Bouncy Castle Cryptography Library 1.80 · org.bouncycastle.jce.provider.RFC3280CertPathUtilities

Modifier and Type	Field and Description
public static final String	ANY_POLICY
public static final String	AUTHORITY_KEY_IDENTIFIER
public static final String	BASIC_CONSTRAINTS
public static final String	CERTIFICATE_POLICIES
public static final String	CRL_DISTRIBUTION_POINTS
public static final String	CRL_NUMBER
protected static final int	CRL_SIGN
protected static final String[]	crlReasons
public static final String	DELTA_CRL_INDICATOR
public static final String	FRESHEST_CRL
public static final String	INHIBIT_ANY_POLICY
public static final String	ISSUING_DISTRIBUTION_POINT
protected static final int	KEY_CERT_SIGN
public static final String	KEY_USAGE
public static final String	NAME_CONSTRAINTS
public static final String	POLICY_CONSTRAINTS
public static final String	POLICY_MAPPINGS
private static final Class<T>	revChkClass
public static final String	SUBJECT_ALTERNATIVE_NAME

Access	Constructor and Description
pack-priv	RFC3280CertPathUtilities()

Method Summary

Modifier and Type	Method and Description
private static void	checkCRL(PKIXCertRevocationCheckerParameters params, DistributionPoint The distribution point to consider. dp, PKIXExtendedParameters PKIX parameters. paramsPKIX, Date The date at which this check is being run. currentDate, Date The date when the certificate revocation status should be checked. validityDate, X509Certificate Certificate to check if it is revoked. cert, X509Certificate The issuer certificate of the certificate `cert`. defaultCRLSignCert, PublicKey The public key of the issuer certificate `defaultCRLSignCert`. defaultCRLSignKey, CertStatus The current certificate revocation status. certStatus, ReasonsMask The reasons mask which is already checked. reasonMask, List<E> The certificates of the certification path. certPathCerts, JcaJceHelper helper) Checks a distribution point for revocation information for the certificate `cert`.
protected static void	checkCRLs(PKIXCertRevocationCheckerParameters params, PKIXExtendedParameters PKIX parameters. paramsPKIX, Date The date at which this check is being run. currentDate, Date The date when the certificate revocation status should be checked. validityDate, X509Certificate Certificate to check if it is revoked. cert, X509Certificate The issuer certificate of the certificate `cert`. sign, PublicKey The public key of the issuer certificate `sign`. workingPublicKey, List<E> The certificates of the certification path. certPathCerts, JcaJceHelper helper) Checks a certificate if it is revoked.
protected static PKIXPolicyNode	prepareCertB(CertPath certPath, int index, List<E>[] policyNodes, PKIXPolicyNode validPolicyTree, int policyMapping)
protected static void	prepareNextCertA(CertPath certPath, int index)
protected static void	prepareNextCertG(CertPath certPath, int index, PKIXNameConstraintValidator nameConstraintValidator)
protected static int	prepareNextCertH1(CertPath certPath, int index, int explicitPolicy)
protected static int	prepareNextCertH2(CertPath certPath, int index, int policyMapping)
protected static int	prepareNextCertH3(CertPath certPath, int index, int inhibitAnyPolicy)
protected static int	prepareNextCertI1(CertPath certPath, int index, int explicitPolicy)
protected static int	prepareNextCertI2(CertPath certPath, int index, int policyMapping)
protected static int	prepareNextCertJ(CertPath certPath, int index, int inhibitAnyPolicy)
protected static void	prepareNextCertK(CertPath certPath, int index)
protected static int	prepareNextCertL(CertPath certPath, int index, int maxPathLength)
protected static int	prepareNextCertM(CertPath certPath, int index, int maxPathLength)
protected static void	prepareNextCertN(CertPath certPath, int index)
protected static void	prepareNextCertO(CertPath certPath, int index, Set<E> criticalExtensions, List<E> pathCheckers)
protected static void	processCertA(CertPath certPath, PKIXExtendedParameters paramsPKIX, Date validityDate, PKIXCertRevocationChecker revocationChecker, int index, PublicKey workingPublicKey, boolean verificationAlreadyPerformed, X500Name workingIssuerName, X509Certificate sign)
