Bouncy Castle Cryptography Library 1.45

## org.bouncycastle.x509
Class ExtendedPKIXParameters

    java.lang.Object
      java.security.cert.PKIXParameters
          org.bouncycastle.x509.ExtendedPKIXParameters

All Implemented Interfaces:
  java.lang.Cloneable, java.security.cert.CertPathParameters

Direct Known Subclasses:
  ExtendedPKIXBuilderParameters

    public class ExtendedPKIXParameters

extends java.security.cert.PKIXParameters

This class extends the PKIXParameters with a validity model parameter.

Field Summary
`static int` `CHAIN_VALIDITY_MODEL` This model uses the following validity model.
`static int` `PKIX_VALIDITY_MODEL` This is the default PKIX validity model.

Constructor Summary
`ExtendedPKIXParameters(java.util.Set trustAnchors)` Creates an instance of `PKIXParameters` with the specified `Set` of most-trusted CAs.

Method Summary
`void` `addAddionalStore(Store store)` Deprecated.
`void` `addAdditionalStore(Store store)` Adds an additional Bouncy Castle `Store` to find CRLs, certificates, attribute certificates or cross certificates.
`void` `addStore(Store store)` Adds a Bouncy Castle `Store` to find CRLs, certificates, attribute certificates or cross certificates.
`java.lang.Object` `clone()`
`java.util.List` `getAdditionalStores()` Returns an immutable `List` of additional Bouncy Castle `Store`s used for finding CRLs, certificates, attribute certificates or cross certificates.
`java.util.Set` `getAttrCertCheckers()` Returns the attribute certificate checker.
`static ExtendedPKIXParameters` `getInstance(java.security.cert.PKIXParameters pkixParams)` Returns an instance with the parameters of a given `PKIXParameters` object.
`java.util.Set` `getNecessaryACAttributes()` Returns the neccessary attributes which must be contained in an attribute certificate.
`java.util.Set` `getProhibitedACAttributes()` Returns the attribute certificates which are not allowed.
`java.util.List` `getStores()` Returns an immutable `List` of Bouncy Castle `Store`s used for finding CRLs, certificates, attribute certificates or cross certificates.
`Selector` `getTargetConstraints()` Returns the required constraints on the target certificate or attribute certificate.
`java.util.Set` `getTrustedACIssuers()` Returns the trusted attribute certificate issuers.
`int` `getValidityModel()`
`boolean` `isAdditionalLocationsEnabled()` Returns if additional `X509Store`s for locations like LDAP found in certificates or CRLs should be used.
`boolean` `isUseDeltasEnabled()` Defaults to `false`.
`void` `setAdditionalLocationsEnabled(boolean enabled)` Sets if additional `X509Store`s for locations like LDAP found in certificates or CRLs should be used.
`void` `setAttrCertCheckers(java.util.Set attrCertCheckers)` Sets the attribute certificate checkers.
`void` `setCertStores(java.util.List stores)` Sets the Java CertStore to this extended PKIX parameters.
`void` `setNecessaryACAttributes(java.util.Set necessaryACAttributes)` Sets the neccessary which must be contained in an attribute certificate.
`protected void` `setParams(java.security.cert.PKIXParameters params)` Method to support `clone()` under J2ME.
`void` `setProhibitedACAttributes(java.util.Set prohibitedACAttributes)` Sets the attribute certificates which are not allowed.
`void` `setStores(java.util.List stores)` Sets the Bouncy Castle Stores for finding CRLs, certificates, attribute certificates or cross certificates.
`void` `setTargetCertConstraints(java.security.cert.CertSelector selector)` Sets the required constraints on the target certificate.
`void` `setTargetConstraints(Selector selector)` Sets the required constraints on the target certificate or attribute certificate.
`void` `setTrustedACIssuers(java.util.Set trustedACIssuers)` Sets the trusted attribute certificate issuers.
`void` `setUseDeltasEnabled(boolean useDeltas)` Sets if delta CRLs should be used for checking the revocation status.
`void` `setValidityModel(int validityModel)`

