Class SignedMailValidator

java.lang.Object
org.bouncycastle.mail.smime.validator.SignedMailValidator
public class SignedMailValidator extends Object

  • Constructor Details

    • SignedMailValidator

      public SignedMailValidator(javax.mail.internet.MimeMessage message, PKIXParameters param) throws SignedMailValidatorException
      Validates the signed MimeMessage message. The PKIXParameters from param are used for the certificate path validation. The actual PKIXParameters used for the certificate path validation are a copy of param with the following changes:
      - If param has no validation date set, the validation date is changed to the signature time (the CMS signingTime attribute, or the current time if none is present).
      - A CertStore with certificates and CRLs from the mail message is added to the CertStores.

      In param it's also possible to add additional CertStores with intermediate certificates and/or CRLs which then are also used for the validation.
      Security note: the CMS signingTime attribute is asserted by the signer and, absent a trusted timestamp, is not authenticated. Using it as the validation date means certificate expiry and revocation are evaluated at a signer-chosen instant, so a signature back-dated to before a key's revocation or expiry would otherwise be accepted. A caller that requires a trusted validation instant should set it explicitly via PKIXParameters.setDate(Date); a date set on param takes precedence over the signing time.
      Parameters:
      message - the signed MimeMessage.
      param - the parameters for the certificate path validation.
      Throws:
      SignedMailValidatorException - if the message is not a signed message or if an exception occurs reading the message.

    • SignedMailValidator

      public SignedMailValidator(javax.mail.internet.MimeMessage message, PKIXParameters param, Class certPathReviewerClass) throws SignedMailValidatorException
      Validates the signed MimeMessage message. The PKIXParameters from param are used for the certificate path validation. The actual PKIXParameters used for the certificate path validation are a copy of param with the following changes:
      - If param has no validation date set, the validation date is changed to the signature time (the CMS signingTime attribute, or the current time if none is present).
      - A CertStore with certificates and CRLs from the mail message is added to the CertStores.

      In param it's also possible to add additional CertStores with intermediate certificates and/or CRLs which then are also used for the validation.
      Security note: the CMS signingTime attribute is asserted by the signer and, absent a trusted timestamp, is not authenticated. Using it as the validation date means certificate expiry and revocation are evaluated at a signer-chosen instant, so a signature back-dated to before a key's revocation or expiry would otherwise be accepted. A caller that requires a trusted validation instant should set it explicitly via PKIXParameters.setDate(Date); a date set on param takes precedence over the signing time.
      Parameters:
      message - the signed MimeMessage.
      param - the parameters for the certificate path validation.
      certPathReviewerClass - a subclass of PKIXCertPathReviewer. The SignedMailValidator uses objects of this type for the cert path vailidation. The class must have an empty constructor.
      Throws:
      SignedMailValidatorException - if the message is not a signed message or if an exception occurs reading the message.
      IllegalArgumentException - if the certPathReviewerClass is not a subclass of PKIXCertPathReviewer or objects of certPathReviewerClass can not be instantiated.

  • Method Details