package org.bouncycastle.x509; import com.huawei.hms.android.SystemUtils; import java.io.ByteArrayInputStream; import java.io.ByteArrayOutputStream; import java.io.IOException; import java.math.BigInteger; import java.security.GeneralSecurityException; import java.security.KeyFactory; import java.security.PublicKey; import java.security.cert.CRLException; import java.security.cert.CertPath; import java.security.cert.CertPathValidatorException; import java.security.cert.CertStore; import java.security.cert.CertStoreException; import java.security.cert.Certificate; import java.security.cert.CertificateException; import java.security.cert.CertificateParsingException; import java.security.cert.PKIXParameters; import java.security.cert.PolicyQualifierInfo; import java.security.cert.TrustAnchor; import java.security.cert.X509CRL; import java.security.cert.X509CRLEntry; import java.security.cert.X509CRLSelector; import java.security.cert.X509CertSelector; import java.security.cert.X509Certificate; import java.security.cert.X509Extension; import java.security.interfaces.DSAParams; import java.security.interfaces.DSAPublicKey; import java.security.spec.DSAPublicKeySpec; import java.text.ParseException; import java.util.ArrayList; import java.util.Collection; import java.util.Date; import java.util.Enumeration; import java.util.HashSet; import java.util.Iterator; import java.util.List; import java.util.Map; import java.util.Set; import javax.security.auth.x500.X500Principal; import org.bouncycastle.asn1.ASN1Encodable; import org.bouncycastle.asn1.ASN1Enumerated; import org.bouncycastle.asn1.ASN1GeneralizedTime; import org.bouncycastle.asn1.ASN1InputStream; import org.bouncycastle.asn1.ASN1Integer; import org.bouncycastle.asn1.ASN1ObjectIdentifier; import org.bouncycastle.asn1.ASN1OctetString; import org.bouncycastle.asn1.ASN1OutputStream; import org.bouncycastle.asn1.ASN1Primitive; import org.bouncycastle.asn1.ASN1Sequence; import org.bouncycastle.asn1.DERIA5String; import org.bouncycastle.asn1.DERSequence; import org.bouncycastle.asn1.isismtt.ISISMTTObjectIdentifiers; import org.bouncycastle.asn1.x509.AlgorithmIdentifier; import org.bouncycastle.asn1.x509.CRLDistPoint; import org.bouncycastle.asn1.x509.DistributionPoint; import org.bouncycastle.asn1.x509.DistributionPointName; import org.bouncycastle.asn1.x509.Extension; import org.bouncycastle.asn1.x509.GeneralName; import org.bouncycastle.asn1.x509.GeneralNames; import org.bouncycastle.asn1.x509.IssuingDistributionPoint; import org.bouncycastle.asn1.x509.PolicyInformation; import org.bouncycastle.asn1.x509.SubjectPublicKeyInfo; import org.bouncycastle.jcajce.PKIXCertStoreSelector; import org.bouncycastle.jcajce.provider.asymmetric.x509.CertificateFactory; import org.bouncycastle.jce.X509LDAPCertStoreParameters; import org.bouncycastle.jce.exception.ExtCertPathValidatorException; import org.bouncycastle.jce.provider.AnnotatedException; import org.bouncycastle.jce.provider.BouncyCastleProvider; import org.bouncycastle.jce.provider.PKIXPolicyNode; import org.bouncycastle.util.Encodable; import org.bouncycastle.util.Integers; import org.bouncycastle.util.Store; import org.bouncycastle.util.StoreException; /* loaded from: classes6.dex */ class CertPathValidatorUtilities { protected static final String ANY_POLICY = "2.5.29.32.0"; protected static final int CRL_SIGN = 6; protected static final int KEY_CERT_SIGN = 5; protected static final PKIXCRLUtil CRL_UTIL = new PKIXCRLUtil(); protected static final String CERTIFICATE_POLICIES = Extension.certificatePolicies.getId(); protected static final String BASIC_CONSTRAINTS = Extension.basicConstraints.getId(); protected static final String POLICY_MAPPINGS = Extension.policyMappings.getId(); protected