- java.lang.Object
-
- java.security.cert.TrustAnchor
-
public class TrustAnchor extends Object
A trust anchor or most-trusted Certification Authority (CA).This class represents a "most-trusted CA", which is used as a trust anchor for validating X.509 certification paths. A most-trusted CA includes the public key of the CA, the CA's name, and any constraints upon the set of paths which may be validated using this key. These parameters can be specified in the form of a trusted
X509Certificate
or as individual parameters.Concurrent Access
All
TrustAnchor
objects must be immutable and thread-safe. That is, multiple threads may concurrently invoke the methods defined in this class on a singleTrustAnchor
object (or more than one) with no ill effects. RequiringTrustAnchor
objects to be immutable and thread-safe allows them to be passed around to various pieces of code without worrying about coordinating access. This stipulation applies to all public fields and methods of this class and any added or overridden by subclasses.
-
-
Constructor Summary
Constructors Constructor and Description TrustAnchor(String caName, PublicKey pubKey, byte[] nameConstraints)
Creates an instance ofTrustAnchor
where the most-trusted CA is specified as a distinguished name and public key.TrustAnchor(X500Principal caPrincipal, PublicKey pubKey, byte[] nameConstraints)
Creates an instance ofTrustAnchor
where the most-trusted CA is specified as an X500Principal and public key.TrustAnchor(X509Certificate trustedCert, byte[] nameConstraints)
Creates an instance ofTrustAnchor
with the specifiedX509Certificate
and optional name constraints, which are intended to be used as additional constraints when validating an X.509 certification path.
-
Method Summary
Methods Modifier and Type Method and Description X500Principal
getCA()
Returns the name of the most-trusted CA as an X500Principal.String
getCAName()
Returns the name of the most-trusted CA in RFC 2253String
format.PublicKey
getCAPublicKey()
Returns the public key of the most-trusted CA.byte[]
getNameConstraints()
Returns the name constraints parameter.X509Certificate
getTrustedCert()
Returns the most-trusted CA certificate.String
toString()
Returns a formatted string describing theTrustAnchor
.
-
-
-
Constructor Detail
-
TrustAnchor
public TrustAnchor(X509Certificate trustedCert, byte[] nameConstraints)
Creates an instance ofTrustAnchor
with the specifiedX509Certificate
and optional name constraints, which are intended to be used as additional constraints when validating an X.509 certification path.The name constraints are specified as a byte array. This byte array should contain the DER encoded form of the name constraints, as they would appear in the NameConstraints structure defined in RFC 3280 and X.509. The ASN.1 definition of this structure appears below.
NameConstraints ::= SEQUENCE { permittedSubtrees [0] GeneralSubtrees OPTIONAL, excludedSubtrees [1] GeneralSubtrees OPTIONAL } GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree GeneralSubtree ::= SEQUENCE { base GeneralName, minimum [0] BaseDistance DEFAULT 0, maximum [1] BaseDistance OPTIONAL } BaseDistance ::= INTEGER (0..MAX) GeneralName ::= CHOICE { otherName [0] OtherName, rfc822Name [1] IA5String, dNSName [2] IA5String, x400Address [3] ORAddress, directoryName [4] Name, ediPartyName [5] EDIPartyName, uniformResourceIdentifier [6] IA5String, iPAddress [7] OCTET STRING, registeredID [8] OBJECT IDENTIFIER}
Note that the name constraints byte array supplied is cloned to protect against subsequent modifications.
- Parameters:
trustedCert
- a trustedX509Certificate
nameConstraints
- a byte array containing the ASN.1 DER encoding of a NameConstraints extension to be used for checking name constraints. Only the value of the extension is included, not the OID or criticality flag. Specifynull
to omit the parameter.- Throws:
IllegalArgumentException
- if the name constraints cannot be decodedNullPointerException
- if the specifiedX509Certificate
isnull
-
TrustAnchor
public TrustAnchor(X500Principal caPrincipal, PublicKey pubKey, byte[] nameConstraints)
Creates an instance ofTrustAnchor
where the most-trusted CA is specified as an X500Principal and public key. Name constraints are an optional parameter, and are intended to be used as additional constraints when validating an X.509 certification path.The name constraints are specified as a byte array. This byte array contains the DER encoded form of the name constraints, as they would appear in the NameConstraints structure defined in RFC 3280 and X.509. The ASN.1 notation for this structure is supplied in the documentation for
TrustAnchor(X509Certificate trustedCert, byte[] nameConstraints)
.Note that the name constraints byte array supplied here is cloned to protect against subsequent modifications.
