java.security.cert

Class PKIXCertPathChecker

Table des matières
  • All Implemented Interfaces:
    Cloneable

    public abstract class PKIXCertPathChecker
extends Object
implements Cloneable
    An abstract class that performs one or more checks on an X509Certificate.

    A concrete implementation of the PKIXCertPathChecker class can be created to extend the PKIX certification path validation algorithm. For example, an implementation may check for and process a critical private extension of each certificate in a certification path.

    Instances of PKIXCertPathChecker are passed as parameters using the setCertPathCheckers or addCertPathChecker methods of the PKIXParameters and PKIXBuilderParameters class. Each of the PKIXCertPathCheckers check methods will be called, in turn, for each certificate processed by a PKIX CertPathValidator or CertPathBuilder implementation.

    A PKIXCertPathChecker may be called multiple times on successive certificates in a certification path. Concrete subclasses are expected to maintain any internal state that may be necessary to check successive certificates. The init method is used to initialize the internal state of the checker so that the certificates of a new certification path may be checked. A stateful implementation must override the clone method if necessary in order to allow a PKIX CertPathBuilder to efficiently backtrack and try other paths. In these situations, the CertPathBuilder is able to restore prior path validation states by restoring the cloned PKIXCertPathCheckers.

    The order in which the certificates are presented to the PKIXCertPathChecker may be either in the forward direction (from target to most-trusted CA) or in the reverse direction (from most-trusted CA to target). A PKIXCertPathChecker implementation must support reverse checking (the ability to perform its checks when it is presented with certificates in the reverse direction) and may support forward checking (the ability to perform its checks when it is presented with certificates in the forward direction). The isForwardCheckingSupported method indicates whether forward checking is supported.

    Additional input parameters required for executing the check may be specified through constructors of concrete implementations of this class.

    Concurrent Access

    Unless otherwise specified, the methods defined in this class are not thread-safe. Multiple threads that need to access a single object concurrently should synchronize amongst themselves and provide the necessary locking. Multiple threads each manipulating separate objects need not synchronize.

    Since:
    1.4
    See Also:
    PKIXParameters, PKIXBuilderParameters

    • Constructor Summary

      Constructors 
      Modifier Constructor and Description
      protected PKIXCertPathChecker()
      Default constructor.

        

    • Method Summary

      Methods 
      Modifier and Type Method and Description
      abstract void check(Certificate cert, Collection<String> unresolvedCritExts)
      Performs the check(s) on the specified certificate using its internal state and removes any critical extensions that it processes from the specified collection of OID strings that represent the unresolved critical extensions.
      Object clone()
      Returns a clone of this object.
      abstract Set<String> getSupportedExtensions()
      Returns an immutable Set of X.509 certificate extensions that this PKIXCertPathChecker supports (i.e.
      abstract void init(boolean forward)
      Initializes the internal state of this PKIXCertPathChecker.
      abstract boolean isForwardCheckingSupported()
      Indicates if forward checking is supported.

        

    • Constructor Detail

      • PKIXCertPathChecker

        protected PKIXCertPathChecker()
        Default constructor.

    • Method Detail

      • init

        public abstract void init(boolean forward)
                   throws CertPathValidatorException
        Initializes the internal state of this PKIXCertPathChecker.

        The forward flag specifies the order that certificates will be passed to the check method (forward or reverse). A PKIXCertPathChecker must support reverse checking and may support forward checking.

        Parameters:
        forward - the order that certificates are presented to the check method. If true, certificates are presented from target to most-trusted CA (forward); if false, from most-trusted CA to target (reverse).
        Throws:
        CertPathValidatorException - if this PKIXCertPathChecker is unable to check certificates in the specified order; it should never be thrown if the forward flag is false since reverse checking must be supported

      • isForwardCheckingSupported

        public abstract boolean isForwardCheckingSupported()
        Indicates if forward checking is supported. Forward checking refers to the ability of the PKIXCertPathChecker to perform its checks when certificates are presented to the check method in the forward direction (from target to most-trusted CA).
        Returns:
        true if forward checking is supported, false otherwise

      • getSupportedExtensions

        public abstract Set<String> getSupportedExtensions()
        Returns an immutable Set of X.509 certificate extensions that this PKIXCertPathChecker supports (i.e. recognizes, is able to process), or null if no extensions are supported.

        Each element of the set is a String representing the Object Identifier (OID) of the X.509 extension that is supported. The OID is represented by a set of nonnegative integers separated by periods.

        All X.509 certificate extensions that a PKIXCertPathChecker might possibly be able to process should be included in the set.

        Returns:
        an immutable Set of X.509 extension OIDs (in String format) supported by this PKIXCertPathChecker, or null if no extensions are supported

      • check

        public abstract void check(Certificate cert,
         Collection<String> unresolvedCritExts)
                    throws CertPathValidatorException
        Performs the check(s) on the specified certificate using its internal state and removes any critical extensions that it processes from the specified collection of OID strings that represent the unresolved critical extensions. The certificates are presented in the order specified by the init method.
        Parameters:
        cert - the Certificate to be checked
        unresolvedCritExts - a Collection of OID strings representing the current set of unresolved critical extensions
        Throws:
        CertPathValidatorException - if the specified certificate does not pass the check

      • clone

        public Object clone()
        Returns a clone of this object. Calls the Object.clone() method. All subclasses which maintain state must support and override this method, if necessary.
        Overrides:
        clone in class Object
        Returns:
        a copy of this PKIXCertPathChecker
        See Also:
        Cloneable

Traduction non disponible

Les API Java ne sont pas encore traduites en français sur l'infobrol. Seule la version anglaise est disponible pour l'instant.

Version en cache

31/12/2024 13:27:05 Cette version de la page est en cache (à la date du 31/12/2024 13:27:05) afin d'accélérer le traitement. Vous pouvez activer le mode utilisateur dans le menu en haut pour afficher la dernère version de la page.

Document créé le 01/09/2006, dernière modification le 04/03/2020
Source du document imprimé : https://www.gaudry.be/java-api-rf-java/security/cert/pkixcertpathchecker.html

L'infobrol est un site personnel dont le contenu n'engage que moi. Le texte est mis à disposition sous licence CreativeCommons(BY-NC-SA). Plus d'info sur les conditions d'utilisation et sur l'auteur.

Références

  1. Consulter le document html Langue du document :fr Manuel PHP : https://docs.oracle.com, PKIXCertPathChecker

Ces références et liens indiquent des documents consultés lors de la rédaction de cette page, ou qui peuvent apporter un complément d'information, mais les auteurs de ces sources ne peuvent être tenus responsables du contenu de cette page.
L'auteur de ce site est seul responsable de la manière dont sont présentés ici les différents concepts, et des libertés qui sont prises avec les ouvrages de référence. N'oubliez pas que vous devez croiser les informations de sources multiples afin de diminuer les risques d'erreurs.

Table des matières Haut