package org.bouncycastle.jce.provider; import com.huawei.hms.android.SystemUtils; import java.io.ByteArrayOutputStream; import java.io.IOException; import java.math.BigInteger; import java.security.GeneralSecurityException; import java.security.PublicKey; import java.security.cert.CRL; import java.security.cert.CRLException; import java.security.cert.CertPath; import java.security.cert.CertPathValidatorException; import java.security.cert.CertStore; import java.security.cert.CertStoreException; import java.security.cert.Certificate; import java.security.cert.CertificateParsingException; import java.security.cert.PolicyQualifierInfo; import java.security.cert.TrustAnchor; import java.security.cert.X509CRL; import java.security.cert.X509CRLEntry; import java.security.cert.X509CRLSelector; import java.security.cert.X509CertSelector; import java.security.cert.X509Certificate; import java.security.cert.X509Extension; import java.security.interfaces.DSAParams; import java.security.interfaces.DSAPublicKey; import java.security.spec.DSAPublicKeySpec; import java.text.ParseException; import java.util.ArrayList; import java.util.Collection; import java.util.Collections; import java.util.Date; import java.util.Enumeration; import java.util.HashSet; import java.util.Iterator; import java.util.LinkedHashSet; import java.util.List; import java.util.Map; import java.util.Set; import javax.security.auth.x500.X500Principal; import org.bouncycastle.asn1.ASN1Encodable; import org.bouncycastle.asn1.ASN1Enumerated; import org.bouncycastle.asn1.ASN1GeneralizedTime; import org.bouncycastle.asn1.ASN1InputStream; import org.bouncycastle.asn1.ASN1Integer; import org.bouncycastle.asn1.ASN1ObjectIdentifier; import org.bouncycastle.asn1.ASN1OctetString; import org.bouncycastle.asn1.ASN1OutputStream; import org.bouncycastle.asn1.ASN1Primitive; import org.bouncycastle.asn1.ASN1Sequence; import org.bouncycastle.asn1.DEROctetString; import org.bouncycastle.asn1.DERSequence; import org.bouncycastle.asn1.isismtt.ISISMTTObjectIdentifiers; import org.bouncycastle.asn1.x500.X500Name; import org.bouncycastle.asn1.x500.style.RFC4519Style; import org.bouncycastle.asn1.x509.AlgorithmIdentifier; import org.bouncycastle.asn1.x509.AuthorityKeyIdentifier; import org.bouncycastle.asn1.x509.CRLDistPoint; import org.bouncycastle.asn1.x509.DistributionPoint; import org.bouncycastle.asn1.x509.DistributionPointName; import org.bouncycastle.asn1.x509.Extension; import org.bouncycastle.asn1.x509.GeneralName; import org.bouncycastle.asn1.x509.GeneralNames; import org.bouncycastle.asn1.x509.PolicyInformation; import org.bouncycastle.asn1.x509.SubjectPublicKeyInfo; import org.bouncycastle.jcajce.PKIXCRLStore; import org.bouncycastle.jcajce.PKIXCRLStoreSelector; import org.bouncycastle.jcajce.PKIXCertStore; import org.bouncycastle.jcajce.PKIXCertStoreSelector; import org.bouncycastle.jcajce.PKIXExtendedParameters; import org.bouncycastle.jcajce.util.JcaJceHelper; import org.bouncycastle.jce.exception.ExtCertPathValidatorException; import org.bouncycastle.util.Store; import org.bouncycastle.util.StoreException; import org.bouncycastle.x509.X509AttributeCertificate; /* JADX INFO: Access modifiers changed from: package-private */ /* loaded from: classes6.dex */ public class CertPathValidatorUtilities { protected static final String ANY_POLICY = "2.5.29.32.0"; protected static final int CRL_SIGN = 6; protected static final int KEY_CERT_SIGN = 5; protected static final PKIXCRLUtil CRL_UTIL = new PKIXCRLUtil(); protected static final String CERTIFICATE_POLICIES = Extension.certificatePolicies.getId(); protected static final String BASIC_CONSTRAINTS = Extension.basicConstraints.getId(); protected static final String POLICY_MAPPINGS = Extension.policyMappings.getId(); protected static final String SUBJECT_ALTERNATIVE_NAME = Extension.subjectAlternativeName.getId(); protected static final String NAME_CONSTRAINTS = Extension.nameConstraints.getId(); protected static final String KEY_USAGE = Extension.keyUsage.getId(); protected static final String INHIBIT_ANY_POLICY = Extension.inhibitAnyPolicy.getId(); protected static final String ISSUING_DISTRIBUTION_POINT = Extension.issuingDistributionPoint.getId(); protected static final String DELTA_CRL_INDICATOR = Extension.deltaCRLIndicator.getId(); protected static final String POLICY_CONSTRAINTS = Extension.policyConstraints.getId(); protected static final String FRESHEST_CRL = Extension.freshestCRL.getId(); protected static final String CRL_DISTRIBUTION_POINTS = Extension.cRLDistributionPoints.getId(); protected static final String AUTHORITY_KEY_IDENTIFIER = Extension.authorityKeyIdentifier.getId(); protected static final String CRL_NUMBER = Extension.cRLNumber.getId(); protected static final String[] crlReasons = {"unspecified", "keyCompromise", "cACompromise", "affiliationChanged", "superseded", "cessationOfOperation", "certificateHold", SystemUtils.UNKNOWN, "removeFromCRL", "privilegeWithdrawn", "aACompromise"}; /* JADX INFO: Access modifiers changed from: protected */ public static void verifyX509Certificate(X509Certificate x509Certificate, PublicKey publicKey, String str) throws GeneralSecurityException { if (str == null) { x509Certificate.verify(publicKey); } else { x509Certificate.verify(publicKey, str); } } private static void removePolicyNodeRecurse(List[] listArr, PKIXPolicyNode pKIXPolicyNode) { listArr[pKIXPolicyNode.getDepth()].remove(pKIXPolicyNode); if (pKIXPolicyNode.hasChildren()) { Iterator children = pKIXPolicyNode.getChildren(); while (children.hasNext()) { removePolicyNodeRecurse(listArr, (PKIXPolicyNode) children.next()); } } } /* JADX INFO: Access modifiers changed from: protected */ public static PKIXPolicyNode removePolicyNode(PKIXPolicyNode pKIXPolicyNode, List[] listArr, PKIXPolicyNode pKIXPolicyNode2) { PKIXPolicyNode pKIXPolicyNode3 = (PKIXPolicyNode) pKIXPolicyNode2.getParent(); if (pKIXPolicyNode == null) { return null; } if (pKIXPolicyNode3 != null) { pKIXPolicyNode3.removeChild(pKIXPolicyNode2); removePolicyNodeRecurse(listArr, pKIXPolicyNode2); return pKIXPolicyNode; } for (int i = 0; i < listArr.length; i++) { listArr[i] = new ArrayList(); } return null; } /* JADX INFO: Access modifiers changed from: protected */ public static void processCertD1ii(int i, List[] listArr, ASN1ObjectIdentifier aSN1ObjectIdentifier, Set set) { List list = listArr[i - 1]; for (int i2 = 0; i2 < list.size(); i2++) { PKIXPolicyNode pKIXPolicyNode = (PKIXPolicyNode) list.get(i2); if ("2.5.29.32.0".equals(pKIXPolicyNode.getValidPolicy())) { HashSet hashSet = new HashSet(); hashSet.add(aSN1ObjectIdentifier.getId()); PKIXPolicyNode pKIXPolicyNode2 = new PKIXPolicyNode(new ArrayList(), i, hashSet, pKIXPolicyNode, set, aSN1ObjectIdentifier.getId(), false); pKIXPolicyNode.addChild(pKIXPolicyNode2); listArr[i].add(pKIXPolicyNode2); return; } } } /* JADX INFO: Access modifiers changed from: protected */ public static boolean processCertD1i(int i, List[] listArr, ASN1ObjectIdentifier aSN1ObjectIdentifier, Set set) { List list = listArr[i - 1]; for (int i2 = 0; i2 < list.size(); i2++) { PKIXPolicyNode pKIXPolicyNode = (PKIXPolicyNode) list.get(i2); if (pKIXPolicyNode.getExpectedPolicies().contains(aSN1ObjectIdentifier.getId())) { HashSet hashSet = new HashSet(); hashSet.add(aSN1ObjectIdentifier.getId()); PKIXPolicyNode pKIXPolicyNode2 = new PKIXPolicyNode(new ArrayList(), i, hashSet, pKIXPolicyNode, set, aSN1ObjectIdentifier.getId(), false); pKIXPolicyNode.addChild(pKIXPolicyNode2); listArr[i].add(pKIXPolicyNode2); return true; } } return false; } protected static PKIXPolicyNode prepareNextCertB2(int i, List[] listArr, String