Top Fields Constructors Methods
org.bouncycastle.jcajce.provider

pack-priv Class CertPathValidatorUtilities

extends Object
Class Inheritance
Imports
java.io.ByteArrayOutputStream, .IOException, java.math.BigInteger, java.security.GeneralSecurityException, .KeyFactory, .Provider, .PublicKey, java.security.cert.CRLException, .CertPath, .CertPathValidatorException, .CertStore, .CertStoreException, .Certificate, .CertificateParsingException, .PolicyQualifierInfo, .TrustAnchor, .X509CRL, .X509CRLEntry, .X509CRLSelector, .X509CertSelector, .X509Certificate, java.security.interfaces.DSAParams, .DSAPublicKey, java.security.spec.DSAPublicKeySpec, java.text.ParseException, java.util.ArrayList, .Collection, .Collections, .Date, .Enumeration, .HashSet, .Iterator, .LinkedHashSet, .List, .Map, .Set, javax.security.auth.x500.X500Principal, org.bouncycastle.asn1.ASN1Encodable, .ASN1Enumerated, .ASN1GeneralizedTime, .ASN1Integer, .ASN1ObjectIdentifier, .ASN1OctetString, .ASN1OutputStream, .ASN1Primitive, .ASN1Sequence, org.bouncycastle.asn1.isismtt.ISISMTTObjectIdentifiers, org.bouncycastle.asn1.x500.X500Name, org.bouncycastle.asn1.x509.AlgorithmIdentifier, .CRLDistPoint, .CRLReason, .DistributionPoint, .DistributionPointName, .Extension, .GeneralName, .GeneralNames, .SubjectPublicKeyInfo, org.bouncycastle.jcajce.PKIXCRLStore, .PKIXCRLStoreSelector, .PKIXCertStore, .PKIXCertStoreSelector, .PKIXExtendedParameters, org.bouncycastle.util.Selector, .Store, .StoreException

Field Summary

Modifier and TypeField and Description
protected static final String
ANY_POLICY

protected static final String
CRL_NUMBER

protected static final int
CRL_SIGN

protected static final PKIXCRLUtil
CRL_UTIL

protected static final String[]
crlReasons

protected static final int
KEY_CERT_SIGN

Constructor Summary

AccessConstructor and Description
pack-priv
CertPathValidatorUtilities()

Method Summary

Modifier and TypeMethod and Description
protected static Collection<E>

Returns:

a Collection of all found X509Certificate May be empty but never null.
findCertificates(PKIXCertStoreSelector<T extends Certificate>
a Selector object that will be used to select the certificates
certSelect, List<E>
a List containing only Store objects. These are used to search for certificates.
certStores)

Return a Collection of all certificates or attribute certificates found in the X509Store's that are matching the certSelect criteriums.

pack-priv static Collection<E>

Returns:

A Collection object containing the issuer X509Certificates. Never null.
findIssuerCerts(X509Certificate
The certificate for which an issuer should be found.
cert, List<CertStore> certStores, List<PKIXCertStore<T extends Certificate>> pkixCertStores)

Find the issuer certificates of a given certificate.

protected static TrustAnchor

Returns:

the TrustAnchor object if found or null if not.
findTrustAnchor(X509Certificate
the X509 certificate
cert, Set<E>
a Set of TrustAnchor's
trustAnchors)

Search the given Set of TrustAnchor's for one that is the issuer of the given X509 certificate.

protected static TrustAnchor

Returns:

the TrustAnchor object if found or null if not.
findTrustAnchor(X509Certificate
the X509 certificate
cert, Set<E>
a Set of TrustAnchor's
trustAnchors, String
the provider to use for signature verification
sigProvider)

Search the given Set of TrustAnchor's for one that is the issuer of the given X509 certificate.

pack-priv static List<PKIXCertStore<T extends Certificate>>
getAdditionalStoresFromAltNames(byte[] issuerAlternativeName, Map<GeneralName, PKIXCertStore<T extends Certificate>> altNameCertStoreMap)

pack-priv static List<PKIXCRLStore<T extends CRL>>
getAdditionalStoresFromCRLDistributionPoint(CRLDistPoint crldp, Map<GeneralName, PKIXCRLStore<T extends CRL>> namedCRLStoreMap)

protected static AlgorithmIdentifier
getAlgorithmIdentifier(PublicKey key)

protected static void
getCertStatus(Date validDate, X509CRL crl, Object cert, CertStatus certStatus)

protected static Set<E>

Returns:

