Top Description Fields Constructors Methods
org.apache.pdfbox.examples.signature.cert

public final Class CRLVerifier

extends Object
Class Inheritance
Imports
java.io.ByteArrayInputStream, .IOException, .InputStream, java.net.URISyntaxException, java.security.GeneralSecurityException, java.security.cert.CRLException, .CertificateException, .CertificateFactory, .X509CRL, .X509CRLEntry, .X509Certificate, java.util.ArrayList, .Calendar, .Date, .Hashtable, .List, .Set, javax.naming.Context, .NamingException, javax.naming.directory.Attribute, .Attributes, .DirContext, .InitialDirContext, org.apache.commons.logging.Log, .LogFactory, org.apache.pdfbox.examples.signature.SigUtils, org.apache.pdfbox.pdmodel.encryption.SecurityProvider, org.bouncycastle.asn1.ASN1IA5String, .ASN1InputStream, .ASN1OctetString, .ASN1Primitive, org.bouncycastle.asn1.x509.CRLDistPoint, .DistributionPoint, .DistributionPointName, .Extension, .GeneralName, .GeneralNames
Copied from Apache CXF 2.4.9, initial version: https://svn.apache.org/repos/asf/cxf/tags/cxf-2.4.9/distribution/src/main/release/samples/sts_issue_operation/src/main/java/demo/sts/provider/cert/

Field Summary

Modifier and TypeField and Description
private static final Log
LOG

Constructor Summary

AccessConstructor and Description
private
CRLVerifier()

Method Summary

Modifier and TypeMethod and Description
public static void
checkRevocation(X509CRL
certificate revocation list
crl, X509Certificate
certificate to be checked
cert, Date
date the certificate was used for signing
signDate, String
URL for log message or exception text
crlDistributionPointsURL)

Check whether the certificate was revoked at signing time.

private static X509CRL
downloadCRL(String crlURL)

Downloads CRL from given URL.

private static X509CRL
downloadCRLFromLDAP(String ldapURL)

Downloads a CRL from given LDAP url, e.g. ldap://ldap.infonotary.com/dc=identity-ca,dc=infonotary,dc=com

public static X509CRL
downloadCRLFromWeb(String crlURL)

Downloads a CRL from given HTTP/HTTPS/FTP URL, e.g. http://crl.infonotary.com/crl/identity-ca.crl

public static List<String>

Returns:

List of CRL distribution point URLs.
getCrlDistributionPoints(X509Certificate cert)

Extracts all CRL distribution point URLs from the "CRL Distribution Point" extension in a X.509 certificate.

public static void
verifyCertificateCRLs(X509Certificate
the certificate to be checked for revocation
cert, Date
the date when the signing took place
signDate, Set<X509Certificate>
set of trusted root CA certificates that will be used as "trust anchors" and intermediate CA certificates that will be used as part of the certification chain.
additionalCerts)

Extracts the CRL distribution points from the certificate (if available) and checks the certificate revocation status against the CRLs coming from the distribution points.

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

LOGback to summary
private static final Log LOG

Constructor Detail

CRLVerifierback to summary
private CRLVerifier()

Method Detail

checkRevocationback to summary
public static void checkRevocation(X509CRL crl, X509Certificate cert, Date signDate, String crlDistributionPointsURL) throws RevokedCertificateException

Check whether the certificate was revoked at signing time.

Parameters
crl:X509CRL

certificate revocation list

cert:X509Certificate

certificate to be checked

signDate:Date

date the certificate was used for signing

crlDistributionPointsURL:String

URL for log message or exception text

Exceptions
RevokedCertificateException:
if the certificate was revoked at signing time
downloadCRLback to summary
private static X509CRL downloadCRL(String crlURL) throws IOException, CertificateException, CRLException, CertificateVerificationException, NamingException, URISyntaxException

Downloads CRL from given URL. Supports http, https, ftp and ldap based URLs.

downloadCRLFromLDAPback to summary
private static X509CRL downloadCRLFromLDAP(String ldapURL) throws CertificateException, NamingException, CRLException, CertificateVerificationException

Downloads a CRL from given LDAP url, e.g. ldap://ldap.infonotary.com/dc=identity-ca,dc=infonotary,dc=com

downloadCRLFromWebback to summary
public static X509CRL downloadCRLFromWeb(String crlURL) throws IOException, CertificateException, CRLException, URISyntaxException

Downloads a CRL from given HTTP/HTTPS/FTP URL, e.g. http://crl.infonotary.com/crl/identity-ca.crl

getCrlDistributionPointsback to summary
public static List<String> getCrlDistributionPoints(X509Certificate cert) throws IOException

Extracts all CRL distribution point URLs from the "CRL Distribution Point" extension in a X.509 certificate. If CRL distribution point extension is unavailable, returns an empty list.

Returns:List<String>

List of CRL distribution point URLs.

verifyCertificateCRLsback to summary
public static void verifyCertificateCRLs(X509Certificate cert, Date signDate, Set<X509Certificate> additionalCerts) throws CertificateVerificationException, RevokedCertificateException

Extracts the CRL distribution points from the certificate (if available) and checks the certificate revocation status against the CRLs coming from the distribution points. Supports HTTP, HTTPS, FTP and LDAP based URLs.

Parameters
cert:X509Certificate

the certificate to be checked for revocation

signDate:Date

the date when the signing took place

additionalCerts:Set<X509Certificate>

set of trusted root CA certificates that will be used as "trust anchors" and intermediate CA certificates that will be used as part of the certification chain.

Annotations
@SuppressWarnings:squid:S1141
Exceptions
CertificateVerificationException:
if the certificate could not be verified
RevokedCertificateException:
if the certificate is revoked