Note that the validate() implementation tries to use a PKIX validator if that appears possible and a PKIX builder otherwise. This increases performance and currently also leads to better exception messages in case of failures.
PKIXValidator objects are immutable once they have been created.
Please DO NOT add methods that can change the state of an instance once
it has been created.
| Modifier and Type | Field and Description |
|---|---|
| private static final boolean | ALLOW_NON_CA_ANCHOR
System or security property that if set (or set to "true"), allows trust anchor certificates to be used if they do not have the proper CA extensions. |
| private int | |
| private static final boolean | checkTLSRevocation
Flag indicating whether to enable revocation check for the PKIX trust manager. |
| private final CertificateFactory | |
| private final PKIXBuilderParameters | |
| private final Set | |
| private final Map |
| Access | Constructor and Description |
|---|---|
| pack-priv | |
| pack-priv |
| Modifier and Type | Method and Description |
|---|---|
| private static void | addResponses(PKIXBuilderParameters
the pkixParameters object that will be used in
path validation. pkixParams, X509Certificate[] the chain of certificates to verify chain, List<byte[]> a responseList)List of zero or more byte arrays, each
one being a DER-encoded OCSP response (per RFC 6960). Entries
in the List must match the order of the certificates in the
chain parameter.For OCSP Stapling, add responses that came in during the handshake
into a |
| private static boolean | |
| private X509Certificate[] | doBuild(X509Certificate[] chain, Collection<X509Certificate> otherCerts, PKIXBuilderParameters params)
|
| private X509Certificate[] | |
| pack-priv X509Certificate[] | engineValidate(X509Certificate[] chain, Collection<X509Certificate> otherCerts, List<byte[]> responseList, AlgorithmConstraints constraints, Object parameter)
Implements abstract sun.
|
| public int | Returns: the length of the last certification path passed to CertPathValidator.validate, or -1 if it has not been invoked yetReturns the length of the last certification path that is validated by CertPathValidator. |
| public PKIXBuilderParameters | |
| public Collection | getTrustedCertificates()
Implements abstract sun. Returns an immutable Collection of the X509Certificates this instance uses as trust anchors. |
| private void | |
| private void | |
| private Map | Returns: Map containing each subject DN and one or more public keys tied to those DNs.Populate the trustedSubjects Map using the DN and public keys from the list of trusted certificates |
| private static X509Certificate[] | |
| private static void | verifyTrustAnchor(X509Certificate trustedCert)
Verify that a trust anchor certificate is a CA certificate. |
| ALLOW_NON_CA_ANCHOR | back to summary |
|---|---|
| private static final boolean ALLOW_NON_CA_ANCHOR System or security property that if set (or set to "true"), allows trust anchor certificates to be used if they do not have the proper CA extensions. Set to false if prop is not set, or set to any other value. | |
| certPathLength | back to summary |
|---|---|
| private int certPathLength | |
| checkTLSRevocation | back to summary |
|---|---|
| private static final boolean checkTLSRevocation Flag indicating whether to enable revocation check for the PKIX trust manager. Typically, this will only work if the PKIX implementation supports CRL distribution points as we do not manually set up CertStores. | |
| factory | back to summary |
|---|---|
| private final CertificateFactory factory | |
| parameterTemplate | back to summary |
|---|---|
| private final PKIXBuilderParameters parameterTemplate | |
| trustedCerts | back to summary |
|---|---|
| private final Set<X509Certificate> trustedCerts | |
| trustedSubjects | back to summary |
|---|---|
| private final Map<X500Principal, List<PublicKey>> trustedSubjects | |
| PKIXValidator | back to summary |
|---|---|
| pack-priv PKIXValidator(String variant, Collection<X509Certificate> trustedCerts) | |
| PKIXValidator | back to summary |
|---|---|
| pack-priv PKIXValidator(String variant, PKIXBuilderParameters params) | |
| addResponses | back to summary |
|---|---|
| private static void addResponses(PKIXBuilderParameters pkixParams, X509Certificate[] chain, List<byte[]> responseList) For OCSP Stapling, add responses that came in during the handshake
into a
| |
| allowNonCaAnchor | back to summary |
|---|---|
| private static boolean allowNonCaAnchor() | |
| doBuild | back to summary |
|---|---|
| private X509Certificate[] doBuild(X509Certificate[] chain, Collection<X509Certificate> otherCerts, PKIXBuilderParameters params) throws CertificateException | |
| doValidate | back to summary |
|---|---|
| private X509Certificate[] doValidate(X509Certificate[] chain, PKIXBuilderParameters params) throws CertificateException | |
| engineValidate | back to summary |
|---|---|
| pack-priv X509Certificate[] engineValidate(X509Certificate[] chain, Collection<X509Certificate> otherCerts, List<byte[]> responseList, AlgorithmConstraints constraints, Object parameter) throws CertificateException Implements abstract sun.
| |
| getCertPathLength | back to summary |
|---|---|
| public int getCertPathLength() Returns the length of the last certification path that is validated by CertPathValidator. This is intended primarily as a callback mechanism for PKIXCertPathCheckers to determine the length of the certification path that is being validated. It is necessary since engineValidate() may modify the length of the path.
| |
| getParameters | back to summary |
|---|---|
| public PKIXBuilderParameters getParameters() Return the PKIX parameters used by this instance. An application may modify the parameters but must make sure not to perform any concurrent validations. | |
| getTrustedCertificates | back to summary |
|---|---|
| public Collection Implements abstract sun. Doc from sun. Returns an immutable Collection of the X509Certificates this instance uses as trust anchors.
| |
| setDate | back to summary |
|---|---|
| private void setDate(PKIXBuilderParameters params) Set the check date (for debugging). | |
| setDefaultParameters | back to summary |
|---|---|
| private void setDefaultParameters(String variant) Set J2SE global default PKIX parameters. Currently, hardcoded to disable revocation checking. In the future, this should be configurable. | |
| setTrustedSubjects | back to summary |
|---|---|
| private Map Populate the trustedSubjects Map using the DN and public keys from the list of trusted certificates
| |
| toArray | back to summary |
|---|---|
| private static X509Certificate[] toArray(CertPath path, TrustAnchor anchor) throws CertificateException | |
| verifyTrustAnchor | back to summary |
|---|---|
| private static void verifyTrustAnchor(X509Certificate trustedCert) throws ValidatorException Verify that a trust anchor certificate is a CA certificate. | |
