org.bouncycastle.x509
Class ExtendedPKIXParameters

java.lang.Object
  java.security.cert.PKIXParameters
      org.bouncycastle.x509.ExtendedPKIXParameters

All Implemented Interfaces:

java.lang.Cloneable, java.security.cert.CertPathParameters

Direct Known Subclasses:

ExtendedPKIXBuilderParameters

public class ExtendedPKIXParameters
extends java.security.cert.PKIXParameters

This class extends the PKIXParameters with a validity model parameter.

Field Summary

static int	CHAIN_VALIDITY_MODEL This model uses the following validity model.
static int	PKIX_VALIDITY_MODEL This is the default PKIX validity model.

Constructor Summary

ExtendedPKIXParameters(java.util.Set trustAnchors)
Creates an instance of PKIXParameters with the specified Set of most-trusted CAs.

Method Summary

void	addAddionalStore(Store store) Adds a additional Bouncy Castle Store to find CRLs, certificates, attribute certificates or cross certificates.
void	addCertStore(java.security.cert.CertStore store) Adds a Java CertStore to this extended PKIX parameters.
void	addStore(Store store) Adds a Bouncy Castle Store to find CRLs, certificates, attribute certificates or cross certificates.
java.lang.Object	clone()
java.util.List	getAddionalStores() Returns an immutable List of additional Bouncy Castle Stores used for finding CRLs, certificates, attribute certificates or cross certificates.
java.util.Set	getAttrCertCheckers() Returns the attribute certificate checker.
static ExtendedPKIXParameters	getInstance(java.security.cert.PKIXParameters pkixParams) Returns an instance with the parameters of a given PKIXParameters object.
java.util.Set	getNecessaryACAttributes() Returns the neccessary attributes which must be contained in an attribute certificate.
java.util.Set	getProhibitedACAttributes() Returns the attribute certificates which are not allowed.
java.util.List	getStores() Returns an immutable List of Bouncy Castle Stores used for finding CRLs, certificates, attribute certificates or cross certificates.
Selector	getTargetConstraints() Returns the required constraints on the target certificate or attribute certificate.
java.util.Set	getTrustedACIssuers() Returns the trusted attribute certificate issuers.
int	getValidityModel()
boolean	isAdditionalLocationsEnabled() Returns if additional X509Stores for locations like LDAP found in certificates or CRLs should be used.
boolean	isUseDeltasEnabled() Defaults to false.
void	setAdditionalLocationsEnabled(boolean enabled) Sets if additional X509Stores for locations like LDAP found in certificates or CRLs should be used.
void	setAttrCertCheckers(java.util.Set attrCertCheckers) Sets the attribute certificate checkers.
void	setCertStores(java.util.List stores) Sets the Java CertStore to this extended PKIX parameters.
void	setNecessaryACAttributes(java.util.Set necessaryACAttributes) Sets the neccessary which must be contained in an attribute certificate.
protected void	setParams(java.security.cert.PKIXParameters params) Method to support clone() under J2ME.
void	setProhibitedACAttributes(java.util.Set prohibitedACAttributes) Sets the attribute certificates which are not allowed.
void	setStores(java.util.List stores) Sets the Bouncy Castle Stores for finding CRLs, certificates, attribute certificates or cross certificates.
void	setTargetCertConstraints(java.security.cert.CertSelector selector) Sets the required constraints on the target certificate.
void	setTargetConstraints(Selector selector) Sets the required constraints on the target certificate or attribute certificate.
void	setTrustedACIssuers(java.util.Set trustedACIssuers) Sets the trusted attribute certificate issuers.
void	setUseDeltasEnabled(boolean useDeltas) Sets if delta CRLs should be used for checking the revocation status.
void	setValidityModel(int validityModel)

Methods inherited from class java.security.cert.PKIXParameters

addCertPathChecker, getCertPathCheckers, getCertStores, getDate, getInitialPolicies, getPolicyQualifiersRejected, getSigProvider, getTargetCertConstraints, getTrustAnchors, isAnyPolicyInhibited, isExplicitPolicyRequired, isPolicyMappingInhibited, isRevocationEnabled, setAnyPolicyInhibited, setCertPathCheckers, setDate, setExplicitPolicyRequired, setInitialPolicies, setPolicyMappingInhibited, setPolicyQualifiersRejected, setRevocationEnabled, setSigProvider, setTrustAnchors, toString

Methods inherited from class java.lang.Object

equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Field Detail

PKIX_VALIDITY_MODEL

public static final int PKIX_VALIDITY_MODEL

This is the default PKIX validity model. Actually there are two variants of this: The PKIX model and the modified PKIX model. The PKIX model verifies that all involved certificates must have been valid at the current time. The modified PKIX model verifies that all involved certificates were valid at the signing time. Both are indirectly choosen with the PKIXParameters.setDate(java.util.Date) method, so this methods sets the Date when all certificates must have been valid.

See Also:

Constant Field Values

CHAIN_VALIDITY_MODEL

public static final int CHAIN_VALIDITY_MODEL

This model uses the following validity model. Each certificate must have been valid at the moment where is was used. That means the end certificate must have been valid at the time the signature was done. The CA certificate which signed the end certificate must have been valid, when the end certificate was signed. The CA (or Root CA) certificate must have been valid, when the CA certificate was signed and so on. So the PKIXParameters.setDate(java.util.Date) method sets the time, when the end certificate must have been valid.

It is used e.g. in the German signature law.

See Also:

Constant Field Values

Constructor Detail

ExtendedPKIXParameters

public ExtendedPKIXParameters(java.util.Set trustAnchors)
                       throws java.security.InvalidAlgorithmParameterException

Creates an instance of PKIXParameters with the specified Set of most-trusted CAs. Each element of the set is a TrustAnchor.

Note that the Set is copied to protect against subsequent modifications.

Parameters:

trustAnchors - a Set of TrustAnchors

Throws:

java.security.InvalidAlgorithmParameterException - if the specified Set is empty.

java.lang.NullPointerException - if the specified Set is null

java.lang.ClassCastException - if any of the elements in the Set is not of type java.security.cert.TrustAnchor

Method Detail

getInstance

public static ExtendedPKIXParameters getInstance(java.security.cert.PKIXParameters pkixParams)

Returns an instance with the parameters of a given PKIXParameters object.

Parameters:

pkixParams - The given PKIXParameters

Returns:

an extended PKIX params object

setParams

protected void setParams(java.security.cert.PKIXParameters params)

Method to support clone() under J2ME. super.clone() does not exist and fields are not copied.

Parameters:

params - Parameters to set. If this are ExtendedPKIXParameters they are copied to.

isUseDeltasEnabled

public boolean isUseDeltasEnabled()

Defaults to false.

Returns:

Returns if delta CRLs should be used.

setUseDeltasEnabled

public void setUseDeltasEnabled(boolean useDeltas)

Sets if delta CRLs should be used for checking the revocation status.

Parameters:

useDeltas - true if delta CRLs should be used.

getValidityModel

public int getValidityModel()

Returns:

Returns the validity model.

See Also:

CHAIN_VALIDITY_MODEL, PKIX_VALIDITY_MODEL

addCertStore

public void addCertStore(java.security.cert.CertStore store)

Adds a Java CertStore to this extended PKIX parameters. If the store uses initialisation parameters of type CollectionCertStoreParameters or the corresponding Bouncy Castle Store type is created additionally to it.

Overrides:

addCertStore in class java.security.cert.PKIXParameters

setCertStores

public void setCertStores(java.util.List stores)

Sets the Java CertStore to this extended PKIX parameters. If the stores use initialisation parameters of type CollectionCertStoreParameters or the corresponding Bouncy Castle Store types are created additionally to it.

Overrides:

setCertStores in class java.security.cert.PKIXParameters

Throws:

java.lang.ClassCastException - if an element of stores is not a CertStore.

setStores

public void setStores(java.util.List stores)

Sets the Bouncy Castle Stores for finding CRLs, certificates, attribute certificates or cross certificates.

The List is cloned.

Parameters:

stores - A list of stores to use.

Throws:

java.lang.ClassCastException - if an element of stores is not a Store.

See Also:

getStores()

addStore

public void addStore(Store store)

Adds a Bouncy Castle Store to find CRLs, certificates, attribute certificates or cross certificates.

This method should be used to add local stores, like collection based X.509 stores, if available. Local stores should be considered first, before trying to use additional (remote) locations, because they do not need possible additional network traffic.

If store is null it is ignored.

Parameters:

store - The store to add.

See Also:

getStores()

addAddionalStore

public void addAddionalStore(Store store)

Adds a additional Bouncy Castle Store to find CRLs, certificates, attribute certificates or cross certificates.

You should not use this method. This method is used for adding additional X.509 stores, which are used to add (remote) locations, e.g. LDAP, found during X.509 object processing, e.g. in certificates or CRLs. This method is used in PKIX certification path processing.

If store is null it is ignored.

Parameters:

store - The store to add.

See Also:

getStores()

getAddionalStores

public java.util.List getAddionalStores()

Returns an immutable List of additional Bouncy Castle Stores used for finding CRLs, certificates, attribute certificates or cross certificates.

Returns:

an immutable List of additional Bouncy Castle Stores. Never null.

See Also:

addAddionalStore(Store)

getStores

public java.util.List getStores()

Returns an immutable List of Bouncy Castle Stores used for finding CRLs, certificates, attribute certificates or cross certificates.

Returns:

an immutable List of Bouncy Castle Stores. Never null.

See Also:

setStores(List)

setValidityModel

public void setValidityModel(int validityModel)

Parameters:

validityModel - The validity model to set.

See Also:

CHAIN_VALIDITY_MODEL, PKIX_VALIDITY_MODEL

clone

public java.lang.Object clone()

Specified by:

clone in interface java.security.cert.CertPathParameters

Overrides:

clone in class java.security.cert.PKIXParameters

isAdditionalLocationsEnabled

public boolean isAdditionalLocationsEnabled()

Returns if additional X509Stores for locations like LDAP found in certificates or CRLs should be used.

Returns:

Returns true if additional stores are used.

setAdditionalLocationsEnabled

public void setAdditionalLocationsEnabled(boolean enabled)

Sets if additional X509Stores for locations like LDAP found in certificates or CRLs should be used.

Parameters:

enabled - true if additional stores are used.

getTargetConstraints

public Selector getTargetConstraints()

Returns the required constraints on the target certificate or attribute certificate. The constraints are returned as an instance of Selector. If null, no constraints are defined.

The target certificate in a PKIX path may be a certificate or an attribute certificate.

Note that the Selector returned is cloned to protect against subsequent modifications.

Returns:

a Selector specifying the constraints on the target certificate or attribute certificate (or null)

See Also:

setTargetConstraints(org.bouncycastle.util.Selector), X509CertStoreSelector, X509AttributeCertStoreSelector

setTargetConstraints

public void setTargetConstraints(Selector selector)

Sets the required constraints on the target certificate or attribute certificate. The constraints are specified as an instance of Selector. If null, no constraints are defined.

The target certificate in a PKIX path may be a certificate or an attribute certificate.

Note that the Selector specified is cloned to protect against subsequent modifications.

Parameters:

selector - a Selector specifying the constraints on the target certificate or attribute certificate (or null)

See Also:

getTargetConstraints(), X509CertStoreSelector, X509AttributeCertStoreSelector

setTargetCertConstraints

public void setTargetCertConstraints(java.security.cert.CertSelector selector)

Sets the required constraints on the target certificate. The constraints are specified as an instance of X509CertSelector. If null, no constraints are defined.

This method wraps the given X509CertSelector into a X509CertStoreSelector.

Note that the X509CertSelector specified is cloned to protect against subsequent modifications.

Overrides:

setTargetCertConstraints in class java.security.cert.PKIXParameters

Parameters:

selector - a X509CertSelector specifying the constraints on the target certificate (or null)

See Also:

PKIXParameters.getTargetCertConstraints(), X509CertStoreSelector

getTrustedACIssuers

public java.util.Set getTrustedACIssuers()

Returns the trusted attribute certificate issuers. If attribute certificates is verified the trusted AC issuers must be set.

The returned Set consists of TrustAnchors.

The returned Set is immutable. Never null

Returns:

Returns an immutable set of the trusted AC issuers.

setTrustedACIssuers

public void setTrustedACIssuers(java.util.Set trustedACIssuers)

Sets the trusted attribute certificate issuers. If attribute certificates is verified the trusted AC issuers must be set.

The trustedACIssuers must be a Set of TrustAnchor

The given set is cloned.

Parameters:

trustedACIssuers - The trusted AC issuers to set. Is never null.

Throws:

java.lang.ClassCastException - if an element of stores is not a TrustAnchor.

getNecessaryACAttributes

public java.util.Set getNecessaryACAttributes()

Returns the neccessary attributes which must be contained in an attribute certificate.

The returned Set is immutable and contains Strings with the OIDs.

Returns:

Returns the necessary AC attributes.

setNecessaryACAttributes

public void setNecessaryACAttributes(java.util.Set necessaryACAttributes)

Sets the neccessary which must be contained in an attribute certificate.

The Set must contain Strings with the OIDs.

The set is cloned.

Parameters:

necessaryACAttributes - The necessary AC attributes to set.

Throws:

java.lang.ClassCastException - if an element of necessaryACAttributes is not a String.

getProhibitedACAttributes

public java.util.Set getProhibitedACAttributes()

Returns the attribute certificates which are not allowed.

The returned Set is immutable and contains Strings with the OIDs.

Returns:

Returns the prohibited AC attributes. Is never null.

setProhibitedACAttributes

public void setProhibitedACAttributes(java.util.Set prohibitedACAttributes)

Sets the attribute certificates which are not allowed.

The Set must contain Strings with the OIDs.

The set is cloned.

Parameters:

prohibitedACAttributes - The prohibited AC attributes to set.

Throws:

java.lang.ClassCastException - if an element of prohibitedACAttributes is not a String.

getAttrCertCheckers

public java.util.Set getAttrCertCheckers()

Returns the attribute certificate checker. The returned set contains PKIXAttrCertCheckers and is immutable.

Returns:

Returns the attribute certificate checker. Is never null.

setAttrCertCheckers

public void setAttrCertCheckers(java.util.Set attrCertCheckers)

Sets the attribute certificate checkers.

All elements in the Set must a PKIXAttrCertChecker.

The given set is cloned.

Parameters:

attrCertCheckers - The attribute certificate checkers to set. Is never null.

Throws:

java.lang.ClassCastException - if an element of attrCertCheckers is not a PKIXAttrCertChecker.