Package org.bouncycastle.pkix.jcajce

Class X509RevocationChecker

java.lang.Object

java.security.cert.PKIXCertPathChecker

org.bouncycastle.pkix.jcajce.X509RevocationChecker

All Implemented Interfaces:

Cloneable, CertPathChecker

public class X509RevocationChecker
extends PKIXCertPathChecker

X.509 Certificate Revocation Checker - still lacks OCSP support and support for delta CRLs.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static class	X509RevocationChecker.Builder

Field Summary

Fields

Modifier and Type	Field	Description
static final int	CHAIN_VALIDITY_MODEL	This model uses the following validity model.
protected static final String[]	crlReasons
static final int	PKIX_VALIDITY_MODEL	This is the default PKIX validity model.

Method Summary

Modifier and Type	Method	Description
void	check(Certificate certificate, Collection<String> collection)
protected void	checkCRLs(org.bouncycastle.jcajce.PKIXExtendedParameters pkixParams, Date currentDate, Date validityDate, X509Certificate cert, X509Certificate sign, PublicKey workingPublicKey, List certPathCerts, org.bouncycastle.jcajce.util.JcaJceHelper helper)	Checks a certificate if it is revoked.
Object	clone()
Set<String>	getSupportedExtensions()
void	init(boolean forward)
boolean	isForwardCheckingSupported()

Methods inherited from class java.security.cert.PKIXCertPathChecker

check

Methods inherited from class java.lang.Object

equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

PKIX_VALIDITY_MODEL

public static final int PKIX_VALIDITY_MODEL

This is the default PKIX validity model. Actually there are two variants of this: The PKIX model and the modified PKIX model. The PKIX model verifies that all involved certificates must have been valid at the current time. The modified PKIX model verifies that all involved certificates were valid at the time of signing. Both are indirectly chosen with the PKIXParameters.setDate(Date) method, so this methods sets the Date when all certificates must have been valid.

See Also:

• Constant Field Values

CHAIN_VALIDITY_MODEL

public static final int CHAIN_VALIDITY_MODEL

This model uses the following validity model. Each certificate must have been valid at the moment where is was used. That means the end certificate must have been valid at the time the signature was done. The CA certificate which signed the end certificate must have been valid, when the end certificate was signed. The CA (or Root CA) certificate must have been valid, when the CA certificate was signed and so on. So the PKIXParameters.setDate(Date) method sets the time, when the end certificate must have been valid. It is used e.g. in the German signature law.

See Also:

• Constant Field Values

crlReasons

protected static final String[] crlReasons

Method Details

init

public void init(boolean forward)
          throws CertPathValidatorException

Specified by:

init in interface CertPathChecker

Specified by:

init in class PKIXCertPathChecker

Throws:

CertPathValidatorException

isForwardCheckingSupported

public boolean isForwardCheckingSupported()

Specified by:

isForwardCheckingSupported in interface CertPathChecker

Specified by:

isForwardCheckingSupported in class PKIXCertPathChecker

getSupportedExtensions

public Set<String> getSupportedExtensions()

Specified by:

getSupportedExtensions in class PKIXCertPathChecker

check

public void check(Certificate certificate,
 Collection<String> collection)
           throws CertPathValidatorException

Specified by:

check in class PKIXCertPathChecker

Throws:

CertPathValidatorException

checkCRLs

protected void checkCRLs(org.bouncycastle.jcajce.PKIXExtendedParameters pkixParams,
 Date currentDate,
 Date validityDate,
 X509Certificate cert,
 X509Certificate sign,
 PublicKey workingPublicKey,
 List certPathCerts,
 org.bouncycastle.jcajce.util.JcaJceHelper helper)
                  throws org.bouncycastle.pkix.jcajce.AnnotatedException,
CertPathValidatorException

Checks a certificate if it is revoked.

Parameters:

pkixParams - PKIX parameters.

cert - Certificate to check if it is revoked.

validityDate - The date when the certificate revocation status should be checked.

sign - The issuer certificate of the certificate cert.

workingPublicKey - The public key of the issuer certificate sign.

certPathCerts - The certificates of the certification path.

Throws:

org.bouncycastle.pkix.jcajce.AnnotatedException - if the certificate is revoked or the status cannot be checked or some error occurs.

CertPathValidatorException

clone

public Object clone()

Overrides:

clone in class PKIXCertPathChecker