static final String SUBJECT_ALTERNATIVE_NAME = Extension.subjectAlternativeName.getId(); protected static final String NAME_CONSTRAINTS = Extension.nameConstraints.getId(); protected static final String KEY_USAGE = Extension.keyUsage.getId(); protected static final String INHIBIT_ANY_POLICY = Extension.inhibitAnyPolicy.getId(); protected static final String ISSUING_DISTRIBUTION_POINT = Extension.issuingDistributionPoint.getId(); protected static final String DELTA_CRL_INDICATOR = Extension.deltaCRLIndicator.getId(); protected static final String POLICY_CONSTRAINTS = Extension.policyConstraints.getId(); protected static final String FRESHEST_CRL = Extension.freshestCRL.getId(); protected static final String CRL_DISTRIBUTION_POINTS = Extension.cRLDistributionPoints.getId(); protected static final String AUTHORITY_KEY_IDENTIFIER = Extension.authorityKeyIdentifier.getId(); protected static final String CRL_NUMBER = Extension.cRLNumber.getId(); protected static final String[] crlReasons = {"unspecified", "keyCompromise", "cACompromise", "affiliationChanged", "superseded", "cessationOfOperation", "certificateHold", SystemUtils.UNKNOWN, "removeFromCRL", "privilegeWithdrawn", "aACompromise"}; /* JADX INFO: Access modifiers changed from: protected */ public static void verifyX509Certificate(X509Certificate x509Certificate, PublicKey publicKey, String str) throws GeneralSecurityException { if (str == null) { x509Certificate.verify(publicKey); } else { x509Certificate.verify(publicKey, str); } } private static void removePolicyNodeRecurse(List[] listArr, PKIXPolicyNode pKIXPolicyNode) { listArr[pKIXPolicyNode.getDepth()].remove(pKIXPolicyNode); if (pKIXPolicyNode.hasChildren()) { Iterator children = pKIXPolicyNode.getChildren(); while (children.hasNext()) { removePolicyNodeRecurse(listArr, (PKIXPolicyNode) children.next()); } } } /* JADX INFO: Access modifiers changed from: protected */ public static PKIXPolicyNode removePolicyNode(PKIXPolicyNode pKIXPolicyNode, List[] listArr, PKIXPolicyNode pKIXPolicyNode2) { PKIXPolicyNode pKIXPolicyNode3 = (PKIXPolicyNode) pKIXPolicyNode2.getParent(); if (pKIXPolicyNode == null) { return null; } if (pKIXPolicyNode3 != null) { pKIXPolicyNode3.removeChild(pKIXPolicyNode2); removePolicyNodeRecurse(listArr, pKIXPolicyNode2); return pKIXPolicyNode; } for (int i = 0; i < listArr.length; i++) { listArr[i] = new ArrayList(); } return null; } /* JADX INFO: Access modifiers changed from: protected */ public static void processCertD1ii(int i, List[] listArr, ASN1ObjectIdentifier aSN1ObjectIdentifier, Set set) { List list = listArr[i - 1]; for (int i2 = 0; i2 < list.size(); i2++) { PKIXPolicyNode pKIXPolicyNode = (PKIXPolicyNode) list.get(i2); if ("2.5.29.32.0".equals(pKIXPolicyNode.getValidPolicy())) { HashSet hashSet = new HashSet(); hashSet.add(aSN1ObjectIdentifier.getId()); PKIXPolicyNode pKIXPolicyNode2 = new PKIXPolicyNode(new ArrayList(), i, hashSet, pKIXPolicyNode, set, aSN1ObjectIdentifier.getId(), false); pKIXPolicyNode.addChild(pKIXPolicyNode2); listArr[i].add(pKIXPolicyNode2); return; } } } /* JADX INFO: Access modifiers changed from: protected */ public static boolean processCertD1i(int i, List[] listArr, ASN1ObjectIdentifier aSN1ObjectIdentifier, Set set) { List list = listArr[i - 1]; for (int i2 = 0; i2 < list.size(); i2++) { PKIXPolicyNode pKIXPolicyNode = (PKIXPolicyNode) list.get(i2); if (pKIXPolicyNode.getExpectedPolicies().contains(aSN1ObjectIdentifier.getId())) { HashSet hashSet = new HashSet(); hashSet.add(aSN1ObjectIdentifier.getId()); PKIXPolicyNode pKIXPolicyNode2 = new PKIXPolicyNode(new ArrayList(), i, hashSet, pKIXPolicyNode, set, aSN1ObjectIdentifier.getId(), false); pKIXPolicyNode.addChild(pKIXPolicyNode2); listArr[i].add(pKIXPolicyNode2); return