# TrustAnchor
Added in[API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)
Summary:[Ctors](https://developer.android.com/reference/java/security/cert/TrustAnchor#pubctors)\|[Methods](https://developer.android.com/reference/java/security/cert/TrustAnchor#pubmethods)\|[Inherited Methods](https://developer.android.com/reference/java/security/cert/TrustAnchor#inhmethods)
# TrustAnchor
`
public
class
TrustAnchor
`
`
extends `[Object](https://developer.android.com/reference/java/lang/Object)`
``
`
|---|--------------------------------|
| [java.lang.Object](https://developer.android.com/reference/java/lang/Object) ||
| ↳ | java.security.cert.TrustAnchor |
*** ** * ** ***
A trust anchor or most-trusted Certification Authority (CA).
This class represents a "most-trusted CA", which is used as a trust anchor for validating X.509 certification paths. A most-trusted CA includes the public key of the CA, the CA's name, and any constraints upon the set of paths which may be validated using this key. These parameters can be specified in the form of a trusted`X509Certificate`or as individual parameters.
**Concurrent Access**
All`TrustAnchor`objects must be immutable and thread-safe. That is, multiple threads may concurrently invoke the methods defined in this class on a single`TrustAnchor`object (or more than one) with no ill effects. Requiring`TrustAnchor`objects to be immutable and thread-safe allows them to be passed around to various pieces of code without worrying about coordinating access. This stipulation applies to all public fields and methods of this class and any added or overridden by subclasses.
**See also:**
- [PKIXParameters.PKIXParameters(Set)](https://developer.android.com/reference/java/security/cert/PKIXParameters#PKIXParameters(java.util.Set))
- [PKIXBuilderParameters.PKIXBuilderParameters(Set, CertSelector)](https://developer.android.com/reference/java/security/cert/PKIXBuilderParameters#PKIXBuilderParameters(java.util.Set,%20java.security.cert.CertSelector))
## Summary
| ### Public constructors ||
|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---|
| ` `[TrustAnchor](https://developer.android.com/reference/java/security/cert/TrustAnchor#TrustAnchor(java.lang.String,%20java.security.PublicKey,%20byte[]))`(`[String](https://developer.android.com/reference/java/lang/String)` caName, `[PublicKey](https://developer.android.com/reference/java/security/PublicKey)` pubKey, byte[] nameConstraints) ` Creates an instance of`TrustAnchor`where the most-trusted CA is specified as a distinguished name and public key. |
| ` `[TrustAnchor](https://developer.android.com/reference/java/security/cert/TrustAnchor#TrustAnchor(java.security.cert.X509Certificate,%20byte[]))`(`[X509Certificate](https://developer.android.com/reference/java/security/cert/X509Certificate)` trustedCert, byte[] nameConstraints) ` Creates an instance of`TrustAnchor`with the specified`X509Certificate`and optional name constraints, which are intended to be used as additional constraints when validating an X.509 certification path. |
| ` `[TrustAnchor](https://developer.android.com/reference/java/security/cert/TrustAnchor#TrustAnchor(javax.security.auth.x500.X500Principal,%20java.security.PublicKey,%20byte[]))`(`[X500Principal](https://developer.android.com/reference/javax/security/auth/x500/X500Principal)` caPrincipal, `[PublicKey](https://developer.android.com/reference/java/security/PublicKey)` pubKey, byte[] nameConstraints) ` Creates an instance of`TrustAnchor`where the most-trusted CA is specified as an X500Principal and public key. |
| ### Public methods ||
|----------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| ` final `[X500Principal](https://developer.android.com/reference/javax/security/auth/x500/X500Principal) | ` `[getCA](https://developer.android.com/reference/java/security/cert/TrustAnchor#getCA())`() ` Returns the name of the most-trusted CA as an X500Principal. |
| ` final `[String](https://developer.android.com/reference/java/lang/String) | ` `[getCAName](https://developer.android.com/reference/java/security/cert/TrustAnchor#getCAName())`() ` Returns the name of the most-trusted CA in RFC 2253`String`format. |
