- java.lang.Object
-
- java.security.cert.X509CRLSelector
-
- All Implemented Interfaces:
- Cloneable, CRLSelector
public class X509CRLSelector extends Object implements CRLSelector
ACRLSelector
that selectsX509CRLs
that match all specified criteria. This class is particularly useful when selecting CRLs from aCertStore
to check revocation status of a particular certificate.When first constructed, an
X509CRLSelector
has no criteria enabled and each of theget
methods return a default value (null
). Therefore, thematch
method would returntrue
for anyX509CRL
. Typically, several criteria are enabled (by callingsetIssuers
orsetDateAndTime
, for instance) and then theX509CRLSelector
is passed toCertStore.getCRLs
or some similar method.Please refer to RFC 3280: Internet X.509 Public Key Infrastructure Certificate and CRL Profile for definitions of the X.509 CRL fields and extensions mentioned below.
Concurrent Access
Unless otherwise specified, the methods defined in this class are not thread-safe. Multiple threads that need to access a single object concurrently should synchronize amongst themselves and provide the necessary locking. Multiple threads each manipulating separate objects need not synchronize.
- Since:
- 1.4
- See Also:
CRLSelector
,X509CRL
-
-
Constructor Summary
Constructors Constructor and Description X509CRLSelector()
Creates anX509CRLSelector
.
-
Method Summary
Methods Modifier and Type Method and Description void
addIssuer(X500Principal issuer)
Adds a name to the issuerNames criterion.void
addIssuerName(byte[] name)
Adds a name to the issuerNames criterion.void
addIssuerName(String name)
Denigrated, use addIssuer(X500Principal) or addIssuerName(byte[]) instead.Object
clone()
Returns a copy of this object.X509Certificate
getCertificateChecking()
Returns the certificate being checked.Date
getDateAndTime()
Returns the dateAndTime criterion.Collection<Object>
getIssuerNames()
Returns a copy of the issuerNames criterion.Collection<X500Principal>
getIssuers()
Returns the issuerNames criterion.BigInteger
getMaxCRL()
Returns the maxCRLNumber criterion.BigInteger
getMinCRL()
Returns the minCRLNumber criterion.boolean
match(CRL crl)
Decides whether aCRL
should be selected.void
setCertificateChecking(X509Certificate cert)
Sets the certificate being checked.void
setDateAndTime(Date dateAndTime)
Sets the dateAndTime criterion.void
setIssuerNames(Collection<?> names)
Note: use setIssuers(Collection) instead or only specify the byte array form of distinguished names when using this method.void
setIssuers(Collection<X500Principal> issuers)
Sets the issuerNames criterion.void
setMaxCRLNumber(BigInteger maxCRL)
Sets the maxCRLNumber criterion.void
setMinCRLNumber(BigInteger minCRL)
Sets the minCRLNumber criterion.String
toString()
Returns a printable representation of theX509CRLSelector
.
-
-
-
Constructor Detail
-
X509CRLSelector
public X509CRLSelector()
Creates anX509CRLSelector
. Initially, no criteria are set so anyX509CRL
will match.
-
-
Method Detail
-
setIssuers
public void setIssuers(Collection<X500Principal> issuers)
Sets the issuerNames criterion. The issuer distinguished name in theX509CRL
must match at least one of the specified distinguished names. Ifnull
, any issuer distinguished name will do.This method allows the caller to specify, with a single method call, the complete set of issuer names which
X509CRLs
may contain. The specified value replaces the previous value for the issuerNames criterion.The
names
parameter (if notnull
) is aCollection
ofX500Principal
s.Note that the
names
parameter can contain duplicate distinguished names, but they may be removed from theCollection
of names returned by thegetIssuers
method.Note that a copy is performed on the
Collection
to protect against subsequent modifications.- Parameters:
issuers
- aCollection
of X500Principals (ornull
)- Since:
- 1.5
- See Also:
getIssuers()
-
setIssuerNames
public void setIssuerNames(Collection<?> names) throws IOException
Note: use setIssuers(Collection) instead or only specify the byte array form of distinguished names when using this method. SeeaddIssuerName(String)
for more information.Sets the issuerNames criterion. The issuer distinguished name in the
X509CRL
must match at least one of the specified distinguished names. Ifnull
, any issuer distinguished name will do.This method allows the caller to specify, with a single method call, the complete set of issuer names which
X509CRLs
may contain. The specified value replaces the previous value for the issuerNames criterion.The
names
parameter (if notnull
) is aCollection
of names. Each name is aString
or a byte array representing a distinguished name (in RFC 2253 or ASN.1 DER encoded form, respectively). Ifnull
is supplied as the value for this argument, no issuerNames check will be performed.Note that the
names
parameter can contain duplicate distinguished names, but they may be removed from theCollection
of names returned by thegetIssuerNames
method.If a name is specified as a byte array, it should contain a single DER encoded distinguished name, as defined in X.501. The ASN.1 notation for this structure is as follows.
Name ::= CHOICE { RDNSequence } RDNSequence ::= SEQUENCE OF RelativeDistinguishedName RelativeDistinguishedName ::= SET SIZE (1 .. MAX) OF AttributeTypeAndValue AttributeTypeAndValue ::= SEQUENCE { type AttributeType, value AttributeValue } AttributeType ::= OBJECT IDENTIFIER AttributeValue ::= ANY DEFINED BY AttributeType .... DirectoryString ::= CHOICE { teletexString TeletexString (SIZE (1..MAX)), printableString PrintableString (SIZE (1..MAX)), universalString UniversalString (SIZE (1..MAX)), utf8String UTF8String (SIZE (1.. MAX)), bmpString BMPString (SIZE (1..MAX)) }
Note that a deep copy is performed on the
Collection
to protect against subsequent modifications.- Parameters:
names
- aCollection
of names (ornull
)- Throws:
IOException
- if a parsing error occurs- See Also:
getIssuerNames()
-
addIssuer
public void addIssuer(X500Principal issuer)
Adds a name to the issuerNames criterion. The issuer distinguished name in theX509CRL
must match at least one of the specified distinguished names.This method allows the caller to add a name to the set of issuer names which
X509CRLs
may contain. The specified name is added to any previous value for the issuerNames criterion. If the specified name is a duplicate, it may be ignored.- Parameters:
issuer
- the issuer as X500Principal- Since:
- 1.5
-
addIssuerName
public void addIssuerName(String name) throws IOException
Denigrated, use addIssuer(X500Principal) or addIssuerName(byte[]) instead. This method should not be relied on as it can fail to match some CRLs because of a loss of encoding information in the RFC 2253 String form of some distinguished names.Adds a name to the issuerNames criterion. The issuer distinguished name in the
X509CRL
must match at least one of the specified distinguished names.This method allows the caller to add a name to the set of issuer names which
X509CRLs
may contain. The specified name is added to any previous value for the issuerNames criterion. If the specified name is a duplicate, it may be ignored.- Parameters:
name
- the name in RFC 2253 form- Throws:
IOException
- if a parsing error occurs
-
addIssuerName
public void addIssuerName(byte[] name) throws IOException
Adds a name to the issuerNames criterion. The issuer distinguished name in theX509CRL
must match at least one of the specified distinguished names.This method allows the caller to add a name to the set of issuer names which
X509CRLs
may contain. The specified name is added to any previous value for the issuerNames criterion. If the specified name is a duplicate, it may be ignored. If a name is specified as a byte array, it should contain a single DER encoded distinguished name, as defined in X.501. The ASN.1 notation for this structure is as follows.The name is provided as a byte array. This byte array should contain a single DER encoded distinguished name, as defined in X.501. The ASN.1 notation for this structure appears in the documentation for
setIssuerNames(Collection names)
.Note that the byte array supplied here is cloned to protect against subsequent modifications.
- Parameters:
name
- a byte array containing the name in ASN.1 DER encoded form- Throws:
IOException
- if a parsing error occurs
-
setMinCRLNumber
public void setMinCRLNumber(BigInteger minCRL)
Sets the minCRLNumber criterion. TheX509CRL
must have a CRL number extension whose value is greater than or equal to the specified value. Ifnull
, no minCRLNumber check will be done.- Parameters:
minCRL
- the minimum CRL number accepted (ornull
)
-
setMaxCRLNumber
public void setMaxCRLNumber(BigInteger maxCRL)
Sets the maxCRLNumber criterion. TheX509CRL
must have a CRL number extension whose value is less than or equal to the specified value. Ifnull
, no maxCRLNumber check will be done.- Parameters:
maxCRL
- the maximum CRL number accepted (ornull
)
-
setDateAndTime
public void setDateAndTime(Date dateAndTime)
Sets the dateAndTime criterion. The specified date must be equal to or later than the value of the thisUpdate component of theX509CRL
and earlier than the value of the nextUpdate component. There is no match if theX509CRL
does not contain a nextUpdate component. Ifnull
, no dateAndTime check will be done.Note that the
Date
supplied here is cloned to protect against subsequent modifications.- Parameters:
dateAndTime
- theDate
to match against (ornull
)- See Also:
getDateAndTime()
-
setCertificateChecking
public void setCertificateChecking(X509Certificate cert)
Sets the certificate being checked. This is not a criterion. Rather, it is optional information that may help aCertStore
find CRLs that would be relevant when checking revocation for the specified certificate. Ifnull
is specified, then no such optional information is provided.- Parameters:
cert