protected static void	processCertBC(CertPath certPath, int index, PKIXNameConstraintValidator nameConstraintValidator, boolean isForCRLCheck)
protected static PKIXPolicyNode	processCertD(CertPath certPath, int index, Set<E> acceptablePolicies, PKIXPolicyNode validPolicyTree, List<E>[] policyNodes, int inhibitAnyPolicy, boolean isForCRLCheck)
protected static PKIXPolicyNode	processCertE(CertPath certPath, int index, PKIXPolicyNode validPolicyTree)
protected static void	processCertF(CertPath certPath, int index, PKIXPolicyNode validPolicyTree, int explicitPolicy)
protected static void	processCRLB1(DistributionPoint The distribution point. dp, Object The certificate ot attribute certificate. cert, X509CRL The CRL for `cert`. crl) If the DP includes cRLIssuer, then verify that the issuer field in the complete CRL matches cRLIssuer in the DP and that the complete CRL contains an issuing distribution point extension with the indirectCRL boolean asserted.
protected static void	processCRLB2(DistributionPoint The distribution point. dp, Object The certificate. cert, X509CRL The CRL. crl) If the complete CRL includes an issuing distribution point (IDP) CRL extension check the following: (i) If the distribution point name is present in the IDP CRL extension and the distribution field is present in the DP, then verify that one of the names in the IDP matches one of the names in the DP.
protected static void	processCRLC(X509CRL The delta CRL. deltaCRL, X509CRL The complete CRL. completeCRL, PKIXExtendedParameters The PKIX paramaters. pkixParams) If use-deltas is set, verify the issuer and scope of the delta CRL.
protected static ReasonsMask	processCRLD(X509CRL crl, DistributionPoint dp)
protected static Set<E>	Returns: A `Set` with all keys of possible CRL issuer certificates. processCRLF(X509CRL CRL which contains revocation information for the certificate `cert`. crl, Object The attribute certificate or certificate to check if it is revoked. cert, X509Certificate The issuer certificate of the certificate `cert`. defaultCRLSignCert, PublicKey The public key of the issuer certificate `defaultCRLSignCert`. defaultCRLSignKey, PKIXExtendedParameters paramsPKIX PKIX parameters. paramsPKIX, List<E> The certificates on the certification path. certPathCerts, JcaJceHelper helper) Obtain and validate the certification path for the complete CRL issuer.
protected static PublicKey	processCRLG(X509CRL crl, Set<E> keys)
protected static X509CRL	processCRLH(Set<E> deltacrls, PublicKey key)
protected static void	processCRLI(Date validDate, X509CRL deltacrl, Object cert, CertStatus certStatus, PKIXExtendedParameters pkixParams)
protected static void	processCRLJ(Date validDate, X509CRL completecrl, Object cert, CertStatus certStatus)
protected static int	wrapupCertA(int explicitPolicy, X509Certificate cert)
protected static int	wrapupCertB(CertPath certPath, int index, int explicitPolicy)
protected static void	wrapupCertF(CertPath certPath, int index, List<E> pathCheckers, Set<E> criticalExtensions)
protected static PKIXPolicyNode	wrapupCertG(CertPath certPath, PKIXExtendedParameters paramsPKIX, Set<E> userInitialPolicySet, int index, List<E>[] policyNodes, PKIXPolicyNode validPolicyTree, Set<E> acceptablePolicies)

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

ANY_POLICY	back to summary
public static final String ANY_POLICY

AUTHORITY_KEY_IDENTIFIER	back to summary
public static final String AUTHORITY_KEY_IDENTIFIER

BASIC_CONSTRAINTS	back to summary
public static final String BASIC_CONSTRAINTS

CERTIFICATE_POLICIES	back to summary
public static final String CERTIFICATE_POLICIES

CRL_DISTRIBUTION_POINTS	back to summary
public static final String CRL_DISTRIBUTION_POINTS

CRL_NUMBER	back to summary
public static final String CRL_NUMBER

CRL_SIGN	back to summary
protected static final int CRL_SIGN

crlReasons	back to summary
protected static final String[] crlReasons

DELTA_CRL_INDICATOR	back to summary
public static final String DELTA_CRL_INDICATOR

