public class CertVerifier extends java.lang.Object implements ValidationInfo
| Constructor and Description |
|---|
CertVerifier(X509Certificate[] rootsOfTrust,
LdapDirectory directory,
ClientSettings clientSettings)
Constructor with multiple roots of trust.
|
CertVerifier(X509Certificate[] rootsOfTrust,
LdapDirectory directory,
ClientSettings clientSettings,
UserRevocationInfo revInfo)
Constructor with multiple roots of trust.
|
CertVerifier(X509Certificate rootOfTrust,
LdapDirectory directory,
ClientSettings clientSettings)
Constructor.
|
CertVerifier(X509Certificate rootOfTrust,
LdapDirectory directory,
ClientSettings clientSettings,
UserRevocationInfo revInfo)
Constructor.
|
| Modifier and Type | Method and Description |
|---|---|
CollectionCS |
getCertificateStore()
Returns the certificate store.
|
ClientSettings |
getClientSettings()
Returns the client settings.
|
LdapDirectory |
getDirectory()
Returns the LDAP Directory
|
ExtensionTester |
getExtensionTester()
Returns the extension tester.
|
boolean |
getForceV1CertAsCA()
Return whether a V1 X509Certificate will always be considered a CA
certificate (true), or whether it will always be considered an
End-Entity (false)
|
RevocationChecker |
getRevocationChecker() |
UserRevocationInfo |
getRevocationInfo()
Return the UserRevocation Information
|
RevocationManager |
getRevocationManager()
Returns the Revocation Manager for this CertVerifier.
|
CollectionRS |
getRevocationStore()
Returns the revocation store.
|
X509Certificate |
getRootOfTrust()
Returns the root of trust.
|
X509Certificate[] |
getRootsOfTrust()
Returns all roots of trust.
|
ValidationConfig |
getValidationConfig()
Return the ValidationConfig that is configured in the
associated CollectionCS certificate store object.
|
static boolean |
readForceV1CertsAsCAUsage()
This method sets the global default usage for determining
whether V1 X509Certificates should be considered CA certificates,
or End-Entity certificates.
|
void |
setDirectory(LdapDirectory dir)
Changes the directory on-the-fly
|
void |
setForceV1CertAsCA(boolean enforceV1CertAsCA)
This setting is used to determine whether V1 X509Certificates
should be considered CA certificates, or End-Entity certificates.
|
void |
setRevocationInfo(UserRevocationInfo revInfo)
Allows a customized revocation configuration to be used for revocation
checking.
|
void |
setValidationConfig(ValidationConfig validationConfig)
Configure this CertVerifier to use the specified ValidationConfig.
|
X509Certificate[] |
validate(X509Certificate certificate)
Validates an X.509 certificate.
|
X509Certificate[] |
validate(X509Certificate certificate,
java.util.Date validationTime)
Validates an X.509 certificate at a given point in time.
|
public CertVerifier(X509Certificate rootOfTrust, LdapDirectory directory, ClientSettings clientSettings)
rootOfTrust - A trusted certificate used as the trust anchor for certificate validation.directory - A connection to the Directory to retrieve CRLs and certificates from,
or null if no Directory is required. If a Directory is used,
it is a good idea to set connection and search timeout values. If no
Directory is provided, revocation checking is turned off. This can be changed
later by calling getRevocationStore().requireCRL(true);clientSettings - Controls whether arbitrary certificates can be trusted, and the initial
inputs to the path validation algorithm:
null causes the default values to be used.
That is, anyPolicy and policy mapping are allowed, and the acceptable policy
set is all policies.java.lang.RuntimeException - if the signature on the root-of-trust certificate cannot be verifiedpublic CertVerifier(X509Certificate[] rootsOfTrust, LdapDirectory directory, ClientSettings clientSettings) throws CertificationRootException
rootsOfTrust - An array of trusted certificates, each being a trust anchor for certificate validation.directory - A connection to the Directory to retrieve CRLs and certificates from,
or null if no Directory is required. If a Directory is used,
it is a good idea to set connection and search timeout values. If no
Directory is provided, revocation checking is turned off. This can be changed
later by calling getRevocationStore().requireCRL(true);clientSettings - Controls whether arbitrary certificates can be trusted, and the initial
inputs to the path validation algorithm:
null causes the default values to be used.
That is, anyPolicy and policy mapping are allowed, and the acceptable policy
set is all policies.CertificationRootException - if the signature on the self-signed CA
certificate cannot be verifiedpublic CertVerifier(X509Certificate rootOfTrust, LdapDirectory directory, ClientSettings clientSettings, UserRevocationInfo revInfo)
rootOfTrust - A trusted certificate used as the trust anchor for certificate validation.directory - A connection to the Directory to retrieve CRLs and certificates from,
or null if no Directory is required. If a Directory is used,
it is a good idea to set connection and search timeout values. If no
Directory is provided, revocation checking is turned off. This can be changed
later by calling getRevocationStore().requireCRL(true);clientSettings - Controls whether arbitrary certificates can be trusted, and the initial
inputs to the path validation algorithm:
null causes the default values to be used.
That is, anyPolicy and policy mapping are allowed, and the acceptable policy
set is all policies.revInfo - The Revocation Information used to configure the RevocationConfiguration which
is used to setup the revocation checking parameters.java.lang.RuntimeException - if the signature on the root-of-trust certificate cannot be verifiedpublic CertVerifier(X509Certificate[] rootsOfTrust, LdapDirectory directory, ClientSettings clientSettings, UserRevocationInfo revInfo) throws CertificationRootException
rootsOfTrust - An array of trusted certificates, each being a trust anchor for certificate validation.directory - A connection to the Directory to retrieve CRLs and certificates from,
or null if no Directory is required. If a Directory is used,
it is a good idea to set connection and search timeout values. If no
Directory is provided, revocation checking is turned off. This can be changed
later by calling getRevocationStore().requireCRL(true);clientSettings - Controls whether arbitrary certificates can be trusted, and the initial
inputs to the path validation algorithm:
null causes the default values to be used.
That is, anyPolicy and policy mapping are allowed, and the acceptable policy
set is all policies.
* @param revInfo
The Revocation Information used to configure the RevocationConfiguration which
is used to setup the revocation checking parameters.CertificationRootException - if there are no CA certificates in the provided rootsOfTrust
array, or the signature on the self-signed CA certificate cannot be verifiedpublic CollectionCS getCertificateStore()
getCertificateStore in interface ValidationInfopublic ExtensionTester getExtensionTester()
getExtensionTester in interface ValidationInfopublic CollectionRS getRevocationStore()
getRevocationStore in interface ValidationInfopublic RevocationChecker getRevocationChecker()
getRevocationChecker in interface ValidationInfopublic LdapDirectory getDirectory()
getDirectory in interface ValidationInfopublic void setDirectory(LdapDirectory dir)
setDirectory in interface ValidationInfodir - the new Directory to use for searches.public void setRevocationInfo(UserRevocationInfo revInfo)
setRevocationInfo in interface ValidationInforevInfo - - The UserRevocationInfo object used to
configure revocation.public void setForceV1CertAsCA(boolean enforceV1CertAsCA)
com.entrust.toolkit.x509.CertVerifier.ForceV1CertAsCA=<true|false>When set to true, V1 certificates will be considered as CA certificates. When set to false, V1 certificates are considered End Entity certificates. If the System property is not set, the default is false.
enforceV1CertAsCA - true to indicate V1 certificates are CA certificates,
False to indicate End entity certificates.public void setValidationConfig(ValidationConfig validationConfig)
validationConfig - The validationConfigpublic ValidationConfig getValidationConfig()
public static boolean readForceV1CertsAsCAUsage()
com.entrust.toolkit.x509.CertVerifier.ForceV1CertAsCA
It will only return true if a value of 'true' is passed in as the value of the system property, otherwise it will return false.public boolean getForceV1CertAsCA()
getForceV1CertAsCA in interface ValidationInfopublic RevocationManager getRevocationManager()
getRevocationManager in interface ValidationInfopublic X509Certificate getRootOfTrust()
getRootOfTrust in interface ValidationInfopublic X509Certificate[] getRootsOfTrust()
public ClientSettings getClientSettings()
getClientSettings in interface ValidationInfopublic X509Certificate[] validate(X509Certificate certificate) throws CertificationException
Validation consists of three steps:
certificate to
the root of trustThis may cause the Directory to be contacted, which could cause this call to run for a long time if the Directory is slow to respond. If possible, set Directory connection and search timeout values.
This method returns a certificate chain from the root of trust
to the given certificate if a chain is found and successfully
validated. It throws a CertificateException if no
chain is found, or if a chain is found but fails to validate.
certificate - the certificate to validateCertificationException - if no valid certificate chain is foundpublic X509Certificate[] validate(X509Certificate certificate, java.util.Date validationTime) throws CertificationException, RevocationWarningException
Validation consists of three steps:
certificate to the root
of trustThis may cause the Directory to be contacted, which could cause this call to run for a long time if the Directory is slow to respond. If possible, set Directory connection and search timeout values.
The validation of a trusted certificate does not check its extension or revocation.
This method returns a certificate chain from the root of trust to the given certificate if a chain is found and successfully validated without any errors or warnings.
certificate - the certificate being validatedvalidationTime - the time at which the validation is being done forCertificationException - thrown if no valid certificate chain is foundRevocationWarningException - thrown if the certificate is revoked, but was revoked
after the time of validationpublic UserRevocationInfo getRevocationInfo()
getRevocationInfo in interface ValidationInfo