A Set of X509CRLs with complete CRLs.
getCompleteCRLs(DistributionPoint
The distribution point for which the complete CRL
dp, Object
The X509Certificate for which the CRL should be searched.
cert, Date
The date for which the delta CRLs must be valid.
currentDate, PKIXExtendedParameters
The extended PKIX parameters.
paramsPKIX)

Fetches complete CRLs according to RFC 3280.

protected static void
getCRLIssuersFromDistributionPoint(DistributionPoint
The distribution point.
dp, Collection<E>
The issuers of the certificate or attribute certificate which contains the distribution point.
issuerPrincipals, X509CRLSelector
The CRL selector.
selector)

Add the CRL issuers from the cRLIssuer field of the distribution point or from the certificate if not given to the issuer criterion of the selector.

protected static Set<E>

Returns:

A Set of X509CRLs with delta CRLs.
getDeltaCRLs(Date
The date for which the delta CRLs must be valid.
validityDate, X509CRL
The complete CRL the delta CRL is for.
completeCRL, List<CertStore> certStores, List<PKIXCRLStore<T extends CRL>> pkixCrlStores)

Fetches delta CRLs according to RFC 3280 section 5.2.4.

protected static X500Principal

Returns:

The issuer as X500Principal.
getEncodedIssuerPrincipal(Object
The attribute certificate or certificate.
cert)

Returns the issuer of an attribute certificate or certificate.

protected static ASN1Primitive
getExtensionValue(X509Extension
The extension object.
ext, String
The object identifier to obtain.
oid)

Extract the value of the given extension, if it exists.

protected static X500Principal
getIssuerPrincipal(X509CRL crl)

protected static PublicKey

Returns:

The public key of the certificate in list position index extended with DSA parameters if applicable.
getNextWorkingKey(List<E>
The certification path.
certs, int
The index of the certificate which contains the public key which should be extended with DSA parameters.
index, Provider fipsProvider)

Return the next working key inheriting DSA parameters if necessary.

private static ASN1Primitive
getObject(String oid, byte[] ext)

protected static final Set<E>
getQualifierSet(ASN1Sequence qualifiers)

private static BigInteger
getSerialNumber(Object cert)

protected static X500Name
getSubjectDN(X509Certificate cert)

protected static X500Principal
getSubjectPrincipal(X509Certificate cert)

protected static Date
getValidCertDateFromValidityModel(PKIXExtendedParameters paramsPKIX, CertPath certPath, int index)

protected static Date
getValidDate(PKIXExtendedParameters paramsPKIX)

protected static boolean
isAnyPolicy(Set<E> policySet)

private static boolean
isDeltaCRL(X509CRL crl)

protected static boolean
isSelfIssued(X509Certificate cert)

protected static boolean
processCertD1i(int index, List<E>[] policyNodes, ASN1ObjectIdentifier pOid, Set<E> pq)

protected static void
processCertD1ii(int index, List<E>[] policyNodes, ASN1ObjectIdentifier _poid, Set<E> _pq)

protected static PKIXPolicyNode
removePolicyNode(PKIXPolicyNode validPolicyTree, List<E>[] policyNodes, PKIXPolicyNode _node)

private static void
removePolicyNodeRecurse(List<E>[] policyNodes, PKIXPolicyNode _node)

protected static void
verifyX509Certificate(X509Certificate cert, PublicKey publicKey, String sigProvider)

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

ANY_POLICYback to summary
protected static final String ANY_POLICY
CRL_NUMBERback to summary
protected static final String CRL_NUMBER
CRL_SIGNback to summary
protected static final int CRL_SIGN
CRL_UTILback to summary
protected static final PKIXCRLUtil CRL_UTIL
crlReasonsback to summary
protected static final String[] crlReasons
KEY_CERT_SIGNback to summary
protected static final int KEY_CERT_SIGN

Constructor Detail

CertPathValidatorUtilitiesback to summary
pack-priv CertPathValidatorUtilities()

Method Detail

findCertificatesback to summary
protected static Collection<E> findCertificates(PKIXCertStoreSelector<T extends Certificate> certSelect, List<E> certStores) throws AnnotatedException

Return a Collection of all certificates or attribute certificates found in the X509Store's that are matching the certSelect criteriums.

