Examples with TrustAnchor java.security.cert.TrustAnchor used on opensource projects

Example 66 with TrustAnchor

use of java.security.cert.TrustAnchor in project nhin-d by DirectProject.

the class TrustChainValidator method isTrusted.

/**
	 * Indicates if a certificate is considered to be trusted by resolving a valid certificate trust chain with the provided anchors.
	 * @param certificate The certificate to check.
	 * @param anchors A list of trust anchors used to check the trust chain.
	 * @return Returns true if the certificate can find a valid trust chain in the collection of anchors.  False otherwise.
	 */
public boolean isTrusted(X509Certificate certificate, Collection<X509Certificate> anchors) {
    if (certificate == null)
        throw new IllegalArgumentException();
    if (anchors == null || anchors.size() == 0)
        // no anchors... conspiracy theory?  trust no one    
        return false;
    try {
        // check if the certificate is in the list of anchors... this is a valid trust model
        if (isIssuerInAnchors(anchors, certificate))
            return true;
        CertPath certPath = null;
        CertificateFactory factory = CertificateFactory.getInstance("X509");
        List<Certificate> certs = new ArrayList<Certificate>();
        certs.add(certificate);
        // check for intermediates
        if (certResolvers != null) {
            Collection<X509Certificate> intermediatesCerts = resolveIntermediateIssuers(certificate, anchors);
            if (intermediatesCerts != null && intermediatesCerts.size() > 0)
                certs.addAll(intermediatesCerts);
        }
        Set<TrustAnchor> trustAnchorSet = new HashSet<TrustAnchor>();
        for (X509Certificate archor : anchors) trustAnchorSet.add(new TrustAnchor(archor, null));
        PKIXParameters params = new PKIXParameters(trustAnchorSet);
        /*
        	 *  Disable CRL checking in cert path validation for now until a better implementation is put together
        	 */
        params.setRevocationEnabled(false);
        // JCE will only allow OSCP checking when revocation checking is enabled
        // however some implementations will fail if revocation checking is turned on, but the CRL
        // extension does not exist. for compatibility reasons, only turn this on if CRL extension points are defined
        /*
        	params.setRevocationEnabled(CRLRevocationManager.isCRLDispPointDefined(certificate));
	        {
	        	// populate the CRL store from the revocation manager
	        	CRLRevocationManager mgr = CRLRevocationManager.getInstance();
	        	Set<CRL> crls = mgr.getCRLCollection();
	        	
	        	CertStore crlStore = CertStore.getInstance("Collection", new CollectionCertStoreParameters(crls), CryptoExtensions.getJCEProviderName()); 
	        	params.addCertStore(crlStore);
	        }
            */
        certPath = factory.generateCertPath(certs);
        CertPathValidator pathValidator = CertPathValidator.getInstance("PKIX", CryptoExtensions.getJCEProviderNameForTypeAndAlgorithm("CertPathValidator", "PKIX"));
        pathValidator.validate(certPath, params);
        return true;
    } catch (Exception e) {
        LOGGER.warn("Certificate " + certificate.getSubjectX500Principal().getName() + " is not trusted.", e);
    }
    return false;
}

Example 67 with TrustAnchor

use of java.security.cert.TrustAnchor in project robovm by robovm.

the class myTrustManagerFactory method test_initLjavax_net_ssl_ManagerFactoryParameters.

/**
     * Test for <code>init(ManagerFactoryParameters params)</code>
     * Assertion:
     * throws InvalidAlgorithmParameterException when params is null
     */
@KnownFailure("ManagerFactoryParameters object is not supported " + "and InvalidAlgorithmParameterException was thrown.")
public void test_initLjavax_net_ssl_ManagerFactoryParameters() throws Exception {
    ManagerFactoryParameters par = null;
    TrustManagerFactory[] trustMF = createTMFac();
    assertNotNull("TrustManagerFactory objects were not created", trustMF);
    for (int i = 0; i < trustMF.length; i++) {
        try {
            trustMF[i].init(par);
            fail("InvalidAlgorithmParameterException must be thrown");
        } catch (InvalidAlgorithmParameterException e) {
        }
    }
    String keyAlg = "DSA";
    String validCaNameRfc2253 = ("CN=Test CA," + "OU=Testing Division," + "O=Test It All," + "L=Test Town," + "ST=Testifornia," + "C=Testland");
    try {
        KeyStore kStore = KeyStore.getInstance(KeyStore.getDefaultType());
        kStore.load(null, null);
        PublicKey pk = new TestKeyPair(keyAlg).getPublic();
        TrustAnchor ta = new TrustAnchor(validCaNameRfc2253, pk, getFullEncoding());
        Set<TrustAnchor> trustAnchors = new HashSet<TrustAnchor>();
        trustAnchors.add(ta);
        X509CertSelector xcs = new X509CertSelector();
        PKIXBuilderParameters pkixBP = new PKIXBuilderParameters(trustAnchors, xcs);
        CertPathTrustManagerParameters cptmp = new CertPathTrustManagerParameters(pkixBP);
        TrustManagerFactory tmf = TrustManagerFactory.getInstance(getDefaultAlgorithm());
        try {
            tmf.init(cptmp);
        } catch (Exception ex) {
            fail(ex + " was thrown for init(ManagerFactoryParameters spec)");
        }
    } catch (Exception e) {
        fail("Unexpected exception for configuration: " + e);
    }
}

Example 68 with TrustAnchor

use of java.security.cert.TrustAnchor in project robovm by robovm.

the class X509CertSelectorTest method buildCertPath.

private CertPath buildCertPath() throws InvalidAlgorithmParameterException {
    PKIXCertPathBuilderResult result = null;
    PKIXBuilderParameters buildParams = new PKIXBuilderParameters(Collections.singleton(new TrustAnchor(rootCertificate, null)), theCertSelector);
    try {
        result = (PKIXCertPathBuilderResult) builder.build(buildParams);
    } catch (CertPathBuilderException e) {
        return null;
    }
    return result.getCertPath();
}

Example 69 with TrustAnchor

use of java.security.cert.TrustAnchor in project robovm by robovm.

the class TrustAnchorTest method testGetCAName01.

/**
     * Test #1 for <code>getCAName()</code> method<br>
     *
     * Assertion: returns most trusted CA name as <code>String</code><br>
     * Test preconditions: valid name passed to the constructor<br>
     * Expected: the same name must be returned by the method<br>
     * @throws InvalidKeySpecException
     */
public final void testGetCAName01() throws Exception {
    PublicKey pk = new TestKeyPair(keyAlg).getPublic();
    // sub testcase 1
    TrustAnchor ta = new TrustAnchor(validCaNameRfc2253, pk, null);
    assertEquals("equals1", validCaNameRfc2253, ta.getCAName());
    // sub testcase 2
    X500Principal x500p = new X500Principal(validCaNameRfc2253);
    ta = new TrustAnchor(x500p, pk, null);
    assertEquals("equals2", validCaNameRfc2253, ta.getCAName());
}

Example 70 with TrustAnchor

use of java.security.cert.TrustAnchor in project robovm by robovm.

the class TrustAnchorTest method testTrustAnchorX500PrincipalPublicKeybyteArray03.

/**
     * Test #3 for <code>TrustAnchor(X500Principal, PublicKey, byte[])</code> constructor<br>
     * Assertion: nameConstraints cloned by the constructor<br>
     * Test preconditions: modify passed nameConstraints<br>
     * Expected: modification must not change object internal state
     * @throws InvalidKeySpecException
     */
public final void testTrustAnchorX500PrincipalPublicKeybyteArray03() throws Exception {
    PublicKey pk = new TestKeyPair(keyAlg).getPublic();
    byte[] nc = getEncodingPSOnly();
    byte[] ncCopy = nc.clone();
    // sub testcase 5 - nameConstraints can be null
    TrustAnchor ta = new TrustAnchor(new X500Principal(validCaNameRfc2253), pk, ncCopy);
    // modify
    ncCopy[0] = (byte) 0;
    // check that above modification did not change
    // object internal state
    assertTrue(Arrays.equals(nc, ta.getNameConstraints()));
}