Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) Summary: [Ctors](https://developer.android.com/reference/java/security/cert/X509CertSelector#pubctors) \| [Methods](https://developer.android.com/reference/java/security/cert/X509CertSelector#pubmethods) \| [Inherited Methods](https://developer.android.com/reference/java/security/cert/X509CertSelector#inhmethods) # X509CertSelector ` public class X509CertSelector ` ` extends https://developer.android.com/reference/java/lang/Object ` ` implements https://developer.android.com/reference/java/security/cert/CertSelector ` |---|---| | [java.lang.Object](https://developer.android.com/reference/java/lang/Object) || | ↳ | java.security.cert.X509CertSelector |
*** ** * ** *** A `CertSelector` that selects `X509Certificates` that match all specified criteria. This class is particularly useful when selecting certificates from a `CertStore` to build a PKIX-compliant certification path. When first constructed, an `X509CertSelector` has no criteria enabled and each of the `get` methods return a default value (`null`, or `-1` for the `https://developer.android.com/reference/java/security/cert/X509CertSelector#getBasicConstraints()` method). Therefore, the `https://developer.android.com/reference/java/security/cert/X509CertSelector#match(java.security.cert.Certificate)` method would return `true` for any `X509Certificate`. Typically, several criteria are enabled (by calling `https://developer.android.com/reference/java/security/cert/X509CertSelector#setIssuer(byte[])` or `https://developer.android.com/reference/java/security/cert/X509CertSelector#setKeyUsage(boolean[])`, for instance) and then the `X509CertSelector` is passed to `https://developer.android.com/reference/java/security/cert/CertStore#getCertificates(java.security.cert.CertSelector)` or some similar method. Several criteria can be enabled (by calling `https://developer.android.com/reference/java/security/cert/X509CertSelector#setIssuer(byte[])` and `https://developer.android.com/reference/java/security/cert/X509CertSelector#setSerialNumber(java.math.BigInteger)`, for example) such that the `match` method usually uniquely matches a single `X509Certificate`. We say usually, since it is possible for two issuing CAs to have the same distinguished name and each issue a certificate with the same serial number. Other unique combinations include the issuer, subject, subjectKeyIdentifier and/or the subjectPublicKey criteria. Please refer to [RFC 5280: Internet X.509 Public Key Infrastructure Certificate and CRL Profile](http://tools.ietf.org/html/rfc5280) for definitions of the X.509 certificate extensions mentioned below. **Concurrent Access** Unless otherwise specified, the methods defined in this class are not thread-safe. Multiple threads that need to access a single object concurrently should synchronize amongst themselves and provide the necessary locking. Multiple threads each manipulating separate objects need not synchronize. **See also:** - `https://developer.android.com/reference/java/security/cert/CertSelector` - `https://developer.android.com/reference/java/security/cert/X509Certificate` ## Summary | ### Public constructors || |---|---| | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#X509CertSelector()() ` Creates an `X509CertSelector`. | | ### Public methods || |---|---| | ` void` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#addPathToName(int,%20java.lang.String)(int type, https://developer.android.com/reference/java/lang/String name) ` Adds a name to the pathToNames criterion. | | ` void` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#addPathToName(int,%20byte[])(int type, byte[] name) ` Adds a name to the pathToNames criterion. | | ` void` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#addSubjectAlternativeName(int,%20java.lang.String)(int type, https://developer.android.com/reference/java/lang/String name) ` Adds a name to the subjectAlternativeNames criterion. | | ` void` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#addSubjectAlternativeName(int,%20byte[])(int type, byte[] name) ` Adds a name to the subjectAlternativeNames criterion. | | ` https://developer.android.com/reference/java/lang/Object` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#clone()() ` Returns a copy of this object. | | ` byte[]` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#getAuthorityKeyIdentifier()() ` Returns the authorityKeyIdentifier criterion. | | ` int` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#getBasicConstraints()() ` Returns the basic constraints constraint. | | ` https://developer.android.com/reference/java/security/cert/X509Certificate` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#getCertificate()() ` Returns the certificateEquals criterion. | | ` https://developer.android.com/reference/java/util/Date` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#getCertificateValid()() ` Returns the certificateValid criterion. | | ` https://developer.android.com/reference/java/util/Set` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#getExtendedKeyUsage()() ` Returns the extendedKeyUsage criterion. | | ` https://developer.android.com/reference/javax/security/auth/x500/X500Principal` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#getIssuer()() ` Returns the issuer criterion as an `X500Principal`. | | ` byte[]` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#getIssuerAsBytes()() ` Returns the issuer criterion as a byte array. | | ` https://developer.android.com/reference/java/lang/String` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#getIssuerAsString()() ` **Denigrated** , use [getIssuer()](https://developer.android.com/reference/java/security/cert/X509CertSelector#getIssuer()) or [getIssuerAsBytes()](https://developer.android.com/reference/java/security/cert/X509CertSelector#getIssuerAsBytes()) instead. | | ` boolean[]` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#getKeyUsage()() ` Returns the keyUsage criterion. | | ` boolean` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#getMatchAllSubjectAltNames()() ` Indicates if the `X509Certificate` must contain all or at least one of the subjectAlternativeNames specified in the `https://developer.android.com/reference/java/security/cert/X509CertSelector#setSubjectAlternativeNames(java.util.Collection>)` or `https://developer.android.com/reference/java/security/cert/X509CertSelector#addSubjectAlternativeName(int,%20byte[])` methods. | | ` byte[]` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#getNameConstraints()() ` Returns the name constraints criterion. | | ` https://developer.android.com/reference/java/util/Collection>` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#getPathToNames()() ` Returns a copy of the pathToNames criterion. | | ` https://developer.android.com/reference/java/util/Set` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#getPolicy()() ` Returns the policy criterion. | | ` https://developer.android.com/reference/java/util/Date` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#getPrivateKeyValid()() ` Returns the privateKeyValid criterion. | | ` https://developer.android.com/reference/java/math/BigInteger` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#getSerialNumber()() ` Returns the serialNumber criterion. | | ` https://developer.android.com/reference/javax/security/auth/x500/X500Principal` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#getSubject()() ` Returns the subject criterion as an `X500Principal`. | | ` https://developer.android.com/reference/java/util/Collection>` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#getSubjectAlternativeNames()() ` Returns a copy of the subjectAlternativeNames criterion. | | ` byte[]` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#getSubjectAsBytes()() ` Returns the subject criterion as a byte array. | | ` https://developer.android.com/reference/java/lang/String` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#getSubjectAsString()() ` **Denigrated** , use [getSubject()](https://developer.android.com/reference/java/security/cert/X509CertSelector#getSubject()) or [getSubjectAsBytes()](https://developer.android.com/reference/java/security/cert/X509CertSelector#getSubjectAsBytes()) instead. | | ` byte[]` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#getSubjectKeyIdentifier()() ` Returns the subjectKeyIdentifier criterion. | | ` https://developer.android.com/reference/java/security/PublicKey` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#getSubjectPublicKey()() ` Returns the subjectPublicKey criterion. | | ` https://developer.android.com/reference/java/lang/String` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#getSubjectPublicKeyAlgID()() ` Returns the subjectPublicKeyAlgID criterion. | | ` boolean` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#match(java.security.cert.Certificate)(https://developer.android.com/reference/java/security/cert/Certificate cert) ` Decides whether a `Certificate` should be selected. | | ` void` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#setAuthorityKeyIdentifier(byte[])(byte[] authorityKeyID) ` Sets the authorityKeyIdentifier criterion. | | ` void` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#setBasicConstraints(int)(int minMaxPathLen) ` Sets the basic constraints constraint. | | ` void` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#setCertificate(java.security.cert.X509Certificate)(https://developer.android.com/reference/java/security/cert/X509Certificate cert) ` Sets the certificateEquals criterion. | | ` void` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#setCertificateValid(java.util.Date)(https://developer.android.com/reference/java/util/Date certValid) ` Sets the certificateValid criterion. | | ` void` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#setExtendedKeyUsage(java.util.Set)(https://developer.android.com/reference/java/util/Set keyPurposeSet) ` Sets the extendedKeyUsage criterion. | | ` void` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#setIssuer(byte[])(byte[] issuerDN) ` Sets the issuer