPTION

KU_SERVER_KEY_AGREEMENT	back to summary
private static final Collection<String> KU_SERVER_KEY_AGREEMENT

KU_SERVER_SIGNATURE	back to summary
private static final Collection<String> KU_SERVER_SIGNATURE

KU_SIGNATURE	back to summary
private static final int KU_SIGNATURE

NSCT_CODE_SIGNING	back to summary
private static final String NSCT_CODE_SIGNING

NSCT_SSL_CLIENT	back to summary
private static final String NSCT_SSL_CLIENT

NSCT_SSL_SERVER	back to summary
private static final String NSCT_SSL_SERVER

OID_EKU_ANY_USAGE	back to summary
private static final String OID_EKU_ANY_USAGE

OID_EKU_CODE_SIGNING	back to summary
private static final String OID_EKU_CODE_SIGNING

OID_EKU_MS_SGC	back to summary
private static final String OID_EKU_MS_SGC

OID_EKU_NS_SGC	back to summary
private static final String OID_EKU_NS_SGC

OID_EKU_TIME_STAMPING	back to summary
private static final String OID_EKU_TIME_STAMPING

OID_EKU_TLS_CLIENT	back to summary
private static final String OID_EKU_TLS_CLIENT

OID_EKU_TLS_SERVER	back to summary
private static final String OID_EKU_TLS_SERVER

OID_EXTENDED_KEY_USAGE	back to summary
private static final String OID_EXTENDED_KEY_USAGE

OID_SUBJECT_ALT_NAME	back to summary
private static final String OID_SUBJECT_ALT_NAME

type	back to summary
private final String type

variant	back to summary
private final String variant

Constructor Detail

EndEntityChecker	back to summary
private EndEntityChecker(String type, String variant)

Method Detail

check	back to summary
pack-priv void check(X509Certificate[] chain, Object parameter, boolean checkUnresolvedCritExts) throws CertificateException

checkCodeSigning	back to summary
private void checkCodeSigning(X509Certificate cert, Set<String> exts) throws CertificateException Check whether this certificate can be used for code signing. Exceptions CertificateException: if not.

checkCodeSigning

back to summary

private void checkCodeSigning(X509Certificate cert, Set<String> exts) throws CertificateException

Check whether this certificate can be used for code signing.

Exceptions

CertificateException:: if not.

checkEKU	back to summary
private boolean checkEKU(X509Certificate cert, Set<String> exts, String expectedEKU) throws CertificateException Utility method checking if the extended key usage extension in certificate cert allows use for expectedEKU.

checkKeyUsage	back to summary
private boolean checkKeyUsage(X509Certificate cert, int bit) Utility method checking if bit 'bit' is set in this certificates key usage extension.

checkRemainingExtensions	back to summary
private void checkRemainingExtensions(Set<String> exts) throws CertificateException Utility method checking if there are any unresolved critical extensions. Exceptions CertificateException: if so.

checkRemainingExtensions

back to summary

private void checkRemainingExtensions(Set<String> exts) throws CertificateException

Utility method checking if there are any unresolved critical extensions.

Exceptions

CertificateException:: if so.

checkTLSClient	back to summary
private void checkTLSClient(X509Certificate cert, Set<String> exts) throws CertificateException Check whether this certificate can be used for TLS client authentication. Exceptions CertificateException: if not.

checkTLSClient

back to summary

private void checkTLSClient(X509Certificate cert, Set<String> exts) throws CertificateException

Check whether this certificate can be used for TLS client authentication.

Exceptions

CertificateException:: if not.

checkTLSServer	back to summary
private void checkTLSServer(X509Certificate cert, String parameter, Set<String> exts) throws CertificateException Check whether this certificate can be used for TLS server authentication using the specified authentication type parameter. See X509TrustManager specification for details. Exceptions CertificateException: if not.

checkTLSServer

back to summary

private void checkTLSServer(X509Certificate cert, String parameter, Set<String> exts) throws CertificateException

Check whether this certificate can be used for TLS server authentication using the specified authentication type parameter. See X509TrustManager specification for details.

Exceptions

CertificateException:: if not.

checkTSAServer	back to summary
private void checkTSAServer(X509Certificate cert, Set<String> exts) throws CertificateException Check whether this certificate can be used by a time stamping authority server (see RFC 3161, section 2.3). Exceptions CertificateException: if not.

checkTSAServer

back to summary

private void checkTSAServer(X509Certificate cert, Set<String> exts) throws CertificateException

Check whether this certificate can be used by a time stamping authority server (see RFC 3161, section 2.3).

Exceptions

CertificateException:: if not.

getCriticalExtensions	back to summary
private Set<String> getCriticalExtensions(X509Certificate cert) Utility method returning the Set of critical extensions for certificate cert (never null).

getInstance	back to summary
pack-priv static EndEntityChecker getInstance(String type, String variant)

pack-priv Class EndEntityChecker

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail