OpenJDK 27 · sun.security.validator.Validator · APIdia, the JavaDoc alternative

Validator abstract base class. Concrete classes are instantiated by calling one of the getInstance() methods. All methods defined in this class must be safe for concurrent use by multiple threads.

The model is that a Validator instance is created specifying validation settings, such as trust anchors or PKIX parameters. Then one or more paths are validated using those parameters. In some cases, additional information can be provided per path validation. This is independent of the validation parameters and currently only used for TLS server validation.

Path validation is performed by calling one of the validate() methods. It specifies a suggested path to be used for validation if available, or only the end entity certificate otherwise. Optionally additional certificates can be specified that the caller believes could be helpful. Implementations are free to make use of this information or validate the path using other means. validate() also checks that the end entity certificate is suitable for the intended purpose as described below.

There are two orthogonal parameters to select the Validator implementation: type and variant. Type selects the validation algorithm. Currently, supported are TYPE_SIMPLE and TYPE_PKIX. See SimpleValidator and PKIXValidator for details.

Variant controls additional extension checks. Currently, supported are five variants:

VAR_GENERIC (no additional checks),
VAR_TLS_CLIENT (TLS client specific checks)
VAR_TLS_SERVER (TLS server specific checks), and
VAR_CODE_SIGNING (code signing specific checks).
VAR_JCE_SIGNING (JCE code signing specific checks).
VAR_TSA_SERVER (TSA server specific checks).

See EndEntityChecker for more information.

Examples:

  // instantiate validator specifying type, variant, and trust anchors
  Validator validator = Validator.getInstance(Validator.TYPE_PKIX,
                                              Validator.VAR_TLS_CLIENT,
                                              trustedCerts);
  // validate one or more chains using the validator
  validator.validate(chain); // throws CertificateException if failed

Field Summary

Modifier and Type	Field and Description
pack-priv static final X509Certificate[]	CHAIN0
pack-priv final EndEntityChecker	endEntityChecker
private final String	type
public static final String	TYPE_PKIX Constant for a validator of type PKIX.
public static final String	TYPE_SIMPLE Constant for a validator of type Simple.
pack-priv volatile Date	validationDate Deprecated
public static final String	VAR_CODE_SIGNING Constant for a Code Signing variant of a validator.
public static final String	VAR_GENERIC Constant for a Generic variant of a validator.
public static final String	VAR_JCE_SIGNING Constant for a JCE Code Signing variant of a validator.
public static final String	VAR_TLS_CLIENT Constant for a TLS Client variant of a validator.
public static final String	VAR_TLS_SERVER Constant for a TLS Server variant of a validator.
public static final String	VAR_TSA_SERVER Constant for a TSA Server variant of a validator.
pack-priv final String	variant

Constructor Summary

Access	Constructor and Description
pack-priv	Validator(String type, String variant)

Method Summary

Modifier and Type	Method and Description
pack-priv abstract X509Certificate[]	engineValidate(X509Certificate[] chain, Collection<X509Certificate> otherCerts, List<byte[]> responseList, AlgorithmConstraints constraints, Object parameter)
public static Validator	getInstance(String type, String variant, KeyStore ks) Get a new Validator instance using the trusted certificates from the specified KeyStore as trust anchors.
public static Validator	getInstance(String type, String variant, Collection<X509Certificate> trustedCerts) Get a new Validator instance using the Set of X509Certificates as trust anchors.
public static Validator	getInstance(String type, String variant, PKIXBuilderParameters params) Get a new Validator instance using the provided PKIXBuilderParameters.
public abstract Collection<X509Certificate>	getTrustedCertificates() Returns an immutable Collection of the X509Certificates this instance uses as trust anchors.
public void	setValidationDate(Date validationDate) Deprecated Set the date to be used for subsequent validations.
public final X509Certificate[]	validate(X509Certificate[] chain) Validate the given certificate chain.
public final X509Certificate[]	validate(X509Certificate[] chain, Collection<X509Certificate> otherCerts) Validate the given certificate chain.
public final X509Certificate[]	Returns: a non-empty chain that was used to validate the path. The end entity cert is at index 0, the trust anchor at index n-1. validate(X509Certificate[] chain, Collection<X509Certificate> otherCerts, Object parameter) Validate the given certificate chain.
public final X509Certificate[]	Returns: a non-empty chain that was used to validate the path. The end entity cert is at index 0, the trust anchor at index n-1. validate(X509Certificate[] the target certificate chain chain, Collection<X509Certificate> a Collection of additional X509Certificates that could be helpful for path building (or null) otherCerts, List<byte[]> a List of zero or more byte arrays, each one being a DER-encoded OCSP response (per RFC 6960). Entries in the List must match the order of the certificates in the chain parameter. It is possible that fewer responses may be in the list than are elements in `chain` and a missing response for a matching element in `chain` can be represented with a zero-length byte array. responseList, AlgorithmConstraints algorithm constraints for certification path processing constraints, Object an additional parameter object to pass specific data. This parameter object maybe one of the two below: 1) TLS_SERVER variant validators, where it must be non-null and the name of the TLS key exchange algorithm being used (see JSSE X509TrustManager specification). 2) `Timestamp` object from a signed JAR file. parameter) Validate the given certificate chain.

