Package eu.europa.esig.dss.validation

Class CommonCertificateVerifier

java.lang.Object

eu.europa.esig.dss.validation.CommonCertificateVerifier

All Implemented Interfaces:

CertificateVerifier

public class CommonCertificateVerifier
extends Object
implements CertificateVerifier

This class provides the different sources used to verify the status of a certificate using the trust model. There are four different types of sources to be defined:
- Trusted certificates source;
- Adjunct certificates source (not trusted);
- OCSP source;
- CRL source.
The DataLoader should be provided to give access to the certificates through AIA.

Constructor Summary

Constructors

Constructor	Description
CommonCertificateVerifier()	The default constructor.
CommonCertificateVerifier(boolean simpleCreationOnly)	This constructor allows to create CommonCertificateVerifier without DataLoader.
CommonCertificateVerifier(List<CertificateSource> trustedCertSources, CRLSource crlSource, OCSPSource ocspSource, DataLoader dataLoader)	The constructor with key parameters.

Method Summary

Modifier and Type	Method	Description
void	clearTrustedCertSources()	This methods clears the list of defined trusted certificate sources
CertificatePool	createValidationPool()	This method creates the validation pool of certificates which is used during the validation process.
CertificateSource	getAdjunctCertSource()	Returns the adjunct certificates source associated with this verifier.
RevocationSource<CRLToken>	getCrlSource()	Returns the CRL source associated with this verifier.
DataLoader	getDataLoader()	The data loader used to access AIA certificate source.
DigestAlgorithm	getDefaultDigestAlgorithm()	This method returns a default Digest Algorithm what will be used for digest calculation
RevocationSource<OCSPToken>	getOcspSource()	Returns the OCSP source associated with this verifier.
ListCRLSource	getSignatureCRLSource()	This method returns the CRL source (information extracted from signatures).
ListOCSPSource	getSignatureOCSPSource()	This method returns the OCSP source (information extracted from signatures).
List<CertificateSource>	getTrustedCertSources()	Returns the trusted certificate sources associated with this verifier.
boolean	isCheckRevocationForUntrustedChains()	This method returns true if revocation check is enabled for untrusted certificate chains.
boolean	isExceptionOnInvalidTimestamp()	This method returns true if an exception needs to be thrown on invalid timestamp.
boolean	isExceptionOnMissingRevocationData()	This method returns true if an exception needs to be thrown on missing revocation data.
boolean	isExceptionOnNoRevocationAfterBestSignatureTime()	This method returns true if an exception needs to be thrown in case if no revocation data obtained with an issuance time after the bestSignatureTime
boolean	isExceptionOnRevokedCertificate()	This method returns true if an exception needs to be thrown on revoked certificate.
boolean	isExceptionOnUncoveredPOE()	This method returns true if an exception needs to be thrown on uncovered POE(timestamp).
boolean	isIncludeCertificateRevocationValues()	This method returns true if the revocation data need to be exported in the diagnostic data report.
boolean	isIncludeCertificateTokenValues()	This method returns true if the certificate tokens need to be exported in the diagnostic data report.
boolean	isIncludeTimestampTokenValues()	This method returns true if the timestamp tokens need to be exported in the diagnostic data report.
void	setAdjunctCertSource(CertificateSource adjunctCertSource)	Associates an adjunct certificates source to this verifier.
void	setCheckRevocationForUntrustedChains(boolean checkRevocationForUntrustedChains)	This method allows to enable revocation checking for untrusted certificate chains (default : false)
void	setCrlSource(RevocationSource<CRLToken> crlSource)	Defines the source of CRL used by this class
void	setDataLoader(DataLoader dataLoader)	The data loader used to access AIA certificate source.
void	setDefaultDigestAlgorithm(DigestAlgorithm digestAlgorithm)	This method allows to change the Digest Algorithm that will be used for tokens' digest calculation
void	setExceptionOnInvalidTimestamp(boolean throwExceptionOnInvalidTimestamp)	This method allows to change the behavior on invalid timestamp (LT/LTA augmentation).
void	setExceptionOnMissingRevocationData(boolean throwExceptionOnMissingRevocationData)	This method allows to change the behavior on missing revocation data (LT/LTA augmentation).
void	setExceptionOnNoRevocationAfterBestSignatureTime(boolean exceptionOnNoRevocationAfterBestSignatureTime)	This method allows to change the behavior on revocation data issued after a control time.
void	setExceptionOnRevokedCertificate(boolean exceptionOnRevokedCertificate)	This method allows to change the behavior on revoked certificates (LT/LTA augmentation).
void	setExceptionOnUncoveredPOE(boolean exceptionOnUncoveredPOE)	This method allows to change the behavior on uncovered POE (timestamp).
void	setIncludeCertificateRevocationValues(boolean include)	This method allows to change the behavior by including raw revocation data in the diagnostic data report.
void	setIncludeCertificateTokenValues(boolean includeCertificateTokens)	This method allows to change the behavior by including raw certificate tokens in the diagnostic data report.
void	setIncludeTimestampTokenValues(boolean include)	This method allows to change the behavior by including raw timestamp tokens in the diagnostic data report.
void	setOcspSource(RevocationSource<OCSPToken> ocspSource)	Defines the source of OCSP used by this class
void	setSignatureCRLSource(ListCRLSource signatureCRLSource)	This method allows to set the CRL source (information extracted from signatures).
void	setSignatureOCSPSource(ListOCSPSource signatureOCSPSource)	This method allows to set the OCSP source (information extracted from signatures).
void	setTrustedCertSource(CertificateSource trustedCertSource)	Sets the trusted certificates source.
void	setTrustedCertSources(CertificateSource... certSources)	Sets multiple trusted certificates source.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

CommonCertificateVerifier

public CommonCertificateVerifier()

The default constructor. The DataLoader is created to allow the retrieval of certificates through AIA.

CommonCertificateVerifier

public CommonCertificateVerifier(boolean simpleCreationOnly)

This constructor allows to create CommonCertificateVerifier without DataLoader. It means that only a profile -B signatures can be created.

Parameters:

simpleCreationOnly - if true the CommonCertificateVerifier will not contain DataLoader.

CommonCertificateVerifier

public CommonCertificateVerifier(List<CertificateSource> trustedCertSources, CRLSource crlSource, OCSPSource ocspSource, DataLoader dataLoader)

The constructor with key parameters.

Parameters:

trustedCertSources - the reference to the trusted certificate sources.

crlSource - contains the reference to the OCSPSource.

ocspSource - contains the reference to the CRLSource.

dataLoader - contains the reference to a data loader used to access AIA certificate source.

Method Details

getTrustedCertSources

public List<CertificateSource> getTrustedCertSources()

Description copied from interface: CertificateVerifier

Returns the trusted certificate sources associated with this verifier. These sources are used to identify the trusted anchors.

Specified by:

getTrustedCertSources in interface CertificateVerifier

Returns:

the certificate sources which contain trusted certificates

getOcspSource

public RevocationSource<OCSPToken> getOcspSource()

Description copied from interface: CertificateVerifier

Returns the OCSP source associated with this verifier.

Specified by:

getOcspSource in interface CertificateVerifier

Returns:

the used OCSP source for external access (web, filesystem, cached,...)

getCrlSource

public RevocationSource<CRLToken> getCrlSource()

Description copied from interface: CertificateVerifier

Returns the CRL source associated with this verifier.

Specified by:

getCrlSource in interface CertificateVerifier

Returns:

the used CRL source for external access (web, filesystem, cached,...)

setCrlSource

public void setCrlSource(RevocationSource<CRLToken> crlSource)

Description copied from interface: CertificateVerifier

Defines the source of CRL used by this class

Specified by:

setCrlSource in interface CertificateVerifier

Parameters:

crlSource - the CRL source to set for external access (web, filesystem, cached,...)

setOcspSource

public void setOcspSource(RevocationSource<OCSPToken> ocspSource)

Description copied from interface: CertificateVerifier

Defines the source of OCSP used by this class

Specified by:

setOcspSource in interface CertificateVerifier

Parameters:

ocspSource - the OCSP source to set for external access (web, filesystem, cached,...)

setTrustedCertSource

public void setTrustedCertSource(CertificateSource trustedCertSource)

Description copied from interface: CertificateVerifier

Sets the trusted certificates source.

Specified by:

setTrustedCertSource in interface CertificateVerifier

Parameters:

trustedCertSource - The certificates source with known trusted certificates

setTrustedCertSources

public void setTrustedCertSources(CertificateSource... certSources)

Description copied from interface: CertificateVerifier

Sets multiple trusted certificates source.

Specified by:

setTrustedCertSources in interface CertificateVerifier

Parameters:

certSources - The certificate sources with known trusted certificates

clearTrustedCertSources

public void clearTrustedCertSources()

This methods clears the list of defined trusted certificate sources

getAdjunctCertSource

public CertificateSource getAdjunctCertSource()

Description copied from interface: CertificateVerifier

Returns the adjunct certificates source associated with this verifier.

Specified by:

getAdjunctCertSource in interface CertificateVerifier

Returns:

the certificate source which contains additional certificate (missing CA,...)

setAdjunctCertSource

public void setAdjunctCertSource(CertificateSource adjunctCertSource)

Description copied from interface: CertificateVerifier

Associates an adjunct certificates source to this verifier.

Specified by:

setAdjunctCertSource in interface CertificateVerifier

Parameters:

adjunctCertSource - the certificate source with additional and missing certificates

getDataLoader

public DataLoader getDataLoader()

Description copied from interface: CertificateVerifier

The data loader used to access AIA certificate source.

Specified by:

getDataLoader in interface CertificateVerifier

Returns:

the used data loaded to load AIA resources and policy files

setDataLoader

public void setDataLoader(DataLoader dataLoader)

Description copied from interface: CertificateVerifier

The data loader used to access AIA certificate source. If this property is not set the default CommonsHttpDataLoader is created.

Specified by:

setDataLoader in interface CertificateVerifier

Parameters:

dataLoader - the used data loaded to load AIA resources and policy files

getSignatureCRLSource

public ListCRLSource getSignatureCRLSource()

Description copied from interface: CertificateVerifier

This method returns the CRL source (information extracted from signatures).

Specified by:

getSignatureCRLSource in interface CertificateVerifier

Returns:

the CRL sources from the signature

setSignatureCRLSource

public void setSignatureCRLSource(ListCRLSource signatureCRLSource)

Description copied from interface: CertificateVerifier

This method allows to set the CRL source (information extracted from signatures).

Specified by:

setSignatureCRLSource in interface CertificateVerifier

Parameters:

signatureCRLSource - the CRL sources from the signature

getSignatureOCSPSource

public ListOCSPSource getSignatureOCSPSource()

Description copied from interface: CertificateVerifier

This method returns the OCSP source (information extracted from signatures).

Specified by:

getSignatureOCSPSource in interface CertificateVerifier

Returns:

the OCSP sources from the signature

setSignatureOCSPSource

public void setSignatureOCSPSource(ListOCSPSource signatureOCSPSource)

Description copied from interface: CertificateVerifier

This method allows to set the OCSP source (information extracted from signatures).

Specified by:

setSignatureOCSPSource in interface CertificateVerifier

Parameters:

signatureOCSPSource - the OCSP sources from the signature

setExceptionOnMissingRevocationData

public void setExceptionOnMissingRevocationData(boolean throwExceptionOnMissingRevocationData)

Description copied from interface: CertificateVerifier

This method allows to change the behavior on missing revocation data (LT/LTA augmentation). (default : true)

Specified by:

setExceptionOnMissingRevocationData in interface CertificateVerifier

Parameters:

throwExceptionOnMissingRevocationData - true if an exception is raised on missing revocation data, false will only display a warning message

isExceptionOnMissingRevocationData

public boolean isExceptionOnMissingRevocationData()

Description copied from interface: CertificateVerifier

This method returns true if an exception needs to be thrown on missing revocation data.

Specified by:

isExceptionOnMissingRevocationData in interface CertificateVerifier

Returns:

true if an exception is thrown, false if a warning message is added

isExceptionOnUncoveredPOE

public boolean isExceptionOnUncoveredPOE()

Description copied from interface: CertificateVerifier

This method returns true if an exception needs to be thrown on uncovered POE(timestamp).

Specified by:

isExceptionOnUncoveredPOE in interface CertificateVerifier

Returns:

true if an exception is thrown, false if a warning message is added

setExceptionOnUncoveredPOE

public void setExceptionOnUncoveredPOE(boolean exceptionOnUncoveredPOE)

Description copied from interface: CertificateVerifier

This method allows to change the behavior on uncovered POE (timestamp). (default : false)

Specified by:

setExceptionOnUncoveredPOE in interface CertificateVerifier

Parameters:

exceptionOnUncoveredPOE - true if an exception is raised on uncovered timestamp, false will only display a warning message

isExceptionOnRevokedCertificate

public boolean isExceptionOnRevokedCertificate()

Description copied from interface: CertificateVerifier

This method returns true if an exception needs to be thrown on revoked certificate.

Specified by:

isExceptionOnRevokedCertificate in interface CertificateVerifier

Returns:

true if an exception is thrown, false if a warning message is added

setExceptionOnRevokedCertificate

public void setExceptionOnRevokedCertificate(boolean exceptionOnRevokedCertificate)

Description copied from interface: CertificateVerifier

This method allows to change the behavior on revoked certificates (LT/LTA augmentation). (default : true)

Specified by:

setExceptionOnRevokedCertificate in interface CertificateVerifier

Parameters:

exceptionOnRevokedCertificate - true if an exception is raised on revoked certificate, false will only display a warning message

setExceptionOnInvalidTimestamp

public void setExceptionOnInvalidTimestamp(boolean throwExceptionOnInvalidTimestamp)

Description copied from interface: CertificateVerifier

This method allows to change the behavior on invalid timestamp (LT/LTA augmentation). (default : true)

Specified by:

setExceptionOnInvalidTimestamp in interface CertificateVerifier

Parameters:

throwExceptionOnInvalidTimestamp - true if an exception is raised on invalid timestamp, false will only display a warning message

isExceptionOnInvalidTimestamp

public boolean isExceptionOnInvalidTimestamp()

Description copied from interface: CertificateVerifier

This method returns true if an exception needs to be thrown on invalid timestamp.

Specified by:

isExceptionOnInvalidTimestamp in interface CertificateVerifier

Returns:

true if an exception is thrown, false if a warning message is added

setExceptionOnNoRevocationAfterBestSignatureTime

public void setExceptionOnNoRevocationAfterBestSignatureTime(boolean exceptionOnNoRevocationAfterBestSignatureTime)

Description copied from interface: CertificateVerifier

This method allows to change the behavior on revocation data issued after a control time. (default : false)

Specified by:

setExceptionOnNoRevocationAfterBestSignatureTime in interface CertificateVerifier

Parameters:

exceptionOnNoRevocationAfterBestSignatureTime - true if an exception is raised on no revocation data issued after the bestSignatureTime, false will only display a warning message

isExceptionOnNoRevocationAfterBestSignatureTime

public boolean isExceptionOnNoRevocationAfterBestSignatureTime()

Description copied from interface: CertificateVerifier

This method returns true if an exception needs to be thrown in case if no revocation data obtained with an issuance time after the bestSignatureTime

Specified by:

isExceptionOnNoRevocationAfterBestSignatureTime in interface CertificateVerifier

Returns:

true if an exception is thrown, false if a warning message is added

isCheckRevocationForUntrustedChains

public boolean isCheckRevocationForUntrustedChains()

Description copied from interface: CertificateVerifier

This method returns true if revocation check is enabled for untrusted certificate chains.

Specified by:

isCheckRevocationForUntrustedChains in interface CertificateVerifier

Returns:

true if external revocation check is done for untrusted certificate chains

setCheckRevocationForUntrustedChains

public void setCheckRevocationForUntrustedChains(boolean checkRevocationForUntrustedChains)

Description copied from interface: CertificateVerifier

This method allows to enable revocation checking for untrusted certificate chains (default : false)

Specified by:

setCheckRevocationForUntrustedChains in interface CertificateVerifier

Parameters:

checkRevocationForUntrustedChains - true if revocation checking is allowed for untrusted certificate chains

createValidationPool

public CertificatePool createValidationPool()

Description copied from interface: CertificateVerifier

This method creates the validation pool of certificates which is used during the validation process.

Specified by:

createValidationPool in interface CertificateVerifier

setDefaultDigestAlgorithm

public void setDefaultDigestAlgorithm(DigestAlgorithm digestAlgorithm)

Description copied from interface: CertificateVerifier

This method allows to change the Digest Algorithm that will be used for tokens' digest calculation

Specified by:

setDefaultDigestAlgorithm in interface CertificateVerifier

Parameters:

digestAlgorithm - DigestAlgorithm to use

getDefaultDigestAlgorithm

public DigestAlgorithm getDefaultDigestAlgorithm()

Description copied from interface: CertificateVerifier

This method returns a default Digest Algorithm what will be used for digest calculation

Specified by:

getDefaultDigestAlgorithm in interface CertificateVerifier

Returns:

DigestAlgorithm

setIncludeCertificateTokenValues

public void setIncludeCertificateTokenValues(boolean includeCertificateTokens)

Description copied from interface: CertificateVerifier

This method allows to change the behavior by including raw certificate tokens in the diagnostic data report.

Specified by:

setIncludeCertificateTokenValues in interface CertificateVerifier

Parameters:

includeCertificateTokens - true if raw certificate tokens should be included (default: false)

isIncludeCertificateTokenValues

public boolean isIncludeCertificateTokenValues()

Description copied from interface: CertificateVerifier

This method returns true if the certificate tokens need to be exported in the diagnostic data report.

Specified by:

isIncludeCertificateTokenValues in interface CertificateVerifier

Returns:

true if raw certificate tokens should be included in the diagnotic data report (default: false)

setIncludeCertificateRevocationValues

public void setIncludeCertificateRevocationValues(boolean include)

Description copied from interface: CertificateVerifier

This method allows to change the behavior by including raw revocation data in the diagnostic data report.

Specified by:

setIncludeCertificateRevocationValues in interface CertificateVerifier

Parameters:

include - true if raw revocation data should be included (default: false)

isIncludeCertificateRevocationValues

public boolean isIncludeCertificateRevocationValues()

Description copied from interface: CertificateVerifier

This method returns true if the revocation data need to be exported in the diagnostic data report.

Specified by:

isIncludeCertificateRevocationValues in interface CertificateVerifier

Returns:

true if raw revocation data should be included in the diagnotic data report (default: false)

setIncludeTimestampTokenValues

public void setIncludeTimestampTokenValues(boolean include)

Description copied from interface: CertificateVerifier

This method allows to change the behavior by including raw timestamp tokens in the diagnostic data report.

Specified by:

setIncludeTimestampTokenValues in interface CertificateVerifier

Parameters:

include - true if raw timestamp tokens should be included (default: false)

isIncludeTimestampTokenValues

public boolean isIncludeTimestampTokenValues()

Description copied from interface: CertificateVerifier

This method returns true if the timestamp tokens need to be exported in the diagnostic data report.

Specified by:

isIncludeTimestampTokenValues in interface CertificateVerifier

Returns:

true if raw timestamp tokens should be included in the diagnotic data report (default: false)