Module jpms_dss_document
Package eu.europa.esig.dss.validation

Class SignatureValidationContext

java.lang.Object
eu.europa.esig.dss.validation.SignatureValidationContext
All Implemented Interfaces:
ValidationContext
public class SignatureValidationContext extends Object implements ValidationContext
During the validation of a signature, the software retrieves different X509 artifacts like Certificate, CRL and OCSP Response. The SignatureValidationContext is a "cache" for one validation request that contains every object retrieved so far.

  • Field Details

    • currentTime

      protected Date currentTime
      This is the time at what the validation is carried out. It is used only for test purpose.

  • Constructor Details

    • SignatureValidationContext

      public SignatureValidationContext()
      Default constructor instantiating object with null or empty values and current time

  • Method Details

    • initialize

      public void initialize(CertificateVerifier certificateVerifier)
      Description copied from interface: ValidationContext
      This method initializes the ValidationContext by retrieving the relevant data from certificateVerifier
      Specified by:
      initialize in interface ValidationContext
      Parameters:
      certificateVerifier - The certificate verifier (eg: using the TSL as list of trusted certificates).

    • addSignatureForVerification

      public void addSignatureForVerification(AdvancedSignature signature)
      Description copied from interface: ValidationContext
      Adds a new signature to collect the information to verify.
      Specified by:
      addSignatureForVerification in interface ValidationContext
      Parameters:
      signature - AdvancedSignature to extract data to be verified

    • addDocumentCertificateSource

      public void addDocumentCertificateSource(eu.europa.esig.dss.spi.x509.CertificateSource certificateSource)
      Description copied from interface: ValidationContext
      Adds an extracted certificate source to the used list of sources
      Specified by:
      addDocumentCertificateSource in interface ValidationContext
      Parameters:
      certificateSource - CertificateSource

    • addDocumentCertificateSource

      public void addDocumentCertificateSource(eu.europa.esig.dss.spi.x509.ListCertificateSource listCertificateSource)
      Description copied from interface: ValidationContext
      Adds a list certificate source to the used list of sources
      Specified by:
      addDocumentCertificateSource in interface ValidationContext
      Parameters:
      listCertificateSource - ListCertificateSource

    • addDocumentCRLSource

      public void addDocumentCRLSource(eu.europa.esig.dss.spi.x509.revocation.OfflineRevocationSource<eu.europa.esig.dss.model.x509.revocation.crl.CRL> crlSource)
      Description copied from interface: ValidationContext
      Adds an extracted CRL source to the used list of sources
      Specified by:
      addDocumentCRLSource in interface ValidationContext
      Parameters:
      crlSource - OfflineRevocationSource for CRL

    • addDocumentCRLSource

      public void addDocumentCRLSource(eu.europa.esig.dss.spi.x509.revocation.ListRevocationSource<eu.europa.esig.dss.model.x509.revocation.crl.CRL> crlSource)
      Description copied from interface: ValidationContext
      Adds a list CRL source to the used list of sources
      Specified by:
      addDocumentCRLSource in interface ValidationContext
      Parameters:
      crlSource - ListRevocationSource for CRL

    • addDocumentOCSPSource

      public void addDocumentOCSPSource(eu.europa.esig.dss.spi.x509.revocation.OfflineRevocationSource<eu.europa.esig.dss.model.x509.revocation.ocsp.OCSP> ocspSource)
      Description copied from interface: ValidationContext
      Adds an extracted OCSP source to the used list of sources
      Specified by:
      addDocumentOCSPSource in interface ValidationContext
      Parameters:
      ocspSource - OfflineRevocationSource for OCSP

    • addDocumentOCSPSource

      public void addDocumentOCSPSource(eu.europa.esig.dss.spi.x509.revocation.ListRevocationSource<eu.europa.esig.dss.model.x509.revocation.ocsp.OCSP> ocspSource)
      Description copied from interface: ValidationContext
      Adds a listd OCSP source to the used list of sources
      Specified by:
      addDocumentOCSPSource in interface ValidationContext
      Parameters:
      ocspSource - ListRevocationSource for OCSP

    • getCurrentTime

      public Date getCurrentTime()
      Description copied from interface: ValidationContext
      Gets the current validation time.
      Specified by:
      getCurrentTime in interface ValidationContext
      Returns:
      Date

    • setCurrentTime

      public void setCurrentTime(Date currentTime)
      Description copied from interface: ValidationContext
      This function sets the validation time.
      Specified by:
      setCurrentTime in interface ValidationContext
      Parameters:
      currentTime - the current Date

    • getAllCertificateSources

      public eu.europa.esig.dss.spi.x509.ListCertificateSource getAllCertificateSources()
      Description copied from interface: ValidationContext
      Returns a list of all CertificateSources used during the validation process. It is represented by sources extracted from the provided document (e.g. signatures, timestamps) as well as the sources obtained during the validation process (e.g. AIA, OCSP).
      Specified by:
      getAllCertificateSources in interface ValidationContext
      Returns:
      ListCertificateSource

