Class QWACValidator

java.lang.Object

eu.europa.esig.dss.validation.AbstractCertificateValidator<CertificateReports, CertificateProcessExecutor>

eu.europa.esig.dss.validation.qwac.QWACValidator

All Implemented Interfaces:

ProcessExecutorProvider<CertificateProcessExecutor>

public class QWACValidator
extends AbstractCertificateValidator<CertificateReports, CertificateProcessExecutor>

This class performs a validation of a TLS/SSL certificate as per ETSI TS 119 411-5 "Policy and security requirements for Trust Service Providers issuing certificates; Part 5: Implementation of qualified certificates for website authentication as in amended Regulation 910/2014"

Field Summary

Fields inherited from class AbstractCertificateValidator

certificateVerifier, defaultDigestAlgorithm, identifierProvider, locale, processExecutor, tokenExtractionStrategy, validationContextExecutor, validationTime

Method Summary

Modifier and Type	Method	Description
protected void	assertResponseValid(ResponseEnvelope response)	Verifies whether the response is valid and contains the information required to continue the QWAC validation process
protected ResponseEnvelope	connectToUrl()	Connects to the url
protected DiagnosticDataBuilder	createDiagnosticDataBuilder(ValidationContext validationContext, SignedDocumentValidator signedDocumentValidator, CertificateToken tlsCertificate, String tlsCertificateBindingUrl, AdvancedSignature signature)	Creates and configures a new DiagnosticDataBuilder
static QWACValidator	fromUrl(String url)	Instantiates a new QWAC Validator to verify the TSL/SSL certificate from the specified url.
static QWACValidator	fromUrlAndCertificate(String url, CertificateToken certificateToken)	Instantiates a new QWAC Validator to verify the provided TSL/SSL certificateToken against the specified url.
protected AdvancedDataLoader	getDataLoader()	Gets the data loader to be used for accessing the information from remote sources.
CertificateProcessExecutor	getDefaultProcessExecutor()	Returns a default for a validator process executor
protected String	getDefaultValidationPolicyPath()	Returns the default validation policy path
protected CertificateVerifier	getOfflineCertificateVerifier()	Builds a complete copy of the CertificateVerifier for the offline validation
protected DiagnosticDataBuilder	initDiagnosticDataBuilder()	Instantiates a new DiagnosticDataBuilder
protected DiagnosticDataBuilder	prepareDiagnosticDataBuilder()	Creates a DiagnosticDataBuilder
protected ValidationContext	prepareValidationContext(CertificateToken tlsCertificate, List<CertificateToken> otherTlsCertificates, AdvancedSignature signature)	This method is used to prepare a ValidationContext using the configuration and provided data objects
protected CertificateProcessExecutor	provideProcessExecutorInstance()	Gets the ProcessExecutor
protected String	readTLSCertificateBindingUrl(ResponseEnvelope responseEnvelope)	This method reads the HTTP response headers and extracts the value of the "Link" header with a "rel" value of "tls-certificate-binding".
void	setDataLoader(AdvancedDataLoader dataLoader)	Sets a data loader used to establish TLS/SSL connection and retrieve any related information over.

Methods inherited from class AbstractCertificateValidator

assertConfigurationValid, createDiagnosticDataBuilder, createValidationContext, fromDefaultCertificateValidationPolicyLoader, getDiagnosticData, getValidationTime, loadValidationPolicy, prepareValidationContext, setCertificateVerifier, setDefaultDigestAlgorithm, setLocale, setProcessExecutor, setTokenExtractionStrategy, setTokenIdentifierProvider, setValidationContextExecutor, setValidationTime, validate, validate, validate, validate, validate, validate, validate, validate, validate, validate, validate, validate, validateContext

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

getDataLoader

protected AdvancedDataLoader getDataLoader()

Gets the data loader to be used for accessing the information from remote sources. If not defined with a setter, the method instantiates a NativeHTTPDataLoader by default.

Returns:

AdvancedDataLoader

setDataLoader

public void setDataLoader(AdvancedDataLoader dataLoader)

Sets a data loader used to establish TLS/SSL connection and retrieve any related information over. If not set, a default instance of NativeHTTPDataLoader will be used for remote calls, if any.

Parameters:

dataLoader - AdvancedDataLoader

fromUrl

public static QWACValidator fromUrl(String url)

Instantiates a new QWAC Validator to verify the TSL/SSL certificate from the specified url. When loaded with this method, QWACValidator will perform a request to the remote url to retrieve the actual TSL/SSL certificate and perform its validation.