Parameters
certSelect:PKIXCertStoreSelector<T extends Certificate>

a Selector object that will be used to select the certificates

certStores:List<E>

a List containing only Store objects. These are used to search for certificates.

Returns:Collection<E>

a Collection of all found X509Certificate May be empty but never null.

findIssuerCertsback to summary
pack-priv static Collection<E> findIssuerCerts(X509Certificate cert, List<CertStore> certStores, List<PKIXCertStore<T extends Certificate>> pkixCertStores) throws AnnotatedException

Find the issuer certificates of a given certificate.

Parameters
cert:X509Certificate

The certificate for which an issuer should be found.

Returns:Collection<E>

A Collection object containing the issuer X509Certificates. Never null.

Exceptions
AnnotatedException:
if an error occurs.
findTrustAnchorback to summary
protected static TrustAnchor findTrustAnchor(X509Certificate cert, Set<E> trustAnchors) throws AnnotatedException

Search the given Set of TrustAnchor's for one that is the issuer of the given X509 certificate. Uses the default provider for signature verification.

Parameters
cert:X509Certificate

the X509 certificate

trustAnchors:Set<E>

a Set of TrustAnchor's

Returns:TrustAnchor

the TrustAnchor object if found or null if not.

Exceptions
AnnotatedException:
if a TrustAnchor was found but the signature verification on the given certificate has thrown an exception.
findTrustAnchorback to summary
protected static TrustAnchor findTrustAnchor(X509Certificate cert, Set<E> trustAnchors, String sigProvider) throws AnnotatedException

Search the given Set of TrustAnchor's for one that is the issuer of the given X509 certificate. Uses the specified provider for signature verification, or the default provider if null.

Parameters
cert:X509Certificate

the X509 certificate

trustAnchors:Set<E>

a Set of TrustAnchor's

sigProvider:String

the provider to use for signature verification

Returns:TrustAnchor

the TrustAnchor object if found or null if not.

Exceptions
AnnotatedException:
if a TrustAnchor was found but the signature verification on the given certificate has thrown an exception.
getAdditionalStoresFromAltNamesback to summary
pack-priv static List<PKIXCertStore<T extends Certificate>> getAdditionalStoresFromAltNames(byte[] issuerAlternativeName, Map<GeneralName, PKIXCertStore<T extends Certificate>> altNameCertStoreMap) throws CertificateParsingException
getAdditionalStoresFromCRLDistributionPointback to summary
pack-priv static List<PKIXCRLStore<T extends CRL>> getAdditionalStoresFromCRLDistributionPoint(CRLDistPoint crldp, Map<GeneralName, PKIXCRLStore<T extends CRL>> namedCRLStoreMap) throws AnnotatedException
getAlgorithmIdentifierback to summary
protected static AlgorithmIdentifier getAlgorithmIdentifier(PublicKey key) throws CertPathValidatorException
getCertStatusback to summary
protected static void getCertStatus(Date validDate, X509CRL crl, Object cert, CertStatus certStatus) throws AnnotatedException
getCompleteCRLsback to summary
protected static Set<E> getCompleteCRLs(DistributionPoint dp, Object cert, Date currentDate, PKIXExtendedParameters paramsPKIX) throws AnnotatedException

Fetches complete CRLs according to RFC 3280.

Parameters
dp:DistributionPoint

The distribution point for which the complete CRL

cert:Object

The X509Certificate for which the CRL should be searched.

currentDate:Date

The date for which the delta CRLs must be valid.

paramsPKIX:PKIXExtendedParameters

The extended PKIX parameters.

Returns:Set<E>

A Set of X509CRLs with complete CRLs.

Exceptions
AnnotatedException:
if an exception occurs while picking the CRLs or no CRLs are found.
getCRLIssuersFromDistributionPointback to summary
protected static void getCRLIssuersFromDistributionPoint(DistributionPoint dp, Collection<E> issuerPrincipals, X509CRLSelector selector) throws AnnotatedException

Add the CRL issuers from the cRLIssuer field of the distribution point or from the certificate if not given to the issuer criterion of the selector.

The issuerPrincipals are a collection with a single X500Principal for X509Certificates.

Parameters
dp:DistributionPoint

The distribution point.

issuerPrincipals:Collection<E>

The issuers of the certificate or attribute certificate which contains the distribution point.

selector:X509CRLSelector

The CRL selector.