Methods inherited from class java.security.cert.PKIXParameters

`addCertPathChecker, addCertStore, getCertPathCheckers, getCertStores, getDate, getInitialPolicies, getPolicyQualifiersRejected, getSigProvider, getTargetCertConstraints, getTrustAnchors, isAnyPolicyInhibited, isExplicitPolicyRequired, isPolicyMappingInhibited, isRevocationEnabled, setAnyPolicyInhibited, setCertPathCheckers, setDate, setExplicitPolicyRequired, setInitialPolicies, setPolicyMappingInhibited, setPolicyQualifiersRejected, setRevocationEnabled, setSigProvider, setTrustAnchors, toString`

Methods inherited from class java.lang.Object
`equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait`

Field Detail

### PKIX_VALIDITY_MODEL

    public static final int PKIX_VALIDITY_MODEL

  This is the default PKIX validity model. Actually there are two variants of this: The PKIX model and the modified PKIX model. The PKIX model verifies that all involved certificates must have been valid at the current time. The modified PKIX model verifies that all involved certificates were valid at the signing time. Both are indirectly choosen with the `PKIXParameters.setDate(java.util.Date)` method, so this methods sets the Date when all certificates must have been valid.

  See Also:
    Constant Field Values

### CHAIN_VALIDITY_MODEL

    public static final int CHAIN_VALIDITY_MODEL

  This model uses the following validity model. Each certificate must have been valid at the moment where is was used. That means the end certificate must have been valid at the time the signature was done. The CA certificate which signed the end certificate must have been valid, when the end certificate was signed. The CA (or Root CA) certificate must have been valid, when the CA certificate was signed and so on. So the `PKIXParameters.setDate(java.util.Date)` method sets the time, when the end certificate must have been valid.

  It is used e.g. in the German signature law.

  See Also:
    Constant Field Values

Constructor Detail

### ExtendedPKIXParameters

    public ExtendedPKIXParameters(java.util.Set trustAnchors)
                           throws java.security.InvalidAlgorithmParameterException

  Creates an instance of `PKIXParameters` with the specified `Set` of most-trusted CAs. Each element of the set is a `TrustAnchor`.

  Note that the `Set` is copied to protect against subsequent modifications.

  Parameters:
    `trustAnchors` - a `Set` of `TrustAnchor`s
  Throws:
    `java.security.InvalidAlgorithmParameterException` - if the specified `Set` is empty.
    `java.lang.NullPointerException` - if the specified `Set` is `null`
    `java.lang.ClassCastException` - if any of the elements in the `Set` is not of type `java.security.cert.TrustAnchor`

Method Detail

### getInstance

    public static ExtendedPKIXParameters getInstance(java.security.cert.PKIXParameters pkixParams)

  Returns an instance with the parameters of a given `PKIXParameters` object.

  Parameters:
    `pkixParams` - The given `PKIXParameters`
  Returns:
    an extended PKIX params object

### setParams

    protected void setParams(java.security.cert.PKIXParameters params)

  Method to support `clone()` under J2ME. `super.clone()` does not exist and fields are not copied.

  Parameters:
    `params` - Parameters to set. If this are `ExtendedPKIXParameters` they are copied to.

### isUseDeltasEnabled

    public boolean isUseDeltasEnabled()

  Defaults to `false`.

  Returns:
    Returns if delta CRLs should be used.

### setUseDeltasEnabled

    public void setUseDeltasEnabled(boolean useDeltas)

  Sets if delta CRLs should be used for checking the revocation status.

  Parameters:
    `useDeltas` - `true` if delta CRLs should be used.

### getValidityModel

    public int getValidityModel()

  Returns:
    Returns the validity model.
  See Also:
    `CHAIN_VALIDITY_MODEL`, `PKIX_VALIDITY_MODEL`

### setCertStores

    public void setCertStores(java.util.List stores)

  Sets the Java CertStore to this extended PKIX parameters.

  Overrides:
    `setCertStores` in class `java.security.cert.PKIXParameters`
  Throws:
    `java.lang.ClassCastException` - if an element of `stores` is not a `CertStore`.

### setStores

    public void setStores(java.util.List stores)

  Sets the Bouncy Castle Stores for finding CRLs, certificates, attribute certificates or cross certificates.

  The `List` is cloned.

  Parameters:
    `stores` - A list of stores to use.
  Throws:
    `java.lang.ClassCastException` - if an element of `stores` is not a `Store`.
  See Also:
    `getStores()`

### addStore

    public void addStore(Store store)

  Adds a Bouncy Castle `Store` to find CRLs, certificates, attribute certificates or cross certificates.

  This method should be used to add local stores, like collection based X.509 stores, if available. Local stores should be considered first, before trying to use additional (remote) locations, because they do not need possible additional network traffic.

  If `store` is `null` it is ignored.

  Parameters:
    `store` - The store to add.
  See Also:
    `getStores()`

### addAdditionalStore

    public void addAdditionalStore(Store store)

  Adds an additional Bouncy Castle `Store` to find CRLs, certificates, attribute certificates or cross certificates.

  You should not use this method. This method is used for adding additional X.509 stores, which are used to add (remote) locations, e.g. LDAP, found during X.509 object processing, e.g. in certificates or CRLs. This method is used in PKIX certification path processing.

  If `store` is `null` it is ignored.

  Parameters:
    `store` - The store to add.
  See Also:
    `getStores()`

### addAddionalStore

    public void addAddionalStore(Store store)

  Deprecated.

### getAdditionalStores

    public java.util.List getAdditionalStores()

  Returns an immutable `List` of additional Bouncy Castle `Store`s used for finding CRLs, certificates, attribute certificates or cross certificates.

  Returns:
    an immutable `List` of additional Bouncy Castle `Store`s. Never `null`.
  See Also:
    `addAdditionalStore(Store)`

### getStores

    public java.util.List getStores()

  Returns an immutable `List` of Bouncy Castle `Store`s used for finding CRLs, certificates, attribute certificates or cross certificates.

  Returns:
    an immutable `List` of Bouncy Castle `Store`s. Never `null`.
  See Also:
    `setStores(List)`

### setValidityModel

    public void setValidityModel(int validityModel)

  Parameters:
    `validityModel` - The validity model to set.
  See Also:
    `CHAIN_VALIDITY_MODEL`, `PKIX_VALIDITY_MODEL`

### clone

    public java.lang.Object clone()

  Specified by:
    `clone` in interface `java.security.cert.CertPathParameters`
  Overrides:
    `clone` in class `java.security.cert.PKIXParameters`

### isAdditionalLocationsEnabled

    public boolean isAdditionalLocationsEnabled()

  Returns if additional `X509Store`s for locations like LDAP found in certificates or CRLs should be used.

  Returns:
    Returns `true` if additional stores are used.

### setAdditionalLocationsEnabled

    public void setAdditionalLocationsEnabled(boolean enabled)

  Sets if additional `X509Store`s for locations like LDAP found in certificates or CRLs should be used.

  Parameters:
    `enabled` - `true` if additional stores are used.

### getTargetConstraints

    public Selector getTargetConstraints()

  Returns the required constraints on the target certificate or attribute certificate. The constraints are returned as an instance of `Selector`. If `null`, no constraints are defined.

  The target certificate in a PKIX path may be a certificate or an attribute certificate.

  Note that the `Selector` returned is cloned to protect against subsequent modifications.

  Returns:
    a `Selector` specifying the constraints on the target certificate or attribute certificate (or `null`)
  See Also:
    `setTargetConstraints(org.bouncycastle.util.Selector)`, `X509CertStoreSelector`, `X509AttributeCertStoreSelector`

### setTargetConstraints

    public void setTargetConstraints(Selector selector)

  Sets the required constraints on the target certificate or attribute certificate. The constraints are specified as an instance of `Selector`. If `null`, no constraints are defined.

  The target certificate in a PKIX path may be a certificate or an attribute certificate.

  Note that the `Selector` specified is cloned to protect against subsequent modifications.

