Examples with PKIXCertPathBuilderResult java.security.cert.PKIXCertPathBuilderResult used on opensource projects

Example 16 with PKIXCertPathBuilderResult

use of java.security.cert.PKIXCertPathBuilderResult in project oxAuth by GluuFederation.

the class PathCertificateVerifier method verifyCertificate.

public PKIXCertPathBuilderResult verifyCertificate(X509Certificate certificate, List<X509Certificate> additionalCerts) {
    try {
        // Check for self-signed certificate
        if (!verifySelfSignedCertificate && isSelfSigned(certificate)) {
            log.error("The certificate is self-signed!");
            return null;
        }
        // Prepare a set of trusted root CA certificates and a set of
        // intermediate certificates
        Set<X509Certificate> trustedRootCerts = new HashSet<X509Certificate>();
        Set<X509Certificate> intermediateCerts = new HashSet<X509Certificate>();
        for (X509Certificate additionalCert : additionalCerts) {
            if (isSelfSigned(additionalCert)) {
                trustedRootCerts.add(additionalCert);
            } else {
                intermediateCerts.add(additionalCert);
            }
        }
        // Attempt to build the certification chain and verify it
        PKIXCertPathBuilderResult certPathBuilderResult = verifyCertificate(certificate, trustedRootCerts, intermediateCerts);
        // Check that first certificate is an EE certificate
        CertPath certPath = certPathBuilderResult.getCertPath();
        List<? extends Certificate> certList = certPath.getCertificates();
        X509Certificate cert = (X509Certificate) certList.get(0);
        if (cert.getBasicConstraints() != -1) {
            log.error("Target certificate is not an EE certificate!");
            return null;
        }
        // The chain is verified. Return it as a result
        return certPathBuilderResult;
    } catch (CertPathBuilderException ex) {
        log.error("Failed to build certificate path", ex);
    } catch (GeneralSecurityException ex) {
        log.error("Failed to build certificate path", ex);
    }
    return null;
}

Example 17 with PKIXCertPathBuilderResult

use of java.security.cert.PKIXCertPathBuilderResult in project oxAuth by GluuFederation.

the class PathCertificateVerifier method validate.

@Override
public ValidationStatus validate(X509Certificate certificate, List<X509Certificate> issuers, Date validationDate) {
    X509Certificate issuer = issuers.get(0);
    ValidationStatus status = new ValidationStatus(certificate, issuer, validationDate, ValidatorSourceType.CHAIN, CertificateValidity.UNKNOWN);
    try {
        ArrayList<X509Certificate> chains = new ArrayList<X509Certificate>();
        chains.add(certificate);
        chains.addAll(issuers);
        Principal subjectX500Principal = certificate.getSubjectX500Principal();
        PKIXCertPathBuilderResult certPathResult = verifyCertificate(certificate, chains);
        if (certPathResult == null) {
            log.warn("Chain status is not valid for '" + subjectX500Principal + "'");
            status.setValidity(CertificateValidity.INVALID);
            return status;
        }
        log.debug("Chain status is valid for '" + subjectX500Principal + "'");
        status.setValidity(CertificateValidity.VALID);
    } catch (Exception ex) {
        log.error("OCSP exception: ", ex);
    }
    return status;
}