Bouncy Castle PKIX APIs (FIPS Distribution) 1.0.7 · org.bouncycastle.pkix.jcajce.RFC3280CertPathUtilities

Modifier and Type	Field and Description
public static final String	AUTHORITY_KEY_IDENTIFIER
public static final String	BASIC_CONSTRAINTS
protected static final int	CRL_SIGN
public static final String	DELTA_CRL_INDICATOR
public static final String	FRESHEST_CRL
public static final String	ISSUING_DISTRIBUTION_POINT
protected static final int	KEY_CERT_SIGN

Access	Constructor and Description
pack-priv	RFC3280CertPathUtilities()

Method Summary

Modifier and Type	Method and Description
pack-priv static void	checkCRL(DistributionPoint The distribution point to consider. dp, PKIXExtendedParameters PKIX parameters. paramsPKIX, Date currentDate, Date validityDate, X509Certificate Certificate to check if it is revoked. cert, X509Certificate The issuer certificate of the certificate `cert`. defaultCRLSignCert, PublicKey The public key of the issuer certificate `defaultCRLSignCert`. defaultCRLSignKey, CertStatus The current certificate revocation status. certStatus, ReasonsMask The reasons mask which is already checked. reasonMask, List<E> The certificates of the certification path. certPathCerts, PKIXJcaJceHelper helper) Checks a distribution point for revocation information for the certificate `cert`.
protected static Set<E>	processCRLA1i(PKIXExtendedParameters paramsPKIX, Date currentDate, X509Certificate cert, X509CRL crl)
protected static Set<E>[]	processCRLA1ii(PKIXExtendedParameters paramsPKIX, Date currentDate, Date validityDate, X509Certificate cert, X509CRL crl)
protected static void	processCRLB1(DistributionPoint The distribution point. dp, Object The certificate ot attribute certificate. cert, X509CRL The CRL for `cert`. crl) If the DP includes cRLIssuer, then verify that the issuer field in the complete CRL matches cRLIssuer in the DP and that the complete CRL contains an issuing distribution point extension with the indirectCRL boolean asserted.
protected static void	processCRLB2(DistributionPoint The distribution point. dp, Object The certificate. cert, X509CRL The CRL. crl) If the complete CRL includes an issuing distribution point (IDP) CRL extension check the following: (i) If the distribution point name is present in the IDP CRL extension and the distribution field is present in the DP, then verify that one of the names in the IDP matches one of the names in the DP.
protected static void	processCRLC(X509CRL The delta CRL. deltaCRL, X509CRL The complete CRL. completeCRL, PKIXExtendedParameters The PKIX paramaters. pkixParams) If use-deltas is set, verify the issuer and scope of the delta CRL.
protected static ReasonsMask	processCRLD(X509CRL crl, DistributionPoint dp)
protected static Set<E>	Returns: A `Set` with all keys of possible CRL issuer certificates. processCRLF(X509CRL CRL which contains revocation information for the certificate `cert`. crl, Object The attribute certificate or certificate to check if it is revoked. cert, X509Certificate The issuer certificate of the certificate `cert`. defaultCRLSignCert, PublicKey The public key of the issuer certificate `defaultCRLSignCert`. defaultCRLSignKey, PKIXExtendedParameters PKIX parameters. paramsPKIX, List<E> The certificates on the certification path. certPathCerts, PKIXJcaJceHelper helper) Obtain and validate the certification path for the complete CRL issuer.
protected static PublicKey	processCRLG(X509CRL crl, Set<E> keys)
protected static X509CRL	processCRLH(Set<E> deltacrls, PublicKey key)
protected static void	processCRLI(Date validDate, X509CRL deltacrl, Object cert, CertStatus certStatus, PKIXExtendedParameters pkixParams)
protected static void	processCRLJ(Date validDate, X509CRL completecrl, Object cert, CertStatus certStatus)

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

AUTHORITY_KEY_IDENTIFIER	back to summary
public static final String AUTHORITY_KEY_IDENTIFIER

BASIC_CONSTRAINTS	back to summary
public static final String BASIC_CONSTRAINTS

CRL_SIGN	back to summary
protected static final int CRL_SIGN

DELTA_CRL_INDICATOR	back to summary
public static final String DELTA_CRL_INDICATOR

FRESHEST_CRL	back to summary
public static final String FRESHEST_CRL

ISSUING_DISTRIBUTION_POINT	back to summary
public static final String ISSUING_DISTRIBUTION_POINT

KEY_CERT_SIGN	back to summary
protected static final int KEY_CERT_SIGN

RFC3280CertPathUtilities	back to summary
pack-priv RFC3280CertPathUtilities()

