to top

Summary: Ctors | Methods | Inherited Methods | [Expand All]

Since: API Level 1

public class

X509CertSelector

extends Object
implements CertSelector

java.lang.Object
↳	java.security.cert.X509CertSelector

Class Overview

A certificate selector (CertSelector for selecting X509Certificates that match the specified criteria.

Summary

Public Constructors
	X509CertSelector() Creates a new `X509CertSelector`.

Public Methods
void	addPathToName(int type, byte[] name) Adds a "pathToName" to the respective criterion.
void	addPathToName(int type, String name) Adds a "pathToName" to the respective criterion.
void	addSubjectAlternativeName(int tag, String name) Adds a subject alternative name to the respective criterion.
void	addSubjectAlternativeName(int tag, byte[] name) Adds a subject alternative name to the respective criterion.
Object	clone() Clones this `X509CertSelector` instance.
byte[]	getAuthorityKeyIdentifier() Returns the criterion for the AuthorityKeyIdentifier extension.
int	getBasicConstraints() Returns the criterion for the basic constraints extension.
X509Certificate	getCertificate() Returns the certificate that a matching certificate must be equal to.
Date	getCertificateValid() Returns the criterion for the validity date of the certificate.
Set<String>	getExtendedKeyUsage() Returns the criterion for the ExtendedKeyUsage extension.
X500Principal	getIssuer() Returns the issuer that a certificate must match.
byte[]	getIssuerAsBytes() Returns the issuer that a certificate must match.
String	getIssuerAsString() Do not use, use `getIssuer()` or `getIssuerAsBytes()` instead.
boolean[]	getKeyUsage() Returns the criterion for the KeyUsage extension.
boolean	getMatchAllSubjectAltNames() Returns the flag for the matching behavior for subject alternative names.
byte[]	getNameConstraints() Returns the criterion for the name constraints.
Collection<List<?>>	getPathToNames() Returns the criterion for the pathToNames constraint.
Set<String>	getPolicy() Returns the criterion for the policy constraint.
Date	getPrivateKeyValid() Returns the criterion for the validity date of the private key.
BigInteger	getSerialNumber() Returns the serial number that a certificate must match.
X500Principal	getSubject() Returns the subject that a certificate must match.
Collection<List<?>>	getSubjectAlternativeNames() Returns the criterion for subject alternative names.
byte[]	getSubjectAsBytes() Returns the subject that a certificate must match.
String	getSubjectAsString() Do not use, use `getSubject()` or `getSubjectAsBytes()` instead.
byte[]	getSubjectKeyIdentifier() Returns the criterion for the SubjectKeyIdentifier extension.
PublicKey	getSubjectPublicKey() Returns the criterion for the subject public key.
String	getSubjectPublicKeyAlgID() Returns the criterion for the subject public key signature algorithm.
boolean	match(Certificate certificate) Returns whether the specified certificate matches all the criteria collected in this instance.
void	setAuthorityKeyIdentifier(byte[] authorityKeyIdentifier) Sets the criterion for the AuthorityKeyIdentifier extension.
void	setBasicConstraints(int pathLen) Sets the criterion for the basic constraints extension.
void	setCertificate(X509Certificate certificate) Sets the certificate that a matching certificate must be equal to.
void	setCertificateValid(Date certificateValid) Sets the criterion for the validity date of the certificate.
void	setExtendedKeyUsage(Set<String> keyUsage) Sets the criterion for the ExtendedKeyUsage extension.
void	setIssuer(String issuerName) Do not use, use `getIssuer()` or `getIssuerAsBytes()` instead.
void	setIssuer(X500Principal issuer) Sets the issuer that a certificate must match.
void	setIssuer(byte[] issuerDN) Sets the issuer that a certificate must match.
void	setKeyUsage(boolean[] keyUsage) Sets the criterion for the KeyUsage extension.
void	setMatchAllSubjectAltNames(boolean matchAllNames) Sets the flag for the matching behavior for subject alternative names.
void	setNameConstraints(byte[] bytes) Sets the criterion for the name constraints.
void	setPathToNames(Collection<List<?>> names) Sets the criterion for the pathToNames constraint.
void	setPolicy(Set<String> policies) Sets the criterion for the policy constraint.
void	setPrivateKeyValid(Date privateKeyValid) Sets the criterion for the validity date of the private key.
void	setSerialNumber(BigInteger serialNumber) Sets the serial number that a certificate must match.
void	setSubject(X500Principal subject) Set the subject that a certificate must match.
void	setSubject(String subjectDN) Do not use, use `setSubject(byte[])` or `setSubject(X500Principal)` instead.
void	setSubject(byte[] subjectDN) Sets the subject that a certificate must match.
void	setSubjectAlternativeNames(Collection<List<?>> names) Sets the criterion for subject alternative names.
void	setSubjectKeyIdentifier(byte[] subjectKeyIdentifier) Sets the criterion for the SubjectKeyIdentifier extension.
void	setSubjectPublicKey(byte[] key) Sets the criterion for the subject public key.
void	setSubjectPublicKey(PublicKey key) Sets the criterion for the subject public key.
void	setSubjectPublicKeyAlgID(String oid) Sets the criterion for the subject public key signature algorithm.
String	toString() Returns a string representation of this `X509CertSelector` instance.

[Expand]

Inherited Methods

From class java.lang.Object

Object	clone() Creates and returns a copy of this `Object`.
boolean	equals(Object o) Compares this instance with the specified object and indicates if they are equal.
void	finalize() Invoked when the garbage collector has detected that this instance is no longer reachable.
final Class<?>	getClass() Returns the unique instance of `Class` that represents this object's class.
int	hashCode() Returns an integer hash code for this object.
final void	notify() Causes a thread which is waiting on this object's monitor (by means of calling one of the `wait()` methods) to be woken up.
final void	notifyAll() Causes all threads which are waiting on this object's monitor (by means of calling one of the `wait()` methods) to be woken up.
String	toString() Returns a string containing a concise, human-readable description of this object.
final void	wait() Causes the calling thread to wait until another thread calls the `notify()` or `notifyAll()` method of this object.
final void	wait(long millis, int nanos) Causes the calling thread to wait until another thread calls the `notify()` or `notifyAll()` method of this object or until the specified timeout expires.
final void	wait(long millis) Causes the calling thread to wait until another thread calls the `notify()` or `notifyAll()` method of this object or until the specified timeout expires.

From interface java.security.cert.CertSelector

Public Constructors

public X509CertSelector ()

Since: API Level 1

Creates a new X509CertSelector.

Public Methods

public void addPathToName (int type, byte[] name)

Since: API Level 1

Adds a "pathToName" to the respective criterion.

Parameters

type	the type of the name
name	the name in ASN.1 DER encoded form.

Throws

IOException	if decoding fails.

public void addPathToName (int type, String name)

Since: API Level 1

Adds a "pathToName" to the respective criterion.

Parameters

type	the type of the name.
name	the name in string format.

Throws

IOException	if parsing fails.

public void addSubjectAlternativeName (int tag, String name)

Since: API Level 1

Adds a subject alternative name to the respective criterion.

Parameters

tag	the type of the name
name	the name in string format.

Throws

IOException	if parsing the name fails.

public void addSubjectAlternativeName (int tag, byte[] name)

Since: API Level 1

Adds a subject alternative name to the respective criterion.

Parameters

tag	the type of the name.
name	the name in ASN.1 DER encoded form.

Throws

IOException	if the decoding of the name fails.

public Object clone ()

Since: API Level 1

Clones this X509CertSelector instance.

Returns

the cloned instance.

public byte[] getAuthorityKeyIdentifier ()

Since: API Level 1

Returns the criterion for the AuthorityKeyIdentifier extension.

Returns

the authority key identifier, or null if it is not to be checked.

public int getBasicConstraints ()

Since: API Level 1

Returns the criterion for the basic constraints extension.

A value greater than or equal to zero indicates that a certificate must include a basic constraints extension with a path length of a least that value. A value of -2 indicates that only end-entity certificates are accepted. A value of -1 indicates that no check is done.

Returns

the value of the criterion.

public X509Certificate getCertificate ()

Since: API Level 1

Returns the certificate that a matching certificate must be equal to.

Returns

the certificate to match, or null if this criteria is not checked.

public Date getCertificateValid ()

Since: API Level 1

Returns the criterion for the validity date of the certificate.

Returns

the validity date or null if the date is not to be checked.

public Set<String> getExtendedKeyUsage ()

Since: API Level 1

Returns the criterion for the ExtendedKeyUsage extension.

Returns

the set of key usage OIDs, or null if it's not to be checked.

public X500Principal getIssuer ()

Since: API Level 1

Returns the issuer that a certificate must match.

Returns

the issuer that a certificate must match, or null if the issuer is not to be checked.

public byte[] getIssuerAsBytes ()

Since: API Level 1

Returns the issuer that a certificate must match.

Returns

the distinguished issuer name in ASN.1 DER encoded format, or null if the issuer is not to be checked.

Throws

IOException	if encoding the issuer fails.

public String getIssuerAsString ()

Since: API Level 1

Do not use, use getIssuer() or getIssuerAsBytes() instead. Returns the issuer that a certificate must match in a RFC 2253 format string.

Returns

the issuer in a RFC 2253 format string, or null if the issuer is not to be checked.

public boolean[] getKeyUsage ()

Since: API Level 1

Returns the criterion for the KeyUsage extension.

Returns

the boolean array in the format as returned by getKeyUsage(), or null if the key usage is not to be checked.

public boolean getMatchAllSubjectAltNames ()

Since: API Level 1

Returns the flag for the matching behavior for subject alternative names.

The flag indicates whether a certificate must contain all or at least one of the subject alternative names specified by setSubjectAlternativeNames(Collection>) or addSubjectAlternativeName(int, byte[]).

Returns

true if a certificate must contain all of the specified subject alternative names, otherwise false.

public byte[] getNameConstraints ()

Since: API Level 1

Returns the criterion for the name constraints.

Returns

the name constraints or null if none specified.

public Collection<List<?>> getPathToNames ()

Since: API Level 1

Returns the criterion for the pathToNames constraint.

The constraint is a collection with an entry for each name to be included in the criterion. The name is specified as a List, the first entry is an Integer specifying the name type (0-8), the second entry is a byte array specifying the name in ASN.1 DER encoded form.

Returns

the pathToNames constraint or null if none specified.

public Set<String> getPolicy ()

Since: API Level 1

Returns the criterion for the policy constraint.

The certificate must have at least one of the certificate policy extensions. For an empty set the certificate must have at least some policies in its policy extension.

Returns

the certificate policy OIDs, an empty set, or null if not to be checked.

public Date getPrivateKeyValid ()

Since: API Level 1

Returns the criterion for the validity date of the private key.

The private key must be valid at the specified date.

Returns

the validity date or null if the date is not to be checked.

public BigInteger getSerialNumber ()

Since: API Level 1

Returns the serial number that a certificate must match.

Returns

the serial number to match, or null if the serial number is not to be checked.

public X500Principal getSubject ()

Since: API Level 1

Returns the subject that a certificate must match.

Returns

the subject distinguished name, or null if the subject is not to be checked.

public Collection<List<?>> getSubjectAlternativeNames ()

Since: API Level 1

Returns the criterion for subject alternative names.

the certificate must contain all or at least one of the specified subject alternative names. The behavior is specified by getMatchAllSubjectAltNames().

The subject alternative names is a collection with an entry for each name included in the criterion. The name is specified as a List, the first entry is an Integer specifying the name type (0-8), the second entry is byte array specifying the name in ASN.1 DER encoded form)

Returns

the names collection or null if none specified.

public byte[] getSubjectAsBytes ()

Since: API Level 1

Returns the subject that a certificate must match.

Returns

the subject distinguished name in ASN.1 DER format, or null if the subject is not to be checked.

Throws

IOException	if encoding the subject fails.

public String getSubjectAsString ()

Since: API Level 1

Do not use, use getSubject() or getSubjectAsBytes() instead. Returns the subject that a certificate must match.

Returns

the subject distinguished name in RFC 2253 format, or null if the subject is not to be checked.

public byte[] getSubjectKeyIdentifier ()

Since: API Level 1

Returns the criterion for the SubjectKeyIdentifier extension.

Returns

the subject key identifier or null if it is not to be checked.

public PublicKey getSubjectPublicKey ()

Since: API Level 1

Returns the criterion for the subject public key.

Returns

the subject public key or null if the key is not to be checked.

public String getSubjectPublicKeyAlgID ()

Since: API Level 1

Returns the criterion for the subject public key signature algorithm.

Returns

the OID (object identifier) or the signature algorithm or null if it's not to be checked.

public boolean match (Certificate certificate)

Since: API Level 1

Returns whether the specified certificate matches all the criteria collected in this instance.

Parameters

certificate	the certificate to check.

Returns

true if the certificate matches all the criteria, otherwise false.

public void setAuthorityKeyIdentifier (byte[] authorityKeyIdentifier)

Since: API Level 1

Sets the criterion for the AuthorityKeyIdentifier extension.

Parameters

authorityKeyIdentifier	the authority key identifier, or `null` to disable this check.

public void setBasicConstraints (int pathLen)

Since: API Level 1

Sets the criterion for the basic constraints extension.

