Package eu.europa.esig.dss.validation

Class SignatureValidationContext

java.lang.Object

eu.europa.esig.dss.validation.SignatureValidationContext

All Implemented Interfaces:

ValidationContext

public class SignatureValidationContext
extends Object
implements ValidationContext

During the validation of a signature, the software retrieves different X509 artifacts like Certificate, CRL and OCSP Response. The SignatureValidationContext is a "cache" for one validation request that contains every object retrieved so far.

Field Summary

Fields

Modifier and Type	Field	Description
protected Date	currentTime	This is the time at what the validation is carried out.

Constructor Summary

Constructors

Constructor	Description
SignatureValidationContext()	Default constructor instantiating object with null or empty values and current time

Method Summary

Modifier and Type	Method	Description
void	addCertificateTokenForVerification(CertificateToken certificateToken)	Adds a new certificate token to the list of tokens to verify.
void	addDocumentCertificateSource(CertificateSource certificateSource)	Adds an extracted certificate source to the used list of sources
void	addDocumentCertificateSource(ListCertificateSource listCertificateSource)	Adds a list certificate source to the used list of sources
void	addDocumentCRLSource(OfflineRevocationSource<CRL> crlSource)	Adds an extracted CRL source to the used list of sources
void	addDocumentCRLSource(ListRevocationSource<CRL> crlSource)	Adds a list CRL source to the used list of sources
void	addDocumentOCSPSource(OfflineRevocationSource<OCSP> ocspSource)	Adds an extracted OCSP source to the used list of sources
void	addDocumentOCSPSource(ListRevocationSource<OCSP> ocspSource)	Adds a listd OCSP source to the used list of sources
void	addRevocationTokenForVerification(RevocationToken<?> revocationToken)	Adds a new revocation token to the list of tokens to verify.
void	addSignatureForVerification(AdvancedSignature signature)	Adds a new signature to collect the information to verify.
void	addTimestampTokenForVerification(TimestampToken timestampToken)	Adds a new timestamp token to the list of tokens to verify.
boolean	checkAllCertificatesValid()	Deprecated.
boolean	checkAllPOECoveredByRevocationData()	This method allows to verify if all POE (timestamp tokens) are covered by a revocation data Additionally, an alert can be handled CertificateVerifier.setAlertOnUncoveredPOE(eu.europa.esig.dss.alert.StatusAlert)
boolean	checkAllRequiredRevocationDataPresent()	This method allows to verify if all processed certificates have a revocation data Additionally, an alert can be handled CertificateVerifier.setAlertOnMissingRevocationData(eu.europa.esig.dss.alert.StatusAlert)
boolean	checkAllTimestampsValid()	This method allows to verify if all processed timestamps are valid and intact.
boolean	checkAtLeastOneRevocationDataPresentAfterBestSignatureTime(AdvancedSignature signature)	This method allows to verify if there is at least one revocation data present after the earliest available timestamp token producing time Additionally, an alert can be handled CertificateVerifier.setAlertOnNoRevocationAfterBestSignatureTime(eu.europa.esig.dss.alert.StatusAlert)
boolean	checkCertificateNotRevoked(CertificateToken certificateToken)	This method allows to verify if the certificate is not revoked Additionally, an alert can be handled CertificateVerifier.setAlertOnRevokedCertificate(eu.europa.esig.dss.alert.StatusAlert)
boolean	checkCertificatesNotRevoked(AdvancedSignature signature)	This method allows to verify if signature certificates are not revoked Additionally, an alert can be handled CertificateVerifier.setAlertOnRevokedCertificate(eu.europa.esig.dss.alert.StatusAlert)
boolean	checkSignatureNotExpired(AdvancedSignature signature)	This method verifies if the signing certificate has not been expired yet or has a still valid timestamp Additionally, an alert can be handled CertificateVerifier.setAlertOnExpiredSignature(eu.europa.esig.dss.alert.StatusAlert)
ListCertificateSource	getAllCertificateSources()	Returns a list of all CertificateSources used during the validation process.
Date	getCurrentTime()	Gets the current validation time.
ListCertificateSource	getDocumentCertificateSource()	Returns a list of all CertificateSources extracted from a validating document (signature(s), timestamp(s))
ListRevocationSource<CRL>	getDocumentCRLSource()	Returns a list of all CRL OfflineRevocationSources extracted from a validating document
ListRevocationSource<OCSP>	getDocumentOCSPSource()	Returns a list of all OCSP OfflineRevocationSources extracted from a validating document
Set<CertificateToken>	getProcessedCertificates()	Returns a read only list of all certificates used in the process of the validation of all signatures from the given document.
Set<RevocationToken>	getProcessedRevocations()	Returns a read only list of all revocations used in the process of the validation of all signatures from the given document.
Set<TimestampToken>	getProcessedTimestamps()	Returns a read only list of all timestamps processed during the validation of all signatures from the given document.
ValidationData	getValidationData(AdvancedSignature signature)	Returns a validation data for the given signature's certificate chain
ValidationData	getValidationData(TimestampToken timestampToken)	Returns a validation data for the given timestampToken's certificate chain
void	initialize(CertificateVerifier certificateVerifier)	This method initializes the ValidationContext by retrieving the relevant data from certificateVerifier
protected boolean	isTimestampValid(TimestampToken timestampToken)	This method verifies whether a timestampToken is valid and can be used as a valid POE for covered objects
void	setCurrentTime(Date currentTime)	This function sets the validation time.
void	validate()	Carries out the validation process in recursive manner for not yet checked tokens.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

currentTime

protected Date currentTime

This is the time at what the validation is carried out. It is used only for test purpose.

Constructor Details

SignatureValidationContext

public SignatureValidationContext()

Default constructor instantiating object with null or empty values and current time

Method Details

initialize

public void initialize(CertificateVerifier certificateVerifier)

Description copied from interface: ValidationContext

This method initializes the ValidationContext by retrieving the relevant data from certificateVerifier

Specified by:

initialize in interface ValidationContext

Parameters:

certificateVerifier - The certificate verifier (eg: using the TSL as list of trusted certificates).

addSignatureForVerification

public void addSignatureForVerification(AdvancedSignature signature)

Description copied from interface: ValidationContext

Adds a new signature to collect the information to verify.

Specified by:

addSignatureForVerification in interface ValidationContext

Parameters:

signature - AdvancedSignature to extract data to be verified

addDocumentCertificateSource

public void addDocumentCertificateSource(CertificateSource certificateSource)

Description copied from interface: ValidationContext

Adds an extracted certificate source to the used list of sources

Specified by:

addDocumentCertificateSource in interface ValidationContext

Parameters:

certificateSource - CertificateSource

addDocumentCertificateSource

public void addDocumentCertificateSource(ListCertificateSource listCertificateSource)

Description copied from interface: ValidationContext

Adds a list certificate source to the used list of sources

Specified by:

addDocumentCertificateSource in interface ValidationContext

Parameters:

listCertificateSource - ListCertificateSource

addDocumentCRLSource

public void addDocumentCRLSource(OfflineRevocationSource<CRL> crlSource)

Description copied from interface: ValidationContext

Adds an extracted CRL source to the used list of sources

Specified by:

addDocumentCRLSource in interface ValidationContext

Parameters:

crlSource - OfflineRevocationSource for CRL

addDocumentCRLSource

public void addDocumentCRLSource(ListRevocationSource<CRL> crlSource)

Description copied from interface: ValidationContext

Adds a list CRL source to the used list of sources

Specified by:

addDocumentCRLSource in interface ValidationContext

Parameters:

crlSource - ListRevocationSource for CRL

addDocumentOCSPSource

public void addDocumentOCSPSource(OfflineRevocationSource<OCSP> ocspSource)

Description copied from interface: ValidationContext

Adds an extracted OCSP source to the used list of sources

Specified by:

addDocumentOCSPSource in interface ValidationContext

Parameters:

ocspSource - OfflineRevocationSource for OCSP

addDocumentOCSPSource

public void addDocumentOCSPSource(ListRevocationSource<OCSP> ocspSource)

Description copied from interface: ValidationContext

Adds a listd OCSP source to the used list of sources

Specified by:

addDocumentOCSPSource in interface ValidationContext

Parameters:

ocspSource - ListRevocationSource for OCSP

getCurrentTime

public Date getCurrentTime()

Description copied from interface: ValidationContext

Gets the current validation time.

Specified by:

getCurrentTime in interface ValidationContext

Returns:

Date

setCurrentTime

public void setCurrentTime(Date currentTime)

Description copied from interface: ValidationContext

This function sets the validation time.

Specified by:

setCurrentTime in interface ValidationContext

Parameters:

currentTime - the current Date

getAllCertificateSources

public ListCertificateSource getAllCertificateSources()

Description copied from interface: ValidationContext

Returns a list of all CertificateSources used during the validation process. It is represented by sources extracted from the provided document (e.g. signatures, timestamps) as well as the sources obtained during the validation process (e.g. AIA, OCSP).

Specified by:

getAllCertificateSources in interface ValidationContext

Returns:

ListCertificateSource

getDocumentCertificateSource

public ListCertificateSource getDocumentCertificateSource()

Description copied from interface: ValidationContext

Returns a list of all CertificateSources extracted from a validating document (signature(s), timestamp(s))

Specified by:

getDocumentCertificateSource in interface ValidationContext

Returns:

ListCertificateSource

getDocumentCRLSource

public ListRevocationSource<CRL> getDocumentCRLSource()

Description copied from interface: ValidationContext

Returns a list of all CRL OfflineRevocationSources extracted from a validating document

Specified by:

getDocumentCRLSource in interface ValidationContext

Returns:

ListRevocationSource

getDocumentOCSPSource

public ListRevocationSource<OCSP> getDocumentOCSPSource()

Description copied from interface: ValidationContext

Returns a list of all OCSP OfflineRevocationSources extracted from a validating document

Specified by:

getDocumentOCSPSource in interface ValidationContext

Returns:

ListRevocationSource

addRevocationTokenForVerification

public void addRevocationTokenForVerification(RevocationToken<?> revocationToken)

Description copied from interface: ValidationContext

Adds a new revocation token to the list of tokens to verify. If the revocation token has already been added then it is ignored.

Specified by:

addRevocationTokenForVerification in interface ValidationContext

Parameters:

revocationToken - an instance of RevocationToken revocation tokens to verify

addCertificateTokenForVerification

public void addCertificateTokenForVerification(CertificateToken certificateToken)

Description copied from interface: ValidationContext

Adds a new certificate token to the list of tokens to verify. If the certificate token has already been added then it is ignored.

Specified by:

addCertificateTokenForVerification in interface ValidationContext

Parameters:

certificateToken - CertificateToken certificate token to verify

addTimestampTokenForVerification

public void addTimestampTokenForVerification(TimestampToken timestampToken)

Description copied from interface: ValidationContext

Adds a new timestamp token to the list of tokens to verify. If the timestamp token has already been added then it is ignored.

Specified by:

addTimestampTokenForVerification in interface ValidationContext

Parameters:

timestampToken - TimestampToken timestamp token to verify

isTimestampValid

protected boolean isTimestampValid(TimestampToken timestampToken)

This method verifies whether a timestampToken is valid and can be used as a valid POE for covered objects

Parameters:

timestampToken - TimestampToken to be checked

Returns:

TRUE if the timestamp is valid, FALSE otherwise

validate

public void validate()

Description copied from interface: ValidationContext

Carries out the validation process in recursive manner for not yet checked tokens.

Specified by:

validate in interface ValidationContext

checkAllRequiredRevocationDataPresent

public boolean checkAllRequiredRevocationDataPresent()

Description copied from interface: ValidationContext

This method allows to verify if all processed certificates have a revocation data Additionally, an alert can be handled CertificateVerifier.setAlertOnMissingRevocationData(eu.europa.esig.dss.alert.StatusAlert)

Specified by:

checkAllRequiredRevocationDataPresent in interface ValidationContext

Returns:

true if all needed revocation data are present

checkAllPOECoveredByRevocationData

public boolean checkAllPOECoveredByRevocationData()

Description copied from interface: ValidationContext

This method allows to verify if all POE (timestamp tokens) are covered by a revocation data Additionally, an alert can be handled CertificateVerifier.setAlertOnUncoveredPOE(eu.europa.esig.dss.alert.StatusAlert)

Specified by:

checkAllPOECoveredByRevocationData in interface ValidationContext

Returns:

true if all timestamps are covered by a usable revocation data

checkAllTimestampsValid

public boolean checkAllTimestampsValid()

Description copied from interface: ValidationContext

This method allows to verify if all processed timestamps are valid and intact. Additionally, an alert can be handled CertificateVerifier.setAlertOnInvalidTimestamp(eu.europa.esig.dss.alert.StatusAlert)

Specified by:

checkAllTimestampsValid in interface ValidationContext

Returns:

true if all timestamps are valid

checkAllCertificatesValid

@Deprecated
public boolean checkAllCertificatesValid()

Deprecated.

Description copied from interface: ValidationContext

This method allows to verify if all processed certificates are not revoked Additionally, an alert can be handled CertificateVerifier.setAlertOnRevokedCertificate(eu.europa.esig.dss.alert.StatusAlert)

Specified by:

checkAllCertificatesValid in interface ValidationContext

Returns:

true if all certificates are valid

checkCertificateNotRevoked

public boolean checkCertificateNotRevoked(CertificateToken certificateToken)

Description copied from interface: ValidationContext

This method allows to verify if the certificate is not revoked Additionally, an alert can be handled CertificateVerifier.setAlertOnRevokedCertificate(eu.europa.esig.dss.alert.StatusAlert)

Specified by:

checkCertificateNotRevoked in interface ValidationContext

Parameters:

certificateToken - CertificateToken certificate to be checked

Returns:

true if all certificates are valid

checkCertificatesNotRevoked

public boolean checkCertificatesNotRevoked(AdvancedSignature signature)

Description copied from interface: ValidationContext

This method allows to verify if signature certificates are not revoked Additionally, an alert can be handled CertificateVerifier.setAlertOnRevokedCertificate(eu.europa.esig.dss.alert.StatusAlert)

Specified by:

checkCertificatesNotRevoked in interface ValidationContext

Parameters:

signature - AdvancedSignature signature to be checked

Returns:

true if all certificates are valid

checkAtLeastOneRevocationDataPresentAfterBestSignatureTime

public boolean checkAtLeastOneRevocationDataPresentAfterBestSignatureTime(AdvancedSignature signature)

Description copied from interface: ValidationContext

This method allows to verify if there is at least one revocation data present after the earliest available timestamp token producing time Additionally, an alert can be handled CertificateVerifier.setAlertOnNoRevocationAfterBestSignatureTime(eu.europa.esig.dss.alert.StatusAlert)

Specified by:

checkAtLeastOneRevocationDataPresentAfterBestSignatureTime in interface ValidationContext

Parameters:

signature - AdvancedSignature signature to be checked

Returns:

true if the signing certificate is covered with a updated revocation data (after signature-timestamp production time)

checkSignatureNotExpired

public boolean checkSignatureNotExpired(AdvancedSignature signature)

Description copied from interface: ValidationContext

This method verifies if the signing certificate has not been expired yet or has a still valid timestamp Additionally, an alert can be handled CertificateVerifier.setAlertOnExpiredSignature(eu.europa.esig.dss.alert.StatusAlert)

Specified by:

checkSignatureNotExpired in interface ValidationContext

Parameters:

signature - AdvancedSignature signature to be verified

Returns:

true if the signing certificate or its POE(s) not yet expired, false otherwise

getProcessedCertificates

public Set<CertificateToken> getProcessedCertificates()

Description copied from interface: ValidationContext

Returns a read only list of all certificates used in the process of the validation of all signatures from the given document. This list includes the certificate to check, certification chain certificates, OCSP response certificate...

Specified by:

getProcessedCertificates in interface ValidationContext

Returns:

The list of CertificateToken(s)

getProcessedRevocations

public Set<RevocationToken> getProcessedRevocations()

Description copied from interface: ValidationContext

Returns a read only list of all revocations used in the process of the validation of all signatures from the given document.

Specified by:

getProcessedRevocations in interface ValidationContext

Returns:

The list of RevocationToken(s)

getProcessedTimestamps

public Set<TimestampToken> getProcessedTimestamps()

Description copied from interface: ValidationContext

Returns a read only list of all timestamps processed during the validation of all signatures from the given document.

Specified by:

getProcessedTimestamps in interface ValidationContext

Returns:

The list of TimestampTokens(s)

getValidationData

public ValidationData getValidationData(AdvancedSignature signature)

Description copied from interface: ValidationContext

Returns a validation data for the given signature's certificate chain

Specified by:

getValidationData in interface ValidationContext

Parameters:

signature - AdvancedSignature to extract validation data for

Returns:

ValidationData

getValidationData

public ValidationData getValidationData(TimestampToken timestampToken)

Description copied from interface: ValidationContext

Returns a validation data for the given timestampToken's certificate chain

Specified by:

getValidationData in interface ValidationContext

Parameters:

timestampToken - TimestampToken to extract validation data for

Returns:

ValidationData