Module jpms_dss_document
Package eu.europa.esig.dss.validation

Interface CertificateVerifier

All Known Implementing Classes:
CommonCertificateVerifier
public interface CertificateVerifier
Provides information on the sources to be used in the validation process in the context of a signature.

  • Method Summary

    Modifier and Type
    Method
    Description
    void
    addAdjunctCertSources(eu.europa.esig.dss.spi.x509.CertificateSource... certSources)
    Adds adjunct certificate sources to an existing list of adjunct certificate sources
    void
    addTrustedCertSources(eu.europa.esig.dss.spi.x509.CertificateSource... certSources)
    Adds trusted certificate sources to an existing list of trusted certificate sources
    eu.europa.esig.dss.spi.x509.ListCertificateSource
    getAdjunctCertSources()
    Returns the list of adjunct certificate sources assigned to this verifier.
    eu.europa.esig.dss.spi.x509.aia.AIASource
    getAIASource()
    Gets the AIASource used to load a eu.europa.esig.dss.model.x509.CertificateToken's issuer by defined AIA URI(s) within the token
    eu.europa.esig.dss.alert.StatusAlert
    getAlertOnExpiredSignature()
    This method returns the defined execution behaviour on expired signature (if the signing certificate or its POE(s) has been expired).
    eu.europa.esig.dss.alert.StatusAlert
    getAlertOnInvalidTimestamp()
    This method returns the defined execution behaviour on invalid timestamp.
    eu.europa.esig.dss.alert.StatusAlert
    getAlertOnMissingRevocationData()
    This method returns the defined execution behaviour on missing revocation data.
    eu.europa.esig.dss.alert.StatusAlert
    getAlertOnNoRevocationAfterBestSignatureTime()
    This method returns the defined execution behaviour if no revocation data obtained with an issuance time after the bestSignatureTime
    eu.europa.esig.dss.alert.StatusAlert
    getAlertOnRevokedCertificate()
    This method returns the defined execution behaviour on revoked certificate.
    eu.europa.esig.dss.alert.StatusAlert
    getAlertOnUncoveredPOE()
    This method returns the defined execution behaviour on uncovered POE (timestamp).
    eu.europa.esig.dss.spi.x509.revocation.RevocationSource<eu.europa.esig.dss.model.x509.revocation.crl.CRL>
    getCrlSource()
    Returns the CRL source associated with this verifier.
    eu.europa.esig.dss.enumerations.DigestAlgorithm
    getDefaultDigestAlgorithm()
    This method returns a default Digest Algorithm what will be used for digest calculation
    eu.europa.esig.dss.spi.x509.revocation.RevocationSource<eu.europa.esig.dss.model.x509.revocation.ocsp.OCSP>
    getOcspSource()
    Returns the OCSP source associated with this verifier.
    RevocationDataLoadingStrategyFactory
    getRevocationDataLoadingStrategyFactory()
    Returns a factory used to create revocation data loading strategy associated with this verifier.
    RevocationDataVerifier
    getRevocationDataVerifier()
    Returns a RevocationDataVerifier associated with this verifier.
    eu.europa.esig.dss.spi.x509.ListCertificateSource
    getTrustedCertSources()
    Returns the trusted certificate sources associated with this verifier.
    boolean
    isCheckRevocationForUntrustedChains()
    This method returns true if revocation check is enabled for untrusted certificate chains.
    boolean
    isExtractPOEFromUntrustedChains()
    This method returns whether POEs should be extracted from timestamps coming from untrusted certificate chains.
    boolean
    isRevocationFallback()
    Returns whether revocation data still shall be returned if validation of requested revocation data failed (i.e.