| ` final `[PublicKey](https://developer.android.com/reference/java/security/PublicKey) | ` `[getCAPublicKey](https://developer.android.com/reference/java/security/cert/TrustAnchor#getCAPublicKey())`() ` Returns the public key of the most-trusted CA. |
| ` final byte[]` | ` `[getNameConstraints](https://developer.android.com/reference/java/security/cert/TrustAnchor#getNameConstraints())`() ` Returns the name constraints parameter. |
| ` final `[X509Certificate](https://developer.android.com/reference/java/security/cert/X509Certificate) | ` `[getTrustedCert](https://developer.android.com/reference/java/security/cert/TrustAnchor#getTrustedCert())`() ` Returns the most-trusted CA certificate. |
| ` `[String](https://developer.android.com/reference/java/lang/String) | ` `[toString](https://developer.android.com/reference/java/security/cert/TrustAnchor#toString())`() ` Returns a formatted string describing the`TrustAnchor`. |
| ### Inherited methods |
|-----------------------|---|
| From class` `[java.lang.Object](https://developer.android.com/reference/java/lang/Object)` ` |--------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | ` `[Object](https://developer.android.com/reference/java/lang/Object) | ` `[clone](https://developer.android.com/reference/java/lang/Object#clone())`() ` Creates and returns a copy of this object. | | ` boolean` | ` `[equals](https://developer.android.com/reference/java/lang/Object#equals(java.lang.Object))`(`[Object](https://developer.android.com/reference/java/lang/Object)` obj) ` Indicates whether some other object is "equal to" this one. | | ` void` | ` `[finalize](https://developer.android.com/reference/java/lang/Object#finalize())`() ` Called by the garbage collector on an object when garbage collection determines that there are no more references to the object. | | ` final `[Class](https://developer.android.com/reference/java/lang/Class)`` | ` `[getClass](https://developer.android.com/reference/java/lang/Object#getClass())`() ` Returns the runtime class of this`Object`. | | ` int` | ` `[hashCode](https://developer.android.com/reference/java/lang/Object#hashCode())`() ` Returns a hash code value for the object. | | ` final void` | ` `[notify](https://developer.android.com/reference/java/lang/Object#notify())`() ` Wakes up a single thread that is waiting on this object's monitor. | | ` final void` | ` `[notifyAll](https://developer.android.com/reference/java/lang/Object#notifyAll())`() ` Wakes up all threads that are waiting on this object's monitor. | | ` `[String](https://developer.android.com/reference/java/lang/String) | ` `[toString](https://developer.android.com/reference/java/lang/Object#toString())`() ` Returns a string representation of the object. | | ` final void` | ` `[wait](https://developer.android.com/reference/java/lang/Object#wait(long,%20int))`(long timeoutMillis, int nanos) ` Causes the current thread to wait until it is awakened, typically by being*notified* or*interrupted*, or until a certain amount of real time has elapsed. | | ` final void` | ` `[wait](https://developer.android.com/reference/java/lang/Object#wait(long))`(long timeoutMillis) ` Causes the current thread to wait until it is awakened, typically by being*notified* or*interrupted*, or until a certain amount of real time has elapsed. | | ` final void` | ` `[wait](https://developer.android.com/reference/java/lang/Object#wait())`() ` Causes the current thread to wait until it is awakened, typically by being*notified* or*interrupted*. | ||
## Public constructors
### TrustAnchor
Added in[API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)
```
public TrustAnchor (String caName,
PublicKey pubKey,
byte[] nameConstraints)
```
Creates an instance of`TrustAnchor`where the most-trusted CA is specified as a distinguished name and public key. Name constraints are an optional parameter, and are intended to be used as additional constraints when validating an X.509 certification path.
