Class PKIXCRLValidator

java.lang.Object
org.bouncycastle.asn1.x509.PKIXCRLValidator
public class PKIXCRLValidator extends Object
Validator for the CRL scope rules of RFC 5280 sec. 6.3.3: the (b)(1) cRLIssuer check, the (b)(2) issuing distribution point checks, the (c) delta CRL consistency checks and the (d) reasons intersection. The methods work purely on ASN.1 structures so the JCA cert path implementations in the provider and in the PKIX revocation checker can share them - the scope analogue of PKIXNameConstraintValidator.

  • Field Details

    • ALL_REASONS

      public static final int ALL_REASONS
      A reasons mask asserting all revocation reasons.
      See Also:

  • Constructor Details

    • PKIXCRLValidator

      public PKIXCRLValidator()

  • Method Details

    • requiresCRLIssuer

      public static boolean requiresCRLIssuer(IssuingDistributionPoint idp)
      Return true if checkDistributionPointName(IssuingDistributionPoint, DistributionPoint, X500Name, X500Name) will need the CRL issuer name for the passed in issuing distribution point - i.e. its distribution point name is relative to the CRL issuer.

    • requiresCertificateIssuer

      public static boolean requiresCertificateIssuer(IssuingDistributionPoint idp, DistributionPoint dp)
      Return true if checkDistributionPointName(IssuingDistributionPoint, DistributionPoint, X500Name, X500Name) will need the certificate issuer name for the passed in issuing distribution point and distribution point - i.e. the DP name is relative to the CRL issuer and the DP carries no cRLIssuer to resolve it against.

    • checkDistributionPointName

      public static void checkDistributionPointName(IssuingDistributionPoint idp, DistributionPoint dp, X500Name crlIssuer, X500Name certIssuer) throws CRLValidatorException
      RFC 5280 sec. 6.3.3 (b)(2)(i): if the distribution point name is present in the IDP CRL extension and the distribution field is present in the DP, verify that one of the names in the IDP matches one of the names in the DP; if the distribution field is omitted from the DP, verify that one of the names in the IDP matches one of the names in the cRLIssuer field of the DP.
      Parameters:
      idp - the CRL's issuing distribution point (may be null - no checks apply).
      dp - the distribution point from the certificate.
      crlIssuer - the CRL issuer name; only required when requiresCRLIssuer(IssuingDistributionPoint).
      certIssuer - the certificate issuer name; only required when requiresCertificateIssuer(IssuingDistributionPoint, DistributionPoint).
      Throws:
      CRLValidatorException - if no match is found or the DP is malformed.

    • checkOnlyContains

      public static void checkOnlyContains(IssuingDistributionPoint idp, BasicConstraints certBasicConstraints, boolean isCertificate) throws CRLValidatorException
      RFC 5280 sec. 6.3.3 (b)(2)(ii)-(iv): the onlyContainsUserCerts, onlyContainsCACerts and onlyContainsAttributeCerts checks.
      Parameters:
      idp - the CRL's issuing distribution point (may be null - no checks apply).
      certBasicConstraints - the certificate's basic constraints extension, null if absent.
      isCertificate - true for a public key certificate, false for an attribute certificate.
      Throws:
      CRLValidatorException - if the certificate is outside the CRL's asserted scope.

    • checkCRLIssuer

      public static void checkCRLIssuer(DistributionPoint dp, byte[] crlIssuerEncoded, boolean isIndirect) throws CRLValidatorException
      RFC 5280 sec. 6.3.3 (b)(1), cRLIssuer present in the DP: verify that the issuer field in the complete CRL matches cRLIssuer in the DP and that the CRL is an indirect CRL.
      Parameters:
      dp - the distribution point, with a cRLIssuer field present.
      crlIssuerEncoded - the DER encoding of the CRL's issuer name.
      isIndirect - whether the CRL's issuing distribution point asserts indirectCRL.
      Throws:
      CRLValidatorException - if the issuer does not match or the CRL is not indirect.

    • checkDeltaIssuingDistributionPoint

      public static void checkDeltaIssuingDistributionPoint(IssuingDistributionPoint completeIDP, IssuingDistributionPoint deltaIDP) throws CRLValidatorException
      RFC 5280 sec. 6.3.3 (c)(2): the complete CRL and delta CRL must carry matching issuing distribution point extensions (or both omit them).
      Throws:
      CRLValidatorException - if the issuing distribution points do not match.

    • checkDeltaAuthorityKeyIdentifiers

      public static void checkDeltaAuthorityKeyIdentifiers(ASN1Primitive completeKeyIdentifier, ASN1Primitive deltaKeyIdentifier) throws CRLValidatorException
      RFC 5280 sec. 6.3.3 (c)(3): the complete CRL and delta CRL must both carry an authority key identifier, and the two must match.
      Throws:
      CRLValidatorException - if either key identifier is absent or they do not match.

    • isRevocationEffective

      public static boolean isRevocationEffective(Date validDate, Date revocationDate, int reasonCodeValue)
      RFC 5280 sec. 6.3.3 (i)/(j): whether a CRL entry's revocation takes effect for the validation date - it does when the date is not before the entry's revocation date, and additionally, whatever the dates, for the unspecified, keyCompromise, cACompromise and aACompromise reasons.
      Parameters:
      validDate - the date validation is being performed for.
      revocationDate - the CRL entry's revocation date.
      reasonCodeValue - the entry's CRLReason code, CRLReason.unspecified if absent.
      Returns:
      true if the certificate is to be treated as revoked at validDate.

    • intersectReasons

      public static int intersectReasons(IssuingDistributionPoint idp, DistributionPoint dp)
      RFC 5280 sec. 6.3.3 (d)(1)-(d)(4): intersect the reasons asserted by the CRL's issuing distribution point and the certificate's distribution point; absent reasons are interpreted as all reasons.
      Returns:
      the intersected ReasonFlags reasons.