Package com.itextpdf.signatures
Class IssuingCertificateRetriever
- java.lang.Object
-
- com.itextpdf.signatures.IssuingCertificateRetriever
-
- All Implemented Interfaces:
IIssuingCertificateRetriever
public class IssuingCertificateRetriever extends java.lang.Object implements IIssuingCertificateRetriever
IIssuingCertificateRetriever
default implementation.
-
-
Field Summary
Fields Modifier and Type Field Description private static IBouncyCastleFactory
FACTORY
private java.util.Map<java.lang.String,java.util.List<java.security.cert.Certificate>>
knownCertificates
private static org.slf4j.Logger
LOGGER
private TrustedCertificatesStore
trustedCertificatesStore
-
Constructor Summary
Constructors Constructor Description IssuingCertificateRetriever()
CreatesIssuingCertificateRetriever
instance.
-
Method Summary
All Methods Static Methods Instance Methods Concrete Methods Modifier and Type Method Description void
addKnownCertificates(java.util.Collection<java.security.cert.Certificate> certificates)
Add certificates collection to known certificates storage, which is used for issuer certificates retrieval.void
addTrustedCertificates(java.util.Collection<java.security.cert.Certificate> certificates)
Add trusted certificates collection to trusted certificates storage.java.util.List<java.security.cert.X509Certificate[]>
buildCertificateChains(java.security.cert.X509Certificate certificate)
This method tries to rebuild certificate issuer chain.java.util.List<java.security.cert.X509Certificate[]>
buildCertificateChains(java.security.cert.X509Certificate[] certificate)
This method tries to rebuild certificate issuer chain.private java.util.List<java.util.List<java.security.cert.X509Certificate>>
buildCertificateChainsList(java.security.cert.X509Certificate certificate)
private java.util.List<java.util.List<java.security.cert.X509Certificate>>
buildCertificateChainsList(java.security.cert.X509Certificate[] certificates)
java.security.cert.Certificate[]
getCrlIssuerCertificates(java.security.cert.CRL crl)
Retrieves the certificate chain for the certificate that should be used to verify the signature on the CRL response using CRL Authority Information Access (AIA) Extension and known certificates.java.security.cert.Certificate[][]
getCrlIssuerCertificatesByName(java.security.cert.CRL crl)
Retrieves the certificate chaind for the certificates that could be used to verify the signature on the CRL response using CRL Authority Information Access (AIA) Extension and known certificates.private java.security.cert.Certificate[][]
getCrlIssuerCertificatesGeneric(java.security.cert.CRL crl, boolean verify)
private java.util.List<java.security.cert.Certificate>
getCrlIssuersFromKnownCertificates(java.security.cert.X509CRL crl)
protected java.io.InputStream
getIssuerCertByURI(java.lang.String uri)
Get CA issuers certificates represented asInputStream
.private static java.security.cert.Certificate
getIssuerFromCertificateSet(java.security.cert.X509Certificate lastAddedCert, java.util.Collection<java.security.cert.Certificate> certs)
TrustedCertificatesStore
getTrustedCertificatesStore()
GetsTrustedCertificatesStore
to be used to provide more complex trusted certificates configuration.boolean
isCertificateTrusted(java.security.cert.Certificate certificate)
Check if provided certificate is present in trusted certificates storage.private static boolean
isSignedBy(java.security.cert.X509Certificate certificate, java.security.cert.Certificate issuer)
private static boolean
isSignedBy(java.security.cert.X509CRL crl, java.security.cert.Certificate issuer)
protected java.util.Collection<java.security.cert.Certificate>
parseCertificates(java.io.InputStream certsData)
Parses certificates represented as byte array.private java.util.Collection<java.security.cert.Certificate>
processCertificatesFromAIA(java.lang.String url)
java.util.List<java.security.cert.X509Certificate>
retrieveIssuerCertificate(java.security.cert.Certificate certificate)
Retrieve issuer certificate for the provided certificate.java.security.cert.Certificate[]
retrieveMissingCertificates(java.security.cert.Certificate[] chain)
Retrieves missing certificates in chain using certificate Authority Information Access (AIA) Extension.java.util.Set<java.security.cert.Certificate>
retrieveOCSPResponderByNameCertificate(IBasicOCSPResp ocspResp)
Retrieves OCSP responder certificate candidates either from the response certs or trusted store in case responder certificate isn't found in /Certs.void
setTrustedCertificates(java.util.Collection<java.security.cert.Certificate> certificates)
Sets trusted certificate list to be used as certificates trusted for any possible usage.