true; } } return false; } /* JADX INFO: Access modifiers changed from: protected */ public static PKIXPolicyNode prepareNextCertB2(int i, List[] listArr, String str, PKIXPolicyNode pKIXPolicyNode) { int i2; Iterator it = listArr[i].iterator(); while (it.hasNext()) { PKIXPolicyNode pKIXPolicyNode2 = (PKIXPolicyNode) it.next(); if (pKIXPolicyNode2.getValidPolicy().equals(str)) { ((PKIXPolicyNode) pKIXPolicyNode2.getParent()).removeChild(pKIXPolicyNode2); it.remove(); for (int i3 = i - 1; i3 >= 0; i3--) { List list = listArr[i3]; while (i2 < list.size()) { PKIXPolicyNode pKIXPolicyNode3 = (PKIXPolicyNode) list.get(i2); i2 = (pKIXPolicyNode3.hasChildren() || (pKIXPolicyNode = removePolicyNode(pKIXPolicyNode, listArr, pKIXPolicyNode3)) != null) ? i2 + 1 : 0; } } } } return pKIXPolicyNode; } /* JADX INFO: Access modifiers changed from: protected */ public static void prepareNextCertB1(int i, List[] listArr, String str, Map map, X509Certificate x509Certificate) throws AnnotatedException, CertPathValidatorException { Set set; for (PKIXPolicyNode pKIXPolicyNode : listArr[i]) { if (pKIXPolicyNode.getValidPolicy().equals(str)) { pKIXPolicyNode.setExpectedPolicies((Set) map.get(str)); return; } } for (PKIXPolicyNode pKIXPolicyNode2 : listArr[i]) { if ("2.5.29.32.0".equals(pKIXPolicyNode2.getValidPolicy())) { try { Enumeration objects = DERSequence.getInstance(getExtensionValue(x509Certificate, CERTIFICATE_POLICIES)).getObjects(); while (true) { if (!objects.hasMoreElements()) { set = null; break; } try { PolicyInformation policyInformation = PolicyInformation.getInstance(objects.nextElement()); if ("2.5.29.32.0".equals(policyInformation.getPolicyIdentifier().getId())) { try { set = getQualifierSet(policyInformation.getPolicyQualifiers()); break; } catch (CertPathValidatorException e) { throw new ExtCertPathValidatorException("Policy qualifier info set could not be built.", e); } } } catch (Exception e2) { throw new AnnotatedException("Policy information cannot be decoded.", e2); } } Set set2 = set; boolean contains = x509Certificate.getCriticalExtensionOIDs() != null ? x509Certificate.getCriticalExtensionOIDs().contains(CERTIFICATE_POLICIES) : false; PKIXPolicyNode pKIXPolicyNode3 = (PKIXPolicyNode) pKIXPolicyNode2.getParent(); if ("2.5.29.32.0".equals(pKIXPolicyNode3.getValidPolicy())) { PKIXPolicyNode pKIXPolicyNode4 = new PKIXPolicyNode(new ArrayList(), i, (Set) map.get(str), pKIXPolicyNode3, set2, str, contains); pKIXPolicyNode3.addChild(pKIXPolicyNode4); listArr[i].add(pKIXPolicyNode4); return; } return; } catch (Exception e3) { throw new AnnotatedException("Certificate policies cannot be decoded.", e3); } } } } /* JADX INFO: Access modifiers changed from: protected */ public static boolean isSelfIssued(X509Certificate x509Certificate) { return x509Certificate.getSubjectDN().equals(x509Certificate.getIssuerDN()); } static boolean isIndirectCRL(X509CRL x509crl) throws CRLException { try { byte[] extensionValue = x509crl.getExtensionValue(Extension.issuingDistributionPoint.getId()); if (extensionValue != null) { if (IssuingDistributionPoint.getInstance(ASN1OctetString.getInstance(extensionValue).getOctets()).isIndirectCRL()) { return true; } } return false; } catch (Exception e) { throw new CRLException("Exception reading IssuingDistributionPoint: ".concat(String.valueOf(e))); } } private static boolean isDeltaCRL(X509CRL x509crl) { Set criticalExtensionOIDs = x509crl.getCriticalExtensionOIDs(); if (criticalExtensionOIDs == null) { return false; } return criticalExtensionOIDs.contains(Extension.deltaCRLIndicator.getId()); } /* JADX INFO: Access modifiers changed from: protected */ public static boolean isAnyPolicy(Set set) { return