Top Fields Constructors Methods
org.bouncycastle.jce.provider

pack-priv Class CertPathValidatorUtilities

extends Object
Class Inheritance
Imports
java.io.ByteArrayOutputStream, .IOException, java.math.BigInteger, java.net.URI, java.security.GeneralSecurityException, .KeyFactory, .PublicKey, java.security.cert.CRLException, .CertPath, .CertPathBuilderException, .CertPathValidatorException, .CertStore, .CertStoreException, .Certificate, .CertificateFactory, .CertificateParsingException, .PolicyQualifierInfo, .TrustAnchor, .X509CRL, .X509CRLEntry, .X509CRLSelector, .X509CertSelector, .X509Certificate, java.security.interfaces.DSAParams, .DSAPublicKey, java.security.spec.DSAPublicKeySpec, java.text.ParseException, java.util.ArrayList, .Collection, .Collections, .Date, .Enumeration, .HashSet, .Iterator, .LinkedHashSet, .List, .Map, .Set, javax.security.auth.x500.X500Principal, org.bouncycastle.asn1.ASN1Encodable, .ASN1Enumerated, .ASN1GeneralizedTime, .ASN1Integer, .ASN1ObjectIdentifier, .ASN1OctetString, .ASN1OutputStream, .ASN1Primitive, .ASN1Sequence, .ASN1String, .DEROctetString, .DERSequence, org.bouncycastle.asn1.x500.X500Name, org.bouncycastle.asn1.x500.style.RFC4519Style, org.bouncycastle.asn1.x509.AlgorithmIdentifier, .AuthorityKeyIdentifier, .CRLDistPoint, .CRLReason, .DistributionPoint, .DistributionPointName, .Extension, .GeneralName, .GeneralNames, .PolicyInformation, .SubjectPublicKeyInfo, org.bouncycastle.internal.asn1.isismtt.ISISMTTObjectIdentifiers, org.bouncycastle.jcajce.PKIXCRLStore, .PKIXCRLStoreSelector, .PKIXCertRevocationCheckerParameters, .PKIXCertStore, .PKIXCertStoreSelector, .PKIXExtendedBuilderParameters, .PKIXExtendedParameters, org.bouncycastle.jcajce.util.JcaJceHelper, org.bouncycastle.jce.exception.ExtCertPathBuilderException, .ExtCertPathValidatorException, org.bouncycastle.util.Properties, .Selector, .Store, .StoreException, org.bouncycastle.x509.X509AttributeCertificate

Field Summary

Modifier and TypeField and Description
protected static final String
ANY_POLICY

protected static final String
AUTHORITY_KEY_IDENTIFIER

protected static final String
BASIC_CONSTRAINTS

protected static final String
CERTIFICATE_POLICIES

protected static final String
CRL_DISTRIBUTION_POINTS

protected static final String
CRL_NUMBER

protected static final int
CRL_SIGN

protected static final String[]
crlReasons

protected static final String
DELTA_CRL_INDICATOR

protected static final String
FRESHEST_CRL

protected static final String
INHIBIT_ANY_POLICY

protected static final String
ISSUING_DISTRIBUTION_POINT

protected static final int
KEY_CERT_SIGN

protected static final String
KEY_USAGE

protected static final String
NAME_CONSTRAINTS

protected static final String
POLICY_CONSTRAINTS

protected static final String
POLICY_MAPPINGS

protected static final String
SUBJECT_ALTERNATIVE_NAME

Constructor Summary

AccessConstructor and Description
pack-priv
CertPathValidatorUtilities()

Method Summary

Modifier and TypeMethod and Description
pack-priv static void
checkCRLsNotEmpty(PKIXCertRevocationCheckerParameters params, Set<E> crls, Object cert)

protected static void

Returns:

a Collection of all found X509Certificate May be empty but never null.
findCertificates(LinkedHashSet<E>
a LinkedHashSet to which the certificates will be added.
certs, PKIXCertStoreSelector<T extends Certificate>
a Selector object that will be used to select the certificates
certSelect, List<E>
a List containing only Store objects. These are used to search for certificates.
certStores)

Return a Collection of all certificates or attribute certificates found in the X509Store's that are matching the certSelect criteriums.

