Java Code Examples for java.security.cert.TrustAnchor#getTrustedCert()

/**
 * Create a new <code>AlgorithmChecker</code> with the
 * given <code>TrustAnchor</code> and <code>AlgorithmConstraints</code>.
 *
 * @param anchor the trust anchor selected to validate the target
 *     certificate
 * @param constraints the algorithm constraints (or null)
 *
 * @throws IllegalArgumentException if the <code>anchor</code> is null
 */
public AlgorithmChecker(TrustAnchor anchor,
        AlgorithmConstraints constraints) {

    if (anchor == null) {
        throw new IllegalArgumentException(
                    "The trust anchor cannot be null");
    }

    if (anchor.getTrustedCert() != null) {
        this.trustedPubKey = anchor.getTrustedCert().getPublicKey();
    } else {
        this.trustedPubKey = anchor.getCAPublicKey();
    }

    this.prevPubKey = trustedPubKey;
    this.constraints = constraints;
}
 

/**
 * Try to set the trust anchor of the checker.
 * <p>
 * If there is no trust anchor specified and the checker has not started,
 * set the trust anchor.
 *
 * @param anchor the trust anchor selected to validate the target
 *     certificate
 */
void trySetTrustAnchor(TrustAnchor anchor) {
    // Don't bother if the check has started or trust anchor has already
    // specified.
    if (prevPubKey == null) {
        if (anchor == null) {
            throw new IllegalArgumentException(
                    "The trust anchor cannot be null");
        }

        // Don't bother to change the trustedPubKey.
        if (anchor.getTrustedCert() != null) {
            prevPubKey = anchor.getTrustedCert().getPublicKey();
        } else {
            prevPubKey = anchor.getCAPublicKey();
        }
    }
}
 

/**
 * Try to set the trust anchor of the checker.
 * <p>
 * If there is no trust anchor specified and the checker has not started,
 * set the trust anchor.
 *
 * @param anchor the trust anchor selected to validate the target
 *     certificate
 */
void trySetTrustAnchor(TrustAnchor anchor) {
    // Don't bother if the check has started or trust anchor has already
    // specified.
    if (prevPubKey == null) {
        if (anchor == null) {
            throw new IllegalArgumentException(
                    "The trust anchor cannot be null");
        }

        // Don't bother to change the trustedPubKey.
        if (anchor.getTrustedCert() != null) {
            prevPubKey = anchor.getTrustedCert().getPublicKey();
            // Check for anchor certificate restrictions
            trustedMatch = checkFingerprint(anchor.getTrustedCert());
            if (trustedMatch && debug != null) {
                debug.println("trustedMatch = true");
            }
        } else {
            prevPubKey = anchor.getCAPublicKey();
        }
    }
}
 

/**
 * Try to set the trust anchor of the checker.
 * <p>
 * If there is no trust anchor specified and the checker has not started,
 * set the trust anchor.
 *
 * @param anchor the trust anchor selected to validate the target
 *     certificate
 */
void trySetTrustAnchor(TrustAnchor anchor) {
    // Don't bother if the check has started or trust anchor has already
    // specified.
    if (prevPubKey == null) {
        if (anchor == null) {
            throw new IllegalArgumentException(
                    "The trust anchor cannot be null");
        }

        // Don't bother to change the trustedPubKey.
        if (anchor.getTrustedCert() != null) {
            prevPubKey = anchor.getTrustedCert().getPublicKey();
            // Check for anchor certificate restrictions
            trustedMatch = checkFingerprint(anchor.getTrustedCert());
            if (trustedMatch && debug != null) {
                debug.println("trustedMatch = true");
            }
        } else {
            prevPubKey = anchor.getCAPublicKey();
        }
    }
}
 

/**
 * Initialize the builder with the input parameters.
 *
 * @param params the parameter set used to build a certification path
 */
ForwardBuilder(BuilderParams buildParams, boolean searchAllCertStores) {
    super(buildParams);

    // populate sets of trusted certificates and subject DNs
    trustAnchors = buildParams.trustAnchors();
    trustedCerts = new HashSet<X509Certificate>(trustAnchors.size());
    trustedSubjectDNs = new HashSet<X500Principal>(trustAnchors.size());
    for (TrustAnchor anchor : trustAnchors) {
        X509Certificate trustedCert = anchor.getTrustedCert();
        if (trustedCert != null) {
            trustedCerts.add(trustedCert);
            trustedSubjectDNs.add(trustedCert.getSubjectX500Principal());
        } else {
            trustedSubjectDNs.add(anchor.getCA());
        }
    }
    comparator = new PKIXCertComparator(trustedSubjectDNs);
    this.searchAllCertStores = searchAllCertStores;
}
 

