APIdia Launch Partner
Top Description Fields Constructors Methods
sun.security.x509

public Class NameConstraintsExtension

extends Extension
implements Cloneable
Class Inheritance
All Implemented Interfaces
java.lang.Cloneable
Imports
java.io.IOException, java.security.cert.CertificateException, .X509Certificate, javax.security.auth.x500.X500Principal, sun.net.util.IPAddressUtil, sun.security.util.*, sun.security.pkcs.PKCS9Attribute
This class defines the Name Constraints Extension.

The name constraints extension provides permitted and excluded subtrees that place restrictions on names that may be included within a certificate issued by a given CA. Restrictions may apply to the subject distinguished name or subject alternative names. Any name matching a restriction in the excluded subtrees field is invalid regardless of information appearing in the permitted subtrees.

The ASN.1 syntax for this is: 

NameConstraints ::= SEQUENCE {
   permittedSubtrees [0]  GeneralSubtrees OPTIONAL,
   excludedSubtrees  [1]  GeneralSubtrees OPTIONAL
}
GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree
Authors
Amit Kapoor, Hemma Prafullchandra
See Also
Extension

Field Summary

Modifier and TypeField and Description
private GeneralSubtrees
excluded

private boolean
hasMax

private boolean
hasMin

private boolean
minMaxValid

public static final String
NAME

private GeneralSubtrees
permitted

private static final byte
TAG_EXCLUDED

private static final byte
TAG_PERMITTED

Inherited from sun.security.x509.Extension:
criticalextensionIdextensionValue

Constructor Summary

AccessConstructor and Description
public
NameConstraintsExtension(GeneralSubtrees
the permitted GeneralSubtrees (null for optional).
permitted, GeneralSubtrees
the excluded GeneralSubtrees (null for optional).
excluded)

The default constructor for this class.

public
NameConstraintsExtension(Boolean
true if the extension is to be treated as critical.
critical, Object
an array of DER encoded bytes of the actual value.
value)

Create the extension from the passed DER encoded value.

Method Summary

Modifier and TypeMethod and Description
private void
calcMinMax()

public Object
clone()

Overrides java.lang.Object.clone.

Clone all objects that may be modified during certificate validation.

public void
encode(DerOutputStream
the DerOutputStream to write the extension to.
out)

Overrides sun.security.x509.Extension.encode.

Implements sun.security.util.DerEncoder.encode.

Write the extension to the OutputStream.

private void
encodeThis()

public GeneralSubtrees
getExcludedSubtrees()

public String
getName()

Overrides sun.security.x509.Extension.getName.

Return the name of this extension.

public GeneralSubtrees
getPermittedSubtrees()

private static boolean
hasNameType(GeneralNames names, int type)

public void
merge(NameConstraintsExtension
additional NameConstraints to be applied
newConstraints)

Merge additional name constraints with existing ones.

public String
toString()

Overrides sun.security.x509.Extension.toString.

Return the printable string.

public boolean

Returns:

true if certificate verifies successfully
verify(X509Certificate
X509Certificate to be verified
cert)

check whether a certificate conforms to these NameConstraints.

public boolean

Returns:

true if certificate verifies successfully
verify(GeneralNameInterface
GeneralNameInterface name to be verified
name)

check whether a name conforms to these NameConstraints.

Inherited from sun.security.x509.Extension:
encodeequalsgetExtensionIdgetExtensionValuegetIdgetValuehashCodeisCriticalnewExtension

Field Detail

excludedback to summary
private GeneralSubtrees excluded
hasMaxback to summary
private boolean hasMax
hasMinback to summary
private boolean hasMin
minMaxValidback to summary
private boolean minMaxValid
NAMEback to summary
public static final String NAME
permittedback to summary
private GeneralSubtrees permitted
TAG_EXCLUDEDback to summary
private static final byte TAG_EXCLUDED
TAG_PERMITTEDback to summary
private static final byte TAG_PERMITTED

Constructor Detail

NameConstraintsExtensionback to summary
public NameConstraintsExtension(GeneralSubtrees permitted, GeneralSubtrees excluded)

The default constructor for this class. Both parameters are optional but at least one should be non null. The extension criticality is set to true.

Parameters
permitted:GeneralSubtrees

the permitted GeneralSubtrees (null for optional).

excluded:GeneralSubtrees

the excluded GeneralSubtrees (null for optional).

NameConstraintsExtensionback to summary
public NameConstraintsExtension(Boolean critical, Object value) throws IOException

Create the extension from the passed DER encoded value.

Parameters
critical:Boolean

true if the extension is to be treated as critical.

value:Object

an array of DER encoded bytes of the actual value.

Exceptions
IOException:
on error.
ClassCastException:
if value is not an array of bytes

Method Detail

calcMinMaxback to summary
private void calcMinMax()
cloneback to summary
public Object clone()

Overrides java.lang.Object.clone.

Clone all objects that may be modified during certificate validation.

encodeback to summary
public void encode(DerOutputStream out)

Overrides sun.security.x509.Extension.encode.

Implements sun.security.util.DerEncoder.encode.

Write the extension to the OutputStream.

Parameters
out:DerOutputStream

the DerOutputStream to write the extension to.

Annotations
@Override
encodeThisback to summary
private void encodeThis()
getExcludedSubtreesback to summary
public GeneralSubtrees getExcludedSubtrees()
getNameback to summary
public String getName()

Overrides sun.security.x509.Extension.getName.

Return the name of this extension.

Annotations
@Override
getPermittedSubtreesback to summary
public GeneralSubtrees getPermittedSubtrees()
hasNameTypeback to summary
private static boolean hasNameType(GeneralNames names, int type)
mergeback to summary
public void merge(NameConstraintsExtension newConstraints) throws IOException

Merge additional name constraints with existing ones. This function is used in certification path processing to accumulate name constraints from successive certificates in the path. Note that NameConstraints can never be expanded by a merge, just remain constant or become more limiting.

IETF RFC 5280 specifies the processing of Name Constraints as follows:

(j) If permittedSubtrees is present in the certificate, set the constrained subtrees state variable to the intersection of its previous value and the value indicated in the extension field.

(k) If excludedSubtrees is present in the certificate, set the excluded subtrees state variable to the union of its previous value and the value indicated in the extension field.

Parameters
newConstraints:NameConstraintsExtension

additional NameConstraints to be applied

Exceptions
IOException:
on error
toStringback to summary
public String toString()

Overrides sun.security.x509.Extension.toString.

Return the printable string.

verifyback to summary
public boolean verify(X509Certificate cert) throws IOException

check whether a certificate conforms to these NameConstraints. This involves verifying that the subject name and subjectAltName extension (critical or noncritical) is consistent with the permitted subtrees state variables. Also verify that the subject name and subjectAltName extension (critical or noncritical) is consistent with the excluded subtrees state variables.

Parameters
cert:X509Certificate

X509Certificate to be verified

Returns:boolean

true if certificate verifies successfully

Exceptions
IOException:
on error
verifyback to summary
public boolean verify(GeneralNameInterface name) throws IOException

check whether a name conforms to these NameConstraints. This involves verifying that the name is consistent with the permitted and excluded subtrees variables.

Parameters
name:GeneralNameInterface

GeneralNameInterface name to be verified

Returns:boolean

true if certificate verifies successfully

Exceptions
IOException:
on error