Class PKIXBuilderParameters

public class PKIXBuilderParameters
extends PKIXParameters

Parameters used as input for the PKIX CertPathBuilder algorithm.

A PKIX CertPathBuilder uses these parameters to build a CertPath which has been validated according to the PKIX certification path validation algorithm.

To instantiate a PKIXBuilderParameters object, an application must specify one or more most-trusted CAs as defined by the PKIX certification path validation algorithm. The most-trusted CA can be specified using one of two constructors. An application can call PKIXBuilderParameters(Set, CertSelector), specifying a Set of TrustAnchor objects, each of which identifies a most-trusted CA. Alternatively, an application can call PKIXBuilderParameters(KeyStore, CertSelector), specifying a KeyStore instance containing trusted certificate entries, each of which will be considered as a most-trusted CA.

In addition, an application must specify constraints on the target certificate that the CertPathBuilder will attempt to build a path to. The constraints are specified as a CertSelector object. These constraints should provide the CertPathBuilder with enough search criteria to find the target certificate. Minimal criteria for an X509Certificate usually include the subject name and/or one or more subject alternative names. If enough criteria is not specified, the CertPathBuilder may throw a CertPathBuilderException.

Concurrent Access

Unless otherwise specified, the methods defined in this class are not thread-safe. Multiple threads that need to access a single object concurrently should synchronize amongst themselves and provide the necessary locking. Multiple threads each manipulating separate objects need not synchronize.

Constructors

PKIXBuilderParameters

public PKIXBuilderParameters(Set<TrustAnchor> trustAnchors,
                             CertSelector targetConstraints)
                      throws InvalidAlgorithmParameterException

Parameters:

trustAnchors - a Set of TrustAnchors

targetConstraints - a CertSelector specifying the constraints on the target certificate

Throws:

InvalidAlgorithmParameterException - if trustAnchors is empty (trustAnchors.isEmpty() == true)

NullPointerException - if trustAnchors is null

ClassCastException - if any of the elements of trustAnchors are not of type java.security.cert.TrustAnchor

PKIXBuilderParameters

public PKIXBuilderParameters(KeyStore keystore,
                             CertSelector targetConstraints)
                      throws KeyStoreException,
                             InvalidAlgorithmParameterException

Creates an instance of PKIXBuilderParameters that populates the set of most-trusted CAs from the trusted certificate entries contained in the specified KeyStore. Only keystore entries that contain trusted X509Certificates are considered; all other certificate types are ignored.

Parameters:

keystore - a KeyStore from which the set of most-trusted CAs will be populated

targetConstraints - a CertSelector specifying the constraints on the target certificate

Throws:

KeyStoreException - if keystore has not been initialized

InvalidAlgorithmParameterException - if keystore does not contain at least one trusted certificate entry

NullPointerException - if keystore is null

Methods

setMaxPathLength

public void setMaxPathLength(int maxPathLength)

Parameters:

maxPathLength - the maximum number of non-self-issued intermediate certificates that may exist in a certification path

Throws:

InvalidParameterException - if maxPathLength is set to a value less than -1

See Also:

getMaxPathLength()

getMaxPathLength

public int getMaxPathLength()

Returns the value of the maximum number of intermediate non-self-issued certificates that may exist in a certification path. See the setMaxPathLength(int) method for more details.

Returns:

the maximum number of non-self-issued intermediate certificates that may exist in a certification path, or -1 if there is no limit

See Also:

setMaxPathLength(int)

toString

public String toString()

Returns a formatted string describing the parameters.

Overrides:

toString in class PKIXParameters

Returns:

a formatted string describing the parameters