Java X509CertSelector.setBasicConstraints方法代码示例

import java.security.cert.X509CertSelector; //导入方法依赖的package包/类
/**
 * @tests java.security.cert.X509CertSelector#setBasicConstraints(int)
 */
@TestTargetNew(
    level = TestLevel.COMPLETE,
    notes = "",
    method = "setBasicConstraints",
    args = {int.class}
)
public void test_setBasicConstraintsLint() {
    X509CertSelector selector = new X509CertSelector();
    int[] invalidValues = { -3, -4, -5, 1000000000 };
    for (int i = 0; i < invalidValues.length; i++) {
        try {
            selector.setBasicConstraints(-3);
            fail("IllegalArgumentException expected");
        } catch (IllegalArgumentException e) {
            // expected
        }
    }

    int[] validValues = { -2, -1, 0, 1, 2, 3, 10, 20 };
    for (int i = 0; i < validValues.length; i++) {
        selector.setBasicConstraints(validValues[i]);
        assertEquals(validValues[i], selector.getBasicConstraints());
    }
}
 

import java.security.cert.X509CertSelector; //导入方法依赖的package包/类
public static void main(String[] args) throws Exception {
    // reset the security property to make sure that the algorithms
    // and keys used in this test are not disabled.
    Security.setProperty("jdk.certpath.disabledAlgorithms", "MD2");

    X509Certificate rootCert = CertUtils.getCertFromFile("anchor.cer");
    TrustAnchor anchor = new TrustAnchor
        (rootCert.getSubjectX500Principal(), rootCert.getPublicKey(), null);
    X509CertSelector sel = new X509CertSelector();
    sel.setBasicConstraints(-2);
    PKIXBuilderParameters params = new PKIXBuilderParameters
        (Collections.singleton(anchor), sel);
    params.setRevocationEnabled(false);
    X509Certificate eeCert = CertUtils.getCertFromFile("ee.cer");
    X509Certificate caCert = CertUtils.getCertFromFile("ca.cer");
    ArrayList<X509Certificate> certs = new ArrayList<X509Certificate>();
    certs.add(caCert);
    certs.add(eeCert);
    CollectionCertStoreParameters ccsp =
        new CollectionCertStoreParameters(certs);
    CertStore cs = CertStore.getInstance("Collection", ccsp);
    params.addCertStore(cs);
    PKIXCertPathBuilderResult res = CertUtils.build(params);
    CertPath cp = res.getCertPath();
    // check that first certificate is an EE cert
    List<? extends Certificate> certList = cp.getCertificates();
    X509Certificate cert = (X509Certificate) certList.get(0);
    if (cert.getBasicConstraints() != -1) {
        throw new Exception("Target certificate is not an EE certificate");
    }
}
 

import java.security.cert.X509CertSelector; //导入方法依赖的package包/类
private void testBasicConstraints() {
    System.out.println("X.509 Certificate Match on basic constraints");
    // bad match
    X509CertSelector selector = new X509CertSelector();
    int mpl = cert.getBasicConstraints();
    selector.setBasicConstraints(0);
    checkMatch(selector, cert, false);

    // good match
    selector.setBasicConstraints(mpl);
    checkMatch(selector, cert, true);
}
 

import java.security.cert.X509CertSelector; //导入方法依赖的package包/类
/**
 * @tests java.security.cert.X509CertSelector#getBasicConstraints()
 */
@TestTargetNew(
    level = TestLevel.COMPLETE,
    notes = "",
    method = "getBasicConstraints",
    args = {}
)
public void test_getBasicConstraints() {
    X509CertSelector selector = new X509CertSelector();
    int[] validValues = { 2, 1, 0, 1, 2, 3, 10, 20 };
    for (int i = 0; i < validValues.length; i++) {
        selector.setBasicConstraints(validValues[i]);
        assertEquals(validValues[i], selector.getBasicConstraints());
    }
}
 

import java.security.cert.X509CertSelector; //导入方法依赖的package包/类
public static void main(String[] args) throws Exception {