    void
    setAdjunctCertSources(eu.europa.esig.dss.spi.x509.CertificateSource... certSources)
    Sets multiple adjunct certificate sources.
    void
    setAdjunctCertSources(eu.europa.esig.dss.spi.x509.ListCertificateSource adjunctListCertificateSource)
    Sets a list of adjunct certificate sources
    void
    setAIASource(eu.europa.esig.dss.spi.x509.aia.AIASource aiaSource)
    Sets the AIASource used to load a eu.europa.esig.dss.model.x509.CertificateToken's issuer by defined AIA URI(s) within the token
    void
    setAlertOnExpiredSignature(eu.europa.esig.dss.alert.StatusAlert alertOnUncoveredPOE)
    This method allows to change the behavior on expired signature (if the signing certificate or its POE(s) has been expired).
    void
    setAlertOnInvalidTimestamp(eu.europa.esig.dss.alert.StatusAlert alertOnInvalidTimestamp)
    This method allows to change the behavior on invalid timestamp (LT/LTA augmentation).
    void
    setAlertOnMissingRevocationData(eu.europa.esig.dss.alert.StatusAlert alertOnMissingRevocationData)
    This method allows to change the behavior on missing revocation data (LT/LTA augmentation).
    void
    setAlertOnNoRevocationAfterBestSignatureTime(eu.europa.esig.dss.alert.StatusAlert alertOnNoRevocationAfterBestSignatureTime)
    This method allows to change the behavior on revocation data issued after a control time.
    void
    setAlertOnRevokedCertificate(eu.europa.esig.dss.alert.StatusAlert alertOnRevokedCertificate)
    This method allows to change the behavior on revoked certificates (LT/LTA augmentation).
    void
    setAlertOnUncoveredPOE(eu.europa.esig.dss.alert.StatusAlert alertOnUncoveredPOE)
    This method allows to change the behavior on uncovered POE (timestamp).
    void
    setCheckRevocationForUntrustedChains(boolean enable)
    This method allows enabling of revocation checking for untrusted certificate chains.
    void
    setCrlSource(eu.europa.esig.dss.spi.x509.revocation.RevocationSource<eu.europa.esig.dss.model.x509.revocation.crl.CRL> crlSource)
    Defines the source of CRL used by this class
    void
    setDefaultDigestAlgorithm(eu.europa.esig.dss.enumerations.DigestAlgorithm digestAlgorithm)
    This method allows to change the Digest Algorithm that will be used for tokens' digest calculation Default : DigestAlgorithm.SHA256
    void
    setExtractPOEFromUntrustedChains(boolean enable)
    This method allows enabling of POE extraction from timestamps coming from untrusted certificate chains.
    void
    setOcspSource(eu.europa.esig.dss.spi.x509.revocation.RevocationSource<eu.europa.esig.dss.model.x509.revocation.ocsp.OCSP> ocspSource)
    Defines the source of OCSP used by this class
    void
    setRevocationDataLoadingStrategyFactory(RevocationDataLoadingStrategyFactory revocationDataLoadingStrategyFactory)
    Creates a strategy used to fetch OCSP or CRL for certificate validation.
    void
    setRevocationDataVerifier(RevocationDataVerifier revocationDataVerifier)
    Sets RevocationDataVerifier used to validate acceptance of the retrieved (from offline or online sources) revocation data.
    void
    setRevocationFallback(boolean revocationFallback)
    Sets whether a revocation data still have to be returned to the validation process, in case validation of obtained revocation data has failed (i.e.
    void
    setTrustedCertSources(eu.europa.esig.dss.spi.x509.CertificateSource... certSources)
    Sets multiple trusted certificate sources.
    void
    setTrustedCertSources(eu.europa.esig.dss.spi.x509.ListCertificateSource trustedListCertificateSource)
    Sets a list of trusted certificate sources

