Class TrustAnchor
 This class represents a "most-trusted CA", which is used as a trust anchor
 for validating X.509 certification paths. A most-trusted CA includes the
 public key of the CA, the CA's name, and any constraints upon the set of
 paths which may be validated using this key. These parameters can be
 specified in the form of a trusted X509Certificate or as
 individual parameters.
 
Concurrent Access
All TrustAnchor objects must be immutable and
 thread-safe. That is, multiple threads may concurrently invoke the
 methods defined in this class on a single TrustAnchor
 object (or more than one) with no ill effects. Requiring
 TrustAnchor objects to be immutable and thread-safe
 allows them to be passed around to various pieces of code without
 worrying about coordinating access. This stipulation applies to all
 public fields and methods of this class and any added or overridden
 by subclasses.
- Since:
- 1.4
- See Also:
- 
Constructor SummaryConstructorsConstructorDescriptionTrustAnchor(String caName, PublicKey pubKey, byte[] nameConstraints) Creates an instance ofTrustAnchorwhere the most-trusted CA is specified as a distinguished name and public key.TrustAnchor(X509Certificate trustedCert, byte[] nameConstraints) Creates an instance ofTrustAnchorwith the specifiedX509Certificateand optional name constraints, which are intended to be used as additional constraints when validating an X.509 certification path.TrustAnchor(X500Principal caPrincipal, PublicKey pubKey, byte[] nameConstraints) Creates an instance ofTrustAnchorwhere the most-trusted CA is specified as an X500Principal and public key.
- 
Method SummaryModifier and TypeMethodDescriptionfinal X500PrincipalgetCA()Returns the name of the most-trusted CA as an X500Principal.final StringReturns the name of the most-trusted CA in RFC 2253Stringformat.final PublicKeyReturns the public key of the most-trusted CA.final byte[]Returns the name constraints parameter.final X509CertificateReturns the most-trusted CA certificate.toString()Returns a formatted string describing theTrustAnchor.
- 
Constructor Details- 
TrustAnchorCreates an instance ofTrustAnchorwith the specifiedX509Certificateand optional name constraints, which are intended to be used as additional constraints when validating an X.509 certification path.The name constraints are specified as a byte array. This byte array should contain the DER encoded form of the name constraints, as they would appear in the NameConstraints structure defined in RFC 5280 and X.509. The ASN.1 definition of this structure appears below. NameConstraints ::= SEQUENCE { permittedSubtrees [0] GeneralSubtrees OPTIONAL, excludedSubtrees [1] GeneralSubtrees OPTIONAL } GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree GeneralSubtree ::= SEQUENCE { base GeneralName, minimum [0] BaseDistance DEFAULT 0, maximum [1] BaseDistance OPTIONAL } BaseDistance ::= INTEGER (0..MAX) GeneralName ::= CHOICE { otherName [0] OtherName, rfc822Name [1] IA5String, dNSName [2] IA5String, x400Address [3] ORAddress, directoryName [4] Name, ediPartyName [5] EDIPartyName, uniformResourceIdentifier [6] IA5String, iPAddress [7] OCTET STRING, registeredID [8] OBJECT IDENTIFIER}Note that the name constraints byte array supplied is cloned to protect against subsequent modifications. - Parameters:
- trustedCert- a trusted- X509Certificate
- nameConstraints- a byte array containing the ASN.1 DER encoding of a NameConstraints extension to be used for checking name constraints. Only the value of the extension is included, not the OID or criticality flag. Specify- nullto omit the parameter.
- Throws:
- IllegalArgumentException- if the name constraints cannot be decoded
- NullPointerException- if the specified- X509Certificateis- null
- External Specifications
 
- 
TrustAnchorCreates an instance ofTrustAnchorwhere the most-trusted CA is specified as an X500Principal and public key. Name constraints are an optional parameter, and are intended to be used as additional constraints when validating an X.509 certification path.The name constraints are specified as a byte array. This byte array contains the DER encoded form of the name constraints, as they would appear in the NameConstraints structure defined in RFC 5280 and X.509. The ASN.1 notation for this structure is supplied in the documentation for TrustAnchor(X509Certificate trustedCert, byte[] nameConstraints).Note that the name constraints byte array supplied here is cloned to protect against subsequent modifications. - Parameters:
- caPrincipal- the name of the most-trusted CA as X500Principal
- pubKey- the public key of the most-trusted CA
- nameConstraints- a byte array containing the ASN.1 DER encoding of a NameConstraints extension to be used for checking name constraints. Only the value of the extension is included, not the OID or criticality flag. Specify- nullto omit the parameter.
- Throws:
- NullPointerException- if the specified- caPrincipalor- pubKeyparameter is- null
- Since:
- 1.5
 
- 
TrustAnchorCreates an instance ofTrustAnchorwhere the most-trusted CA is specified as a distinguished name and public key. Name constraints are an optional parameter, and are intended to be used as additional constraints when validating an X.509 certification path.The name constraints are specified as a byte array. This byte array contains the DER encoded form of the name constraints, as they would appear in the NameConstraints structure defined in RFC 5280 and X.509. The ASN.1 notation for this structure is supplied in the documentation for TrustAnchor(X509Certificate trustedCert, byte[] nameConstraints).Note that the name constraints byte array supplied here is cloned to protect against subsequent modifications. - Parameters:
- caName- the X.500 distinguished name of the most-trusted CA in RFC 2253- Stringformat
- pubKey- the public key of the most-trusted CA
- nameConstraints- a byte array containing the ASN.1 DER encoding of a NameConstraints extension to be used for checking name constraints. Only the value of the extension is included, not the OID or criticality flag. Specify- nullto omit the parameter.
- Throws:
- IllegalArgumentException- if the specified- caNameparameter is empty- (caName.length() == 0)or incorrectly formatted or the name constraints cannot be decoded
- NullPointerException- if the specified- caNameor- pubKeyparameter is- null
- External Specifications
 
 
- 
- 
Method Details- 
getTrustedCertReturns the most-trusted CA certificate.- Returns:
- a trusted X509Certificateornullif the trust anchor was not specified as a trusted certificate
 
- 
getCAReturns the name of the most-trusted CA as an X500Principal.- Returns:
- the X.500 distinguished name of the most-trusted CA, or
 nullif the trust anchor was not specified as a trusted public key and name or X500Principal pair
- Since:
- 1.5
 
- 
getCANameReturns the name of the most-trusted CA in RFC 2253Stringformat.- Returns:
- the X.500 distinguished name of the most-trusted CA, or
 nullif the trust anchor was not specified as a trusted public key and name or X500Principal pair
 
- 
getCAPublicKeyReturns the public key of the most-trusted CA.- Returns:
- the public key of the most-trusted CA, or nullif the trust anchor was not specified as a trusted public key and name or X500Principal pair
 
- 
getNameConstraintspublic final byte[] getNameConstraints()Returns the name constraints parameter. The specified name constraints are associated with this trust anchor and are intended to be used as additional constraints when validating an X.509 certification path.The name constraints are returned as a byte array. This byte array contains the DER encoded form of the name constraints, as they would appear in the NameConstraints structure defined in RFC 5280 and X.509. The ASN.1 notation for this structure is supplied in the documentation for TrustAnchor(X509Certificate trustedCert, byte[] nameConstraints).Note that the byte array returned is cloned to protect against subsequent modifications. - Returns:
- a byte array containing the ASN.1 DER encoding of
         a NameConstraints extension used for checking name constraints,
         or nullif not set.
 
- 
toString
 
-