        X509Certificate rootCert = CertUtils.getCertFromFile("anchor.cer");
        TrustAnchor anchor = new TrustAnchor
            (rootCert.getSubjectX500Principal(), rootCert.getPublicKey(), null);
        X509CertSelector sel = new X509CertSelector();
        sel.setBasicConstraints(-2);
        PKIXBuilderParameters params = new PKIXBuilderParameters
            (Collections.singleton(anchor), sel);
        params.setRevocationEnabled(false);
        X509Certificate eeCert = CertUtils.getCertFromFile("ee.cer");
        X509Certificate caCert = CertUtils.getCertFromFile("ca.cer");
        ArrayList<X509Certificate> certs = new ArrayList<X509Certificate>();
        certs.add(caCert);
        certs.add(eeCert);
        CollectionCertStoreParameters ccsp =
            new CollectionCertStoreParameters(certs);
        CertStore cs = CertStore.getInstance("Collection", ccsp);
        params.addCertStore(cs);
        PKIXCertPathBuilderResult res = CertUtils.build(params);
        CertPath cp = res.getCertPath();
        // check that first certificate is an EE cert
        List<? extends Certificate> certList = cp.getCertificates();
        X509Certificate cert = (X509Certificate) certList.get(0);
        if (cert.getBasicConstraints() != -1) {
            throw new Exception("Target certificate is not an EE certificate");
        }
    }
 

import java.security.cert.X509CertSelector; //导入方法依赖的package包/类
/**
 * Attempts to build a certification chain for given certificate to verify
 * it. Relies on a set of root CA certificates (trust anchors) and a set of
 * intermediate certificates (to be used as part of the chain).
 */
private PKIXCertPathBuilderResult verifyCertificate(X509Certificate certificate, Set<X509Certificate> trustedRootCerts, Set<X509Certificate> intermediateCerts)
		throws GeneralSecurityException {

	// Create the selector that specifies the starting certificate
	X509CertSelector selector = new X509CertSelector();
	selector.setBasicConstraints(-2);
	selector.setCertificate(certificate);

	// Create the trust anchors (set of root CA certificates)
	Set<TrustAnchor> trustAnchors = new HashSet<TrustAnchor>();
	for (X509Certificate trustedRootCert : trustedRootCerts) {
		trustAnchors.add(new TrustAnchor(trustedRootCert, null));
	}

	// Configure the PKIX certificate builder algorithm parameters
	PKIXBuilderParameters pkixParams = new PKIXBuilderParameters(trustAnchors, selector);

	// Turn off default revocation-checking mechanism
	pkixParams.setRevocationEnabled(false);

	// Specify a list of intermediate certificates
	CertStore intermediateCertStore = CertStore.getInstance("Collection", new CollectionCertStoreParameters(intermediateCerts));
	pkixParams.addCertStore(intermediateCertStore);

	// Build and verify the certification chain
	CertPathBuilder builder = CertPathBuilder.getInstance("PKIX", BouncyCastleProvider.PROVIDER_NAME);
	PKIXCertPathBuilderResult certPathBuilderResult = (PKIXCertPathBuilderResult) builder.build(pkixParams);

	// Additional check to Verify cert path
	CertPathValidator certPathValidator = CertPathValidator.getInstance("PKIX", BouncyCastleProvider.PROVIDER_NAME);
	PKIXCertPathValidatorResult certPathValidationResult = (PKIXCertPathValidatorResult) certPathValidator.validate(certPathBuilderResult.getCertPath(), pkixParams);

	return certPathBuilderResult;
}
 

import java.security.cert.X509CertSelector; //导入方法依赖的package包/类
private Collection<X509Certificate> getMatchingEECerts
    (ReverseState currentState, List<CertStore> certStores)
    throws CertStoreException, CertificateException, IOException {

    /*
     * Compose a CertSelector to filter out
     * certs which do not satisfy requirements.
     *
     * First, retrieve clone of current target cert constraints, and
     * then add more selection criteria based on current validation state.
     */
    X509CertSelector sel = (X509CertSelector) targetCertConstraints.clone();

    /*
     * Match on issuer (subject of previous cert)
     */
    sel.setIssuer(currentState.subjectDN);

    /*
     * Match on certificate validity date.
     */
    sel.setCertificateValid(buildParams.date());

    /*
     * Policy processing optimizations
     */
    if (currentState.explicitPolicy == 0)
        sel.setPolicy(getMatchingPolicies());

    /*
     * If previous cert has a subject key identifier extension,
     * use it to match on authority key identifier extension.
     */
    /*if (currentState.subjKeyId != null) {
      AuthorityKeyIdentifierExtension authKeyId = new AuthorityKeyIdentifierExtension(
            (KeyIdentifier) currentState.subjKeyId.get(SubjectKeyIdentifierExtension.KEY_ID),
            null, null);
    sel.setAuthorityKeyIdentifier(authKeyId.getExtensionValue());
    }*/

    /*
     * Require EE certs
     */
    sel.setBasicConstraints(-2);

    /* Retrieve matching certs from CertStores */
    HashSet<X509Certificate> eeCerts = new HashSet<>();
    addMatchingCerts(sel, certStores, eeCerts, true);

    if (debug != null) {
        debug.println("ReverseBuilder.getMatchingEECerts got "
                      + eeCerts.size() + " certs.");
    }
    return eeCerts;
}
 

import java.security.cert.X509CertSelector; //导入方法依赖的package包/类
private Collection<X509Certificate> getMatchingCACerts
    (ReverseState currentState, List<CertStore> certStores)
    throws CertificateException, CertStoreException, IOException {

    /*
     * Compose a CertSelector to filter out
     * certs which do not satisfy requirements.
     */
    X509CertSelector sel = new X509CertSelector();

    /*
     * Match on issuer (subject of previous cert)
     */
    sel.setIssuer(currentState.subjectDN);

    /*
     * Match on certificate validity date.
     */
    sel.setCertificateValid(buildParams.date());

    /*
     * Match on target subject name (checks that current cert's
     * name constraints permit it to certify target).
     * (4 is the integer type for DIRECTORY name).
     */
    byte[] subject = targetCertConstraints.getSubjectAsBytes();
    if (subject != null) {
        sel.addPathToName(4, subject);
    } else {
        X509Certificate cert = targetCertConstraints.getCertificate();
        if (cert != null) {
            sel.addPathToName(4,
                              cert.getSubjectX500Principal().getEncoded());
        }
    }

    /*
     * Policy processing optimizations
     */
    if (currentState.explicitPolicy == 0)
        sel.setPolicy(getMatchingPolicies());

    /*
     * If previous cert has a subject key identifier extension,
     * use it to match on authority key identifier extension.
     */
    /*if (currentState.subjKeyId != null) {
      AuthorityKeyIdentifierExtension authKeyId = new AuthorityKeyIdentifierExtension(
            (KeyIdentifier) currentState.subjKeyId.get(SubjectKeyIdentifierExtension.KEY_ID),
                            null, null);
      sel.setAuthorityKeyIdentifier(authKeyId.getExtensionValue());
    }*/

    /*
     * Require CA certs
     */
    sel.setBasicConstraints(0);

    /* Retrieve matching certs from CertStores */
    ArrayList<X509Certificate> reverseCerts = new ArrayList<>();
    addMatchingCerts(sel, certStores, reverseCerts, true);

    /* Sort remaining certs using name constraints */
    Collections.sort(reverseCerts, new PKIXCertComparator());

    if (debug != null)
        debug.println("ReverseBuilder.getMatchingCACerts got " +
                      reverseCerts.size() + " certs.");
    return reverseCerts;
}
 

import java.security.cert.X509CertSelector; //导入方法依赖的package包/类
private Collection<X509Certificate> getMatchingEECerts
    (ReverseState currentState, List<CertStore> certStores)
    throws CertStoreException, CertificateException, IOException {

