Check certificate issuer.

@param ValidatorState $state
@param Certificate $cert
@throws PathValidationException
506699
private function _checkIssuer(ValidatorState $state, Certificate $cert)
    {
        if (!$cert->tbsCertificate()
            ->issuer()
            ->equals($state->workingIssuerName())) {
            throw new PathValidationException("Certification issuer mismatch.");
        }
    }
1243873
public static void validateSslCertificate() {
        final NetworkHttpClient client = new NetworkHttpClient();
        final Request request = new Request(HttpMethod.GET, "https://api.twilio.com:8443");

        try {
            final Response response = client.makeRequest(request);

            if (!TwilioRestClient.SUCCESS.apply(response.getStatusCode())) {
                throw new CertificateValidationException(
                    "Unexpected response from certificate endpoint", request, response
                );
            }
        } catch (final ApiException e) {
            throw new CertificateValidationException("Could not get response from certificate endpoint", request);
        }
    }
1148895
private function _prepareNameConstraints(ValidatorState $state,
        Certificate $cert): ValidatorState
    {
        $extensions = $cert->tbsCertificate()->extensions();
        if ($extensions->hasNameConstraints()) {
            $state = $this->_processNameConstraints($state, $cert);
        }
        return $state;
    }
1018477
private function _checkValidity(Certificate $cert)
    {
        $refdt = $this->_config->dateTime();
        $validity = $cert->tbsCertificate()->validity();
        if ($validity->notBefore()
            ->dateTime()
            ->diff($refdt)->invert) {
            throw new PathValidationException(
                "Certificate validity period has not started.");
        }
        if ($refdt->diff($validity->notAfter()
            ->dateTime())->invert) {
            throw new PathValidationException("Certificate has expired.");
        }
    }
27037
public function isIssuedBy(Certificate $cert): bool
    {
        if (!$this->_acinfo->issuer()->identifiesPKC($cert)) {
            return false;
        }
        return true;
    }
581511
private static boolean issues(X509CertImpl cert, X509CRLImpl crl,
                                  String provider) throws IOException
    {
        boolean matched = false;

        AdaptableX509CertSelector issuerSelector =
                                    new AdaptableX509CertSelector();

        // check certificate's key usage
        boolean[] usages = cert.getKeyUsage();
        if (usages != null) {
            usages[6] = true;       // cRLSign
            issuerSelector.setKeyUsage(usages);
        }

        // check certificate's subject
        X500Principal crlIssuer = crl.getIssuerX500Principal();
        issuerSelector.setSubject(crlIssuer);

        /*
         * Facilitate certification path construction with authority
         * key identifier and subject key identifier.
         *
         * In practice, conforming CAs MUST use the key identifier method,
         * and MUST include authority key identifier extension in all CRLs
         * issued. [section 5.2.1, RFC 2459]
         */
        AuthorityKeyIdentifierExtension crlAKID = crl.getAuthKeyIdExtension();
        if (crlAKID != null) {
            issuerSelector.parseAuthorityKeyIdentifierExtension(crlAKID);
        }

        matched = issuerSelector.match(cert);

        // if AKID is unreliable, verify the CRL signature with the cert
        if (matched && (crlAKID == null ||
                cert.getAuthorityKeyIdentifierExtension() == null)) {
            try {
                crl.verify(cert.getPublicKey(), provider);
                matched = true;
            } catch (GeneralSecurityException e) {
                matched = false;
            }
        }

        return matched;
    }
740079
private function verifyCert(Request $request, string $certData)
    {
        if (1 !== @openssl_verify($request->amazonRequestBody, base64_decode($request->signature, true), $certData, 'sha1')) {
            throw new RequestInvalidSignatureException('Cert ssl verification failed.');
        }
    }
951639
public static function state($state) {

        $result = new \sb\Validate\Results();
        $result->value = $state;

        if (in_array($state, self::states)) {

            $result->is_valid = true;
            $result->message = 'Valid state code';
        } else {

            $result->is_valid = false;
            $result->message = 'Invalid state code, are you sure you are using a two letter abbreviation';
        }

        return $result;
    }
1191317
public static function setCasServerCACert($cert, $validate_cn = true)
    {
        phpCAS :: traceBegin();
        phpCAS::_validateClientExists();

        try {
            self::$_PHPCAS_CLIENT->setCasServerCACert($cert, $validate_cn);
        } catch (Exception $e) {
            phpCAS :: error(get_class($e) . ': ' . $e->getMessage());
        }

