CertStore

AI-generated Key Takeaways

• CertStore is a class used for retrieving certificates and Certificate Revocation Lists (CRLs) from a repository, using a provider-based architecture.

• It provides access to a potentially large repository of untrusted certificates and CRLs, unlike a KeyStore which handles trusted certificates and private keys.

• CertStore offers methods like getCertificates and getCRLs for retrieving certificates and CRLs based on specified selectors.

• All public methods and static methods of CertStore are thread-safe, enabling concurrent access from multiple threads without adverse effects.

• Android supports the "Collection" CertStore type across all API levels.

public class CertStore extends Object

A class for retrieving Certificates and CRLs from a repository.

This class uses a provider-based architecture. To create a CertStore, call one of the static getInstance methods, passing in the type of CertStore desired, any applicable initialization parameters and optionally the name of the provider desired.

Once the CertStore has been created, it can be used to retrieve Certificates and CRLs by calling its getCertificates and getCRLs methods.

Unlike a KeyStore, which provides access to a cache of private keys and trusted certificates, a CertStore is designed to provide access to a potentially vast repository of untrusted certificates and CRLs. For example, an LDAP implementation of CertStore provides access to certificates and CRLs stored in one or more directories using the LDAP protocol and the schema as defined in the RFC service attribute.

Android provides the following CertStore types:

Algorithm	Supported API Levels
Collection	1+

This type is described in the CertStore section of the Java Cryptography Architecture Standard Algorithm Name Documentation.

Concurrent Access

All public methods of CertStore objects must be thread-safe. That is, multiple threads may concurrently invoke these methods on a single CertStore object (or more than one) with no ill effects. This allows a CertPathBuilder to search for a CRL while simultaneously searching for further certificates, for instance.

The static methods of this class are also guaranteed to be thread-safe. Multiple threads may concurrently invoke the static methods defined in this class with no ill effects.

Protected Constructor Summary

CertStore(CertStoreSpi storeSpi, Provider provider, String type, CertStoreParameters params) Creates a CertStore object of the given type, and encapsulates the given provider implementation (SPI object) in it.

Public Method Summary

final Collection<? extends CRL>	getCRLs(CRLSelector selector) Returns a Collection of CRLs that match the specified selector.
final CertStoreParameters	getCertStoreParameters() Returns the parameters used to initialize this CertStore.
final Collection<? extends Certificate>	getCertificates(CertSelector selector) Returns a Collection of Certificates that match the specified selector.
final static String	getDefaultType() Returns the default CertStore type as specified by the certstore.type security property, or the string "LDAP" if no such property exists.
static CertStore	getInstance(String type, CertStoreParameters params) Returns a CertStore object that implements the specified CertStore type and is initialized with the specified parameters.
static CertStore	getInstance(String type, CertStoreParameters params, Provider provider) Returns a CertStore object that implements the specified CertStore type.
static CertStore	getInstance(String type, CertStoreParameters params, String provider) Returns a CertStore object that implements the specified CertStore type.
final Provider	getProvider() Returns the provider of this CertStore.
final String	getType() Returns the type of this CertStore.

Inherited Method Summary

From class java.lang.Object

Object	clone() Creates and returns a copy of this Object.
boolean	equals(Object obj) Compares this instance with the specified object and indicates if they are equal.
void	finalize() Invoked when the garbage collector has detected that this instance is no longer reachable.
final Class<?>	getClass() Returns the unique instance of Class that represents this object's class.
int	hashCode() Returns an integer hash code for this object.
final void	notify() Causes a thread which is waiting on this object's monitor (by means of calling one of the wait() methods) to be woken up.
final void	notifyAll() Causes all threads which are waiting on this object's monitor (by means of calling one of the wait() methods) to be woken up.
String	toString() Returns a string containing a concise, human-readable description of this object.
final void	wait(long timeout, int nanos) Causes the calling thread to wait until another thread calls the notify() or notifyAll() method of this object or until the specified timeout expires.
final void	wait(long timeout) Causes the calling thread to wait until another thread calls the notify() or notifyAll() method of this object or until the specified timeout expires.
final void	wait() Causes the calling thread to wait until another thread calls the notify() or notifyAll() method of this object.

Protected Constructors

protected CertStore (CertStoreSpi storeSpi, Provider provider, String type, CertStoreParameters params)

Creates a CertStore object of the given type, and encapsulates the given provider implementation (SPI object) in it.

Parameters

storeSpi	the provider implementation
provider	the provider
type	the type
params	the initialization parameters (may be null)

Public Methods

public final Collection<? extends CRL> getCRLs (CRLSelector selector)

Returns a Collection of CRLs that match the specified selector. If no CRLs match the selector, an empty Collection will be returned.

For some CertStore types, the resulting Collection may not contain all of the CRLs that match the selector. For instance, an LDAP CertStore may not search all entries in the directory. Instead, it may just search entries that are likely to contain the CRLs it is looking for.

Some CertStore implementations (especially LDAP CertStores) may throw a CertStoreException unless a non-null CRLSelector is provided that includes specific criteria that can be used to find the CRLs. Issuer names and/or the certificate to be checked are especially useful.

