Certificate validation against multiple certificate chain

Question

Hello everyone,
I would like to have your opinion on a specific use case of the java.security.cert API.
I've a set of trusted certificate chains provided in a trusted way by a CA. An example of a chain would be: R->I1->I2, R being a root certificate and I1/I2 being intermediates CAs.
I receive messages from some untrusted sources. These message are signed using some end-user certificate, let's call it U. The certificate U is only transmitted along the message (ie. it's not available from a trusted source).
Verifying the validity of the signed message is therefore a two step process:
- Check that the signature made by U is valid.
- Check that a valid certificate path could be build from U (querying a CRL if needed) back to a trusted anchor, such as R->I1->I2->U.
Now, my question is, how to efficiently achieve the latter one with the java.security.cert API?
The most straightforward way i've found so far to validate a certificate against a set of certificate chain is to use the CertPathBuilder interface:
1) I build a CertStore (of type "Collection") with all my trusted certificate chain in it.
2) I add the received U certificate to the store.
3) I try to build a certificate path specifying "U" as the target certificate in the search constraints (X509CertSelector).
If the algorithm find a valid path, it returns it, and U could possibly be kept in the store for future use.
If no valid path could be deduced, U is removed from the store, and a corresponding error is returned.
This sounds like a good way of doing ?
All suggestions are most welcome,
Thanks,
M. H.

Answer 1

Ok, I think I've found my solution.
Actually, if you specify a target certificate using the X509CertSelector.setCertificate methode, the said certificate don't have to be in a CertStore in order to perform the validation:
// the 'store' variable contains only the trusted certificate chains.
CertStore store = CertStore.getInstance("Collection",
          new CollectionCertStoreParameters(certCol));
CertPathBuilder cpb = CertPathBuilder.getInstance("PKIX");
X509CertSelector targetConstraints = new X509CertSelector();
targetConstraints.setCertificate(userCertificate);
PKIXBuilderParameters params = new PKIXBuilderParameters(anchors, targetConstraints);
params.addCertStore(store);
/* params.setRevocationEnabled(false); */ // If needed.
PKIXCertPathBuilderResult result = (PKIXCertPathBuilderResult) cpb.build(params);
CertPath path = result.getCertPath();This is it, on validation, the "path" variable will contains the complete certificate chain including the tested certificate.
I've still a problem with OCSP validations though, but i'll create a new topic for that...
Thank you for your time, ejp,
++
Edited by: marc_h on May 14, 2010 5:54 AM