Class CertStore
Certificate
s and CRL
s
from a repository.
This class uses a provider-based architecture.
To create a CertStore
, call one of the static
getInstance
methods, passing in the type of
CertStore
desired, any applicable initialization parameters
and optionally the name of the provider desired.
Once the CertStore
has been created, it can be used to
retrieve Certificate
s and CRL
s by calling its
getCertificates
and
getCRLs
methods.
Unlike a KeyStore
, which provides access
to a cache of private keys and trusted certificates, a
CertStore
is designed to provide access to a potentially
vast repository of untrusted certificates and CRLs. For example, an LDAP
implementation of CertStore
provides access to certificates
and CRLs stored in one or more directories using the LDAP protocol and the
schema as defined in the RFC service attribute.
Every implementation of the Java platform is required to support the
following standard CertStore
type:
Collection
Concurrent Access
All public methods of CertStore
objects must be thread-safe.
That is, multiple threads may concurrently invoke these methods on a
single CertStore
object (or more than one) with no
ill effects. This allows a CertPathBuilder
to search for a
CRL while simultaneously searching for further certificates, for instance.
The static methods of this class are also guaranteed to be thread-safe. Multiple threads may concurrently invoke the static methods defined in this class with no ill effects.
- Since:
- 1.4
-
Constructor Summary
ModifierConstructorDescriptionprotected
CertStore
(CertStoreSpi storeSpi, Provider provider, String type, CertStoreParameters params) Creates aCertStore
object of the given type, and encapsulates the given provider implementation (SPI object) in it. -
Method Summary
Modifier and TypeMethodDescriptionfinal Collection
<? extends Certificate> getCertificates
(CertSelector selector) Returns aCollection
ofCertificate
s that match the specified selector.final CertStoreParameters
Returns the parameters used to initialize thisCertStore
.final Collection
<? extends CRL> getCRLs
(CRLSelector selector) Returns aCollection
ofCRL
s that match the specified selector.static final String
Returns the defaultCertStore
type as specified by thecertstore.type
security property, or the string "LDAP" if no such property exists.static CertStore
getInstance
(String type, CertStoreParameters params) Returns aCertStore
object that implements the specifiedCertStore
type and is initialized with the specified parameters.static CertStore
getInstance
(String type, CertStoreParameters params, String provider) Returns aCertStore
object that implements the specifiedCertStore
type.static CertStore
getInstance
(String type, CertStoreParameters params, Provider provider) Returns aCertStore
object that implements the specifiedCertStore
type.final Provider
Returns the provider of thisCertStore
.final String
getType()
Returns the type of thisCertStore
.
-
Constructor Details
-
CertStore
protected CertStore(CertStoreSpi storeSpi, Provider provider, String type, CertStoreParameters params) Creates aCertStore
object of the given type, and encapsulates the given provider implementation (SPI object) in it.- Parameters:
storeSpi
- the provider implementationprovider
- the providertype
- the typeparams
- the initialization parameters (may benull
)
-
-
Method Details
-
getCertificates
public final Collection<? extends Certificate> getCertificates(CertSelector selector) throws CertStoreException Returns aCollection
ofCertificate
s that match the specified selector. If noCertificate
s match the selector, an emptyCollection
will be returned.For some
CertStore
types, the resultingCollection
may not contain all of theCertificate
s that match the selector. For instance, an LDAPCertStore
may not search all entries in the directory. Instead, it may just search entries that are likely to contain theCertificate
s it is looking for.Some
CertStore
implementations (especially LDAPCertStore
s) may throw aCertStoreException
unless a non-nullCertSelector
is provided that includes specific criteria that can be used to find the certificates. Issuer and/or subject names are especially useful criteria.- Parameters:
selector
- ACertSelector
used to select whichCertificate
s should be returned. Specifynull
to return allCertificate
s (if supported).- Returns:
- A
Collection
ofCertificate
s that match the specified selector (nevernull
) - Throws:
CertStoreException
- if an exception occurs
-
getCRLs
Returns aCollection
ofCRL
s that match the specified selector. If noCRL
s match the selector, an emptyCollection
will be returned.For some
CertStore
types, the resultingCollection
may not contain all of theCRL
s that match the selector. For instance, an LDAPCertStore
may not search all entries in the directory. Instead, it may just search entries that are likely to contain theCRL
s it is looking for.Some
CertStore
implementations (especially LDAPCertStore
s) may throw aCertStoreException
unless a non-nullCRLSelector
is provided that includes specific criteria that can be used to find the CRLs. Issuer names and/or the certificate to be checked are especially useful.- Parameters:
selector
- ACRLSelector
used to select whichCRL
s should be returned. Specifynull
to return allCRL
s (if supported).- Returns:
- A
Collection
ofCRL
s that match the specified selector (nevernull
) - Throws:
CertStoreException
- if an exception occurs
-
getInstance
public static CertStore getInstance(String type, CertStoreParameters params) throws InvalidAlgorithmParameterException, NoSuchAlgorithmException Returns aCertStore
object that implements the specifiedCertStore
type and is initialized with the specified parameters.This method traverses the list of registered security Providers, starting with the most preferred Provider. A new CertStore object encapsulating the CertStoreSpi implementation from the first Provider that supports the specified type is returned.
Note that the list of registered providers may be retrieved via the
Security.getProviders()
method.The
CertStore
that is returned is initialized with the specifiedCertStoreParameters
. The type of parameters needed may vary between different types ofCertStore
s. Note that the specifiedCertStoreParameters
object is cloned.- Implementation Note:
- The JDK Reference Implementation additionally uses the
jdk.security.provider.preferred
Security
property to determine the preferred provider order for the specified algorithm. This may be different from the order of providers returned bySecurity.getProviders()
. - Parameters:
type
- the name of the requestedCertStore
type. See the CertStore section in the Java Security Standard Algorithm Names Specification for information about standard types.params
- the initialization parameters (may benull
).- Returns:
- a
CertStore
object that implements the specifiedCertStore
type - Throws:
InvalidAlgorithmParameterException
- if the specified initialization parameters are inappropriate for thisCertStore
NoSuchAlgorithmException
- if noProvider
supports aCertStoreSpi
implementation for the specified typeNullPointerException
- iftype
isnull
- See Also:
-
getInstance
public static CertStore getInstance(String type, CertStoreParameters params, String provider) throws InvalidAlgorithmParameterException, NoSuchAlgorithmException, NoSuchProviderException Returns aCertStore
object that implements the specifiedCertStore
type.A new CertStore object encapsulating the CertStoreSpi implementation from the specified provider is returned. The specified provider must be registered in the security provider list.
Note that the list of registered providers may be retrieved via the
Security.getProviders()
method.The
CertStore
that is returned is initialized with the specifiedCertStoreParameters
. The type of parameters needed may vary between different types ofCertStore
s. Note that the specifiedCertStoreParameters
object is cloned.- Parameters:
type
- the requestedCertStore
type. See the CertStore section in the Java Security Standard Algorithm Names Specification for information about standard types.params
- the initialization parameters (may benull
).provider
- the name of the provider.- Returns:
- a
CertStore
object that implements the specified type - Throws:
IllegalArgumentException
- if theprovider
isnull
or emptyInvalidAlgorithmParameterException
- if the specified initialization parameters are inappropriate for thisCertStore
NoSuchAlgorithmException
- if aCertStoreSpi
implementation for the specified type is not available from the specified providerNoSuchProviderException
- if the specified provider is not registered in the security provider listNullPointerException
- iftype
isnull
- See Also:
-
getInstance
public static CertStore getInstance(String type, CertStoreParameters params, Provider provider) throws NoSuchAlgorithmException, InvalidAlgorithmParameterException Returns aCertStore
object that implements the specifiedCertStore
type.A new CertStore object encapsulating the CertStoreSpi implementation from the specified Provider object is returned. Note that the specified Provider object does not have to be registered in the provider list.
The
CertStore
that is returned is initialized with the specifiedCertStoreParameters
. The type of parameters needed may vary between different types ofCertStore
s. Note that the specifiedCertStoreParameters
object is cloned.- Parameters:
type
- the requestedCertStore
type. See the CertStore section in the Java Security Standard Algorithm Names Specification for information about standard types.params
- the initialization parameters (may benull
).provider
- the provider.- Returns:
- a
CertStore
object that implements the specified type - Throws:
IllegalArgumentException
- if theprovider
is nullInvalidAlgorithmParameterException
- if the specified initialization parameters are inappropriate for thisCertStore
NoSuchAlgorithmException
- if aCertStoreSpi
implementation for the specified type is not available from the specified Provider objectNullPointerException
- iftype
isnull
- See Also:
-
getCertStoreParameters
Returns the parameters used to initialize thisCertStore
. Note that theCertStoreParameters
object is cloned before it is returned.- Returns:
- the parameters used to initialize this
CertStore
(may benull
)
-
getType
Returns the type of thisCertStore
.- Returns:
- the type of this
CertStore
-
getProvider
Returns the provider of thisCertStore
.- Returns:
- the provider of this
CertStore
-
getDefaultType
Returns the defaultCertStore
type as specified by thecertstore.type
security property, or the string "LDAP" if no such property exists.The default
CertStore
type can be used by applications that do not want to use a hard-coded type when calling one of thegetInstance
methods, and want to provide a defaultCertStore
type in case a user does not specify its own.The default
CertStore
type can be changed by setting the value of thecertstore.type
security property to the desired type.- Returns:
- the default
CertStore
type as specified by thecertstore.type
security property, or the string "LDAP" if no such property exists. - See Also:
-