Package se.idsec.signservice.security.certificate.impl

Class SimpleCertificateValidator

java.lang.Object

se.idsec.signservice.security.certificate.impl.SimpleCertificateValidator

All Implemented Interfaces:

CertificateValidator

public class SimpleCertificateValidator
extends Object
implements CertificateValidator

A simple validator that does not perform revocation checking and only relies upon the supplied certificates when building the chain.

Note: If no trust anchors are defined, the path root must be available as the last element of the additionalCertificates parameter. This certificate must be self-signed.

Author:

Martin Lindström (martin@idsec.se), Stefan Santesson (stefan@idsec.se)

Field Summary

Fields

Modifier and Type	Field	Description
protected List<X509Certificate>	defaultTrustAnchors	The trust anchors.
protected Date	validationDate	The date/time when the certificate status should be determined.

Constructor Summary

Constructors

Constructor	Description
SimpleCertificateValidator()	Default constructor.

Method Summary

Modifier and Type	Method	Description
protected PKIXBuilderParameters	buildParameters(X509Certificate subjectCertificate, Set<TrustAnchor> trustAnchors, List<CertStore> certStores)	Builds the parameters for path building and validation.
protected List<CertStore>	getCertStores(X509Certificate subjectCertificate, List<X509Certificate> additionalCertificates, List<X509CRL> crls)	Gets the certificate stores that should be used during path building and validation.
List<X509Certificate>	getDefaultTrustAnchors()	Gets the trusted (root) certificates for this validator.
Date	getValidationDate()	The date/time when the certificate status should be determined.
boolean	isRevocationCheckingActive()	Always returns false.
void	setDefaultTrustAnchors(List<X509Certificate> defaultTrustAnchors)	Assigns the default trust anchors for this validator.
protected Set<TrustAnchor>	setupTrustAnchors(List<X509Certificate> trustAnchors, List<X509Certificate> additionalCertificates)	The implementation creates a set of trust anchors based on the trustAnchors parameter.
void	setValidationDate(Date validationDate)	Assigns the date/time when the certificate status should be determined.
protected X509CertSelector	toCertSelector(X509Certificate subjectCertificate)	Creates a X509CertSelector for the supplied subject certificate.
CertificateValidationResult	validate(X509Certificate subjectCertificate, List<X509Certificate> additionalCertificates, List<X509CRL> crls)	Validates the supplied subject certificate.
CertificateValidationResult	validate(X509Certificate subjectCertificate, List<X509Certificate> additionalCertificates, List<X509CRL> crls, List<X509Certificate> trustAnchors)	Validates the supplied subject certificate.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

validationDate

protected Date validationDate

The date/time when the certificate status should be determined. For testing mainly.

defaultTrustAnchors

protected List<X509Certificate> defaultTrustAnchors

The trust anchors.

Constructor Details

SimpleCertificateValidator

public SimpleCertificateValidator()

Default constructor.

Method Details

validate

public CertificateValidationResult validate(X509Certificate subjectCertificate,
 List<X509Certificate> additionalCertificates,
 List<X509CRL> crls)
                                     throws CertPathBuilderException,
CertPathValidatorException,
GeneralSecurityException

Validates the supplied subject certificate.

Specified by:

validate in interface CertificateValidator

Parameters:

subjectCertificate - the certificate to validate

additionalCertificates - other certificates that may be useful when building a certificate path (may be null or empty)

crls - optional list of CRL:s that may be useful during path validation (may be null or empty)

Returns:

a validator result

Throws:

CertPathBuilderException - if a valid certificate path could not be built

CertPathValidatorException - if the path failed to verify

GeneralSecurityException - for general errors

validate

public CertificateValidationResult validate(X509Certificate subjectCertificate,
 List<X509Certificate> additionalCertificates,
 List<X509CRL> crls,
 List<X509Certificate> trustAnchors)
                                     throws CertPathBuilderException,
CertPathValidatorException,
GeneralSecurityException

Validates the supplied subject certificate. The supplied trust anchors overrides the trust configured for this validator (CertificateValidator.getDefaultTrustAnchors()).