-
-
-
Field Detail
-
FACTORY
private static final IBouncyCastleFactory FACTORY
-
LOGGER
private static final org.slf4j.Logger LOGGER
-
trustedCertificatesStore
private final TrustedCertificatesStore trustedCertificatesStore
-
knownCertificates
private final java.util.Map<java.lang.String,java.util.List<java.security.cert.Certificate>> knownCertificates
-
-
Constructor Detail
-
IssuingCertificateRetriever
public IssuingCertificateRetriever()
CreatesIssuingCertificateRetriever
instance.
-
-
Method Detail
-
retrieveMissingCertificates
public java.security.cert.Certificate[] retrieveMissingCertificates(java.security.cert.Certificate[] chain)
Retrieves missing certificates in chain using certificate Authority Information Access (AIA) Extension.- Specified by:
retrieveMissingCertificates
in interfaceIIssuingCertificateRetriever
- Parameters:
chain
- certificate chain to restore with at least signing certificate.- Returns:
- full chain of trust or maximum chain that could be restored in case missing certificates cannot be retrieved from AIA extension.
-
buildCertificateChains
public java.util.List<java.security.cert.X509Certificate[]> buildCertificateChains(java.security.cert.X509Certificate certificate)
This method tries to rebuild certificate issuer chain. The result contains all possible chains starting with the given certificate based on issuer names and public keys.- Parameters:
certificate
-X509Certificate
for which issuer chains shall be built- Returns:
- all possible issuer chains
-
buildCertificateChains
public java.util.List<java.security.cert.X509Certificate[]> buildCertificateChains(java.security.cert.X509Certificate[] certificate)
This method tries to rebuild certificate issuer chain. The result contains all possible chains starting with the given certificate array based on issuer names and public keys.- Parameters:
certificate
-X509Certificate
array for which issuer chains shall be built- Returns:
- all possible issuer chains
-
buildCertificateChainsList
private java.util.List<java.util.List<java.security.cert.X509Certificate>> buildCertificateChainsList(java.security.cert.X509Certificate[] certificates)
-
buildCertificateChainsList
private java.util.List<java.util.List<java.security.cert.X509Certificate>> buildCertificateChainsList(java.security.cert.X509Certificate certificate)
-
retrieveIssuerCertificate
public java.util.List<java.security.cert.X509Certificate> retrieveIssuerCertificate(java.security.cert.Certificate certificate)
Retrieve issuer certificate for the provided certificate.- Parameters:
certificate
-Certificate
for which issuer certificate shall be retrieved- Returns:
- issuer certificate.
null
if there is no issuer certificate, or it cannot be retrieved.
-
retrieveOCSPResponderByNameCertificate
public java.util.Set<java.security.cert.Certificate> retrieveOCSPResponderByNameCertificate(IBasicOCSPResp ocspResp)
Retrieves OCSP responder certificate candidates either from the response certs or trusted store in case responder certificate isn't found in /Certs.- Parameters:
ocspResp
- basic OCSP response to get responder certificate for- Returns:
- retrieved OCSP responder candidates or an empty set in case none were found.
-
getCrlIssuerCertificates
public java.security.cert.Certificate[] getCrlIssuerCertificates(java.security.cert.CRL crl)
Retrieves the certificate chain for the certificate that should be used to verify the signature on the CRL response using CRL Authority Information Access (AIA) Extension and known certificates.- Specified by:
getCrlIssuerCertificates
in interfaceIIssuingCertificateRetriever
- Parameters:
crl
- CRL response to retrieve issuer for.- Returns:
- certificates retrieved from CRL AIA extension or an empty list in case certificates cannot be retrieved.
-
getCrlIssuerCertificatesByName
public java.security.cert.Certificate[][] getCrlIssuerCertificatesByName(java.security.cert.CRL crl)
Retrieves the certificate chaind for the certificates that could be used to verify the signature on the CRL response using CRL Authority Information Access (AIA) Extension and known certificates.- Specified by:
getCrlIssuerCertificatesByName
in interfaceIIssuingCertificateRetriever
- Parameters:
crl
- CRL response to retrieve issuer for.- Returns:
- certificates retrieved from CRL AIA extension or an empty list in case certificates cannot be retrieved.
-
getCrlIssuerCertificatesGeneric
private java.security.cert.Certificate[][] getCrlIssuerCertificatesGeneric(java.security.cert.CRL crl, boolean verify)
-
setTrustedCertificates
public void setTrustedCertificates(java.util.Collection<java.security.cert.Certificate> certificates)
Sets trusted certificate list to be used as certificates trusted for any possible usage. In case more specific trusted is desired to be configuredgetTrustedCertificatesStore()
method is expected to be used.- Specified by:
setTrustedCertificates
in interfaceIIssuingCertificateRetriever
- Parameters:
certificates
- certificate list to be used as certificates trusted for any possible usage.
-
addTrustedCertificates
public void addTrustedCertificates(java.util.Collection<java.security.cert.Certificate> certificates)
Add trusted certificates collection to trusted certificates storage.- Parameters:
certificates
- certificatesCollection
to be added
-
addKnownCertificates
public void addKnownCertificates(java.util.Collection<java.security.cert.Certificate> certificates)
Add certificates collection to known certificates storage, which is used for issuer certificates retrieval.- Parameters:
certificates
- certificatesCollection
to be added
-
getTrustedCertificatesStore
public TrustedCertificatesStore getTrustedCertificatesStore()
GetsTrustedCertificatesStore
to be used to provide more complex trusted certificates configuration.- Returns:
TrustedCertificatesStore
storage
-
isCertificateTrusted
public boolean isCertificateTrusted(java.security.cert.Certificate certificate)
Check if provided certificate is present in trusted certificates storage.- Parameters:
certificate
-Certificate
to be checked- Returns:
true
if certificate is present in trusted certificates storage,false
otherwise
-
getIssuerCertByURI
protected java.io.InputStream getIssuerCertByURI(java.lang.String uri) throws java.io.IOException
Get CA issuers certificates represented asInputStream
.- Parameters:
uri
-URL
URI, which is expected to be used to get issuer certificates from. Usually CA Issuers value from Authority Information Access (AIA) certificate extension.- Returns:
- CA issuer certificate (or chain) bytes, represented as
InputStream
. - Throws:
java.io.IOException
- if an I/O error occurs.
-
parseCertificates
protected java.util.Collection<java.security.cert.Certificate> parseCertificates(java.io.InputStream certsData) throws java.security.cert.CertificateException
Parses certificates represented as byte array.- Parameters:
certsData
- stream which contains one or more X509 certificates.- Returns:
- a (possibly empty) collection of the certificates read from the given byte array.
- Throws:
java.security.cert.CertificateException
- if parsing error occurs.
-
processCertificatesFromAIA
private java.util.Collection<java.security.cert.Certificate> processCertificatesFromAIA(java.lang.String url)
-
isSignedBy
private static boolean isSignedBy(java.security.cert.X509Certificate certificate, java.security.cert.Certificate issuer)
-
isSignedBy
private static boolean isSignedBy(java.security.cert.X509CRL crl, java.security.cert.Certificate issuer)
-
getIssuerFromCertificateSet
private static java.security.cert.Certificate getIssuerFromCertificateSet(java.security.cert.X509Certificate lastAddedCert, java.util.Collection<java.security.cert.Certificate> certs)
-
getCrlIssuersFromKnownCertificates
private java.util.List<java.security.cert.Certificate> getCrlIssuersFromKnownCertificates(java.security.cert.X509CRL crl)
-
-