com.rsa.swsj
Class DefaultCertValidator

java.lang.Object
  com.rsa.swsj.DefaultCertValidator

All Implemented Interfaces:

CertValidator

public final class DefaultCertValidator

extends java.lang.Object

implements CertValidator

This class represents a default Certificate Path Validator and provides a default/sample implementation available to the application for Cert Path validation functionality. This implementation uses the default PKIX validation algorithm provided in JDK 1.4+.

See Also:

CertValidator

Field Summary
static byte	CRL_SIG Flag to indicate that the certificate must be validated for CRL signing
static byte	DAT_ENC Flag to indicate that the certificate must be validated for data encipherment
static byte	DEC_ONLY Flag to indicate that the certificate must be validated for decipherment only
static byte	DIG_SIG Flag to indicate that the certificate must be validated for digital signature
static byte	ENC_ONLY Flag to indicate that the certificate must be validated for encipherment only
static java.util.BitSet	enciphermentUsages a bit string to flag the available usages for xml encipherment
static byte	KEY_AGR Flag to indicate that the certificate must be validated for key agreement
static byte	KEY_ENC Flag to indicate that the certificate must be validated for key encipherment
static byte	KEY_SIG Flag to indicate that the certificate must be validated for key certificate signing
static byte	NON_REP Flag to indicate that the certificate must be validated for digital signature
static java.util.BitSet	signatureUsages a bit string to flag the available usages for xml encipherment

 

Fields inherited from interface com.rsa.swsj.CertValidator

XML_ENC, XML_SIG

 

Constructor Summary

DefaultCertValidator() Generates a new DefaultCertValidator instance.

 

Method Summary
void	setIntermediateCertificates(java.security.cert.X509Certificate[] certs) Sets an array of intermediate CA certificates.
void	setTrustedCertificates(java.security.cert.X509Certificate[] certs) Sets an array of trusted certificates.
boolean	validate(java.security.cert.X509Certificate cert) Validates a single certificate as a certifcate path.
boolean	validate(java.security.cert.X509Certificate cert, int requiredUsage) Validates a single certificate as a certifcate path, and verifies that the certificate supports the required key usage extensions.
boolean	validate(java.security.cert.X509Certificate cert, java.security.cert.X509Certificate[] extraCerts, int requiredUsage) Validates a certificate path/chain for specified certificate and checks usage extensions.

 

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

 

Field Detail

DIG_SIG

public static final byte DIG_SIG

Flag to indicate that the certificate must be validated for digital signature

See Also:

Constant Field Values

NON_REP

public static final byte NON_REP

Flag to indicate that the certificate must be validated for digital signature

See Also:

Constant Field Values

KEY_ENC

public static final byte KEY_ENC

Flag to indicate that the certificate must be validated for key encipherment

See Also:

Constant Field Values

DAT_ENC

public static final byte DAT_ENC

Flag to indicate that the certificate must be validated for data encipherment

See Also:

Constant Field Values

KEY_AGR

public static final byte KEY_AGR

Flag to indicate that the certificate must be validated for key agreement

See Also:

Constant Field Values

KEY_SIG

public static final byte KEY_SIG

Flag to indicate that the certificate must be validated for key certificate signing

See Also:

Constant Field Values

CRL_SIG

public static final byte CRL_SIG

Flag to indicate that the certificate must be validated for CRL signing

See Also:

Constant Field Values

ENC_ONLY

public static final byte ENC_ONLY

Flag to indicate that the certificate must be validated for encipherment only

See Also:

Constant Field Values

DEC_ONLY

public static final byte DEC_ONLY

Flag to indicate that the certificate must be validated for decipherment only

See Also:

Constant Field Values

enciphermentUsages

public static final java.util.BitSet enciphermentUsages

a bit string to flag the available usages for xml encipherment

signatureUsages

public static final java.util.BitSet signatureUsages

a bit string to flag the available usages for xml encipherment

DefaultCertValidator

public DefaultCertValidator()
                     throws SWSJException

Generates a new DefaultCertValidator instance.

validate

public boolean validate(java.security.cert.X509Certificate cert,
                        java.security.cert.X509Certificate[] extraCerts,
                        int requiredUsage)
                 throws SWSJException

Validates a certificate path/chain for specified certificate and checks usage extensions.

Specified by:

validate in interface CertValidator

Parameters:

cert - The certificate that SWS-J is requesting to validate.

extraCerts - An array of (possibly unrelated) certificates, that may have been present in the parsed message, which are to be used in trying to validate the certificate path. NOTE: this array can be empty. Certificates to be used in the building of a valid certificate chain can also be specified via setIntermediateCerts. To provide appropriate checks and assurances that the certificate is valid for use, the path is processed in the following manner: the issuer DN of the supplied cert is retrieved, and compared to the subject DN of each of the supplied certificates. If a matching certificate is found, the process is repeated until the issuer of a certificate cannot be found. This certificate is then assumed to be a CA certificate supplied via setTrustedCerts and the default JDK validation algorithm is applied to the chain.

requiredUsage - An int identifier for the usage required to be supported by the cert. i.e. the operations this cert will be used for e.g. encrypt, sign. Valid values at present are CertValidator.XML_SIG and CertValidator.XML_ENC.

Returns:

true If the certificate path was validated. false Otherwise.

Throws:

SWSJException

SWSJException - If any of the parameters are invalid.

validate

public boolean validate(java.security.cert.X509Certificate cert)
                 throws SWSJException

Validates a single certificate as a certifcate path.

Parameters:

cert - The certficate to be validated

Returns:

true If the certificate-as-a-path was validated. false Otherwise.

Throws:

SWSJException

SWSJException

validate

public boolean validate(java.security.cert.X509Certificate cert,
                        int requiredUsage)
                 throws SWSJException

Validates a single certificate as a certifcate path, and verifies that the certificate supports the required key usage extensions.

Parameters:

cert - The certficate to be validated

requiredUsage - An int identifier expressing the key usage extensions required to be supported by the cert

Returns:

true If the certificate + usage were validated false Otherwise.

Throws:

SWSJException

SWSJException

setTrustedCertificates

public void setTrustedCertificates(java.security.cert.X509Certificate[] certs)
                            throws InvalidParameterException

Sets an array of trusted certificates. These certificates will be used during certificate path validation.

Parameters:

certs - Array of certificates.

Throws:

InvalidParameterException

setIntermediateCertificates

public void setIntermediateCertificates(java.security.cert.X509Certificate[] certs)
                                 throws InvalidParameterException

Sets an array of intermediate CA certificates. These certificates will be used during certificate path validation.

Parameters:

certs - Array of certificates.

Throws:

InvalidParameterException