Bouncy Castle Provider 1.77 · org.bouncycastle.x509.ExtendedPKIXParameters

Modifier and Type	Field and Description
private boolean	additionalLocationsEnabled
private List<E>	additionalStores
private Set<E>	attrCertCheckers
public static final int	CHAIN_VALIDITY_MODEL This model uses the following validity model.
private Set<E>	necessaryACAttributes
public static final int	PKIX_VALIDITY_MODEL This is the default PKIX validity model.
private Set<E>	prohibitedACAttributes
private Selector<T>	selector
private List<E>	stores
private Set<E>	trustedACIssuers
private boolean	useDeltas
private int	validityModel

Access	Constructor and Description
public	ExtendedPKIXParameters(Set<E> a `Set` of `TrustAnchor`s trustAnchors) Creates an instance of `PKIXParameters` with the specified `Set` of most-trusted CAs.

Method Summary

Modifier and Type	Method and Description
public void	addAddionalStore(Store<T> store) Deprecated
public void	addAdditionalStore(Store<T> The store to add. store) Deprecated use addStore(). Adds an additional Bouncy Castle `Store` to find CRLs, certificates, attribute certificates or cross certificates.
public void	addStore(Store<T> The store to add. store) Adds a Bouncy Castle `Store` to find CRLs, certificates, attribute certificates or cross certificates.
public Object	clone() Overrides java.security.cert.PKIXParameters.clone. Implements java.security.cert.CertPathParameters.clone. Makes a copy of this `PKIXParameters` object.
public List<E>	Returns: an immutable `List` of additional Bouncy Castle `Store`s. Never `null`. getAdditionalStores() Returns an immutable `List` of additional Bouncy Castle `Store`s used for finding CRLs, certificates, attribute certificates or cross certificates.
public Set<E>	Returns: Returns the attribute certificate checker. Is never `null`. getAttrCertCheckers() Returns the attribute certificate checker.
public static ExtendedPKIXParameters	Returns: an extended PKIX params object getInstance(PKIXParameters The given `PKIXParameters` pkixParams) Deprecated as a consequence of `ExtendedPKIXParameters` being deprecated. Returns an instance with the parameters of a given `PKIXParameters` object.
public Set<E>	Returns: Returns the necessary AC attributes. getNecessaryACAttributes() Returns the neccessary attributes which must be contained in an attribute certificate.
public Set<E>	Returns: Returns the prohibited AC attributes. Is never `null`. getProhibitedACAttributes() Returns the attribute certificates which are not allowed.
public List<E>	Returns: an immutable `List` of Bouncy Castle `Store`s. Never `null`. getStores() Returns an immutable `List` of Bouncy Castle `Store`s used for finding CRLs, certificates, attribute certificates or cross certificates.
public Selector<T>	Returns: a `Selector` specifying the constraints on the target certificate or attribute certificate (or `null`) getTargetConstraints() Returns the required constraints on the target certificate or attribute certificate.
public Set<E>	Returns: Returns an immutable set of the trusted AC issuers. getTrustedACIssuers() Returns the trusted attribute certificate issuers.
public int	Returns: Returns the validity model. getValidityModel()
public boolean	Returns: Returns `true` if additional stores are used. isAdditionalLocationsEnabled() Returns if additional `X509Store`s for locations like LDAP found in certificates or CRLs should be used.
public boolean	Returns: Returns if delta CRLs should be used. isUseDeltasEnabled() Defaults to `false`.
public void	setAdditionalLocationsEnabled(boolean `true` if additional stores are used. enabled) Sets if additional `X509Store`s for locations like LDAP found in certificates or CRLs should be used.
public void	setAttrCertCheckers(Set<E> The attribute certificate checkers to set. Is never `null`. attrCertCheckers) Sets the attribute certificate checkers.
public void	setCertStores(List<E> a `List` of `CertStore`s (or `null`) stores) Overrides java.security.cert.PKIXParameters.setCertStores. Sets the Java CertStore to this extended PKIX parameters.
public void	setNecessaryACAttributes(Set<E> The necessary AC attributes to set. necessaryACAttributes) Sets the neccessary which must be contained in an attribute certificate.
protected void	setParams(PKIXParameters Parameters to set. If this are `ExtendedPKIXParameters` they are copied to. params) Method to support `clone()` under J2ME.
public void	setProhibitedACAttributes(Set<E> The prohibited AC attributes to set. prohibitedACAttributes) Sets the attribute certificates which are not allowed.
public void	setStores(List<E> A list of stores to use. stores) Sets the Bouncy Castle Stores for finding CRLs, certificates, attribute certificates or cross certificates.
public void	setTargetCertConstraints(CertSelector a `X509CertSelector` specifying the constraints on the target certificate (or `null`) selector) Overrides java.security.cert.PKIXParameters.setTargetCertConstraints. Sets the required constraints on the target certificate.
public void	setTargetConstraints(Selector<T> a `Selector` specifying the constraints on the target certificate or attribute certificate (or `null`) selector) Sets the required constraints on the target certificate or attribute certificate.
public void	setTrustedACIssuers(Set<E> The trusted AC issuers to set. Is never `null`. trustedACIssuers) Sets the trusted attribute certificate issuers.
public void	setUseDeltasEnabled(boolean `true` if delta CRLs should be used. useDeltas) Sets if delta CRLs should be used for checking the revocation status.
public void	setValidityModel(int The validity model to set. validityModel)

