CertPath

CertPath

java.security.cert

---

Java 1.4

serializable

A CertPath is a immutable sequence or chain of certificates that establishes a "certification path " from an unknown "end entity" to a known and trusted Certificate Authority or "trust anchor". Use a CertPathValidator to validate a certificate chain and establish trust in the public key presented in the certificate of the end entity.

getType( ) returns the type of the certificates in the CertPath . For X.509 certificate chains (the only type supported by the default "SUN" provider) this method returns "X.509". getCertificates( ) returns a java.util.List object that contains the Certificate objects that comprise the chain. For X.509 chains, the list contains X509Certificate objects. Also, for X.509 certificate paths, the List returned by getCertificates( ) starts with the certificate of of the end entity, and ends with a certificate signed by the trust anchor. The signer of any certificate but the last must be the subject of the next certificate in the List . If the end entity presents a certificate that is directly signed by a trust anchor (which is a not uncommon occurrence) then the List returned by getCertificates( ) consists of only that single certificate. Note that the list of certificates does not include the certificate of the trust anchor. The public keys of trusted CAs must be known by the system in advance. In Sun's JDK implementation, the public-key certificates of trusted CAs are stored in the file jre/lib/security/cacerts .

CertPath objects can be created with a CertificateFactory , or at a lower level with a CertPathBuilder object. A CertificateFactory can parse or decode a CertPath object from a binary stream. The getEncoded( ) methods reverse the process and encode a CertPath into an array of bytes. getEncodings( ) returns the encodings supported for a CertPath . The first returned encoding name is the default one, but you can use any supported encoding by using the one-argument version of getEncoded( ) . The default "SUN" provider supports encodings named "PKCS7" and "PkiPath".

CertPath objects are immutable as is the List object returned by getCertificates( ) and the Certificate objects contained in the list. Furthermore, all CertPath methods are threadsafe.

Figure 14-53. java.security.cert.CertPath

 public abstract class  CertPath  implements Serializable {  // Protected Constructors  protected  CertPath  (String  type  );  // Nested Types  protected static class  CertPathRep  implements Serializable;  // Public Instance Methods  public abstract java.util.List<? extends java.security.cert.Certificate>  getCertificates  ( );        public abstract byte[ ]  getEncoded  ( ) throws CertificateEncodingException;        public abstract byte[ ]  getEncoded  (String  encoding  )          throws CertificateEncodingException;        public abstract java.util.Iterator<String>  getEncodings  ( );        public String  getType  ( );  // Public Methods Overriding Object  public boolean  equals  (Object  other  );        public int  hashCode  ( );        public String  toString  ( );  // Protected Instance Methods  protected Object  writeReplace  ( ) throws java.io.ObjectStreamException;   } 

Passed To

java.security.CodeSigner.CodeSigner( ) , java.security.Timestamp.Timestamp( ) , CertPathValidator.validate( ) , CertPathValidatorException.CertPathValidatorException( ) , CertPathValidatorSpi.engineValidate( ) , PKIXCertPathBuilderResult.PKIXCertPathBuilderResult( )

Returned By

java.security.CodeSigner.getSignerCertPath( ) , java.security.Timestamp.getSignerCertPath( ) , CertificateFactory.generateCertPath( ) , CertificateFactorySpi.engineGenerateCertPath( ) , CertPathBuilderResult.getCertPath( ) , CertPathValidatorException.getCertPath( ) , PKIXCertPathBuilderResult.getCertPath( )