Top Fields Constructors Methods
org.bouncycastle.jcajce.provider

pack-priv Class RFC3280CertPathUtilities

extends Object
Class Inheritance
Imports
java.io.IOException, java.math.BigInteger, java.security.GeneralSecurityException, .Provider, .PublicKey, java.security.cert.CertPath, .CertPathBuilder, .CertPathBuilderException, .CertPathValidatorException, .CertificateExpiredException, .CertificateNotYetValidException, .PKIXCertPathChecker, .X509CRL, .X509CRLSelector, .X509CertSelector, .X509Certificate, .X509Extension, java.text.SimpleDateFormat, java.util.ArrayList, .Collection, .Date, .Enumeration, .HashMap, .HashSet, .Iterator, .List, .Map, .Set, .TimeZone, javax.security.auth.x500.X500Principal, org.bouncycastle.asn1.ASN1Encodable, .ASN1EncodableVector, .ASN1Integer, .ASN1ObjectIdentifier, .ASN1Primitive, .ASN1Sequence, .ASN1String, .ASN1TaggedObject, .DERSequence, org.bouncycastle.asn1.x500.RDN, .X500Name, org.bouncycastle.asn1.x500.style.BCStyle, org.bouncycastle.asn1.x509.BasicConstraints, .CRLDistPoint, .CRLReason, .DistributionPoint, .DistributionPointName, .Extension, .GeneralName, .GeneralNames, .GeneralSubtree, .IssuingDistributionPoint, .NameConstraintValidatorException, .NameConstraints, .PKIXNameConstraintValidator, .PolicyInformation, org.bouncycastle.jcajce.PKIXCRLStore, .PKIXCRLStoreSelector, .PKIXCertStoreSelector, .PKIXExtendedBuilderParameters, .PKIXExtendedParameters, org.bouncycastle.util.Arrays

Field Summary

Modifier and TypeField and Description
public static final String
ANY_POLICY

public static final String
AUTHORITY_KEY_IDENTIFIER

public static final String
BASIC_CONSTRAINTS

pack-priv static final Set<String>
CERT_SUPPORTED_CRITICAL_EXTENSIONS

public static final String
CERTIFICATE_POLICIES

public static final String
CRL_DISTRIBUTION_POINTS

public static final String
CRL_NUMBER

protected static final int
CRL_SIGN

pack-priv static final Set<String>
CRL_SUPPORTED_CRITICAL_EXTENSIONS

private static final PKIXCRLUtil
CRL_UTIL

protected static final String[]
crlReasons

public static final String
DELTA_CRL_INDICATOR

public static final String
FRESHEST_CRL

public static final String
INHIBIT_ANY_POLICY

public static final String
ISSUING_DISTRIBUTION_POINT

protected static final int
KEY_CERT_SIGN

public static final String
KEY_USAGE

public static final String
NAME_CONSTRAINTS

public static final String
POLICY_CONSTRAINTS

public static final String
POLICY_MAPPINGS

public static final String
SUBJECT_ALTERNATIVE_NAME

Constructor Summary

AccessConstructor and Description
pack-priv
RFC3280CertPathUtilities()

Method Summary

Modifier and TypeMethod and Description
private static void
checkCRL(DistributionPoint
The distribution point to consider.
dp, PKIXExtendedParameters
PKIX parameters.
paramsPKIX, X509Certificate
Certificate to check if it is revoked.
cert, Date
The date when the certificate revocation status should be checked.
validDate, X509Certificate
The issuer certificate of the certificate cert.
defaultCRLSignCert, PublicKey
The public key of the issuer certificate defaultCRLSignCert.
defaultCRLSignKey, CertStatus
The current certificate revocation status.
certStatus, ReasonsMask
The reasons mask which is already checked.
reasonMask, List<E>
The certificates of the certification path.
certPathCerts, Provider fipsProvider)

Checks a distribution point for revocation information for the certificate cert.

protected static void
checkCRLs(PKIXExtendedParameters
PKIX parameters.
paramsPKIX, X509Certificate
Certificate to check if it is revoked.
cert, Date
The date when the certificate revocation status should be checked.
validDate, X509Certificate
The issuer certificate of the certificate cert.
sign, PublicKey
The public key of the issuer certificate sign.
workingPublicKey, List<E>
The certificates of the certification path.
certPathCerts, Provider fipsProvider)

Checks a certificate if it is revoked.