set == null || set.contains("2.5.29.32.0") || set.isEmpty(); } /* JADX INFO: Access modifiers changed from: protected */ public static Date getValidDate(PKIXParameters pKIXParameters) { Date date = pKIXParameters.getDate(); return date == null ? new Date() : date; } protected static Date getValidCertDateFromValidityModel(ExtendedPKIXParameters extendedPKIXParameters, CertPath certPath, int i) throws AnnotatedException { if (extendedPKIXParameters.getValidityModel() == 1 && i > 0) { int i2 = i - 1; if (i2 == 0) { try { byte[] extensionValue = ((X509Certificate) certPath.getCertificates().get(i2)).getExtensionValue(ISISMTTObjectIdentifiers.id_isismtt_at_dateOfCertGen.getId()); ASN1GeneralizedTime aSN1GeneralizedTime = extensionValue != null ? ASN1GeneralizedTime.getInstance(ASN1Primitive.fromByteArray(extensionValue)) : null; if (aSN1GeneralizedTime != null) { try { return aSN1GeneralizedTime.getDate(); } catch (ParseException e) { throw new AnnotatedException("Date from date of cert gen extension could not be parsed.", e); } } } catch (IOException unused) { throw new AnnotatedException("Date of cert gen extension could not be read."); } catch (IllegalArgumentException unused2) { throw new AnnotatedException("Date of cert gen extension could not be read."); } } return ((X509Certificate) certPath.getCertificates().get(i2)).getNotBefore(); } return getValidDate(extendedPKIXParameters); } /* JADX INFO: Access modifiers changed from: protected */ public static X500Principal getSubjectPrincipal(X509Certificate x509Certificate) { return x509Certificate.getSubjectX500Principal(); } private static BigInteger getSerialNumber(Object obj) { return obj instanceof X509Certificate ? ((X509Certificate) obj).getSerialNumber() : ((X509AttributeCertificate) obj).getSerialNumber(); } /* JADX INFO: Access modifiers changed from: protected */ public static final Set getQualifierSet(ASN1Sequence aSN1Sequence) throws CertPathValidatorException { HashSet hashSet = new HashSet(); if (aSN1Sequence == null) { return hashSet; } ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream(); ASN1OutputStream aSN1OutputStream = new ASN1OutputStream(byteArrayOutputStream); Enumeration objects = aSN1Sequence.getObjects(); while (objects.hasMoreElements()) { try { aSN1OutputStream.writeObject((ASN1Encodable) objects.nextElement()); hashSet.add(new PolicyQualifierInfo(byteArrayOutputStream.toByteArray())); byteArrayOutputStream.reset(); } catch (IOException e) { throw new ExtCertPathValidatorException("Policy qualifier info cannot be decoded.", e); } } return hashSet; } private static ASN1Primitive getObject(String str, byte[] bArr) throws AnnotatedException { try { return new ASN1InputStream(((ASN1OctetString) new ASN1InputStream(bArr).readObject()).getOctets()).readObject(); } catch (Exception e) { throw new AnnotatedException("exception processing extension ".concat(String.valueOf(str)), e); } } /* JADX INFO: Access modifiers changed from: protected */ public static PublicKey getNextWorkingKey(List list, int i) throws CertPathValidatorException { DSAPublicKey dSAPublicKey; PublicKey publicKey = ((Certificate) list.get(i)).getPublicKey(); if (!(publicKey instanceof DSAPublicKey)) { return publicKey; } DSAPublicKey dSAPublicKey2 = (DSAPublicKey) publicKey; if (dSAPublicKey2.getParams() != null) { return dSAPublicKey2; } do { i++; if (i >= list.size()) { throw new CertPathValidatorException("DSA parameters cannot be inherited from previous certificate."); } PublicKey publicKey2 = ((X509Certificate) list.get(i)).getPublicKey(); if (!