Parameters

selector	A CRLSelector used to select which CRLs should be returned. Specify null to return all CRLs (if supported).

Returns

• A Collection of CRLs that match the specified selector (never null)

Throws

CertStoreException	if an exception occurs

public final CertStoreParameters getCertStoreParameters ()

Returns the parameters used to initialize this CertStore. Note that the CertStoreParameters object is cloned before it is returned.

Returns

• the parameters used to initialize this CertStore (may be null)

public final Collection<? extends Certificate> getCertificates (CertSelector selector)

Returns a Collection of Certificates that match the specified selector. If no Certificates match the selector, an empty Collection will be returned.

For some CertStore types, the resulting Collection may not contain all of the Certificates that match the selector. For instance, an LDAP CertStore may not search all entries in the directory. Instead, it may just search entries that are likely to contain the Certificates it is looking for.

Some CertStore implementations (especially LDAP CertStores) may throw a CertStoreException unless a non-null CertSelector is provided that includes specific criteria that can be used to find the certificates. Issuer and/or subject names are especially useful criteria.

Parameters

selector	A CertSelector used to select which Certificates should be returned. Specify null to return all Certificates (if supported).

Returns

• A Collection of Certificates that match the specified selector (never null)

Throws

CertStoreException	if an exception occurs

public static final String getDefaultType ()

Returns the default CertStore type as specified by the certstore.type security property, or the string "LDAP" if no such property exists.

The default CertStore type can be used by applications that do not want to use a hard-coded type when calling one of the getInstance methods, and want to provide a default CertStore type in case a user does not specify its own.

The default CertStore type can be changed by setting the value of the certstore.type security property to the desired type.

Returns

• the default CertStore type as specified by the certstore.type security property, or the string "LDAP" if no such property exists.

See Also

• security properties

public static CertStore getInstance (String type, CertStoreParameters params)

Returns a CertStore object that implements the specified CertStore type and is initialized with the specified parameters.

This method traverses the list of registered security Providers, starting with the most preferred Provider. A new CertStore object encapsulating the CertStoreSpi implementation from the first Provider that supports the specified type is returned.

Note that the list of registered providers may be retrieved via the Security.getProviders() method.

The CertStore that is returned is initialized with the specified CertStoreParameters. The type of parameters needed may vary between different types of CertStores. Note that the specified CertStoreParameters object is cloned.

Parameters

type	the name of the requested CertStore type. See the CertStore section in the Java Cryptography Architecture Standard Algorithm Name Documentation for information about standard types.
params	the initialization parameters (may be null).

Returns

• a CertStore object that implements the specified CertStore type.

Throws

NoSuchAlgorithmException	if no Provider supports a CertStoreSpi implementation for the specified type.
InvalidAlgorithmParameterException	if the specified initialization parameters are inappropriate for this CertStore.

See Also

• Provider

public static CertStore getInstance (String type, CertStoreParameters params, Provider provider)

Returns a CertStore object that implements the specified CertStore type.

A new CertStore object encapsulating the CertStoreSpi implementation from the specified Provider object is returned. Note that the specified Provider object does not have to be registered in the provider list.

The CertStore that is returned is initialized with the specified CertStoreParameters. The type of parameters needed may vary between different types of CertStores. Note that the specified CertStoreParameters object is cloned.

Parameters

type	the requested CertStore type. See the CertStore section in the Java Cryptography Architecture Standard Algorithm Name Documentation for information about standard types.
params	the initialization parameters (may be null).
provider	the provider.

Returns

• a CertStore object that implements the specified type.

Throws

NoSuchAlgorithmException	if a CertStoreSpi implementation for the specified type is not available from the specified Provider object.
InvalidAlgorithmParameterException	if the specified initialization parameters are inappropriate for this CertStore
IllegalArgumentException	if the provider is null.

See Also

• Provider

public static CertStore getInstance (String type, CertStoreParameters params, String provider)

Returns a CertStore object that implements the specified CertStore type.

A new CertStore object encapsulating the CertStoreSpi implementation from the specified provider is returned. The specified provider must be registered in the security provider list.

Note that the list of registered providers may be retrieved via the Security.getProviders() method.

The CertStore that is returned is initialized with the specified CertStoreParameters. The type of parameters needed may vary between different types of CertStores. Note that the specified CertStoreParameters object is cloned.

Parameters

type	the requested CertStore type. See the CertStore section in the Java Cryptography Architecture Standard Algorithm Name Documentation for information about standard types.
params	the initialization parameters (may be null).
provider	the name of the provider.

Returns

• a CertStore object that implements the specified type.

Throws

NoSuchAlgorithmException	if a CertStoreSpi implementation for the specified type is not available from the specified provider.
InvalidAlgorithmParameterException	if the specified initialization parameters are inappropriate for this CertStore.
NoSuchProviderException	if the specified provider is not registered in the security provider list.
IllegalArgumentException	if the provider is null or empty.

See Also

• Provider

public final Provider getProvider ()

Returns the provider of this CertStore.

Returns

• the provider of this CertStore

public final String getType ()

Returns the type of this CertStore.

Returns

• the type of this CertStore