FRESHEST_CRL	back to summary
public static final String FRESHEST_CRL

INHIBIT_ANY_POLICY	back to summary
public static final String INHIBIT_ANY_POLICY

ISSUING_DISTRIBUTION_POINT	back to summary
public static final String ISSUING_DISTRIBUTION_POINT

KEY_CERT_SIGN	back to summary
protected static final int KEY_CERT_SIGN

KEY_USAGE	back to summary
public static final String KEY_USAGE

NAME_CONSTRAINTS	back to summary
public static final String NAME_CONSTRAINTS

POLICY_CONSTRAINTS	back to summary
public static final String POLICY_CONSTRAINTS

POLICY_MAPPINGS	back to summary
public static final String POLICY_MAPPINGS

revChkClass	back to summary
private static final Class<T> revChkClass

SUBJECT_ALTERNATIVE_NAME	back to summary
public static final String SUBJECT_ALTERNATIVE_NAME

RFC3280CertPathUtilities	back to summary
pack-priv RFC3280CertPathUtilities()

Method Detail

checkCRL back to summary

checkCRL	back to summary
private static void checkCRL(PKIXCertRevocationCheckerParameters params, DistributionPoint dp, PKIXExtendedParameters paramsPKIX, Date currentDate, Date validityDate, X509Certificate cert, X509Certificate defaultCRLSignCert, PublicKey defaultCRLSignKey, CertStatus certStatus, ReasonsMask reasonMask, List<E> certPathCerts, JcaJceHelper helper) throws AnnotatedException, RecoverableCertPathValidatorException Checks a distribution point for revocation information for the certificate `cert`. Parameters dp:DistributionPoint The distribution point to consider. paramsPKIX:PKIXExtendedParameters PKIX parameters. currentDate:Date The date at which this check is being run. validityDate:Date The date when the certificate revocation status should be checked. cert:X509Certificate Certificate to check if it is revoked. defaultCRLSignCert:X509Certificate The issuer certificate of the certificate `cert`. defaultCRLSignKey:PublicKey The public key of the issuer certificate `defaultCRLSignCert`. certStatus:CertStatus The current certificate revocation status. reasonMask:ReasonsMask The reasons mask which is already checked. certPathCerts:List<E> The certificates of the certification path. Exceptions AnnotatedException: if the certificate is revoked or the status cannot be checked or some error occurs.

private static void checkCRL(PKIXCertRevocationCheckerParameters params, DistributionPoint dp, PKIXExtendedParameters paramsPKIX, Date currentDate, Date validityDate, X509Certificate cert, X509Certificate defaultCRLSignCert, PublicKey defaultCRLSignKey, CertStatus certStatus, ReasonsMask reasonMask, List<E> certPathCerts, JcaJceHelper helper) throws AnnotatedException, RecoverableCertPathValidatorException

Checks a distribution point for revocation information for the certificate cert.

Parameters

dp:DistributionPoint: The distribution point to consider.
paramsPKIX:PKIXExtendedParameters: PKIX parameters.
currentDate:Date: The date at which this check is being run.
validityDate:Date: The date when the certificate revocation status should be checked.
cert:X509Certificate: Certificate to check if it is revoked.
defaultCRLSignCert:X509Certificate: The issuer certificate of the certificate cert.
defaultCRLSignKey:PublicKey: The public key of the issuer certificate defaultCRLSignCert.
certStatus:CertStatus: The current certificate revocation status.
reasonMask:ReasonsMask: The reasons mask which is already checked.
certPathCerts:List<E>: The certificates of the certification path.

Exceptions

AnnotatedException:: if the certificate is revoked or the status cannot be checked or some error occurs.

checkCRLs back to summary

checkCRLs	back to summary
protected static void checkCRLs(PKIXCertRevocationCheckerParameters params, PKIXExtendedParameters paramsPKIX, Date currentDate, Date validityDate, X509Certificate cert, X509Certificate sign, PublicKey workingPublicKey, List<E> certPathCerts, JcaJceHelper helper) throws AnnotatedException, RecoverableCertPathValidatorException Checks a certificate if it is revoked. Parameters paramsPKIX:PKIXExtendedParameters PKIX parameters. currentDate:Date The date at which this check is being run. validityDate:Date The date when the certificate revocation status should be checked. cert:X509Certificate Certificate to check if it is revoked. sign:X509Certificate The issuer certificate of the certificate `cert`. workingPublicKey:PublicKey The public key of the issuer certificate `sign`. certPathCerts:List<E> The certificates of the certification path. Exceptions AnnotatedException: if the certificate is revoked or the status cannot be checked or some error occurs.

protected static void checkCRLs(PKIXCertRevocationCheckerParameters params, PKIXExtendedParameters paramsPKIX, Date currentDate, Date validityDate, X509Certificate cert, X509Certificate sign, PublicKey workingPublicKey, List<E> certPathCerts, JcaJceHelper helper) throws AnnotatedException, RecoverableCertPathValidatorException

Checks a certificate if it is revoked.

