Package eu.europa.esig.dss.validation

Class CommonCertificateVerifier

  • All Implemented Interfaces:
    CertificateVerifier
    public class CommonCertificateVerifier
extends Object
implements CertificateVerifier
    This class provides the different sources used to verify the status of a certificate using the trust model. There are four different types of sources to be defined:
    - Trusted certificates source;
    - Adjunct certificates source (not trusted);
    - OCSP source;
    - CRL source.
    The DataLoader should be provided to give access to the certificates through AIA.

    • Constructor Detail

      • CommonCertificateVerifier

        public CommonCertificateVerifier()
        The default constructor. The DataLoader is created to allow the retrieval of certificates through AIA.

      • CommonCertificateVerifier

        public CommonCertificateVerifier​(boolean simpleCreationOnly)
        This constructor allows to create CommonCertificateVerifier without DataLoader. It means that only a profile -B signatures can be created.
        Parameters:
        simpleCreationOnly - if true the CommonCertificateVerifier will not contain DataLoader.

      • CommonCertificateVerifier

        public CommonCertificateVerifier​(CertificateSource trustedCertSource,
                                 CRLSource crlSource,
                                 OCSPSource ocspSource,
                                 DataLoader dataLoader)
        The constructor with key parameters.
        Parameters:
        trustedCertSource - the reference to the trusted certificate source.
        crlSource - contains the reference to the OCSPSource.
        ocspSource - contains the reference to the CRLSource.
        dataLoader - contains the reference to a data loader used to access AIA certificate source.

    • Method Detail

      • getTrustedCertSource

        public CertificateSource getTrustedCertSource()
        Description copied from interface: CertificateVerifier
        Returns the trusted certificates source associated with this verifier. This source is used to identify the trusted anchors.
        Specified by:
        getTrustedCertSource in interface CertificateVerifier
        Returns:
        the certificate source which contains trusted certificates

      • getOcspSource

        public OCSPSource getOcspSource()
        Description copied from interface: CertificateVerifier
        Returns the OCSP source associated with this verifier.
        Specified by:
        getOcspSource in interface CertificateVerifier
        Returns:
        the used OCSP source for external access (web, filesystem, cached,...)

      • getCrlSource

        public CRLSource getCrlSource()
        Description copied from interface: CertificateVerifier
        Returns the CRL source associated with this verifier.
        Specified by:
        getCrlSource in interface CertificateVerifier
        Returns:
        the used CRL source for external access (web, filesystem, cached,...)

      • setCrlSource

        public void setCrlSource​(CRLSource crlSource)
        Description copied from interface: CertificateVerifier
        Defines the source of CRL used by this class
        Specified by:
        setCrlSource in interface CertificateVerifier
        Parameters:
        crlSource - the CRL source to set for external access (web, filesystem, cached,...)

      • setOcspSource

        public void setOcspSource​(OCSPSource ocspSource)
        Description copied from interface: CertificateVerifier
        Defines the source of OCSP used by this class
        Specified by:
        setOcspSource in interface CertificateVerifier
        Parameters:
        ocspSource - the OCSP source to set for external access (web, filesystem, cached,...)

      • setAdjunctCertSource

        public void setAdjunctCertSource​(CertificateSource adjunctCertSource)
        Description copied from interface: CertificateVerifier
        Associates an adjunct certificates source to this verifier.
        Specified by:
        setAdjunctCertSource in interface CertificateVerifier
        Parameters:
        adjunctCertSource - the certificate source with additional and missing certificates

      • setDataLoader

        public void setDataLoader​(DataLoader dataLoader)
        Description copied from interface: CertificateVerifier
        The data loader used to access AIA certificate source. If this property is not set the default CommonsHttpDataLoader is created.
        Specified by:
        setDataLoader in interface CertificateVerifier
        Parameters:
        dataLoader - the used data loaded to load AIA resources and policy files

      • setSignatureCRLSource

        public void setSignatureCRLSource​(ListCRLSource signatureCRLSource)
        Description copied from interface: CertificateVerifier
        This method allows to set the CRL source (information extracted from signatures).
        Specified by:
        setSignatureCRLSource in interface CertificateVerifier
        Parameters:
        signatureCRLSource - the CRL sources from the signature

      • setSignatureOCSPSource

        public void setSignatureOCSPSource​(ListOCSPSource signatureOCSPSource)
        Description copied from interface: CertificateVerifier
        This method allows to set the OCSP source (information extracted from signatures).
        Specified by:
        setSignatureOCSPSource in interface CertificateVerifier
        Parameters:
        signatureOCSPSource - the OCSP sources from the signature

      • setExceptionOnMissingRevocationData

        public void setExceptionOnMissingRevocationData​(boolean throwExceptionOnMissingRevocationData)
        Description copied from interface: CertificateVerifier
        This method allows to change the behavior on missing revocation data (LT/LTA augmentation). (default : true)
        Specified by:
        setExceptionOnMissingRevocationData in interface CertificateVerifier
        Parameters:
        throwExceptionOnMissingRevocationData - true if an exception is raised on missing revocation data, false will only display a warning message

      • isExceptionOnMissingRevocationData

        public boolean isExceptionOnMissingRevocationData()
        Description copied from interface: CertificateVerifier
        This method returns true if an exception needs to be thrown on missing revocation data.
        Specified by:
        isExceptionOnMissingRevocationData in interface CertificateVerifier
        Returns:
        true if an exception is thrown, false if a warning message is added

      • isExceptionOnUncoveredPOE

        public boolean isExceptionOnUncoveredPOE()
        Description copied from interface: CertificateVerifier
        This method returns true if an exception needs to be thrown on uncovered POE(timestamp).
        Specified by:
        isExceptionOnUncoveredPOE in interface CertificateVerifier
        Returns:
        true if an exception is thrown, false if a warning message is added

      • setExceptionOnUncoveredPOE

        public void setExceptionOnUncoveredPOE​(boolean exceptionOnUncoveredPOE)
        Description copied from interface: CertificateVerifier
        This method allows to change the behavior on uncovered POE (timestamp). (default : false)
        Specified by:
        setExceptionOnUncoveredPOE in interface CertificateVerifier
        Parameters:
        exceptionOnUncoveredPOE - true if an exception is raised on uncovered timestamp, false will only display a warning message

      • isExceptionOnRevokedCertificate

        public boolean isExceptionOnRevokedCertificate()
        Description copied from interface: CertificateVerifier
        This method returns true if an exception needs to be thrown on revoked certificate.
        Specified by:
        isExceptionOnRevokedCertificate in interface CertificateVerifier
        Returns:
        true if an exception is thrown, false if a warning message is added

      • setExceptionOnRevokedCertificate

        public void setExceptionOnRevokedCertificate​(boolean exceptionOnRevokedCertificate)
        Description copied from interface: CertificateVerifier
        This method allows to change the behavior on revoked certificates (LT/LTA augmentation). (default : true)
        Specified by:
        setExceptionOnRevokedCertificate in interface CertificateVerifier
        Parameters:
        exceptionOnRevokedCertificate - true if an exception is raised on revoked certificate, false will only display a warning message

      • setExceptionOnInvalidTimestamp

        public void setExceptionOnInvalidTimestamp​(boolean throwExceptionOnInvalidTimestamp)
        Description copied from interface: CertificateVerifier
        This method allows to change the behavior on invalid timestamp (LT/LTA augmentation). (default : true)
        Specified by:
        setExceptionOnInvalidTimestamp in interface CertificateVerifier
        Parameters:
        throwExceptionOnInvalidTimestamp - true if an exception is raised on invalid timestamp, false will only display a warning message

      • isExceptionOnInvalidTimestamp

        public boolean isExceptionOnInvalidTimestamp()
        Description copied from interface: CertificateVerifier
        This method returns true if an exception needs to be thrown on invalid timestamp.
        Specified by:
        isExceptionOnInvalidTimestamp in interface CertificateVerifier
        Returns:
        true if an exception is thrown, false if a warning message is added

      • setExceptionOnNoRevocationAfterBestSignatureTime

        public void setExceptionOnNoRevocationAfterBestSignatureTime​(boolean exceptionOnNoRevocationAfterBestSignatureTime)
        Description copied from interface: CertificateVerifier
        This method allows to change the behavior on revocation data issued after a control time. (default : false)
        Specified by:
        setExceptionOnNoRevocationAfterBestSignatureTime in interface CertificateVerifier
        Parameters:
        exceptionOnNoRevocationAfterBestSignatureTime - true if an exception is raised on no revocation data issued after the bestSignatureTime, false will only display a warning message

      • isExceptionOnNoRevocationAfterBestSignatureTime

        public boolean isExceptionOnNoRevocationAfterBestSignatureTime()
        Description copied from interface: CertificateVerifier
        This method returns true if an exception needs to be thrown in case if no revocation data obtained with an issuance time after the bestSignatureTime
        Specified by:
        isExceptionOnNoRevocationAfterBestSignatureTime in interface CertificateVerifier
        Returns:
        true if an exception is thrown, false if a warning message is added

      • isCheckRevocationForUntrustedChains

        public boolean isCheckRevocationForUntrustedChains()
        Description copied from interface: CertificateVerifier
        This method returns true if revocation check is enabled for untrusted certificate chains.
        Specified by:
        isCheckRevocationForUntrustedChains in interface CertificateVerifier
        Returns:
        true if external revocation check is done for untrusted certificate chains

      • setCheckRevocationForUntrustedChains

        public void setCheckRevocationForUntrustedChains​(boolean checkRevocationForUntrustedChains)
        Description copied from interface: CertificateVerifier
        This method allows to enable revocation checking for untrusted certificate chains (default : false)
        Specified by:
        setCheckRevocationForUntrustedChains in interface CertificateVerifier
        Parameters:
        checkRevocationForUntrustedChains - true if revocation checking is allowed for untrusted certificate chains

      • setIncludeCertificateTokenValues

        public void setIncludeCertificateTokenValues​(boolean includeCertificateTokens)
        Description copied from interface: CertificateVerifier
        This method allows to change the behavior by including raw certificate tokens in the diagnostic data report.
        Specified by:
        setIncludeCertificateTokenValues in interface CertificateVerifier
        Parameters:
        includeCertificateTokens - true if raw certificate tokens should be included (default: false)

      • isIncludeCertificateTokenValues

        public boolean isIncludeCertificateTokenValues()
        Description copied from interface: CertificateVerifier
        This method returns true if the certificate tokens need to be exported in the diagnostic data report.
        Specified by:
        isIncludeCertificateTokenValues in interface CertificateVerifier
        Returns:
        true if raw certificate tokens should be included in the diagnotic data report (default: false)

      • setIncludeCertificateRevocationValues

        public void setIncludeCertificateRevocationValues​(boolean include)
        Description copied from interface: CertificateVerifier
        This method allows to change the behavior by including raw revocation data in the diagnostic data report.
        Specified by:
        setIncludeCertificateRevocationValues in interface CertificateVerifier
        Parameters:
        include - true if raw revocation data should be included (default: false)

      • isIncludeCertificateRevocationValues

        public boolean isIncludeCertificateRevocationValues()
        Description copied from interface: CertificateVerifier
        This method returns true if the revocation data need to be exported in the diagnostic data report.
        Specified by:
        isIncludeCertificateRevocationValues in interface CertificateVerifier
        Returns:
        true if raw revocation data should be included in the diagnotic data report (default: false)

      • setIncludeTimestampTokenValues

        public void setIncludeTimestampTokenValues​(boolean include)
        Description copied from interface: CertificateVerifier
        This method allows to change the behavior by including raw timestamp tokens in the diagnostic data report.
        Specified by:
        setIncludeTimestampTokenValues in interface CertificateVerifier
        Parameters:
        include - true if raw timestamp tokens should be included (default: false)

      • isIncludeTimestampTokenValues

        public boolean isIncludeTimestampTokenValues()
        Description copied from interface: CertificateVerifier
        This method returns true if the timestamp tokens need to be exported in the diagnostic data report.
        Specified by:
        isIncludeTimestampTokenValues in interface CertificateVerifier
        Returns:
        true if raw timestamp tokens should be included in the diagnotic data report (default: false)