Method Detail

checkCRL back to summary

checkCRL	back to summary
pack-priv static void checkCRL(DistributionPoint dp, PKIXExtendedParameters paramsPKIX, Date currentDate, Date validityDate, X509Certificate cert, X509Certificate defaultCRLSignCert, PublicKey defaultCRLSignKey, CertStatus certStatus, ReasonsMask reasonMask, List<E> certPathCerts, PKIXJcaJceHelper helper) throws AnnotatedException, CRLNotFoundException Checks a distribution point for revocation information for the certificate `cert`. Parameters dp:DistributionPoint The distribution point to consider. paramsPKIX:PKIXExtendedParameters PKIX parameters. cert:X509Certificate Certificate to check if it is revoked. defaultCRLSignCert:X509Certificate The issuer certificate of the certificate `cert`. defaultCRLSignKey:PublicKey The public key of the issuer certificate `defaultCRLSignCert`. certStatus:CertStatus The current certificate revocation status. reasonMask:ReasonsMask The reasons mask which is already checked. certPathCerts:List<E> The certificates of the certification path. Exceptions AnnotatedException: if the certificate is revoked or the status cannot be checked or some error occurs.

pack-priv static void checkCRL(DistributionPoint dp, PKIXExtendedParameters paramsPKIX, Date currentDate, Date validityDate, X509Certificate cert, X509Certificate defaultCRLSignCert, PublicKey defaultCRLSignKey, CertStatus certStatus, ReasonsMask reasonMask, List<E> certPathCerts, PKIXJcaJceHelper helper) throws AnnotatedException, CRLNotFoundException

Checks a distribution point for revocation information for the certificate cert.

Parameters

dp:DistributionPoint: The distribution point to consider.
paramsPKIX:PKIXExtendedParameters: PKIX parameters.
cert:X509Certificate: Certificate to check if it is revoked.
defaultCRLSignCert:X509Certificate: The issuer certificate of the certificate cert.
defaultCRLSignKey:PublicKey: The public key of the issuer certificate defaultCRLSignCert.
certStatus:CertStatus: The current certificate revocation status.
reasonMask:ReasonsMask: The reasons mask which is already checked.
certPathCerts:List<E>: The certificates of the certification path.

Exceptions

AnnotatedException:: if the certificate is revoked or the status cannot be checked or some error occurs.

processCRLA1i	back to summary
protected static Set<E> processCRLA1i(PKIXExtendedParameters paramsPKIX, Date currentDate, X509Certificate cert, X509CRL crl) throws AnnotatedException

processCRLA1ii	back to summary
protected static Set<E>[] processCRLA1ii(PKIXExtendedParameters paramsPKIX, Date currentDate, Date validityDate, X509Certificate cert, X509CRL crl) throws AnnotatedException

processCRLB1 back to summary

processCRLB1	back to summary
protected static void processCRLB1(DistributionPoint dp, Object cert, X509CRL crl) throws AnnotatedException If the DP includes cRLIssuer, then verify that the issuer field in the complete CRL matches cRLIssuer in the DP and that the complete CRL contains an issuing distribution point extension with the indirectCRL boolean asserted. Otherwise, verify that the CRL issuer matches the certificate issuer. Parameters dp:DistributionPoint The distribution point. cert:Object The certificate ot attribute certificate. crl:X509CRL The CRL for `cert`. Exceptions AnnotatedException: if one of the above conditions does not apply or an error occurs.

protected static void processCRLB1(DistributionPoint dp, Object cert, X509CRL crl) throws AnnotatedException

If the DP includes cRLIssuer, then verify that the issuer field in the complete CRL matches cRLIssuer in the DP and that the complete CRL contains an issuing distribution point extension with the indirectCRL boolean asserted. Otherwise, verify that the CRL issuer matches the certificate issuer.

Parameters

dp:DistributionPoint: The distribution point.
cert:Object: The certificate ot attribute certificate.
crl:X509CRL: The CRL for cert.

Exceptions

AnnotatedException:: if one of the above conditions does not apply or an error occurs.

processCRLB2	back to summary
protected static void processCRLB2(DistributionPoint dp, Object cert, X509CRL crl) throws AnnotatedException If the complete CRL includes an issuing distribution point (IDP) CRL extension check the following: (i) If the distribution point name is present in the IDP CRL extension and the distribution field is present in the DP, then verify that one of the names in the IDP matches one of the names in the DP. If the distribution point name is present in the IDP CRL extension and the distribution field is omitted from the DP, then verify that one of the names in the IDP matches one of the names in the cRLIssuer field of the DP. (ii) If the onlyContainsUserCerts boolean is asserted in the IDP CRL extension, verify that the certificate does not include the basic constraints extension with the cA boolean asserted. (iii) If the onlyContainsCACerts boolean is asserted in the IDP CRL extension, verify that the certificate includes the basic constraints extension with the cA boolean asserted. (iv) Verify that the onlyContainsAttributeCerts boolean is not asserted. Parameters dp:DistributionPoint The distribution point. cert:Object The certificate. crl:X509CRL The CRL. Exceptions AnnotatedException: if one of the conditions is not met or an error occurs.

processCRLB2

back to summary

protected static void processCRLB2(DistributionPoint dp, Object cert, X509CRL crl) throws AnnotatedException

If the complete CRL includes an issuing distribution point (IDP) CRL extension check the following:

(i) If the distribution point name is present in the IDP CRL extension and the distribution field is present in the DP, then verify that one of the names in the IDP matches one of the names in the DP. If the distribution point name is present in the IDP CRL extension and the distribution field is omitted from the DP, then verify that one of the names in the IDP matches one of the names in the cRLIssuer field of the DP.