  /*
   * Compose a CertSelector to filter out
   * certs which do not satisfy requirements.
   *
   * First, retrieve clone of current target cert constraints,
   * and then add more selection criteria based on current validation state.
   */
  X509CertSelector sel = (X509CertSelector) targetCertConstraints.clone();

  /*
   * Match on issuer (subject of previous cert)
   */
  sel.setIssuer(currentState.subjectDN);

  /*
   * Match on certificate validity date.
   */
  sel.setCertificateValid(date);

  /*
   * Policy processing optimizations
   */
  if (currentState.explicitPolicy == 0)
      sel.setPolicy(getMatchingPolicies());

  /*
   * If previous cert has a subject key identifier extension,
   * use it to match on authority key identifier extension.
   */
  /*if (currentState.subjKeyId != null) {
    AuthorityKeyIdentifierExtension authKeyId = new AuthorityKeyIdentifierExtension(
            (KeyIdentifier) currentState.subjKeyId.get(SubjectKeyIdentifierExtension.KEY_ID),
            null, null);
    sel.setAuthorityKeyIdentifier(authKeyId.getExtensionValue());
  }*/

  /*
   * Require EE certs
   */
  sel.setBasicConstraints(-2);

  /* Retrieve matching certs from CertStores */
  HashSet<X509Certificate> eeCerts = new HashSet<X509Certificate>();
  addMatchingCerts(sel, certStores, eeCerts, true);

  if (debug != null) {
    debug.println("ReverseBuilder.getMatchingEECerts got " + eeCerts.size()
                + " certs.");
  }
  return eeCerts;
}
 

import java.security.cert.X509CertSelector; //导入方法依赖的package包/类
private Collection<X509Certificate> getMatchingCACerts
    (ReverseState currentState, List<CertStore> certStores)
    throws CertificateException, CertStoreException, IOException {

  /*
   * Compose a CertSelector to filter out
   * certs which do not satisfy requirements.
   */
  X509CertSelector sel = new X509CertSelector();

  /*
   * Match on issuer (subject of previous cert)
   */
  sel.setIssuer(currentState.subjectDN);

  /*
   * Match on certificate validity date.
   */
  sel.setCertificateValid(date);

  /*
   * Match on target subject name (checks that current cert's
   * name constraints permit it to certify target).
   * (4 is the integer type for DIRECTORY name).
   */
  sel.addPathToName(4, targetCertConstraints.getSubjectAsBytes());

  /*
   * Policy processing optimizations
   */
  if (currentState.explicitPolicy == 0)
      sel.setPolicy(getMatchingPolicies());

  /*
   * If previous cert has a subject key identifier extension,
   * use it to match on authority key identifier extension.
   */
  /*if (currentState.subjKeyId != null) {
    AuthorityKeyIdentifierExtension authKeyId = new AuthorityKeyIdentifierExtension(
            (KeyIdentifier) currentState.subjKeyId.get(SubjectKeyIdentifierExtension.KEY_ID),
                            null, null);
    sel.setAuthorityKeyIdentifier(authKeyId.getExtensionValue());
  }*/

  /*
   * Require CA certs
   */
  sel.setBasicConstraints(0);

  /* Retrieve matching certs from CertStores */
  ArrayList<X509Certificate> reverseCerts =
      new ArrayList<X509Certificate>();
  addMatchingCerts(sel, certStores, reverseCerts, true);

  /* Sort remaining certs using name constraints */
  Collections.sort(reverseCerts, new PKIXCertComparator());

  if (debug != null)
    debug.println("ReverseBuilder.getMatchingCACerts got " +
                reverseCerts.size() + " certs.");
  return reverseCerts;
}