BCJSSE: Tolerate empty trusted certs set in TM
private final JcaJceHelper helper;
private final Set<X509Certificate> trustedCerts;
- private final PKIXParameters baseParameters;
+ private final PKIXBuilderParameters baseParameters;
private final X509TrustManager exportX509TrustManager;
ProvX509TrustManager(JcaJceHelper helper, Set<TrustAnchor> trustAnchors)
this.trustedCerts = getTrustedCerts(trustAnchors);
// Setup PKIX parameters
+ if (trustedCerts.isEmpty())
+ {
+ this.baseParameters = null;
+ }
+ else
{
this.baseParameters = new PKIXBuilderParameters(trustAnchors, null);
this.baseParameters.setRevocationEnabled(provCheckRevocation);
this.trustedCerts = getTrustedCerts(baseParameters.getTrustAnchors());
// Setup PKIX parameters
+ if (trustedCerts.isEmpty())
{
- if (baseParameters instanceof PKIXBuilderParameters)
+ this.baseParameters = null;
+ }
+ else if (baseParameters instanceof PKIXBuilderParameters)
{
this.baseParameters = (PKIXBuilderParameters)baseParameters.clone();
this.baseParameters.setTargetCertConstraints(null);
this.baseParameters.setRevocationEnabled(baseParameters.isRevocationEnabled());
this.baseParameters.setSigProvider(baseParameters.getSigProvider());
}
- }
this.exportX509TrustManager = X509TrustManagerUtil.exportX509TrustManager(this);
}
@@ -201,6 +208,11 @@ private CertStoreParameters getCertStoreParameters(X509Certificate eeCert, X509C
return new X509Certificate[]{ eeCert };
}
+ if (null == baseParameters)
+ {
+ throw new CertificateException("unable to process certificates: no PKIXBuilderParameters available");
+ }
+
try
{
/*