  • Method Details

    • getCrlSource

      eu.europa.esig.dss.spi.x509.revocation.RevocationSource<eu.europa.esig.dss.model.x509.revocation.crl.CRL> getCrlSource()
      Returns the CRL source associated with this verifier.
      Returns:
      the used CRL source for external access (web, filesystem, cached,...)

    • setCrlSource

      void setCrlSource(eu.europa.esig.dss.spi.x509.revocation.RevocationSource<eu.europa.esig.dss.model.x509.revocation.crl.CRL> crlSource)
      Defines the source of CRL used by this class
      Parameters:
      crlSource - the CRL source to set for external access (web, filesystem, cached,...)

    • getOcspSource

      eu.europa.esig.dss.spi.x509.revocation.RevocationSource<eu.europa.esig.dss.model.x509.revocation.ocsp.OCSP> getOcspSource()
      Returns the OCSP source associated with this verifier.
      Returns:
      the used OCSP source for external access (web, filesystem, cached,...)

    • setOcspSource

      void setOcspSource(eu.europa.esig.dss.spi.x509.revocation.RevocationSource<eu.europa.esig.dss.model.x509.revocation.ocsp.OCSP> ocspSource)
      Defines the source of OCSP used by this class
      Parameters:
      ocspSource - the OCSP source to set for external access (web, filesystem, cached,...)

    • getRevocationDataLoadingStrategyFactory

      RevocationDataLoadingStrategyFactory getRevocationDataLoadingStrategyFactory()
      Returns a factory used to create revocation data loading strategy associated with this verifier.
      Returns:
      creates the defined strategy to fetch OCSP or CRL for certificate validation

    • setRevocationDataLoadingStrategyFactory

      void setRevocationDataLoadingStrategyFactory(RevocationDataLoadingStrategyFactory revocationDataLoadingStrategyFactory)
      Creates a strategy used to fetch OCSP or CRL for certificate validation. Default: OCSPFirstRevocationDataLoadingStrategyFactory used to create a strategy to extract OCSP token first and CRL after
      Parameters:
      revocationDataLoadingStrategyFactory - RevocationDataLoadingStrategyFactory

    • getRevocationDataVerifier

      RevocationDataVerifier getRevocationDataVerifier()
      Returns a RevocationDataVerifier associated with this verifier.
      Returns:
      RevocationDataVerifier

    • setRevocationDataVerifier

      void setRevocationDataVerifier(RevocationDataVerifier revocationDataVerifier)
      Sets RevocationDataVerifier used to validate acceptance of the retrieved (from offline or online sources) revocation data. This class is used to verify revocation data extracted from the validating document itself, as well the revocation data retrieved from remote sources during the validation process.

      NOTE: It is not recommended to use the same instance of RevocationDataVerifier within different CertificateVerifiers, as it may lead to concurrency issues during the execution in multi-threaded environments. Please use a new RevocationDataVerifier per each CertificateVerifier.

      Parameters:
      revocationDataVerifier - RevocationDataVerifier

    • isRevocationFallback

      boolean isRevocationFallback()
      Returns whether revocation data still shall be returned if validation of requested revocation data failed (i.e. both for OCSP and CRL).
      Returns:
      revocation fallback

    • setRevocationFallback

      void setRevocationFallback(boolean revocationFallback)
      Sets whether a revocation data still have to be returned to the validation process, in case validation of obtained revocation data has failed (i.e. both for OCSP and CRL). Default: FALSE (invalid revocation data not returned)

      NOTE: Revocation fallback is enforced to TRUE (return even invalid revocation data, when no valid found) on signature validation

      Parameters:
      revocationFallback - whether invalid revocation data shall be returned, when not valid revocation available

    • getTrustedCertSources

      eu.europa.esig.dss.spi.x509.ListCertificateSource getTrustedCertSources()
      Returns the trusted certificate sources associated with this verifier. These sources are used to identify the trusted anchors.
      Returns:
      the certificate sources which contain trusted certificates

    • setTrustedCertSources

      void setTrustedCertSources(eu.europa.esig.dss.spi.x509.CertificateSource... certSources)
      Sets multiple trusted certificate sources.
      Parameters:
      certSources - The certificate sources with known trusted certificates

    • addTrustedCertSources

      void addTrustedCertSources(eu.europa.esig.dss.spi.x509.CertificateSource... certSources)
      Adds trusted certificate sources to an existing list of trusted certificate sources
      Parameters:
      certSources - The certificate sources with known trusted certificates

    • setTrustedCertSources

      void setTrustedCertSources(eu.europa.esig.dss.spi.x509.ListCertificateSource trustedListCertificateSource)
      Sets a list of trusted certificate sources
      Parameters:
      trustedListCertificateSource - ListCertificateSource of trusted cert sources

    • getAdjunctCertSources

      eu.europa.esig.dss.spi.x509.ListCertificateSource getAdjunctCertSources()
      Returns the list of adjunct certificate sources assigned to this verifier.
      Returns:
      the certificate source which contains additional certificate (missing CA,...)

    • setAdjunctCertSources

      void setAdjunctCertSources(eu.europa.esig.dss.spi.x509.CertificateSource... certSources)
      Sets multiple adjunct certificate sources.
      Parameters:
      certSources - the certificate sources with additional and/or missing certificates

    • addAdjunctCertSources

      void addAdjunctCertSources(eu.europa.esig.dss.spi.x509.CertificateSource... certSources)
      Adds adjunct certificate sources to an existing list of adjunct certificate sources
      Parameters:
      certSources - The certificate sources with additional certificates

    • setAdjunctCertSources

      void setAdjunctCertSources(eu.europa.esig.dss.spi.x509.ListCertificateSource adjunctListCertificateSource)
      Sets a list of adjunct certificate sources
      Parameters:
      adjunctListCertificateSource - ListCertificateSource of adjunct cert sources

    • getAIASource

      eu.europa.esig.dss.spi.x509.aia.AIASource getAIASource()
      Gets the AIASource used to load a eu.europa.esig.dss.model.x509.CertificateToken's issuer by defined AIA URI(s) within the token
      Returns:
      aiaSource AIASource

    • setAIASource

      void setAIASource(eu.europa.esig.dss.spi.x509.aia.AIASource aiaSource)
      Sets the AIASource used to load a eu.europa.esig.dss.model.x509.CertificateToken's issuer by defined AIA URI(s) within the token
      Parameters:
      aiaSource - AIASource

    • setDefaultDigestAlgorithm

      void setDefaultDigestAlgorithm(eu.europa.esig.dss.enumerations.DigestAlgorithm digestAlgorithm)
      This method allows to change the Digest Algorithm that will be used for tokens' digest calculation Default : DigestAlgorithm.SHA256
      Parameters:
      digestAlgorithm - DigestAlgorithm to use

    • getDefaultDigestAlgorithm

      eu.europa.esig.dss.enumerations.DigestAlgorithm getDefaultDigestAlgorithm()
      This method returns a default Digest Algorithm what will be used for digest calculation
      Returns:
      DigestAlgorithm

    • setAlertOnInvalidTimestamp

      void setAlertOnInvalidTimestamp(eu.europa.esig.dss.alert.StatusAlert alertOnInvalidTimestamp)
      This method allows to change the behavior on invalid timestamp (LT/LTA augmentation). Default : ExceptionOnStatusAlert - throw an exception.
      Parameters:
      alertOnInvalidTimestamp - defines a behaviour in case of invalid timestamp

    • getAlertOnInvalidTimestamp

      eu.europa.esig.dss.alert.StatusAlert getAlertOnInvalidTimestamp()
      This method returns the defined execution behaviour on invalid timestamp.
      Returns:
      StatusAlert to be processed in case of an invalid timestamp

    • setAlertOnMissingRevocationData

      void setAlertOnMissingRevocationData(eu.europa.esig.dss.alert.StatusAlert alertOnMissingRevocationData)
      This method allows to change the behavior on missing revocation data (LT/LTA augmentation). Default : ExceptionOnStatusAlert - throw an exception.
      Parameters:
      alertOnMissingRevocationData - defines a behaviour in case of missing revocation data

    • getAlertOnMissingRevocationData

      eu.europa.esig.dss.alert.StatusAlert getAlertOnMissingRevocationData()
      This method returns the defined execution behaviour on missing revocation data.
      Returns:
      StatusAlert to be processed in case of missing revocation data