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

Field Detail

CHAIN0	back to summary
pack-priv static final X509Certificate[] CHAIN0

endEntityChecker	back to summary
pack-priv final EndEntityChecker endEntityChecker

type	back to summary
private final String type

TYPE_PKIX back to summary

TYPE_PKIX	back to summary
public static final String TYPE_PKIX Constant for a validator of type PKIX. See Also `getInstance`

public static final String TYPE_PKIX

Constant for a validator of type PKIX.

See Also: getInstance

TYPE_SIMPLE back to summary

TYPE_SIMPLE	back to summary
public static final String TYPE_SIMPLE Constant for a validator of type Simple. See Also `getInstance`

public static final String TYPE_SIMPLE

Constant for a validator of type Simple.

See Also: getInstance

validationDate	back to summary
pack-priv volatile Date validationDate Deprecated Annotations @Deprecated See Also `setValidationDate`

VAR_CODE_SIGNING back to summary

VAR_CODE_SIGNING	back to summary
public static final String VAR_CODE_SIGNING Constant for a Code Signing variant of a validator. See Also `getInstance`

public static final String VAR_CODE_SIGNING

Constant for a Code Signing variant of a validator.

See Also: getInstance

VAR_GENERIC back to summary

VAR_GENERIC	back to summary
public static final String VAR_GENERIC Constant for a Generic variant of a validator. See Also `getInstance`

public static final String VAR_GENERIC

Constant for a Generic variant of a validator.

See Also: getInstance

VAR_JCE_SIGNING back to summary

VAR_JCE_SIGNING	back to summary
public static final String VAR_JCE_SIGNING Constant for a JCE Code Signing variant of a validator. See Also `getInstance`

public static final String VAR_JCE_SIGNING

Constant for a JCE Code Signing variant of a validator.

See Also: getInstance

VAR_TLS_CLIENT back to summary

VAR_TLS_CLIENT	back to summary
public static final String VAR_TLS_CLIENT Constant for a TLS Client variant of a validator. See Also `getInstance`

public static final String VAR_TLS_CLIENT

Constant for a TLS Client variant of a validator.

See Also: getInstance

VAR_TLS_SERVER back to summary

VAR_TLS_SERVER	back to summary
public static final String VAR_TLS_SERVER Constant for a TLS Server variant of a validator. See Also `getInstance`

public static final String VAR_TLS_SERVER

Constant for a TLS Server variant of a validator.

See Also: getInstance

VAR_TSA_SERVER back to summary

VAR_TSA_SERVER	back to summary
public static final String VAR_TSA_SERVER Constant for a TSA Server variant of a validator. See Also `getInstance`

public static final String VAR_TSA_SERVER

Constant for a TSA Server variant of a validator.

See Also: getInstance

variant	back to summary
pack-priv final String variant

Constructor Detail

Validator	back to summary
pack-priv Validator(String type, String variant)

Method Detail

engineValidate	back to summary
pack-priv abstract X509Certificate[] engineValidate(X509Certificate[] chain, Collection<X509Certificate> otherCerts, List<byte[]> responseList, AlgorithmConstraints constraints, Object parameter) throws CertificateException

getInstance	back to summary
public static Validator getInstance(String type, String variant, KeyStore ks) Get a new Validator instance using the trusted certificates from the specified KeyStore as trust anchors.

getInstance	back to summary
public static Validator getInstance(String type, String variant, Collection<X509Certificate> trustedCerts) Get a new Validator instance using the Set of X509Certificates as trust anchors.