protected static PKIXPolicyNode
prepareCertB(CertPath certPath, int index, List<E>[] policyNodes, PKIXPolicyNode validPolicyTree, int policyMapping)

protected static void
prepareNextCertA(CertPath certPath, int index)

protected static void
prepareNextCertG(CertPath certPath, int index, PKIXNameConstraintValidator nameConstraintValidator)

protected static int
prepareNextCertH1(CertPath certPath, int index, int explicitPolicy)

protected static int
prepareNextCertH2(CertPath certPath, int index, int policyMapping)

protected static int
prepareNextCertH3(CertPath certPath, int index, int inhibitAnyPolicy)

protected static int
prepareNextCertI1(CertPath certPath, int index, int explicitPolicy)

protected static int
prepareNextCertI2(CertPath certPath, int index, int policyMapping)

protected static int
prepareNextCertJ(CertPath certPath, int index, int inhibitAnyPolicy)

protected static void
prepareNextCertK(CertPath certPath, int index)

protected static int
prepareNextCertL(CertPath certPath, int index, int maxPathLength)

protected static int
prepareNextCertM(CertPath certPath, int index, int maxPathLength)

protected static void
prepareNextCertN(CertPath certPath, int index)

protected static void
prepareNextCertO(CertPath certPath, int index, Set<E> criticalExtensions, List<E> pathCheckers)

protected static void
processCertA(CertPath certPath, PKIXExtendedParameters paramsPKIX, int index, PublicKey workingPublicKey, boolean verificationAlreadyPerformed, X500Principal workingIssuerName, X509Certificate sign, Provider fipsProvider)

protected static void
processCertBC(CertPath certPath, int index, PKIXNameConstraintValidator nameConstraintValidator)

protected static PKIXPolicyNode
processCertD(CertPath certPath, int index, Set<E> acceptablePolicies, PKIXPolicyNode validPolicyTree, List<E>[] policyNodes, int inhibitAnyPolicy)

protected static PKIXPolicyNode
processCertE(CertPath certPath, int index, PKIXPolicyNode validPolicyTree)

protected static void
processCertF(CertPath certPath, int index, PKIXPolicyNode validPolicyTree, int explicitPolicy)

protected static Set<E>
processCRLA1i(Date currentDate, PKIXExtendedParameters paramsPKIX, X509Certificate cert, X509CRL crl)

protected static Set<E>[]
processCRLA1ii(Date currentDate, PKIXExtendedParameters paramsPKIX, X509Certificate cert, X509CRL crl)

protected static void
processCRLB1(DistributionPoint
The distribution point.
dp, Object
The certificate ot attribute certificate.
cert, X509CRL
The CRL for cert.
crl)

If the DP includes cRLIssuer, then verify that the issuer field in the complete CRL matches cRLIssuer in the DP and that the complete CRL contains an issuing distribution point extension with the indirectCRL boolean asserted.

protected static void
processCRLB2(DistributionPoint
The distribution point.
dp, Object
The certificate.
cert, X509CRL
The CRL.
crl)

If the complete CRL includes an issuing distribution point (IDP) CRL extension check the following:

(i) If the distribution point name is present in the IDP CRL extension and the distribution field is present in the DP, then verify that one of the names in the IDP matches one of the names in the DP.

protected static void
processCRLC(X509CRL
The delta CRL.
deltaCRL, X509CRL
The complete CRL.
completeCRL, PKIXExtendedParameters
The PKIX paramaters.
pkixParams)

If use-deltas is set, verify the issuer and scope of the delta CRL.

protected static ReasonsMask
processCRLD(X509CRL crl, DistributionPoint dp)

protected static Set<E>

Returns:

A Set with all keys of possible CRL issuer certificates.
processCRLF(X509CRL
CRL which contains revocation information for the certificate cert.
crl, Object
The attribute certificate or certificate to check if it is revoked.
cert, X509Certificate
The issuer certificate of the certificate cert.
defaultCRLSignCert, PublicKey
The public key of the issuer certificate defaultCRLSignCert.
defaultCRLSignKey, PKIXExtendedParameters
paramsPKIX PKIX parameters.
paramsPKIX, List<E>
The certificates on the certification path.
certPathCerts, Provider fipsProvider)

Obtain and validate the certification path for the complete CRL issuer.

protected static PublicKey
processCRLG(X509CRL crl, Set<E> keys)

protected static X509CRL
processCRLH(Set<E> deltacrls, PublicKey key)

protected static void
processCRLI(Date validDate, X509CRL deltacrl, Object cert, CertStatus certStatus, PKIXExtendedParameters pkixParams)

protected static void
processCRLJ(Date validDate, X509CRL completecrl, Object cert, CertStatus certStatus)

protected static int
wrapupCertA(int explicitPolicy, X509Certificate cert)

protected static int
wrapupCertB(CertPath certPath, int index, int explicitPolicy)

protected static void
wrapupCertF(CertPath certPath, int index, List<E> pathCheckers, Set<E> criticalExtensions)

protected static PKIXPolicyNode
wrapupCertG(CertPath certPath, PKIXExtendedParameters paramsPKIX, Set<E> userInitialPolicySet, int index, List<E>[] policyNodes, PKIXPolicyNode validPolicyTree, Set<E> acceptablePolicies)

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

ANY_POLICYback to summary
public static final String ANY_POLICY
AUTHORITY_KEY_IDENTIFIERback to summary
public static final String AUTHORITY_KEY_IDENTIFIER
BASIC_CONSTRAINTSback to summary
public static final String BASIC_CONSTRAINTS
CERT_SUPPORTED_CRITICAL_EXTENSIONSback to summary
pack-priv static final Set<String> CERT_SUPPORTED_CRITICAL_EXTENSIONS
CERTIFICATE_POLICIESback to summary
public static final String CERTIFICATE_POLICIES
CRL_DISTRIBUTION_POINTSback to summary
public static final String CRL_DISTRIBUTION_POINTS
CRL_NUMBERback to summary
public static final String CRL_NUMBER
CRL_SIGNback to summary
protected static final int CRL_SIGN
CRL_SUPPORTED_CRITICAL_EXTENSIONSback to summary
pack-priv static final Set<String> CRL_SUPPORTED_CRITICAL_EXTENSIONS
CRL_UTILback to summary
private static final PKIXCRLUtil CRL_UTIL
crlReasonsback to summary
protected static final String[] crlReasons
DELTA_CRL_INDICATORback to summary
public static final String DELTA_CRL_INDICATOR
FRESHEST_CRLback to summary
public static final String FRESHEST_CRL
INHIBIT_ANY_POLICYback to summary
public static final String INHIBIT_ANY_POLICY
ISSUING_DISTRIBUTION_POINTback to summary
public static final String ISSUING_DISTRIBUTION_POINT
KEY_CERT_SIGNback to summary
protected static final int KEY_CERT_SIGN
KEY_USAGEback to summary
public static final String KEY_USAGE
NAME_CONSTRAINTSback to summary
public static final String NAME_CONSTRAINTS
POLICY_CONSTRAINTSback to summary
public static final String POLICY_CONSTRAINTS
POLICY_MAPPINGSback to summary
public static final String POLICY_MAPPINGS
SUBJECT_ALTERNATIVE_NAMEback to summary
public static final String SUBJECT_ALTERNATIVE_NAME

Constructor Detail

RFC3280CertPathUtilitiesback to summary
pack-priv RFC3280CertPathUtilities()

Method Detail

checkCRLback to summary
private static void checkCRL(DistributionPoint dp, PKIXExtendedParameters paramsPKIX, X509Certificate cert, Date validDate, X509Certificate defaultCRLSignCert, PublicKey defaultCRLSignKey, CertStatus certStatus, ReasonsMask reasonMask, List<E> certPathCerts, Provider fipsProvider) throws AnnotatedException

Checks a distribution point for revocation information for the certificate cert.

Parameters
dp:DistributionPoint

The distribution point to consider.

paramsPKIX:PKIXExtendedParameters

PKIX parameters.

cert:X509Certificate

Certificate to check if it is revoked.

validDate:Date

The date when the certificate revocation status should be checked.

defaultCRLSignCert:X509Certificate

The issuer certificate of the certificate cert.

defaultCRLSignKey:PublicKey

The public key of the issuer certificate defaultCRLSignCert.

certStatus:CertStatus

The current certificate revocation status.

reasonMask:ReasonsMask

The reasons mask which is already checked.

certPathCerts:List<E>

The certificates of the certification path.

Exceptions
AnnotatedException:
if the certificate is revoked or the status cannot be checked or some error occurs.
checkCRLsback to summary
protected static void checkCRLs(PKIXExtendedParameters paramsPKIX, X509Certificate cert, Date validDate, X509Certificate sign, PublicKey workingPublicKey, List<E> certPathCerts, Provider fipsProvider) throws AnnotatedException

Checks a certificate if it is revoked.

Parameters
paramsPKIX:PKIXExtendedParameters

PKIX parameters.

cert:X509Certificate

Certificate to check if it is revoked.

validDate:Date

The date when the certificate revocation status should be checked.

sign:X509Certificate

The issuer certificate of the certificate cert.

workingPublicKey:PublicKey

The public key of the issuer certificate sign.

certPathCerts:List<E>

The certificates of the certification path.

Exceptions
AnnotatedException:
if the certificate is revoked or the status cannot be checked or some error occurs.
prepareCertBback to summary
protected static PKIXPolicyNode prepareCertB(CertPath certPath, int index, List<E>[] policyNodes, PKIXPolicyNode validPolicyTree, int policyMapping) throws CertPathValidatorException
prepareNextCertAback to summary
protected static void prepareNextCertA(CertPath certPath, int index) throws CertPathValidatorException
prepareNextCertGback to summary
protected static void prepareNextCertG(CertPath certPath, int index, PKIXNameConstraintValidator nameConstraintValidator) throws CertPathValidatorException
prepareNextCertH1back to summary
protected static int prepareNextCertH1(CertPath certPath, int index, int explicitPolicy)
prepareNextCertH2back to summary
protected static int prepareNextCertH2(CertPath certPath, int index, int policyMapping)
prepareNextCertH3back to summary
protected static int prepareNextCertH3(CertPath certPath, int index, int inhibitAnyPolicy)
prepareNextCertI1back to summary
protected static int prepareNextCertI1(CertPath certPath, int index, int explicitPolicy) throws CertPathValidatorException
prepareNextCertI2back to summary
protected static int prepareNextCertI2(CertPath certPath, int index, int policyMapping) throws CertPathValidatorException
prepareNextCertJback to summary
protected static int prepareNextCertJ(CertPath certPath, int index, int inhibitAnyPolicy) throws CertPathValidatorException
prepareNextCertKback to summary
protected static void prepareNextCertK(CertPath certPath, int index) throws CertPathValidatorException
prepareNextCertLback to summary
protected static int prepareNextCertL(CertPath certPath, int index, int maxPathLength) throws CertPathValidatorException
prepareNextCertMback to summary
protected static int prepareNextCertM(CertPath certPath, int index, int maxPathLength) throws CertPathValidatorException
prepareNextCertNback to summary
protected static void prepareNextCertN(CertPath certPath, int index) throws CertPathValidatorException
prepareNextCertOback to summary
protected static void prepareNextCertO(CertPath certPath, int index, Set<E> criticalExtensions, List<E> pathCheckers) throws CertPathValidatorException
processCertAback to summary
protected static void processCertA(CertPath certPath, PKIXExtendedParameters paramsPKIX, int index, PublicKey workingPublicKey, boolean verificationAlreadyPerformed, X500Principal workingIssuerName, X509Certificate sign, Provider fipsProvider) throws CertPathValidatorException
processCertBCback to summary
protected static void processCertBC(CertPath certPath, int index, PKIXNameConstraintValidator nameConstraintValidator) throws CertPathValidatorException
processCertDback to summary
protected static PKIXPolicyNode processCertD(CertPath certPath, int index, Set<E> acceptablePolicies, PKIXPolicyNode validPolicyTree, List<E>[] policyNodes, int inhibitAnyPolicy) throws CertPathValidatorException
processCertEback to summary
protected static PKIXPolicyNode processCertE(CertPath certPath, int index, PKIXPolicyNode validPolicyTree) throws CertPathValidatorException
processCertFback to summary
protected static void processCertF(CertPath certPath, int index, PKIXPolicyNode validPolicyTree, int explicitPolicy) throws CertPathValidatorException
processCRLA1iback to summary
protected static Set<E> processCRLA1i(Date currentDate, PKIXExtendedParameters paramsPKIX, X509Certificate cert, X509CRL crl) throws AnnotatedException
processCRLA1iiback to summary
protected static Set<E>[] processCRLA1ii(Date currentDate, PKIXExtendedParameters paramsPKIX, X509Certificate cert, X509CRL crl) throws AnnotatedException
processCRLB1back to summary
protected static void processCRLB1(DistributionPoint dp, Object cert, X509CRL crl) throws AnnotatedException

If the DP includes cRLIssuer, then verify that the issuer field in the complete CRL matches cRLIssuer in the DP and that the complete CRL contains an issuing distribution point extension with the indirectCRL boolean asserted. Otherwise, verify that the CRL issuer matches the certificate issuer.

