Top Description Fields Constructors Methods
org.eclipse.jetty.util.security

public Class CertificateValidator

extends Object
Class Inheritance
Imports
java.security.GeneralSecurityException, .InvalidParameterException, .KeyStore, .KeyStoreException, .Security, java.security.cert.CRL, .CertPathBuilder, .CertPathBuilderResult, .CertPathValidator, .CertStore, .Certificate, .CertificateException, .CollectionCertStoreParameters, .PKIXBuilderParameters, .X509CertSelector, .X509Certificate, java.util.ArrayList, .Collection, .Enumeration, java.util.concurrent.atomic.AtomicLong, org.slf4j.Logger, .LoggerFactory
Convenience class to handle validation of certificates, aliases and keystores Allows specifying Certificate Revocation List (CRL), as well as enabling CRL Distribution Points Protocol (CRLDP) certificate extension support, and also enabling On-Line Certificate Status Protocol (OCSP) support.

Important Note

at least one of the above mechanisms *MUST* be configured and operational, otherwise certificate validation *WILL FAIL* unconditionally.

Field Summary

Modifier and TypeField and Description
private static AtomicLong
__aliasCount

private Collection<? extends CRL>
_crls

private boolean
_enableCRLDP

CRL Distribution Points (CRLDP) support

private boolean
_enableOCSP

On-Line Certificate Status Protocol (OCSP) support

private int
_maxCertPathLength

Maximum certification path length (n - number of intermediate certs, -1 for unlimited)

private String
_ocspResponderURL

Location of OCSP Responder

private KeyStore
_trustStore

private static final Logger
LOG

Constructor Summary

AccessConstructor and Description
public
CertificateValidator(KeyStore
the truststore to use
trustStore, Collection<? extends CRL>
the Certificate Revocation List to use
crls)

creates an instance of the certificate validator

Method Summary

Modifier and TypeMethod and Description
public Collection<? extends CRL>
getCrls()

public int

Returns:

Maximum number of intermediate certificates in the certification path (-1 for unlimited)
getMaxCertPathLength()

public String

Returns:

Location of the OCSP Responder
getOcspResponderURL()

public KeyStore
getTrustStore()

public boolean

Returns:

true if CRL Distribution Points support is enabled
isEnableCRLDP()

public boolean

Returns:

true if On-Line Certificate Status Protocol support is enabled
isEnableOCSP()

public void
setEnableCRLDP(boolean
true - turn on, false - turns off
enableCRLDP)

Enables CRL Distribution Points Support

public void
setEnableOCSP(boolean
true - turn on, false - turn off
enableOCSP)

Enables On-Line Certificate Status Protocol support

public void
setMaxCertPathLength(int
maximum number of intermediate certificates in the certification path (-1 for unlimited)
maxCertPathLength)

public void
setOcspResponderURL(String
location of the OCSP Responder
ocspResponderURL)

Set the location of the OCSP Responder.

public void
validate(KeyStore
the keystore to validate
keyStore)

validates all aliases inside of a given keystore

public String

Returns:

the keyAlias if valid
validate(KeyStore
the keystore to validate
keyStore, String
the keyalias in the keystore to valid with
keyAlias)

validates a specific alias inside of the keystore being passed in

public void
validate(KeyStore
the keystore to validate against
keyStore, Certificate
the certificate to validate
cert)

validates a specific certificate inside of the keystore being passed in

public void
validate(Certificate[] certChain)

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

__aliasCountback to summary
private static AtomicLong __aliasCount
_crlsback to summary
private Collection<? extends CRL> _crls
_enableCRLDPback to summary
private boolean _enableCRLDP

CRL Distribution Points (CRLDP) support

_enableOCSPback to summary
private boolean _enableOCSP

On-Line Certificate Status Protocol (OCSP) support

_maxCertPathLengthback to summary
private int _maxCertPathLength

Maximum certification path length (n - number of intermediate certs, -1 for unlimited)

_ocspResponderURLback to summary
private String _ocspResponderURL

Location of OCSP Responder

_trustStoreback to summary
private KeyStore _trustStore
LOGback to summary
private static final Logger LOG

Constructor Detail

CertificateValidatorback to summary
public CertificateValidator(KeyStore trustStore, Collection<? extends CRL> crls)

creates an instance of the certificate validator

Parameters
trustStore:KeyStore

the truststore to use

crls:Collection<? extends CRL>

the Certificate Revocation List to use

Method Detail

getCrlsback to summary
public Collection<? extends CRL> getCrls()
getMaxCertPathLengthback to summary
public int getMaxCertPathLength()
Returns:int

Maximum number of intermediate certificates in the certification path (-1 for unlimited)

getOcspResponderURLback to summary
public String getOcspResponderURL()
Returns:String

Location of the OCSP Responder

getTrustStoreback to summary
public KeyStore getTrustStore()
isEnableCRLDPback to summary
public boolean isEnableCRLDP()
Returns:boolean

true if CRL Distribution Points support is enabled

isEnableOCSPback to summary
public boolean isEnableOCSP()
Returns:boolean

true if On-Line Certificate Status Protocol support is enabled

setEnableCRLDPback to summary
public void setEnableCRLDP(boolean enableCRLDP)

Enables CRL Distribution Points Support

Parameters
enableCRLDP:boolean

true - turn on, false - turns off

setEnableOCSPback to summary
public void setEnableOCSP(boolean enableOCSP)

Enables On-Line Certificate Status Protocol support

Parameters
enableOCSP:boolean

true - turn on, false - turn off

setMaxCertPathLengthback to summary
public void setMaxCertPathLength(int maxCertPathLength)
Parameters
maxCertPathLength:int

maximum number of intermediate certificates in the certification path (-1 for unlimited)

setOcspResponderURLback to summary
public void setOcspResponderURL(String ocspResponderURL)

Set the location of the OCSP Responder.

Parameters
ocspResponderURL:String

location of the OCSP Responder

validateback to summary
public void validate(KeyStore keyStore) throws CertificateException

validates all aliases inside of a given keystore

Parameters
keyStore:KeyStore

the keystore to validate

Exceptions
CertificateException:
if keystore error and unable to validate
validateback to summary
public String validate(KeyStore keyStore, String keyAlias) throws CertificateException

validates a specific alias inside of the keystore being passed in

Parameters
keyStore:KeyStore

the keystore to validate

keyAlias:String

the keyalias in the keystore to valid with

Returns:String

the keyAlias if valid

Exceptions
CertificateException:
if keystore error and unable to validate
validateback to summary
public void validate(KeyStore keyStore, Certificate cert) throws CertificateException

validates a specific certificate inside of the keystore being passed in

Parameters
keyStore:KeyStore

the keystore to validate against

cert:Certificate

the certificate to validate

Exceptions
CertificateException:
if keystore error and unable to validate
validateback to summary
public void validate(Certificate[] certChain) throws CertificateException