getInstance	back to summary
public static Validator getInstance(String type, String variant, PKIXBuilderParameters params) Get a new Validator instance using the provided PKIXBuilderParameters. This method can only be used with the PKIX validator.

getTrustedCertificates	back to summary
public abstract Collection<X509Certificate> getTrustedCertificates() Returns an immutable Collection of the X509Certificates this instance uses as trust anchors.

setValidationDate	back to summary
public void setValidationDate(Date validationDate) Deprecated Set the date to be used for subsequent validations. NOTE that this is not a supported API, it is provided to simplify writing tests only. Annotations @Deprecated

setValidationDate

back to summary

public void setValidationDate(Date validationDate)

Deprecated

Set the date to be used for subsequent validations. NOTE that this is not a supported API, it is provided to simplify writing tests only.

Annotations

@Deprecated

validate	back to summary
public final X509Certificate[] validate(X509Certificate[] chain) throws CertificateException Validate the given certificate chain.

validate	back to summary
public final X509Certificate[] validate(X509Certificate[] chain, Collection<X509Certificate> otherCerts) throws CertificateException Validate the given certificate chain. If otherCerts is non-null, it is a Collection of additional X509Certificates that could be helpful for path building.

validate	back to summary
public final X509Certificate[] validate(X509Certificate[] chain, Collection<X509Certificate> otherCerts, Object parameter) throws CertificateException Validate the given certificate chain. If otherCerts is non-null, it is a Collection of additional X509Certificates that could be helpful for path building. Returns:X509Certificate[] a non-empty chain that was used to validate the path. The end entity cert is at index 0, the trust anchor at index n-1.

validate

back to summary

public final X509Certificate[] validate(X509Certificate[] chain, Collection<X509Certificate> otherCerts, Object parameter) throws CertificateException

Validate the given certificate chain. If otherCerts is non-null, it is a Collection of additional X509Certificates that could be helpful for path building.

Returns:X509Certificate[]: a non-empty chain that was used to validate the path. The end entity cert is at index 0, the trust anchor at index n-1.

validate back to summary

validate	back to summary
public final X509Certificate[] validate(X509Certificate[] chain, Collection<X509Certificate> otherCerts, List<byte[]> responseList, AlgorithmConstraints constraints, Object parameter) throws CertificateException Validate the given certificate chain. Parameters chain:X509Certificate[] the target certificate chain otherCerts:Collection<X509Certificate> a Collection of additional X509Certificates that could be helpful for path building (or null) responseList:List<byte[]> a List of zero or more byte arrays, each one being a DER-encoded OCSP response (per RFC 6960). Entries in the List must match the order of the certificates in the chain parameter. It is possible that fewer responses may be in the list than are elements in `chain` and a missing response for a matching element in `chain` can be represented with a zero-length byte array. constraints:AlgorithmConstraints algorithm constraints for certification path processing parameter:Object an additional parameter object to pass specific data. This parameter object maybe one of the two below: 1) TLS_SERVER variant validators, where it must be non-null and the name of the TLS key exchange algorithm being used (see JSSE X509TrustManager specification). 2) `Timestamp` object from a signed JAR file. Returns:X509Certificate[] a non-empty chain that was used to validate the path. The end entity cert is at index 0, the trust anchor at index n-1.

public final X509Certificate[] validate(X509Certificate[] chain, Collection<X509Certificate> otherCerts, List<byte[]> responseList, AlgorithmConstraints constraints, Object parameter) throws CertificateException

Validate the given certificate chain.

Parameters

chain:X509Certificate[]: the target certificate chain
otherCerts:Collection<X509Certificate>: a Collection of additional X509Certificates that could be helpful for path building (or null)
responseList:List<byte[]>: a List of zero or more byte arrays, each one being a DER-encoded OCSP response (per RFC 6960). Entries in the List must match the order of the certificates in the chain parameter. It is possible that fewer responses may be in the list than are elements in chain and a missing response for a matching element in chain can be represented with a zero-length byte array.
constraints:AlgorithmConstraints: algorithm constraints for certification path processing
parameter:Object: an additional parameter object to pass specific data. This parameter object maybe one of the two below: 1) TLS_SERVER variant validators, where it must be non-null and the name of the TLS key exchange algorithm being used (see JSSE X509TrustManager specification). 2) Timestamp object from a signed JAR file.

Returns:X509Certificate[]