  Parameters:
    `selector` - a `Selector` specifying the constraints on the target certificate or attribute certificate (or `null`)
  See Also:
    `getTargetConstraints()`, `X509CertStoreSelector`, `X509AttributeCertStoreSelector`

### setTargetCertConstraints

    public void setTargetCertConstraints(java.security.cert.CertSelector selector)

  Sets the required constraints on the target certificate. The constraints are specified as an instance of `X509CertSelector`. If `null`, no constraints are defined.

  This method wraps the given `X509CertSelector` into a `X509CertStoreSelector`.

  Note that the `X509CertSelector` specified is cloned to protect against subsequent modifications.

  Overrides:
    `setTargetCertConstraints` in class `java.security.cert.PKIXParameters`
  Parameters:
    `selector` - a `X509CertSelector` specifying the constraints on the target certificate (or `null`)
  See Also:
    `PKIXParameters.getTargetCertConstraints()`, `X509CertStoreSelector`

### getTrustedACIssuers

    public java.util.Set getTrustedACIssuers()

  Returns the trusted attribute certificate issuers. If attribute certificates is verified the trusted AC issuers must be set.

  The returned `Set` consists of `TrustAnchor`s.

  The returned `Set` is immutable. Never `null`

  Returns:
    Returns an immutable set of the trusted AC issuers.

### setTrustedACIssuers

    public void setTrustedACIssuers(java.util.Set trustedACIssuers)

  Sets the trusted attribute certificate issuers. If attribute certificates is verified the trusted AC issuers must be set.

  The `trustedACIssuers` must be a `Set` of `TrustAnchor`

  The given set is cloned.

  Parameters:
    `trustedACIssuers` - The trusted AC issuers to set. Is never `null`.
  Throws:
    `java.lang.ClassCastException` - if an element of `stores` is not a `TrustAnchor`.

### getNecessaryACAttributes

    public java.util.Set getNecessaryACAttributes()

  Returns the neccessary attributes which must be contained in an attribute certificate.

  The returned `Set` is immutable and contains `String`s with the OIDs.

  Returns:
    Returns the necessary AC attributes.

### setNecessaryACAttributes

    public void setNecessaryACAttributes(java.util.Set necessaryACAttributes)

  Sets the neccessary which must be contained in an attribute certificate.

  The `Set` must contain `String`s with the OIDs.

  The set is cloned.

  Parameters:
    `necessaryACAttributes` - The necessary AC attributes to set.
  Throws:
    `java.lang.ClassCastException` - if an element of `necessaryACAttributes` is not a `String`.

### getProhibitedACAttributes

    public java.util.Set getProhibitedACAttributes()

  Returns the attribute certificates which are not allowed.

  The returned `Set` is immutable and contains `String`s with the OIDs.

  Returns:
    Returns the prohibited AC attributes. Is never `null`.

### setProhibitedACAttributes

    public void setProhibitedACAttributes(java.util.Set prohibitedACAttributes)

  Sets the attribute certificates which are not allowed.

  The `Set` must contain `String`s with the OIDs.

  The set is cloned.

  Parameters:
    `prohibitedACAttributes` - The prohibited AC attributes to set.
  Throws:
    `java.lang.ClassCastException` - if an element of `prohibitedACAttributes` is not a `String`.

### getAttrCertCheckers

    public java.util.Set getAttrCertCheckers()

  Returns the attribute certificate checker. The returned set contains `PKIXAttrCertChecker`s and is immutable.

  Returns:
    Returns the attribute certificate checker. Is never `null`.

### setAttrCertCheckers

    public void setAttrCertCheckers(java.util.Set attrCertCheckers)

  Sets the attribute certificate checkers.

  All elements in the `Set` must a `PKIXAttrCertChecker`.

  The given set is cloned.

  Parameters:
    `attrCertCheckers` - The attribute certificate checkers to set. Is never `null`.
  Throws:
    `java.lang.ClassCastException` - if an element of `attrCertCheckers` is not a `PKIXAttrCertChecker`.

Bouncy Castle Cryptography Library 1.45