Apache PDFBox 3.0.4 · org.apache.pdfbox.examples.signature.cert.CertificateVerifier

Modifier and Type	Field and Description
private static final Log	LOG

Access	Constructor and Description
private	CertificateVerifier()

Method Summary

Modifier and Type	Method and Description
private static void	checkRevocations(X509Certificate cert, Set<X509Certificate> additionalCerts, Date signDate)
private static void	checkRevocationsWithIssuer(X509Certificate cert, X509Certificate issuerCert, Set<X509Certificate> additionalCerts, Date signDate)
public static Set<X509Certificate>	Returns: a certificate set, never null. downloadExtraCertificates(X509Extension an X509 object that can have extensions. ext) Download extra certificates from the URI mentioned in id-ad-caIssuers in the "authority information access" extension.
private static String	Returns: the URL of the OCSP validation service extractOCSPURL(X509Certificate X.509 certificate cert) Extract the OCSP URL from an X.509 certificate if available.
public static boolean	Returns: true if the certificate is self-signed, false if not. isSelfSigned(X509Certificate The X.509 certificate to check. cert) Checks whether given X.509 certificate is self-signed.
public static PKIXCertPathBuilderResult	Returns: the certification chain (if verification is successful) verifyCertificate(X509Certificate - certificate for validation cert, Set<X509Certificate> - set of trusted root CA certificates that will be used as "trust anchors" and intermediate CA certificates that will be used as part of the certification chain. All self-signed certificates are considered to be trusted root CA certificates. All the rest are considered to be intermediate CA certificates. additionalCerts, boolean true if a self-signed certificate is accepted, false if not. verifySelfSignedCert, Date the date when the signing took place signDate) Attempts to build a certification chain for given certificate and to verify it.
private static PKIXCertPathBuilderResult	Returns: the certification chain (if verification is successful) verifyCertificate(X509Certificate - certificate for validation cert, Set<TrustAnchor> - set of trust anchors trustAnchors, Set<X509Certificate> - set of intermediate certificates intermediateCerts, Date the date when the signing took place signDate) Attempts to build a certification chain for given certificate and to verify it.
private static void	verifyOCSP(OcspHelper the OCSP helper. ocspHelper, Set<X509Certificate> additionalCerts) Verify whether the certificate has been revoked at signing date, and verify whether the certificate of the responder has been revoked now.

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

LOG	back to summary
private static final Log LOG

CertificateVerifier	back to summary
private CertificateVerifier()

Method Detail

checkRevocations	back to summary
private static void checkRevocations(X509Certificate cert, Set<X509Certificate> additionalCerts, Date signDate) throws IOException, CertificateVerificationException, OCSPException, RevokedCertificateException, GeneralSecurityException, URISyntaxException

checkRevocationsWithIssuer	back to summary
private static void checkRevocationsWithIssuer(X509Certificate cert, X509Certificate issuerCert, Set<X509Certificate> additionalCerts, Date signDate) throws OCSPException, CertificateVerificationException, RevokedCertificateException, GeneralSecurityException, IOException, URISyntaxException

downloadExtraCertificates	back to summary
public static Set<X509Certificate> downloadExtraCertificates(X509Extension ext) Download extra certificates from the URI mentioned in id-ad-caIssuers in the "authority information access" extension. The method is lenient, i.e. catches all exceptions. Parameters ext:X509Extension an X509 object that can have extensions. Returns:Set<X509Certificate> a certificate set, never null.

downloadExtraCertificates

back to summary

public static Set<X509Certificate> downloadExtraCertificates(X509Extension ext)

Download extra certificates from the URI mentioned in id-ad-caIssuers in the "authority information access" extension. The method is lenient, i.e. catches all exceptions.

Parameters

ext:X509Extension: an X509 object that can have extensions.

Returns:Set<X509Certificate>

a certificate set, never null.

extractOCSPURL	back to summary
private static String extractOCSPURL(X509Certificate cert) throws IOException Extract the OCSP URL from an X.509 certificate if available. Parameters cert:X509Certificate X.509 certificate Returns:String the URL of the OCSP validation service

extractOCSPURL

back to summary

private static String extractOCSPURL(X509Certificate cert) throws IOException

Extract the OCSP URL from an X.509 certificate if available.

Parameters

cert:X509Certificate: X.509 certificate

Returns:String

the URL of the OCSP validation service

isSelfSigned	back to summary
public static boolean isSelfSigned(X509Certificate cert) throws GeneralSecurityException Checks whether given X.509 certificate is self-signed. Parameters cert:X509Certificate The X.509 certificate to check. Returns:boolean true if the certificate is self-signed, false if not.

isSelfSigned

back to summary

public static boolean isSelfSigned(X509Certificate cert) throws GeneralSecurityException

Checks whether given X.509 certificate is self-signed.

Parameters

cert:X509Certificate: The X.509 certificate to check.