Specified by:

validate in interface CertificateValidator

Parameters:

subjectCertificate - the certificate to validate

additionalCertificates - other certificates that may be useful when building a certificate path (may be null or empty)

crls - optional list of CRL:s that may be useful during path validation (may be null or empty)

trustAnchors - the trust anchors to use during validation (null or empty list means "trust any root")

Returns:

a validator result

Throws:

CertPathBuilderException - if a valid certificate path could not be built

CertPathValidatorException - if the path failed to verify

GeneralSecurityException - for general errors

setupTrustAnchors

protected Set<TrustAnchor> setupTrustAnchors(List<X509Certificate> trustAnchors,
 List<X509Certificate> additionalCertificates)
                                      throws CertPathBuilderException

The implementation creates a set of trust anchors based on the trustAnchors parameter. This parameter was either supplied in a call to validate(X509Certificate, List, List, List) or set as the default anchors (setDefaultTrustAnchors(List)).

If no trust anchors is available, this implementation uses the last certificate from the supplied additionalCertificates parameter as the root.

Parameters:

trustAnchors - the trust anchors

additionalCertificates - additional certs

Returns:

a set of trust anchors

Throws:

CertPathBuilderException - if trust can not be setup

getCertStores

protected List<CertStore> getCertStores(X509Certificate subjectCertificate,
 List<X509Certificate> additionalCertificates,
 List<X509CRL> crls)
                                 throws GeneralSecurityException

Gets the certificate stores that should be used during path building and validation. The default implementation builds one store holding the certificates supplied in subjectCertificate and additionalCertificates.

Parameters:

subjectCertificate - the certificate to validate

additionalCertificates - other certificates that may be useful when building a certificate path

crls - optional list of CRL:s that may be useful during path validation

Returns:

a list of cert stores

Throws:

GeneralSecurityException - for cert store creation errors

buildParameters

protected PKIXBuilderParameters buildParameters(X509Certificate subjectCertificate,
 Set<TrustAnchor> trustAnchors,
 List<CertStore> certStores)
                                         throws GeneralSecurityException

Builds the parameters for path building and validation. This implementation disables revocation checking and uses default settings from the PKIXBuilderParameters class.

Parameters:

subjectCertificate - the subject certificate

trustAnchors - the trust anchors

certStores - the cert stores

Returns:

a PKIXBuilderParameters object

Throws:

GeneralSecurityException - for errors setting up the params

toCertSelector

protected X509CertSelector toCertSelector(X509Certificate subjectCertificate)

Creates a X509CertSelector for the supplied subject certificate.

Parameters:

subjectCertificate - the certificate

Returns:

a X509CertSelector

isRevocationCheckingActive

public boolean isRevocationCheckingActive()

Always returns false.

Specified by:

isRevocationCheckingActive in interface CertificateValidator

Returns:

true if revocation checking is active and false otherwise

getDefaultTrustAnchors

public List<X509Certificate> getDefaultTrustAnchors()

Gets the trusted (root) certificates for this validator. An empty list indicates "trust any root".

Note: These anchors may be overridden by supplying an alternative set to CertificateValidator.validate(X509Certificate, List, List, List).

Specified by:

getDefaultTrustAnchors in interface CertificateValidator

Returns:

trusted certificates

setDefaultTrustAnchors

public void setDefaultTrustAnchors(List<X509Certificate> defaultTrustAnchors)

Assigns the default trust anchors for this validator.

Parameters:

defaultTrustAnchors - trusted root certificates

getValidationDate

public Date getValidationDate()

The date/time when the certificate status should be determined. For testing mainly. If null is returned, this indicates "now".

Returns:

the validation date/time, or null for "now"

setValidationDate

public void setValidationDate(Date validationDate)

Assigns the date/time when the certificate status should be determined. For testing mainly. If null, which is the default, is assigned this indicates "now".

Parameters:

validationDate - the validation date/time, or null for "now"