Package com.itextpdf.signatures

Class IssuingCertificateRetriever

    • Method Summary

      All Methods Static Methods Instance Methods Concrete Methods 
      Modifier and Type Method Description
      void addKnownCertificates​(java.util.Collection<java.security.cert.Certificate> certificates)
      Add certificates collection to known certificates storage, which is used for issuer certificates retrieval.
      void addTrustedCertificates​(java.util.Collection<java.security.cert.Certificate> certificates)
      Add trusted certificates collection to trusted certificates storage.
      java.util.List<java.security.cert.X509Certificate[]> buildCertificateChains​(java.security.cert.X509Certificate certificate)
      This method tries to rebuild certificate issuer chain.
      java.util.List<java.security.cert.X509Certificate[]> buildCertificateChains​(java.security.cert.X509Certificate[] certificate)
      This method tries to rebuild certificate issuer chain.
      private java.util.List<java.util.List<java.security.cert.X509Certificate>> buildCertificateChainsList​(java.security.cert.X509Certificate certificate)  
      private java.util.List<java.util.List<java.security.cert.X509Certificate>> buildCertificateChainsList​(java.security.cert.X509Certificate[] certificates)  
      java.security.cert.Certificate[] getCrlIssuerCertificates​(java.security.cert.CRL crl)
      Retrieves the certificate chain for the certificate that should be used to verify the signature on the CRL response using CRL Authority Information Access (AIA) Extension and known certificates.
      java.security.cert.Certificate[][] getCrlIssuerCertificatesByName​(java.security.cert.CRL crl)
      Retrieves the certificate chaind for the certificates that could be used to verify the signature on the CRL response using CRL Authority Information Access (AIA) Extension and known certificates.
      private java.security.cert.Certificate[][] getCrlIssuerCertificatesGeneric​(java.security.cert.CRL crl, boolean verify)  
      private java.util.List<java.security.cert.Certificate> getCrlIssuersFromKnownCertificates​(java.security.cert.X509CRL crl)  
      protected java.io.InputStream getIssuerCertByURI​(java.lang.String uri)
      Get CA issuers certificates represented as InputStream.
      private static java.security.cert.Certificate getIssuerFromCertificateSet​(java.security.cert.X509Certificate lastAddedCert, java.util.Collection<java.security.cert.Certificate> certs)  
      TrustedCertificatesStore getTrustedCertificatesStore()
      Gets TrustedCertificatesStore to be used to provide more complex trusted certificates configuration.
      boolean isCertificateTrusted​(java.security.cert.Certificate certificate)
      Check if provided certificate is present in trusted certificates storage.
      private static boolean isSignedBy​(java.security.cert.X509Certificate certificate, java.security.cert.Certificate issuer)  
      private static boolean isSignedBy​(java.security.cert.X509CRL crl, java.security.cert.Certificate issuer)  
      protected java.util.Collection<java.security.cert.Certificate> parseCertificates​(java.io.InputStream certsData)
      Parses certificates represented as byte array.
      private java.util.Collection<java.security.cert.Certificate> processCertificatesFromAIA​(java.lang.String url)  
      java.util.List<java.security.cert.X509Certificate> retrieveIssuerCertificate​(java.security.cert.Certificate certificate)
      Retrieve issuer certificate for the provided certificate.
      java.security.cert.Certificate[] retrieveMissingCertificates​(java.security.cert.Certificate[] chain)
      Retrieves missing certificates in chain using certificate Authority Information Access (AIA) Extension.
      java.util.Set<java.security.cert.Certificate> retrieveOCSPResponderByNameCertificate​(IBasicOCSPResp ocspResp)
      Retrieves OCSP responder certificate candidates either from the response certs or trusted store in case responder certificate isn't found in /Certs.
      void setTrustedCertificates​(java.util.Collection<java.security.cert.Certificate> certificates)
      Sets trusted certificate list to be used as certificates trusted for any possible usage.

      • Methods inherited from class java.lang.Object

        clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    • Field Detail

      • LOGGER

        private static final org.slf4j.Logger LOGGER

      • knownCertificates

        private final java.util.Map<java.lang.String,​java.util.List<java.security.cert.Certificate>> knownCertificates

    • Constructor Detail

      • IssuingCertificateRetriever

        public IssuingCertificateRetriever​(IResourceRetriever resourceRetriever)
        Creates IssuingCertificateRetriever instance.
        Parameters:
        resourceRetriever - an @{link IResourceRetriever} instance to use for performing http requests.

    • Method Detail

      • retrieveMissingCertificates

        public java.security.cert.Certificate[] retrieveMissingCertificates​(java.security.cert.Certificate[] chain)
        Retrieves missing certificates in chain using certificate Authority Information Access (AIA) Extension.
        Specified by:
        retrieveMissingCertificates in interface IIssuingCertificateRetriever
        Parameters:
        chain - certificate chain to restore with at least signing certificate.
        Returns:
        full chain of trust or maximum chain that could be restored in case missing certificates cannot be retrieved from AIA extension.

      • buildCertificateChains

        public java.util.List<java.security.cert.X509Certificate[]> buildCertificateChains​(java.security.cert.X509Certificate certificate)
        This method tries to rebuild certificate issuer chain. The result contains all possible chains starting with the given certificate based on issuer names and public keys.
        Parameters:
        certificate - X509Certificate for which issuer chains shall be built
        Returns:
        all possible issuer chains

      • buildCertificateChains

        public java.util.List<java.security.cert.X509Certificate[]> buildCertificateChains​(java.security.cert.X509Certificate[] certificate)
        This method tries to rebuild certificate issuer chain. The result contains all possible chains starting with the given certificate array based on issuer names and public keys.
        Parameters:
        certificate - X509Certificate array for which issuer chains shall be built
        Returns:
        all possible issuer chains

      • buildCertificateChainsList

        private java.util.List<java.util.List<java.security.cert.X509Certificate>> buildCertificateChainsList​(java.security.cert.X509Certificate[] certificates)

      • buildCertificateChainsList

        private java.util.List<java.util.List<java.security.cert.X509Certificate>> buildCertificateChainsList​(java.security.cert.X509Certificate certificate)

      • retrieveIssuerCertificate

        public java.util.List<java.security.cert.X509Certificate> retrieveIssuerCertificate​(java.security.cert.Certificate certificate)
        Retrieve issuer certificate for the provided certificate.
        Parameters:
        certificate - Certificate for which issuer certificate shall be retrieved
        Returns:
        issuer certificate. null if there is no issuer certificate, or it cannot be retrieved.

      • retrieveOCSPResponderByNameCertificate

        public java.util.Set<java.security.cert.Certificate> retrieveOCSPResponderByNameCertificate​(IBasicOCSPResp ocspResp)
        Retrieves OCSP responder certificate candidates either from the response certs or trusted store in case responder certificate isn't found in /Certs.
        Parameters:
        ocspResp - basic OCSP response to get responder certificate for
        Returns:
        retrieved OCSP responder candidates or an empty set in case none were found.

      • getCrlIssuerCertificates

        public java.security.cert.Certificate[] getCrlIssuerCertificates​(java.security.cert.CRL crl)
        Retrieves the certificate chain for the certificate that should be used to verify the signature on the CRL response using CRL Authority Information Access (AIA) Extension and known certificates.
        Specified by:
        getCrlIssuerCertificates in interface IIssuingCertificateRetriever
        Parameters:
        crl - CRL response to retrieve issuer for.
        Returns:
        certificates retrieved from CRL AIA extension or an empty list in case certificates cannot be retrieved.

      • getCrlIssuerCertificatesByName

        public java.security.cert.Certificate[][] getCrlIssuerCertificatesByName​(java.security.cert.CRL crl)
        Retrieves the certificate chaind for the certificates that could be used to verify the signature on the CRL response using CRL Authority Information Access (AIA) Extension and known certificates.
        Specified by:
        getCrlIssuerCertificatesByName in interface IIssuingCertificateRetriever
        Parameters:
        crl - CRL response to retrieve issuer for.
        Returns:
        certificates retrieved from CRL AIA extension or an empty list in case certificates cannot be retrieved.

      • getCrlIssuerCertificatesGeneric

        private java.security.cert.Certificate[][] getCrlIssuerCertificatesGeneric​(java.security.cert.CRL crl,
                                                                           boolean verify)

      • setTrustedCertificates

        public void setTrustedCertificates​(java.util.Collection<java.security.cert.Certificate> certificates)
        Sets trusted certificate list to be used as certificates trusted for any possible usage. In case more specific trusted is desired to be configured getTrustedCertificatesStore() method is expected to be used.
        Specified by:
        setTrustedCertificates in interface IIssuingCertificateRetriever
        Parameters:
        certificates - certificate list to be used as certificates trusted for any possible usage.

      • addTrustedCertificates

        public void addTrustedCertificates​(java.util.Collection<java.security.cert.Certificate> certificates)
        Add trusted certificates collection to trusted certificates storage.
        Parameters:
        certificates - certificates Collection to be added

      • addKnownCertificates

        public void addKnownCertificates​(java.util.Collection<java.security.cert.Certificate> certificates)
        Add certificates collection to known certificates storage, which is used for issuer certificates retrieval.
        Parameters:
        certificates - certificates Collection to be added

      • isCertificateTrusted

        public boolean isCertificateTrusted​(java.security.cert.Certificate certificate)
        Check if provided certificate is present in trusted certificates storage.
        Parameters:
        certificate - Certificate to be checked
        Returns:
        true if certificate is present in trusted certificates storage, false otherwise

      • getIssuerCertByURI

        protected java.io.InputStream getIssuerCertByURI​(java.lang.String uri)
                                          throws java.io.IOException
        Get CA issuers certificates represented as InputStream.
        Parameters:
        uri - URL URI, which is expected to be used to get issuer certificates from. Usually CA Issuers value from Authority Information Access (AIA) certificate extension.
        Returns:
        CA issuer certificate (or chain) bytes, represented as InputStream.
        Throws:
        java.io.IOException - if an I/O error occurs.

      • parseCertificates

        protected java.util.Collection<java.security.cert.Certificate> parseCertificates​(java.io.InputStream certsData)
                                                                          throws java.security.cert.CertificateException
        Parses certificates represented as byte array.
        Parameters:
        certsData - stream which contains one or more X509 certificates.
        Returns:
        a (possibly empty) collection of the certificates read from the given byte array.
        Throws:
        java.security.cert.CertificateException - if parsing error occurs.

      • processCertificatesFromAIA

        private java.util.Collection<java.security.cert.Certificate> processCertificatesFromAIA​(java.lang.String url)

      • isSignedBy

        private static boolean isSignedBy​(java.security.cert.X509Certificate certificate,
                                  java.security.cert.Certificate issuer)

      • isSignedBy

        private static boolean isSignedBy​(java.security.cert.X509CRL crl,
                                  java.security.cert.Certificate issuer)

      • getIssuerFromCertificateSet

        private static java.security.cert.Certificate getIssuerFromCertificateSet​(java.security.cert.X509Certificate lastAddedCert,
                                                                          java.util.Collection<java.security.cert.Certificate> certs)

      • getCrlIssuersFromKnownCertificates

        private java.util.List<java.security.cert.Certificate> getCrlIssuersFromKnownCertificates​(java.security.cert.X509CRL crl)