Modifier and Type	Class and Description
public static class	X509RevocationChecker.Builder
private class	X509RevocationChecker.LocalCRLStore

Modifier and Type	Field and Description
private final boolean	canSoftFail
public static final int	CHAIN_VALIDITY_MODEL This model uses the following validity model.
private final List<CertStore>	crlCertStores
protected static final String[]	crlReasons
private final List<Store<CRL>>	crls
private Date	currentDate
private final long	failHardMaxTime
private final long	failLogMaxTime
private final Map<X500Principal, Long>	failures
private final PKIXJcaJceHelper	helper
private final boolean	isCheckEEOnly
private static Logger	LOG
public static final int	PKIX_VALIDITY_MODEL This is the default PKIX validity model.
private X509Certificate	signingCert
private final Set<TrustAnchor>	trustAnchors
private final Date	validationDate
private final int	validityModel
private X500Principal	workingIssuerName
private PublicKey	workingPublicKey

Access	Constructor and Description
private	X509RevocationChecker(X509RevocationChecker.Builder bldr)

Method Summary

Modifier and Type	Method and Description
private void	addIssuers(final List<X500Principal> issuerList, CertStore certStore)
private void	addIssuers(final List<X500Principal> issuerList, Store<CRL> certStore)
public void	check(Certificate the `Certificate` to be checked certificate, Collection<String> a `Collection` of OID strings representing the current set of unresolved critical extensions collection) Implements abstract java.security.cert.PKIXCertPathChecker.check. Performs the check(s) on the specified certificate using its internal state and removes any critical extensions that it processes from the specified collection of OID strings that represent the unresolved critical extensions.
protected void	checkCRLs(PKIXExtendedParameters PKIX parameters. pkixParams, Date currentDate, Date The date when the certificate revocation status should be checked. validityDate, X509Certificate Certificate to check if it is revoked. cert, X509Certificate The issuer certificate of the certificate `cert`. sign, PublicKey The public key of the issuer certificate `sign`. workingPublicKey, List<E> The certificates of the certification path. certPathCerts, PKIXJcaJceHelper helper) Checks a certificate if it is revoked.
public Object	clone() Overrides java.security.cert.PKIXCertPathChecker.clone. Returns a clone of this object.
private Set<CRL>	downloadCRLs(X500Principal issuer, Date currentDate, ASN1Primitive crlDpPrimitive, JcaJceHelper helper)
pack-priv static List<PKIXCRLStore<T extends CRL>>	getAdditionalStoresFromCRLDistributionPoint(CRLDistPoint crldp, Map<GeneralName, PKIXCRLStore<T extends CRL>> namedCRLStoreMap)
public Set<String>	getSupportedExtensions() Implements abstract java.security.cert.PKIXCertPathChecker.getSupportedExtensions. Returns an immutable `Set` of X.509 certificate extensions that this `PKIXCertPathChecker` supports (i.e. recognizes, is able to process), or `null` if no extensions are supported.
public void	init(boolean the order that certificates are presented to the `check` method. If `true`, certificates are presented from target to most-trusted CA (forward); if `false`, from most-trusted CA to target (reverse). forward) Implements abstract java.security.cert.PKIXCertPathChecker.init. Implements java.security.cert.CertPathChecker.init. Initializes the internal state of this `PKIXCertPathChecker`.
public boolean	isForwardCheckingSupported() Implements abstract java.security.cert.PKIXCertPathChecker.isForwardCheckingSupported. Implements java.security.cert.CertPathChecker.isForwardCheckingSupported. Indicates if forward checking is supported.

Inherited from java.security.cert.PKIXCertPathChecker:: check

Field Detail

canSoftFail	back to summary
private final boolean canSoftFail

CHAIN_VALIDITY_MODEL back to summary

CHAIN_VALIDITY_MODEL	back to summary
public static final int CHAIN_VALIDITY_MODEL This model uses the following validity model. Each certificate must have been valid at the moment where is was used. That means the end certificate must have been valid at the time the signature was done. The CA certificate which signed the end certificate must have been valid, when the end certificate was signed. The CA (or Root CA) certificate must have been valid, when the CA certificate was signed and so on. So the `PKIXParameters#setDate(Date)` method sets the time, when the end certificate must have been valid. It is used e.g. in the German signature law.

public static final int CHAIN_VALIDITY_MODEL

This model uses the following validity model. Each certificate must have been valid at the moment where is was used. That means the end certificate must have been valid at the time the signature was done. The CA certificate which signed the end certificate must have been valid, when the end certificate was signed. The CA (or Root CA) certificate must have been valid, when the CA certificate was signed and so on. So the PKIXParameters#setDate(Date) method sets the time, when the end certificate must have been valid. It is used e.g. in the German signature law.

crlCertStores	back to summary
private final List<CertStore> crlCertStores

crlReasons	back to summary
protected static final String[] crlReasons

crls	back to summary
private final List<Store<CRL>> crls

currentDate	back to summary
private Date currentDate

failHardMaxTime	back to summary
private final long failHardMaxTime

failLogMaxTime	back to summary
private final long failLogMaxTime

failures	back to summary
private final Map<X500Principal, Long> failures

helper	back to summary
private final PKIXJcaJceHelper helper

isCheckEEOnly	back to summary
private final boolean isCheckEEOnly

LOG	back to summary
private static Logger LOG

PKIX_VALIDITY_MODEL back to summary

PKIX_VALIDITY_MODEL	back to summary
public static final int PKIX_VALIDITY_MODEL This is the default PKIX validity model. Actually there are two variants of this: The PKIX model and the modified PKIX model. The PKIX model verifies that all involved certificates must have been valid at the current time. The modified PKIX model verifies that all involved certificates were valid at the time of signing. Both are indirectly chosen with the `PKIXParameters#setDate(Date)` method, so this methods sets the Date when all certificates must have been valid.

public static final int PKIX_VALIDITY_MODEL

This is the default PKIX validity model. Actually there are two variants of this: The PKIX model and the modified PKIX model. The PKIX model verifies that all involved certificates must have been valid at the current time. The modified PKIX model verifies that all involved certificates were valid at the time of signing. Both are indirectly chosen with the PKIXParameters#setDate(Date) method, so this methods sets the Date when all certificates must have been valid.

signingCert	back to summary
private X509Certificate signingCert

trustAnchors	back to summary
private final Set<TrustAnchor> trustAnchors

validationDate	back to summary
private final Date validationDate

validityModel	back to summary
private final int validityModel

workingIssuerName	back to summary
private X500Principal workingIssuerName

workingPublicKey	back to summary
private PublicKey workingPublicKey

X509RevocationChecker	back to summary
private X509RevocationChecker(X509RevocationChecker.Builder bldr)

Method Detail

addIssuers	back to summary
private void addIssuers(final List<X500Principal> issuerList, CertStore certStore) throws CertStoreException

addIssuers	back to summary
private void addIssuers(final List<X500Principal> issuerList, Store<CRL> certStore)

check back to summary

check	back to summary
public void check(Certificate certificate, Collection<String> collection) throws CertPathValidatorException Implements abstract java.security.cert.PKIXCertPathChecker.check. Doc from java.security.cert.PKIXCertPathChecker.check. Performs the check(s) on the specified certificate using its internal state and removes any critical extensions that it processes from the specified collection of OID strings that represent the unresolved critical extensions. The certificates are presented in the order specified by the `init` method. Parameters certificate:Certificate the `Certificate` to be checked collection:Collection<String> a `Collection` of OID strings representing the current set of unresolved critical extensions Exceptions CertPathValidatorException: if the specified certificate does not pass the check

public void check(Certificate certificate, Collection<String> collection) throws CertPathValidatorException

Implements abstract java.security.cert.PKIXCertPathChecker.check.

Doc from java.security.cert.PKIXCertPathChecker.check.

Performs the check(s) on the specified certificate using its internal state and removes any critical extensions that it processes from the specified collection of OID strings that represent the unresolved critical extensions. The certificates are presented in the order specified by the init method.

Parameters

certificate:Certificate: the Certificate to be checked
collection:Collection<String>: a Collection of OID strings representing the current set of unresolved critical extensions

Exceptions

CertPathValidatorException:: if the specified certificate does not pass the check

checkCRLs back to summary

checkCRLs	back to summary
protected void checkCRLs(PKIXExtendedParameters pkixParams, Date currentDate, Date validityDate, X509Certificate cert, X509Certificate sign, PublicKey workingPublicKey, List<E> certPathCerts, PKIXJcaJceHelper helper) throws AnnotatedException, CertPathValidatorException Checks a certificate if it is revoked. Parameters pkixParams:PKIXExtendedParameters PKIX parameters. validityDate:Date The date when the certificate revocation status should be checked. cert:X509Certificate Certificate to check if it is revoked. sign:X509Certificate The issuer certificate of the certificate `cert`. workingPublicKey:PublicKey The public key of the issuer certificate `sign`. certPathCerts:List<E> The certificates of the certification path. Exceptions AnnotatedException: if the certificate is revoked or the status cannot be checked or some error occurs.

protected void checkCRLs(PKIXExtendedParameters pkixParams, Date currentDate, Date validityDate, X509Certificate cert, X509Certificate sign, PublicKey workingPublicKey, List<E> certPathCerts, PKIXJcaJceHelper helper) throws AnnotatedException, CertPathValidatorException

Checks a certificate if it is revoked.

Parameters

pkixParams:PKIXExtendedParameters: PKIX parameters.
validityDate:Date: The date when the certificate revocation status should be checked.
cert:X509Certificate: Certificate to check if it is revoked.
sign:X509Certificate: The issuer certificate of the certificate cert.
workingPublicKey:PublicKey: The public key of the issuer certificate sign.
certPathCerts:List<E>: The certificates of the certification path.

Exceptions

AnnotatedException:: if the certificate is revoked or the status cannot be checked or some error occurs.

clone back to summary

clone	back to summary
public Object clone() Overrides java.security.cert.PKIXCertPathChecker.clone. Doc from java.security.cert.PKIXCertPathChecker.clone. Returns a clone of this object. Calls the `Object.clone()` method. All subclasses which maintain state must support and override this method, if necessary. Returns:Object a copy of this `PKIXCertPathChecker`

public Object clone()

Overrides java.security.cert.PKIXCertPathChecker.clone.

Doc from java.security.cert.PKIXCertPathChecker.clone.

Returns a clone of this object. Calls the Object.clone() method. All subclasses which maintain state must support and override this method, if necessary.

Returns:Object: a copy of this PKIXCertPathChecker

downloadCRLs	back to summary
private Set<CRL> downloadCRLs(X500Principal issuer, Date currentDate, ASN1Primitive crlDpPrimitive, JcaJceHelper helper)

getAdditionalStoresFromCRLDistributionPoint	back to summary
pack-priv static List<PKIXCRLStore<T extends CRL>> getAdditionalStoresFromCRLDistributionPoint(CRLDistPoint crldp, Map<GeneralName, PKIXCRLStore<T extends CRL>> namedCRLStoreMap) throws AnnotatedException

getSupportedExtensions back to summary

getSupportedExtensions	back to summary
public Set<String> getSupportedExtensions() Implements abstract java.security.cert.PKIXCertPathChecker.getSupportedExtensions. Doc from java.security.cert.PKIXCertPathChecker.getSupportedExtensions. Returns an immutable `Set` of X.509 certificate extensions that this `PKIXCertPathChecker` supports (i.e. recognizes, is able to process), or `null` if no extensions are supported. Each element of the set is a `String` representing the Object Identifier (OID) of the X.509 extension that is supported. The OID is represented by a set of nonnegative integers separated by periods. All X.509 certificate extensions that a `PKIXCertPathChecker` might possibly be able to process should be included in the set. Returns:Set<String> an immutable `Set` of X.509 extension OIDs (in `String` format) supported by this `PKIXCertPathChecker`, or `null` if no extensions are supported

public Set<String> getSupportedExtensions()

Implements abstract java.security.cert.PKIXCertPathChecker.getSupportedExtensions.

Doc from java.security.cert.PKIXCertPathChecker.getSupportedExtensions.

Returns an immutable Set of X.509 certificate extensions that this PKIXCertPathChecker supports (i.e. recognizes, is able to process), or null if no extensions are supported.

Each element of the set is a String representing the Object Identifier (OID) of the X.509 extension that is supported. The OID is represented by a set of nonnegative integers separated by periods.

All X.509 certificate extensions that a PKIXCertPathChecker might possibly be able to process should be included in the set.

Returns:Set<String>: an immutable Set of X.509 extension OIDs (in String format) supported by this PKIXCertPathChecker, or null if no extensions are supported

init back to summary

init	back to summary
public void init(boolean forward) throws CertPathValidatorException Implements abstract java.security.cert.PKIXCertPathChecker.init. Implements java.security.cert.CertPathChecker.init. Doc from java.security.cert.PKIXCertPathChecker.init. Initializes the internal state of this `PKIXCertPathChecker`. The `forward` flag specifies the order that certificates will be passed to the `check` method (forward or reverse). A `PKIXCertPathChecker` must support reverse checking and may support forward checking. Parameters forward:boolean the order that certificates are presented to the `check` method. If `true`, certificates are presented from target to most-trusted CA (forward); if `false`, from most-trusted CA to target (reverse). Exceptions CertPathValidatorException: if this `PKIXCertPathChecker` is unable to check certificates in the specified order; it should never be thrown if the forward flag is false since reverse checking must be supported

public void init(boolean forward) throws CertPathValidatorException

Implements abstract java.security.cert.PKIXCertPathChecker.init.

Implements java.security.cert.CertPathChecker.init.

Doc from java.security.cert.PKIXCertPathChecker.init.

Initializes the internal state of this PKIXCertPathChecker.

The forward flag specifies the order that certificates will be passed to the check method (forward or reverse). A PKIXCertPathChecker must support reverse checking and may support forward checking.

Parameters

forward:boolean: the order that certificates are presented to the check method. If true, certificates are presented from target to most-trusted CA (forward); if false, from most-trusted CA to target (reverse).

Exceptions

CertPathValidatorException:: if this PKIXCertPathChecker is unable to check certificates in the specified order; it should never be thrown if the forward flag is false since reverse checking must be supported

isForwardCheckingSupported back to summary

isForwardCheckingSupported	back to summary
public boolean isForwardCheckingSupported() Implements abstract java.security.cert.PKIXCertPathChecker.isForwardCheckingSupported. Implements java.security.cert.CertPathChecker.isForwardCheckingSupported. Doc from java.security.cert.PKIXCertPathChecker.isForwardCheckingSupported. Indicates if forward checking is supported. Forward checking refers to the ability of the `PKIXCertPathChecker` to perform its checks when certificates are presented to the `check` method in the forward direction (from target to most-trusted CA). Returns:boolean `true` if forward checking is supported, `false` otherwise

public boolean isForwardCheckingSupported()

Implements abstract java.security.cert.PKIXCertPathChecker.isForwardCheckingSupported.

Implements java.security.cert.CertPathChecker.isForwardCheckingSupported.

Doc from java.security.cert.PKIXCertPathChecker.isForwardCheckingSupported.

Indicates if forward checking is supported. Forward checking refers to the ability of the PKIXCertPathChecker to perform its checks when certificates are presented to the check method in the forward direction (from target to most-trusted CA).

Returns:boolean: true if forward checking is supported, false otherwise

org.bouncycastle.pkix.jcajce back to summary

public Class X509RevocationChecker.Builder

Class Inheritance

extends Object

java.lang.Object
org.bouncycastle.pkix.jcajce.X509RevocationChecker.Builder

Field Summary

Modifier and Type	Field and Description
private boolean	canSoftFail
private List<CertStore>	crlCertStores
private List<Store<CRL>>	crls
private long	failHardMaxTime
private long	failLogMaxTime
private boolean	isCheckEEOnly
private Provider	provider
private String	providerName
private Set<TrustAnchor>	trustAnchors
private Date	validityDate
private int	validityModel

Constructor Summary

Access	Constructor and Description
public	Builder(TrustAnchor the trust anchor our chain should start with. trustAnchor) Base constructor.
public	Builder(Set<TrustAnchor> a set of potential trust anchors trustAnchors) Base constructor.
public	Builder(KeyStore a keystore of potential trust anchors trustStore) Base constructor.