The name constraints are specified as a byte array. This byte array contains the DER encoded form of the name constraints, as they would appear in the NameConstraints structure defined in RFC 5280 and X.509. The ASN.1 notation for this structure is supplied in the documentation for[TrustAnchor(X509Certificate trustedCert, byte[] nameConstraints)](https://developer.android.com/reference/java/security/cert/TrustAnchor#TrustAnchor(java.security.cert.X509Certificate,%20byte[])).
Note that the name constraints byte array supplied here is cloned to protect against subsequent modifications.
| Parameters ||
|-------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `caName` | `String`: the X.500 distinguished name of the most-trusted CA in[RFC 2253](http://www.ietf.org/rfc/rfc2253.txt)`String`format
|
| `pubKey` | `PublicKey`: the public key of the most-trusted CA
|
| `nameConstraints` | `byte`: a byte array containing the ASN.1 DER encoding of a NameConstraints extension to be used for checking name constraints. Only the value of the extension is included, not the OID or criticality flag. Specify`null`to omit the parameter.
|
| Throws ||
|--------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------|
| [IllegalArgumentException](https://developer.android.com/reference/java/lang/IllegalArgumentException) | if the specified`caName`parameter is empty`(caName.length() == 0)`or incorrectly formatted or the name constraints cannot be decoded |
| [NullPointerException](https://developer.android.com/reference/java/lang/NullPointerException) | if the specified`caName`or`pubKey`parameter is`null` |
### TrustAnchor
Added in[API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)
```
public TrustAnchor (X509Certificate trustedCert,
byte[] nameConstraints)
```
Creates an instance of`TrustAnchor`with the specified`X509Certificate`and optional name constraints, which are intended to be used as additional constraints when validating an X.509 certification path.
The name constraints are specified as a byte array. This byte array should contain the DER encoded form of the name constraints, as they would appear in the NameConstraints structure defined in[RFC 5280](http://tools.ietf.org/html/rfc5280)and X.509. The ASN.1 definition of this structure appears below.
NameConstraints ::= SEQUENCE {
permittedSubtrees [0] GeneralSubtrees OPTIONAL,
excludedSubtrees [1] GeneralSubtrees OPTIONAL }
GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree
GeneralSubtree ::= SEQUENCE {
base GeneralName,
minimum [0] BaseDistance DEFAULT 0,
maximum [1] BaseDistance OPTIONAL }
BaseDistance ::= INTEGER (0..MAX)
GeneralName ::= CHOICE {
otherName [0] OtherName,
rfc822Name [1] IA5String,
dNSName [2] IA5String,
x400Address [3] ORAddress,
directoryName [4] Name,
ediPartyName [5] EDIPartyName,
uniformResourceIdentifier [6] IA5String,
iPAddress [7] OCTET STRING,
registeredID [8] OBJECT IDENTIFIER}
Note that the name constraints byte array supplied is cloned to protect against subsequent modifications.
| Parameters ||
|-------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `trustedCert` | `X509Certificate`: a trusted`X509Certificate`
|
| `nameConstraints` | `byte`: a byte array containing the ASN.1 DER encoding of a NameConstraints extension to be used for checking name constraints. Only the value of the extension is included, not the OID or criticality flag. Specify`null`to omit the parameter.
|
| Throws ||
|--------------------------------------------------------------------------------------------------------|-------------------------------------------|
| [IllegalArgumentException](https://developer.android.com/reference/java/lang/IllegalArgumentException) | if the name constraints cannot be decoded |
| [NullPointerException](https://developer.android.com/reference/java/lang/NullPointerException) | if the specified`X509Certificate`is`null` |
### TrustAnchor
Added in[API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)
```
public TrustAnchor (X500Principal caPrincipal,
PublicKey pubKey,
byte[] nameConstraints)
```
Creates an instance of`TrustAnchor`where the most-trusted CA is specified as an X500Principal and public key. Name constraints are an optional parameter, and are intended to be used as additional constraints when validating an X.509 certification path.