IssuerInfo(TrustAnchor anchor, X509Certificate issuerCert) {
    if (anchor == null && issuerCert == null) {
        throw new NullPointerException("TrustAnchor and issuerCert " +
                "cannot be null");
    }
    this.anchor = anchor;
    if (issuerCert != null) {
        name = issuerCert.getSubjectX500Principal();
        pubKey = issuerCert.getPublicKey();
        certificate = issuerCert;
    } else {
        name = anchor.getCA();
        pubKey = anchor.getCAPublicKey();
        certificate = anchor.getTrustedCert();
    }
}
 

/**
 * Initialize the builder with the input parameters.
 *
 * @param params the parameter set used to build a certification path
 */
ForwardBuilder(BuilderParams buildParams, boolean searchAllCertStores) {
    super(buildParams);

    // populate sets of trusted certificates and subject DNs
    trustAnchors = buildParams.trustAnchors();
    trustedCerts = new HashSet<X509Certificate>(trustAnchors.size());
    trustedSubjectDNs = new HashSet<X500Principal>(trustAnchors.size());
    for (TrustAnchor anchor : trustAnchors) {
        X509Certificate trustedCert = anchor.getTrustedCert();
        if (trustedCert != null) {
            trustedCerts.add(trustedCert);
            trustedSubjectDNs.add(trustedCert.getSubjectX500Principal());
        } else {
            trustedSubjectDNs.add(anchor.getCA());
        }
    }
    this.searchAllCertStores = searchAllCertStores;
}
 

/**
 * Try to set the trust anchor of the checker.
 * <p>
 * If there is no trust anchor specified and the checker has not started,
 * set the trust anchor.
 *
 * @param anchor the trust anchor selected to validate the target
 *     certificate
 */
void trySetTrustAnchor(TrustAnchor anchor) {
    // Don't bother if the check has started or trust anchor has already
    // specified.
    if (prevPubKey == null) {
        if (anchor == null) {
            throw new IllegalArgumentException(
                    "The trust anchor cannot be null");
        }

        // Don't bother to change the trustedPubKey.
        if (anchor.getTrustedCert() != null) {
            prevPubKey = anchor.getTrustedCert().getPublicKey();
        } else {
            prevPubKey = anchor.getCAPublicKey();
        }
    }
}
 

/**
 * Create a new <code>AlgorithmChecker</code> with the
 * given <code>TrustAnchor</code> and <code>AlgorithmConstraints</code>.
 *
 * @param anchor the trust anchor selected to validate the target
 *     certificate
 * @param constraints the algorithm constraints (or null)
 *
 * @throws IllegalArgumentException if the <code>anchor</code> is null
 */
public AlgorithmChecker(TrustAnchor anchor,
        AlgorithmConstraints constraints) {

    if (anchor == null) {
        throw new IllegalArgumentException(
                    "The trust anchor cannot be null");
    }

    if (anchor.getTrustedCert() != null) {
        this.trustedPubKey = anchor.getTrustedCert().getPublicKey();
    } else {
        this.trustedPubKey = anchor.getCAPublicKey();
    }

    this.prevPubKey = trustedPubKey;
    this.constraints = constraints;
}
 

/**
 * Initialize the builder with the input parameters.
 *
 * @param params the parameter set used to build a certification path
 */
ForwardBuilder(BuilderParams buildParams, boolean searchAllCertStores) {
    super(buildParams);

    // populate sets of trusted certificates and subject DNs
    trustAnchors = buildParams.trustAnchors();
    trustedCerts = new HashSet<X509Certificate>(trustAnchors.size());
    trustedSubjectDNs = new HashSet<X500Principal>(trustAnchors.size());
    for (TrustAnchor anchor : trustAnchors) {
        X509Certificate trustedCert = anchor.getTrustedCert();
        if (trustedCert != null) {
            trustedCerts.add(trustedCert);
            trustedSubjectDNs.add(trustedCert.getSubjectX500Principal());
        } else {
            trustedSubjectDNs.add(anchor.getCA());
        }
    }
    this.searchAllCertStores = searchAllCertStores;
}
 

/**
 * Initialize the builder with the input parameters.
 *
 * @param params the parameter set used to build a certification path
 */
ForwardBuilder(BuilderParams buildParams, boolean searchAllCertStores) {
    super(buildParams);

    // populate sets of trusted certificates and subject DNs
    trustAnchors = buildParams.trustAnchors();
    trustedCerts = new HashSet<X509Certificate>(trustAnchors.size());
    trustedSubjectDNs = new HashSet<X500Principal>(trustAnchors.size());
    for (TrustAnchor anchor : trustAnchors) {
        X509Certificate trustedCert = anchor.getTrustedCert();
        if (trustedCert != null) {
            trustedCerts.add(trustedCert);
            trustedSubjectDNs.add(trustedCert.getSubjectX500Principal());
        } else {
            trustedSubjectDNs.add(anchor.getCA());
        }
    }
    this.searchAllCertStores = searchAllCertStores;
}
 

public Set<TrustAnchor> findAllByIssuerAndSignature(X509Certificate cert) {
    X500Principal issuer = cert.getIssuerX500Principal();
    synchronized (subjectToTrustAnchors) {
        List<TrustAnchor> anchors = subjectToTrustAnchors.get(issuer);
        if (anchors == null) {
            return Collections.<TrustAnchor>emptySet();
        }

        Set<TrustAnchor> result = new HashSet<TrustAnchor>();
        for (TrustAnchor anchor : anchors) {
            try {
                PublicKey publicKey;
                X509Certificate caCert = anchor.getTrustedCert();
                if (caCert != null) {
                    publicKey = caCert.getPublicKey();
                } else {
                    publicKey = anchor.getCAPublicKey();
                }
                if (publicKey == null) {
                    continue;
                }
                cert.verify(publicKey);
                result.add(anchor);
            } catch (Exception ignored) {
            }
        }
        return result;
    }
}
 

/**
 * Constructor that initializes the input parameters.
 *
 * @param anchor the anchor selected to validate the target certificate
 * @param testDate the time for which the validity of the certificate
 *        should be determined
 * @param sigProvider the name of the signature provider
 * @param sigOnly true if only signature checking is to be done;
 *        if false, all checks are done
 */
BasicChecker(TrustAnchor anchor, Date date, String sigProvider,
             boolean sigOnly) {
    if (anchor.getTrustedCert() != null) {
        this.trustedPubKey = anchor.getTrustedCert().getPublicKey();
        this.caName = anchor.getTrustedCert().getSubjectX500Principal();
    } else {
        this.trustedPubKey = anchor.getCAPublicKey();
        this.caName = anchor.getCA();
    }
    this.date = date;
    this.sigProvider = sigProvider;
    this.sigOnly = sigOnly;
    this.prevPubKey = trustedPubKey;
}
 

/**
 * Constructor that initializes the input parameters.
 *
 * @param anchor the anchor selected to validate the target certificate
 * @param testDate the time for which the validity of the certificate
 *        should be determined
 * @param sigProvider the name of the signature provider
 * @param sigOnly true if only signature checking is to be done;
 *        if false, all checks are done
 */
BasicChecker(TrustAnchor anchor, Date date, String sigProvider,
             boolean sigOnly) {
    if (anchor.getTrustedCert() != null) {
        this.trustedPubKey = anchor.getTrustedCert().getPublicKey();
        this.caName = anchor.getTrustedCert().getSubjectX500Principal();
    } else {
        this.trustedPubKey = anchor.getCAPublicKey();
        this.caName = anchor.getCA();
    }
    this.date = date;
    this.sigProvider = sigProvider;
    this.sigOnly = sigOnly;
    this.prevPubKey = trustedPubKey;
}
 

/**
 * Create a new {@code AlgorithmChecker} with the
 * given {@code TrustAnchor}, {@code AlgorithmConstraints},
 * {@code Timestamp}, and {@code String} variant.
 *
 * @param anchor the trust anchor selected to validate the target
 *     certificate
 * @param constraints the algorithm constraints (or null)
 * @param pkixdate The date specified by the PKIXParameters date.  If the
 *                 PKIXParameters is null, the current date is used.  This
 *                 should be null when jar files are being checked.
 * @param jarTimestamp Timestamp passed for JAR timestamp constraint
 *                     checking. Set to null if not applicable.
 * @param variant is the Validator variants of the operation. A null value
 *                passed will set it to Validator.GENERIC.
 */
public AlgorithmChecker(TrustAnchor anchor,
        AlgorithmConstraints constraints, Date pkixdate,
        Timestamp jarTimestamp, String variant) {

    if (anchor != null) {
        if (anchor.getTrustedCert() != null) {
            this.trustedPubKey = anchor.getTrustedCert().getPublicKey();
            // Check for anchor certificate restrictions
            trustedMatch = checkFingerprint(anchor.getTrustedCert());
            if (trustedMatch && debug != null) {
                debug.println("trustedMatch = true");
            }
        } else {
            this.trustedPubKey = anchor.getCAPublicKey();
        }
    } else {
        this.trustedPubKey = null;
        if (debug != null) {
            debug.println("TrustAnchor is null, trustedMatch is false.");
        }
    }

    this.prevPubKey = this.trustedPubKey;
    this.constraints = (constraints == null ? certPathDefaultConstraints :
            constraints);
    // If we are checking jar files, set pkixdate the same as the timestamp
    // for certificate checking
    this.pkixdate = (jarTimestamp != null ? jarTimestamp.getTimestamp() :
            pkixdate);
    this.jarTimestamp = jarTimestamp;
    this.variant = (variant == null ? Validator.VAR_GENERIC : variant);
}
 

/**
 * Verifies whether the input certificate completes the path.
 * Checks the cert against each trust anchor that was specified, in order,
 * and returns true as soon as it finds a valid anchor.
 * Returns true if the cert matches a trust anchor specified as a
 * certificate or if the cert verifies with a trust anchor that
 * was specified as a trusted {pubkey, caname} pair. Returns false if none
 * of the trust anchors are valid for this cert.
 *
 * @param cert the certificate to test
 * @return a boolean value indicating whether the cert completes the path.
 */
@Override
boolean isPathCompleted(X509Certificate cert) {
    for (TrustAnchor anchor : trustAnchors) {
        if (anchor.getTrustedCert() != null) {
            if (cert.equals(anchor.getTrustedCert())) {
                this.trustAnchor = anchor;
                return true;
            } else {
                continue;
            }
        }
        X500Principal principal = anchor.getCA();
        PublicKey publicKey = anchor.getCAPublicKey();

        if (principal != null && publicKey != null &&
                principal.equals(cert.getSubjectX500Principal())) {
            if (publicKey.equals(cert.getPublicKey())) {
                // the cert itself is a trust anchor
                this.trustAnchor = anchor;
                return true;
            }
            // else, it is a self-issued certificate of the anchor
        }

        // Check subject/issuer name chaining
        if (principal == null ||
                !principal.equals(cert.getIssuerX500Principal())) {
            continue;
        }

        // skip anchor if it contains a DSA key with no DSA params
        if (PKIX.isDSAPublicKeyWithoutParams(publicKey)) {
            continue;
        }

        /*
         * Check signature
         */
        try {
            cert.verify(publicKey, buildParams.sigProvider());
        } catch (InvalidKeyException ike) {
            if (debug != null) {
                debug.println("ForwardBuilder.isPathCompleted() invalid "
                              + "DSA key found");
            }
            continue;
        } catch (GeneralSecurityException e){
            if (debug != null) {
                debug.println("ForwardBuilder.isPathCompleted() " +
                              "unexpected exception");
                e.printStackTrace();
            }
            continue;
        }

        this.trustAnchor = anchor;
        return true;
    }

    return false;
}
 

IssuerInfo(TrustAnchor anchor) {
    this(anchor, (anchor != null) ? anchor.getTrustedCert() : null);
}
 

protected Collection getTrustAnchors(X509Certificate cert, Set trustanchors) throws CertPathReviewerException
{
    Collection trustColl = new ArrayList();
    Iterator it = trustanchors.iterator();
    
    X509CertSelector certSelectX509 = new X509CertSelector();

    try
    {
        certSelectX509.setSubject(getEncodedIssuerPrincipal(cert).getEncoded());
        byte[] ext = cert.getExtensionValue(X509Extensions.AuthorityKeyIdentifier.getId());

        if (ext != null)
        {
            ASN1OctetString oct = (ASN1OctetString)ASN1Primitive.fromByteArray(ext);
            AuthorityKeyIdentifier authID = AuthorityKeyIdentifier.getInstance(ASN1Primitive.fromByteArray(oct.getOctets()));

            certSelectX509.setSerialNumber(authID.getAuthorityCertSerialNumber());
            byte[] keyID = authID.getKeyIdentifier();
            if (keyID != null)
            {
                certSelectX509.setSubjectKeyIdentifier(new DEROctetString(keyID).getEncoded());
            }
        }
    }
    catch (IOException ex)
    {
        ErrorBundle msg = new ErrorBundle(RESOURCE_NAME,"CertPathReviewer.trustAnchorIssuerError");
        throw new CertPathReviewerException(msg);
    }

