|
Bouncy Castle Cryptography 1.21 | |||||||||
PREV CLASS NEXT CLASS | FRAMES NO FRAMES | |||||||||
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD |
java.lang.Object | +--org.bouncycastle.jce.cert.TrustAnchor
A trust anchor or most-trusted Certification Authority (CA).
This class represents a "most-trusted CA", which is used as a trust anchor
for validating X.509 certification paths. A most-trusted CA includes the
public key of the CA, the CA's name, and any constraints upon the set of
paths which may be validated using this key. These parameters can be
specified in the form of a trusted X509Certificate or as individual
parameters.
Concurrent Access
All TrustAnchor objects must be immutable and thread-safe. That is, multiple
threads may concurrently invoke the methods defined in this class on a
single TrustAnchor object (or more than one) with no ill effects. Requiring
TrustAnchor objects to be immutable and thread-safe allows them to be passed
around to various pieces of code without worrying about coordinating access.
This stipulation applies to all public fields and methods of this class and
any added or overridden by subclasses.
TODO: implement better nameConstraints testing.
Constructor Summary | |
TrustAnchor(java.lang.String caName,
java.security.PublicKey pubKey,
byte[] nameConstraints)
Creates an instance of TrustAnchor where the most-trusted
CA is specified as a distinguished name and public
key. |
|
TrustAnchor(java.security.cert.X509Certificate trustedCert,
byte[] nameConstraints)
Creates an instance of TrustAnchor with the specified X509Certificate and optional name constraints, which are intended to be used as additional constraints when validating an X.509 certification path. The name constraints are specified as a byte array. |
Method Summary | |
java.lang.String |
getCAName()
Returns the name of the most-trusted CA in RFC 2253 String format. |
java.security.PublicKey |
getCAPublicKey()
Returns the public key of the most-trusted CA. |
byte[] |
getNameConstraints()
Returns the name constraints parameter. |
java.security.cert.X509Certificate |
getTrustedCert()
Returns the most-trusted CA certificate. |
java.lang.String |
toString()
Returns a formatted string describing the TrustAnchor . |
Methods inherited from class java.lang.Object |
clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait |
Constructor Detail |
public TrustAnchor(java.security.cert.X509Certificate trustedCert, byte[] nameConstraints)
NameConstraints ::= SEQUENCE { permittedSubtrees [0] GeneralSubtrees OPTIONAL, excludedSubtrees [1] GeneralSubtrees OPTIONAL } GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree GeneralSubtree ::= SEQUENCE { base GeneralName, minimum [0] BaseDistance DEFAULT 0, maximum [1] BaseDistance OPTIONAL } BaseDistance ::= INTEGER (0..MAX) GeneralName ::= CHOICE { otherName [0] OtherName, rfc822Name [1] IA5String, dNSName [2] IA5String, x400Address [3] ORAddress, directoryName [4] Name, ediPartyName [5] EDIPartyName, uniformResourceIdentifier [6] IA5String, iPAddress [7] OCTET STRING, registeredID [8] OBJECT IDENTIFIER}
trustedCert
- a trusted X509CertificatenameConstraints
- a byte array containing the ASN.1
DER encoding of a NameConstraints extension to be used for
checking name constraints. Only the value of the extension
is included, not the OID or criticality flag. Specify null
to omit the parameter.
java.lang.IllegalArgumentException
- if the name constraints
cannot be decoded
java.lang.NullPointerException
- if the specified X509Certificate is nullpublic TrustAnchor(java.lang.String caName, java.security.PublicKey pubKey, byte[] nameConstraints)
TrustAnchor
where the most-trusted
CA is specified as a distinguished name and public
key. Name constraints are an optional parameter, and are
intended to be used as additional constraints when
validating an X.509 certification path.
The name constraints are specified as a byte array. This
byte array contains the DER encoded form of the name
constraints, as they would appear in the NameConstraints
structure defined in RFC 2459 and X.509. The ASN.1 notation
for this structure is supplied in the documentation for
TrustAnchor(X509Certificate trustedCert,
byte[] nameConstraints)
.
Note that the name constraints byte array supplied here is
cloned to protect against subsequent modifications.
caName
- the X.500 distinguished name of the
most-trusted CA in RFC 2253 String formatpubKey
- the public key of the most-trusted CAnameConstraints
- a byte array containing the ASN.1
DER encoding of a NameConstraints extension to be used for
checking name constraints. Only the value of the extension
is included, not the OID or criticality flag. Specify null
to omit the parameter.
java.lang.IllegalArgumentException
- if the specified caName
parameter is empty (caName.length() == 0
) or incorrectly
formatted or the name constraints cannot be decoded
java.lang.NullPointerException
- if the specified caName or pubKey parameter is nullMethod Detail |
public final java.security.cert.X509Certificate getTrustedCert()
X509Certificate
or null
if the trust
anchor was not specified as a trusted certificatepublic final java.lang.String getCAName()
null
if the trust anchor was not specified as a
trusted public key and name pairpublic final java.security.PublicKey getCAPublicKey()
public final byte[] getNameConstraints()
TrustAnchor(X509Certificate trustedCert, byte[]
nameConstraints)
.
null
if not set.public java.lang.String toString()
TrustAnchor
.
toString
in class java.lang.Object
TrustAnchor
|
Bouncy Castle Cryptography 1.21 | |||||||||
PREV CLASS NEXT CLASS | FRAMES NO FRAMES | |||||||||
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD |