Examples with CollectionCertStoreParameters java.security.cert.CollectionCertStoreParameters used on opensource projects

Example 26 with CollectionCertStoreParameters

use of java.security.cert.CollectionCertStoreParameters in project j2objc by google.

the class CollectionCertStoreParametersTest method testClone01.

/**
 * Test #1 for <code>clone()</code> method<br>
 */
public final void testClone01() {
    Vector<Certificate> certificates = new Vector<Certificate>();
    certificates.add(new MyCertificate("TEST", new byte[] { (byte) 4 }));
    CollectionCertStoreParameters cp1 = new CollectionCertStoreParameters(certificates);
    CollectionCertStoreParameters cp2 = (CollectionCertStoreParameters) cp1.clone();
    // check that that we have new object
    assertTrue(cp1 != cp2);
}

Example 27 with CollectionCertStoreParameters

use of java.security.cert.CollectionCertStoreParameters in project cloudstack by apache.

the class CertServiceImpl method validateChain.

private void validateChain(final List<Certificate> chain, final Certificate cert, boolean revocationEnabled) {
    final List<Certificate> certs = new ArrayList<Certificate>();
    final Set<TrustAnchor> anchors = new HashSet<TrustAnchor>();
    // adding for self signed certs
    certs.add(cert);
    certs.addAll(chain);
    for (final Certificate c : certs) {
        if (!(c instanceof X509Certificate)) {
            throw new IllegalArgumentException("Invalid chain format. Expected X509 certificate");
        }
        final X509Certificate xCert = (X509Certificate) c;
        anchors.add(new TrustAnchor(xCert, null));
    }
    final X509CertSelector target = new X509CertSelector();
    target.setCertificate((X509Certificate) cert);
    PKIXBuilderParameters params = null;
    try {
        params = new PKIXBuilderParameters(anchors, target);
        params.setRevocationEnabled(revocationEnabled);
        params.addCertStore(CertStore.getInstance("Collection", new CollectionCertStoreParameters(certs)));
        final CertPathBuilder builder = CertPathBuilder.getInstance("PKIX", "BC");
        builder.build(params);
    } catch (final InvalidAlgorithmParameterException | CertPathBuilderException | NoSuchAlgorithmException e) {
        throw new IllegalStateException("Invalid certificate chain", e);
    } catch (final NoSuchProviderException e) {
        throw new CloudRuntimeException("No provider for certificate validation", e);
    }
}

Example 28 with CollectionCertStoreParameters

use of java.security.cert.CollectionCertStoreParameters in project tomcat by apache.

the class SSLUtilBase method getParameters.

/**
 * Return the initialization parameters for the TrustManager.
 * Currently, only the default <code>PKIX</code> is supported.
 *
 * @param crlf The path to the CRL file.
 * @param trustStore The configured TrustStore.
 * @param revocationEnabled Should the JSSE provider perform revocation
 *                          checks? Ignored if {@code crlf} is non-null.
 *                          Configuration of revocation checks are expected
 *                          to be via proprietary JSSE provider methods.
 * @return The parameters including the CRLs and TrustStore.
 * @throws Exception An error occurred
 */
protected CertPathParameters getParameters(String crlf, KeyStore trustStore, boolean revocationEnabled) throws Exception {
    PKIXBuilderParameters xparams = new PKIXBuilderParameters(trustStore, new X509CertSelector());
    if (crlf != null && crlf.length() > 0) {
        Collection<? extends CRL> crls = getCRLs(crlf);
        CertStoreParameters csp = new CollectionCertStoreParameters(crls);
        CertStore store = CertStore.getInstance("Collection", csp);
        xparams.addCertStore(store);
        xparams.setRevocationEnabled(true);
    } else {
        xparams.setRevocationEnabled(revocationEnabled);
    }
    xparams.setMaxPathLength(sslHostConfig.getCertificateVerificationDepth());
    return xparams;
}

Example 29 with CollectionCertStoreParameters

use of java.security.cert.CollectionCertStoreParameters in project open-ecard by ecsec.

the class SignatureVerifier method validatePath.

private PKIXCertPathBuilderResult validatePath(X509Certificate cert, Collection<X509Certificate> intermediateCerts, @Nullable Date checkDate) throws NoSuchAlgorithmException, KeyStoreException, InvalidAlgorithmParameterException, CertPathBuilderException {
    // enable downloading of missing certificates based on the AIA extension
    try {
        System.setProperty("com.sun.security.enableAIAcaIssuers", "true");
    } catch (SecurityException ex) {
        LOG.warn("Failed to enable AIA evaluation. Skipping downloads of missing certificates.");
    }
    CertPathBuilder builder = CertPathBuilder.getInstance("PKIX");
    // configure path building
    X509CertSelector target = new X509CertSelector();
    target.setCertificate(cert);
    PKIXBuilderParameters params = new PKIXBuilderParameters(trustStore, target);
    CertStoreParameters intermediates = new CollectionCertStoreParameters(intermediateCerts);
    params.addCertStore(CertStore.getInstance("Collection", intermediates));
    params.setDate(checkDate);
    params.setRevocationEnabled(false);
    if (ChipGatewayProperties.isRevocationCheck()) {
        PKIXRevocationChecker revChecker = (PKIXRevocationChecker) builder.getRevocationChecker();
        Set<PKIXRevocationChecker.Option> revOpts = new HashSet<>();
        // revOpts.add(PKIXRevocationChecker.Option.ONLY_END_ENTITY);
        revChecker.setOptions(revOpts);
        params.setCertPathCheckers(null);
        params.addCertPathChecker(revChecker);
    }
    // try to build the path
    PKIXCertPathBuilderResult r = (PKIXCertPathBuilderResult) builder.build(params);
    return r;
}

Example 30 with CollectionCertStoreParameters

use of java.security.cert.CollectionCertStoreParameters in project cosmic by MissionCriticalCloud.

the class CertServiceImpl method validateChain.

private void validateChain(final List<Certificate> chain, final Certificate cert) {
    final List<Certificate> certs = new ArrayList<>();
    final Set<TrustAnchor> anchors = new HashSet<>();
    // adding for self signed certs
    certs.add(cert);
    certs.addAll(chain);
    for (final Certificate c : certs) {
        if (!(c instanceof X509Certificate)) {
            throw new IllegalArgumentException("Invalid chain format. Expected X509 certificate");
        }
        final X509Certificate xCert = (X509Certificate) c;
        final Principal subject = xCert.getSubjectDN();
        final Principal issuer = xCert.getIssuerDN();
        anchors.add(new TrustAnchor(xCert, null));
    }
    final X509CertSelector target = new X509CertSelector();
    target.setCertificate((X509Certificate) cert);
    PKIXBuilderParameters params = null;
    try {
        params = new PKIXBuilderParameters(anchors, target);
        params.setRevocationEnabled(false);
        params.addCertStore(CertStore.getInstance("Collection", new CollectionCertStoreParameters(certs)));
        final CertPathBuilder builder = CertPathBuilder.getInstance("PKIX", "BC");
        builder.build(params);
    } catch (final InvalidAlgorithmParameterException e) {
        throw new IllegalArgumentException("Invalid certificate chain", e);
    } catch (final CertPathBuilderException e) {
        throw new IllegalArgumentException("Invalid certificate chain", e);
    } catch (final NoSuchAlgorithmException e) {
        throw new IllegalArgumentException("Invalid certificate chain", e);
    } catch (final NoSuchProviderException e) {
        throw new CloudRuntimeException("No provider for certificate validation", e);
    }
}