list.add(new ValidationError(HierarchyCertificateValidator.VALIDATOR_NAME, "Certificate issuer '" + BouncyCastleProviderHelper.toString(issuer.getSubjectX500Principal()) + "' dont have 'keyCertSign' in key usage"));
}
} catch (SignatureException e) {
list.add(new ValidationError(HierarchyCertificateValidator.VALIDATOR_NAME, "Certificate '" + BouncyCastleProviderHelper.toString(certificate.getSubjectX500Principal()) + "' not signed by '" + BouncyCastleProviderHelper.toString(issuer.getSubjectX500Principal()) + "'"));
} catch (Exception e) {
throw new CertificateException(e);
}
}
try {
if (Conditions.isNotEmpty(this.certificates)) {
boolean requiredOk = false;
outer: for (int i = 1; i < chain.length; i++) {
X509Certificate issuer = (X509Certificate) chain[i];
for (Certificate required : this.certificates) {
X509Certificate x509Required = (X509Certificate) required;
if (Arrays.equals(issuer.getEncoded(), x509Required.getEncoded())) {
RockFrameworkLogger.getLogger().info("Matches " + BouncyCastleProviderHelper.toString(x509Required.getSubjectX500Principal()));
requiredOk = true;
break outer;
}
}
}
if (!requiredOk) {
list.add(new ValidationError(HierarchyCertificateValidator.VALIDATOR_NAME, "Certificate chain is invalid, a required certificate could not be found"));
}
}
} catch (CertificateEncodingException e) {
throw new CertificateException(e);
}
return Collections.toArray(list, ValidationError.class);
}