Exceptions
AnnotatedException:
if an exception occurs while processing.
ClassCastException:
if issuerPrincipals does not contain only X500Principals.
getDeltaCRLsback to summary
protected static Set<E> getDeltaCRLs(Date validityDate, X509CRL completeCRL, List<CertStore> certStores, List<PKIXCRLStore<T extends CRL>> pkixCrlStores) throws AnnotatedException

Fetches delta CRLs according to RFC 3280 section 5.2.4.

Parameters
validityDate:Date

The date for which the delta CRLs must be valid.

completeCRL:X509CRL

The complete CRL the delta CRL is for.

Returns:Set<E>

A Set of X509CRLs with delta CRLs.

Exceptions
AnnotatedException:
if an exception occurs while picking the delta CRLs.
getEncodedIssuerPrincipalback to summary
protected static X500Principal getEncodedIssuerPrincipal(Object cert)

Returns the issuer of an attribute certificate or certificate.

Parameters
cert:Object

The attribute certificate or certificate.

Returns:X500Principal

The issuer as X500Principal.

getExtensionValueback to summary
protected static ASN1Primitive getExtensionValue(X509Extension ext, String oid) throws AnnotatedException

Extract the value of the given extension, if it exists.

Parameters
ext:X509Extension

The extension object.

oid:String

The object identifier to obtain.

Exceptions
AnnotatedException:
if the extension cannot be read.
getIssuerPrincipalback to summary
protected static X500Principal getIssuerPrincipal(X509CRL crl)
getNextWorkingKeyback to summary
protected static PublicKey getNextWorkingKey(List<E> certs, int index, Provider fipsProvider) throws CertPathValidatorException

Return the next working key inheriting DSA parameters if necessary.

This methods inherits DSA parameters from the indexed certificate or previous certificates in the certificate chain to the returned PublicKey. The list is searched upwards, meaning the end certificate is at position 0 and previous certificates are following.

If the indexed certificate does not contain a DSA key this method simply returns the public key. If the DSA key already contains DSA parameters the key is also only returned.

Parameters
certs:List<E>

The certification path.

index:int

The index of the certificate which contains the public key which should be extended with DSA parameters.

Returns:PublicKey

The public key of the certificate in list position index extended with DSA parameters if applicable.

Exceptions
AnnotatedException:
if DSA parameters cannot be inherited.
getObjectback to summary
private static ASN1Primitive getObject(String oid, byte[] ext) throws AnnotatedException
getQualifierSetback to summary
protected static final Set<E> getQualifierSet(ASN1Sequence qualifiers) throws CertPathValidatorException
getSerialNumberback to summary
private static BigInteger getSerialNumber(Object cert)
getSubjectDNback to summary
protected static X500Name getSubjectDN(X509Certificate cert)
getSubjectPrincipalback to summary
protected static X500Principal getSubjectPrincipal(X509Certificate cert)
getValidCertDateFromValidityModelback to summary
protected static Date getValidCertDateFromValidityModel(PKIXExtendedParameters paramsPKIX, CertPath certPath, int index) throws AnnotatedException
getValidDateback to summary
protected static Date getValidDate(PKIXExtendedParameters paramsPKIX)
isAnyPolicyback to summary
protected static boolean isAnyPolicy(Set<E> policySet)
isDeltaCRLback to summary
private static boolean isDeltaCRL(X509CRL crl)
isSelfIssuedback to summary
protected static boolean isSelfIssued(X509Certificate cert)
processCertD1iback to summary
protected static boolean processCertD1i(int index, List<E>[] policyNodes, ASN1ObjectIdentifier pOid, Set<E> pq)
processCertD1iiback to summary
protected static void processCertD1ii(int index, List<E>[] policyNodes, ASN1ObjectIdentifier _poid, Set<E> _pq)
removePolicyNodeback to summary
protected static PKIXPolicyNode removePolicyNode(PKIXPolicyNode validPolicyTree, List<E>[] policyNodes, PKIXPolicyNode _node)
removePolicyNodeRecurseback to summary
private static void removePolicyNodeRecurse(List<E>[] policyNodes, PKIXPolicyNode _node)
verifyX509Certificateback to summary
protected static void verifyX509Certificate(X509Certificate cert, PublicKey publicKey, String sigProvider) throws GeneralSecurityException