Class StatusCheckingCertificateValidatorImpl
java.lang.Object
se.swedenconnect.sigval.cert.chain.impl.StatusCheckingCertificateValidatorImpl
- All Implemented Interfaces:
se.idsec.signservice.security.certificate.CertificateValidator,CertificatePathValidatorFactory
public class StatusCheckingCertificateValidatorImpl
extends Object
implements se.idsec.signservice.security.certificate.CertificateValidator, CertificatePathValidatorFactory
This is an implementation of the Certificate validator interface
CertificateValidator in the sign service
commons library. An instance of this interface can perform any number of validations based on validation data input.
This implementation uses an implementation of the Runnable AbstractPathValidator class to perform path
validation. Because the AbstractPathValidator is runnable that can be executed in a separate thread, it must
be instantiated for every instance of validation.
Because this class creates a new CertificatePathValidator for each instance of path validation, a Factory
class is configured that provides instances of an implementation of the AbstractPathValidator. A default
implementation of this factory is included here but this can be replaced by a setter.
If you need to run path validation in an isolated thread as a runnable object, then use the
CertificatePathValidator class directly instead of using this interface implementation.-
Constructor Summary
ConstructorsConstructorDescriptionStatusCheckingCertificateValidatorImpl(CRLCache crlCache, CertStore certStore, X509Certificate... defaultTrustAnchors) Constructor for the CertificateValidator implementations -
Method Summary
Modifier and TypeMethodDescriptiongetPathValidator(X509Certificate targetCert, List<X509Certificate> chain, List<TrustAnchor> trustAnchors, CertStore certStore, CRLCache crlCache) booleanvalidate(X509Certificate subjectCertificate, List<X509Certificate> additionalCertificates) Validate a certificate using default trust anchorsvalidate(X509Certificate subjectCertificate, List<X509Certificate> additionalCertificates, List<X509CRL> crls) Validate a certificate using default trust anchorsvalidate(X509Certificate subjectCertificate, List<X509Certificate> additionalCertificates, List<X509CRL> crls, List<X509Certificate> trustAnchors) Validate a certificate using default trust anchors
-
Constructor Details
-
StatusCheckingCertificateValidatorImpl
public StatusCheckingCertificateValidatorImpl(CRLCache crlCache, CertStore certStore, X509Certificate... defaultTrustAnchors) Constructor for the CertificateValidator implementations- Parameters:
crlCache- The CRLCache used to support CRL status checkingcertStore- Optional cert store (mey be null) providing intermediary certificatesdefaultTrustAnchors- Optional default trust anchors used to validate certificate paths
-
-
Method Details
-
validate
public PathValidationResult validate(X509Certificate subjectCertificate, List<X509Certificate> additionalCertificates, List<X509CRL> crls) throws CertPathBuilderException, CertPathValidatorException, GeneralSecurityException Validate a certificate using default trust anchorsThis implementation does not support CRL input. the CRL input MUST be null or an empty list
- Specified by:
validatein interfacese.idsec.signservice.security.certificate.CertificateValidator- Parameters:
subjectCertificate- The certificate to validateadditionalCertificates- Supporting certificates used to construct a path to trusted certificatescrls- Certificate revocation lists. This MUST be null or an empty list.- Returns:
- Result of certificate path building
PathValidationResult - Throws:
CertPathBuilderException- if certificate path building failsExtendedCertPathValidatorException- if certificate validation failsGeneralSecurityException- never thrown but required by interfaceCertPathValidatorException
-
validate
public PathValidationResult validate(X509Certificate subjectCertificate, List<X509Certificate> additionalCertificates, List<X509CRL> crls, List<X509Certificate> trustAnchors) throws CertPathBuilderException, CertPathValidatorException, GeneralSecurityException Validate a certificate using default trust anchorsThis implementation does not support CRL input. the CRL input MUST be null or an empty list
- Specified by:
validatein interfacese.idsec.signservice.security.certificate.CertificateValidator- Parameters:
subjectCertificate- The certificate to validateadditionalCertificates- Supporting certificates used to construct a path to trusted certificatescrls- Certificate revocation lists. This MUST be null or an empty listtrustAnchors- Trust anchors provided in addition to the default trust anchors- Returns:
- Path validation result
- Throws:
CertPathBuilderException- if certificate path building failsExtendedCertPathValidatorException- if certificate validation failsGeneralSecurityException- never thrown but required by interfaceCertPathValidatorException
-
validate
public PathValidationResult validate(X509Certificate subjectCertificate, List<X509Certificate> additionalCertificates) throws CertPathBuilderException, CertPathValidatorException, GeneralSecurityException Validate a certificate using default trust anchors- Parameters:
subjectCertificate- The certificate to validateadditionalCertificates- Supporting certificates used to construct a path to trusted certificates- Returns:
- Result of certificate path building
PathValidationResult - Throws:
CertPathBuilderException- if certificate path building failsExtendedCertPathValidatorException- if certificate validation failsGeneralSecurityException- never thrown but required by interfaceCertPathValidatorException
-
getPathValidator
public AbstractPathValidator getPathValidator(X509Certificate targetCert, List<X509Certificate> chain, List<TrustAnchor> trustAnchors, CertStore certStore, CRLCache crlCache) - Specified by:
getPathValidatorin interfaceCertificatePathValidatorFactory
-
isRevocationCheckingActive
public boolean isRevocationCheckingActive()- Specified by:
isRevocationCheckingActivein interfacese.idsec.signservice.security.certificate.CertificateValidator
-
getDefaultTrustAnchors
- Specified by:
getDefaultTrustAnchorsin interfacese.idsec.signservice.security.certificate.CertificateValidator
-