Examples with CertPath java.security.cert.CertPath used on opensource projects

Example 86 with CertPath

use of java.security.cert.CertPath in project keycloak by keycloak.

the class JavaKeystoreKeyProvider method validateCertificateChain.

/**
 * <p>Validates the giving certificate chain represented by {@code certificates}. If the list of certificates is empty
 * or does not have at least 2 certificates (end-user certificate plus intermediary/root CAs) this method does nothing.
 *
 * <p>It should not be possible to import to keystores invalid chains though. So this is just an additional check
 * that we can reuse later for other purposes when the cert chain is also provided manually, in PEM.
 *
 * @param certificates
 */
private void validateCertificateChain(List<X509Certificate> certificates) throws GeneralSecurityException {
    if (certificates == null || certificates.isEmpty()) {
        return;
    }
    Set<TrustAnchor> anchors = new HashSet<>();
    // consider the last certificate in the chain as the most trusted cert
    anchors.add(new TrustAnchor(certificates.get(certificates.size() - 1), null));
    PKIXParameters params = new PKIXParameters(anchors);
    params.setRevocationEnabled(false);
    CertPath certPath = CertificateFactory.getInstance("X.509").generateCertPath(certificates);
    CertPathValidator validator = CertPathValidator.getInstance(CertPathValidator.getDefaultType());
    validator.validate(certPath, params);
}