Parameters
dp:DistributionPoint

The distribution point.

cert:Object

The certificate ot attribute certificate.

crl:X509CRL

The CRL for cert.

Exceptions
AnnotatedException:
if one of the above conditions does not apply or an error occurs.
processCRLB2back to summary
protected static void processCRLB2(DistributionPoint dp, Object cert, X509CRL crl) throws AnnotatedException

If the complete CRL includes an issuing distribution point (IDP) CRL extension check the following:

(i) If the distribution point name is present in the IDP CRL extension and the distribution field is present in the DP, then verify that one of the names in the IDP matches one of the names in the DP. If the distribution point name is present in the IDP CRL extension and the distribution field is omitted from the DP, then verify that one of the names in the IDP matches one of the names in the cRLIssuer field of the DP.

(ii) If the onlyContainsUserCerts boolean is asserted in the IDP CRL extension, verify that the certificate does not include the basic constraints extension with the cA boolean asserted.

(iii) If the onlyContainsCACerts boolean is asserted in the IDP CRL extension, verify that the certificate includes the basic constraints extension with the cA boolean asserted.

(iv) Verify that the onlyContainsAttributeCerts boolean is not asserted.

Parameters
dp:DistributionPoint

The distribution point.

cert:Object

The certificate.

crl:X509CRL

The CRL.

Exceptions
AnnotatedException:
if one of the conditions is not met or an error occurs.
processCRLCback to summary
protected static void processCRLC(X509CRL deltaCRL, X509CRL completeCRL, PKIXExtendedParameters pkixParams) throws AnnotatedException

If use-deltas is set, verify the issuer and scope of the delta CRL.

Parameters
deltaCRL:X509CRL

The delta CRL.

completeCRL:X509CRL

The complete CRL.

pkixParams:PKIXExtendedParameters

The PKIX paramaters.

Exceptions
AnnotatedException:
if an exception occurs.
processCRLDback to summary
protected static ReasonsMask processCRLD(X509CRL crl, DistributionPoint dp) throws AnnotatedException
processCRLFback to summary
protected static Set<E> processCRLF(X509CRL crl, Object cert, X509Certificate defaultCRLSignCert, PublicKey defaultCRLSignKey, PKIXExtendedParameters paramsPKIX, List<E> certPathCerts, Provider fipsProvider) throws AnnotatedException

Obtain and validate the certification path for the complete CRL issuer. If a key usage extension is present in the CRL issuer's certificate, verify that the cRLSign bit is set.

Parameters
crl:X509CRL

CRL which contains revocation information for the certificate cert.

cert:Object

The attribute certificate or certificate to check if it is revoked.

defaultCRLSignCert:X509Certificate

The issuer certificate of the certificate cert.

defaultCRLSignKey:PublicKey

The public key of the issuer certificate defaultCRLSignCert.

paramsPKIX:PKIXExtendedParameters

paramsPKIX PKIX parameters.

certPathCerts:List<E>

The certificates on the certification path.

Returns:Set<E>

A Set with all keys of possible CRL issuer certificates.

Exceptions
AnnotatedException:
if the CRL is not valid or the status cannot be checked or some error occurs.
processCRLGback to summary
protected static PublicKey processCRLG(X509CRL crl, Set<E> keys) throws AnnotatedException
processCRLHback to summary
protected static X509CRL processCRLH(Set<E> deltacrls, PublicKey key) throws AnnotatedException
processCRLIback to summary
protected static void processCRLI(Date validDate, X509CRL deltacrl, Object cert, CertStatus certStatus, PKIXExtendedParameters pkixParams) throws AnnotatedException
processCRLJback to summary
protected static void processCRLJ(Date validDate, X509CRL completecrl, Object cert, CertStatus certStatus) throws AnnotatedException
wrapupCertAback to summary
protected static int wrapupCertA(int explicitPolicy, X509Certificate cert)
wrapupCertBback to summary
protected static int wrapupCertB(CertPath certPath, int index, int explicitPolicy) throws CertPathValidatorException
wrapupCertFback to summary
protected static void wrapupCertF(CertPath certPath, int index, List<E> pathCheckers, Set<E> criticalExtensions) throws CertPathValidatorException
wrapupCertGback to summary
protected static PKIXPolicyNode wrapupCertG(CertPath certPath, PKIXExtendedParameters paramsPKIX, Set<E> userInitialPolicySet, int index, List<E>[] policyNodes, PKIXPolicyNode validPolicyTree, Set<E> acceptablePolicies) throws CertPathValidatorException