Construct secure networked applications with certificates, Part 4

  public
  static
  boolean
  verify
  (
    X509Certificate x509certificateRoot,
    Collection collectionX509CertificateChain,
    String stringTarget
  )
  {
    int nSize = collectionX509CertificateChain.size();
    X509Certificate [] arx509certificate = new X509Certificate [nSize];
    collectionX509CertificateChain.toArray(arx509certificate);
    // Working down the chain, for every certificate in the chain,
    // verify that the subject of the certificate is the issuer of the
    // next certificate in the chain.
    Principal principalLast = null;
    for (int i = 0; i < nSize; i++)
    {
      X509Certificate x509certificate = arx509certificate[i];
      Principal principalIssuer = x509certificate.getIssuerDN();
      Principal principalSubject = x509certificate.getSubjectDN();
      if (principalLast != null)
      {
        if (principalIssuer.equals(principalLast))
        {
          try
          {
            PublicKey publickey = arx509certificate[i - 1].getPublicKey();
            arx509certificate[i].verify(publickey);
          }
          catch (GeneralSecurityException generalsecurityexception)
          {
            System.out.println("signature verification failed");
            return false;
          }
        }
        else
        {
          System.out.println("subject/issuer verification failed");
          return false;
        }
      }
      principalLast = principalSubject;
    }
    // Verify that the the first certificate in the chain was issued
    // by a third-party that the client trusts.
    try
    {
      PublicKey publickey = x509certificateRoot.getPublicKey();
      arx509certificate[0].verify(publickey);
    }
    catch (GeneralSecurityException generalsecurityexception)
    {
      System.out.println("signature verification failed");
      return false;
    }
    // Verify that the last certificate in the chain corresponds to
    // the server we desire to authenticate.
    Principal principalSubject = arx509certificate[nSize - 
1].getSubjectDN();
    if (!stringTarget.equals(principalSubject.getName()))
    {
      System.out.println("target verification failed");
      return false;
    }
    // For every certificate in the chain, verify that the certificate
    // is valid at the current time.
    Date date = new Date();
    for (int i = 0; i < nSize; i++)
    {
      try
      {
        arx509certificate[i].checkValidity(date);
      }
      catch (GeneralSecurityException generalsecurityexception)
      {
        System.out.println("invalid date");
        return false;
      }
    }
    return true;
  }

  java Client <> <>