Parameters

pathLen	the value specifying the criterion.

Throws

IllegalArgumentException	if `pathLen` is less than `-2`.

public void setCertificate (X509Certificate certificate)

Since: API Level 1

Sets the certificate that a matching certificate must be equal to.

Parameters

certificate	the certificate to match, or null to not check this criteria.

public void setCertificateValid (Date certificateValid)

Since: API Level 1

Sets the criterion for the validity date of the certificate.

The certificate must be valid at the specified date.

Parameters

certificateValid	the validity date or `null` to not check the date.

public void setExtendedKeyUsage (Set<String> keyUsage)

Since: API Level 1

Sets the criterion for the ExtendedKeyUsage extension.

Parameters

keyUsage	the set of key usage OIDs, or `null` to not check it.

Throws

IOException	if one of the OIDs is invalid.

public void setIssuer (String issuerName)

Since: API Level 1

Do not use, use getIssuer() or getIssuerAsBytes() instead. Sets the issuer that a certificate must match.

Parameters

issuerName	the issuer in a RFC 2253 format string, or `null` to not check the issuer.

Throws

IOException	if parsing the issuer fails.

public void setIssuer (X500Principal issuer)

Since: API Level 1

Sets the issuer that a certificate must match.

Parameters

issuer	the issuer to match, or `null` if the issuer is not to be checked.

public void setIssuer (byte[] issuerDN)

Since: API Level 1

Sets the issuer that a certificate must match.

Parameters

issuerDN	the distinguished issuer name in ASN.1 DER encoded format, or `null` to not check the issuer.

Throws

IOException	if decoding the issuer fail.

public void setKeyUsage (boolean[] keyUsage)

Since: API Level 1

Sets the criterion for the KeyUsage extension.

Parameters

keyUsage	the boolean array in the format as returned by `getKeyUsage()`, or `null` to not check the key usage.

public void setMatchAllSubjectAltNames (boolean matchAllNames)

Since: API Level 1

Sets the flag for the matching behavior for subject alternative names.

Parameters

matchAllNames	`true` if a certificate must contain all of the specified subject alternative names, otherwise `false`.

public void setNameConstraints (byte[] bytes)

Since: API Level 1

Sets the criterion for the name constraints.

The certificate must constraint subject and subject alternative names that match the specified name constraints.

The name constraints in ASN.1:

 NameConstraints ::= SEQUENCE {
        permittedSubtrees       [0]     GeneralSubtrees OPTIONAL,
        excludedSubtrees        [1]     GeneralSubtrees OPTIONAL }

 GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree

 GeneralSubtree ::= SEQUENCE {
        base                    GeneralName,
        minimum         [0]     BaseDistance DEFAULT 0,
        maximum         [1]     BaseDistance OPTIONAL }

 BaseDistance ::= INTEGER (0..MAX)

 GeneralName ::= CHOICE {
        otherName                       [0]     OtherName,
        rfc822Name                      [1]     IA5String,
        dNSName                         [2]     IA5String,
        x400Address                     [3]     ORAddress,
        directoryName                   [4]     Name,
        ediPartyName                    [5]     EDIPartyName,
        uniformResourceIdentifier       [6]     IA5String,
        iPAddress                       [7]     OCTET STRING,
        registeredID                    [8]     OBJECT IDENTIFIER}

Parameters

bytes	the name constraints in ASN.1 DER encoded format, or null to not check any constraints.

Throws

IOException	if decoding the name constraints fail.

public void setPathToNames (Collection<List<?>> names)

Since: API Level 1

Sets the criterion for the pathToNames constraint.

This allows to specify the complete set of names, a certificate's name constraints must permit.

The specified parameter names is a collection with an entry for each name to be included in the criterion. The name is specified as a List, the first entry must be an Integer specifying the name type (0-8), the second entry must be a String or a byte array specifying the name (in string or ASN.1 DER encoded form)

Parameters

names	the names collection or `null` to not perform this check.

Throws

IOException	if decoding fails.

public void setPolicy (Set<String> policies)

Since: API Level 1

Sets the criterion for the policy constraint.

The certificate must have at least one of the specified certificate policy extensions. For an empty set the certificate must have at least some policies in its policy extension.

Parameters

policies	the certificate policy OIDs, an empty set, or `null` to not perform this check.

Throws

IOException	if parsing the specified OIDs fails.

public void setPrivateKeyValid (Date privateKeyValid)

Since: API Level 1

Sets the criterion for the validity date of the private key.

The private key must be valid at the specified date.

Parameters

privateKeyValid	the validity date or `null` to not check the date.

public void setSerialNumber (BigInteger serialNumber)

Since: API Level 1

Sets the serial number that a certificate must match.

Parameters

serialNumber	the serial number to match, or `null` to not check the serial number.

public void setSubject (X500Principal subject)

Since: API Level 1

Set the subject that a certificate must match.

Parameters

subject	the subject distinguished name or `null` to not check the subject.

public void setSubject (String subjectDN)

Since: API Level 1

Do not use, use setSubject(byte[]) or setSubject(X500Principal) instead. Returns the subject that a certificate must match.

Parameters

subjectDN	the subject distinguished name in RFC 2253 format or `null` to not check the subject.

Throws

IOException	if decoding the subject fails.

public void setSubject (byte[] subjectDN)

Since: API Level 1

Sets the subject that a certificate must match.

Parameters

subjectDN	the subject distinguished name in ASN.1 DER format, or `null` to not check the subject.

Throws

IOException	if decoding the subject fails.

public void setSubjectAlternativeNames (Collection<List<?>> names)

Since: API Level 1

Sets the criterion for subject alternative names.

the certificate must contain all or at least one of the specified subject alternative names. The behavior is specified by getMatchAllSubjectAltNames().

Parameters

names	the names collection or `null` to not perform this check.

Throws

IOException	if the decoding of a name fails.

public void setSubjectKeyIdentifier (byte[] subjectKeyIdentifier)

Since: API Level 1

Sets the criterion for the SubjectKeyIdentifier extension.

The subjectKeyIdentifier should be a single DER encoded value.

Parameters

subjectKeyIdentifier	the subject key identifier or `null` to disable this check.

public void setSubjectPublicKey (byte[] key)

Since: API Level 1

Sets the criterion for the subject public key.

Parameters

key	the subject public key in ASN.1 DER encoded format or `null` to not check the key.

Throws

IOException	if decoding the the public key fails.

public void setSubjectPublicKey (PublicKey key)

Since: API Level 1

Sets the criterion for the subject public key.

Parameters

key	the subject public key or `null` to not check the key.

public void setSubjectPublicKeyAlgID (String oid)

Since: API Level 1

Sets the criterion for the subject public key signature algorithm.

The certificate must contain a subject public key with the algorithm specified.

Parameters

oid	the OID (object identifier) of the signature algorithm or `null` to not check the OID.

Throws

IOException	if the specified object identifier is invalid.

public String toString ()

Since: API Level 1

Returns a string representation of this X509CertSelector instance.

Returns

a string representation of this X509CertSelector instance.

Results

Interfaces

Classes

Exceptions

X509CertSelector

Class Overview

Summary

Public Constructors

public X509CertSelector ()

Public Methods

public void addPathToName (int type, byte[] name)

Parameters

Throws

See Also

public void addPathToName (int type, String name)

Parameters

Throws

See Also

public void addSubjectAlternativeName (int tag, String name)

Parameters

Throws

public void addSubjectAlternativeName (int tag, byte[] name)

Parameters

Throws

public Object clone ()

Returns

public byte[] getAuthorityKeyIdentifier ()

Returns

public int getBasicConstraints ()

Returns

public X509Certificate getCertificate ()

Returns

public Date getCertificateValid ()

Returns

public Set<String> getExtendedKeyUsage ()

Returns

public X500Principal getIssuer ()

Returns

public byte[] getIssuerAsBytes ()

Returns

Throws

public String getIssuerAsString ()

Returns

public boolean[] getKeyUsage ()

Returns

public boolean getMatchAllSubjectAltNames ()

Returns

public byte[] getNameConstraints ()

Returns

See Also

public Collection<List<?>> getPathToNames ()

Returns

public Set<String> getPolicy ()

Returns

public Date getPrivateKeyValid ()

Returns

public BigInteger getSerialNumber ()

Returns

public X500Principal getSubject ()

Returns

public Collection<List<?>> getSubjectAlternativeNames ()

Returns

public byte[] getSubjectAsBytes ()

Returns

Throws

public String getSubjectAsString ()

Returns

public byte[] getSubjectKeyIdentifier ()

Returns

public PublicKey getSubjectPublicKey ()

Returns

public String getSubjectPublicKeyAlgID ()

Returns

public boolean match (Certificate certificate)

Parameters

Returns

public void setAuthorityKeyIdentifier (byte[] authorityKeyIdentifier)

Parameters

public void setBasicConstraints (int pathLen)

Parameters