C# Class Org.BouncyCastle.Pkix.TrustAnchor

A trust anchor or most-trusted Certification Authority (CA). This class represents a "most-trusted CA", which is used as a trust anchor for validating X.509 certification paths. A most-trusted CA includes the public key of the CA, the CA's name, and any constraints upon the set of paths which may be validated using this key. These parameters can be specified in the form of a trusted X509Certificate or as individual parameters.

显示文件 Open project: nonorganic/dssnet Class Usage Examples

Public Methods

Method	Description
ToString ( ) : string	Returns a formatted string describing the `TrustAnchor`.
TrustAnchor ( X509Certificate trustedCert, byte nameConstraints ) : System	Creates an instance of TrustAnchor with the specified X509Certificate and optional name constraints, which are intended to be used as additional constraints when validating an X.509 certification path. The name constraints are specified as a byte array. This byte array should contain the DER encoded form of the name constraints, as they would appear in the NameConstraints structure defined in RFC 2459 and X.509. The ASN.1 definition of this structure appears below. NameConstraints ::= SEQUENCE { permittedSubtrees [0] GeneralSubtrees OPTIONAL, excludedSubtrees [1] GeneralSubtrees OPTIONAL } GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree GeneralSubtree ::= SEQUENCE { base GeneralName, minimum [0] BaseDistance DEFAULT 0, maximum [1] BaseDistance OPTIONAL } BaseDistance ::= INTEGER (0..MAX) GeneralName ::= CHOICE { otherName [0] OtherName, rfc822Name [1] IA5String, dNSName [2] IA5String, x400Address [3] ORAddress, directoryName [4] Name, ediPartyName [5] EDIPartyName, uniformResourceIdentifier [6] IA5String, iPAddress [7] OCTET STRING, registeredID [8] OBJECT IDENTIFIER} Note that the name constraints byte array supplied is cloned to protect against subsequent modifications.
TrustAnchor ( Org.BouncyCastle.Asn1.X509.X509Name caPrincipal, AsymmetricKeyParameter pubKey, byte nameConstraints ) : System	Creates an instance of `TrustAnchor` where the most-trusted CA is specified as an X500Principal and public key. Name constraints are an optional parameter, and are intended to be used as additional constraints when validating an X.509 certification path. The name constraints are specified as a byte array. This byte array contains the DER encoded form of the name constraints, as they would appear in the NameConstraints structure defined in RFC 2459 and X.509. The ASN.1 notation for this structure is supplied in the documentation for the other constructors. Note that the name constraints byte array supplied here is cloned to protect against subsequent modifications.
TrustAnchor ( string caName, AsymmetricKeyParameter pubKey, byte nameConstraints ) : System	Creates an instance of `TrustAnchor` where the most-trusted CA is specified as a distinguished name and public key. Name constraints are an optional parameter, and are intended to be used as additional constraints when validating an X.509 certification path. The name constraints are specified as a byte array. This byte array contains the DER encoded form of the name constraints, as they would appear in the NameConstraints structure defined in RFC 2459 and X.509.

Private Methods

Method	Description
setNameConstraints ( byte bytes ) : void	Decode the name constraints and clone them if not null.

Method Details

ToString() public method

Returns a formatted string describing the TrustAnchor.

public ToString ( ) : string
return	string

TrustAnchor() public method

Creates an instance of TrustAnchor with the specified X509Certificate and optional name constraints, which are intended to be used as additional constraints when validating an X.509 certification path. The name constraints are specified as a byte array. This byte array should contain the DER encoded form of the name constraints, as they would appear in the NameConstraints structure defined in RFC 2459 and X.509. The ASN.1 definition of this structure appears below.

 NameConstraints ::= SEQUENCE { permittedSubtrees       [0]     GeneralSubtrees OPTIONAL, excludedSubtrees        [1]     GeneralSubtrees OPTIONAL } GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree GeneralSubtree ::= SEQUENCE { base                    GeneralName, minimum         [0]     BaseDistance DEFAULT 0, maximum         [1]     BaseDistance OPTIONAL } BaseDistance ::= INTEGER (0..MAX) GeneralName ::= CHOICE { otherName                       [0]     OtherName, rfc822Name                      [1]     IA5String, dNSName                         [2]     IA5String, x400Address                     [3]     ORAddress, directoryName                   [4]     Name, ediPartyName                    [5]     EDIPartyName, uniformResourceIdentifier       [6]     IA5String, iPAddress                       [7]     OCTET STRING, registeredID                    [8]     OBJECT IDENTIFIER}

Note that the name constraints byte array supplied is cloned to protect against subsequent modifications.

if the specified X509Certificate is null

public TrustAnchor ( X509Certificate trustedCert, byte nameConstraints ) : System
trustedCert	Org.BouncyCastle.X509.X509Certificate	a trusted X509Certificate
nameConstraints	byte	a byte array containing the ASN.1 DER encoding of a /// NameConstraints extension to be used for checking name /// constraints. Only the value of the extension is included, not /// the OID or criticality flag. Specify null to omit the /// parameter.
return	System

TrustAnchor() public method

Creates an instance of TrustAnchor where the most-trusted CA is specified as an X500Principal and public key.

Name constraints are an optional parameter, and are intended to be used as additional constraints when validating an X.509 certification path.

The name constraints are specified as a byte array. This byte array contains the DER encoded form of the name constraints, as they would appear in the NameConstraints structure defined in RFC 2459 and X.509. The ASN.1 notation for this structure is supplied in the documentation for the other constructors.

Note that the name constraints byte array supplied here is cloned to protect against subsequent modifications.

/// if caPrincipal or pubKey is null ///

public TrustAnchor ( Org.BouncyCastle.Asn1.X509.X509Name caPrincipal, AsymmetricKeyParameter pubKey, byte nameConstraints ) : System
caPrincipal	Org.BouncyCastle.Asn1.X509.X509Name	the name of the most-trusted CA as X509Name
pubKey	Org.BouncyCastle.Crypto.AsymmetricKeyParameter	the public key of the most-trusted CA
nameConstraints	byte	/// a byte array containing the ASN.1 DER encoding of a NameConstraints extension to /// be used for checking name constraints. Only the value of the extension is included, /// not the OID or criticality flag. Specify null to omit the parameter. ///
return	System

TrustAnchor() public method

Creates an instance of TrustAnchor where the most-trusted CA is specified as a distinguished name and public key. Name constraints are an optional parameter, and are intended to be used as additional constraints when validating an X.509 certification path.
The name constraints are specified as a byte array. This byte array contains the DER encoded form of the name constraints, as they would appear in the NameConstraints structure defined in RFC 2459 and X.509.

public TrustAnchor ( string caName, AsymmetricKeyParameter pubKey, byte nameConstraints ) : System
caName	string	the X.500 distinguished name of the most-trusted CA in RFC /// 2253 string format
pubKey	Org.BouncyCastle.Crypto.AsymmetricKeyParameter	the public key of the most-trusted CA
nameConstraints	byte	a byte array containing the ASN.1 DER encoding of a /// NameConstraints extension to be used for checking name /// constraints. Only the value of the extension is included, not /// the OID or criticality flag. Specify null to omit the /// parameter.
return	System