Parameters:

url - String to validate a used TSL/SSL certificate from

Returns:

QWACValidator

fromUrlAndCertificate

public static QWACValidator fromUrlAndCertificate(String url,
 CertificateToken certificateToken)

Instantiates a new QWAC Validator to verify the provided TSL/SSL certificateToken against the specified url. When loaded with this method, QWACValidator will validate the provided certificateToken whether it can be used as a QWAC TSL/SSL certificate for the url.

Parameters:

url - String to validate the TSL/SSL certificate against

certificateToken - CertificateToken representing a TSL/SSL certificate to be validated

Returns:

QWACValidator

prepareDiagnosticDataBuilder

protected DiagnosticDataBuilder prepareDiagnosticDataBuilder()

Description copied from class: AbstractCertificateValidator

Creates a DiagnosticDataBuilder

Overrides:

prepareDiagnosticDataBuilder in class AbstractCertificateValidator<CertificateReports, CertificateProcessExecutor>

Returns:

DiagnosticDataBuilder

connectToUrl

protected ResponseEnvelope connectToUrl()

Connects to the url

Returns:

ResponseEnvelope containing metadata and context received from the server

prepareValidationContext

protected ValidationContext prepareValidationContext(CertificateToken tlsCertificate,
 List<CertificateToken> otherTlsCertificates,
 AdvancedSignature signature)

This method is used to prepare a ValidationContext using the configuration and provided data objects

Parameters:

tlsCertificate - CertificateToken used to establish the secure TLS/SSL connection

otherTlsCertificates - a list of TLS/SSL CertificateTokens returned by a server

signature - AdvancedSignature TLS Certificate Binding signature, when present

Returns:

ValidationContext

readTLSCertificateBindingUrl

protected String readTLSCertificateBindingUrl(ResponseEnvelope responseEnvelope)

This method reads the HTTP response headers and extracts the value of the "Link" header with a "rel" value of "tls-certificate-binding".

Parameters:

responseEnvelope - ResponseEnvelope to process

Returns:

System TSL Certificate Binding URL, when present

assertResponseValid

protected void assertResponseValid(ResponseEnvelope response)

Verifies whether the response is valid and contains the information required to continue the QWAC validation process

Parameters:

response - ResponseEnvelope

createDiagnosticDataBuilder

protected DiagnosticDataBuilder createDiagnosticDataBuilder(ValidationContext validationContext,
 SignedDocumentValidator signedDocumentValidator,
 CertificateToken tlsCertificate,
 String tlsCertificateBindingUrl,
 AdvancedSignature signature)

Creates and configures a new DiagnosticDataBuilder

Parameters:

validationContext - ValidationContext

signedDocumentValidator - SignedDocumentValidator used to validate a signature

tlsCertificate - CertificateToken used to establish a TLS/SSL connection

tlsCertificateBindingUrl - String TLS Certificate Binding URL, when present

signature - AdvancedSignature TLS Certificate Binding signature, when present

Returns:

DiagnosticDataBuilder

getOfflineCertificateVerifier

protected CertificateVerifier getOfflineCertificateVerifier()

Builds a complete copy of the CertificateVerifier for the offline validation

Returns:

CertificateVerifier

initDiagnosticDataBuilder

protected DiagnosticDataBuilder initDiagnosticDataBuilder()

Description copied from class: AbstractCertificateValidator

Instantiates a new DiagnosticDataBuilder

Overrides:

initDiagnosticDataBuilder in class AbstractCertificateValidator<CertificateReports, CertificateProcessExecutor>

Returns:

DiagnosticDataBuilder

getDefaultValidationPolicyPath

protected String getDefaultValidationPolicyPath()

Description copied from class: AbstractCertificateValidator

Returns the default validation policy path

Specified by:

getDefaultValidationPolicyPath in class AbstractCertificateValidator<CertificateReports, CertificateProcessExecutor>

Returns:

String

provideProcessExecutorInstance

protected CertificateProcessExecutor provideProcessExecutorInstance()

Description copied from class: AbstractCertificateValidator

Gets the ProcessExecutor

Specified by:

provideProcessExecutorInstance in class AbstractCertificateValidator<CertificateReports, CertificateProcessExecutor>

Returns:

ProcessExecutor

getDefaultProcessExecutor

public CertificateProcessExecutor getDefaultProcessExecutor()

Description copied from interface: ProcessExecutorProvider

Returns a default for a validator process executor

Returns:

Process Executor