str, PKIXPolicyNode pKIXPolicyNode) { int i2; Iterator it = listArr[i].iterator(); while (it.hasNext()) { PKIXPolicyNode pKIXPolicyNode2 = (PKIXPolicyNode) it.next(); if (pKIXPolicyNode2.getValidPolicy().equals(str)) { ((PKIXPolicyNode) pKIXPolicyNode2.getParent()).removeChild(pKIXPolicyNode2); it.remove(); for (int i3 = i - 1; i3 >= 0; i3--) { List list = listArr[i3]; while (i2 < list.size()) { PKIXPolicyNode pKIXPolicyNode3 = (PKIXPolicyNode) list.get(i2); i2 = (pKIXPolicyNode3.hasChildren() || (pKIXPolicyNode = removePolicyNode(pKIXPolicyNode, listArr, pKIXPolicyNode3)) != null) ? i2 + 1 : 0; } } } } return pKIXPolicyNode; } protected static void prepareNextCertB1(int i, List[] listArr, String str, Map map, X509Certificate x509Certificate) throws AnnotatedException, CertPathValidatorException { Set set; for (PKIXPolicyNode pKIXPolicyNode : listArr[i]) { if (pKIXPolicyNode.getValidPolicy().equals(str)) { pKIXPolicyNode.expectedPolicies = (Set) map.get(str); return; } } for (PKIXPolicyNode pKIXPolicyNode2 : listArr[i]) { if ("2.5.29.32.0".equals(pKIXPolicyNode2.getValidPolicy())) { try { Enumeration objects = DERSequence.getInstance(getExtensionValue(x509Certificate, CERTIFICATE_POLICIES)).getObjects(); while (true) { if (!objects.hasMoreElements()) { set = null; break; } try { PolicyInformation policyInformation = PolicyInformation.getInstance(objects.nextElement()); if ("2.5.29.32.0".equals(policyInformation.getPolicyIdentifier().getId())) { try { set = getQualifierSet(policyInformation.getPolicyQualifiers()); break; } catch (CertPathValidatorException e) { throw new ExtCertPathValidatorException("Policy qualifier info set could not be built.", e); } } } catch (Exception e2) { throw new AnnotatedException("Policy information cannot be decoded.", e2); } } Set set2 = set; boolean contains = x509Certificate.getCriticalExtensionOIDs() != null ? x509Certificate.getCriticalExtensionOIDs().contains(CERTIFICATE_POLICIES) : false; PKIXPolicyNode pKIXPolicyNode3 = (PKIXPolicyNode) pKIXPolicyNode2.getParent(); if ("2.5.29.32.0".equals(pKIXPolicyNode3.getValidPolicy())) { PKIXPolicyNode pKIXPolicyNode4 = new PKIXPolicyNode(new ArrayList(), i, (Set) map.get(str), pKIXPolicyNode3, set2, str, contains); pKIXPolicyNode3.addChild(pKIXPolicyNode4); listArr[i].add(pKIXPolicyNode4); return; } return; } catch (Exception e3) { throw new AnnotatedException("Certificate policies cannot be decoded.", e3); } } } } /* JADX INFO: Access modifiers changed from: protected */ public static boolean isSelfIssued(X509Certificate x509Certificate) { return x509Certificate.getSubjectDN().equals(x509Certificate.getIssuerDN()); } private static boolean isDeltaCRL(X509CRL x509crl) { Set criticalExtensionOIDs = x509crl.getCriticalExtensionOIDs(); if (criticalExtensionOIDs == null) { return false; } return criticalExtensionOIDs.contains(RFC3280CertPathUtilities.DELTA_CRL_INDICATOR); } /* JADX INFO: Access modifiers changed from: protected */ public static boolean isAnyPolicy(Set set) { return set == null || set.contains("2.5.29.32.0") || set.isEmpty(); } /* JADX INFO: Access modifiers changed from: protected */ public static Date getValidDate(PKIXExtendedParameters pKIXExtendedParameters) { Date date = pKIXExtendedParameters.getDate(); return date == null ? new Date() : date; } /* JADX INFO: Access modifiers changed from: protected */ public static Date getValidCertDateFromValidityModel(PKIXExtendedParameters pKIXExtendedParameters, CertPath certPath, int i) throws AnnotatedException { if (pKIXExtendedParameters.getValidityModel() == 1 && i > 0) { int i2 = i - 1; if (i2 == 0) { try { byte[] extensionValue = ((X509Certificate) certPath.getCertificates().get(i2)).getExtensionValue(ISISMTTObjectIdentifiers.id_isismtt_at_dateOfCertGen.getId()); ASN1GeneralizedTime aSN1GeneralizedTime = extensionValue != null ? ASN1GeneralizedTime.getInstance(ASN1Primitive.fromByteArray(extensionValue)) : null; if (aSN1GeneralizedTime != null) { try { return aSN1GeneralizedTime.getDate(); } catch (ParseException e) { throw new AnnotatedException("Date from date of cert gen extension could not be parsed.", e); } } } catch (IOException unused) { throw new AnnotatedException("Date of cert gen extension could not be read."); } catch (IllegalArgumentException unused2) { throw new AnnotatedException("Date of cert gen extension could not be read."); } } return ((X509Certificate) certPath.getCertificates().get(i2)).getNotBefore(); } return getValidDate(pKIXExtendedParameters); } private static BigInteger getSerialNumber(Object obj) { return ((X509Certificate) obj).getSerialNumber(); } /* JADX INFO: Access modifiers changed from: protected */ public static final Set getQualifierSet(ASN1Sequence aSN1Sequence) throws CertPathValidatorException { HashSet hashSet = new HashSet(); if (aSN1Sequence == null) { return hashSet; } ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream(); ASN1OutputStream aSN1OutputStream = new ASN1OutputStream(byteArrayOutputStream); Enumeration objects = aSN1Sequence.getObjects(); while (objects.hasMoreElements()) { try { aSN1OutputStream.writeObject((ASN1Encodable) objects.nextElement()); hashSet.add(new PolicyQualifierInfo(byteArrayOutputStream.toByteArray())); byteArrayOutputStream.reset(); } catch (IOException e) { throw new ExtCertPathValidatorException("Policy qualifier info cannot be decoded.", e); } } return hashSet; } private static ASN1Primitive getObject(String str, byte[] bArr) throws AnnotatedException { try { return new ASN1InputStream(((ASN1OctetString) new ASN1InputStream(bArr).readObject()).getOctets()).readObject(); } catch (Exception e) { throw new AnnotatedException("exception processing extension ".concat(String.valueOf(str)), e); } } /* JADX INFO: Access modifiers changed from: protected */ public static PublicKey getNextWorkingKey(List list, int i, JcaJceHelper jcaJceHelper) throws CertPathValidatorException { DSAPublicKey dSAPublicKey; PublicKey publicKey = ((Certificate) list.get(i)).getPublicKey(); if (!(publicKey instanceof DSAPublicKey)) { return publicKey; } DSAPublicKey dSAPublicKey2 = (DSAPublicKey) publicKey; if (dSAPublicKey2.getParams() != null) { return dSAPublicKey2; } do { i++; if (i >= list.size()) { throw new CertPathValidatorException("DSA parameters cannot be inherited from previous certificate."); } PublicKey publicKey2 = ((X509Certificate) list.get(i)).getPublicKey(); if (!(publicKey2 instanceof DSAPublicKey)) { throw new CertPathValidatorException("DSA parameters cannot be inherited from previous certificate."); } dSAPublicKey = (DSAPublicKey) publicKey2; } while (dSAPublicKey.getParams() == null); DSAParams params = dSAPublicKey.getParams(); try { return jcaJceHelper.createKeyFactory("DSA").generatePublic(new DSAPublicKeySpec(dSAPublicKey2.getY(), params.getP(), params.getQ(), params.getG())); } catch (Exception e) { throw new RuntimeException(e.getMessage()); } } /* JADX INFO: Access modifiers changed from: protected */ public static ASN1Primitive getExtensionValue(X509Extension x509Extension, String str) throws AnnotatedException { byte[] extensionValue = x509Extension.getExtensionValue(str); if (extensionValue == null) { return null; } return getObject(str, extensionValue); } /* JADX INFO: Access modifiers changed from: protected */ public static Set getDeltaCRLs(Date date, X509CRL x509crl, List list, List list2) throws AnnotatedException { X509CRLSelector x509CRLSelector = new X509CRLSelector(); try { x509CRLSelector.addIssuerName(PrincipalUtils.getIssuerPrincipal(x509crl).getEncoded()); try { ASN1Primitive extensionValue = getExtensionValue(x509crl, CRL_NUMBER); BigInteger positiveValue = extensionValue != null ? ASN1Integer.getInstance(extensionValue).getPositiveValue() : null; try { byte[] extensionValue2 = x509crl.getExtensionValue(ISSUING_DISTRIBUTION_POINT); x509CRLSelector.setMinCRLNumber(positiveValue != null ? positiveValue.add(BigInteger.valueOf(1L)) : null); PKIXCRLStoreSelector.Builder builder = new PKIXCRLStoreSelector.Builder(x509CRLSelector); builder.setIssuingDistributionPoint(extensionValue2); builder.setIssuingDistributionPointEnabled(true); builder.setMaxBaseCRLNumber(positiveValue); Set findCRLs = CRL_UTIL.findCRLs(builder.build(), date, list, list2); HashSet hashSet = new HashSet(); for (X509CRL x509crl2 : findCRLs) { if (isDeltaCRL(x509crl2)) { hashSet.add(x509crl2); } } return hashSet; } catch (Exception e) { throw new AnnotatedException("Issuing distribution point extension value could not be read.", e); } } catch (Exception e2) { throw new AnnotatedException("CRL number extension could not be extracted from CRL.", e2); } } catch (IOException e3) { throw new AnnotatedException("Cannot extract issuer from CRL.", e3); } } /* JADX INFO: Access modifiers changed from: protected */ public static Set getCompleteCRLs(DistributionPoint distributionPoint, Object obj, Date date, PKIXExtendedParameters pKIXExtendedParameters) throws AnnotatedException { X509CRLSelector x509CRLSelector = new X509CRLSelector(); try { HashSet hashSet = new HashSet(); hashSet.add(PrincipalUtils.getEncodedIssuerPrincipal(obj)); getCRLIssuersFromDistributionPoint(distributionPoint, hashSet, x509CRLSelector); if (obj instanceof X509Certificate) { x509CRLSelector.setCertificateChecking((X509Certificate) obj); } PKIXCRLStoreSelector build = new PKIXCRLStoreSelector.Builder(x509CRLSelector).setCompleteCRLEnabled(true).build(); if (pKIXExtendedParameters.getDate() != null) { date = pKIXExtendedParameters.getDate(); } Set findCRLs = CRL_UTIL.findCRLs(build, date, pKIXExtendedParameters.getCertStores(), pKIXExtendedParameters.getCRLStores()); checkCRLsNotEmpty(findCRLs, obj); return findCRLs; } catch (AnnotatedException e) { throw new AnnotatedException("Could not get issuer information from distribution point.", e); } } /* JADX INFO: Access modifiers changed from: protected */ public static void getCertStatus(Date date, X509CRL x509crl, Object obj, CertStatus certStatus) throws AnnotatedException { X509CRLEntry revokedCertificate; ASN1Enumerated aSN1Enumerated; try { if (X509CRLObject.isIndirectCRL(x509crl)) { revokedCertificate = x509crl.getRevokedCertificate(getSerialNumber(obj)); if (revokedCertificate == null) { return; } X500Principal certificateIssuer = revokedCertificate.getCertificateIssuer(); if (!PrincipalUtils.getEncodedIssuerPrincipal(obj).equals(certificateIssuer == null ? PrincipalUtils.getIssuerPrincipal(x509crl) : X500Name.getInstance(certificateIssuer.getEncoded()))) { return; } } else if (!PrincipalUtils.getEncodedIssuerPrincipal(obj).equals(PrincipalUtils.getIssuerPrincipal(x509crl)) || (revokedCertificate = x509crl.getRevokedCertificate(getSerialNumber(obj))) == null) { return; } if (revokedCertificate.hasExtensions()) { try { aSN1Enumerated = ASN1Enumerated.getInstance(getExtensionValue(revokedCertificate, Extension.reasonCode.getId())); } catch (Exception e) { throw new AnnotatedException("Reason code CRL entry extension could not be decoded.", e); } } else { aSN1Enumerated = null; } if (date.getTime() >= revokedCertificate.getRevocationDate().getTime() || aSN1Enumerated == null || aSN1Enumerated.getValue().intValue() == 0 || aSN1Enumerated.getValue().intValue() == 1 || aSN1Enumerated.getValue().intValue() == 2 || aSN1Enumerated.getValue().intValue() == 8) { certStatus.setCertStatus(aSN1Enumerated != null ? aSN1Enumerated.getValue().intValue() : 0); certStatus.setRevocationDate(revokedCertificate.getRevocationDate()); } } catch (CRLException e2) { throw new AnnotatedException("Failed check for indirect CRL.", e2); } } protected static void getCRLIssuersFromDistributionPoint(DistributionPoint distributionPoint, Collection collection, X509CRLSelector x509CRLSelector) throws AnnotatedException { ArrayList arrayList = new ArrayList(); if (distributionPoint.getCRLIssuer() != null) { GeneralName[] names = distributionPoint.getCRLIssuer().getNames(); for (int i = 0; i < names.length; i++) { if (names[i].getTagNo() == 4) { try { arrayList.add(X500Name.getInstance(names[i].getName().toASN1Primitive().getEncoded())); } catch (IOException e) { throw new AnnotatedException("CRL issuer information from distribution point cannot be decoded.", e); } } } } else { if (distributionPoint.getDistributionPoint() == null) { throw new AnnotatedException("CRL issuer is omitted from distribution point but no distributionPoint field present."); } Iterator it = collection.iterator(); while (it.hasNext()) { arrayList.add(it.next()); } } Iterator it2 = arrayList.iterator(); while (it2.hasNext()) { try { x509CRLSelector.addIssuerName(((X500Name) it2.next()).getEncoded()); } catch (IOException e2) { throw new AnnotatedException("Cannot decode CRL issuer information.", e2); } } } /* JADX INFO: Access modifiers changed from: protected */ public static AlgorithmIdentifier getAlgorithmIdentifier(PublicKey publicKey) throws CertPathValidatorException { try { return SubjectPublicKeyInfo.getInstance(new ASN1InputStream(publicKey.getEncoded()).readObject()).getAlgorithm(); } catch (Exception e) { throw new ExtCertPathValidatorException("Subject public key cannot be decoded.", e); } } /* JADX INFO: Access modifiers changed from: package-private */ public static List getAdditionalStoresFromCRLDistributionPoint(CRLDistPoint cRLDistPoint, Map map) throws AnnotatedException { if (cRLDistPoint == null) { return Collections.EMPTY_LIST; } try { DistributionPoint[] distributionPoints = cRLDistPoint.getDistributionPoints(); ArrayList arrayList = new ArrayList(); for (DistributionPoint distributionPoint : distributionPoints) { DistributionPointName distributionPoint2 = distributionPoint.getDistributionPoint(); if (distributionPoint2 != null && distributionPoint2.getType() == 0) { for (GeneralName generalName : GeneralNames.getInstance(distributionPoint2.getName()).getNames()) { PKIXCRLStore pKIXCRLStore = map.get(generalName); if (pKIXCRLStore != null) { arrayList.add(pKIXCRLStore); } } } } return arrayList; } catch (Exception e) { throw new AnnotatedException("Distribution points could not be read.", e); } } /* JADX INFO: Access modifiers changed from: package-private */ public static List getAdditionalStoresFromAltNames(byte[] bArr, Map map) throws CertificateParsingException { if (bArr == null) { return Collections.EMPTY_LIST; } GeneralName[] names = GeneralNames.getInstance(ASN1OctetString.getInstance(bArr).getOctets()).getNames(); ArrayList arrayList = new ArrayList(); for (int i = 0; i != names.length; i++) { PKIXCertStore pKIXCertStore = map.get(names[i]); if (pKIXCertStore != null) { arrayList.add(pKIXCertStore); } } return arrayList; } /* JADX INFO: Access modifiers changed from: protected */ public static TrustAnchor findTrustAnchor(X509Certificate x509Certificate, Set set, String str) throws AnnotatedException { X509CertSelector x509CertSelector = new X509CertSelector(); X500Name encodedIssuerPrincipal = PrincipalUtils.getEncodedIssuerPrincipal(x509Certificate); try { x509CertSelector.setSubject(encodedIssuerPrincipal.getEncoded()); Iterator it = set.iterator(); TrustAnchor trustAnchor = null; Exception e = null; PublicKey publicKey = null; while (it.hasNext() && trustAnchor == null) { trustAnchor = (TrustAnchor) it.next(); if (trustAnchor.getTrustedCert() != null) { if (x509CertSelector.match(trustAnchor.getTrustedCert())) { publicKey = trustAnchor.getTrustedCert().getPublicKey(); } trustAnchor = null; } else { if (trustAnchor.getCAName() != null && trustAnchor.getCAPublicKey() != null) { try { if (encodedIssuerPrincipal.equals(PrincipalUtils.getCA(trustAnchor))) { publicKey = trustAnchor.getCAPublicKey(); } } catch (IllegalArgumentException unused) { } } trustAnchor = null; } if (publicKey != null) { try { verifyX509Certificate(x509Certificate, publicKey, str); } catch (Exception e2) { e = e2; trustAnchor = null; publicKey = null; } } } if (trustAnchor != null || e == null) { return trustAnchor; } throw new AnnotatedException("TrustAnchor found but certificate validation failed.", e); } catch (IOException e3) { throw new AnnotatedException("Cannot set subject search criteria for trust anchor.", e3); } } protected static TrustAnchor findTrustAnchor(X509Certificate x509Certificate, Set set) throws AnnotatedException { return findTrustAnchor(x509Certificate, set, null); } /* JADX INFO: Access modifiers changed from: package-private */ public static Collection findIssuerCerts(X509Certificate x509Certificate, List list, List list2) throws AnnotatedException { byte[] keyIdentifier; X509CertSelector x509CertSelector = new X509CertSelector(); try { x509CertSelector.setSubject(PrincipalUtils.getIssuerPrincipal(x509Certificate).getEncoded()); try { byte[] extensionValue = x509Certificate.getExtensionValue(AUTHORITY_KEY_IDENTIFIER); if (extensionValue != null && (keyIdentifier = AuthorityKeyIdentifier.getInstance(ASN1OctetString.getInstance(extensionValue).getOctets()).getKeyIdentifier()) != null) { x509CertSelector.setSubjectKeyIdentifier(new DEROctetString(keyIdentifier).getEncoded()); } } catch (Exception unused) { } PKIXCertStoreSelector build = new PKIXCertStoreSelector.Builder(x509CertSelector).build(); LinkedHashSet linkedHashSet = new LinkedHashSet(); try { ArrayList arrayList = new ArrayList(); arrayList.addAll(findCertificates(build, list)); arrayList.addAll(findCertificates(build, list2)); Iterator it = arrayList.iterator(); while (it.hasNext()) { linkedHashSet.add((X509Certificate) it.next()); } return linkedHashSet; } catch (AnnotatedException e) { throw new AnnotatedException("Issuer certificate cannot be searched.", e); } } catch (IOException e2) { throw new AnnotatedException("Subject criteria for certificate selector to find issuer certificate could not be set.", e2); } } /* JADX INFO: Access modifiers changed from: protected */ public static Collection findCertificates(PKIXCertStoreSelector pKIXCertStoreSelector, List list) throws AnnotatedException { LinkedHashSet linkedHashSet = new LinkedHashSet(); for (Object obj : list) { if (obj instanceof Store) { try { linkedHashSet.addAll(((Store) obj).getMatches(pKIXCertStoreSelector)); } catch (StoreException e) { throw new AnnotatedException("Problem while picking certificates from X.509 store.", e); } } else { try { linkedHashSet.addAll(PKIXCertStoreSelector.getCertificates(pKIXCertStoreSelector, (CertStore) obj)); } catch (CertStoreException e2) { throw new AnnotatedException("Problem while picking certificates from certificate store.", e2); } } } return linkedHashSet; } static void checkCRLsNotEmpty(Set set, Object obj) throws AnnotatedException { if (set.isEmpty()) { if (obj instanceof X509AttributeCertificate) { StringBuilder sb = new StringBuilder("No CRLs found for issuer \""); sb.append(((X509AttributeCertificate) obj).getIssuer().getPrincipals()[0]); sb.append("\""); throw new AnnotatedException(sb.toString()); } StringBuilder sb2 = new StringBuilder("No CRLs found for issuer \""); sb2.append(RFC4519Style.INSTANCE.toString(PrincipalUtils.getIssuerPrincipal((X509Certificate) obj))); sb2.append("\""); throw new AnnotatedException(sb2.toString()); } } CertPathValidatorUtilities() { } }