Parameters

paramsPKIX:PKIXExtendedParameters: PKIX parameters.
currentDate:Date: The date at which this check is being run.
validityDate:Date: The date when the certificate revocation status should be checked.
cert:X509Certificate: Certificate to check if it is revoked.
sign:X509Certificate: The issuer certificate of the certificate cert.
workingPublicKey:PublicKey: The public key of the issuer certificate sign.
certPathCerts:List<E>: The certificates of the certification path.

Exceptions

AnnotatedException:: if the certificate is revoked or the status cannot be checked or some error occurs.

prepareCertB	back to summary
protected static PKIXPolicyNode prepareCertB(CertPath certPath, int index, List<E>[] policyNodes, PKIXPolicyNode validPolicyTree, int policyMapping) throws CertPathValidatorException

prepareNextCertA	back to summary
protected static void prepareNextCertA(CertPath certPath, int index) throws CertPathValidatorException

prepareNextCertG	back to summary
protected static void prepareNextCertG(CertPath certPath, int index, PKIXNameConstraintValidator nameConstraintValidator) throws CertPathValidatorException

prepareNextCertH1	back to summary
protected static int prepareNextCertH1(CertPath certPath, int index, int explicitPolicy)

prepareNextCertH2	back to summary
protected static int prepareNextCertH2(CertPath certPath, int index, int policyMapping)

prepareNextCertH3	back to summary
protected static int prepareNextCertH3(CertPath certPath, int index, int inhibitAnyPolicy)

prepareNextCertI1	back to summary
protected static int prepareNextCertI1(CertPath certPath, int index, int explicitPolicy) throws CertPathValidatorException

prepareNextCertI2	back to summary
protected static int prepareNextCertI2(CertPath certPath, int index, int policyMapping) throws CertPathValidatorException

prepareNextCertJ	back to summary
protected static int prepareNextCertJ(CertPath certPath, int index, int inhibitAnyPolicy) throws CertPathValidatorException

prepareNextCertK	back to summary
protected static void prepareNextCertK(CertPath certPath, int index) throws CertPathValidatorException

prepareNextCertL	back to summary
protected static int prepareNextCertL(CertPath certPath, int index, int maxPathLength) throws CertPathValidatorException

prepareNextCertM	back to summary
protected static int prepareNextCertM(CertPath certPath, int index, int maxPathLength) throws CertPathValidatorException

prepareNextCertN	back to summary
protected static void prepareNextCertN(CertPath certPath, int index) throws CertPathValidatorException

prepareNextCertO	back to summary
protected static void prepareNextCertO(CertPath certPath, int index, Set<E> criticalExtensions, List<E> pathCheckers) throws CertPathValidatorException

processCertA	back to summary
protected static void processCertA(CertPath certPath, PKIXExtendedParameters paramsPKIX, Date validityDate, PKIXCertRevocationChecker revocationChecker, int index, PublicKey workingPublicKey, boolean verificationAlreadyPerformed, X500Name workingIssuerName, X509Certificate sign) throws CertPathValidatorException

processCertBC	back to summary
protected static void processCertBC(CertPath certPath, int index, PKIXNameConstraintValidator nameConstraintValidator, boolean isForCRLCheck) throws CertPathValidatorException

processCertD	back to summary
protected static PKIXPolicyNode processCertD(CertPath certPath, int index, Set<E> acceptablePolicies, PKIXPolicyNode validPolicyTree, List<E>[] policyNodes, int inhibitAnyPolicy, boolean isForCRLCheck) throws CertPathValidatorException

processCertE	back to summary
protected static PKIXPolicyNode processCertE(CertPath certPath, int index, PKIXPolicyNode validPolicyTree) throws CertPathValidatorException

processCertF	back to summary
protected static void processCertF(CertPath certPath, int index, PKIXPolicyNode validPolicyTree, int explicitPolicy) throws CertPathValidatorException

processCRLB1 back to summary

processCRLB1	back to summary
protected static void processCRLB1(DistributionPoint dp, Object cert, X509CRL crl) throws AnnotatedException If the DP includes cRLIssuer, then verify that the issuer field in the complete CRL matches cRLIssuer in the DP and that the complete CRL contains an issuing distribution point extension with the indirectCRL boolean asserted. Otherwise, verify that the CRL issuer matches the certificate issuer. Parameters dp:DistributionPoint The distribution point. cert:Object The certificate ot attribute certificate. crl:X509CRL The CRL for `cert`. Exceptions AnnotatedException: if one of the above conditions does not apply or an error occurs.

protected static void processCRLB1(DistributionPoint dp, Object cert, X509CRL crl) throws AnnotatedException

If the DP includes cRLIssuer, then verify that the issuer field in the complete CRL matches cRLIssuer in the DP and that the complete CRL contains an issuing distribution point extension with the indirectCRL boolean asserted. Otherwise, verify that the CRL issuer matches the certificate issuer.

Parameters

dp:DistributionPoint: The distribution point.
cert:Object: The certificate ot attribute certificate.
crl:X509CRL: The CRL for cert.

Exceptions

AnnotatedException:: if one of the above conditions does not apply or an error occurs.

processCRLB2	back to summary
protected static void processCRLB2(DistributionPoint dp, Object cert, X509CRL crl) throws AnnotatedException If the complete CRL includes an issuing distribution point (IDP) CRL extension check the following: (i) If the distribution point name is present in the IDP CRL extension and the distribution field is present in the DP, then verify that one of the names in the IDP matches one of the names in the DP. If the distribution point name is present in the IDP CRL extension and the distribution field is omitted from the DP, then verify that one of the names in the IDP matches one of the names in the cRLIssuer field of the DP. (ii) If the onlyContainsUserCerts boolean is asserted in the IDP CRL extension, verify that the certificate does not include the basic constraints extension with the cA boolean asserted. (iii) If the onlyContainsCACerts boolean is asserted in the IDP CRL extension, verify that the certificate includes the basic constraints extension with the cA boolean asserted. (iv) Verify that the onlyContainsAttributeCerts boolean is not asserted. Parameters dp:DistributionPoint The distribution point. cert:Object The certificate. crl:X509CRL The CRL. Exceptions AnnotatedException: if one of the conditions is not met or an error occurs.

processCRLB2

back to summary

protected static void processCRLB2(DistributionPoint dp, Object cert, X509CRL crl) throws AnnotatedException

If the complete CRL includes an issuing distribution point (IDP) CRL extension check the following:

(i) If the distribution point name is present in the IDP CRL extension and the distribution field is present in the DP, then verify that one of the names in the IDP matches one of the names in the DP. If the distribution point name is present in the IDP CRL extension and the distribution field is omitted from the DP, then verify that one of the names in the IDP matches one of the names in the cRLIssuer field of the DP.

(ii) If the onlyContainsUserCerts boolean is asserted in the IDP CRL extension, verify that the certificate does not include the basic constraints extension with the cA boolean asserted.

(iii) If the onlyContainsCACerts boolean is asserted in the IDP CRL extension, verify that the certificate includes the basic constraints extension with the cA boolean asserted.

(iv) Verify that the onlyContainsAttributeCerts boolean is not asserted.

Parameters

dp:DistributionPoint: The distribution point.
cert:Object: The certificate.
crl:X509CRL: The CRL.

Exceptions

AnnotatedException:: if one of the conditions is not met or an error occurs.

processCRLC	back to summary
protected static void processCRLC(X509CRL deltaCRL, X509CRL completeCRL, PKIXExtendedParameters pkixParams) throws AnnotatedException If use-deltas is set, verify the issuer and scope of the delta CRL. Parameters deltaCRL:X509CRL The delta CRL. completeCRL:X509CRL The complete CRL. pkixParams:PKIXExtendedParameters The PKIX paramaters. Exceptions AnnotatedException: if an exception occurs.

processCRLC

back to summary

protected static void processCRLC(X509CRL deltaCRL, X509CRL completeCRL, PKIXExtendedParameters pkixParams) throws AnnotatedException

If use-deltas is set, verify the issuer and scope of the delta CRL.