- Parameters:
caPrincipal
- the name of the most-trusted CA as X500PrincipalpubKey
- the public key of the most-trusted CAnameConstraints
- a byte array containing the ASN.1 DER encoding of a NameConstraints extension to be used for checking name constraints. Only the value of the extension is included, not the OID or criticality flag. Specifynull
to omit the parameter.- Throws:
NullPointerException
- if the specifiedcaPrincipal
orpubKey
parameter isnull
- Since:
- 1.5
-
TrustAnchor
public TrustAnchor(String caName, PublicKey pubKey, byte[] nameConstraints)
Creates an instance ofTrustAnchor
where the most-trusted CA is specified as a distinguished name and public key. Name constraints are an optional parameter, and are intended to be used as additional constraints when validating an X.509 certification path.The name constraints are specified as a byte array. This byte array contains the DER encoded form of the name constraints, as they would appear in the NameConstraints structure defined in RFC 3280 and X.509. The ASN.1 notation for this structure is supplied in the documentation for
TrustAnchor(X509Certificate trustedCert, byte[] nameConstraints)
.Note that the name constraints byte array supplied here is cloned to protect against subsequent modifications.
- Parameters:
caName
- the X.500 distinguished name of the most-trusted CA in RFC 2253String
formatpubKey
- the public key of the most-trusted CAnameConstraints
- a byte array containing the ASN.1 DER encoding of a NameConstraints extension to be used for checking name constraints. Only the value of the extension is included, not the OID or criticality flag. Specifynull
to omit the parameter.- Throws:
IllegalArgumentException
- if the specifiedcaName
parameter is empty(caName.length() == 0)
or incorrectly formatted or the name constraints cannot be decodedNullPointerException
- if the specifiedcaName
orpubKey
parameter isnull
-
-
Method Detail
-
getTrustedCert
public final X509Certificate getTrustedCert()
Returns the most-trusted CA certificate.- Returns:
- a trusted
X509Certificate
ornull
if the trust anchor was not specified as a trusted certificate
-
getCA
public final X500Principal getCA()
Returns the name of the most-trusted CA as an X500Principal.- Returns:
- the X.500 distinguished name of the most-trusted CA, or
null
if the trust anchor was not specified as a trusted public key and name or X500Principal pair - Since:
- 1.5
-
getCAName
public final String getCAName()
Returns the name of the most-trusted CA in RFC 2253String
format.- Returns:
- the X.500 distinguished name of the most-trusted CA, or
null
if the trust anchor was not specified as a trusted public key and name or X500Principal pair
-
getCAPublicKey
public final PublicKey getCAPublicKey()
Returns the public key of the most-trusted CA.- Returns:
- the public key of the most-trusted CA, or
null
if the trust anchor was not specified as a trusted public key and name or X500Principal pair
-
getNameConstraints
public final byte[] getNameConstraints()
Returns the name constraints parameter. The specified name constraints are associated with this trust anchor and are intended to be used as additional constraints when validating an X.509 certification path.The name constraints are returned as a byte array. This byte array contains the DER encoded form of the name constraints, as they would appear in the NameConstraints structure defined in RFC 3280 and X.509. The ASN.1 notation for this structure is supplied in the documentation for
TrustAnchor(X509Certificate trustedCert, byte[] nameConstraints)
.Note that the byte array returned is cloned to protect against subsequent modifications.
- Returns:
- a byte array containing the ASN.1 DER encoding of
a NameConstraints extension used for checking name constraints,
or
null
if not set.
-
-
Traduction non disponible
Les API Java ne sont pas encore traduites en français sur l'infobrol. Seule la version anglaise est disponible pour l'instant.
Version en cache
22/11/2024 03:16:19 Cette version de la page est en cache (à la date du 22/11/2024 03:16:19) afin d'accélérer le traitement. Vous pouvez activer le mode utilisateur dans le menu en haut pour afficher la dernère version de la page.Document créé le 30/08/2006, dernière modification le 04/03/2020
Source du document imprimé : https://www.gaudry.be/java-api-rf-java/security/cert/TrustAnchor.html
L'infobrol est un site personnel dont le contenu n'engage que moi. Le texte est mis à disposition sous licence CreativeCommons(BY-NC-SA). Plus d'info sur les conditions d'utilisation et sur l'auteur.
Références
Ces références et liens indiquent des documents consultés lors de la rédaction de cette page, ou qui peuvent apporter un complément d'information, mais les auteurs de ces sources ne peuvent être tenus responsables du contenu de cette page.
L'auteur de ce site est seul responsable de la manière dont sont présentés ici les différents concepts, et des libertés qui sont prises avec les ouvrages de référence. N'oubliez pas que vous devez croiser les informations de sources multiples afin de diminuer les risques d'erreurs.