(publicKey2 instanceof DSAPublicKey)) { throw new CertPathValidatorException("DSA parameters cannot be inherited from previous certificate."); } dSAPublicKey = (DSAPublicKey) publicKey2; } while (dSAPublicKey.getParams() == null); DSAParams params = dSAPublicKey.getParams(); try { return KeyFactory.getInstance("DSA", BouncyCastleProvider.PROVIDER_NAME).generatePublic(new DSAPublicKeySpec(dSAPublicKey2.getY(), params.getP(), params.getQ(), params.getG())); } catch (Exception e) { throw new RuntimeException(e.getMessage()); } } /* JADX INFO: Access modifiers changed from: protected */ public static X500Principal getIssuerPrincipal(X509CRL x509crl) { return x509crl.getIssuerX500Principal(); } /* JADX INFO: Access modifiers changed from: protected */ public static ASN1Primitive getExtensionValue(X509Extension x509Extension, String str) throws AnnotatedException { byte[] extensionValue = x509Extension.getExtensionValue(str); if (extensionValue == null) { return null; } return getObject(str, extensionValue); } /* JADX INFO: Access modifiers changed from: protected */ public static X500Principal getEncodedIssuerPrincipal(Object obj) { return obj instanceof X509Certificate ? ((X509Certificate) obj).getIssuerX500Principal() : (X500Principal) ((X509AttributeCertificate) obj).getIssuer().getPrincipals()[0]; } protected static Set getDeltaCRLs(Date date, ExtendedPKIXParameters extendedPKIXParameters, X509CRL x509crl) throws AnnotatedException { X509CRLStoreSelector x509CRLStoreSelector = new X509CRLStoreSelector(); try { x509CRLStoreSelector.addIssuerName(getIssuerPrincipal(x509crl).getEncoded()); try { ASN1Primitive extensionValue = getExtensionValue(x509crl, CRL_NUMBER); BigInteger positiveValue = extensionValue != null ? ASN1Integer.getInstance(extensionValue).getPositiveValue() : null; try { byte[] extensionValue2 = x509crl.getExtensionValue(ISSUING_DISTRIBUTION_POINT); x509CRLStoreSelector.setMinCRLNumber(positiveValue != null ? positiveValue.add(BigInteger.valueOf(1L)) : null); x509CRLStoreSelector.setIssuingDistributionPoint(extensionValue2); x509CRLStoreSelector.setIssuingDistributionPointEnabled(true); x509CRLStoreSelector.setMaxBaseCRLNumber(positiveValue); Set findCRLs = CRL_UTIL.findCRLs(x509CRLStoreSelector, extendedPKIXParameters, date); HashSet hashSet = new HashSet(); for (X509CRL x509crl2 : findCRLs) { if (isDeltaCRL(x509crl2)) { hashSet.add(x509crl2); } } return hashSet; } catch (Exception e) { throw new AnnotatedException("Issuing distribution point extension value could not be read.", e); } } catch (Exception e2) { throw new AnnotatedException("CRL number extension could not be extracted from CRL.", e2); } } catch (IOException e3) { throw new AnnotatedException("Cannot extract issuer from CRL.", e3); } } protected static Set getCompleteCRLs(DistributionPoint distributionPoint, Object obj, Date date, ExtendedPKIXParameters extendedPKIXParameters) throws AnnotatedException { X509CRLStoreSelector x509CRLStoreSelector = new X509CRLStoreSelector(); try { HashSet hashSet = new HashSet(); hashSet.add(obj instanceof X509AttributeCertificate ? ((X509AttributeCertificate) obj).getIssuer().getPrincipals()[0] : getEncodedIssuerPrincipal(obj)); getCRLIssuersFromDistributionPoint(distributionPoint, hashSet, x509CRLStoreSelector, extendedPKIXParameters); if (obj instanceof X509Certificate) { x509CRLStoreSelector.setCertificateChecking((X509Certificate) obj); } else if (obj instanceof X509AttributeCertificate) { x509CRLStoreSelector.setAttrCertificateChecking((X509AttributeCertificate) obj); } x509CRLStoreSelector.setCompleteCRLEnabled(true); Set findCRLs = CRL_UTIL.findCRLs(x509CRLStoreSelector, extendedPKIXParameters, date); if (!findCRLs.isEmpty()) { return findCRLs; } if (obj instanceof X509AttributeCertificate) { StringBuilder sb = new StringBuilder("No CRLs found for issuer \""); sb.append(((X509AttributeCertificate) obj).getIssuer().getPrincipals()[0]); sb.append("\""); throw new AnnotatedException(sb.toString()); } StringBuilder sb2 = new StringBuilder("No CRLs found for issuer \""); sb2.append(((X509Certificate) obj).getIssuerX500Principal()); sb2.append("\""); throw new AnnotatedException(sb2.toString()); } catch (AnnotatedException e) { throw new AnnotatedException("Could not get issuer information from distribution point.", e); } } protected static void getCertStatus(Date date, X509CRL x509crl, Object obj, CertStatus certStatus) throws AnnotatedException { X509CRLEntry revokedCertificate; ASN1Enumerated aSN1Enumerated; try { if (isIndirectCRL(x509crl)) { revokedCertificate = x509crl.getRevokedCertificate(getSerialNumber(obj)); if (revokedCertificate == null) { return; } X500Principal certificateIssuer = revokedCertificate.getCertificateIssuer(); if (certificateIssuer == null) { certificateIssuer = getIssuerPrincipal(x509crl); } if (!getEncodedIssuerPrincipal(obj).equals(certificateIssuer)) { return; } } else if (!getEncodedIssuerPrincipal(obj).equals(getIssuerPrincipal(x509crl)) || (revokedCertificate = x509crl.getRevokedCertificate(getSerialNumber(obj))) == null) { return; } if (revokedCertificate.hasExtensions()) { try { aSN1Enumerated = ASN1Enumerated.getInstance(getExtensionValue(revokedCertificate, org.bouncycastle.asn1.x509.X509Extension.reasonCode.getId())); } catch (Exception e) { throw new AnnotatedException("Reason code CRL entry extension could not be decoded.", e); } } else { aSN1Enumerated = null; } if (date.getTime() >= revokedCertificate.getRevocationDate().getTime() || aSN1Enumerated == null || aSN1Enumerated.getValue().intValue() == 0 || aSN1Enumerated.getValue().intValue() == 1 || aSN1Enumerated.getValue().intValue() == 2 || aSN1Enumerated.getValue().intValue() == 8) { certStatus.setCertStatus(aSN1Enumerated != null ? aSN1Enumerated.getValue().intValue() : 0); certStatus.setRevocationDate(revokedCertificate.getRevocationDate()); } } catch (CRLException e2) { throw new AnnotatedException("Failed check for indirect CRL.", e2); } } protected static void getCRLIssuersFromDistributionPoint(DistributionPoint distributionPoint, Collection collection, X509CRLSelector x509CRLSelector, ExtendedPKIXParameters extendedPKIXParameters) throws AnnotatedException { ArrayList arrayList = new ArrayList(); if (distributionPoint.getCRLIssuer() != null) { GeneralName[] names = distributionPoint.getCRLIssuer().getNames(); for (int i = 0; i < names.length; i++) { if (names[i].getTagNo() == 4) { try { arrayList.add(new X500Principal(names[i].getName().toASN1Primitive().getEncoded())); } catch (IOException e) { throw new AnnotatedException("CRL issuer information from distribution point cannot be decoded.", e); } } } } else { if (distributionPoint.getDistributionPoint() == null) { throw new AnnotatedException("CRL issuer is omitted from distribution point but no distributionPoint field present."); } Iterator it = collection.iterator(); while (it.hasNext()) { arrayList.add((X500Principal) it.next()); } } Iterator it2 = arrayList.iterator(); while (it2.hasNext()) { try { x509CRLSelector.addIssuerName(((X500Principal) it2.next()).getEncoded()); } catch (IOException e2) { throw new AnnotatedException("Cannot decode CRL issuer information.", e2); } } } /* JADX INFO: Access modifiers changed from: protected */ public static AlgorithmIdentifier getAlgorithmIdentifier(PublicKey publicKey) throws CertPathValidatorException { try { return SubjectPublicKeyInfo.getInstance(new ASN1InputStream(publicKey.getEncoded()).readObject()).getAlgorithmId(); } catch (Exception e) { throw new ExtCertPathValidatorException("Subject public key cannot be decoded.", e); } } protected static TrustAnchor findTrustAnchor(X509Certificate x509Certificate, Set set, String str) throws AnnotatedException { X509CertSelector x509CertSelector = new X509CertSelector(); X500Principal encodedIssuerPrincipal = getEncodedIssuerPrincipal(x509Certificate); try { x509CertSelector.setSubject(encodedIssuerPrincipal.getEncoded()); Iterator it = set.iterator(); TrustAnchor trustAnchor = null; Exception e = null; PublicKey publicKey = null; while (it.hasNext() && trustAnchor == null) { trustAnchor = (TrustAnchor) it.next(); if (trustAnchor.getTrustedCert() != null) { if (x509CertSelector.match(trustAnchor.getTrustedCert())) { publicKey = trustAnchor.getTrustedCert().getPublicKey(); } trustAnchor = null; } else { if (trustAnchor.getCAName() != null && trustAnchor.getCAPublicKey() != null) { try { if (encodedIssuerPrincipal.equals(new X500Principal(trustAnchor.getCAName()))) { publicKey = trustAnchor.getCAPublicKey(); } } catch (IllegalArgumentException unused) { } } trustAnchor = null; } if (publicKey != null) { try { verifyX509Certificate(x509Certificate, publicKey, str); } catch (Exception e2) { e = e2; trustAnchor = null; publicKey = null; } } } if (trustAnchor != null || e == null) { return trustAnchor; } throw new AnnotatedException("TrustAnchor found but certificate validation failed.", e); } catch (IOException e3) { throw new AnnotatedException("Cannot set subject search criteria for trust anchor.", e3); } } protected static TrustAnchor findTrustAnchor(X509Certificate x509Certificate, Set set) throws AnnotatedException { return findTrustAnchor(x509Certificate, set, null); } static Collection findIssuerCerts(X509Certificate x509Certificate, List list, List list2) throws AnnotatedException { X509CertSelector x509CertSelector = new X509CertSelector(); try { x509CertSelector.setSubject(x509Certificate.getIssuerX500Principal().getEncoded()); PKIXCertStoreSelector build = new PKIXCertStoreSelector.Builder(x509CertSelector).build(); HashSet hashSet = new HashSet(); try { ArrayList arrayList = new ArrayList(); arrayList.addAll(findCertificates(build, list)); arrayList.addAll(findCertificates(build, list2)); Iterator it = arrayList.iterator(); while (it.hasNext()) { hashSet.add((X509Certificate) it.next()); } return hashSet; } catch (AnnotatedException e) { throw new AnnotatedException("Issuer certificate cannot be searched.", e); } } catch (IOException e2) { throw new AnnotatedException("Subject criteria for certificate selector to find issuer certificate could not be set.", e2); } } protected static Collection findCertificates(X509CertStoreSelector x509CertStoreSelector, List list) throws AnnotatedException { HashSet hashSet = new HashSet(); CertificateFactory certificateFactory = new CertificateFactory(); for (Object obj : list) { if (obj instanceof Store) { try { for (Object obj2 : ((Store) obj).getMatches(x509CertStoreSelector)) { if (obj2 instanceof Encodable) { obj2 = certificateFactory.engineGenerateCertificate(new ByteArrayInputStream(((Encodable) obj2).getEncoded())); } else if (!(obj2 instanceof Certificate)) { throw new AnnotatedException("Unknown object found in certificate store."); } hashSet.add(obj2); } } catch (IOException e) { throw new AnnotatedException("Problem while extracting certificates from X.509 store.", e); } catch (CertificateException e2) { throw new AnnotatedException("Problem while extracting certificates from X.509 store.", e2); } catch (StoreException e3) { throw new AnnotatedException("Problem while picking certificates from X.509 store.", e3); } } else { try { hashSet.addAll(((CertStore) obj).getCertificates(x509CertStoreSelector)); } catch (CertStoreException e4) { throw new AnnotatedException("Problem while picking certificates from certificate store.", e4); } } } return hashSet; } protected static Collection findCertificates(X509AttributeCertStoreSelector x509AttributeCertStoreSelector, List list) throws AnnotatedException { HashSet hashSet = new HashSet(); for (Object obj : list) { if (obj instanceof X509Store) { try { hashSet.addAll(((X509Store) obj).getMatches(x509AttributeCertStoreSelector)); } catch (StoreException e) { throw new AnnotatedException("Problem while picking certificates from X.509 store.", e); } } } return hashSet; } protected static Collection findCertificates(PKIXCertStoreSelector pKIXCertStoreSelector, List list) throws AnnotatedException { HashSet hashSet = new HashSet(); for (Object obj : list) { if (obj instanceof Store) { try { hashSet.addAll(((Store) obj).getMatches(pKIXCertStoreSelector)); } catch (StoreException e) { throw new AnnotatedException("Problem while picking certificates from X.509 store.", e); } } else { try { hashSet.addAll(PKIXCertStoreSelector.getCertificates(pKIXCertStoreSelector, (CertStore) obj)); } catch (CertStoreException e2) { throw new AnnotatedException("Problem while picking certificates from certificate store.", e2); } } } return hashSet; } protected static void addAdditionalStoresFromCRLDistributionPoint(CRLDistPoint cRLDistPoint, ExtendedPKIXParameters extendedPKIXParameters) throws AnnotatedException { if (cRLDistPoint != null) { try { for (DistributionPoint distributionPoint : cRLDistPoint.getDistributionPoints()) { DistributionPointName distributionPoint2 = distributionPoint.getDistributionPoint(); if (distributionPoint2 != null && distributionPoint2.getType() == 0) { GeneralName[] names = GeneralNames.getInstance(distributionPoint2.getName()).getNames(); for (int i = 0; i < names.length; i++) { if (names[i].getTagNo() == 6) { addAdditionalStoreFromLocation(DERIA5String.getInstance(names[i].getName()).getString(), extendedPKIXParameters); } } } } } catch (Exception e) { throw new AnnotatedException("Distribution points could not be read.", e); } } } protected static void addAdditionalStoresFromAltNames(X509Certificate x509Certificate, ExtendedPKIXParameters extendedPKIXParameters) throws CertificateParsingException { if (x509Certificate.getIssuerAlternativeNames() != null) { for (List list : x509Certificate.getIssuerAlternativeNames()) { if (list.get(0).equals(Integers.valueOf(6))) { addAdditionalStoreFromLocation((String) list.get(1), extendedPKIXParameters); } } } } protected static void addAdditionalStoreFromLocation(String str, ExtendedPKIXParameters extendedPKIXParameters) { String obj; String str2; if (extendedPKIXParameters.isAdditionalLocationsEnabled()) { try { if (str.startsWith("ldap://")) { String substring = str.substring(7); if (substring.indexOf("/") != -1) { str2 = substring.substring(substring.indexOf("/")); StringBuilder sb = new StringBuilder("ldap://"); sb.append(substring.substring(0, substring.indexOf("/"))); obj = sb.toString(); } else { StringBuilder sb2 = new StringBuilder("ldap://"); sb2.append(substring); obj = sb2.toString(); str2 = null; } X509LDAPCertStoreParameters build = new X509LDAPCertStoreParameters.Builder(obj, str2).build(); extendedPKIXParameters.addAdditionalStore(X509Store.getInstance("CERTIFICATE/LDAP", build, BouncyCastleProvider.PROVIDER_NAME)); extendedPKIXParameters.addAdditionalStore(X509Store.getInstance("CRL/LDAP", build, BouncyCastleProvider.PROVIDER_NAME)); extendedPKIXParameters.addAdditionalStore(X509Store.getInstance("ATTRIBUTECERTIFICATE/LDAP", build, BouncyCastleProvider.PROVIDER_NAME)); extendedPKIXParameters.addAdditionalStore(X509Store.getInstance("CERTIFICATEPAIR/LDAP", build, BouncyCastleProvider.PROVIDER_NAME)); } } catch (Exception unused) { throw new RuntimeException("Exception adding X.509 stores."); } } } }