Parameters

deltaCRL:X509CRL: The delta CRL.
completeCRL:X509CRL: The complete CRL.
pkixParams:PKIXExtendedParameters: The PKIX paramaters.

Exceptions

AnnotatedException:: if an exception occurs.

processCRLD	back to summary
protected static ReasonsMask processCRLD(X509CRL crl, DistributionPoint dp) throws AnnotatedException

processCRLF back to summary

processCRLF	back to summary
protected static Set<E> processCRLF(X509CRL crl, Object cert, X509Certificate defaultCRLSignCert, PublicKey defaultCRLSignKey, PKIXExtendedParameters paramsPKIX, List<E> certPathCerts, JcaJceHelper helper) throws AnnotatedException Obtain and validate the certification path for the complete CRL issuer. If a key usage extension is present in the CRL issuer's certificate, verify that the cRLSign bit is set. Parameters crl:X509CRL CRL which contains revocation information for the certificate `cert`. cert:Object The attribute certificate or certificate to check if it is revoked. defaultCRLSignCert:X509Certificate The issuer certificate of the certificate `cert`. defaultCRLSignKey:PublicKey The public key of the issuer certificate `defaultCRLSignCert`. paramsPKIX:PKIXExtendedParameters paramsPKIX PKIX parameters. certPathCerts:List<E> The certificates on the certification path. Returns:Set<E> A `Set` with all keys of possible CRL issuer certificates. Exceptions AnnotatedException: if the CRL is not valid or the status cannot be checked or some error occurs.

protected static Set<E> processCRLF(X509CRL crl, Object cert, X509Certificate defaultCRLSignCert, PublicKey defaultCRLSignKey, PKIXExtendedParameters paramsPKIX, List<E> certPathCerts, JcaJceHelper helper) throws AnnotatedException

Obtain and validate the certification path for the complete CRL issuer. If a key usage extension is present in the CRL issuer's certificate, verify that the cRLSign bit is set.

Parameters

crl:X509CRL: CRL which contains revocation information for the certificate cert.
cert:Object: The attribute certificate or certificate to check if it is revoked.
defaultCRLSignCert:X509Certificate: The issuer certificate of the certificate cert.
defaultCRLSignKey:PublicKey: The public key of the issuer certificate defaultCRLSignCert.
paramsPKIX:PKIXExtendedParameters: paramsPKIX PKIX parameters.
certPathCerts:List<E>: The certificates on the certification path.

Returns:Set<E>

A Set with all keys of possible CRL issuer certificates.

Exceptions

AnnotatedException:: if the CRL is not valid or the status cannot be checked or some error occurs.

processCRLG	back to summary
protected static PublicKey processCRLG(X509CRL crl, Set<E> keys) throws AnnotatedException

processCRLH	back to summary
protected static X509CRL processCRLH(Set<E> deltacrls, PublicKey key) throws AnnotatedException

processCRLI	back to summary
protected static void processCRLI(Date validDate, X509CRL deltacrl, Object cert, CertStatus certStatus, PKIXExtendedParameters pkixParams) throws AnnotatedException

processCRLJ	back to summary
protected static void processCRLJ(Date validDate, X509CRL completecrl, Object cert, CertStatus certStatus) throws AnnotatedException

wrapupCertA	back to summary
protected static int wrapupCertA(int explicitPolicy, X509Certificate cert)

wrapupCertB	back to summary
protected static int wrapupCertB(CertPath certPath, int index, int explicitPolicy) throws CertPathValidatorException

wrapupCertF	back to summary
protected static void wrapupCertF(CertPath certPath, int index, List<E> pathCheckers, Set<E> criticalExtensions) throws CertPathValidatorException

wrapupCertG	back to summary
protected static PKIXPolicyNode wrapupCertG(CertPath certPath, PKIXExtendedParameters paramsPKIX, Set<E> userInitialPolicySet, int index, List<E>[] policyNodes, PKIXPolicyNode validPolicyTree, Set<E> acceptablePolicies) throws CertPathValidatorException

pack-priv Class RFC3280CertPathUtilities

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail