Java PKIXParameters.addCertPathChecker方法代码示例

import java.security.cert.PKIXParameters; //导入方法依赖的package包/类
private void validateNoCache(List<? extends X509Certificate> certs)
    throws SignatureException {
  try {
    CertPathValidator validator = CertPathValidator.getInstance(
        VALIDATOR_TYPE);
    PKIXParameters params = new PKIXParameters(trustRoots);
    params.addCertPathChecker(WAVE_OID_CHECKER);
    params.setDate(timeSource.now());

    // turn off default revocation-checking mechanism
    params.setRevocationEnabled(false);

    // TODO: add a way for clients to add certificate revocation checks,
    // perhaps by letting them pass in PKIXCertPathCheckers. This can also be
    // useful to check for Wave-specific certificate extensions.

    CertificateFactory certFactory = CertificateFactory.getInstance(
        CERTIFICATE_TYPE);
    CertPath certPath = certFactory.generateCertPath(certs);
    validator.validate(certPath, params);
  } catch (GeneralSecurityException e) {
    throw new SignatureException("Certificate validation failure", e);
  }
}
 

import java.security.cert.PKIXParameters; //导入方法依赖的package包/类
private static void runTest(CertificateFactory cf,
        List<X509Certificate> certList, TrustAnchor anchor)
        throws Exception {
    CertPath path = cf.generateCertPath(certList);
    CertPathValidator validator = CertPathValidator.getInstance("PKIX");

    System.out.println(anchor);

    // Attach the OCSP responses to a PKIXParameters object
    PKIXRevocationChecker pkrev =
            (PKIXRevocationChecker)validator.getRevocationChecker();
    Map<X509Certificate, byte[]> responseMap = new HashMap<>();
    responseMap.put(certList.get(0), DECODER.decode(EE_OCSP_RESP));
    responseMap.put(certList.get(1), DECODER.decode(INT_CA_OCSP_RESP));
    pkrev.setOcspResponses(responseMap);
    PKIXParameters params =
            new PKIXParameters(Collections.singleton(anchor));
    params.addCertPathChecker(pkrev);
    params.setDate(EVAL_DATE);

    validator.validate(path, params);
}
 

import java.security.cert.PKIXParameters; //导入方法依赖的package包/类
/**
 * Test #1 for <code>addCertPathChecker(PKIXCertPathChecker)</code> method<br>
 * Assertion: adds a <code>CertPathChecker</code> to the end of the
 * list of <code>CertPathChecker</code>s 
 * @throws CertPathValidatorException
 */
public final void testAddCertPathChecker01() throws Exception {
    Set taSet = TestUtils.getTrustAnchorSet();
    if (taSet == null) {
        fail(getName() + ": not performed (could not create test TrustAnchor set)");
    }

    PKIXParameters p = new PKIXParameters(taSet);
    PKIXCertPathChecker cpc = TestUtils.getTestCertPathChecker();
    List l = new ArrayList();
    assertTrue("addedOk", l.add(cpc));
    p.setCertPathCheckers(l);
    // create one more PKIXCertPathChecker
    PKIXCertPathChecker cpc1 = TestUtils.getTestCertPathChecker();
    cpc1.init(true);
    p.addCertPathChecker(cpc1);
    // check that we have two PKIXCertPathCheckers and
    // they are in right order
    List l1 = p.getCertPathCheckers();
    assertEquals("listSize", 2, l1.size());
    assertFalse("order1",
            ((PKIXCertPathChecker)l1.get(0)).isForwardCheckingSupported());
    assertTrue("order2",
            ((PKIXCertPathChecker)l1.get(1)).isForwardCheckingSupported());
}
 

import java.security.cert.PKIXParameters; //导入方法依赖的package包/类
/**
 * Test #2 for <code>addCertPathChecker(PKIXCertPathChecker)</code> method<br>
 * Assertion: if null, the checker is ignored (not added to list).
 * @throws InvalidAlgorithmParameterException
 */
public final void testAddCertPathChecker02() throws Exception {
    Set taSet = TestUtils.getTrustAnchorSet();
    if (taSet == null) {
        fail(getName() + ": not performed (could not create test TrustAnchor set)");
    }

    PKIXParameters p = new PKIXParameters(taSet);
    PKIXCertPathChecker cpc = TestUtils.getTestCertPathChecker();
    List l = new ArrayList();
    assertTrue("addedOk", l.add(cpc));
    p.setCertPathCheckers(l);
    // try to add null
    p.addCertPathChecker(null);
    // check that we have one PKIXCertPathChecker
    List l1 = p.getCertPathCheckers();
    assertEquals("listSize", 1, l1.size());
}
 

import java.security.cert.PKIXParameters; //导入方法依赖的package包/类
/**
 * Test #3 for <code>addCertPathChecker(PKIXCertPathChecker)</code> method<br>
 * Assertion: <code>PKIXCertPathChecker</code> is cloned to protect
 * against subsequent modifications
 * @throws InvalidAlgorithmParameterException
 * @throws CertPathValidatorException
 */
public final void testAddCertPathChecker03() throws Exception {
    Set taSet = TestUtils.getTrustAnchorSet();
    if (taSet == null) {
        fail(getName() + ": not performed (could not create test TrustAnchor set)");
    }

    // checks that checkers cloned
    PKIXParameters p = new PKIXParameters(taSet);
    PKIXCertPathChecker cpc = TestUtils.getTestCertPathChecker();

    p.addCertPathChecker(cpc);
    // modify checker
    cpc.init(true);
    // retrieve list and check that CertPathChecker's
    // state it contains has not been changed by the
    // above modification
    List l = p.getCertPathCheckers();
    PKIXCertPathChecker cpc1 = (PKIXCertPathChecker)l.get(0);
    assertEquals("listSize", 1, l.size());
    assertFalse("isCopied", cpc1.isForwardCheckingSupported());
}