Working with path validation results

This code sample demonstrates working with path validation results

Supported Languages

C++

void WorkingWithPathValidationResults()
{
      if(g_pvr == NULL)
            return;

      //**********************************************************************
      //CPKIFPathValidationResults functionality
      //**********************************************************************
      //Diagnostic code: This should be 0 for all successful paths
      //and non-zero for failed paths.
      int diagnosticCode = g_pvr->DiagnosticCode();

      //GetCertificate: This returns the certificate that was
      //the target of the path processing operation.
      CPKIFCertificateNodeEntryPtr targetCert = g_pvr->GetCertificate();
 

      //GetBasicChecksSuccessfullyPerformed, GetCertSignaturesVerified
      //and GetRevocationStatusMostSevere: Path validation is implemented
      //in three stages: basic validation checks, signature verification
      //and revocation status determination.  These functions return the
      //outcome of each stage.  True represents success for basic checks
      //and signature verification; NOT_REVOKED represents success for
      //revocation status determination.
      bool basicChecksSucceeded = g_pvr->GetBasicChecksSuccessfullyPerformed();
      bool signaturesVerified = g_pvr->GetBasicChecksSuccessfullyPerformed();
      RevocationStatus worstRevocationStatus =
            g_pvr->GetRevocationStatusMostSevere(); 

      //GetTargetIsTrustAnchor: This returns true is the target certificate
      //is a trust anchor and false otherwise.  When the target is a trust
      //anchor,path validation checks are not performed.
      bool targetIsTrustAnchor = g_pvr->GetTargetIsTrustAnchor(); 

      //PathSuccessfullyValidated: This is a convenience function that returns
      //true if each of GetBasicChecksSuccessfullyPerformed,
      //GetCertSignaturesVerified and GetRevocationStatusMostSevere are
      //successful or the target certificate is a trust anchor.
      bool pathSuccessfullyValidated = g_pvr->PathSuccessfullyValidated(); 

      //GetWorkingParams: This function returns the DSA parameters that
      //should be used in conjunction with the target certificate public key
      //when verifying signatures.
      CPKIFAlgorithmIdentifierPtr workingParams = g_pvr->GetWorkingParams(); 

      //GetUserConstrainedSet: This function return the list of of
      //PolicyInformation objects representing the set of certificate policies
      //for which the target certificate is valid based on the authority
      //constraints present in the path and the initial policy set specified
      //by the application.

      CPKIFPolicyInformationListPtr userConstrainedSet
            (new CPKIFPolicyInformationList);
        

      g_pvr->GetUserConstrainedSet(userConstrainedSet); 

      //GetExplicitPolicyIndicator:
      bool explicitPolicyIndicator = g_pvr->GetExplicitPolicyIndicator(); 

      //GetAuthorityConstrainedSet and GetAuthorityConstrainedSetTable:
      //These functions can be used to return simply the list of policies for
      //which the target certificate is valid based on the authority constraints
      //present in the path or the entire history of policy processing accumulated
      //during the path validation operation, including policy mapping.
      CPKIFPolicyInformationListPtr authorityConstrainedSet
            (new CPKIFPolicyInformationList);

      g_pvr->GetAuthorityConstrainedSet(authorityConstrainedSet);
      const vector<CPKIFPolicyInformationListPtr>* authSetTable =
            g_pvr->GetAuthorityConstrainedSetTable(); 

      //GetCertStatus: This function returns the CPKIFCertStatus object for
      //the certificate being processed when the validation operation terminated. 
      //For successful paths this will always
      //be the certificate status information associated with the target certificate.
      CPKIFCertStatusPtr certStatus = g_pvr->GetCertStatus(); 

      //******************************************************************************
      //CPKIFCertStatus functionality
      //******************************************************************************
      if(certStatus == NULL)
            return; 

      //Diagnostic code: This should be 0 for all successful certificates
      //and non-zero for failed certificates.
      int csDiagnosticCode = certStatus->GetDiagnosticCode(); 

      //GetBasicChecksSuccessfullyPerformed, GetCertSignaturesVerified and
      //GetRevocationStatusMostSevere: Path validation is implemented in three
      //stages: basic validation checks, signature verification and revocation
      //status determination.  These functions return the outcome of each
      //stage for a specific certificate.  True represents success for basic checks 
      //and signature verification; NOT_REVOKED represents success for revocation
      //status determination.
      bool csBasicChecksSucceeded = certStatus->GetPassedValidationChecks();
      bool csSignatureVerified = certStatus->GetSignatureVerified();
      RevocationStatus csRevocationStatus = certStatus->GetRevocationStatus(); 

      //GetIsTrustAnchor: This returns true is the certificate associated with
      //the cert status object is a a trust anchor and false otherwise.
      bool csIsTrustAnchor = certStatus->GetIsTrustAnchor();

      //GetRevocationSources:  The GetRevocationSources function returns a list of
      //revocation information used to produce a decision regarding the revocation
      //status of the associated certificate. 
      certStatus->GetRevocationSources(g_rsl);
}

C#

public void WorkingWithPathValidationResults()
{
    if (g_pvr == null || g_pvr.get() == null)
        return; 

    //**********************************************************************
    //CPKIFPathValidationResults functionality
    //**********************************************************************
    //Diagnostic code: This should be 0 for all successful paths
    //and non-zero for failed paths.
    int diagnosticCode = g_pvr.DiagnosticCode(); 

    //GetCertificate: This returns the certificate that was
    //the target of the path processing operation.
    CPKIFCertificateNodeEntryPtr targetCert = g_pvr.GetCertificate(); 

    //GetBasicChecksSuccessfullyPerformed, GetCertSignaturesVerified
    //and GetRevocationStatusMostSevere: Path validation is implemented
    //in three stages: basic validation checks, signature verification
    //and revocation status determination.  These functions return the
    //outcome of each stage.  True represents success for basic checks
    //and signature verification; NOT_REVOKED represents success for
    //revocation status determination.
    bool basicChecksSucceeded = g_pvr.GetBasicChecksSuccessfullyPerformed();
    bool signaturesVerified = g_pvr.GetBasicChecksSuccessfullyPerformed();
    RevocationStatus worstRevocationStatus = g_pvr.GetRevocationStatusMostSevere(); 

    //GetTargetIsTrustAnchor: This returns true is the target certificate
    //is a trust anchor and false otherwise.  When the target is a trust
    //anchor,path validation checks are not performed.
    bool targetIsTrustAnchor = g_pvr.GetTargetIsTrustAnchor(); 

    //PathSuccessfullyValidated: This is a convenience function that returns
    //true if each of GetBasicChecksSuccessfullyPerformed,
    //GetCertSignaturesVerified and GetRevocationStatusMostSevere are
    //successful or the target certificate is a trust anchor.
    bool pathSuccessfullyValidated = g_pvr.PathSuccessfullyValidated(); 

    //GetWorkingParams: This function returns the DSA parameters that
    //should be used in conjunction with the target certificate public key
    //when verifying signatures.
    CPKIFAlgorithmIdentifierPtr workingParams = g_pvr.GetWorkingParams(); 

    //GetUserConstrainedSet: This function return the list of of
    //PolicyInformation objects representing the set of certificate policies
    //for which the target certificate is valid based on the authority
    //constraints present in the path and the initial policy set specified
    //by the application.
    CPKIFPolicyInformationListPtr userConstrainedSet = pkif_module.make_CPKIFPolicyInformationListPtr();
    g_pvr.GetUserConstrainedSet(userConstrainedSet); 

    //GetExplicitPolicyIndicator:
    bool explicitPolicyIndicator = g_pvr.GetExplicitPolicyIndicator(); 

    //GetAuthorityConstrainedSet and GetAuthorityConstrainedSetTable:
    //These functions can be used to return simply the list of policies for
    //which the target certificate is valid based on the authority constraints
    //present in the path or the entire history of policy processing accumulated
    //during the path validation operation, including policy mapping.
    CPKIFPolicyInformationListPtr authorityConstrainedSet = pkif_module.make_CPKIFPolicyInformationListPtr();
    g_pvr.GetAuthorityConstrainedSet(authorityConstrainedSet);
    CPKIFAuthorityConstrainedSetTable authSetTable = g_pvr.GetAuthorityConstrainedSetTable(); 

    //GetCertStatus: This function returns the CPKIFCertStatus object for
    //the certificate being processed when the validation operation terminated. 
    //For successful paths this will always
    //be the certificate status information associated with the target certificate.
    CPKIFCertStatusPtr certStatus = g_pvr.GetCertStatus(); 

    //******************************************************************************
    //CPKIFCertStatus functionality
    //******************************************************************************
    if(certStatus.get() == null)
        return;

    //Diagnostic code: This should be 0 for all successful certificates
    //and non-zero for failed certificates.
    int csDiagnosticCode = certStatus.GetDiagnosticCode(); 

    //GetBasicChecksSuccessfullyPerformed, GetCertSignaturesVerified and
    //GetRevocationStatusMostSevere: Path validation is implemented in three
    //stages: basic validation checks, signature verification and revocation
    //status determination.  These functions return the outcome of each
    //stage for a specific certificate.  True represents success for basic checks
    //and signature verification; NOT_REVOKED represents success for revocation
    //status determination.
    bool csBasicChecksSucceeded = certStatus.GetPassedValidationChecks();
    bool csSignatureVerified = certStatus.GetSignatureVerified();
    RevocationStatus csRevocationStatus = certStatus.GetRevocationStatus(); 

    //GetIsTrustAnchor: This returns true is the certificate associated with
    //the cert status object is a a trust anchor and false otherwise.
    bool csIsTrustAnchor = certStatus.GetIsTrustAnchor(); 

    //GetRevocationSources:  The GetRevocationSources function returns a list of
    //revocation information used to produce a decision regarding the revocation
    //status of the associated certificate. 
    g_rsl = new RevocationSourceList();
    certStatus.GetRevocationSources(g_rsl);
}

JAVA

public void WorkingWithPathValidationResults()
{
    if (g_pvr == null || g_pvr.get() == null)
        return; 

    //**********************************************************************
    //CPKIFPathValidationResults functionality
    //**********************************************************************
    //Diagnostic code: This should be 0 for all successful paths
    //and non-zero for failed paths.
    int diagnosticCode = g_pvr.DiagnosticCode(); 

    //GetCertificate: This returns the certificate that was
    //the target of the path processing operation.
    CPKIFCertificateNodeEntryPtr targetCert = g_pvr.GetCertificate(); 

    //GetBasicChecksSuccessfullyPerformed, GetCertSignaturesVerified
    //and GetRevocationStatusMostSevere: Path validation is implemented
    //in three stages: basic validation checks, signature verification
    //and revocation status determination.  These functions return the
    //outcome of each stage.  True represents success for basic checks
    //and signature verification; NOT_REVOKED represents success for
    //revocation status determination.
    boolean basicChecksSucceeded = g_pvr.GetBasicChecksSuccessfullyPerformed();
    boolean signaturesVerified = g_pvr.GetBasicChecksSuccessfullyPerformed();
    RevocationStatus worstRevocationStatus = g_pvr.GetRevocationStatusMostSevere(); 

    //GetTargetIsTrustAnchor: This returns true is the target certificate
    //is a trust anchor and false otherwise.  When the target is a trust
    //anchor,path validation checks are not performed.
    boolean targetIsTrustAnchor = g_pvr.GetTargetIsTrustAnchor(); 

    //PathSuccessfullyValidated: This is a convenience function that returns
    //true if each of GetBasicChecksSuccessfullyPerformed,
    //GetCertSignaturesVerified and GetRevocationStatusMostSevere are
    //successful or the target certificate is a trust anchor.
    boolean pathSuccessfullyValidated = g_pvr.PathSuccessfullyValidated(); 

    //GetWorkingParams: This function returns the DSA parameters that
    //should be used in conjunction with the target certificate public key
    //when verifying signatures.
    CPKIFAlgorithmIdentifierPtr workingParams = g_pvr.GetWorkingParams(); 

    //GetUserConstrainedSet: This function return the list of of
    //PolicyInformation objects representing the set of certificate policies 
    //for which the target certificate is valid based on the authority
    //constraints present in the path and the initial policy set specified
    //by the application.
    CPKIFPolicyInformationListPtr userConstrainedSet = pkif_module.make_CPKIFPolicyInformationListPtr();
    g_pvr.GetUserConstrainedSet(userConstrainedSet); 

    //GetExplicitPolicyIndicator:
    boolean explicitPolicyIndicator = g_pvr.GetExplicitPolicyIndicator(); 

    //GetAuthorityConstrainedSet and GetAuthorityConstrainedSetTable:
    //These functions can be used to return simply the list of policies for
    //which the target certificate is valid based on the authority constraints
    //present in the path or the entire history of policy processing accumulated
    //during the path validation operation, including policy mapping.
    CPKIFPolicyInformationListPtr authorityConstrainedSet = pkif_module.make_CPKIFPolicyInformationListPtr();
    g_pvr.GetAuthorityConstrainedSet(authorityConstrainedSet);
    CPKIFAuthorityConstrainedSetTable authSetTable = g_pvr.GetAuthorityConstrainedSetTable(); 

    //GetCertStatus: This function returns the CPKIFCertStatus object for
    //the certificate being processed when the validation operation terminated. 
    //For successful paths this will always
    //be the certificate status information associated with the target certificate.
    CPKIFCertStatusPtr certStatus = g_pvr.GetCertStatus(); 

    //******************************************************************************
    //CPKIFCertStatus functionality
    //******************************************************************************
    if(certStatus.get() == null)
        return; 

    //Diagnostic code: This should be 0 for all successful certificates
    //and non-zero for failed certificates.
    int csDiagnosticCode = certStatus.GetDiagnosticCode(); 

    //GetBasicChecksSuccessfullyPerformed, GetCertSignaturesVerified and
    //GetRevocationStatusMostSevere: Path validation is implemented in three
    //stages: basic validation checks, signature verification and revocation
    //status determination.  These functions return the outcome of each
    //stage for a specific certificate.  True represents success for basic checks
    //and signature verification; NOT_REVOKED represents success for revocation
    //status determination.
    boolean csBasicChecksSucceeded = certStatus.GetPassedValidationChecks();
    boolean csSignatureVerified = certStatus.GetSignatureVerified();
    RevocationStatus csRevocationStatus = certStatus.GetRevocationStatus();

    //GetIsTrustAnchor: This returns true is the certificate associated with
    //the cert status object is a a trust anchor and false otherwise.
    boolean csIsTrustAnchor = certStatus.GetIsTrustAnchor(); 

    //GetRevocationSources:  The GetRevocationSources function returns a list of
    //revocation information used to produce a decision regarding the revocation
    //status of the associated certificate. 
    g_rsl = new RevocationSourceList();
    certStatus.GetRevocationSources(g_rsl);
}