Verify maximum certification path length for the preparation step.

@param ValidatorState $state
@param Certificate $cert
@throws PathValidationException
@return ValidatorState
432925
private function _verifyMaxPathLength(ValidatorState $state,
        Certificate $cert): ValidatorState
    {
        if (!$cert->isSelfIssued()) {
            if ($state->maxPathLength() <= 0) {
                throw new PathValidationException(
                    "Certification path length exceeded.");
            }
            $state = $state->withMaxPathLength($state->maxPathLength() - 1);
        }
        return $state;
    }
881496
protected void checkCRLDateValidity(X509CRL crl)
            throws CertPathValidatorException {

        Date now = new Date();
        boolean valid = crl.getThisUpdate().before(now) && ((crl.getNextUpdate() != null)
                && (crl.getNextUpdate().after(now)));
        if (!valid) {
            throw new CertPathValidatorException("CRL issued by " + crl.getIssuerDN() + " has expired");
        }
    }
33911
protected void validateCertificate(X509Certificate[] chain) throws com.ibm.wsspi.security.wim.exception.CertificateMapFailedException {
        // validate the certificate array
        if (chain == null || chain.length == 0) {
            throw new com.ibm.wsspi.security.wim.exception.CertificateMapFailedException();
        }

        for (X509Certificate cert : chain) {
            if (cert == null) {
                throw new com.ibm.wsspi.security.wim.exception.CertificateMapFailedException();
            }
        }
    }
1051813
private function _validateHolder(): Certificate
    {
        $path = $this->_config->holderPath();
        $config = PathValidationConfig::defaultConfig()->withMaxLength(
            count($path))->withDateTime($this->_config->evaluationTime());
        try {
            $holder = $path->validate($config, $this->_crypto)->certificate();
        } catch (PathValidationException $e) {
            throw new ACValidationException(
                "Failed to validate holder PKC's certification path.", 0, $e);
        }
        if (!$this->_ac->isHeldBy($holder)) {
            throw new ACValidationException("Name mismatch of AC's holder PKC.");
        }
        return $holder;
    }
735733
public function validate(): PathValidationResult
    {
        $n = count($this->_certificates);
        $state = ValidatorState::initialize($this->_config, $this->_trustAnchor,
            $n);
        for ($i = 0; $i < $n; ++$i) {
            $state = $state->withIndex($i + 1);
            $cert = $this->_certificates[$i];
            // process certificate (section 6.1.3.)
            $state = $this->_processCertificate($state, $cert);
            if (!$state->isFinal()) {
                // prepare next certificate (section 6.1.4.)
                $state = $this->_prepareNext($state, $cert);
            }
        }
        if (!isset($cert)) {
            throw new \LogicException("No certificates.");
        }
        // wrap-up (section 6.1.5.)
        $state = $this->_wrapUp($state, $cert);
        // return outputs
        return $state->getResult($this->_certificates);
    }
175081
public function equals(Certificate $cert): bool
    {
        return $this->_hasEqualSerialNumber($cert) &&
             $this->_hasEqualPublicKey($cert) && $this->_hasEqualSubject($cert);
    }
1130914
function loadCA($cert)
    {
        $olddn = $this->dn;
        $oldcert = $this->currentCert;
        $oldsigsubj = $this->signatureSubject;

        $cert = $this->loadX509($cert);
        if (!$cert) {
            $this->dn = $olddn;
            $this->currentCert = $oldcert;
            $this->signatureSubject = $oldsigsubj;

            return false;
        }

        /* From RFC5280 "PKIX Certificate and CRL Profile":

           If the keyUsage extension is present, then the subject public key
           MUST NOT be used to verify signatures on certificates or CRLs unless
           the corresponding keyCertSign or cRLSign bit is set. */
        //$keyUsage = $this->getExtension('id-ce-keyUsage');
        //if ($keyUsage && !in_array('keyCertSign', $keyUsage)) {
        //    return false;
        //}

        /* From RFC5280 "PKIX Certificate and CRL Profile":

           The cA boolean indicates whether the certified public key may be used
           to verify certificate signatures.  If the cA boolean is not asserted,
           then the keyCertSign bit in the key usage extension MUST NOT be
           asserted.  If the basic constraints extension is not present in a
           version 3 certificate, or the extension is present but the cA boolean
           is not asserted, then the certified public key MUST NOT be used to
           verify certificate signatures. */
        //$basicConstraints = $this->getExtension('id-ce-basicConstraints');
        //if (!$basicConstraints || !$basicConstraints['cA']) {
        //    return false;
        //}

        $this->CAs[] = $cert;

        $this->dn = $olddn;
        $this->currentCert = $oldcert;
        $this->signatureSubject = $oldsigsubj;

        return true;
    }
1149358
private function _hasEqualPublicKey(Certificate $cert): bool
    {
        $kid1 = $this->_tbsCertificate->subjectPublicKeyInfo()->keyIdentifier();
        $kid2 = $cert->_tbsCertificate->subjectPublicKeyInfo()->keyIdentifier();
        return $kid1 == $kid2;
    }
506699
private function _checkIssuer(ValidatorState $state, Certificate $cert)
    {
        if (!$cert->tbsCertificate()
            ->issuer()
            ->equals($state->workingIssuerName())) {
            throw new PathValidationException("Certification issuer mismatch.");
        }
    }
251343
public static function setValidationState( $state = true)
	{
		$previousState = XBRL::$validating;
		XBRL::$validating = $state;
		return $previousState;
	}
79784
public int getPathConstraint() {

        int pathLength = Integer.MAX_VALUE;
        try {
            for (int i=0; i<this.certChain.length; i++) {
                int length = BouncyCastleUtil.getProxyPathConstraint(this.certChain[i]);
                // if length is one, then no proxy cert extension exists, so
                // path length is -1
                if (length == -1) {
                    length = Integer.MAX_VALUE;
                }
                if (length < pathLength) {
                    pathLength = length;
                }
            }
        } catch (Exception e) {
            logger.warn("Error retrieving path length.", e);
            pathLength = -1;
        }
        return pathLength;
    }
6010
private function _processBasicContraints(Certificate $cert)
    {
        if ($cert->tbsCertificate()->version() == TBSCertificate::VERSION_3) {
            $extensions = $cert->tbsCertificate()->extensions();
            if (!$extensions->hasBasicConstraints()) {
                throw new PathValidationException(
                    "v3 certificate must have basicConstraints extension.");
            }
            // verify that cA is set to TRUE
            if (!$extensions->basicConstraints()->isCA()) {
                throw new PathValidationException(
                    "Certificate is not a CA certificate.");
            }
        }
    }
1174707
private function _preparePolicyMappings(ValidatorState $state,
        Certificate $cert): ValidatorState
    {
        $extensions = $cert->tbsCertificate()->extensions();
        if ($extensions->hasPolicyMappings()) {
            // (a) verify that anyPolicy mapping is not used
            if ($extensions->policyMappings()->hasAnyPolicyMapping()) {
                throw new PathValidationException("anyPolicy mapping found.");
            }
            // (b) process policy mappings
            if ($state->hasValidPolicyTree()) {
                $state = $state->validPolicyTree()->processMappings($state,
                    $cert);
            }
        }
        return $state;
    }
479326
public function contains(Certificate $cert): bool
    {
        $id = self::_getCertKeyId($cert);
        $map = $this->_getKeyIdMap();
        if (!isset($map[$id])) {
            return false;
        }
        foreach ($map[$id] as $c) {
            /** @var Certificate $c */
            if ($cert->equals($c)) {
                return true;
            }
        }
        return false;
    }
9996
private function _preparePolicyConstraints(ValidatorState $state,
        Certificate $cert): ValidatorState
    {
        $extensions = $cert->tbsCertificate()->extensions();
        if (!$extensions->hasPolicyConstraints()) {
            return $state;
        }
        $ext = $extensions->policyConstraints();
        // (i.1)
        if ($ext->hasRequireExplicitPolicy() &&
             $ext->requireExplicitPolicy() < $state->explicitPolicy()) {
            $state = $state->withExplicitPolicy($ext->requireExplicitPolicy());
        }
        // (i.2)
        if ($ext->hasInhibitPolicyMapping() &&
             $ext->inhibitPolicyMapping() < $state->policyMapping()) {
            $state = $state->withPolicyMapping($ext->inhibitPolicyMapping());
        }
        return $state;
    }
429054
private static function _getCertKeyId(Certificate $cert): string
    {
        $exts = $cert->tbsCertificate()->extensions();
        if ($exts->hasSubjectKeyIdentifier()) {
            return $exts->subjectKeyIdentifier()->keyIdentifier();
        }
        return $cert->tbsCertificate()
            ->subjectPublicKeyInfo()
            ->keyIdentifier();
    }
442768
public void updateState(TrustAnchor anchor, BuilderParams buildParams)
        throws CertificateException, IOException, CertPathValidatorException
    {
        trustAnchor = anchor;
        X509Certificate trustedCert = anchor.getTrustedCert();
        if (trustedCert != null) {
            updateState(trustedCert);
        } else {
            X500Principal caName = anchor.getCA();
            updateState(anchor.getCAPublicKey(), caName);
        }

        // The user specified AlgorithmChecker and RevocationChecker may not be
        // able to set the trust anchor until now.
        boolean revCheckerAdded = false;
        for (PKIXCertPathChecker checker : userCheckers) {
            if (checker instanceof AlgorithmChecker) {
                ((AlgorithmChecker)checker).trySetTrustAnchor(anchor);
            } else if (checker instanceof PKIXRevocationChecker) {
                if (revCheckerAdded) {
                    throw new CertPathValidatorException(
                        "Only one PKIXRevocationChecker can be specified");
                }
                // if it's our own, initialize it
                if (checker instanceof RevocationChecker) {
                    ((RevocationChecker)checker).init(anchor, buildParams);
                }
                ((PKIXRevocationChecker)checker).init(false);
                revCheckerAdded = true;
            }
        }

        // only create a RevocationChecker if revocation is enabled and
        // a PKIXRevocationChecker has not already been added
        if (buildParams.revocationEnabled() && !revCheckerAdded) {
            revChecker = new RevocationChecker(anchor, buildParams);
            revChecker.init(false);
        }

        init = false;
    }