additionalLocationsEnabled	back to summary
private boolean additionalLocationsEnabled

additionalStores	back to summary
private List<E> additionalStores

attrCertCheckers	back to summary
private Set<E> attrCertCheckers

CHAIN_VALIDITY_MODEL	back to summary
public static final int CHAIN_VALIDITY_MODEL This model uses the following validity model. Each certificate must have been valid at the moment where is was used. That means the end certificate must have been valid at the time the signature was done. The CA certificate which signed the end certificate must have been valid, when the end certificate was signed. The CA (or Root CA) certificate must have been valid, when the CA certificate was signed and so on. So the `PKIXParameters#setDate(java.util.Date)` method sets the time, when the end certificate must have been valid. It is used e.g. in the German signature law.

necessaryACAttributes	back to summary
private Set<E> necessaryACAttributes

PKIX_VALIDITY_MODEL	back to summary
public static final int PKIX_VALIDITY_MODEL This is the default PKIX validity model. Actually there are two variants of this: The PKIX model and the modified PKIX model. The PKIX model verifies that all involved certificates must have been valid at the current time. The modified PKIX model verifies that all involved certificates were valid at the signing time. Both are indirectly choosen with the `PKIXParameters#setDate(java.util.Date)` method, so this methods sets the Date when all certificates must have been valid.

prohibitedACAttributes	back to summary
private Set<E> prohibitedACAttributes

selector	back to summary
private Selector<T> selector

stores	back to summary
private List<E> stores

trustedACIssuers	back to summary
private Set<E> trustedACIssuers

useDeltas	back to summary
private boolean useDeltas

validityModel	back to summary
private int validityModel

ExtendedPKIXParameters	back to summary
public ExtendedPKIXParameters(Set<E> trustAnchors) throws InvalidAlgorithmParameterException Creates an instance of `PKIXParameters` with the specified `Set` of most-trusted CAs. Each element of the set is a `TrustAnchor`. Note that the `Set` is copied to protect against subsequent modifications. Parameters trustAnchors:Set<E> a `Set` of `TrustAnchor`s Exceptions InvalidAlgorithmParameterException: if the specified `Set` is empty. NullPointerException: if the specified `Set` is `null` ClassCastException: if any of the elements in the `Set` is not of type `java.security.cert.TrustAnchor`

Method Detail

addAddionalStore	back to summary
public void addAddionalStore(Store<T> store) Deprecated

addAdditionalStore back to summary

addAdditionalStore	back to summary
public void addAdditionalStore(Store<T> store) Deprecated use addStore(). Adds an additional Bouncy Castle `Store` to find CRLs, certificates, attribute certificates or cross certificates. You should not use this method. This method is used for adding additional X.509 stores, which are used to add (remote) locations, e.g. LDAP, found during X.509 object processing, e.g. in certificates or CRLs. This method is used in PKIX certification path processing. If `store` is `null` it is ignored. Parameters store:Store<T> The store to add. See Also `getStores()`

public void addAdditionalStore(Store<T> store)

Deprecated

use addStore().

Adds an additional Bouncy Castle Store to find CRLs, certificates, attribute certificates or cross certificates.

You should not use this method. This method is used for adding additional X.509 stores, which are used to add (remote) locations, e.g. LDAP, found during X.509 object processing, e.g. in certificates or CRLs. This method is used in PKIX certification path processing.

If store is null it is ignored.

Parameters

store:Store<T>: The store to add.

See Also

getStores()

addStore back to summary

addStore	back to summary
public void addStore(Store<T> store) Adds a Bouncy Castle `Store` to find CRLs, certificates, attribute certificates or cross certificates. This method should be used to add local stores, like collection based X.509 stores, if available. Local stores should be considered first, before trying to use additional (remote) locations, because they do not need possible additional network traffic. If `store` is `null` it is ignored. Parameters store:Store<T> The store to add. See Also `getStores`

public void addStore(Store<T> store)

Adds a Bouncy Castle Store to find CRLs, certificates, attribute certificates or cross certificates.

This method should be used to add local stores, like collection based X.509 stores, if available. Local stores should be considered first, before trying to use additional (remote) locations, because they do not need possible additional network traffic.

If store is null it is ignored.

Parameters

store:Store<T>: The store to add.

See Also

getStores

clone back to summary

clone	back to summary
public Object clone() Overrides java.security.cert.PKIXParameters.clone. Implements java.security.cert.CertPathParameters.clone. Doc from java.security.cert.PKIXParameters.clone. Makes a copy of this `PKIXParameters` object. Changes to the copy will not affect the original and vice versa. Returns:Object a copy of this `PKIXParameters` object

public Object clone()

Overrides java.security.cert.PKIXParameters.clone.

Implements java.security.cert.CertPathParameters.clone.

Doc from java.security.cert.PKIXParameters.clone.

Makes a copy of this PKIXParameters object. Changes to the copy will not affect the original and vice versa.

Returns:Object: a copy of this PKIXParameters object

getAdditionalStores back to summary

getAdditionalStores	back to summary
public List<E> getAdditionalStores() Returns an immutable `List` of additional Bouncy Castle `Store`s used for finding CRLs, certificates, attribute certificates or cross certificates. Returns:List<E> an immutable `List` of additional Bouncy Castle `Store`s. Never `null`. See Also `addAdditionalStore(Store)`

public List<E> getAdditionalStores()

Returns an immutable List of additional Bouncy Castle Stores used for finding CRLs, certificates, attribute certificates or cross certificates.

Returns:List<E>: an immutable List of additional Bouncy Castle Stores. Never null.
See Also: addAdditionalStore(Store)

getAttrCertCheckers back to summary

getAttrCertCheckers	back to summary
public Set<E> getAttrCertCheckers() Returns the attribute certificate checker. The returned set contains `PKIXAttrCertChecker`s and is immutable. Returns:Set<E> Returns the attribute certificate checker. Is never `null`.

public Set<E> getAttrCertCheckers()

Returns the attribute certificate checker. The returned set contains PKIXAttrCertCheckers and is immutable.

Returns:Set<E>: Returns the attribute certificate checker. Is never null.

getInstance back to summary

getInstance	back to summary
public static ExtendedPKIXParameters getInstance(PKIXParameters pkixParams) Deprecated as a consequence of `ExtendedPKIXParameters` being deprecated. See corresponding docs for further information. Returns an instance with the parameters of a given `PKIXParameters` object. Parameters pkixParams:PKIXParameters The given `PKIXParameters` Returns:ExtendedPKIXParameters an extended PKIX params object

public static ExtendedPKIXParameters getInstance(PKIXParameters pkixParams)

Deprecated

as a consequence of ExtendedPKIXParameters being deprecated. See corresponding docs for further information.

Returns an instance with the parameters of a given PKIXParameters object.

Parameters

pkixParams:PKIXParameters: The given PKIXParameters

Returns:ExtendedPKIXParameters

an extended PKIX params object

getNecessaryACAttributes back to summary

getNecessaryACAttributes	back to summary
public Set<E> getNecessaryACAttributes() Returns the neccessary attributes which must be contained in an attribute certificate. The returned `Set` is immutable and contains `String`s with the OIDs. Returns:Set<E> Returns the necessary AC attributes.

public Set<E> getNecessaryACAttributes()

Returns the neccessary attributes which must be contained in an attribute certificate.

The returned Set is immutable and contains Strings with the OIDs.

Returns:Set<E>: Returns the necessary AC attributes.

getProhibitedACAttributes back to summary

getProhibitedACAttributes	back to summary
public Set<E> getProhibitedACAttributes() Returns the attribute certificates which are not allowed. The returned `Set` is immutable and contains `String`s with the OIDs. Returns:Set<E> Returns the prohibited AC attributes. Is never `null`.

public Set<E> getProhibitedACAttributes()

Returns the attribute certificates which are not allowed.

The returned Set is immutable and contains Strings with the OIDs.

Returns:Set<E>: Returns the prohibited AC attributes. Is never null.

getStores back to summary

getStores	back to summary
public List<E> getStores() Returns an immutable `List` of Bouncy Castle `Store`s used for finding CRLs, certificates, attribute certificates or cross certificates. Returns:List<E> an immutable `List` of Bouncy Castle `Store`s. Never `null`. See Also `setStores(List)`

public List<E> getStores()

Returns an immutable List of Bouncy Castle Stores used for finding CRLs, certificates, attribute certificates or cross certificates.

Returns:List<E>: an immutable List of Bouncy Castle Stores. Never null.
See Also: setStores(List)

getTargetConstraints back to summary

getTargetConstraints	back to summary
public Selector<T> getTargetConstraints() Returns the required constraints on the target certificate or attribute certificate. The constraints are returned as an instance of `Selector`. If `null`, no constraints are defined. The target certificate in a PKIX path may be a certificate or an attribute certificate. Note that the `Selector` returned is cloned to protect against subsequent modifications. Returns:Selector<T> a `Selector` specifying the constraints on the target certificate or attribute certificate (or `null`) See Also `setTargetConstraints`, `X509CertStoreSelector`, `X509AttributeCertStoreSelector`

public Selector<T> getTargetConstraints()

Returns the required constraints on the target certificate or attribute certificate. The constraints are returned as an instance of Selector. If null, no constraints are defined.

The target certificate in a PKIX path may be a certificate or an attribute certificate.

Note that the Selector returned is cloned to protect against subsequent modifications.

Returns:Selector<T>: a Selector specifying the constraints on the target certificate or attribute certificate (or null)
See Also: setTargetConstraints, X509CertStoreSelector, X509AttributeCertStoreSelector

getTrustedACIssuers back to summary

getTrustedACIssuers	back to summary
public Set<E> getTrustedACIssuers() Returns the trusted attribute certificate issuers. If attribute certificates is verified the trusted AC issuers must be set. The returned `Set` consists of `TrustAnchor`s. The returned `Set` is immutable. Never `null` Returns:Set<E> Returns an immutable set of the trusted AC issuers.

public Set<E> getTrustedACIssuers()

Returns the trusted attribute certificate issuers. If attribute certificates is verified the trusted AC issuers must be set.

The returned Set consists of TrustAnchors.

The returned Set is immutable. Never null

Returns:Set<E>: Returns an immutable set of the trusted AC issuers.

getValidityModel	back to summary
public int getValidityModel() Returns:int Returns the validity model. See Also `CHAIN_VALIDITY_MODEL`, `PKIX_VALIDITY_MODEL`

isAdditionalLocationsEnabled back to summary

isAdditionalLocationsEnabled	back to summary
public boolean isAdditionalLocationsEnabled() Returns if additional `X509Store`s for locations like LDAP found in certificates or CRLs should be used. Returns:boolean Returns `true` if additional stores are used.

public boolean isAdditionalLocationsEnabled()

Returns if additional X509Stores for locations like LDAP found in certificates or CRLs should be used.

Returns:boolean: Returns true if additional stores are used.

isUseDeltasEnabled back to summary

isUseDeltasEnabled	back to summary
public boolean isUseDeltasEnabled() Defaults to `false`. Returns:boolean Returns if delta CRLs should be used.

public boolean isUseDeltasEnabled()

Defaults to false.

Returns:boolean: Returns if delta CRLs should be used.

setAdditionalLocationsEnabled back to summary

setAdditionalLocationsEnabled	back to summary
public void setAdditionalLocationsEnabled(boolean enabled) Sets if additional `X509Store`s for locations like LDAP found in certificates or CRLs should be used. Parameters enabled:boolean `true` if additional stores are used.

public void setAdditionalLocationsEnabled(boolean enabled)

Sets if additional X509Stores for locations like LDAP found in certificates or CRLs should be used.

Parameters

enabled:boolean: true if additional stores are used.

setAttrCertCheckers back to summary

setAttrCertCheckers	back to summary
public void setAttrCertCheckers(Set<E> attrCertCheckers) Sets the attribute certificate checkers. All elements in the `Set` must a `PKIXAttrCertChecker`. The given set is cloned. Parameters attrCertCheckers:Set<E> The attribute certificate checkers to set. Is never `null`. Exceptions ClassCastException: if an element of `attrCertCheckers` is not a `PKIXAttrCertChecker`.

public void setAttrCertCheckers(Set<E> attrCertCheckers)

Sets the attribute certificate checkers.

All elements in the Set must a PKIXAttrCertChecker.

The given set is cloned.

Parameters

attrCertCheckers:Set<E>: The attribute certificate checkers to set. Is never null.

Exceptions

ClassCastException:: if an element of attrCertCheckers is not a PKIXAttrCertChecker.

setCertStores back to summary

setCertStores	back to summary
public void setCertStores(List<E> stores) Overrides java.security.cert.PKIXParameters.setCertStores. Sets the Java CertStore to this extended PKIX parameters. Parameters stores:List<E> Doc from java.security.cert.PKIXParameters.setCertStores. a `List` of `CertStore`s (or `null`) Exceptions ClassCastException: if an element of `stores` is not a `CertStore`.

public void setCertStores(List<E> stores)

Overrides java.security.cert.PKIXParameters.setCertStores.

Sets the Java CertStore to this extended PKIX parameters.

Parameters

stores:List<E>

Doc from java.security.cert.PKIXParameters.setCertStores.

a List of CertStores (or null)

Exceptions

ClassCastException:: if an element of stores is not a CertStore.

setNecessaryACAttributes back to summary

setNecessaryACAttributes	back to summary
public void setNecessaryACAttributes(Set<E> necessaryACAttributes) Sets the neccessary which must be contained in an attribute certificate. The `Set` must contain `String`s with the OIDs. The set is cloned. Parameters necessaryACAttributes:Set<E> The necessary AC attributes to set. Exceptions ClassCastException: if an element of `necessaryACAttributes` is not a `String`.

public void setNecessaryACAttributes(Set<E> necessaryACAttributes)

Sets the neccessary which must be contained in an attribute certificate.

The Set must contain Strings with the OIDs.

The set is cloned.

Parameters

necessaryACAttributes:Set<E>: The necessary AC attributes to set.

Exceptions

ClassCastException:: if an element of necessaryACAttributes is not a String.

setParams back to summary

setParams	back to summary
protected void setParams(PKIXParameters params) Method to support `clone()` under J2ME. `super.clone()` does not exist and fields are not copied. Parameters params:PKIXParameters Parameters to set. If this are `ExtendedPKIXParameters` they are copied to.

protected void setParams(PKIXParameters params)

Method to support clone() under J2ME. super.clone() does not exist and fields are not copied.

Parameters

params:PKIXParameters: Parameters to set. If this are ExtendedPKIXParameters they are copied to.

setProhibitedACAttributes back to summary

setProhibitedACAttributes	back to summary
public void setProhibitedACAttributes(Set<E> prohibitedACAttributes) Sets the attribute certificates which are not allowed. The `Set` must contain `String`s with the OIDs. The set is cloned. Parameters prohibitedACAttributes:Set<E> The prohibited AC attributes to set. Exceptions ClassCastException: if an element of `prohibitedACAttributes` is not a `String`.

public void setProhibitedACAttributes(Set<E> prohibitedACAttributes)

Sets the attribute certificates which are not allowed.

The Set must contain Strings with the OIDs.

The set is cloned.

Parameters

prohibitedACAttributes:Set<E>: The prohibited AC attributes to set.

Exceptions

ClassCastException:: if an element of prohibitedACAttributes is not a String.

setStores back to summary

setStores	back to summary
public void setStores(List<E> stores) Sets the Bouncy Castle Stores for finding CRLs, certificates, attribute certificates or cross certificates. The `List` is cloned. Parameters stores:List<E> A list of stores to use. Exceptions ClassCastException: if an element of `stores` is not a `Store`. See Also `getStores`

public void setStores(List<E> stores)

Sets the Bouncy Castle Stores for finding CRLs, certificates, attribute certificates or cross certificates.

