Download - Svetlin Nakov

}
PublicKey publicKey = aCertificate.getPublicKey();
boolean valid = verifyDocumentSignature(aDocument, publicKey, aSignature);
return valid;
/**
* Verifies a certificate. Checks its validity period and tries to find a
* trusted certificate from given list of trusted certificates that is directly
* signed given certificate. The certificate is valid if no exception is thrown.
*
* @param aCertificate the certificate to be verified.
* @param aTrustedCertificates a list of trusted certificates to be used in
* the verification process.
*
* @throws CertificateExpiredException if the certificate validity period is
* expired.
* @throws CertificateNotYetValidException if the certificate validity period is
* not yet started.
* @throws CertificateValidationException if the certificate is invalid (can not
* be validated using the given set of trusted certificates.
*/
public static void verifyCertificate(X509Certificate aCertificate,
X509Certificate[] aTrustedCertificates)
throws GeneralSecurityException {
// First check certificate validity period
aCertificate.checkValidity();
// Check if the certificate is signed by some of the given trusted certs
for (int i=0; i it is invalid
throw new CertificateValidationException(
"Can not find trusted parent certificate.");
/**
* Verifies certification chain using "PKIX" algorithm, defined in RFC-3280.
* It is considered that the given certification chain start with the target
* certificate and finish with some root CA certificate. The certification
* chain is valid if no exception is thrown.
*
* @param aCertChain the certification chain to be verified.
* @param aTrustedCACertificates a list of most trusted root CA certificates.
* @throws CertPathValidatorException if the certification chain is invalid.
*/
public static void verifyCertificationChain(CertPath aCertChain,
X509Certificate[] aTrustedCACertificates)
throws GeneralSecurityException {
int chainLength = aCertChain.getCertificates().size();
if (chainLength < 2) {
throw new CertPathValidatorException("The certification chain is too " +
"short. It should consist of at least 2 certiicates.");
}
129