Class CertificateValidator

java.lang.Object
com.codename1.backend.security.pki.CertificateValidator
public final class CertificateValidator extends Object

Validates a certificate chain against trust anchors the application names.

CertificateValidator validator = new CertificateValidator(
        Certificate.listFromPem(KeyFiles.read("/etc/app/partner-ca.pem")))
        .forHost("partner.example.com");
List<Certificate> path = validator.validate(Certificate.listFromPem(presented));

There is no default trust store: nothing is trusted unless it is given. A path is built from the first certificate, the leaf, through the other certificates given (in any order) to one of the anchors, and every link is checked:

  • each certificate is signed by the next, within the signature profile of Certificate.getSignatureAlgorithm();
  • each certificate, the leaf and the intermediates, is inside its validity period at the validation time;
  • each issuer below the anchor is a CA by its basic constraints, has keyCertSign when it carries a key usage, and its path length is not exceeded;
  • no certificate carries a critical extension this validator does not understand (name constraints and certificate policies among them);
  • when forHost(String) or forPurpose(String) is set, the leaf matches.

An anchor is trusted as given: its signature, validity and constraints are not checked, as RFC 5280 treats an anchor as a name and a key. Revocation (CRL, OCSP) is not checked.