The List is cloned.

Parameters

stores:List<E>: A list of stores to use.

Exceptions

ClassCastException:: if an element of stores is not a Store.

See Also

getStores

setTargetCertConstraints back to summary

setTargetCertConstraints	back to summary
public void setTargetCertConstraints(CertSelector selector) Overrides java.security.cert.PKIXParameters.setTargetCertConstraints. Sets the required constraints on the target certificate. The constraints are specified as an instance of `X509CertSelector`. If `null`, no constraints are defined. This method wraps the given `X509CertSelector` into a `X509CertStoreSelector`. Note that the `X509CertSelector` specified is cloned to protect against subsequent modifications. Parameters selector:CertSelector a `X509CertSelector` specifying the constraints on the target certificate (or `null`) See Also `getTargetCertConstraints`, `X509CertStoreSelector`

public void setTargetCertConstraints(CertSelector selector)

Overrides java.security.cert.PKIXParameters.setTargetCertConstraints.

Sets the required constraints on the target certificate. The constraints are specified as an instance of X509CertSelector. If null, no constraints are defined.

This method wraps the given X509CertSelector into a X509CertStoreSelector.

Note that the X509CertSelector specified is cloned to protect against subsequent modifications.

Parameters

selector:CertSelector: a X509CertSelector specifying the constraints on the target certificate (or null)

setTargetConstraints back to summary

setTargetConstraints	back to summary
public void setTargetConstraints(Selector<T> selector) Sets the required constraints on the target certificate or attribute certificate. The constraints are specified as an instance of `Selector`. If `null`, no constraints are defined. The target certificate in a PKIX path may be a certificate or an attribute certificate. Note that the `Selector` specified is cloned to protect against subsequent modifications. Parameters selector:Selector<T> a `Selector` specifying the constraints on the target certificate or attribute certificate (or `null`) See Also `getTargetConstraints`, `X509CertStoreSelector`, `X509AttributeCertStoreSelector`

public void setTargetConstraints(Selector<T> selector)

Sets the required constraints on the target certificate or attribute certificate. The constraints are specified as an instance of Selector. If null, no constraints are defined.

The target certificate in a PKIX path may be a certificate or an attribute certificate.

Note that the Selector specified is cloned to protect against subsequent modifications.

Parameters

selector:Selector<T>: a Selector specifying the constraints on the target certificate or attribute certificate (or null)

setTrustedACIssuers back to summary

setTrustedACIssuers	back to summary
public void setTrustedACIssuers(Set<E> trustedACIssuers) Sets the trusted attribute certificate issuers. If attribute certificates is verified the trusted AC issuers must be set. The `trustedACIssuers` must be a `Set` of `TrustAnchor` The given set is cloned. Parameters trustedACIssuers:Set<E> The trusted AC issuers to set. Is never `null`. Exceptions ClassCastException: if an element of `stores` is not a `TrustAnchor`.

public void setTrustedACIssuers(Set<E> trustedACIssuers)

Sets the trusted attribute certificate issuers. If attribute certificates is verified the trusted AC issuers must be set.

The trustedACIssuers must be a Set of TrustAnchor

The given set is cloned.

Parameters

trustedACIssuers:Set<E>: The trusted AC issuers to set. Is never null.

Exceptions

ClassCastException:: if an element of stores is not a TrustAnchor.

setUseDeltasEnabled back to summary

setUseDeltasEnabled	back to summary
public void setUseDeltasEnabled(boolean useDeltas) Sets if delta CRLs should be used for checking the revocation status. Parameters useDeltas:boolean `true` if delta CRLs should be used.

public void setUseDeltasEnabled(boolean useDeltas)

Sets if delta CRLs should be used for checking the revocation status.

Parameters

useDeltas:boolean: true if delta CRLs should be used.

setValidityModel	back to summary
public void setValidityModel(int validityModel) Parameters validityModel:int The validity model to set. See Also `CHAIN_VALIDITY_MODEL`, `PKIX_VALIDITY_MODEL`

public Class ExtendedPKIXParameters

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail