Java Code Examples for java.security.cert.CertPathValidatorException#getReason()

/**
 * When a failure happens during certificate checking from an
 * {@link X509TrustManager}, determine what TLS alert description
 * to use.
 *
 * @param cexc The exception thrown by the {@link X509TrustManager}
 *
 * @return A byte value corresponding to a TLS alert description number.
 */
private static Alert getCertificateAlert(
        ClientHandshakeContext chc, CertificateException cexc) {
    // The specific reason for the failure will determine how to
    // set the alert description value
    Alert alert = Alert.CERTIFICATE_UNKNOWN;

    Throwable baseCause = cexc.getCause();
    if (baseCause instanceof CertPathValidatorException) {
        CertPathValidatorException cpve =
                (CertPathValidatorException)baseCause;
        Reason reason = cpve.getReason();
        if (reason == BasicReason.REVOKED) {
            alert = chc.staplingActive ?
                    Alert.BAD_CERT_STATUS_RESPONSE :
                    Alert.CERTIFICATE_REVOKED;
        } else if (
                reason == BasicReason.UNDETERMINED_REVOCATION_STATUS) {
            alert = chc.staplingActive ?
                    Alert.BAD_CERT_STATUS_RESPONSE :
                    Alert.CERTIFICATE_UNKNOWN;
        }
    }

    return alert;
}
 

/**
 * Checks a validation failure to see if it failed for the reason we think
 * it should.  This comes in as an SSLException of some sort, but it
 * encapsulates a ValidatorException which in turn encapsulates the
 * CertPathValidatorException we are interested in.
 *
 * @param e the exception thrown at the top level
 * @param reason the underlying CertPathValidatorException BasicReason
 * we are expecting it to have.
 *
 * @return true if the reason matches up, false otherwise.
 */
static boolean checkClientValidationFailure(Exception e,
        BasicReason reason) {
    boolean result = false;

    if (e instanceof SSLException) {
        Throwable valExc = e.getCause();
        if (valExc instanceof sun.security.validator.ValidatorException) {
            Throwable cause = valExc.getCause();
            if (cause instanceof CertPathValidatorException) {
                CertPathValidatorException cpve =
                        (CertPathValidatorException)cause;
                if (cpve.getReason() == reason) {
                    result = true;
                }
            }
        }
    }
    return result;
}
 

/**
 * Checks a validation failure to see if it failed for the reason we think
 * it should.  This comes in as an SSLException of some sort, but it
 * encapsulates a ValidatorException which in turn encapsulates the
 * CertPathValidatorException we are interested in.
 *
 * @param e the exception thrown at the top level
 * @param reason the underlying CertPathValidatorException BasicReason
 * we are expecting it to have.
 *
 * @return true if the reason matches up, false otherwise.
 */
static boolean checkClientValidationFailure(Exception e,
        CertPathValidatorException.BasicReason reason) {
    boolean result = false;

    if (e instanceof SSLException) {
        Throwable sslhe = e.getCause();
        if (sslhe instanceof SSLHandshakeException) {
            Throwable valExc = sslhe.getCause();
            if (valExc instanceof sun.security.validator.ValidatorException) {
                Throwable cause = valExc.getCause();
                if (cause instanceof CertPathValidatorException) {
                    CertPathValidatorException cpve =
                            (CertPathValidatorException)cause;
                    if (cpve.getReason() == reason) {
                        result = true;
                    }
                }
            }
        }
    }
    return result;
}
 

/**
 * Checks a validation failure to see if it failed for the reason we think
 * it should.  This comes in as an SSLException of some sort, but it
 * encapsulates a ValidatorException which in turn encapsulates the
 * CertPathValidatorException we are interested in.
 *
 * @param e the exception thrown at the top level
 * @param reason the underlying CertPathValidatorException BasicReason
 * we are expecting it to have.
 *
 * @return true if the reason matches up, false otherwise.
 */
static boolean checkClientValidationFailure(Exception e,
        BasicReason reason) {
    boolean result = false;

    if (e instanceof SSLException) {
        Throwable valExc = e.getCause();
        if (valExc instanceof sun.security.validator.ValidatorException) {
            Throwable cause = valExc.getCause();
            if (cause instanceof CertPathValidatorException) {
                CertPathValidatorException cpve =
                        (CertPathValidatorException)cause;
                if (cpve.getReason() == reason) {
                    result = true;
                }
            }
        }
    }
    return result;
}
 

/**
 * When a failure happens during certificate checking from an
 * {@link X509TrustManager}, determine what TLS alert description to use.
 *
 * @param cexc The exception thrown by the {@link X509TrustManager}
 *
 * @return A byte value corresponding to a TLS alert description number.
 */
private byte getCertificateAlert(CertificateException cexc) {
    // The specific reason for the failure will determine how to
    // set the alert description value
    byte alertDesc = Alerts.alert_certificate_unknown;

    Throwable baseCause = cexc.getCause();
    if (baseCause instanceof CertPathValidatorException) {
        CertPathValidatorException cpve =
                (CertPathValidatorException)baseCause;
        Reason reason = cpve.getReason();
        if (reason == BasicReason.REVOKED) {
            alertDesc = staplingActive ?
                    Alerts.alert_bad_certificate_status_response :
                    Alerts.alert_certificate_revoked;
        } else if (reason == BasicReason.UNDETERMINED_REVOCATION_STATUS) {
            alertDesc = staplingActive ?
                    Alerts.alert_bad_certificate_status_response :
                    Alerts.alert_certificate_unknown;
        }
    }

    return alertDesc;
}
 

/**
 * When a failure happens during certificate checking from an
 * {@link X509TrustManager}, determine what TLS alert description
 * to use.
 *
 * @param cexc The exception thrown by the {@link X509TrustManager}
 *
 * @return A byte value corresponding to a TLS alert description number.
 */
private static Alert getCertificateAlert(
        ClientHandshakeContext chc, CertificateException cexc) {
    // The specific reason for the failure will determine how to
    // set the alert description value
    Alert alert = Alert.CERTIFICATE_UNKNOWN;

    Throwable baseCause = cexc.getCause();
    if (baseCause instanceof CertPathValidatorException) {
        CertPathValidatorException cpve =
                (CertPathValidatorException)baseCause;
        Reason reason = cpve.getReason();
        if (reason == BasicReason.REVOKED) {
            alert = chc.staplingActive ?
                    Alert.BAD_CERT_STATUS_RESPONSE :
                    Alert.CERTIFICATE_REVOKED;
        } else if (
                reason == BasicReason.UNDETERMINED_REVOCATION_STATUS) {
            alert = chc.staplingActive ?
                    Alert.BAD_CERT_STATUS_RESPONSE :
                    Alert.CERTIFICATE_UNKNOWN;
        }
    }

    return alert;
}
 

/**
 * When a failure happens during certificate checking from an
 * {@link X509TrustManager}, determine what TLS alert description
 * to use.
 *
 * @param cexc The exception thrown by the {@link X509TrustManager}
 *
 * @return A byte value corresponding to a TLS alert description number.
 */
private static Alert getCertificateAlert(
        ClientHandshakeContext chc, CertificateException cexc) {
    // The specific reason for the failure will determine how to
    // set the alert description value
    Alert alert = Alert.CERTIFICATE_UNKNOWN;

    Throwable baseCause = cexc.getCause();
    if (baseCause instanceof CertPathValidatorException) {
        CertPathValidatorException cpve =
                (CertPathValidatorException)baseCause;
        Reason reason = cpve.getReason();
        if (reason == BasicReason.REVOKED) {
            alert = chc.staplingActive ?
                    Alert.BAD_CERT_STATUS_RESPONSE :
                    Alert.CERTIFICATE_REVOKED;
        } else if (
                reason == BasicReason.UNDETERMINED_REVOCATION_STATUS) {
            alert = chc.staplingActive ?
                    Alert.BAD_CERT_STATUS_RESPONSE :
                    Alert.CERTIFICATE_UNKNOWN;
        } else if (reason == BasicReason.ALGORITHM_CONSTRAINED) {
            alert = Alert.UNSUPPORTED_CERTIFICATE;
        } else if (reason == BasicReason.EXPIRED) {
            alert = Alert.CERTIFICATE_EXPIRED;
        } else if (reason == BasicReason.INVALID_SIGNATURE ||
                reason == BasicReason.NOT_YET_VALID) {
            alert = Alert.BAD_CERTIFICATE;
        }
    }

    return alert;
}
 

/**
 * When a failure happens during certificate checking from an
 * {@link X509TrustManager}, determine what TLS alert description
 * to use.
 *
 * @param cexc The exception thrown by the {@link X509TrustManager}
 *
 * @return A byte value corresponding to a TLS alert description number.
 */
private static Alert getCertificateAlert(
        ClientHandshakeContext chc, CertificateException cexc) {
    // The specific reason for the failure will determine how to
    // set the alert description value
    Alert alert = Alert.CERTIFICATE_UNKNOWN;

    Throwable baseCause = cexc.getCause();
    if (baseCause instanceof CertPathValidatorException) {
        CertPathValidatorException cpve =
                (CertPathValidatorException)baseCause;
        Reason reason = cpve.getReason();
        if (reason == BasicReason.REVOKED) {
            alert = chc.staplingActive ?
                    Alert.BAD_CERT_STATUS_RESPONSE :
                    Alert.CERTIFICATE_REVOKED;
        } else if (
                reason == BasicReason.UNDETERMINED_REVOCATION_STATUS) {
            alert = chc.staplingActive ?
                    Alert.BAD_CERT_STATUS_RESPONSE :
                    Alert.CERTIFICATE_UNKNOWN;
        } else if (reason == BasicReason.ALGORITHM_CONSTRAINED) {
            alert = Alert.UNSUPPORTED_CERTIFICATE;
        } else if (reason == BasicReason.EXPIRED) {
            alert = Alert.CERTIFICATE_EXPIRED;
        } else if (reason == BasicReason.INVALID_SIGNATURE ||
                reason == BasicReason.NOT_YET_VALID) {
            alert = Alert.BAD_CERTIFICATE;
        }
    }

    return alert;
}
 

public static void main(String args[]) throws Exception {
    if (args.length != 1) {
        throw new Exception("Incorrect number of arguments");
    }
    Test test = tests[Integer.parseInt(args[0])];
    Security.setProperty("jdk.tls.disabledAlgorithms", test.tlsDisAlgs);
    Security.setProperty("jdk.certpath.disabledAlgorithms",
                         test.certPathDisAlgs);

    if (debug) {
        System.setProperty("javax.net.debug", "all");
    }

    /*
     * Start the tests.
     */
    try {
        new PKIXExtendedTM();
        if (test.fail) {
            throw new Exception("Expected MD5 certificate to be blocked");
        }
    } catch (Exception e) {
        if (test.fail) {
            // find expected cause
            boolean correctReason = false;
            Throwable cause = e.getCause();
            while (cause != null) {
                if (cause instanceof CertPathValidatorException) {
                    CertPathValidatorException cpve =
                        (CertPathValidatorException)cause;
                    if (cpve.getReason() == CertPathValidatorException.BasicReason.ALGORITHM_CONSTRAINED) {
                        correctReason = true;
                        break;
                    }
                }
                cause = cause.getCause();
            }
            if (!correctReason) {
                throw new Exception("Unexpected exception", e);
            }
        } else {
            throw e;
        }
    }
}
 

public static void main(String args[]) throws Exception {
    if (args.length != 1) {
        throw new Exception("Incorrect number of arguments");
    }
    Test test = tests[Integer.parseInt(args[0])];
    Security.setProperty("jdk.tls.disabledAlgorithms", test.tlsDisAlgs);
    Security.setProperty("jdk.certpath.disabledAlgorithms",
                         test.certPathDisAlgs);

    if (debug) {
        System.setProperty("javax.net.debug", "all");
    }

    /*
     * Start the tests.
     */
    try {
        new PKIXExtendedTM();
        if (test.fail) {
            throw new Exception("Expected MD5 certificate to be blocked");
        }
    } catch (Exception e) {
        if (test.fail) {
            // find expected cause
            boolean correctReason = false;
            Throwable cause = e.getCause();
            while (cause != null) {
                if (cause instanceof CertPathValidatorException) {
                    CertPathValidatorException cpve =
                        (CertPathValidatorException)cause;
                    if (cpve.getReason() == CertPathValidatorException.BasicReason.ALGORITHM_CONSTRAINED) {
                        correctReason = true;
                        break;
                    }
                }
                cause = cause.getCause();
            }
            if (!correctReason) {
                throw new Exception("Unexpected exception", e);
            }
        } else {
            throw e;
        }
    }
}
 

public static void main(String args[]) throws Exception {
    if (args.length != 1) {
        throw new Exception("Incorrect number of arguments");
    }
    Test test = tests[Integer.parseInt(args[0])];
    Security.setProperty("jdk.tls.disabledAlgorithms", test.tlsDisAlgs);
    Security.setProperty("jdk.certpath.disabledAlgorithms",
                         test.certPathDisAlgs);

    if (debug) {
        System.setProperty("javax.net.debug", "all");
    }

    /*
     * Start the tests.
     */
    try {
        new PKIXExtendedTM();
        if (test.fail) {
            throw new Exception("Expected MD5 certificate to be blocked");
        }
    } catch (Exception e) {
        if (test.fail) {
            // find expected cause
            boolean correctReason = false;
            Throwable cause = e.getCause();
            while (cause != null) {
                if (cause instanceof CertPathValidatorException) {
                    CertPathValidatorException cpve =
                        (CertPathValidatorException)cause;
                    if (cpve.getReason() == CertPathValidatorException.BasicReason.ALGORITHM_CONSTRAINED) {
                        correctReason = true;
                        break;
                    }
                }
                cause = cause.getCause();
            }
            if (!correctReason) {
                throw new Exception("Unexpected exception", e);
            }
        } else {
            throw e;
        }
    }
}
 

public static void main(String args[]) throws Exception {
    if (args.length != 1) {
        throw new Exception("Incorrect number of arguments");
    }
    Test test = tests[Integer.parseInt(args[0])];
    Security.setProperty("jdk.tls.disabledAlgorithms", test.tlsDisAlgs);
    Security.setProperty("jdk.certpath.disabledAlgorithms",
                         test.certPathDisAlgs);

    if (debug) {
        System.setProperty("javax.net.debug", "all");
    }

    /*
     * Start the tests.
     */
    try {
        new PKIXExtendedTM();
        if (test.fail) {
            throw new Exception("Expected MD5 certificate to be blocked");
        }
    } catch (Exception e) {
        if (test.fail) {
            // find expected cause
            boolean correctReason = false;
            Throwable cause = e.getCause();
            while (cause != null) {
                if (cause instanceof CertPathValidatorException) {
                    CertPathValidatorException cpve =
                        (CertPathValidatorException)cause;
                    if (cpve.getReason() == CertPathValidatorException.BasicReason.ALGORITHM_CONSTRAINED) {
                        correctReason = true;
                        break;
                    }
                }
                cause = cause.getCause();
            }
            if (!correctReason) {
                throw new Exception("Unexpected exception", e);
            }
        } else {
            throw e;
        }
    }
}
 

@Override
public final int verify(long ssl, byte[][] chain, String auth) {
    X509Certificate[] peerCerts = certificates(chain);
    final ReferenceCountedOpenSslEngine engine = engineMap.get(ssl);
    try {
        verify(engine, peerCerts, auth);
        return CertificateVerifier.X509_V_OK;
    } catch (Throwable cause) {
        logger.debug("verification of certificate failed", cause);
        SSLHandshakeException e = new SSLHandshakeException("General OpenSslEngine problem");
        e.initCause(cause);
        engine.handshakeException = e;

        // Try to extract the correct error code that should be used.
        if (cause instanceof OpenSslCertificateException) {
            // This will never return a negative error code as its validated when constructing the
            // OpenSslCertificateException.
            return ((OpenSslCertificateException) cause).errorCode();
        }
        if (cause instanceof CertificateExpiredException) {
            return CertificateVerifier.X509_V_ERR_CERT_HAS_EXPIRED;
        }
        if (cause instanceof CertificateNotYetValidException) {
            return CertificateVerifier.X509_V_ERR_CERT_NOT_YET_VALID;
        }
        if (PlatformDependent.javaVersion() >= 7) {
            if (cause instanceof CertificateRevokedException) {
                return CertificateVerifier.X509_V_ERR_CERT_REVOKED;
            }

            // The X509TrustManagerImpl uses a Validator which wraps a CertPathValidatorException into
            // an CertificateException. So we need to handle the wrapped CertPathValidatorException to be
            // able to send the correct alert.
            Throwable wrapped = cause.getCause();
            while (wrapped != null) {
                if (wrapped instanceof CertPathValidatorException) {
                    CertPathValidatorException ex = (CertPathValidatorException) wrapped;
                    CertPathValidatorException.Reason reason = ex.getReason();
                    if (reason == CertPathValidatorException.BasicReason.EXPIRED) {
                        return CertificateVerifier.X509_V_ERR_CERT_HAS_EXPIRED;
                    }
                    if (reason == CertPathValidatorException.BasicReason.NOT_YET_VALID) {
                        return CertificateVerifier.X509_V_ERR_CERT_NOT_YET_VALID;
                    }
                    if (reason == CertPathValidatorException.BasicReason.REVOKED) {
                        return CertificateVerifier.X509_V_ERR_CERT_REVOKED;
                    }
                }
                wrapped = wrapped.getCause();
            }
        }

        // Could not detect a specific error code to use, so fallback to a default code.
        return CertificateVerifier.X509_V_ERR_UNSPECIFIED;
    }
}
 

public static void main(String args[]) throws Exception {
    if (args.length != 1) {
        throw new Exception("Incorrect number of arguments");
    }
    Test test = tests[Integer.parseInt(args[0])];
    Security.setProperty("jdk.tls.disabledAlgorithms", test.tlsDisAlgs);
    Security.setProperty("jdk.certpath.disabledAlgorithms",
                         test.certPathDisAlgs);

    if (debug) {
        System.setProperty("javax.net.debug", "all");
    }

    /*
     * Start the tests.
     */
    try {
        new PKIXExtendedTM();
        if (test.fail) {
            throw new Exception("Expected MD5 certificate to be blocked");
        }
    } catch (Exception e) {
        if (test.fail) {
            // find expected cause
            boolean correctReason = false;
            Throwable cause = e.getCause();
            while (cause != null) {
                if (cause instanceof CertPathValidatorException) {
                    CertPathValidatorException cpve =
                        (CertPathValidatorException)cause;
                    if (cpve.getReason() == CertPathValidatorException.BasicReason.ALGORITHM_CONSTRAINED) {
                        correctReason = true;
                        break;
                    }
                }
                cause = cause.getCause();
            }
            if (!correctReason) {
                throw new Exception("Unexpected exception", e);
            }
        } else {
            throw e;
        }
    }
}
 

public static void main(String args[]) throws Exception {
    if (args.length != 1) {
        throw new Exception("Incorrect number of arguments");
    }
    Test test = tests[Integer.parseInt(args[0])];
    Security.setProperty("jdk.tls.disabledAlgorithms", test.tlsDisAlgs);
    Security.setProperty("jdk.certpath.disabledAlgorithms",
                         test.certPathDisAlgs);

    if (debug) {
        System.setProperty("javax.net.debug", "all");
    }

    /*
     * Start the tests.
     */
    try {
        new PKIXExtendedTM();
        if (test.fail) {
            throw new Exception("Expected MD5 certificate to be blocked");
        }
    } catch (Exception e) {
        if (test.fail) {
            // find expected cause
            boolean correctReason = false;
            Throwable cause = e.getCause();
            while (cause != null) {
                if (cause instanceof CertPathValidatorException) {
                    CertPathValidatorException cpve =
                        (CertPathValidatorException)cause;
                    if (cpve.getReason() == CertPathValidatorException.BasicReason.ALGORITHM_CONSTRAINED) {
                        correctReason = true;
                        break;
                    }
                }
                cause = cause.getCause();
            }
            if (!correctReason) {
                throw new Exception("Unexpected exception", e);
            }
        } else {
            throw e;
        }
    }
}
 

/**
 * Validates a certification path consisting exclusively of
 * <code>X509Certificate</code>s using the specified
 * <code>PKIXCertPathChecker</code>s. It is assumed that the
 * <code>PKIXCertPathChecker</code>s
 * have been initialized with any input parameters they may need.
 *
 * @param cpOriginal the original X509 CertPath passed in by the user
 * @param reversedCertList the reversed X509 CertPath (as a List)
 * @param certPathCheckers the PKIXCertPathCheckers
 * @throws CertPathValidatorException if cert path does not validate
 */
static void validate(CertPath cpOriginal,
                     List<X509Certificate> reversedCertList,
                     List<PKIXCertPathChecker> certPathCheckers)
    throws CertPathValidatorException
{
    // we actually process reversedCertList, but we keep cpOriginal because
    // we need to return the original certPath when we throw an exception.
    // we will also need to modify the index appropriately when we
    // throw an exception.

    int cpSize = reversedCertList.size();

    if (debug != null) {
        debug.println("--------------------------------------------------"
              + "------------");
        debug.println("Executing PKIX certification path validation "
              + "algorithm.");
    }

    for (int i = 0; i < cpSize; i++) {

        /* The basic loop algorithm is that we get the
         * current certificate, we verify the current certificate using
         * information from the previous certificate and from the state,
         * and we modify the state for the next loop by setting the
         * current certificate of this loop to be the previous certificate
         * of the next loop. The state is initialized during first loop.
         */
        if (debug != null)
            debug.println("Checking cert" + (i+1) + " ...");

        X509Certificate currCert = reversedCertList.get(i);
        Set<String> unresCritExts = currCert.getCriticalExtensionOIDs();
        if (unresCritExts == null) {
            unresCritExts = Collections.<String>emptySet();
        }

        if (debug != null && !unresCritExts.isEmpty()) {
            debug.println("Set of critical extensions:");
            for (String oid : unresCritExts) {
                debug.println(oid);
            }
        }

        for (int j = 0; j < certPathCheckers.size(); j++) {

            PKIXCertPathChecker currChecker = certPathCheckers.get(j);
            if (debug != null) {
                debug.println("-Using checker" + (j + 1) + " ... [" +
                    currChecker.getClass().getName() + "]");
            }

            if (i == 0)
                currChecker.init(false);

            try {
                currChecker.check(currCert, unresCritExts);

                if (debug != null) {
                    debug.println("-checker" + (j + 1) +
                        " validation succeeded");
                }

            } catch (CertPathValidatorException cpve) {
                throw new CertPathValidatorException(cpve.getMessage(),
                    cpve.getCause(), cpOriginal, cpSize - (i + 1),
                    cpve.getReason());
            }
        }

        if (!unresCritExts.isEmpty()) {
            throw new CertPathValidatorException("unrecognized " +
                "critical extension(s)", null, cpOriginal, cpSize-(i+1),
                PKIXReason.UNRECOGNIZED_CRIT_EXT);
        }

        if (debug != null)
            debug.println("\ncert" + (i+1) + " validation succeeded.\n");
    }

    if (debug != null) {
        debug.println("Cert path validation succeeded. (PKIX validation "
                      + "algorithm)");
        debug.println("-------------------------------------------------"
                      + "-------------");
    }
}
 

/**
 * Validates a certification path consisting exclusively of
 * <code>X509Certificate</code>s using the specified
 * <code>PKIXCertPathChecker</code>s. It is assumed that the
 * <code>PKIXCertPathChecker</code>s
 * have been initialized with any input parameters they may need.
 *
 * @param cpOriginal the original X509 CertPath passed in by the user
 * @param reversedCertList the reversed X509 CertPath (as a List)
 * @param certPathCheckers the PKIXCertPathCheckers
 * @throws CertPathValidatorException if cert path does not validate
 */
static void validate(CertPath cpOriginal,
                     List<X509Certificate> reversedCertList,
                     List<PKIXCertPathChecker> certPathCheckers)
    throws CertPathValidatorException
{
    // we actually process reversedCertList, but we keep cpOriginal because
    // we need to return the original certPath when we throw an exception.
    // we will also need to modify the index appropriately when we
    // throw an exception.

    int cpSize = reversedCertList.size();

    if (debug != null) {
        debug.println("--------------------------------------------------"
              + "------------");
        debug.println("Executing PKIX certification path validation "
              + "algorithm.");
    }

    for (int i = 0; i < cpSize; i++) {

        /* The basic loop algorithm is that we get the
         * current certificate, we verify the current certificate using
         * information from the previous certificate and from the state,
         * and we modify the state for the next loop by setting the
         * current certificate of this loop to be the previous certificate
         * of the next loop. The state is initialized during first loop.
         */
        if (debug != null)
            debug.println("Checking cert" + (i+1) + " ...");

        X509Certificate currCert = reversedCertList.get(i);
        Set<String> unresCritExts = currCert.getCriticalExtensionOIDs();
        if (unresCritExts == null) {
            unresCritExts = Collections.<String>emptySet();
        }

        if (debug != null && !unresCritExts.isEmpty()) {
            debug.println("Set of critical extensions:");
            for (String oid : unresCritExts) {
                debug.println(oid);
            }
        }

        for (int j = 0; j < certPathCheckers.size(); j++) {

            PKIXCertPathChecker currChecker = certPathCheckers.get(j);
            if (debug != null) {
                debug.println("-Using checker" + (j + 1) + " ... [" +
                    currChecker.getClass().getName() + "]");
            }

            if (i == 0)
                currChecker.init(false);

            try {
                currChecker.check(currCert, unresCritExts);

                if (debug != null) {
                    debug.println("-checker" + (j + 1) +
                        " validation succeeded");
                }

            } catch (CertPathValidatorException cpve) {
                throw new CertPathValidatorException(cpve.getMessage(),
                    cpve.getCause(), cpOriginal, cpSize - (i + 1),
                    cpve.getReason());
            }
        }

        if (!unresCritExts.isEmpty()) {
            throw new CertPathValidatorException("unrecognized " +
                "critical extension(s)", null, cpOriginal, cpSize-(i+1),
                PKIXReason.UNRECOGNIZED_CRIT_EXT);
        }

        if (debug != null)
            debug.println("\ncert" + (i+1) + " validation succeeded.\n");
    }

    if (debug != null) {
        debug.println("Cert path validation succeeded. (PKIX validation "
                      + "algorithm)");
        debug.println("-------------------------------------------------"
                      + "-------------");
    }
}
 

public static void main(String args[]) throws Exception {
    if (args.length != 1) {
        throw new Exception("Incorrect number of arguments");
    }
    Test test = tests[Integer.parseInt(args[0])];
    Security.setProperty("jdk.tls.disabledAlgorithms", test.tlsDisAlgs);
    Security.setProperty("jdk.certpath.disabledAlgorithms",
                         test.certPathDisAlgs);

    if (debug) {
        System.setProperty("javax.net.debug", "all");
    }

    /*
     * Start the tests.
     */
    try {
        new PKIXExtendedTM();
        if (test.fail) {
            throw new Exception("Expected MD5 certificate to be blocked");
        }
    } catch (Exception e) {
        if (test.fail) {
            // find expected cause
            boolean correctReason = false;
            Throwable cause = e.getCause();
            while (cause != null) {
                if (cause instanceof CertPathValidatorException) {
                    CertPathValidatorException cpve =
                        (CertPathValidatorException)cause;
                    if (cpve.getReason() == CertPathValidatorException.BasicReason.ALGORITHM_CONSTRAINED) {
                        correctReason = true;
                        break;
                    }
                }
                cause = cause.getCause();
            }
            if (!correctReason) {
                throw new Exception("Unexpected exception", e);
            }
        } else {
            throw e;
        }
    }
}