        phpCAS :: traceEnd();
    }
735733
public function validate(): PathValidationResult
    {
        $n = count($this->_certificates);
        $state = ValidatorState::initialize($this->_config, $this->_trustAnchor,
            $n);
        for ($i = 0; $i < $n; ++$i) {
            $state = $state->withIndex($i + 1);
            $cert = $this->_certificates[$i];
            // process certificate (section 6.1.3.)
            $state = $this->_processCertificate($state, $cert);
            if (!$state->isFinal()) {
                // prepare next certificate (section 6.1.4.)
                $state = $this->_prepareNext($state, $cert);
            }
        }
        if (!isset($cert)) {
            throw new \LogicException("No certificates.");
        }
        // wrap-up (section 6.1.5.)
        $state = $this->_wrapUp($state, $cert);
        // return outputs
        return $state->getResult($this->_certificates);
    }
113344
private function _processPathLengthContraint(ValidatorState $state,
        Certificate $cert): ValidatorState
    {
        $extensions = $cert->tbsCertificate()->extensions();
        if ($extensions->hasBasicConstraints()) {
            $ext = $extensions->basicConstraints();
            if ($ext->hasPathLen()) {
                if ($ext->pathLen() < $state->maxPathLength()) {
                    $state = $state->withMaxPathLength($ext->pathLen());
                }
            }
        }
        return $state;
    }
757808
private void handleCertificateAuthenticator(X509Certificate[] certChain,
                                                CertificateAuthenticator certAuthen) throws Exception {
        String type = certAuthen.getType();
        if (type == null)
            type = AccessIdUtil.TYPE_USER;
        String realm = certAuthen.getRealm();
        if (realm == null)
            realm = "defaultRealm";
        authenticatedId = certAuthen.getUsername();
        username = authenticatedId;
        String accessId = AccessIdUtil.createAccessId(type, realm, authenticatedId);
        addCredentials(accessId);
    }
1265961
private function _validateIssuerProfile(Certificate $cert)
    {
        $exts = $cert->tbsCertificate()->extensions();
        if ($exts->hasKeyUsage() && !$exts->keyUsage()->isDigitalSignature()) {
            throw new ACValidationException(
                "Issuer PKC's Key Usage extension doesn't permit" .
                     " verification of digital signatures.");
        }
        if ($exts->hasBasicConstraints() && $exts->basicConstraints()->isCA()) {
            throw new ACValidationException("Issuer PKC must not be a CA.");
        }
    }
329851
private StateData validateState(HttpSession session, String state) throws Exception {
        if (StringUtils.isNotEmpty(state)) {
            StateData stateDataInSession = removeStateFromSession(session, state);
            if (stateDataInSession != null) {
                return stateDataInSession;
            }
        }
        throw new Exception(FAILED_TO_VALIDATE_MESSAGE + "could not validate state");
    }
700967
@Override
    public void check(Certificate cert, Collection<String> unresCritExts)
        throws CertPathValidatorException
    {
        X509Certificate currCert = (X509Certificate)cert;

        remainingCerts--;

        // if final certificate, check that target constraints are satisfied
        if (remainingCerts == 0) {
            if (targetConstraints != null &&
                targetConstraints.match(currCert) == false) {
                throw new CertPathValidatorException("target certificate " +
                    "constraints check failed");
            }
        } else {
            // otherwise, verify that keyCertSign bit is set in CA certificate
            verifyCAKeyUsage(currCert);
        }

        // remove the extensions that we have checked
        if (unresCritExts != null && !unresCritExts.isEmpty()) {
            unresCritExts.remove(KeyUsage_Id.toString());
            unresCritExts.remove(ExtendedKeyUsage_Id.toString());
            unresCritExts.remove(SubjectAlternativeName_Id.toString());
        }
    }
9996
private function _preparePolicyConstraints(ValidatorState $state,
        Certificate $cert): ValidatorState
    {
        $extensions = $cert->tbsCertificate()->extensions();
        if (!$extensions->hasPolicyConstraints()) {
            return $state;
        }
        $ext = $extensions->policyConstraints();
        // (i.1)
        if ($ext->hasRequireExplicitPolicy() &&
             $ext->requireExplicitPolicy() < $state->explicitPolicy()) {
            $state = $state->withExplicitPolicy($ext->requireExplicitPolicy());
        }
        // (i.2)
        if ($ext->hasInhibitPolicyMapping() &&
             $ext->inhibitPolicyMapping() < $state->policyMapping()) {
            $state = $state->withPolicyMapping($ext->inhibitPolicyMapping());
        }
        return $state;
    }
805802
public void initState(BuilderParams buildParams)
        throws CertPathValidatorException
    {
        /*
         * Initialize number of remainingCACerts.
         * Note that -1 maxPathLen implies unlimited.
         * 0 implies only an EE cert is acceptable.
         */
        int maxPathLen = buildParams.maxPathLength();
        remainingCACerts = (maxPathLen == -1) ? Integer.MAX_VALUE
                                              : maxPathLen;

        /* Initialize explicit policy state variable */
        if (buildParams.explicitPolicyRequired()) {
            explicitPolicy = 0;
        } else {
            // unconstrained if maxPathLen is -1,
            // otherwise, we want to initialize this to the value of the
            // longest possible path + 1 (i.e. maxpathlen + finalcert + 1)
            explicitPolicy = (maxPathLen == -1) ? maxPathLen : maxPathLen + 2;
        }

        /* Initialize policy mapping state variable */
        if (buildParams.policyMappingInhibited()) {
            policyMapping = 0;
        } else {
            policyMapping = (maxPathLen == -1) ? maxPathLen : maxPathLen + 2;
        }

        /* Initialize inhibit any policy state variable */
        if (buildParams.anyPolicyInhibited()) {
            inhibitAnyPolicy = 0;
        } else {
            inhibitAnyPolicy = (maxPathLen == -1) ? maxPathLen : maxPathLen + 2;
        }

        /* Initialize certIndex */
        certIndex = 1;

        /* Initialize policy tree */
        Set<String> initExpPolSet = new HashSet<>(1);
        initExpPolSet.add(PolicyChecker.ANY_POLICY);

        rootNode = new PolicyNodeImpl(null, PolicyChecker.ANY_POLICY, null,
                                      false, initExpPolSet, false);

        /*
         * Initialize each user-defined checker
         * Shallow copy the checkers
         */
        userCheckers = new ArrayList<>(buildParams.certPathCheckers());
        /* initialize each checker (just in case) */
        for (PKIXCertPathChecker checker : userCheckers) {
            checker.init(false);
        }

        /* Start by trusting the cert to sign CRLs */
        crlSign = true;

        init = true;
    }