Examples with ExtCertPathValidatorException com.github.zhenwei.provider.jce.exception.ExtCertPathValidatorException used on opensource projects

Example 21 with ExtCertPathValidatorException

use of com.github.zhenwei.provider.jce.exception.ExtCertPathValidatorException in project LinLong-Java by zhenwei1108.

the class RFC3280CertPathUtilities method prepareNextCertG.

protected static void prepareNextCertG(CertPath certPath, int index, PKIXNameConstraintValidator nameConstraintValidator) throws CertPathValidatorException {
    List certs = certPath.getCertificates();
    X509Certificate cert = (X509Certificate) certs.get(index);
    // 
    // (g) handle the name constraints extension
    // 
    NameConstraints nc = null;
    try {
        ASN1Sequence ncSeq = ASN1Sequence.getInstance(CertPathValidatorUtilities.getExtensionValue(cert, RFC3280CertPathUtilities.NAME_CONSTRAINTS));
        if (ncSeq != null) {
            nc = NameConstraints.getInstance(ncSeq);
        }
    } catch (Exception e) {
        throw new ExtCertPathValidatorException("Name constraints extension could not be decoded.", e, certPath, index);
    }
    if (nc != null) {
        // 
        // (g) (1) permitted subtrees
        // 
        GeneralSubtree[] permitted = nc.getPermittedSubtrees();
        if (permitted != null) {
            try {
                nameConstraintValidator.intersectPermittedSubtree(permitted);
            } catch (Exception ex) {
                throw new ExtCertPathValidatorException("Permitted subtrees cannot be build from name constraints extension.", ex, certPath, index);
            }
        }
        // 
        // (g) (2) excluded subtrees
        // 
        GeneralSubtree[] excluded = nc.getExcludedSubtrees();
        if (excluded != null) {
            for (int i = 0; i != excluded.length; i++) {
                try {
                    nameConstraintValidator.addExcludedSubtree(excluded[i]);
                } catch (Exception ex) {
                    throw new ExtCertPathValidatorException("Excluded subtrees cannot be build from name constraints extension.", ex, certPath, index);
                }
            }
        }
    }
}

Example 22 with ExtCertPathValidatorException

use of com.github.zhenwei.provider.jce.exception.ExtCertPathValidatorException in project LinLong-Java by zhenwei1108.

the class RFC3280CertPathUtilities method processCertA.

protected static void processCertA(CertPath certPath, PKIXExtendedParameters paramsPKIX, Date validityDate, PKIXCertRevocationChecker revocationChecker, int index, PublicKey workingPublicKey, boolean verificationAlreadyPerformed, X500Name workingIssuerName, X509Certificate sign) throws CertPathValidatorException {
    List certs = certPath.getCertificates();
    X509Certificate cert = (X509Certificate) certs.get(index);
    // 
    if (!verificationAlreadyPerformed) {
        try {
            // (a) (1)
            // 
            CertPathValidatorUtilities.verifyX509Certificate(cert, workingPublicKey, paramsPKIX.getSigProvider());
        } catch (GeneralSecurityException e) {
            throw new ExtCertPathValidatorException("Could not validate certificate signature.", e, certPath, index);
        }
    }
    final Date validCertDate;
    try {
        validCertDate = CertPathValidatorUtilities.getValidCertDateFromValidityModel(validityDate, paramsPKIX.getValidityModel(), certPath, index);
    } catch (AnnotatedException e) {
        throw new ExtCertPathValidatorException("Could not validate time of certificate.", e, certPath, index);
    }
    // 
    try {
        cert.checkValidity(validCertDate);
    } catch (CertificateExpiredException e) {
        throw new ExtCertPathValidatorException("Could not validate certificate: " + e.getMessage(), e, certPath, index);
    } catch (CertificateNotYetValidException e) {
        throw new ExtCertPathValidatorException("Could not validate certificate: " + e.getMessage(), e, certPath, index);
    }
    // 
    if (revocationChecker != null) {
        revocationChecker.initialize(new PKIXCertRevocationCheckerParameters(paramsPKIX, validCertDate, certPath, index, sign, workingPublicKey));
        revocationChecker.check(cert);
    }
    // 
    // (a) (4) name chaining
    // 
    X500Name issuer = PrincipalUtils.getIssuerPrincipal(cert);
    if (!issuer.equals(workingIssuerName)) {
        throw new ExtCertPathValidatorException("IssuerName(" + issuer + ") does not match SubjectName(" + workingIssuerName + ") of signing certificate.", null, certPath, index);
    }
}

Example 23 with ExtCertPathValidatorException

use of com.github.zhenwei.provider.jce.exception.ExtCertPathValidatorException in project LinLong-Java by zhenwei1108.

the class RFC3280CertPathUtilities method prepareNextCertI1.

protected static int prepareNextCertI1(CertPath certPath, int index, int explicitPolicy) throws CertPathValidatorException {
    List certs = certPath.getCertificates();
    X509Certificate cert = (X509Certificate) certs.get(index);
    // 
    // (i)
    // 
    ASN1Sequence pc = null;
    try {
        pc = ASN1Sequence.getInstance(CertPathValidatorUtilities.getExtensionValue(cert, RFC3280CertPathUtilities.POLICY_CONSTRAINTS));
    } catch (Exception e) {
        throw new ExtCertPathValidatorException("Policy constraints extension cannot be decoded.", e, certPath, index);
    }
    int tmpInt;
    if (pc != null) {
        Enumeration policyConstraints = pc.getObjects();
        while (policyConstraints.hasMoreElements()) {
            try {
                ASN1TaggedObject constraint = ASN1TaggedObject.getInstance(policyConstraints.nextElement());
                if (constraint.getTagNo() == 0) {
                    tmpInt = ASN1Integer.getInstance(constraint, false).intValueExact();
                    if (tmpInt < explicitPolicy) {
                        return tmpInt;
                    }
                    break;
                }
            } catch (IllegalArgumentException e) {
                throw new ExtCertPathValidatorException("Policy constraints extension contents cannot be decoded.", e, certPath, index);
            }
        }
    }
    return explicitPolicy;
}

Example 24 with ExtCertPathValidatorException

use of com.github.zhenwei.provider.jce.exception.ExtCertPathValidatorException in project LinLong-Java by zhenwei1108.

the class RFC3280CertPathUtilities method prepareNextCertK.

protected static void prepareNextCertK(CertPath certPath, int index) throws CertPathValidatorException {
    List certs = certPath.getCertificates();
    X509Certificate cert = (X509Certificate) certs.get(index);
    // 
    // (k)
    // 
    BasicConstraints bc = null;
    try {
        bc = BasicConstraints.getInstance(CertPathValidatorUtilities.getExtensionValue(cert, RFC3280CertPathUtilities.BASIC_CONSTRAINTS));
    } catch (Exception e) {
        throw new ExtCertPathValidatorException("Basic constraints extension cannot be decoded.", e, certPath, index);
    }
    if (bc != null) {
        if (!(bc.isCA())) {
            throw new CertPathValidatorException("Not a CA certificate", null, certPath, index);
        }
    } else {
        throw new CertPathValidatorException("Intermediate certificate lacks BasicConstraints", null, certPath, index);
    }
}

Example 25 with ExtCertPathValidatorException

use of com.github.zhenwei.provider.jce.exception.ExtCertPathValidatorException in project LinLong-Java by zhenwei1108.

the class RFC3280CertPathUtilities method wrapupCertG.

protected static PKIXPolicyNode wrapupCertG(CertPath certPath, PKIXExtendedParameters paramsPKIX, Set userInitialPolicySet, int index, List[] policyNodes, PKIXPolicyNode validPolicyTree, Set acceptablePolicies) throws CertPathValidatorException {
    int n = certPath.getCertificates().size();
    // 
    // (g)
    // 
    PKIXPolicyNode intersection;
    // 
    if (validPolicyTree == null) {
        if (paramsPKIX.isExplicitPolicyRequired()) {
            throw new ExtCertPathValidatorException("Explicit policy requested but none available.", null, certPath, index);
        }
        intersection = null;
    } else if (// (g)
    CertPathValidatorUtilities.isAnyPolicy(userInitialPolicySet)) // (ii)
    {
        if (paramsPKIX.isExplicitPolicyRequired()) {
            if (acceptablePolicies.isEmpty()) {
                throw new ExtCertPathValidatorException("Explicit policy requested but none available.", null, certPath, index);
            } else {
                Set _validPolicyNodeSet = new HashSet();
                for (int j = 0; j < policyNodes.length; j++) {
                    List _nodeDepth = policyNodes[j];
                    for (int k = 0; k < _nodeDepth.size(); k++) {
                        PKIXPolicyNode _node = (PKIXPolicyNode) _nodeDepth.get(k);
                        if (RFC3280CertPathUtilities.ANY_POLICY.equals(_node.getValidPolicy())) {
                            Iterator _iter = _node.getChildren();
                            while (_iter.hasNext()) {
                                _validPolicyNodeSet.add(_iter.next());
                            }
                        }
                    }
                }
                Iterator _vpnsIter = _validPolicyNodeSet.iterator();
                while (_vpnsIter.hasNext()) {
                    PKIXPolicyNode _node = (PKIXPolicyNode) _vpnsIter.next();
                    String _validPolicy = _node.getValidPolicy();
                    if (!acceptablePolicies.contains(_validPolicy)) {
                    // validPolicyTree =
                    // removePolicyNode(validPolicyTree, policyNodes,
                    // _node);
                    }
                }
                if (validPolicyTree != null) {
                    for (int j = (n - 1); j >= 0; j--) {
                        List nodes = policyNodes[j];
                        for (int k = 0; k < nodes.size(); k++) {
                            PKIXPolicyNode node = (PKIXPolicyNode) nodes.get(k);
                            if (!node.hasChildren()) {
                                validPolicyTree = CertPathValidatorUtilities.removePolicyNode(validPolicyTree, policyNodes, node);
                            }
                        }
                    }
                }
            }
        }
        intersection = validPolicyTree;
    } else {
        // 
        // (g) (iii)
        // 
        // This implementation is not exactly same as the one described in
        // RFC3280.
        // However, as far as the validation result is concerned, both
        // produce
        // adequate result. The only difference is whether AnyPolicy is
        // remain
        // in the policy tree or not.
        // 
        // (g) (iii) 1
        // 
        Set _validPolicyNodeSet = new HashSet();
        for (int j = 0; j < policyNodes.length; j++) {
            List _nodeDepth = policyNodes[j];
            for (int k = 0; k < _nodeDepth.size(); k++) {
                PKIXPolicyNode _node = (PKIXPolicyNode) _nodeDepth.get(k);
                if (RFC3280CertPathUtilities.ANY_POLICY.equals(_node.getValidPolicy())) {
                    Iterator _iter = _node.getChildren();
                    while (_iter.hasNext()) {
                        PKIXPolicyNode _c_node = (PKIXPolicyNode) _iter.next();
                        if (!RFC3280CertPathUtilities.ANY_POLICY.equals(_c_node.getValidPolicy())) {
                            _validPolicyNodeSet.add(_c_node);
                        }
                    }
                }
            }
        }
        // 
        // (g) (iii) 2
        // 
        Iterator _vpnsIter = _validPolicyNodeSet.iterator();
        while (_vpnsIter.hasNext()) {
            PKIXPolicyNode _node = (PKIXPolicyNode) _vpnsIter.next();
            String _validPolicy = _node.getValidPolicy();
            if (!userInitialPolicySet.contains(_validPolicy)) {
                validPolicyTree = CertPathValidatorUtilities.removePolicyNode(validPolicyTree, policyNodes, _node);
            }
        }
        // 
        if (validPolicyTree != null) {
            for (int j = (n - 1); j >= 0; j--) {
                List nodes = policyNodes[j];
                for (int k = 0; k < nodes.size(); k++) {
                    PKIXPolicyNode node = (PKIXPolicyNode) nodes.get(k);
                    if (!node.hasChildren()) {
                        validPolicyTree = CertPathValidatorUtilities.removePolicyNode(validPolicyTree, policyNodes, node);
                    }
                }
            }
        }
        intersection = validPolicyTree;
    }
    return intersection;
}