Returns:boolean

true if the certificate is self-signed, false if not.

verifyCertificate	back to summary
public static PKIXCertPathBuilderResult verifyCertificate(X509Certificate cert, Set<X509Certificate> additionalCerts, boolean verifySelfSignedCert, Date signDate) throws CertificateVerificationException Attempts to build a certification chain for given certificate and to verify it. Relies on a set of root CA certificates and intermediate certificates that will be used for building the certification chain. The verification process assumes that all self-signed certificates in the set are trusted root CA certificates and all other certificates in the set are intermediate certificates. Parameters cert:X509Certificate - certificate for validation additionalCerts:Set<X509Certificate> - set of trusted root CA certificates that will be used as "trust anchors" and intermediate CA certificates that will be used as part of the certification chain. All self-signed certificates are considered to be trusted root CA certificates. All the rest are considered to be intermediate CA certificates. verifySelfSignedCert:boolean true if a self-signed certificate is accepted, false if not. signDate:Date the date when the signing took place Returns:PKIXCertPathBuilderResult the certification chain (if verification is successful) Exceptions CertificateVerificationException: - if the certification is not successful (e.g. certification path cannot be built or some certificate in the chain is expired or CRL checks are failed)

verifyCertificate

back to summary

public static PKIXCertPathBuilderResult verifyCertificate(X509Certificate cert, Set<X509Certificate> additionalCerts, boolean verifySelfSignedCert, Date signDate) throws CertificateVerificationException

Attempts to build a certification chain for given certificate and to verify it. Relies on a set of root CA certificates and intermediate certificates that will be used for building the certification chain. The verification process assumes that all self-signed certificates in the set are trusted root CA certificates and all other certificates in the set are intermediate certificates.

Parameters

cert:X509Certificate: - certificate for validation
additionalCerts:Set<X509Certificate>: - set of trusted root CA certificates that will be used as "trust anchors" and intermediate CA certificates that will be used as part of the certification chain. All self-signed certificates are considered to be trusted root CA certificates. All the rest are considered to be intermediate CA certificates.
verifySelfSignedCert:boolean: true if a self-signed certificate is accepted, false if not.
signDate:Date: the date when the signing took place

Returns:PKIXCertPathBuilderResult

the certification chain (if verification is successful)

Exceptions

CertificateVerificationException:: - if the certification is not successful (e.g. certification path cannot be built or some certificate in the chain is expired or CRL checks are failed)

verifyCertificate	back to summary
private static PKIXCertPathBuilderResult verifyCertificate(X509Certificate cert, Set<TrustAnchor> trustAnchors, Set<X509Certificate> intermediateCerts, Date signDate) throws GeneralSecurityException Attempts to build a certification chain for given certificate and to verify it. Relies on a set of root CA certificates (trust anchors) and a set of intermediate certificates (to be used as part of the chain). Parameters cert:X509Certificate - certificate for validation trustAnchors:Set<TrustAnchor> - set of trust anchors intermediateCerts:Set<X509Certificate> - set of intermediate certificates signDate:Date the date when the signing took place Returns:PKIXCertPathBuilderResult the certification chain (if verification is successful) Exceptions GeneralSecurityException: - if the verification is not successful (e.g. certification path cannot be built or some certificate in the chain is expired)

verifyCertificate

back to summary

private static PKIXCertPathBuilderResult verifyCertificate(X509Certificate cert, Set<TrustAnchor> trustAnchors, Set<X509Certificate> intermediateCerts, Date signDate) throws GeneralSecurityException

Attempts to build a certification chain for given certificate and to verify it. Relies on a set of root CA certificates (trust anchors) and a set of intermediate certificates (to be used as part of the chain).

Parameters

cert:X509Certificate: - certificate for validation
trustAnchors:Set<TrustAnchor>: - set of trust anchors
intermediateCerts:Set<X509Certificate>: - set of intermediate certificates
signDate:Date: the date when the signing took place

Returns:PKIXCertPathBuilderResult

the certification chain (if verification is successful)

Exceptions

GeneralSecurityException:: - if the verification is not successful (e.g. certification path cannot be built or some certificate in the chain is expired)

verifyOCSP	back to summary
private static void verifyOCSP(OcspHelper ocspHelper, Set<X509Certificate> additionalCerts) throws RevokedCertificateException, IOException, OCSPException, CertificateVerificationException, URISyntaxException Verify whether the certificate has been revoked at signing date, and verify whether the certificate of the responder has been revoked now. Parameters ocspHelper:OcspHelper the OCSP helper.

verifyOCSP

back to summary

private static void verifyOCSP(OcspHelper ocspHelper, Set<X509Certificate> additionalCerts) throws RevokedCertificateException, IOException, OCSPException, CertificateVerificationException, URISyntaxException

Verify whether the certificate has been revoked at signing date, and verify whether the certificate of the responder has been revoked now.

Parameters

ocspHelper:OcspHelper: the OCSP helper.

public final Class CertificateVerifier

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail