Package eu.europa.esig.dss.validation

Class CommonCertificateVerifier

java.lang.Object

eu.europa.esig.dss.validation.CommonCertificateVerifier

All Implemented Interfaces:

CertificateVerifier

public class CommonCertificateVerifier
extends Object
implements CertificateVerifier

This class provides the different sources used to verify the status of a certificate using the trust model. There are four different types of sources to be defined:
- Trusted certificates source;
- Adjunct certificates source (not trusted);
- OCSP source;
- CRL source.
The DataLoader should be provided to give access to the certificates through AIA.

Constructor Summary

Constructors

Constructor	Description
CommonCertificateVerifier()	The default constructor.
CommonCertificateVerifier(boolean simpleCreationOnly)	This constructor allows to create CommonCertificateVerifier without DataLoader.
CommonCertificateVerifier(List<CertificateSource> trustedCertSources, CRLSource crlSource, OCSPSource ocspSource, DataLoader dataLoader)	The constructor with key parameters.

Method Summary

Modifier and Type	Method	Description
void	addAdjunctCertSources(CertificateSource... certSources)	Adds adjunct certificate sources to an existing list of adjunct certificate sources
void	addTrustedCertSources(CertificateSource... certSources)	Adds trusted certificate sources to an existing list of trusted certificate sources
ListCertificateSource	getAdjunctCertSources()	Returns the list of adjunct certificate sources assigned to this verifier.
StatusAlert	getAlertOnInvalidTimestamp()	This method returns true if an exception needs to be thrown on invalid timestamp.
StatusAlert	getAlertOnMissingRevocationData()	This method returns true if an exception needs to be thrown on missing revocation data.
StatusAlert	getAlertOnNoRevocationAfterBestSignatureTime()	This method returns true if an exception needs to be thrown in case if no revocation data obtained with an issuance time after the bestSignatureTime
StatusAlert	getAlertOnRevokedCertificate()	This method returns true if an exception needs to be thrown on revoked certificate.
StatusAlert	getAlertOnUncoveredPOE()	This method returns true if an exception needs to be thrown on uncovered POE(timestamp).
RevocationSource<CRL>	getCrlSource()	Returns the CRL source associated with this verifier.
DataLoader	getDataLoader()	The data loader used to access AIA certificate source.
DigestAlgorithm	getDefaultDigestAlgorithm()	This method returns a default Digest Algorithm what will be used for digest calculation
RevocationSource<OCSP>	getOcspSource()	Returns the OCSP source associated with this verifier.
ListCertificateSource	getSignatureCertificateSource()	This method returns the Certificate Source (information extracted from signatures)
ListRevocationSource<CRL>	getSignatureCRLSource()	This method returns the CRL source (information extracted from signatures).
ListRevocationSource<OCSP>	getSignatureOCSPSource()	This method returns the OCSP source (information extracted from signatures).
ListCertificateSource	getTrustedCertSources()	Returns the trusted certificate sources associated with this verifier.
boolean	isCheckRevocationForUntrustedChains()	This method returns true if revocation check is enabled for untrusted certificate chains.
void	setAdjunctCertSource(CertificateSource adjunctCertSource)	Deprecated.
void	setAdjunctCertSources(CertificateSource... certSources)	Sets multiple adjunct certificate sources.
void	setAdjunctCertSources(ListCertificateSource adjunctListCertificateSource)	Sets a list of adjunct certificate sources
void	setAlertOnInvalidTimestamp(StatusAlert alertOnInvalidTimestamp)	This method allows to change the behavior on invalid timestamp (LT/LTA augmentation).
void	setAlertOnMissingRevocationData(StatusAlert alertOnMissingRevocationData)	This method allows to change the behavior on missing revocation data (LT/LTA augmentation).
void	setAlertOnNoRevocationAfterBestSignatureTime(StatusAlert alertOnNoRevocationAfterBestSignatureTime)	This method allows to change the behavior on revocation data issued after a control time.
void	setAlertOnRevokedCertificate(StatusAlert alertOnRevokedCertificate)	This method allows to change the behavior on revoked certificates (LT/LTA augmentation).
void	setAlertOnUncoveredPOE(StatusAlert alertOnUncoveredPOE)	This method allows to change the behavior on uncovered POE (timestamp).
void	setCheckRevocationForUntrustedChains(boolean checkRevocationForUntrustedChains)	This method allows to enable revocation checking for untrusted certificate chains (default : false)
void	setCrlSource(RevocationSource<CRL> crlSource)	Defines the source of CRL used by this class
void	setDataLoader(DataLoader dataLoader)	The data loader used to access AIA certificate source.
void	setDefaultDigestAlgorithm(DigestAlgorithm digestAlgorithm)	This method allows to change the Digest Algorithm that will be used for tokens' digest calculation
void	setOcspSource(RevocationSource<OCSP> ocspSource)	Defines the source of OCSP used by this class
void	setSignatureCertificateSource(ListCertificateSource signatureCertificateSource)	This method allows to set the Certificate source (information extracted from signatures).
void	setSignatureCRLSource(ListRevocationSource<CRL> signatureCRLSource)	This method allows to set the CRL source (information extracted from signatures).
void	setSignatureOCSPSource(ListRevocationSource<OCSP> signatureOCSPSource)	This method allows to set the OCSP source (information extracted from signatures).
void	setTrustedCertSource(CertificateSource trustedCertSource)	Deprecated.
void	setTrustedCertSources(CertificateSource... certSources)	Sets multiple trusted certificate sources.
void	setTrustedCertSources(ListCertificateSource trustedListCertificateSource)	Sets a list of trusted certificate sources

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

CommonCertificateVerifier

public CommonCertificateVerifier()

The default constructor. The DataLoader is created to allow the retrieval of certificates through AIA.

CommonCertificateVerifier

public CommonCertificateVerifier(boolean simpleCreationOnly)

This constructor allows to create CommonCertificateVerifier without DataLoader. It means that only a profile -B signatures can be created.

Parameters:

simpleCreationOnly - if true the CommonCertificateVerifier will not contain DataLoader.

CommonCertificateVerifier

public CommonCertificateVerifier(List<CertificateSource> trustedCertSources, CRLSource crlSource, OCSPSource ocspSource, DataLoader dataLoader)

The constructor with key parameters.

Parameters:

trustedCertSources - the reference to the trusted certificate sources.

crlSource - contains the reference to the OCSPSource.

ocspSource - contains the reference to the CRLSource.

dataLoader - contains the reference to a data loader used to access AIA certificate source.

Method Details

getTrustedCertSources

public ListCertificateSource getTrustedCertSources()

Description copied from interface: CertificateVerifier

Returns the trusted certificate sources associated with this verifier. These sources are used to identify the trusted anchors.

Specified by:

getTrustedCertSources in interface CertificateVerifier

Returns:

the certificate sources which contain trusted certificates

getOcspSource

public RevocationSource<OCSP> getOcspSource()

Description copied from interface: CertificateVerifier

Returns the OCSP source associated with this verifier.

Specified by:

getOcspSource in interface CertificateVerifier

Returns:

the used OCSP source for external access (web, filesystem, cached,...)

getCrlSource

public RevocationSource<CRL> getCrlSource()

Description copied from interface: CertificateVerifier

Returns the CRL source associated with this verifier.

Specified by:

getCrlSource in interface CertificateVerifier

Returns:

the used CRL source for external access (web, filesystem, cached,...)

setCrlSource

public void setCrlSource(RevocationSource<CRL> crlSource)

Description copied from interface: CertificateVerifier

Defines the source of CRL used by this class

Specified by:

setCrlSource in interface CertificateVerifier

Parameters:

crlSource - the CRL source to set for external access (web, filesystem, cached,...)

setOcspSource

public void setOcspSource(RevocationSource<OCSP> ocspSource)

Description copied from interface: CertificateVerifier

Defines the source of OCSP used by this class

Specified by:

setOcspSource in interface CertificateVerifier

Parameters:

ocspSource - the OCSP source to set for external access (web, filesystem, cached,...)

setTrustedCertSource

@Deprecated public void setTrustedCertSource(CertificateSource trustedCertSource)

Deprecated.

Description copied from interface: CertificateVerifier

Sets the trusted certificate source.

Specified by:

setTrustedCertSource in interface CertificateVerifier

Parameters:

trustedCertSource - The certificates source with known trusted certificates

setTrustedCertSources

public void setTrustedCertSources(CertificateSource... certSources)

Description copied from interface: CertificateVerifier

Sets multiple trusted certificate sources.

Specified by:

setTrustedCertSources in interface CertificateVerifier

Parameters:

certSources - The certificate sources with known trusted certificates

addTrustedCertSources

public void addTrustedCertSources(CertificateSource... certSources)

Description copied from interface: CertificateVerifier

Adds trusted certificate sources to an existing list of trusted certificate sources

Specified by:

addTrustedCertSources in interface CertificateVerifier

Parameters:

certSources - The certificate sources with known trusted certificates

setTrustedCertSources

public void setTrustedCertSources(ListCertificateSource trustedListCertificateSource)

Description copied from interface: CertificateVerifier

Sets a list of trusted certificate sources

Specified by:

setTrustedCertSources in interface CertificateVerifier

Parameters:

trustedListCertificateSource - ListCertificateSource of trusted cert sources

getAdjunctCertSources

public ListCertificateSource getAdjunctCertSources()

Description copied from interface: CertificateVerifier

Returns the list of adjunct certificate sources assigned to this verifier.

Specified by:

getAdjunctCertSources in interface CertificateVerifier

Returns:

the certificate source which contains additional certificate (missing CA,...)

setAdjunctCertSource

@Deprecated public void setAdjunctCertSource(CertificateSource adjunctCertSource)

Deprecated.

Description copied from interface: CertificateVerifier

Sets an adjunct certificate source to this verifier.

Specified by:

setAdjunctCertSource in interface CertificateVerifier

Parameters:

adjunctCertSource - the certificate source with additional and missing certificates

setAdjunctCertSources

public void setAdjunctCertSources(CertificateSource... certSources)

Description copied from interface: CertificateVerifier

Sets multiple adjunct certificate sources.

Specified by:

setAdjunctCertSources in interface CertificateVerifier

Parameters:

certSources - the certificate sources with additional and/or missing certificates

addAdjunctCertSources

public void addAdjunctCertSources(CertificateSource... certSources)

Description copied from interface: CertificateVerifier

Adds adjunct certificate sources to an existing list of adjunct certificate sources

Specified by:

addAdjunctCertSources in interface CertificateVerifier

Parameters:

certSources - The certificate sources with additional certificates

setAdjunctCertSources

public void setAdjunctCertSources(ListCertificateSource adjunctListCertificateSource)

Description copied from interface: CertificateVerifier

Sets a list of adjunct certificate sources

Specified by:

setAdjunctCertSources in interface CertificateVerifier

Parameters:

adjunctListCertificateSource - ListCertificateSource of adjunct cert sources

getDataLoader

public DataLoader getDataLoader()

Description copied from interface: CertificateVerifier

The data loader used to access AIA certificate source.

Specified by:

getDataLoader in interface CertificateVerifier

Returns:

the used data loaded to load AIA resources and policy files

setDataLoader

public void setDataLoader(DataLoader dataLoader)

Description copied from interface: CertificateVerifier

The data loader used to access AIA certificate source. If this property is not set the default CommonsHttpDataLoader is created.

Specified by:

setDataLoader in interface CertificateVerifier

Parameters:

dataLoader - the used data loaded to load AIA resources and policy files

getSignatureCRLSource

public ListRevocationSource<CRL> getSignatureCRLSource()

Description copied from interface: CertificateVerifier

This method returns the CRL source (information extracted from signatures).

Specified by:

getSignatureCRLSource in interface CertificateVerifier

Returns:

the CRL sources from the signature

setSignatureCRLSource

public void setSignatureCRLSource(ListRevocationSource<CRL> signatureCRLSource)

Description copied from interface: CertificateVerifier

This method allows to set the CRL source (information extracted from signatures).

Specified by:

setSignatureCRLSource in interface CertificateVerifier

Parameters:

signatureCRLSource - the CRL sources from the signature

getSignatureOCSPSource

public ListRevocationSource<OCSP> getSignatureOCSPSource()

Description copied from interface: CertificateVerifier

This method returns the OCSP source (information extracted from signatures).

Specified by:

getSignatureOCSPSource in interface CertificateVerifier

Returns:

the OCSP sources from the signatures

setSignatureOCSPSource

public void setSignatureOCSPSource(ListRevocationSource<OCSP> signatureOCSPSource)

Description copied from interface: CertificateVerifier

This method allows to set the OCSP source (information extracted from signatures).

Specified by:

setSignatureOCSPSource in interface CertificateVerifier

Parameters:

signatureOCSPSource - the OCSP sources from the signature

getSignatureCertificateSource

public ListCertificateSource getSignatureCertificateSource()

Description copied from interface: CertificateVerifier

This method returns the Certificate Source (information extracted from signatures)

Specified by:

getSignatureCertificateSource in interface CertificateVerifier

Returns:

the certificate sources from the signatures

setSignatureCertificateSource

public void setSignatureCertificateSource(ListCertificateSource signatureCertificateSource)

Description copied from interface: CertificateVerifier

This method allows to set the Certificate source (information extracted from signatures).

Specified by:

setSignatureCertificateSource in interface CertificateVerifier

Parameters:

signatureCertificateSource - the Certificate sources from the signatures

getAlertOnInvalidTimestamp

public StatusAlert getAlertOnInvalidTimestamp()

Description copied from interface: CertificateVerifier

This method returns true if an exception needs to be thrown on invalid timestamp.

Specified by:

getAlertOnInvalidTimestamp in interface CertificateVerifier

Returns:

StatusAlert to be processed in case of an invalid timestamp

setAlertOnInvalidTimestamp

public void setAlertOnInvalidTimestamp(StatusAlert alertOnInvalidTimestamp)

Description copied from interface: CertificateVerifier

This method allows to change the behavior on invalid timestamp (LT/LTA augmentation). Default : ExceptionOnStatusAlert - throw an exception.

Specified by:

setAlertOnInvalidTimestamp in interface CertificateVerifier

Parameters:

alertOnInvalidTimestamp - defines a behaviour in case of invalid timestamp

getAlertOnMissingRevocationData

public StatusAlert getAlertOnMissingRevocationData()

Description copied from interface: CertificateVerifier

This method returns true if an exception needs to be thrown on missing revocation data.

Specified by:

getAlertOnMissingRevocationData in interface CertificateVerifier

Returns:

StatusAlert to be processed in case of missing revocation data

setAlertOnMissingRevocationData

public void setAlertOnMissingRevocationData(StatusAlert alertOnMissingRevocationData)

Description copied from interface: CertificateVerifier

This method allows to change the behavior on missing revocation data (LT/LTA augmentation). Default : ExceptionOnStatusAlert - throw an exception.

Specified by:

setAlertOnMissingRevocationData in interface CertificateVerifier

Parameters:

alertOnMissingRevocationData - defines a behaviour in case of missing revocation data

getAlertOnUncoveredPOE

public StatusAlert getAlertOnUncoveredPOE()

Description copied from interface: CertificateVerifier

This method returns true if an exception needs to be thrown on uncovered POE(timestamp).

Specified by:

getAlertOnUncoveredPOE in interface CertificateVerifier

Returns:

StatusAlert to be processed in case of uncovered POE

setAlertOnUncoveredPOE

public void setAlertOnUncoveredPOE(StatusAlert alertOnUncoveredPOE)

Description copied from interface: CertificateVerifier

This method allows to change the behavior on uncovered POE (timestamp). Default : LogOnStatusAlert - log a warning.

Specified by:

setAlertOnUncoveredPOE in interface CertificateVerifier

Parameters:

alertOnUncoveredPOE - defines a behaviour in case of uncovered POE

getAlertOnRevokedCertificate

public StatusAlert getAlertOnRevokedCertificate()

Description copied from interface: CertificateVerifier

This method returns true if an exception needs to be thrown on revoked certificate.

Specified by:

getAlertOnRevokedCertificate in interface CertificateVerifier

Returns:

StatusAlert to be processed in case of revoked certificate

setAlertOnRevokedCertificate

public void setAlertOnRevokedCertificate(StatusAlert alertOnRevokedCertificate)

Description copied from interface: CertificateVerifier

This method allows to change the behavior on revoked certificates (LT/LTA augmentation). Default : ExceptionOnStatusAlert - throw an exception.

Specified by:

setAlertOnRevokedCertificate in interface CertificateVerifier

Parameters:

alertOnRevokedCertificate - defines a behaviour in case of revoked certificate

getAlertOnNoRevocationAfterBestSignatureTime

public StatusAlert getAlertOnNoRevocationAfterBestSignatureTime()

Description copied from interface: CertificateVerifier

This method returns true if an exception needs to be thrown in case if no revocation data obtained with an issuance time after the bestSignatureTime

Specified by:

getAlertOnNoRevocationAfterBestSignatureTime in interface CertificateVerifier

Returns:

StatusAlert to be processed in case of no revocation data after best signature time

setAlertOnNoRevocationAfterBestSignatureTime

public void setAlertOnNoRevocationAfterBestSignatureTime(StatusAlert alertOnNoRevocationAfterBestSignatureTime)

Description copied from interface: CertificateVerifier

This method allows to change the behavior on revocation data issued after a control time. Default : LogOnStatusAlert - log a warning.

Specified by:

setAlertOnNoRevocationAfterBestSignatureTime in interface CertificateVerifier

Parameters:

alertOnNoRevocationAfterBestSignatureTime - defines a behaviour in case of no revocation data issued after the bestSignatureTime

isCheckRevocationForUntrustedChains

public boolean isCheckRevocationForUntrustedChains()

Description copied from interface: CertificateVerifier

This method returns true if revocation check is enabled for untrusted certificate chains.

Specified by:

isCheckRevocationForUntrustedChains in interface CertificateVerifier

Returns:

true if external revocation check is done for untrusted certificate chains

setCheckRevocationForUntrustedChains

public void setCheckRevocationForUntrustedChains(boolean checkRevocationForUntrustedChains)

Description copied from interface: CertificateVerifier

This method allows to enable revocation checking for untrusted certificate chains (default : false)

Specified by:

setCheckRevocationForUntrustedChains in interface CertificateVerifier

Parameters:

checkRevocationForUntrustedChains - true if revocation checking is allowed for untrusted certificate chains

setDefaultDigestAlgorithm

public void setDefaultDigestAlgorithm(DigestAlgorithm digestAlgorithm)

Description copied from interface: CertificateVerifier

This method allows to change the Digest Algorithm that will be used for tokens' digest calculation

Specified by:

setDefaultDigestAlgorithm in interface CertificateVerifier

Parameters:

digestAlgorithm - DigestAlgorithm to use

getDefaultDigestAlgorithm

public DigestAlgorithm getDefaultDigestAlgorithm()

Description copied from interface: CertificateVerifier

This method returns a default Digest Algorithm what will be used for digest calculation

Specified by:

getDefaultDigestAlgorithm in interface CertificateVerifier

Returns:

DigestAlgorithm