Method Summary

Modifier and Type	Method and Description
public X509RevocationChecker.Builder	Returns: the current builder instance. addCrls(CertStore CRLs to be examined. crls) Add a collection of CRLs to the checker.
public X509RevocationChecker.Builder	Returns: the current builder instance. addCrls(Store<CRL> CRLs to be examined. crls) Add a collection of CRLs to the checker.
public X509RevocationChecker	Returns: a new X509RevocationChecker. build() Build a revocation checker conforming to the current builder.
public X509RevocationChecker.Builder	Returns: the current builder instance. setCheckEndEntityOnly(boolean true if only end-entities should be checked, false otherwise. isTrue)
public X509RevocationChecker.Builder	Returns: the current builder instance. setDate(Date date we are validating for. validityDate) Set the current date for checking if not today.
public X509RevocationChecker.Builder	Returns: the current builder instance. setSoftFail(boolean true soft failure should be enabled, false otherwise. isTrue, long the time that can pass between the first failure and the most recent. maxTime) Configure soft failure if CRLs/OCSP not available.
public X509RevocationChecker.Builder	Returns: the current builder instance. setSoftFailHardLimit(boolean true soft failure should be enabled, false otherwise. isTrue, long the time that can pass between the first failure and the most recent. maxTime) Configure soft failure with a hard limit if CRLs/OCSP not available.
public X509RevocationChecker.Builder	setValidityModel(int The validity model to set. validityModel)
public X509RevocationChecker.Builder	Returns: the current builder instance. usingProvider(Provider provider to use. provider) Configure to use the installed provider with name ProviderName.
public X509RevocationChecker.Builder	Returns: the current builder instance. usingProvider(String name of the installed provider to use. providerName) Configure to use the installed provider with name ProviderName.

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

Field Detail

canSoftFail	back to summary
private boolean canSoftFail

crlCertStores	back to summary
private List<CertStore> crlCertStores

crls	back to summary
private List<Store<CRL>> crls

failHardMaxTime	back to summary
private long failHardMaxTime

failLogMaxTime	back to summary
private long failLogMaxTime

isCheckEEOnly	back to summary
private boolean isCheckEEOnly

provider	back to summary
private Provider provider

providerName	back to summary
private String providerName

trustAnchors	back to summary
private Set<TrustAnchor> trustAnchors

validityDate	back to summary
private Date validityDate

validityModel	back to summary
private int validityModel

Constructor Detail

Builder	back to summary
public Builder(TrustAnchor trustAnchor) Base constructor. Parameters trustAnchor:TrustAnchor the trust anchor our chain should start with.

Builder

back to summary

public Builder(TrustAnchor trustAnchor)

Base constructor.

Parameters

trustAnchor:TrustAnchor: the trust anchor our chain should start with.

Builder	back to summary
public Builder(Set<TrustAnchor> trustAnchors) Base constructor. Parameters trustAnchors:Set<TrustAnchor> a set of potential trust anchors

Builder

back to summary

public Builder(Set<TrustAnchor> trustAnchors)

Base constructor.

Parameters

trustAnchors:Set<TrustAnchor>: a set of potential trust anchors

Builder

back to summary

public Builder(KeyStore trustStore) throws KeyStoreException

Base constructor.

Parameters

trustStore:KeyStore: a keystore of potential trust anchors

Method Detail

addCrls

back to summary

public X509RevocationChecker.Builder addCrls(CertStore crls)

Add a collection of CRLs to the checker.

Parameters

crls:CertStore: CRLs to be examined.

Returns:X509RevocationChecker.Builder

the current builder instance.

addCrls

back to summary

public X509RevocationChecker.Builder addCrls(Store<CRL> crls)

Add a collection of CRLs to the checker.

Parameters

crls:Store<CRL>: CRLs to be examined.