pack-priv static Collection<E>

Returns:

A Collection object containing the issuer X509Certificates. Never null.
findIssuerCerts(X509Certificate
The certificate for which an issuer should be found.
cert, List<CertStore> certStores, List<PKIXCertStore<T extends Certificate>> pkixCertStores)

Find the issuer certificates of a given certificate.

pack-priv static Collection<E>
findTargets(PKIXExtendedBuilderParameters paramsPKIX)

protected static TrustAnchor

Returns:

the TrustAnchor object if found or null if not.
findTrustAnchor(X509Certificate
the X509 certificate
cert, Set<E>
a Set of TrustAnchor's
trustAnchors)

Search the given Set of TrustAnchor's for one that is the issuer of the given X509 certificate.

protected static TrustAnchor

Returns:

the TrustAnchor object if found or null if not.
findTrustAnchor(X509Certificate
the X509 certificate
cert, Set<E>
a Set of TrustAnchor's
trustAnchors, String
the provider to use for signature verification
sigProvider)

Search the given Set of TrustAnchor's for one that is the issuer of the given X509 certificate.

pack-priv static List<PKIXCertStore<T extends Certificate>>
getAdditionalStoresFromAltNames(byte[] issuerAlternativeName, Map<GeneralName, PKIXCertStore<T extends Certificate>> altNameCertStoreMap)

pack-priv static List<PKIXCRLStore<T extends CRL>>
getAdditionalStoresFromCRLDistributionPoint(CRLDistPoint crldp, Map<GeneralName, PKIXCRLStore<T extends CRL>> namedCRLStoreMap, Date validDate, JcaJceHelper helper)

protected static AlgorithmIdentifier
getAlgorithmIdentifier(PublicKey key)

protected static void
getCertStatus(Date validDate, X509CRL crl, Object cert, CertStatus certStatus)

protected static Set<E>

Returns:

A Set of X509CRLs with complete CRLs.
getCompleteCRLs(PKIXCertRevocationCheckerParameters params, DistributionPoint
The distribution point for which the complete CRL
dp, Object
The X509Certificate for which the CRL should be searched.
cert, PKIXExtendedParameters
The extended PKIX parameters.
paramsPKIX, Date validityDate)

Fetches complete CRLs according to RFC 3280.

protected static void
getCRLIssuersFromDistributionPoint(DistributionPoint
The distribution point.
dp, Collection<E>
The issuers of the certificate or attribute certificate which contains the distribution point.
issuerPrincipals, X509CRLSelector
The CRL selector.
selector)

Add the CRL issuers from the cRLIssuer field of the distribution point or from the certificate if not given to the issuer criterion of the selector.

protected static Set<E>

Returns:

A Set of X509CRLs with delta CRLs.
getDeltaCRLs(Date
The date for which the delta CRLs must be valid.
validityDate, X509CRL
The complete CRL the delta CRL is for.
completeCRL, List<CertStore> certStores, List<PKIXCRLStore<T extends CRL>> pkixCrlStores, JcaJceHelper helper)

Fetches delta CRLs according to RFC 3280 section 5.2.4.

protected static ASN1Primitive
getExtensionValue(X509Extension
The extension object.
ext, String
The object identifier to obtain.
oid)

Extract the value of the given extension, if it exists.

protected static PublicKey

Returns:

The public key of the certificate in list position index extended with DSA parameters if applicable.
getNextWorkingKey(List<E>
The certification path.
certs, int
The index of the certificate which contains the public key which should be extended with DSA parameters.
index, JcaJceHelper helper)

Return the next working key inheriting DSA parameters if necessary.

