Verifies that a certificate chain is valid

@param chain
a certificate chain with the root certificate first

@throws IllegalArgumentException
if the chain is invalid, null or empty
17490
public static void verifyChain(List<X509Certificate> chain)
	{
		if (chain == null || chain.isEmpty())
			throw new IllegalArgumentException("Must provide a chain that is non-null and non-empty");

		for (int i = 0; i < chain.size(); i++)
		{
			final X509Certificate certificate = chain.get(i);
			final int issuerIndex = (i != 0) ?
			                        i - 1 :
			                        0; // The index of the issuer is the previous cert (& the root must, of course, sign itself)
			final X509Certificate issuer = chain.get(issuerIndex);

			// Verify the certificate was indeed issued by the previous certificate in the chain
			try
			{
				certificate.verify(issuer.getPublicKey());
			}
			catch (GeneralSecurityException e)
			{
				final String msg = "Failure verifying " + certificate + " against claimed issuer " + issuer;

				throw new IllegalArgumentException(msg + ": " + e.getMessage(), e);
			}
		}
	}
68994
boolean validateCertificate(byte[] certPEM) {

        if (certPEM == null) {
            return false;
        }

        try {

            X509Certificate certificate = getX509Certificate(certPEM);
            if (null == certificate) {
                throw new Exception("Certificate transformation returned null");
            }

            return validateCertificate(certificate);
        } catch (Exception e) {
            logger.error("Cannot validate certificate. Error is: " + e.getMessage() + "\r\nCertificate (PEM, hex): "
                    + DatatypeConverter.printHexBinary(certPEM));
            return false;
        }
    }
639094
public void setChaincodeName(String chaincodeName) throws InvalidArgumentException {
        if (Utils.isNullOrEmpty(chaincodeName)) {
            throw new InvalidArgumentException("The chaincodeName parameter can not be null or empty.");
        }
        this.chaincodeName = chaincodeName;
    }
964548
public void checkClientTrusted(X509Certificate[] chain, String authType)
                 throws CertificateException {
         try {
             pkixTrustManager.checkClientTrusted(chain, authType);
         } catch (CertificateException excep) {
             // do any special handling here, or rethrow exception.
         }
     }
658057
public void setChaincodeEndorsementPolicy(LifecycleChaincodeEndorsementPolicy lifecycleChaincodeEndorsementPolicy) throws InvalidArgumentException {
        if (null == lifecycleChaincodeEndorsementPolicy) {
            throw new InvalidArgumentException("The parameter lifecycleChaincodeEndorsementPolicy may not be null.");
        }
        this.validationParameter = lifecycleChaincodeEndorsementPolicy.getByteString();
    }
1245848
protected BundleHashcodeType isValidBundle(String requestedPath) {
		BundleHashcodeType bundleHashcodeType = BundleHashcodeType.VALID_HASHCODE;
		if (!jawrConfig.isDebugModeOn()) {
			bundleHashcodeType = bundlesHandler.getBundleHashcodeType(requestedPath);
		}
		return bundleHashcodeType;
	}
157993
private void verifyCert(X500Name subject,
        CertificateExtensions extensions)
        throws CertificateParsingException, IOException {

        // if SubjectName is empty, check for SubjectAlternativeNameExtension
        if (subject.isEmpty()) {
            if (extensions == null) {
                throw new CertificateParsingException("X.509 Certificate is " +
                        "incomplete: subject field is empty, and certificate " +
                        "has no extensions");
            }
            SubjectAlternativeNameExtension subjectAltNameExt = null;
            SubjectAlternativeNameExtension extValue = null;
            GeneralNames names = null;
            try {
                subjectAltNameExt = (SubjectAlternativeNameExtension)
                        extensions.get(SubjectAlternativeNameExtension.NAME);
                names = subjectAltNameExt.get(
                        SubjectAlternativeNameExtension.SUBJECT_NAME);
            } catch (IOException e) {
                throw new CertificateParsingException("X.509 Certificate is " +
                        "incomplete: subject field is empty, and " +
                        "SubjectAlternativeName extension is absent");
            }

            // SubjectAlternativeName extension is empty or not marked critical
            if (names == null || names.isEmpty()) {
                throw new CertificateParsingException("X.509 Certificate is " +
                        "incomplete: subject field is empty, and " +
                        "SubjectAlternativeName extension is empty");
            } else if (subjectAltNameExt.isCritical() == false) {
                throw new CertificateParsingException("X.509 Certificate is " +
                        "incomplete: SubjectAlternativeName extension MUST " +
                        "be marked critical when subject field is empty");
            }
        }
    }
859937
@Override
    public synchronized void startChain(ChainData chain) throws ChannelException, ChainException {
        String chainName = (null != chain) ? chain.getName() : null;
        if (TraceComponent.isAnyTracingEnabled() && tc.isEntryEnabled()) {
            Tr.entry(tc, "startChain: " + chainName);
        }
        if (null == chain) {
            throw new InvalidChainNameException("Null chain");
        }

        // Ensure we have an inbound chain.
        if (FlowType.OUTBOUND.equals(chain.getType())) {
            throw new InvalidChainNameException("Outbound chain cannot use this interface.");
        }

        startChainInternal(chain);

        if (TraceComponent.isAnyTracingEnabled() && tc.isEntryEnabled()) {
            Tr.exit(tc, "startChain");
        }
    }
207857
public void validate() throws IllegalArgumentException, IllegalAccessException {
        for (Field field : getClass().getDeclaredFields()) {
            if (CatalogType.class.isAssignableFrom(field.getType())) {
                CatalogType ct = (CatalogType) field.get(this);
                assert(ct.getCatalog() == getCatalog()) : ct.getCatalogPath() + " has wrong catalog";
            }
            if (CatalogReference.class.isAssignableFrom(field.getType())) {
                @SuppressWarnings("unchecked")
                CatalogReference<? extends CatalogType> cr = (CatalogReference<? extends CatalogType>) field.get(this);
                if (cr.m_value != null) {
                    assert(cr.m_value.getCatalog() == getCatalog()) : cr.m_value.getCatalogPath() + " has wrong catalog";
                }
            }
            if (CatalogMap.class.isAssignableFrom(field.getClass())) {
                @SuppressWarnings("unchecked")
                CatalogMap<? extends CatalogType> cm = (CatalogMap<? extends CatalogType>) field.get(this);
                for (CatalogType ct : cm) {
                    assert(ct.getCatalog() == getCatalog()) : ct.getCatalogPath() + " has wrong catalog";
                    ct.validate();
                }
            }
        }
    }
700967
@Override
    public void check(Certificate cert, Collection<String> unresCritExts)
        throws CertPathValidatorException
    {
        X509Certificate currCert = (X509Certificate)cert;

        remainingCerts--;

        // if final certificate, check that target constraints are satisfied
        if (remainingCerts == 0) {
            if (targetConstraints != null &&
                targetConstraints.match(currCert) == false) {
                throw new CertPathValidatorException("target certificate " +
                    "constraints check failed");
            }
        } else {
            // otherwise, verify that keyCertSign bit is set in CA certificate
            verifyCAKeyUsage(currCert);
        }

        // remove the extensions that we have checked
        if (unresCritExts != null && !unresCritExts.isEmpty()) {
            unresCritExts.remove(KeyUsage_Id.toString());
            unresCritExts.remove(ExtendedKeyUsage_Id.toString());
            unresCritExts.remove(SubjectAlternativeName_Id.toString());
        }
    }
1056943
def verify_cert(self):
        '''
        
        '''
        log.debug('Verifying the %s certificate, keyfile: %s',
                  self.certificate, self.keyfile)
        try:
            ssl.create_default_context().load_cert_chain(self.certificate, keyfile=self.keyfile)
        except ssl.SSLError:
            error_string = 'SSL certificate and key do not match'
            log.error(error_string)
            raise SSLMismatchException(error_string)
        except IOError:
            log.error('Unable to open either certificate or key file')
            raise
        log.debug('Certificate looks good.')
1046785
public static X500Principal[] getIssuerDNsFromChain(List<X509Certificate> chain)
	{
		if (chain == null || chain.isEmpty())
			throw new IllegalArgumentException("Must provide a chain that is non-null and non-empty");

		// Given a chain of n, there are n-1 values for "issuers" and 1 "subject"
		final X500Principal[] issuers = new X500Principal[chain.size() - 1]; // Allocate array of n-1 for issuers

		for (int i = 0; i < issuers.length; i++)
		{
			final X509Certificate certificate = chain.get(i);
			final X500Principal subject = certificate.getSubjectX500Principal();

			issuers[i] = subject;
		}

		return issuers;
	}
429693
private void setExchangeRateChain(List<ExchangeRate> chain) {
        this.chain.clear();
        if (chain==null || chain.isEmpty()) {
            this.chain.add(this);
        } else {
            for (ExchangeRate rate : chain) {
                if (rate==null) {
                    throw new IllegalArgumentException("Rate Chain element can not be null.");
                }
            }
            this.chain.addAll(chain);
        }
    }
971930
public void setChaincodeValidationPlugin(String chaincodeValidationPlugin) throws InvalidArgumentException {
        if (Utils.isNullOrEmpty(chaincodeValidationPlugin)) {
            throw new InvalidArgumentException("The getChaincodeValidationPlugin parameter can not be null or empty.");
        }
        this.chaincodeValidationPlugin = chaincodeValidationPlugin;
    }
252215
public void saveCertificateChain(OutputStream out) throws IOException, CertificateEncodingException {

        CertificateIOUtil.writeCertificate(out, this.certChain[0]);

        for (int i = 1; i < this.certChain.length; i++) {
            // skip the self-signed certificates
            if (this.certChain[i].getSubjectDN().equals(certChain[i].getIssuerDN())) {
                continue;
            }
            CertificateIOUtil.writeCertificate(out, this.certChain[i]);
        }
        out.flush();
    }
1346453
private static Chain isKnownChain(String chainID, List<Chain> chains){

		for (int i = 0; i< chains.size();i++){
			Chain testchain =  chains.get(i);
			if (chainID.equals(testchain.getName())) {
				return testchain;
			}
		}

		return null;
	}
565601
@Override
    public synchronized void destroyChain(ChainData chaindata) throws ChannelException, ChainException {
        String chainName = (null != chaindata) ? chaindata.getName() : null;
        if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
            Tr.debug(tc, "destroyChain: " + chainName);
        }

        if (null == chaindata) {
            throw new InvalidChainNameException("Null chain");
        }
        // Ensure we have an inbound chain.
        if (FlowType.OUTBOUND.equals(chaindata.getType())) {
            throw new InvalidChainNameException("Outbound chain cannot use this interface.");
        }

        // Verify the chain is in the runtime.
        Chain chain = getRunningChain(chainName);
        if (null == chain) {
            // Due to timing windows (i.e. multiple channel providers going away), there is
            // a race to destroy chains. This is not a notable condition: the chain can only be destroyed
            // once.
            if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
                Tr.debug(tc, "destroyChain: " + chainName + " does not exist -- may already have been destroyed");
            }
            return;
        }

        destroyChainInternal(chain);
    }