Returns:X509RevocationChecker.Builder

the current builder instance.

build

back to summary

public X509RevocationChecker build()

Build a revocation checker conforming to the current builder.

Returns:X509RevocationChecker: a new X509RevocationChecker.

setCheckEndEntityOnly	back to summary
public X509RevocationChecker.Builder setCheckEndEntityOnly(boolean isTrue) Parameters isTrue:boolean true if only end-entities should be checked, false otherwise. Returns:X509RevocationChecker.Builder the current builder instance.

setDate

back to summary

public X509RevocationChecker.Builder setDate(Date validityDate)

Set the current date for checking if not today.

Parameters

validityDate:Date: date we are validating for.

Returns:X509RevocationChecker.Builder

the current builder instance.

setSoftFail

back to summary

public X509RevocationChecker.Builder setSoftFail(boolean isTrue, long maxTime)

Configure soft failure if CRLs/OCSP not available. If maxTime is greater than zero it represents the acceptable downtime for any responders or distribution points we are trying to connect to, with downtime measured from the first failure. Initially failures will log at Level.WARNING, once maxTime is exceeded any failures will be logged as Level.SEVERE. Setting maxTime to zero will mean 1 failure will be allowed before failures are logged as severe.

Parameters

isTrue:boolean: true soft failure should be enabled, false otherwise.
maxTime:long: the time that can pass between the first failure and the most recent.

Returns:X509RevocationChecker.Builder

the current builder instance.

setSoftFailHardLimit

back to summary

public X509RevocationChecker.Builder setSoftFailHardLimit(boolean isTrue, long maxTime)

Configure soft failure with a hard limit if CRLs/OCSP not available. If maxTime is greater than zero it represents the acceptable downtime for any responders or distribution points we are trying to connect to, with downtime measured from the first failure. Initially failures will log at Level.WARNING, once 75% of maxTime is exceeded any failures will be logged as Level.SEVERE. At maxTime any failures will be treated as hard, setting maxTime to zero will mean 1 failure will be allowed.

Parameters

isTrue:boolean: true soft failure should be enabled, false otherwise.
maxTime:long: the time that can pass between the first failure and the most recent.

Returns:X509RevocationChecker.Builder

the current builder instance.

setValidityModel	back to summary
public X509RevocationChecker.Builder setValidityModel(int validityModel) Parameters validityModel:int The validity model to set. See Also `CHAIN_VALIDITY_MODEL`, `PKIX_VALIDITY_MODEL`

usingProvider

back to summary

public X509RevocationChecker.Builder usingProvider(Provider provider)

Configure to use the installed provider with name ProviderName.

Parameters

provider:Provider: provider to use.

Returns:X509RevocationChecker.Builder

the current builder instance.

usingProvider

back to summary

public X509RevocationChecker.Builder usingProvider(String providerName)

Configure to use the installed provider with name ProviderName.

Parameters

providerName:String: name of the installed provider to use.

Returns:X509RevocationChecker.Builder

the current builder instance.

org.bouncycastle.pkix.jcajce back to summary

private Class X509RevocationChecker.LocalCRLStore

Class Inheritance

extends Object
implements PKIXCRLStore<CRL>, Iterable<CRL>

java.lang.Object
org.bouncycastle.pkix.jcajce.X509RevocationChecker.LocalCRLStore

All Implemented Interfaces

org.bouncycastle.util.Iterable, java.lang.Iterable, org.bouncycastle.jcajce.PKIXCRLStore, org.bouncycastle.util.Store

Field Summary

Modifier and Type	Field and Description
private Collection<CRL>	_local

Constructor Summary

Access	Constructor and Description
public	LocalCRLStore(Store<CRL> - initial contents for the store, this is copied. collection) Basic constructor.

Method Summary

Modifier and Type	Method and Description
public Collection<CRL>	Returns: a possibly empty collection of matching objects. getMatches(Selector<CRL> the selector to match against. selector) Implements org.bouncycastle.jcajce.PKIXCRLStore.getMatches. Return the matches in the collection for the passed in selector.
public Iterator<CRL>	iterator() Implements org.bouncycastle.util.Iterable.iterator. Returns an iterator over a set of elements of type T.