    • getDocumentCertificateSource

      public eu.europa.esig.dss.spi.x509.ListCertificateSource getDocumentCertificateSource()
      Description copied from interface: ValidationContext
      Returns a list of all CertificateSources extracted from a validating document (signature(s), timestamp(s))
      Specified by:
      getDocumentCertificateSource in interface ValidationContext
      Returns:
      ListCertificateSource

    • getDocumentCRLSource

      public eu.europa.esig.dss.spi.x509.revocation.ListRevocationSource<eu.europa.esig.dss.model.x509.revocation.crl.CRL> getDocumentCRLSource()
      Description copied from interface: ValidationContext
      Returns a list of all CRL OfflineRevocationSources extracted from a validating document
      Specified by:
      getDocumentCRLSource in interface ValidationContext
      Returns:
      ListRevocationSource

    • getDocumentOCSPSource

      public eu.europa.esig.dss.spi.x509.revocation.ListRevocationSource<eu.europa.esig.dss.model.x509.revocation.ocsp.OCSP> getDocumentOCSPSource()
      Description copied from interface: ValidationContext
      Returns a list of all OCSP OfflineRevocationSources extracted from a validating document
      Specified by:
      getDocumentOCSPSource in interface ValidationContext
      Returns:
      ListRevocationSource

    • addRevocationTokenForVerification

      public void addRevocationTokenForVerification(eu.europa.esig.dss.spi.x509.revocation.RevocationToken<?> revocationToken)
      Description copied from interface: ValidationContext
      Adds a new revocation token to the list of tokens to verify. If the revocation token has already been added then it is ignored.
      Specified by:
      addRevocationTokenForVerification in interface ValidationContext
      Parameters:
      revocationToken - an instance of RevocationToken revocation tokens to verify

    • addCertificateTokenForVerification

      public void addCertificateTokenForVerification(eu.europa.esig.dss.model.x509.CertificateToken certificateToken)
      Description copied from interface: ValidationContext
      Adds a new certificate token to the list of tokens to verify. If the certificate token has already been added then it is ignored.
      Specified by:
      addCertificateTokenForVerification in interface ValidationContext
      Parameters:
      certificateToken - CertificateToken certificate token to verify

    • addTimestampTokenForVerification

      public void addTimestampTokenForVerification(eu.europa.esig.dss.spi.x509.tsp.TimestampToken timestampToken)
      Description copied from interface: ValidationContext
      Adds a new timestamp token to the list of tokens to verify. If the timestamp token has already been added then it is ignored.
      Specified by:
      addTimestampTokenForVerification in interface ValidationContext
      Parameters:
      timestampToken - TimestampToken timestamp token to verify

    • isTimestampValid

      protected boolean isTimestampValid(eu.europa.esig.dss.spi.x509.tsp.TimestampToken timestampToken)
      This method verifies whether a timestampToken is valid and can be used as a valid POE for covered objects
      Parameters:
      timestampToken - TimestampToken to be checked
      Returns:
      TRUE if the timestamp is valid, FALSE otherwise

    • addEvidenceRecordForVerification

      public void addEvidenceRecordForVerification(EvidenceRecord evidenceRecord)
      Description copied from interface: ValidationContext
      Adds Evidence Record's content to proceed with validation
      Specified by:
      addEvidenceRecordForVerification in interface ValidationContext
      Parameters:
      evidenceRecord - EvidenceRecord to add content from

    • validate

      public void validate()
      Description copied from interface: ValidationContext
      Carries out the validation process in recursive manner for not yet checked tokens.
      Specified by:
      validate in interface ValidationContext

    • checkAllRequiredRevocationDataPresent

      public boolean checkAllRequiredRevocationDataPresent()
      Description copied from interface: ValidationContext
      This method allows to verify if all processed certificates have a revocation data Additionally, an alert can be handled CertificateVerifier.setAlertOnMissingRevocationData(eu.europa.esig.dss.alert.StatusAlert)
      Specified by:
      checkAllRequiredRevocationDataPresent in interface ValidationContext
      Returns:
      true if all needed revocation data are present

    • checkAllPOECoveredByRevocationData

      public boolean checkAllPOECoveredByRevocationData()
      Description copied from interface: ValidationContext
      This method allows to verify if all POE (timestamp tokens) are covered by a revocation data Additionally, an alert can be handled CertificateVerifier.setAlertOnUncoveredPOE(eu.europa.esig.dss.alert.StatusAlert)
      Specified by:
      checkAllPOECoveredByRevocationData in interface ValidationContext
      Returns:
      true if all timestamps are covered by a usable revocation data

    • checkAllTimestampsValid

      public boolean checkAllTimestampsValid()
      Description copied from interface: ValidationContext
      This method allows to verify if all processed timestamps are valid and intact. Additionally, an alert can be handled CertificateVerifier.setAlertOnInvalidTimestamp(eu.europa.esig.dss.alert.StatusAlert)
      Specified by:
      checkAllTimestampsValid in interface ValidationContext
      Returns:
      true if all timestamps are valid

    • checkCertificateNotRevoked

      public boolean checkCertificateNotRevoked(eu.europa.esig.dss.model.x509.CertificateToken certificateToken)
      Description copied from interface: ValidationContext
      This method allows to verify if the certificate is not revoked Additionally, an alert can be handled CertificateVerifier.setAlertOnRevokedCertificate(eu.europa.esig.dss.alert.StatusAlert)
      Specified by:
      checkCertificateNotRevoked in interface ValidationContext
      Parameters:
      certificateToken - CertificateToken certificate to be checked
      Returns:
      true if all certificates are valid

    • checkCertificatesNotRevoked

      public boolean checkCertificatesNotRevoked(AdvancedSignature signature)
      Description copied from interface: ValidationContext
      This method allows to verify if signature certificates are not revoked Additionally, an alert can be handled CertificateVerifier.setAlertOnRevokedCertificate(eu.europa.esig.dss.alert.StatusAlert)
      Specified by:
      checkCertificatesNotRevoked in interface ValidationContext
      Parameters:
      signature - AdvancedSignature signature to be checked
      Returns:
      true if all certificates are valid

    • checkAtLeastOneRevocationDataPresentAfterBestSignatureTime

      public boolean checkAtLeastOneRevocationDataPresentAfterBestSignatureTime(AdvancedSignature signature)
      Description copied from interface: ValidationContext
      This method allows to verify if there is at least one revocation data present after the earliest available timestamp token producing time Additionally, an alert can be handled CertificateVerifier.setAlertOnNoRevocationAfterBestSignatureTime(eu.europa.esig.dss.alert.StatusAlert)
      Specified by:
      checkAtLeastOneRevocationDataPresentAfterBestSignatureTime in interface ValidationContext
      Parameters:
      signature - AdvancedSignature signature to be checked
      Returns:
      true if the signing certificate is covered with a updated revocation data (after signature-timestamp production time)

    • checkSignatureNotExpired

      public boolean checkSignatureNotExpired(AdvancedSignature signature)
      Description copied from interface: ValidationContext
      This method verifies if the signing certificate has not been expired yet or has a still valid timestamp Additionally, an alert can be handled CertificateVerifier.setAlertOnExpiredSignature(eu.europa.esig.dss.alert.StatusAlert)
      Specified by:
      checkSignatureNotExpired in interface ValidationContext
      Parameters:
      signature - AdvancedSignature signature to be verified
      Returns:
      true if the signing certificate or its POE(s) not yet expired, false otherwise

    • getProcessedCertificates

      public Set<eu.europa.esig.dss.model.x509.CertificateToken> getProcessedCertificates()
      Description copied from interface: ValidationContext
      Returns a read only list of all certificates used in the process of the validation of all signatures from the given document. This list includes the certificate to check, certification chain certificates, OCSP response certificate...
      Specified by:
      getProcessedCertificates in interface ValidationContext
      Returns:
      The list of CertificateToken(s)

    • getProcessedRevocations

      public Set<eu.europa.esig.dss.spi.x509.revocation.RevocationToken> getProcessedRevocations()
      Description copied from interface: ValidationContext
      Returns a read only list of all revocations used in the process of the validation of all signatures from the given document.
      Specified by:
      getProcessedRevocations in interface ValidationContext
      Returns:
      The list of RevocationToken(s)

    • getProcessedTimestamps

      public Set<eu.europa.esig.dss.spi.x509.tsp.TimestampToken> getProcessedTimestamps()
      Description copied from interface: ValidationContext
      Returns a read only list of all timestamps processed during the validation of all signatures from the given document.
      Specified by:
      getProcessedTimestamps in interface ValidationContext
      Returns:
      The list of TimestampTokens(s)

    • getValidationData

      public ValidationData getValidationData(AdvancedSignature signature)
      Description copied from interface: ValidationContext
      Returns a validation data for the given signature's certificate chain
      Specified by:
      getValidationData in interface ValidationContext
      Parameters:
      signature - AdvancedSignature to extract validation data for
      Returns:
      ValidationData

    • getValidationData

      public ValidationData getValidationData(eu.europa.esig.dss.spi.x509.tsp.TimestampToken timestampToken)
      Description copied from interface: ValidationContext
      Returns a validation data for the given timestampToken's certificate chain
      Specified by:
      getValidationData in interface ValidationContext
      Parameters:
      timestampToken - TimestampToken to extract validation data for
      Returns:
      ValidationData