criterion. | | ` void` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#setIssuer(javax.security.auth.x500.X500Principal)(https://developer.android.com/reference/javax/security/auth/x500/X500Principal issuer) ` Sets the issuer criterion. | | ` void` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#setIssuer(java.lang.String)(https://developer.android.com/reference/java/lang/String issuerDN) ` **Denigrated** , use [setIssuer(X500Principal)](https://developer.android.com/reference/java/security/cert/X509CertSelector#setIssuer(javax.security.auth.x500.X500Principal)) or [setIssuer(byte\[\])](https://developer.android.com/reference/java/security/cert/X509CertSelector#setIssuer(byte[])) instead. | | ` void` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#setKeyUsage(boolean[])(boolean[] keyUsage) ` Sets the keyUsage criterion. | | ` void` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#setMatchAllSubjectAltNames(boolean)(boolean matchAllNames) ` Enables/disables matching all of the subjectAlternativeNames specified in the `https://developer.android.com/reference/java/security/cert/X509CertSelector#setSubjectAlternativeNames(java.util.Collection>)` or `https://developer.android.com/reference/java/security/cert/X509CertSelector#addSubjectAlternativeName(int,%20byte[])` methods. | | ` void` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#setNameConstraints(byte[])(byte[] bytes) ` Sets the name constraints criterion. | | ` void` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#setPathToNames(java.util.Collection>)(https://developer.android.com/reference/java/util/Collection> names) ` Sets the pathToNames criterion. | | ` void` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#setPolicy(java.util.Set)(https://developer.android.com/reference/java/util/Set certPolicySet) ` Sets the policy constraint. | | ` void` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#setPrivateKeyValid(java.util.Date)(https://developer.android.com/reference/java/util/Date privateKeyValid) ` Sets the privateKeyValid criterion. | | ` void` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#setSerialNumber(java.math.BigInteger)(https://developer.android.com/reference/java/math/BigInteger serial) ` Sets the serialNumber criterion. | | ` void` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#setSubject(javax.security.auth.x500.X500Principal)(https://developer.android.com/reference/javax/security/auth/x500/X500Principal subject) ` Sets the subject criterion. | | ` void` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#setSubject(byte[])(byte[] subjectDN) ` Sets the subject criterion. | | ` void` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#setSubject(java.lang.String)(https://developer.android.com/reference/java/lang/String subjectDN) ` **Denigrated** , use [setSubject(X500Principal)](https://developer.android.com/reference/java/security/cert/X509CertSelector#setSubject(javax.security.auth.x500.X500Principal)) or [setSubject(byte\[\])](https://developer.android.com/reference/java/security/cert/X509CertSelector#setSubject(byte[])) instead. | | ` void` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#setSubjectAlternativeNames(java.util.Collection>)(https://developer.android.com/reference/java/util/Collection> names) ` Sets the subjectAlternativeNames criterion. | | ` void` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#setSubjectKeyIdentifier(byte[])(byte[] subjectKeyID) ` Sets the subjectKeyIdentifier criterion. | | ` void` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#setSubjectPublicKey(byte[])(byte[] key) ` Sets the subjectPublicKey criterion. | | ` void` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#setSubjectPublicKey(java.security.PublicKey)(https://developer.android.com/reference/java/security/PublicKey key) ` Sets the subjectPublicKey criterion. | | ` void` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#setSubjectPublicKeyAlgID(java.lang.String)(https://developer.android.com/reference/java/lang/String oid) ` Sets the subjectPublicKeyAlgID criterion. | | ` https://developer.android.com/reference/java/lang/String` | ` https://developer.android.com/reference/java/security/cert/X509CertSelector#toString()() ` Return a printable representation of the `CertSelector`. | ### Inherited methods From class ` https://developer.android.com/reference/java/lang/Object ` ` https://developer.android.com/reference/java/lang/Object` ` https://developer.android.com/reference/java/lang/Object#clone()() ` Creates and returns a copy of this object. ` boolean` ` https://developer.android.com/reference/java/lang/Object#equals(java.lang.Object)(https://developer.android.com/reference/java/lang/Object obj) ` Indicates whether some other object is "equal to" this one. ` void` ` https://developer.android.com/reference/java/lang/Object#finalize()() ` Called by the garbage collector on an object when garbage collection determines that there are no more references to the object. ` final https://developer.android.com/reference/java/lang/Class` ` https://developer.android.com/reference/java/lang/Object#getClass()() ` Returns the runtime class of this `Object`. ` int` ` https://developer.android.com/reference/java/lang/Object#hashCode()() ` Returns a hash code value for the object. ` final void` ` https://developer.android.com/reference/java/lang/Object#notify()() ` Wakes up a single thread that is waiting on this object's monitor. ` final void` ` https://developer.android.com/reference/java/lang/Object#notifyAll()() ` Wakes up all threads that are waiting on this object's monitor. ` https://developer.android.com/reference/java/lang/String` ` https://developer.android.com/reference/java/lang/Object#toString()() ` Returns a string representation of the object. ` final void` ` https://developer.android.com/reference/java/lang/Object#wait(long,%20int)(long timeoutMillis, int nanos) ` Causes the current thread to wait until it is awakened, typically by being *notified* or *interrupted*, or until a certain amount of real time has elapsed. ` final void` ` https://developer.android.com/reference/java/lang/Object#wait(long)(long timeoutMillis) ` Causes the current thread to wait until it is awakened, typically by being *notified* or *interrupted*, or until a certain amount of real time has elapsed. ` final void` ` https://developer.android.com/reference/java/lang/Object#wait()() ` Causes the current thread to wait until it is awakened, typically by being *notified* or *interrupted*. From interface ` https://developer.android.com/reference/java/security/cert/CertSelector ` ` abstract https://developer.android.com/reference/java/lang/Object` ` https://developer.android.com/reference/java/security/cert/CertSelector#clone()() ` Makes a copy of this `CertSelector`. ` abstract boolean` ` https://developer.android.com/reference/java/security/cert/CertSelector#match(java.security.cert.Certificate)(https://developer.android.com/reference/java/security/cert/Certificate cert) ` Decides whether a `Certificate` should be selected. ## Public constructors ### X509CertSelector Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public X509CertSelector () ``` Creates an `X509CertSelector`. Initially, no criteria are set so any `X509Certificate` will match.
## Public methods ### addPathToName Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public void addPathToName (int type, String name) ``` Adds a name to the pathToNames criterion. The `X509Certificate` must not include name constraints that would prohibit building a path to the specified name. This method allows the caller to add a name to the set of names which the `X509Certificates`'s name constraints must permit. The specified name is added to any previous value for the pathToNames criterion. If the name is a duplicate, it may be ignored. The name is provided in string format. RFC 822, DNS, and URI names use the well-established string formats for those types (subject to the restrictions included in RFC 5280). IPv4 address names are supplied using dotted quad notation. OID address names are represented as a series of nonnegative integers separated by periods. And directory names (distinguished names) are supplied in RFC 2253 format. No standard string format is defined for otherNames, X.400 names, EDI party names, IPv6 address names, or any other type of names. They should be specified using the `https://developer.android.com/reference/java/security/cert/X509CertSelector#addPathToName(int,%20byte[])` method. **Note:** for distinguished names, use [addPathToName(int, byte\[\])](https://developer.android.com/reference/java/security/cert/X509CertSelector#addPathToName(int,%20byte[])) instead. This method should not be relied on as it can fail to match some certificates because of a loss of encoding information in the RFC 2253 String form of some distinguished names.
| Parameters || |---|---| | `type` | `int`: the name type (0-8, as specified in RFC 5280, section 4.2.1.6)
| | `name` | `String`: the name in string form
| | Throws || |---|---| | `https://developer.android.com/reference/java/io/IOException` | if a parsing error occurs | ### addPathToName Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public void addPathToName (int type, byte[] name) ``` Adds a name to the pathToNames criterion. The `X509Certificate` must not include name constraints that would prohibit building a path to the specified name. This method allows the caller to add a name to the set of names which the `X509Certificates`'s name constraints must permit. The specified name is added to any previous value for the pathToNames criterion. If the name is a duplicate, it may be ignored. The name is provided as a byte array. This byte array should contain the DER encoded name, as it would appear in the GeneralName structure defined in RFC 5280 and X.509. The ASN.1 definition of this structure appears in the documentation for `https://developer.android.com/reference/java/security/cert/X509CertSelector#addSubjectAlternativeName(int,%20byte[])`. Note that the byte array supplied here is cloned to protect against subsequent modifications.
