Class X509CertificateReviewer

java.lang.Object

org.bouncycastle.cert.X509CertificateReviewer

public class X509CertificateReviewer
extends Object

Collects the problems found while decoding an X.509 certificate, instead of throwing on the first one, for diagnostic and reporting use (github #1508).

The strict decode path - X509CertificateHolder, Certificate.getInstance(...) and the underlying ASN.1 types - deliberately fails fast and is unchanged. This reviewer re-invokes those same strict decoders at a finer granularity inside a catch-and-continue harness: a failure in one component is recorded as a X509CertificateReviewer.Finding rather than aborting the whole parse, so problems in sibling components are not masked. Nothing here relaxes a check or admits a certificate the strict path would reject - when any component fails, the recovered X509CertificateHolder is null and the reasons are listed in X509CertificateReviewer.Review.getFindings().

This is the lightweight, JCA-free counterpart to the validation-side PKIXCertPathReviewer: a reporting layer over the parser, not a permissive parser.

Granularity: problems are localised to the three top-level certificate components - tbsCertificate, signatureAlgorithm and signature - and, within the tbsCertificate, every repeated/malformed extension is reported individually at tbsCertificate.extensions (the extensions sub-parse returns its problems grouped in an AggregateRuntimeException, which this reviewer expands). The tbsCertificate and its extensions are enumerated via the shared collect-all parse (TBSCertificate.reviewStructure / Extensions.reviewStructure), so the strict constructor and this reviewer apply exactly the same rules from a single source. Localising each remaining individual tbsCertificate scalar field (serialNumber, validity, ...) rather than reporting the first such failure is a possible further refinement.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static class	X509CertificateReviewer.Finding	A single problem found during review.
static class	X509CertificateReviewer.Review	The outcome of a review: the list of findings, plus the recovered certificate when the structure decoded cleanly.
static enum	X509CertificateReviewer.Severity	The severity of a X509CertificateReviewer.Finding.

Constructor Summary

Constructors

Constructor	Description
X509CertificateReviewer()

Method Summary

Modifier and Type	Method	Description
static X509CertificateReviewer.Review	reviewStructure(byte[] encoding)	Review a DER/BER encoded certificate.
static X509CertificateReviewer.Review	reviewStructure(org.bouncycastle.asn1.ASN1Sequence certificateSequence)	Review an already-decoded certificate SEQUENCE.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

X509CertificateReviewer

public X509CertificateReviewer()

Method Details

reviewStructure

public static X509CertificateReviewer.Review reviewStructure(byte[] encoding)

Review a DER/BER encoded certificate.

Parameters:

encoding - the candidate certificate bytes.

Returns:

the review outcome; never null, never throws for malformed input.

reviewStructure

public static X509CertificateReviewer.Review reviewStructure(org.bouncycastle.asn1.ASN1Sequence certificateSequence)

Review an already-decoded certificate SEQUENCE.

Parameters:

certificateSequence - the candidate Certificate SEQUENCE.

Returns:

the review outcome; never null, never throws.