(ii) If the onlyContainsUserCerts boolean is asserted in the IDP CRL extension, verify that the certificate does not include the basic constraints extension with the cA boolean asserted.

(iii) If the onlyContainsCACerts boolean is asserted in the IDP CRL extension, verify that the certificate includes the basic constraints extension with the cA boolean asserted.

(iv) Verify that the onlyContainsAttributeCerts boolean is not asserted.

Parameters

dp:DistributionPoint: The distribution point.
cert:Object: The certificate.
crl:X509CRL: The CRL.

Exceptions

AnnotatedException:: if one of the conditions is not met or an error occurs.

processCRLC	back to summary
protected static void processCRLC(X509CRL deltaCRL, X509CRL completeCRL, PKIXExtendedParameters pkixParams) throws AnnotatedException If use-deltas is set, verify the issuer and scope of the delta CRL. Parameters deltaCRL:X509CRL The delta CRL. completeCRL:X509CRL The complete CRL. pkixParams:PKIXExtendedParameters The PKIX paramaters. Exceptions AnnotatedException: if an exception occurs.

processCRLC

back to summary

protected static void processCRLC(X509CRL deltaCRL, X509CRL completeCRL, PKIXExtendedParameters pkixParams) throws AnnotatedException

If use-deltas is set, verify the issuer and scope of the delta CRL.

Parameters

deltaCRL:X509CRL: The delta CRL.
completeCRL:X509CRL: The complete CRL.
pkixParams:PKIXExtendedParameters: The PKIX paramaters.

Exceptions

AnnotatedException:: if an exception occurs.

processCRLD	back to summary
protected static ReasonsMask processCRLD(X509CRL crl, DistributionPoint dp) throws AnnotatedException

processCRLF back to summary

processCRLF	back to summary
protected static Set<E> processCRLF(X509CRL crl, Object cert, X509Certificate defaultCRLSignCert, PublicKey defaultCRLSignKey, PKIXExtendedParameters paramsPKIX, List<E> certPathCerts, PKIXJcaJceHelper helper) throws AnnotatedException Obtain and validate the certification path for the complete CRL issuer. If a key usage extension is present in the CRL issuer's certificate, verify that the cRLSign bit is set. Parameters crl:X509CRL CRL which contains revocation information for the certificate `cert`. cert:Object The attribute certificate or certificate to check if it is revoked. defaultCRLSignCert:X509Certificate The issuer certificate of the certificate `cert`. defaultCRLSignKey:PublicKey The public key of the issuer certificate `defaultCRLSignCert`. paramsPKIX:PKIXExtendedParameters PKIX parameters. certPathCerts:List<E> The certificates on the certification path. Returns:Set<E> A `Set` with all keys of possible CRL issuer certificates. Exceptions AnnotatedException: if the CRL is not valid or the status cannot be checked or some error occurs.

protected static Set<E> processCRLF(X509CRL crl, Object cert, X509Certificate defaultCRLSignCert, PublicKey defaultCRLSignKey, PKIXExtendedParameters paramsPKIX, List<E> certPathCerts, PKIXJcaJceHelper helper) throws AnnotatedException

Obtain and validate the certification path for the complete CRL issuer. If a key usage extension is present in the CRL issuer's certificate, verify that the cRLSign bit is set.

Parameters

crl:X509CRL: CRL which contains revocation information for the certificate cert.
cert:Object: The attribute certificate or certificate to check if it is revoked.
defaultCRLSignCert:X509Certificate: The issuer certificate of the certificate cert.
defaultCRLSignKey:PublicKey: The public key of the issuer certificate defaultCRLSignCert.
paramsPKIX:PKIXExtendedParameters: PKIX parameters.
certPathCerts:List<E>: The certificates on the certification path.

Returns:Set<E>

A Set with all keys of possible CRL issuer certificates.

Exceptions

AnnotatedException:: if the CRL is not valid or the status cannot be checked or some error occurs.

processCRLG	back to summary
protected static PublicKey processCRLG(X509CRL crl, Set<E> keys) throws AnnotatedException

processCRLH	back to summary
protected static X509CRL processCRLH(Set<E> deltacrls, PublicKey key) throws AnnotatedException

processCRLI	back to summary
protected static void processCRLI(Date validDate, X509CRL deltacrl, Object cert, CertStatus certStatus, PKIXExtendedParameters pkixParams) throws AnnotatedException

processCRLJ	back to summary
protected static void processCRLJ(Date validDate, X509CRL completecrl, Object cert, CertStatus certStatus) throws AnnotatedException

pack-priv Class RFC3280CertPathUtilities

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail