/*
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation. Oracle designates this
* particular file as subject to the "Classpath" exception as provided
* by Oracle in the LICENSE file that accompanied this code.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/**
* The X509CertImpl class represents an X.509 certificate. These certificates
* are widely used to support authentication and other functionality in
* Internet security systems. Common applications include Privacy Enhanced
* Mail (PEM), Transport Layer Security (SSL), code signing for trusted
* software distribution, and Secure Electronic Transactions (SET). There
* is a commercial infrastructure ready to manage large scale deployments
* of X.509 identity certificates.
*
* <P>These certificates are managed and vouched for by <em>Certificate
* Authorities</em> (CAs). CAs are services which create certificates by
* placing data in the X.509 standard format and then digitally signing
* that data. Such signatures are quite difficult to forge. CAs act as
* trusted third parties, making introductions between agents who have no
* direct knowledge of each other. CA certificates are either signed by
* themselves, or by some other CA such as a "root" CA.
*
* <P>RFC 1422 is very informative, though it does not describe much
* of the recent work being done with X.509 certificates. That includes
* a 1996 version (X.509v3) and a variety of enhancements being made to
* facilitate an explosion of personal certificates used as "Internet
* Drivers' Licences", or with SET for credit card transactions.
*
* <P>More recent work includes the IETF PKIX Working Group efforts,
* especially RFC2459.
*
* @author Dave Brownell
* @author Amit Kapoor
* @author Hemma Prafullchandra
* @see X509CertInfo
*/
/**
* Public attribute names.
*/
/**
* The following are defined for ease-of-use. These
* are the most frequently retrieved attributes.
*/
// x509.info.subject.dname
// x509.info.issuer.dname
// x509.info.serialNumber.number
// x509.info.key.value
// x509.info.version.value
// x509.algorithm
// x509.signature
// when we sign and decode we set this to true
// this is our means to make certificates immutable
private boolean readOnly = false;
// Certificate data, and its envelope
// recognized extension OIDS
// number of standard key usage bits.
// SubjectAlterntativeNames cache
// IssuerAlternativeNames cache
// ExtendedKeyUsage cache
// AuthorityInformationAccess cache
/**
* PublicKey that has previously been used to verify
* the signature of this certificate. Null if the certificate has not
* yet been verified.
*/
/**
* If verifiedPublicKey is not null, name of the provider used to
* successfully verify the signature of this certificate, or the
* empty String if no provider was explicitly specified.
*/
/**
* If verifiedPublicKey is not null, result of the verification using
* verifiedPublicKey and verifiedProvider. If true, verification was
* successful, if false, it failed.
*/
private boolean verificationResult;
// Cached SKID
// Cached AKID
/**
* Default constructor.
*/
public X509CertImpl() { }
/**
* Unmarshals a certificate from its encoded form, parsing the
* encoded bytes. This form of constructor is used by agents which
* need to examine and use certificate contents. That is, this is
* one of the more commonly used constructors. Note that the buffer
* must include only a certificate, and no "garbage" may be left at
* the end. If you need to ignore data at the end of a certificate,
* use another constructor.
*
* @param certData the encoded bytes, with no trailing padding.
* @exception CertificateException on parsing and initialization errors.
*/
try {
} catch (IOException e) {
signedCert = null;
throw new CertificateException("Unable to initialize, " + e, e);
}
}
/**
* unmarshals an X.509 certificate from an input stream. If the
* certificate is RFC1421 hex-encoded, then it must begin with
* the line X509Factory.BEGIN_CERT and end with the line
* X509Factory.END_CERT.
*
* @param in an input stream holding at least one certificate that may
* be either DER-encoded or RFC1421 hex-encoded version of the
* DER-encoded certificate.
* @exception CertificateException on parsing and initialization errors.
*/
// First try reading stream as HEX-encoded DER-encoded bytes,
// since not mistakable for raw DER
try {
} catch (IOException ioe) {
try {
// Next, try reading stream as raw DER-encoded bytes
inBuffered.reset();
} catch (IOException ioe1) {
throw new CertificateException("Input stream must be " +
"either DER-encoded bytes " +
"or RFC1421 hex-encoded " +
"DER-encoded bytes: " +
}
}
try {
} catch (IOException ioe) {
signedCert = null;
throw new CertificateException("Unable to parse DER value of " +
}
}
/**
* read input stream as HEX-encoded DER-encoded bytes
*
* @param in InputStream to read
* @returns DerValue corresponding to decoded HEX-encoded bytes
* @throws IOException if stream can not be interpreted as RFC1421
* encoded bytes
*/
try {
} catch (IOException ioe1) {
throw new IOException("Unable to read InputStream: " +
ioe1.getMessage());
}
/* stream appears to be hex-encoded bytes */
try {
break;
} else {
}
}
} catch (IOException ioe2) {
throw new IOException("Unable to read InputStream: "
+ ioe2.getMessage());
}
} else {
throw new IOException("InputStream is not RFC1421 hex-encoded " +
"DER bytes");
}
return der;
}
/**
* Construct an initialized X509 Certificate. The certificate is stored
* in raw form and has to be signed to be useful.
*
* @params info the X509CertificateInfo which the Certificate is to be
* created from.
*/
}
/**
* Unmarshal a certificate from its encoded form, parsing a DER value.
* This form of constructor is used by agents which need to examine
* and use certificate contents.
*
* @param derVal the der value containing the encoded cert.
* @exception CertificateException on parsing and initialization errors.
*/
try {
} catch (IOException e) {
signedCert = null;
throw new CertificateException("Unable to initialize, " + e, e);
}
}
/**
* Appends the certificate to an output stream.
*
* @param out an input stream to which the certificate is appended.
* @exception CertificateEncodingException on encoding errors.
*/
throws CertificateEncodingException {
if (signedCert == null)
throw new CertificateEncodingException(
"Null certificate to encode");
try {
} catch (IOException e) {
throw new CertificateEncodingException(e.toString());
}
}
/**
* DER encode this object onto an output stream.
* Implements the <code>DerEncoder</code> interface.
*
* @param out the output stream on which to write the DER encoding.
*
* @exception IOException on encoding error.
*/
if (signedCert == null)
throw new IOException("Null certificate to encode");
}
/**
* Returns the encoded form of this certificate. It is
* assumed that each certificate type would have only a single
* form of encoding; for example, X.509 certificates would
* be encoded as ASN.1 DER.
*
* @exception CertificateEncodingException if an encoding error occurs.
*/
return getEncodedInternal().clone();
}
/**
* Returned the encoding as an uncloned byte array. Callers must
* guarantee that they neither modify it nor expose it to untrusted
* code.
*/
if (signedCert == null) {
throw new CertificateEncodingException(
"Null certificate to encode");
}
return signedCert;
}
/**
* Throws an exception if the certificate was not signed using the
* verification key provided. Successfully verifying a certificate
* does <em>not</em> indicate that one should trust the entity which
* it represents.
*
* @param key the public key used for verification.
*
* @exception InvalidKeyException on incorrect key.
* @exception NoSuchAlgorithmException on unsupported signature
* algorithms.
* @exception NoSuchProviderException if there's no default provider.
* @exception SignatureException on signature errors.
* @exception CertificateException on encoding errors.
*/
}
/**
* Throws an exception if the certificate was not signed using the
* verification key provided. Successfully verifying a certificate
* does <em>not</em> indicate that one should trust the entity which
* it represents.
*
* @param key the public key used for verification.
* @param sigProvider the name of the provider.
*
* @exception NoSuchAlgorithmException on unsupported signature
* algorithms.
* @exception InvalidKeyException on incorrect key.
* @exception NoSuchProviderException on incorrect provider.
* @exception SignatureException on signature errors.
* @exception CertificateException on encoding errors.
*/
if (sigProvider == null) {
sigProvider = "";
}
// this certificate has already been verified using
// this public key. Make sure providers match, too.
if (verificationResult) {
return;
} else {
throw new SignatureException("Signature does not match.");
}
}
}
if (signedCert == null) {
throw new CertificateEncodingException("Uninitialized certificate");
}
// Verify the signature ...
} else {
}
// verify may throw SignatureException for invalid encodings, etc.
if (verificationResult == false) {
throw new SignatureException("Signature does not match.");
}
}
/**
* Creates an X.509 certificate, and signs it using the given key
* (associating a signature algorithm and an X.500 name).
* This operation is used to implement the certificate generation
* functionality of a certificate authority.
*
* @param key the private key used for signing.
* @param algorithm the name of the signature algorithm used.
*
* @exception InvalidKeyException on incorrect key.
* @exception NoSuchAlgorithmException on unsupported signature
* algorithms.
* @exception NoSuchProviderException if there's no default provider.
* @exception SignatureException on signature errors.
* @exception CertificateException on encoding errors.
*/
}
/**
* Creates an X.509 certificate, and signs it using the given key
* (associating a signature algorithm and an X.500 name).
* This operation is used to implement the certificate generation
* functionality of a certificate authority.
*
* @param key the private key used for signing.
* @param algorithm the name of the signature algorithm used.
* @param provider the name of the provider.
*
* @exception NoSuchAlgorithmException on unsupported signature
* algorithms.
* @exception InvalidKeyException on incorrect key.
* @exception NoSuchProviderException on incorrect provider.
* @exception SignatureException on signature errors.
* @exception CertificateException on encoding errors.
*/
try {
if (readOnly)
throw new CertificateEncodingException(
"cannot over-write existing certificate");
else
// in case the name is reset
// encode certificate info
// encode algorithm identifier
// Create and encode the signature itself.
// Wrap the signed data in a SEQUENCE { data, algorithm, sig }
readOnly = true;
} catch (IOException e) {
throw new CertificateEncodingException(e.toString());
}
}
/**
* Checks that the certificate is currently valid, i.e. the current
* time is within the specified validity period.
*
* @exception CertificateExpiredException if the certificate has expired.
* @exception CertificateNotYetValidException if the certificate is not
* yet valid.
*/
public void checkValidity()
}
/**
* Checks that the specified date is within the certificate's
* validity period, or basically if the certificate would be
*
* @param date the Date to check against to see if this certificate
*
* @exception CertificateExpiredException if the certificate has expired
* with respect to the <code>date</code> supplied.
* @exception CertificateNotYetValidException if the certificate is not
* yet valid with respect to the <code>date</code> supplied.
*/
try {
} catch (Exception e) {
throw new CertificateNotYetValidException("Incorrect validity period");
}
throw new CertificateNotYetValidException("Null validity period");
}
/**
* Return the requested attribute from the certificate.
*
* Note that the X509CertInfo is not cloned for performance reasons.
* Callers must ensure that they do not modify it. All other
* attributes are cloned.
*
* @param name the name of the attribute.
* @exception CertificateParsingException on invalid attribute identifier.
*/
throws CertificateParsingException {
throw new CertificateParsingException("Invalid root of "
+ "attribute name, expected [" + NAME +
}
return null;
}
try {
} catch (IOException e) {
throw new CertificateParsingException(e.toString());
} catch (CertificateException e) {
throw new CertificateParsingException(e.toString());
}
} else {
return info;
}
return(algId);
else
return null;
if (signedCert != null)
return signedCert.clone();
else
return null;
} else {
throw new CertificateParsingException("Attribute name not "
+ "recognized or get() not allowed for the same: " + id);
}
}
/**
* Set the requested attribute in the certificate.
*
* @param name the name of the attribute.
* @param obj the value of the attribute.
* @exception CertificateException on invalid attribute identifier.
* @exception IOException on encoding error of attribute.
*/
throws CertificateException, IOException {
// check if immutable
if (readOnly)
throw new CertificateException("cannot over-write existing"
+ " certificate");
throw new CertificateException("Invalid root of attribute name,"
}
if (!(obj instanceof X509CertInfo)) {
throw new CertificateException("Attribute value should"
+ " be of type X509CertInfo.");
}
} else {
}
} else {
throw new CertificateException("Attribute name not recognized or " +
"set() not allowed for the same: " + id);
}
}
/**
* Delete the requested attribute from the certificate.
*
* @param name the name of the attribute.
* @exception CertificateException on invalid attribute identifier.
* @exception IOException on other errors.
*/
throws CertificateException, IOException {
// check if immutable
if (readOnly)
throw new CertificateException("cannot over-write existing"
+ " certificate");
throw new CertificateException("Invalid root of attribute name,"
+ " expected ["
}
} else {
}
signedCert = null;
} else {
throw new CertificateException("Attribute name not recognized or " +
"delete() not allowed for the same: " + id);
}
}
/**
* Return an enumeration of names of attributes existing within this
* attribute.
*/
}
/**
* Return the name of this attribute.
*/
return(NAME);
}
/**
* Returns a printable representation of the certificate. This does not
* contain all the information available to distinguish this from any
* other certificate. The certificate must be fully constructed
* before this function may be called.
*/
return "";
}
// the strongly typed gets, as per java.security.cert.X509Certificate
/**
* Gets the publickey from this certificate.
*
* @return the publickey.
*/
return null;
try {
return key;
} catch (Exception e) {
return null;
}
}
/**
* Gets the version number from the certificate.
*
* @return the version number, i.e. 1, 2 or 3.
*/
public int getVersion() {
return -1;
try {
return vers+1;
} catch (Exception e) {
return -1;
}
}
/**
* Gets the serial number from the certificate.
*
* @return the serial number.
*/
}
/**
* Gets the serial number from the certificate as
* a SerialNumber object.
*
* @return the serial number.
*/
return null;
try {
return ser;
} catch (Exception e) {
return null;
}
}
/**
* Gets the subject distinguished name from the certificate.
*
* @return the subject name.
*/
return null;
try {
return subject;
} catch (Exception e) {
return null;
}
}
/**
* Get subject name as X500Principal. Overrides implementation in
* X509Certificate with a slightly more efficient version that is
* also aware of X509CertImpl mutability.
*/
return null;
}
try {
return subject;
} catch (Exception e) {
return null;
}
}
/**
* Gets the issuer distinguished name from the certificate.
*
* @return the issuer name.
*/
return null;
try {
return issuer;
} catch (Exception e) {
return null;
}
}
/**
* Get issuer name as X500Principal. Overrides implementation in
* X509Certificate with a slightly more efficient version that is
* also aware of X509CertImpl mutability.
*/
return null;
}
try {
return issuer;
} catch (Exception e) {
return null;
}
}
/**
* Gets the notBefore date from the validity period of the certificate.
*
* @return the start date of the validity period.
*/
return null;
try {
return d;
} catch (Exception e) {
return null;
}
}
/**
* Gets the notAfter date from the validity period of the certificate.
*
* @return the end date of the validity period.
*/
return null;
try {
return d;
} catch (Exception e) {
return null;
}
}
/**
* Gets the DER encoded certificate informations, the
* <code>tbsCertificate</code> from this certificate.
* This can be used to verify the signature independently.
*
* @return the DER encoded certificate information.
* @exception CertificateEncodingException if an encoding error occurs.
*/
return info.getEncodedInfo();
} else
throw new CertificateEncodingException("Uninitialized certificate");
}
/**
* Gets the raw Signature bits from the certificate.
*
* @return the signature.
*/
public byte[] getSignature() {
return null;
return dup;
}
/**
* Gets the signature algorithm name for the certificate
* signature algorithm.
*
* @return the signature algorithm name.
*/
return null;
}
/**
* Gets the signature algorithm OID string from the certificate.
* For example, the string "1.2.840.10040.4.3"
*
* @return the signature algorithm oid string.
*/
return null;
}
/**
* Gets the DER encoded signature algorithm parameters from this
* certificate's signature algorithm.
*
* @return the DER encoded signature algorithm parameters, or
* null if no parameters are present.
*/
public byte[] getSigAlgParams() {
return null;
try {
return algId.getEncodedParams();
} catch (IOException e) {
return null;
}
}
/**
* Gets the Issuer Unique Identity from the certificate.
*
* @return the Issuer Unique Identity.
*/
public boolean[] getIssuerUniqueID() {
return null;
try {
return null;
else
} catch (Exception e) {
return null;
}
}
/**
* Gets the Subject Unique Identity from the certificate.
*
* @return the Subject Unique Identity.
*/
public boolean[] getSubjectUniqueID() {
return null;
try {
return null;
else
} catch (Exception e) {
return null;
}
}
/**
* Get AuthorityKeyIdentifier extension
* @return AuthorityKeyIdentifier object or null (if no such object
* in certificate)
*/
{
return (AuthorityKeyIdentifierExtension)
}
/**
* Return the issuing authority's key identifier bytes, or null
*/
public byte[] getIssuerKeyIdentifier()
{
if (issuerKeyId == null) {
try {
issuerKeyId = ((KeyIdentifier)
.getIdentifier();
} catch (IOException e) {
// should never happen (because KEY_ID attr is supported)
}
} else {
}
}
}
/**
* Get BasicConstraints extension
* @return BasicConstraints object or null (if no such object in
* certificate)
*/
return (BasicConstraintsExtension)
}
/**
* Get CertificatePoliciesExtension
* @return CertificatePoliciesExtension or null (if no such object in
* certificate)
*/
return (CertificatePoliciesExtension)
}
/**
* Get ExtendedKeyUsage extension
* @return ExtendedKeyUsage extension object or null (if no such object
* in certificate)
*/
return (ExtendedKeyUsageExtension)
}
/**
* Get IssuerAlternativeName extension
* @return IssuerAlternativeName object or null (if no such object in
* certificate)
*/
return (IssuerAlternativeNameExtension)
}
/**
* Get NameConstraints extension
* @return NameConstraints object or null (if no such object in certificate)
*/
return (NameConstraintsExtension)
}
/**
* Get PolicyConstraints extension
* @return PolicyConstraints object or null (if no such object in
* certificate)
*/
return (PolicyConstraintsExtension)
}
/**
* Get PolicyMappingsExtension extension
* @return PolicyMappingsExtension object or null (if no such object
* in certificate)
*/
return (PolicyMappingsExtension)
}
/**
* Get PrivateKeyUsage extension
* @return PrivateKeyUsage object or null (if no such object in certificate)
*/
return (PrivateKeyUsageExtension)
}
/**
* Get SubjectAlternativeName extension
* @return SubjectAlternativeName object or null (if no such object in
* certificate)
*/
{
return (SubjectAlternativeNameExtension)
}
/**
* Get SubjectKeyIdentifier extension
* @return SubjectKeyIdentifier object or null (if no such object in
* certificate)
*/
return (SubjectKeyIdentifierExtension)
}
/**
* Returns the subject's key identifier bytes, or null
*/
public byte[] getSubjectKeyIdentifier()
{
if (subjectKeyId == null) {
try {
.getIdentifier();
} catch (IOException e) {
// should never happen (because KEY_ID attr is supported)
}
} else {
}
}
}
/**
* Get CRLDistributionPoints extension
* @return CRLDistributionPoints object or null (if no such object in
* certificate)
*/
return (CRLDistributionPointsExtension)
}
/**
* Return true if a critical extension is found that is
* not supported, otherwise return false.
*/
public boolean hasUnsupportedCriticalExtension() {
return false;
try {
return false;
return exts.hasUnsupportedCriticalExtension();
} catch (Exception e) {
return false;
}
}
/**
* Gets a Set of the extension(s) marked CRITICAL in the
* certificate. In the returned set, each extension is
* represented by its OID string.
*
* @return a set of the extension oid strings in the
* certificate that are marked critical.
*/
return null;
}
try {
return null;
}
if (ex.isCritical()) {
}
}
return extSet;
} catch (Exception e) {
return null;
}
}
/**
* Gets a Set of the extension(s) marked NON-CRITICAL in the
* certificate. In the returned set, each extension is
* represented by its OID string.
*
* @return a set of the extension oid strings in the
* certificate that are NOT marked critical.
*/
return null;
}
try {
return null;
}
if (!ex.isCritical()) {
}
}
return extSet;
} catch (Exception e) {
return null;
}
}
/**
* Gets the extension identified by the given ObjectIdentifier
*
* @param oid the Object Identifier value for the extension.
* @return Extension or null if certificate does not contain this
* extension
*/
return null;
}
try {
try {
} catch (CertificateException ce) {
return null;
}
if (extensions == null) {
return null;
} else {
return ex;
}
//XXXX May want to consider cloning this
return ex2;
}
}
/* no such extension in this certificate */
return null;
}
} catch (IOException ioe) {
return null;
}
}
return null;
}
try {
try {
} catch (CertificateException ce) {
return null;
}
if (extensions == null) {
return null;
} else {
}
} catch (IOException ioe) {
return null;
}
}
/**
* Gets the DER encoded extension identified by the given
* oid String.
*
* @param oid the Object Identifier value for the extension.
*/
try {
// get the extensions, search thru' for this oid
return null;
}
break;
}
}
} else { // there's sub-class that can handle this extension
try {
} catch (CertificateException e) {
// get() throws an Exception instead of returning null, ignore
}
}
}
return null;
}
}
return null;
}
return out.toByteArray();
} catch (Exception e) {
return null;
}
}
/**
* Get a boolean array representing the bits of the KeyUsage extension,
* (oid = 2.5.29.15).
* @return the bit values of this extension as an array of booleans.
*/
public boolean[] getKeyUsage() {
try {
return null;
return null;
boolean[] usageBits = new boolean[NUM_STANDARD_KEY_USAGE];
}
return ret;
} catch (Exception e) {
return null;
}
}
/**
* This method are the overridden implementation of
* getExtendedKeyUsage method in X509Certificate in the Sun
* provider. It is better performance-wise since it returns cached
* values.
*/
throws CertificateParsingException {
return extKeyUsage;
} else {
return null;
}
return extKeyUsage;
}
}
/**
* This static method is the default implementation of the
* getExtendedKeyUsage method in X509Certificate. A
* X509Certificate provider generally should overwrite this to
* provide among other things caching for better performance.
*/
throws CertificateParsingException {
try {
return null;
} catch (IOException ioe) {
throw new CertificateParsingException(ioe);
}
}
/**
* Get the certificate constraints path length from the
* the critical BasicConstraints extension, (oid = 2.5.29.19).
* @return the length of the constraint.
*/
public int getBasicConstraints() {
try {
return -1;
return -1;
).booleanValue() == true)
else
return -1;
} catch (Exception e) {
return -1;
}
}
/**
* Converts a GeneralNames structure into an immutable Collection of
* alternative names (subject or issuer) in the form required by
* {@link #getSubjectAlternativeNames} or
* {@link #getIssuerAlternativeNames}.
*
* @param names the GeneralNames to be converted
* @return an immutable Collection of alternative names
*/
}
break;
case GeneralNameInterface.NAME_DNS:
break;
break;
case GeneralNameInterface.NAME_URI:
break;
case GeneralNameInterface.NAME_IP:
try {
} catch (IOException ioe) {
// IPAddressName in cert is bogus
throw new RuntimeException("IPAddress cannot be parsed",
ioe);
}
break;
case GeneralNameInterface.NAME_OID:
break;
default:
// add DER encoded form
try {
} catch (IOException ioe) {
// should not occur since name has already been decoded
// from cert (this would indicate a bug in our code)
}
break;
}
}
}
/**
* Checks a Collection of altNames and clones any name entries of type
* byte [].
*/ // only partially generified due to javac bug
boolean mustClone = false;
// must clone names
mustClone = true;
}
}
if (mustClone) {
if (nameObject instanceof byte[]) {
} else {
}
}
} else {
return altNames;
}
}
/**
* This method are the overridden implementation of
* getSubjectAlternativeNames method in X509Certificate in the Sun
* provider. It is better performance-wise since it returns cached
* values.
*/
throws CertificateParsingException {
// return cached value if we can
return cloneAltNames(subjectAlternativeNames);
}
if (subjectAltNameExt == null) {
return null;
}
try {
} catch (IOException ioe) {
// should not occur
}
return subjectAlternativeNames;
}
/**
* This static method is the default implementation of the
* getSubjectAlternaitveNames method in X509Certificate. A
* X509Certificate provider generally should overwrite this to
* provide among other things caching for better performance.
*/
throws CertificateParsingException {
try {
return null;
}
data);
try {
} catch (IOException ioe) {
// should not occur
}
return makeAltNames(names);
} catch (IOException ioe) {
throw new CertificateParsingException(ioe);
}
}
/**
* This method are the overridden implementation of
* getIssuerAlternativeNames method in X509Certificate in the Sun
* provider. It is better performance-wise since it returns cached
* values.
*/
throws CertificateParsingException {
// return cached value if we can
return cloneAltNames(issuerAlternativeNames);
}
if (issuerAltNameExt == null) {
return null;
}
try {
} catch (IOException ioe) {
// should not occur
}
return issuerAlternativeNames;
}
/**
* This static method is the default implementation of the
* getIssuerAlternaitveNames method in X509Certificate. A
* X509Certificate provider generally should overwrite this to
* provide among other things caching for better performance.
*/
throws CertificateParsingException {
try {
return null;
}
data);
try {
} catch (IOException ioe) {
// should not occur
}
return makeAltNames(names);
} catch (IOException ioe) {
throw new CertificateParsingException(ioe);
}
}
return (AuthorityInfoAccessExtension)
}
/************************************************************/
/*
* Cert is a SIGNED ASN.1 macro, a three elment sequence:
*
* - Data to be signed (ToBeSigned) -- the "raw" cert
* - Signature algorithm (SigAlgId)
* - The signature bits
*
* This routine unmarshals the certificate, saving the signature
* parts away for later verification.
*/
throws CertificateException, IOException {
// check if can over write the certificate
if (readOnly)
throw new CertificateParsingException(
"cannot over-write existing certificate");
throw new CertificateParsingException(
"invalid DER-encoded certificate data");
throw new CertificateParsingException("signed overrun, bytes = "
}
throw new CertificateParsingException("signed fields invalid");
}
throw new CertificateParsingException("algid field overrun");
}
throw new CertificateParsingException("signed fields overrun");
// The CertificateInfo
// the "inner" and "outer" signature algorithms must match
+ DOT +
throw new CertificateException("Signature algorithm mismatch");
readOnly = true;
}
/**
* Extract the subject or issuer X500Principal from an X509Certificate.
* Parses the encoded form of the cert to preserve the principal's
* ASN.1 encoding.
*/
// skip version number if present
}
// tmp always contains serial number now
if (getIssuer == false) {
}
return new X500Principal(principalBytes);
}
/**
* Extract the subject X500Principal from an X509Certificate.
* Called from java.security.cert.X509Certificate.getSubjectX500Principal().
*/
try {
return getX500Principal(cert, false);
} catch (Exception e) {
throw new RuntimeException("Could not parse subject", e);
}
}
/**
* Extract the issuer X500Principal from an X509Certificate.
* Called from java.security.cert.X509Certificate.getIssuerX500Principal().
*/
try {
return getX500Principal(cert, true);
} catch (Exception e) {
throw new RuntimeException("Could not parse issuer", e);
}
}
/**
* Returned the encoding of the given certificate for internal use.
* Callers must guarantee that they neither modify it nor expose it
* to untrusted code. Uses getEncodedInternal() if the certificate
* is instance of X509CertImpl, getEncoded() otherwise.
*/
throws CertificateEncodingException {
if (cert instanceof X509CertImpl) {
} else {
return cert.getEncoded();
}
}
/**
* Utility method to convert an arbitrary instance of X509Certificate
* to a X509CertImpl. Does a cast if possible, otherwise reparses
* the encoding.
*/
throws CertificateException {
if (cert instanceof X509CertImpl) {
return (X509CertImpl)cert;
} else {
}
}
/**
* Utility method to test if a certificate is self-issued. This is
* the case iff the subject and issuer X500Principals are equal.
*/
}
/**
* Utility method to test if a certificate is self-signed. This is
* the case iff the subject and issuer X500Principals are equal
* AND the certificate's subject public key can be used to verify
* the certificate. In case of exception, returns false.
*/
if (isSelfIssued(cert)) {
try {
if (sigProvider == null) {
} else {
}
return true;
} catch (Exception e) {
// In case of exception, return false
}
}
return false;
}
}