    while (it.hasNext())
    {
        TrustAnchor trust = (TrustAnchor) it.next();
        if (trust.getTrustedCert() != null)
        {
            if (certSelectX509.match(trust.getTrustedCert()))
            {
                trustColl.add(trust);
            }
        }
        else if (trust.getCAName() != null && trust.getCAPublicKey() != null)
        {
            X500Principal certIssuer = getEncodedIssuerPrincipal(cert);
            X500Principal caName = new X500Principal(trust.getCAName());
            if (certIssuer.equals(caName))
            {
                trustColl.add(trust);
            }
        }
    }
    return trustColl;
}
 

/**
 * Update the state with the specified trust anchor.
 *
 * @param anchor the most-trusted CA
 * @param buildParams builder parameters
 */
public void updateState(TrustAnchor anchor, BuilderParams buildParams)
    throws CertificateException, IOException, CertPathValidatorException
{
    trustAnchor = anchor;
    X509Certificate trustedCert = anchor.getTrustedCert();
    if (trustedCert != null) {
        updateState(trustedCert);
    } else {
        X500Principal caName = anchor.getCA();
        updateState(anchor.getCAPublicKey(), caName);
    }

    // The user specified AlgorithmChecker and RevocationChecker may not be
    // able to set the trust anchor until now.
    boolean revCheckerAdded = false;
    for (PKIXCertPathChecker checker : userCheckers) {
        if (checker instanceof AlgorithmChecker) {
            ((AlgorithmChecker)checker).trySetTrustAnchor(anchor);
        } else if (checker instanceof PKIXRevocationChecker) {
            if (revCheckerAdded) {
                throw new CertPathValidatorException(
                    "Only one PKIXRevocationChecker can be specified");
            }
            // if it's our own, initialize it
            if (checker instanceof RevocationChecker) {
                ((RevocationChecker)checker).init(anchor, buildParams);
            }
            ((PKIXRevocationChecker)checker).init(false);
            revCheckerAdded = true;
        }
    }

    // only create a RevocationChecker if revocation is enabled and
    // a PKIXRevocationChecker has not already been added
    if (buildParams.revocationEnabled() && !revCheckerAdded) {
        revChecker = new RevocationChecker(anchor, buildParams);
        revChecker.init(false);
    }

    init = false;
}
 

protected Collection getTrustAnchors(X509Certificate cert, Set trustanchors) throws CertPathReviewerException
{
    Collection trustColl = new ArrayList();
    Iterator it = trustanchors.iterator();
    
    X509CertSelector certSelectX509 = new X509CertSelector();

    try
    {
        certSelectX509.setSubject(getEncodedIssuerPrincipal(cert).getEncoded());
        byte[] ext = cert.getExtensionValue(X509Extensions.AuthorityKeyIdentifier.getId());

        if (ext != null)
        {
            ASN1OctetString oct = (ASN1OctetString)ASN1Primitive.fromByteArray(ext);
            AuthorityKeyIdentifier authID = AuthorityKeyIdentifier.getInstance(ASN1Primitive.fromByteArray(oct.getOctets()));

            certSelectX509.setSerialNumber(authID.getAuthorityCertSerialNumber());
            byte[] keyID = authID.getKeyIdentifier();
            if (keyID != null)
            {
                certSelectX509.setSubjectKeyIdentifier(new DEROctetString(keyID).getEncoded());
            }
        }
    }
    catch (IOException ex)
    {
        ErrorBundle msg = new ErrorBundle(RESOURCE_NAME,"CertPathReviewer.trustAnchorIssuerError");
        throw new CertPathReviewerException(msg);
    }

    while (it.hasNext())
    {
        TrustAnchor trust = (TrustAnchor) it.next();
        if (trust.getTrustedCert() != null)
        {
            if (certSelectX509.match(trust.getTrustedCert()))
            {
                trustColl.add(trust);
            }
        }
        else if (trust.getCAName() != null && trust.getCAPublicKey() != null)
        {
            X500Principal certIssuer = getEncodedIssuerPrincipal(cert);
            X500Principal caName = new X500Principal(trust.getCAName());
            if (certIssuer.equals(caName))
            {
                trustColl.add(trust);
            }
        }
    }
    return trustColl;
}