    • setAlertOnRevokedCertificate

      void setAlertOnRevokedCertificate(eu.europa.esig.dss.alert.StatusAlert alertOnRevokedCertificate)
      This method allows to change the behavior on revoked certificates (LT/LTA augmentation). Default : ExceptionOnStatusAlert - throw an exception.
      Parameters:
      alertOnRevokedCertificate - defines a behaviour in case of revoked certificate

    • getAlertOnRevokedCertificate

      eu.europa.esig.dss.alert.StatusAlert getAlertOnRevokedCertificate()
      This method returns the defined execution behaviour on revoked certificate.
      Returns:
      StatusAlert to be processed in case of revoked certificate

    • setAlertOnNoRevocationAfterBestSignatureTime

      void setAlertOnNoRevocationAfterBestSignatureTime(eu.europa.esig.dss.alert.StatusAlert alertOnNoRevocationAfterBestSignatureTime)
      This method allows to change the behavior on revocation data issued after a control time. Default : LogOnStatusAlert - log a warning.
      Parameters:
      alertOnNoRevocationAfterBestSignatureTime - defines a behaviour in case of no revocation data issued after the bestSignatureTime

    • getAlertOnNoRevocationAfterBestSignatureTime

      eu.europa.esig.dss.alert.StatusAlert getAlertOnNoRevocationAfterBestSignatureTime()
      This method returns the defined execution behaviour if no revocation data obtained with an issuance time after the bestSignatureTime
      Returns:
      StatusAlert to be processed in case of no revocation data after best signature time

    • setAlertOnUncoveredPOE

      void setAlertOnUncoveredPOE(eu.europa.esig.dss.alert.StatusAlert alertOnUncoveredPOE)
      This method allows to change the behavior on uncovered POE (timestamp). Default : LogOnStatusAlert - log a warning.
      Parameters:
      alertOnUncoveredPOE - defines a behaviour in case of uncovered POE

    • getAlertOnUncoveredPOE

      eu.europa.esig.dss.alert.StatusAlert getAlertOnUncoveredPOE()
      This method returns the defined execution behaviour on uncovered POE (timestamp).
      Returns:
      StatusAlert to be processed in case of uncovered POE

    • setAlertOnExpiredSignature

      void setAlertOnExpiredSignature(eu.europa.esig.dss.alert.StatusAlert alertOnUncoveredPOE)
      This method allows to change the behavior on expired signature (if the signing certificate or its POE(s) has been expired). Default : ExceptionOnStatusAlert - throw an exception.
      Parameters:
      alertOnUncoveredPOE - defines a behaviour in case of an expired signature

    • getAlertOnExpiredSignature

      eu.europa.esig.dss.alert.StatusAlert getAlertOnExpiredSignature()
      This method returns the defined execution behaviour on expired signature (if the signing certificate or its POE(s) has been expired).
      Returns:
      StatusAlert to be processed in case of uncovered POE

    • setCheckRevocationForUntrustedChains

      void setCheckRevocationForUntrustedChains(boolean enable)
      This method allows enabling of revocation checking for untrusted certificate chains. Default : FALSE (revocation data is not checked for untrusted certificate chains)
      Parameters:
      enable - true if revocation checking is allowed for untrusted certificate chains

    • isCheckRevocationForUntrustedChains

      boolean isCheckRevocationForUntrustedChains()
      This method returns true if revocation check is enabled for untrusted certificate chains.
      Returns:
      true if external revocation check is done for untrusted certificate chains

    • setExtractPOEFromUntrustedChains

      void setExtractPOEFromUntrustedChains(boolean enable)
      This method allows enabling of POE extraction from timestamps coming from untrusted certificate chains. Default : FALSE (timestamps created with untrusted certificate chains are not considered as POE)
      Parameters:
      enable - true if POE extraction is allowed for timestamps from untrusted certificate chains

    • isExtractPOEFromUntrustedChains

      boolean isExtractPOEFromUntrustedChains()
      This method returns whether POEs should be extracted from timestamps coming from untrusted certificate chains.
      Returns:
      true if POEs should be extracted from timestamp with untrusted certificate chains