- theX509Certificate
being checked (ornull
)- See Also:
getCertificateChecking()
-
getIssuers
public Collection<X500Principal> getIssuers()
Returns the issuerNames criterion. The issuer distinguished name in theX509CRL
must match at least one of the specified distinguished names. If the value returned isnull
, any issuer distinguished name will do.If the value returned is not
null
, it is a unmodifiableCollection
ofX500Principal
s.- Returns:
- an unmodifiable
Collection
of names (ornull
) - Since:
- 1.5
- See Also:
setIssuers(java.util.Collection<javax.security.auth.x500.X500Principal>)
-
getIssuerNames
public Collection<Object> getIssuerNames()
Returns a copy of the issuerNames criterion. The issuer distinguished name in theX509CRL
must match at least one of the specified distinguished names. If the value returned isnull
, any issuer distinguished name will do.If the value returned is not
null
, it is aCollection
of names. Each name is aString
or a byte array representing a distinguished name (in RFC 2253 or ASN.1 DER encoded form, respectively). Note that theCollection
returned may contain duplicate names.If a name is specified as a byte array, it should contain a single DER encoded distinguished name, as defined in X.501. The ASN.1 notation for this structure is given in the documentation for
setIssuerNames(Collection names)
.Note that a deep copy is performed on the
Collection
to protect against subsequent modifications.- Returns:
- a
Collection
of names (ornull
) - See Also:
setIssuerNames(java.util.Collection<?>)
-
getMinCRL
public BigInteger getMinCRL()
Returns the minCRLNumber criterion. TheX509CRL
must have a CRL number extension whose value is greater than or equal to the specified value. Ifnull
, no minCRLNumber check will be done.- Returns:
- the minimum CRL number accepted (or
null
)
-
getMaxCRL
public BigInteger getMaxCRL()
Returns the maxCRLNumber criterion. TheX509CRL
must have a CRL number extension whose value is less than or equal to the specified value. Ifnull
, no maxCRLNumber check will be done.- Returns:
- the maximum CRL number accepted (or
null
)
-
getDateAndTime
public Date getDateAndTime()
Returns the dateAndTime criterion. The specified date must be equal to or later than the value of the thisUpdate component of theX509CRL
and earlier than the value of the nextUpdate component. There is no match if theX509CRL
does not contain a nextUpdate component. Ifnull
, no dateAndTime check will be done.Note that the
Date
returned is cloned to protect against subsequent modifications.- Returns:
- the
Date
to match against (ornull
) - See Also:
setDateAndTime(java.util.Date)
-
getCertificateChecking
public X509Certificate getCertificateChecking()
Returns the certificate being checked. This is not a criterion. Rather, it is optional information that may help aCertStore
find CRLs that would be relevant when checking revocation for the specified certificate. If the value returned isnull
, then no such optional information is provided.- Returns:
- the certificate being checked (or
null
) - See Also:
setCertificateChecking(java.security.cert.X509Certificate)
-
toString
public String toString()
Returns a printable representation of theX509CRLSelector
.
-
match
public boolean match(CRL crl)
Decides whether aCRL
should be selected.- Specified by:
match
in interfaceCRLSelector
- Parameters:
crl
- theCRL
to be checked- Returns:
true
if theCRL
should be selected,false
otherwise
-
-
Traduction non disponible
Les API Java ne sont pas encore traduites en français sur l'infobrol. Seule la version anglaise est disponible pour l'instant.
Version en cache
05/11/2024 17:22:12 Cette version de la page est en cache (à la date du 05/11/2024 17:22:12) afin d'accélérer le traitement. Vous pouvez activer le mode utilisateur dans le menu en haut pour afficher la dernère version de la page.Document créé le 31/08/2006, dernière modification le 04/03/2020
Source du document imprimé : https://www.gaudry.be/java-api-rf-java/security/cert/X509CRLSelector.html
L'infobrol est un site personnel dont le contenu n'engage que moi. Le texte est mis à disposition sous licence CreativeCommons(BY-NC-SA). Plus d'info sur les conditions d'utilisation et sur l'auteur.
Références
Ces références et liens indiquent des documents consultés lors de la rédaction de cette page, ou qui peuvent apporter un complément d'information, mais les auteurs de ces sources ne peuvent être tenus responsables du contenu de cette page.
L'auteur de ce site est seul responsable de la manière dont sont présentés ici les différents concepts, et des libertés qui sont prises avec les ouvrages de référence. N'oubliez pas que vous devez croiser les informations de sources multiples afin de diminuer les risques d'erreurs.