JKSTrustStore implements PKITrustStore { public boolean isTrusted(X509Certificate certificate, Store certStore) throws CryptoException { try { if (certificate == null) { throw new CryptoException("Invalid input parameter. Certificate can not be null"); } LOGGER.info("Checking if certificate with subjectDN={} is trusted", certificate.getSubjectDN()); Store certificateStore = certStore; if (certificateStore == null) { certificateStore = new JcaCertStore(new ArrayList()); } checkConstraints(certSelector, certificate); X509CertSelector selector = new X509CertSelector(); selector.setCertificate(certificate); CertStore pkixParamsCertStore = new JcaCertStoreBuilder().addCertificates(certificateStore).build(); PKIXBuilderParameters buildParams = new PKIXBuilderParameters(keyStore, selector); buildParams.addCertStore(pkixParamsCertStore); buildParams.setRevocationEnabled(false); CertPathBuilder builder = CertPathBuilder.getInstance(ALGORITHM_PKIX); PKIXCertPathBuilderResult result = (PKIXCertPathBuilderResult) builder.build(buildParams); CertPath certPath = result.getCertPath(); PKIXParameters params = new PKIXParameters(keyStore); params.setRevocationEnabled(false); CertPathValidator validator = CertPathValidator.getInstance(ALGORITHM_PKIX); validator.validate(certPath, params); return true; } catch (CertPathValidatorException e) { LOGGER.debug("Cert path validation failed", e); return false; } catch (CertPathBuilderException e) { LOGGER.debug("Cert path building failed", e); return false; } catch (GeneralSecurityException e) { throw new CryptoException("General security error occurred. " + e.getMessage(), e); } } JKSTrustStore(KeyStore keyStore, CertSelector certSelector);  JKSTrustStore(String keyStorePath, char[] password, CertSelector certSelector);  JKSTrustStore(String keyStore, CertSelector certSelector); boolean isTrusted(X509Certificate certificate, Store certStore);  }
@Test(expectedExceptions = InvalidCertificateException.class, expectedExceptionsMessageRegExp = "Invalid certificated subject with subjectDN EMAILADDRESS=publications@guardtime.com.*") public void testCheckIfCertificateIsTrustedWithInvalidEmail_ThrowsInvalidCertificateSubjectException() throws Exception { JKSTrustStore trustStore = new JKSTrustStore("truststore.jks", null, new X509CertificateSubjectRdnSelector("E=invalid_publications@guardtime.com")); Assert.assertTrue(trustStore.isTrusted((X509Certificate) X509CertUtil.toCert(Util.toByteArray(TestUtil.load("server.crt"))), null)); }
@Test public void testCheckUntrustedCertificate_Ok() throws Exception { JKSTrustStore trustStore = new JKSTrustStore("truststore.jks", null); Assert.assertFalse(trustStore.isTrusted((X509Certificate) X509CertUtil.toCert(Util.toByteArray(TestUtil.load("cert.crt"))), null)); }
@Test(expectedExceptions = CryptoException.class, expectedExceptionsMessageRegExp = "General security error occurred. Uninitialized keystore") public void testUseUninitializedKeyStore_ThrowsCryptoException() throws Exception { JKSTrustStore trustStore = new JKSTrustStore(KeyStore.getInstance("JKS"), null); trustStore.isTrusted((X509Certificate) X509CertUtil.toCert(Util.toByteArray(TestUtil.load("server.crt"))), null); }
@Test(expectedExceptions = CryptoException.class, expectedExceptionsMessageRegExp = "Invalid input parameter. Certificate can not be null") public void testCheckIfCertificateIsTrustedUsingInvalidInput_ThrowsCryptoException() throws Exception { JKSTrustStore trustStore = new JKSTrustStore("truststore.jks", null); trustStore.isTrusted(null, null); }
@Test public void testCheckIfCertificateIsTrusted_Ok() throws Exception { JKSTrustStore trustStore = new JKSTrustStore("truststore.jks", null); Assert.assertTrue(trustStore.isTrusted((X509Certificate) X509CertUtil.toCert(Util.toByteArray(TestUtil.load("server.crt"))), null)); }
@Test public void testCheckIfCertificateIsTrustedWithEmail_Ok() throws Exception { JKSTrustStore trustStore = new JKSTrustStore("truststore.jks", null, new X509CertificateSubjectRdnSelector("E=publications@guardtime.com")); Assert.assertTrue(trustStore.isTrusted((X509Certificate) X509CertUtil.toCert(Util.toByteArray(TestUtil.load("server.crt"))), null)); }