Java compact1, compact2, compact3 java.security.cert Class TrustAnchor（JDK8）

Constructor Detail

• TrustAnchor

  public TrustAnchor(X509Certificate trustedCert,
                     byte[] nameConstraints)

  Creates an instance of TrustAnchor with the specified X509Certificate and optional name constraints, which are intended to be used as additional constraints when validating an X.509 certification path.

  The name constraints are specified as a byte array. This byte array should contain the DER encoded form of the name constraints, as they would appear in the NameConstraints structure defined in RFC 3280 and X.509. The ASN.1 definition of this structure appears below.

  
    NameConstraints ::= SEQUENCE {
         permittedSubtrees       [0]     GeneralSubtrees OPTIONAL,
         excludedSubtrees        [1]     GeneralSubtrees OPTIONAL }
  
    GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree
  
    GeneralSubtree ::= SEQUENCE {
         base                    GeneralName,
         minimum         [0]     BaseDistance DEFAULT 0,
         maximum         [1]     BaseDistance OPTIONAL }
  
    BaseDistance ::= INTEGER (0..MAX)
  
    GeneralName ::= CHOICE {
         otherName                       [0]     OtherName,
         rfc822Name                      [1]     IA5String,
         dNSName                         [2]     IA5String,
         x400Address                     [3]     ORAddress,
         directoryName                   [4]     Name,
         ediPartyName                    [5]     EDIPartyName,
         uniformResourceIdentifier       [6]     IA5String,
         iPAddress                       [7]     OCTET STRING,
         registeredID                    [8]     OBJECT IDENTIFIER}
   

  Note that the name constraints byte array supplied is cloned to protect against subsequent modifications.

  Parameters:

  trustedCert - a trusted X509Certificate

  nameConstraints - a byte array containing the ASN.1 DER encoding of a NameConstraints extension to be used for checking name constraints. Only the value of the extension is included, not the OID or criticality flag. Specify null to omit the parameter.

  Throws:

  IllegalArgumentException - if the name constraints cannot be decoded

  NullPointerException - if the specified X509Certificate is null

• TrustAnchor

  public TrustAnchor(X500Principal caPrincipal,
                     PublicKey pubKey,
                     byte[] nameConstraints)

  Creates an instance of TrustAnchor where the most-trusted CA is specified as an X500Principal and public key. Name constraints are an optional parameter, and are intended to be used as additional constraints when validating an X.509 certification path.

  The name constraints are specified as a byte array. This byte array contains the DER encoded form of the name constraints, as they would appear in the NameConstraints structure defined in RFC 3280 and X.509. The ASN.1 notation for this structure is supplied in the documentation for TrustAnchor(X509Certificate trustedCert, byte[] nameConstraints) .

  Note that the name constraints byte array supplied here is cloned to protect against subsequent modifications.

  Parameters:

  caPrincipal - the name of the most-trusted CA as X500Principal

  pubKey - the public key of the most-trusted CA

  nameConstraints - a byte array containing the ASN.1 DER encoding of a NameConstraints extension to be used for checking name constraints. Only the value of the extension is included, not the OID or criticality flag. Specify null to omit the parameter.

  Throws:

  NullPointerException - if the specified caPrincipal or pubKey parameter is null

  Since:

  1.5

• TrustAnchor

  public TrustAnchor(String caName,
                     PublicKey pubKey,
                     byte[] nameConstraints)

  Creates an instance of TrustAnchor where the most-trusted CA is specified as a distinguished name and public key. Name constraints are an optional parameter, and are intended to be used as additional constraints when validating an X.509 certification path.

  The name constraints are specified as a byte array. This byte array contains the DER encoded form of the name constraints, as they would appear in the NameConstraints structure defined in RFC 3280 and X.509. The ASN.1 notation for this structure is supplied in the documentation for TrustAnchor(X509Certificate trustedCert, byte[] nameConstraints) .

  Note that the name constraints byte array supplied here is cloned to protect against subsequent modifications.

  Parameters:

  caName - the X.500 distinguished name of the most-trusted CA in RFC 2253 String format

  pubKey - the public key of the most-trusted CA

  nameConstraints - a byte array containing the ASN.1 DER encoding of a NameConstraints extension to be used for checking name constraints. Only the value of the extension is included, not the OID or criticality flag. Specify null to omit the parameter.

  Throws:

  IllegalArgumentException - if the specified caName parameter is empty (caName.length() == 0) or incorrectly formatted or the name constraints cannot be decoded

  NullPointerException - if the specified caName or pubKey parameter is null

Method Detail

• getTrustedCert

  public final X509Certificate getTrustedCert()

  Returns the most-trusted CA certificate.

  Returns:

  a trusted X509Certificate or null if the trust anchor was not specified as a trusted certificate

• getCA

  public final X500Principal getCA()

  Returns the name of the most-trusted CA as an X500Principal.

  Returns:

  the X.500 distinguished name of the most-trusted CA, or null if the trust anchor was not specified as a trusted public key and name or X500Principal pair

  Since:

  1.5

• getCAName

  public final String getCAName()

  Returns the name of the most-trusted CA in RFC 2253 String format.

  Returns:

  the X.500 distinguished name of the most-trusted CA, or null if the trust anchor was not specified as a trusted public key and name or X500Principal pair

• getCAPublicKey

  public final PublicKey getCAPublicKey()

  Returns the public key of the most-trusted CA.

  Returns:

  the public key of the most-trusted CA, or null if the trust anchor was not specified as a trusted public key and name or X500Principal pair

• getNameConstraints

  public final byte[] getNameConstraints()

  Returns the name constraints parameter. The specified name constraints are associated with this trust anchor and are intended to be used as additional constraints when validating an X.509 certification path.

  The name constraints are returned as a byte array. This byte array contains the DER encoded form of the name constraints, as they would appear in the NameConstraints structure defined in RFC 3280 and X.509. The ASN.1 notation for this structure is supplied in the documentation for TrustAnchor(X509Certificate trustedCert, byte[] nameConstraints) .

  Note that the byte array returned is cloned to protect against subsequent modifications.

  Returns:

  a byte array containing the ASN.1 DER encoding of a NameConstraints extension used for checking name constraints, or null if not set.

• toString

  public String toString()

  Returns a formatted string describing the TrustAnchor.

  Overrides:

  toString in class Object

  Returns:

  a formatted string describing the TrustAnchor