The name constraints are specified as a byte array. This byte array contains the DER encoded form of the name constraints, as they would appear in the NameConstraints structure defined in RFC 5280 and X.509. The ASN.1 notation for this structure is supplied in the documentation for[TrustAnchor(X509Certificate trustedCert, byte[] nameConstraints)](https://developer.android.com/reference/java/security/cert/TrustAnchor#TrustAnchor(java.security.cert.X509Certificate,%20byte[])).
Note that the name constraints byte array supplied here is cloned to protect against subsequent modifications.
| Parameters ||
|-------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `caPrincipal` | `X500Principal`: the name of the most-trusted CA as X500Principal
|
| `pubKey` | `PublicKey`: the public key of the most-trusted CA
|
| `nameConstraints` | `byte`: a byte array containing the ASN.1 DER encoding of a NameConstraints extension to be used for checking name constraints. Only the value of the extension is included, not the OID or criticality flag. Specify`null`to omit the parameter.
|
| Throws ||
|------------------------------------------------------------------------------------------------|-----------------------------------------------------------|
| [NullPointerException](https://developer.android.com/reference/java/lang/NullPointerException) | if the specified`caPrincipal`or`pubKey`parameter is`null` |
## Public methods
### getCA
Added in[API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)
```
public final X500Principal getCA ()
```
Returns the name of the most-trusted CA as an X500Principal.
| Returns ||
|-------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| [X500Principal](https://developer.android.com/reference/javax/security/auth/x500/X500Principal) | the X.500 distinguished name of the most-trusted CA, or`null`if the trust anchor was not specified as a trusted public key and name or X500Principal pair
|
### getCAName
Added in[API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)
```
public final String getCAName ()
```
Returns the name of the most-trusted CA in RFC 2253`String`format.
| Returns ||
|--------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| [String](https://developer.android.com/reference/java/lang/String) | the X.500 distinguished name of the most-trusted CA, or`null`if the trust anchor was not specified as a trusted public key and name or X500Principal pair
|
### getCAPublicKey
Added in[API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)
```
public final PublicKey getCAPublicKey ()
```
Returns the public key of the most-trusted CA.
| Returns ||
|------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------|
| [PublicKey](https://developer.android.com/reference/java/security/PublicKey) | the public key of the most-trusted CA, or`null`if the trust anchor was not specified as a trusted public key and name or X500Principal pair
|
### getNameConstraints
Added in[API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)
```
public final byte[] getNameConstraints ()
```
Returns the name constraints parameter. The specified name constraints are associated with this trust anchor and are intended to be used as additional constraints when validating an X.509 certification path.
The name constraints are returned as a byte array. This byte array contains the DER encoded form of the name constraints, as they would appear in the NameConstraints structure defined in RFC 5280 and X.509. The ASN.1 notation for this structure is supplied in the documentation for[TrustAnchor(X509Certificate trustedCert, byte[] nameConstraints)](https://developer.android.com/reference/java/security/cert/TrustAnchor#TrustAnchor(java.security.cert.X509Certificate,%20byte[])).
Note that the byte array returned is cloned to protect against subsequent modifications.
| Returns ||
|----------|----------------------------------------------------------------------------------------------------------------------------------------------|
| `byte[]` | a byte array containing the ASN.1 DER encoding of a NameConstraints extension used for checking name constraints, or`null`if not set.
|
### getTrustedCert
Added in[API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)
```
public final X509Certificate getTrustedCert ()
```
Returns the most-trusted CA certificate.
| Returns ||
|-----------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------|
| [X509Certificate](https://developer.android.com/reference/java/security/cert/X509Certificate) | a trusted`X509Certificate`or`null`if the trust anchor was not specified as a trusted certificate
|
### toString
Added in[API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)
```
public String toString ()
```
Returns a formatted string describing the`TrustAnchor`.
| Returns ||
|--------------------------------------------------------------------|-------------------------------------------------------|
| [String](https://developer.android.com/reference/java/lang/String) | a formatted string describing the`TrustAnchor`
|