|
| |
|
| java.lang.Object
 sun.security.x509.Extension
sun.security.x509.NameConstraintsExtension
| NameConstraintsExtension | | public class NameConstraintsExtension extends Extension implements CertAttrSet(Code) | | This class defines the Name Constraints Extension.
The name constraints extension provides permitted and excluded
subtrees that place restrictions on names that may be included within
a certificate issued by a given CA. Restrictions may apply to the
subject distinguished name or subject alternative names. Any name
matching a restriction in the excluded subtrees field is invalid
regardless of information appearing in the permitted subtrees.
The ASN.1 syntax for this is:
NameConstraints ::= SEQUENCE {
permittedSubtrees [0] GeneralSubtrees OPTIONAL,
excludedSubtrees [1] GeneralSubtrees OPTIONAL
}
GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree
author:
Amit Kapoor
author:
Hemma Prafullchandra
version:
1.15
See Also: Extension
See Also: CertAttrSet |
| Method Summary | |
| public void | decode(InputStream in)
Decode the extension from the InputStream. | | public void | delete(String name)
Delete the attribute value. | | public void | encode(OutputStream out)
Write the extension to the OutputStream. | | public Object | get(String name)
Get the attribute value. | | public Enumeration | getElements()
Return an enumeration of names of attributes existing within this
attribute. | | public String | getName()
Return the name of this attribute. | | public void | merge(NameConstraintsExtension newConstraints)
Merge additional name constraints with existing ones.
This function is used in certification path processing
to accumulate name constraints from successive certificates
in the path. | | public void | set(String name, Object obj)
Set the attribute value. | | public String | toString()
Return the printable string. | | public boolean | verify(X509Certificate cert)
check whether a certificate conforms to these NameConstraints.
This involves verifying that the subject name and subjectAltName
extension (critical or noncritical) is consistent with the permitted
subtrees state variables. | | public boolean | verify(GeneralNameInterface name)
check whether a name conforms to these NameConstraints. | | public boolean | verifyRFC822SpecialCase(X500Name subject)
Perform the RFC 822 special case check. |
| EXCLUDED_SUBTREES | | final public static String EXCLUDED_SUBTREES(Code) | | |
| IDENT | | final public static String IDENT(Code) | | Identifier for this attribute, to be used with the
get, set, delete methods of Certificate, x509 type.
|
| PERMITTED_SUBTREES | | final public static String PERMITTED_SUBTREES(Code) | | |
| NameConstraintsExtension | | public NameConstraintsExtension(GeneralSubtrees permitted, GeneralSubtrees excluded) throws IOException(Code) | | The default constructor for this class. Both parameters
are optional and can be set to null. The extension criticality
is set to true.
Parameters:
permitted - the permitted GeneralSubtrees (null for optional).
Parameters:
excluded - the excluded GeneralSubtrees (null for optional). |
| NameConstraintsExtension | | public NameConstraintsExtension(Boolean critical, Object value) throws IOException(Code) | | Create the extension from the passed DER encoded value.
Parameters:
critical - true if the extension is to be treated as critical.
Parameters:
value - Array of DER encoded bytes of the actual value.
exception:
IOException - on error. |
| decode | | public void decode(InputStream in) throws IOException(Code) | | Decode the extension from the InputStream.
Parameters:
in - the InputStream to unmarshal the contents from.
exception:
IOException - on decoding or validity errors. |
| encode | | public void encode(OutputStream out) throws IOException(Code) | | Write the extension to the OutputStream.
Parameters:
out - the OutputStream to write the extension to.
exception:
IOException - on encoding errors. |
| getElements | | public Enumeration getElements()(Code) | | Return an enumeration of names of attributes existing within this
attribute.
|
| getName | | public String getName()(Code) | | Return the name of this attribute.
|
| merge | | public void merge(NameConstraintsExtension newConstraints) throws IOException(Code) | | Merge additional name constraints with existing ones.
This function is used in certification path processing
to accumulate name constraints from successive certificates
in the path. Note that NameConstraints can never be
expanded by a merge, just remain constant or become more
limiting.
IETF RFC2459 specifies the processing of Name Constraints as
follows:
(j) If permittedSubtrees is present in the certificate, set the
constrained subtrees state variable to the intersection of its
previous value and the value indicated in the extension field.
(k) If excludedSubtrees is present in the certificate, set the
excluded subtrees state variable to the union of its previous
value and the value indicated in the extension field.
Parameters:
newConstraints - additional NameConstraints to be applied
throws:
IOException - on error |
| toString | | public String toString()(Code) | | Return the printable string.
|
| verify | | public boolean verify(X509Certificate cert) throws IOException(Code) | | check whether a certificate conforms to these NameConstraints.
This involves verifying that the subject name and subjectAltName
extension (critical or noncritical) is consistent with the permitted
subtrees state variables. Also verify that the subject name and
subjectAltName extension (critical or noncritical) is consistent with
the excluded subtrees state variables.
Parameters:
cert - X509Certificate to be verified
throws:
IOException - on error |
| verify | | public boolean verify(GeneralNameInterface name) throws IOException(Code) | | check whether a name conforms to these NameConstraints.
This involves verifying that the name is consistent with the
permitted and excluded subtrees variables.
Parameters:
name - GeneralNameInterface name to be verified
throws:
IOException - on error |
| verifyRFC822SpecialCase | | public boolean verifyRFC822SpecialCase(X500Name subject) throws IOException(Code) | | Perform the RFC 822 special case check. We have a certificate
that does not contain any subject alternative names. Check that
any EMAILADDRESS attributes in its subject name conform to these
NameConstraints.
Parameters:
subject - the certificate's subject name
throws:
IOException - on error |
|
|
|