private static ASN1Primitive
getObject(String oid, byte[] ext)

protected static final Set<E>
getQualifierSet(ASN1Sequence qualifiers)

private static BigInteger
getSerialNumber(Object cert)

protected static Date
getValidCertDateFromValidityModel(Date validityDate, int validityModel, CertPath certPath, int index)

protected static Date
getValidityDate(PKIXExtendedParameters paramsPKIX, Date currentDate)

protected static boolean
isAnyPolicy(Set<E> policySet)

private static boolean
isDeltaCRL(X509CRL crl)

pack-priv static boolean
isIssuerTrustAnchor(X509Certificate cert, Set<E> trustAnchors, String sigProvider)

protected static boolean
isSelfIssued(X509Certificate cert)

protected static void
prepareNextCertB1(int i, List<E>[] policyNodes, String id_p, Map<K, V> m_idp, X509Certificate cert)

protected static PKIXPolicyNode
prepareNextCertB2(int i, List<E>[] policyNodes, String id_p, PKIXPolicyNode validPolicyTree)

protected static boolean
processCertD1i(int index, List<E>[] policyNodes, ASN1ObjectIdentifier pOid, Set<E> pq)

protected static void
processCertD1ii(int index, List<E>[] policyNodes, ASN1ObjectIdentifier _poid, Set<E> _pq)

protected static PKIXPolicyNode
removePolicyNode(PKIXPolicyNode validPolicyTree, List<E>[] policyNodes, PKIXPolicyNode _node)

private static void
removePolicyNodeRecurse(List<E>[] policyNodes, PKIXPolicyNode _node)

protected static void
verifyX509Certificate(X509Certificate cert, PublicKey publicKey, String sigProvider)

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

ANY_POLICYback to summary
protected static final String ANY_POLICY
AUTHORITY_KEY_IDENTIFIERback to summary
protected static final String AUTHORITY_KEY_IDENTIFIER
BASIC_CONSTRAINTSback to summary
protected static final String BASIC_CONSTRAINTS
CERTIFICATE_POLICIESback to summary
protected static final String CERTIFICATE_POLICIES
CRL_DISTRIBUTION_POINTSback to summary
protected static final String CRL_DISTRIBUTION_POINTS
CRL_NUMBERback to summary
protected static final String CRL_NUMBER
CRL_SIGNback to summary
protected static final int CRL_SIGN
crlReasonsback to summary
protected static final String[] crlReasons
DELTA_CRL_INDICATORback to summary
protected static final String DELTA_CRL_INDICATOR
FRESHEST_CRLback to summary
protected static final String FRESHEST_CRL
INHIBIT_ANY_POLICYback to summary
protected static final String INHIBIT_ANY_POLICY
ISSUING_DISTRIBUTION_POINTback to summary
protected static final String ISSUING_DISTRIBUTION_POINT
KEY_CERT_SIGNback to summary
protected static final int KEY_CERT_SIGN
KEY_USAGEback to summary
protected static final String KEY_USAGE
NAME_CONSTRAINTSback to summary
protected static final String NAME_CONSTRAINTS
POLICY_CONSTRAINTSback to summary
protected static final String POLICY_CONSTRAINTS
POLICY_MAPPINGSback to summary
protected static final String POLICY_MAPPINGS
SUBJECT_ALTERNATIVE_NAMEback to summary
protected static final String SUBJECT_ALTERNATIVE_NAME

Constructor Detail

CertPathValidatorUtilitiesback to summary
pack-priv CertPathValidatorUtilities()

Method Detail

checkCRLsNotEmptyback to summary
pack-priv static void checkCRLsNotEmpty(PKIXCertRevocationCheckerParameters params, Set<E> crls, Object cert) throws RecoverableCertPathValidatorException
findCertificatesback to summary
protected static void findCertificates(LinkedHashSet<E> certs, PKIXCertStoreSelector<T extends Certificate> certSelect, List<E> certStores) throws AnnotatedException

Return a Collection of all certificates or attribute certificates found in the X509Store's that are matching the certSelect criteriums.

Parameters
certs:LinkedHashSet<E>

a LinkedHashSet to which the certificates will be added.

certSelect:PKIXCertStoreSelector<T extends Certificate>

a Selector object that will be used to select the certificates

certStores:List<E>

a List containing only Store objects. These are used to search for certificates.

Returns:void

a Collection of all found X509Certificate May be empty but never null.

findIssuerCertsback to summary
pack-priv static Collection<E> findIssuerCerts(X509Certificate cert, List<CertStore> certStores, List<PKIXCertStore<T extends Certificate>> pkixCertStores) throws AnnotatedException

Find the issuer certificates of a given certificate.

Parameters
cert:X509Certificate

The certificate for which an issuer should be found.

Returns:Collection<E>

A Collection object containing the issuer X509Certificates. Never null.

Exceptions
AnnotatedException:
if an error occurs.
findTargetsback to summary
pack-priv static Collection<E> findTargets(PKIXExtendedBuilderParameters paramsPKIX) throws CertPathBuilderException
findTrustAnchorback to summary
protected static TrustAnchor findTrustAnchor(X509Certificate cert, Set<E> trustAnchors) throws AnnotatedException

Search the given Set of TrustAnchor's for one that is the issuer of the given X509 certificate. Uses the default provider for signature verification.

Parameters
cert:X509Certificate

the X509 certificate

trustAnchors:Set<E>

a Set of TrustAnchor's

Returns:TrustAnchor

the TrustAnchor object if found or null if not.

Exceptions
AnnotatedException:
if a TrustAnchor was found but the signature verification on the given certificate has thrown an exception.
findTrustAnchorback to summary
protected static TrustAnchor findTrustAnchor(X509Certificate cert, Set<E> trustAnchors, String sigProvider) throws AnnotatedException

Search the given Set of TrustAnchor's for one that is the issuer of the given X509 certificate. Uses the specified provider for signature verification, or the default provider if null.

Parameters
cert:X509Certificate

the X509 certificate

trustAnchors:Set<E>

a Set of TrustAnchor's

sigProvider:String

the provider to use for signature verification

Returns:TrustAnchor

the TrustAnchor object if found or null if not.

Exceptions
AnnotatedException:
if a TrustAnchor was found but the signature verification on the given certificate has thrown an exception.
getAdditionalStoresFromAltNamesback to summary
pack-priv static List<PKIXCertStore<T extends Certificate>> getAdditionalStoresFromAltNames(byte[] issuerAlternativeName, Map<GeneralName, PKIXCertStore<T extends Certificate>> altNameCertStoreMap) throws CertificateParsingException
getAdditionalStoresFromCRLDistributionPointback to summary
pack-priv static List<PKIXCRLStore<T extends CRL>> getAdditionalStoresFromCRLDistributionPoint(CRLDistPoint crldp, Map<GeneralName, PKIXCRLStore<T extends CRL>> namedCRLStoreMap, Date validDate, JcaJceHelper helper) throws AnnotatedException
getAlgorithmIdentifierback to summary
protected static AlgorithmIdentifier getAlgorithmIdentifier(PublicKey key) throws CertPathValidatorException
getCertStatusback to summary
protected static void getCertStatus(Date validDate, X509CRL crl, Object cert, CertStatus certStatus) throws AnnotatedException
getCompleteCRLsback to summary
protected static Set<E> getCompleteCRLs(PKIXCertRevocationCheckerParameters params, DistributionPoint dp, Object cert, PKIXExtendedParameters paramsPKIX, Date validityDate) throws AnnotatedException, RecoverableCertPathValidatorException

Fetches complete CRLs according to RFC 3280.

Parameters
dp:DistributionPoint

The distribution point for which the complete CRL

cert:Object

The X509Certificate for which the CRL should be searched.

paramsPKIX:PKIXExtendedParameters

The extended PKIX parameters.

Returns:Set<E>

A Set of X509CRLs with complete CRLs.

Exceptions
AnnotatedException:
if an exception occurs while picking the CRLs or no CRLs are found.
getCRLIssuersFromDistributionPointback to summary
protected static void getCRLIssuersFromDistributionPoint(DistributionPoint dp, Collection<E> issuerPrincipals, X509CRLSelector selector) throws AnnotatedException

Add the CRL issuers from the cRLIssuer field of the distribution point or from the certificate if not given to the issuer criterion of the selector.

The issuerPrincipals are a collection with a single X500Name for X509Certificates.

Parameters
dp:DistributionPoint

The distribution point.

issuerPrincipals:Collection<E>

The issuers of the certificate or attribute certificate which contains the distribution point.

selector:X509CRLSelector

The CRL selector.

Exceptions
AnnotatedException:
if an exception occurs while processing.
ClassCastException:
if issuerPrincipals does not contain only X500Names.
getDeltaCRLsback to summary
protected static Set<E> getDeltaCRLs(Date validityDate, X509CRL completeCRL, List<CertStore> certStores, List<PKIXCRLStore<T extends CRL>> pkixCrlStores, JcaJceHelper helper) throws AnnotatedException

Fetches delta CRLs according to RFC 3280 section 5.2.4.

Parameters
validityDate:Date

The date for which the delta CRLs must be valid.

completeCRL:X509CRL

The complete CRL the delta CRL is for.

Returns:Set<E>

A Set of X509CRLs with delta CRLs.

Exceptions
AnnotatedException:
if an exception occurs while picking the delta CRLs.
getExtensionValueback to summary
protected static ASN1Primitive getExtensionValue(X509Extension ext, String oid) throws AnnotatedException

Extract the value of the given extension, if it exists.

Parameters
ext:X509Extension

The extension object.

oid:String

The object identifier to obtain.

Exceptions
AnnotatedException:
if the extension cannot be read.
getNextWorkingKeyback to summary
protected static PublicKey getNextWorkingKey(List<E> certs, int index, JcaJceHelper helper) throws CertPathValidatorException

Return the next working key inheriting DSA parameters if necessary.

This methods inherits DSA parameters from the indexed certificate or previous certificates in the certificate chain to the returned PublicKey. The list is searched upwards, meaning the end certificate is at position 0 and previous certificates are following.

If the indexed certificate does not contain a DSA key this method simply returns the public key. If the DSA key already contains DSA parameters the key is also only returned.

Parameters
certs:List<E>

The certification path.

index:int

The index of the certificate which contains the public key which should be extended with DSA parameters.

Returns:PublicKey

The public key of the certificate in list position index extended with DSA parameters if applicable.

Exceptions
AnnotatedException:
if DSA parameters cannot be inherited.
getObjectback to summary
private static ASN1Primitive getObject(String oid, byte[] ext) throws AnnotatedException
getQualifierSetback to summary
protected static final Set<E> getQualifierSet(ASN1Sequence qualifiers) throws CertPathValidatorException
getSerialNumberback to summary
private static BigInteger getSerialNumber(Object cert)
getValidCertDateFromValidityModelback to summary
protected static Date getValidCertDateFromValidityModel(Date validityDate, int validityModel, CertPath certPath, int index) throws AnnotatedException
getValidityDateback to summary
protected static Date getValidityDate(PKIXExtendedParameters paramsPKIX, Date currentDate)
isAnyPolicyback to summary
protected static boolean isAnyPolicy(Set<E> policySet)
isDeltaCRLback to summary
private static boolean isDeltaCRL(X509CRL crl)
isIssuerTrustAnchorback to summary
pack-priv static boolean isIssuerTrustAnchor(X509Certificate cert, Set<E> trustAnchors, String sigProvider) throws AnnotatedException
isSelfIssuedback to summary
protected static boolean isSelfIssued(X509Certificate cert)
prepareNextCertB1back to summary
protected static void prepareNextCertB1(int i, List<E>[] policyNodes, String id_p, Map<K, V> m_idp, X509Certificate cert) throws AnnotatedException, CertPathValidatorException
prepareNextCertB2back to summary
protected static PKIXPolicyNode prepareNextCertB2(int i, List<E>[] policyNodes, String id_p, PKIXPolicyNode validPolicyTree)
processCertD1iback to summary
protected static boolean processCertD1i(int index, List<E>[] policyNodes, ASN1ObjectIdentifier pOid, Set<E> pq)
processCertD1iiback to summary
protected static void processCertD1ii(int index, List<E>[] policyNodes, ASN1ObjectIdentifier _poid, Set<E> _pq)
removePolicyNodeback to summary
protected static PKIXPolicyNode removePolicyNode(PKIXPolicyNode validPolicyTree, List<E>[] policyNodes, PKIXPolicyNode _node)
removePolicyNodeRecurseback to summary
private static void removePolicyNodeRecurse(List<E>[] policyNodes, PKIXPolicyNode _node)
verifyX509Certificateback to summary
protected static void verifyX509Certificate(X509Certificate cert, PublicKey publicKey, String sigProvider) throws GeneralSecurityException