| Parameters || |---|---| | `type` | `int`: the name type (0-8, as specified in RFC 5280, section 4.2.1.6)
| | `name` | `byte`: a byte array containing the name in ASN.1 DER encoded form
| | Throws || |---|---| | `https://developer.android.com/reference/java/io/IOException` | if a parsing error occurs | ### addSubjectAlternativeName Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public void addSubjectAlternativeName (int type, String name) ``` Adds a name to the subjectAlternativeNames criterion. The `X509Certificate` must contain all or at least one of the specified subjectAlternativeNames, depending on the value of the matchAllNames flag (see `https://developer.android.com/reference/java/security/cert/X509CertSelector#setMatchAllSubjectAltNames(boolean)`). This method allows the caller to add a name to the set of subject alternative names. The specified name is added to any previous value for the subjectAlternativeNames criterion. If the specified name is a duplicate, it may be ignored. The name is provided in string format. [RFC 822](http://www.ietf.org/rfc/rfc822.txt), DNS, and URI names use the well-established string formats for those types (subject to the restrictions included in RFC 5280). IPv4 address names are supplied using dotted quad notation. OID address names are represented as a series of nonnegative integers separated by periods. And directory names (distinguished names) are supplied in RFC 2253 format. No standard string format is defined for otherNames, X.400 names, EDI party names, IPv6 address names, or any other type of names. They should be specified using the `https://developer.android.com/reference/java/security/cert/X509CertSelector#addSubjectAlternativeName(int,%20byte[])` method. **Note:** for distinguished names, use [addSubjectAlternativeName(int, byte\[\])](https://developer.android.com/reference/java/security/cert/X509CertSelector#addSubjectAlternativeName(int,%20byte[])) instead. This method should not be relied on as it can fail to match some certificates because of a loss of encoding information in the RFC 2253 String form of some distinguished names.
| Parameters || |---|---| | `type` | `int`: the name type (0-8, as specified in RFC 5280, section 4.2.1.6)
| | `name` | `String`: the name in string form (not `null`)
| | Throws || |---|---| | `https://developer.android.com/reference/java/io/IOException` | if a parsing error occurs | ### addSubjectAlternativeName Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public void addSubjectAlternativeName (int type, byte[] name) ``` Adds a name to the subjectAlternativeNames criterion. The `X509Certificate` must contain all or at least one of the specified subjectAlternativeNames, depending on the value of the matchAllNames flag (see `https://developer.android.com/reference/java/security/cert/X509CertSelector#setMatchAllSubjectAltNames(boolean)`). This method allows the caller to add a name to the set of subject alternative names. The specified name is added to any previous value for the subjectAlternativeNames criterion. If the specified name is a duplicate, it may be ignored. The name is provided as a byte array. This byte array should contain the DER encoded name, as it would appear in the GeneralName structure defined in RFC 5280 and X.509. The encoded byte array should only contain the encoded value of the name, and should not include the tag associated with the name in the GeneralName structure. The ASN.1 definition of this structure appears below. GeneralName ::= CHOICE { otherName [0] OtherName, rfc822Name [1] IA5String, dNSName [2] IA5String, x400Address [3] ORAddress, directoryName [4] Name, ediPartyName [5] EDIPartyName, uniformResourceIdentifier [6] IA5String, iPAddress [7] OCTET STRING, registeredID [8] OBJECT IDENTIFIER} Note that the byte array supplied here is cloned to protect against subsequent modifications.
| Parameters || |---|---| | `type` | `int`: the name type (0-8, as listed above)
| | `name` | `byte`: a byte array containing the name in ASN.1 DER encoded form
| | Throws || |---|---| | `https://developer.android.com/reference/java/io/IOException` | if a parsing error occurs | ### clone Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public Object clone () ``` Returns a copy of this object.
| Returns || |---|---| | `https://developer.android.com/reference/java/lang/Object` | the copy
| ### getAuthorityKeyIdentifier Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public byte[] getAuthorityKeyIdentifier () ``` Returns the authorityKeyIdentifier criterion. The `X509Certificate` must contain a AuthorityKeyIdentifier extension with the specified value. If `null`, no authorityKeyIdentifier check will be done. Note that the byte array returned is cloned to protect against subsequent modifications.
| Returns || |---|---| | `byte[]` | the key identifier (or `null`)
| **See also:** - `https://developer.android.com/reference/java/security/cert/X509CertSelector#setAuthorityKeyIdentifier(byte[])` ### getBasicConstraints Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public int getBasicConstraints () ``` Returns the basic constraints constraint. If the value is greater than or equal to zero, the `X509Certificates` must include a basicConstraints extension with a pathLen of at least this value. If the value is -2, only end-entity certificates are accepted. If the value is -1, no basicConstraints check is done.
| Returns || |---|---| | `int` | the value for the basic constraints constraint
| **See also:** - `https://developer.android.com/reference/java/security/cert/X509CertSelector#setBasicConstraints(int)` ### getCertificate Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public X509Certificate getCertificate () ``` Returns the certificateEquals criterion. The specified `X509Certificate` must be equal to the `X509Certificate` passed to the `match` method. If `null`, this check is not applied.
| Returns || |---|---| | `https://developer.android.com/reference/java/security/cert/X509Certificate` | the `X509Certificate` to match (or `null`)
| **See also:** - `https://developer.android.com/reference/java/security/cert/X509CertSelector#setCertificate(java.security.cert.X509Certificate)` ### getCertificateValid Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public Date getCertificateValid () ``` Returns the certificateValid criterion. The specified date must fall within the certificate validity period for the `X509Certificate`. If `null`, no certificateValid check will be done. Note that the `Date` returned is cloned to protect against subsequent modifications.
| Returns || |---|---| | `https://developer.android.com/reference/java/util/Date` | the `Date` to check (or `null`)
| **See also:** - `https://developer.android.com/reference/java/security/cert/X509CertSelector#setCertificateValid(java.util.Date)` ### getExtendedKeyUsage Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public Set getExtendedKeyUsage () ``` Returns the extendedKeyUsage criterion. The `X509Certificate` must allow the specified key purposes in its extended key usage extension. If the `keyPurposeSet` returned is empty or `null`, no extendedKeyUsage check will be done. Note that an `X509Certificate` that has no extendedKeyUsage extension implicitly allows all key purposes.
| Returns || |---|---| | `https://developer.android.com/reference/java/util/Set` | an immutable `Set` of key purpose OIDs in string format (or `null`)
| **See also:** - `https://developer.android.com/reference/java/security/cert/X509CertSelector#setExtendedKeyUsage(java.util.Set)` ### getIssuer Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public X500Principal getIssuer () ``` Returns the issuer criterion as an `X500Principal`. This distinguished name must match the issuer distinguished name in the `X509Certificate`. If `null`, the issuer criterion is disabled and any issuer distinguished name will do.
| Returns || |---|---| | `https://developer.android.com/reference/javax/security/auth/x500/X500Principal` | the required issuer distinguished name as X500Principal (or `null`)
| ### getIssuerAsBytes Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public byte[] getIssuerAsBytes () ``` Returns the issuer criterion as a byte array. This distinguished name must match the issuer distinguished name in the `X509Certificate`. If `null`, the issuer criterion is disabled and any issuer distinguished name will do. If the value returned is not `null`, it is a byte array containing a single DER encoded distinguished name, as defined in X.501. The ASN.1 notation for this structure is supplied in the documentation for `https://developer.android.com/reference/java/security/cert/X509CertSelector#setIssuer(byte[])`. Note that the byte array returned is cloned to protect against subsequent modifications.
| Returns || |---|---| | `byte[]` | a byte array containing the required issuer distinguished name in ASN.1 DER format (or `null`)
| | Throws || |---|---| | `https://developer.android.com/reference/java/io/IOException` | if an encoding error occurs | ### getIssuerAsString Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public String getIssuerAsString () ``` **Denigrated** , use [getIssuer()](https://developer.android.com/reference/java/security/cert/X509CertSelector#getIssuer()) or [getIssuerAsBytes()](https://developer.android.com/reference/java/security/cert/X509CertSelector#getIssuerAsBytes()) instead. This method should not be relied on as it can fail to match some certificates because of a loss of encoding information in the RFC 2253 String form of some distinguished names. Returns the issuer criterion as a `String`. This distinguished name must match the issuer distinguished name in the `X509Certificate`. If `null`, the issuer criterion is disabled and any issuer distinguished name will do. If the value returned is not `null`, it is a distinguished name, in RFC 2253 format.
| Returns || |---|---| | `https://developer.android.com/reference/java/lang/String` | the required issuer distinguished name in RFC 2253 format (or `null`)
| ### getKeyUsage Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public boolean[] getKeyUsage () ``` Returns the keyUsage criterion. The `X509Certificate` must allow the specified keyUsage values. If null, no keyUsage check will be done. Note that the boolean array returned is cloned to protect against subsequent modifications.
| Returns || |---|---| | `boolean[]` | a boolean array in the same format as the boolean array returned by `https://developer.android.com/reference/java/security/cert/X509Certificate#getKeyUsage()`. Or `null`.
| **See also:** - `https://developer.android.com/reference/java/security/cert/X509CertSelector#setKeyUsage(boolean[])` ### getMatchAllSubjectAltNames Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public boolean getMatchAllSubjectAltNames () ``` Indicates if the `X509Certificate` must contain all or at least one of the subjectAlternativeNames specified in the `https://developer.android.com/reference/java/security/cert/X509CertSelector#setSubjectAlternativeNames(java.util.Collection>)` or `https://developer.android.com/reference/java/security/cert/X509CertSelector#addSubjectAlternativeName(int,%20byte[])` methods. If `true`, the `X509Certificate` must contain all of the specified subject alternative names. If `false`, the `X509Certificate` must contain at least one of the specified subject alternative names.
| Returns || |---|---| | `boolean` | `true` if the flag is enabled; `false` if the flag is disabled. The flag is `true` by default.
| **See also:** - `https://developer.android.com/reference/java/security/cert/X509CertSelector#setMatchAllSubjectAltNames(boolean)` ### getNameConstraints Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public byte[] getNameConstraints () ``` Returns the name constraints criterion. The `X509Certificate` must have subject and subject alternative names that meet the specified name constraints. The name constraints are returned as a byte array. This byte array contains the DER encoded form of the name constraints, as they would appear in the NameConstraints structure defined in RFC 5280 and X.509. The ASN.1 notation for this structure is supplied in the documentation for `https://developer.android.com/reference/java/security/cert/X509CertSelector#setNameConstraints(byte[])`. Note that the byte array returned is cloned to protect against subsequent modifications.
| Returns || |---|---| | `byte[]` | a byte array containing the ASN.1 DER encoding of a NameConstraints extension used for checking name constraints. `null` if no name constraints check will be performed.
| **See also:** - `https://developer.android.com/reference/java/security/cert/X509CertSelector#setNameConstraints(byte[])` ### getPathToNames Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public Collection> getPathToNames () ``` Returns a copy of the pathToNames criterion. The `X509Certificate` must not include name constraints that would prohibit building a path to the specified names. If the value returned is `null`, no pathToNames check will be performed. If the value returned is not `null`, it is a `Collection` with one entry for each name to be included in the pathToNames criterion. Each entry is a `List` whose first entry is an `Integer` (the name type, 0-8) and whose second entry is a `String` or a byte array (the name, in string or ASN.1 DER encoded form, respectively). There can be multiple names of the same type. Note that the `Collection` returned may contain duplicate names (same name and name type). Each name in the `Collection` may be specified either as a `String` or as an ASN.1 encoded byte array. For more details about the formats used, see `https://developer.android.com/reference/java/security/cert/X509CertSelector#addPathToName(int,%20java.lang.String)` and `https://developer.android.com/reference/java/security/cert/X509CertSelector#addPathToName(int,%20byte[])`. Note that a deep copy is performed on the `Collection` to protect against subsequent modifications.
| Returns || |---|---| | `https://developer.android.com/reference/java/util/Collection>` | a `Collection` of names (or `null`)
| **See also:** - `https://developer.android.com/reference/java/security/cert/X509CertSelector#setPathToNames(java.util.Collection>)` ### getPolicy Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public Set getPolicy () ``` Returns the policy criterion. The `X509Certificate` must include at least one of the specified policies in its certificate policies extension. If the `Set` returned is empty, then the `X509Certificate` must include at least some specified policy in its certificate policies extension. If the `Set` returned is `null`, no policy check will be performed.
| Returns || |---|---| | `https://developer.android.com/reference/java/util/Set` | an immutable `Set` of certificate policy OIDs in string format (or `null`)
| **See also:** - `https://developer.android.com/reference/java/security/cert/X509CertSelector#setPolicy(java.util.Set)` ### getPrivateKeyValid Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public Date getPrivateKeyValid () ``` Returns the privateKeyValid criterion. The specified date must fall within the private key validity period for the `X509Certificate`. If `null`, no privateKeyValid check will be done. Note that the `Date` returned is cloned to protect against subsequent modifications.
| Returns || |---|---| | `https://developer.android.com/reference/java/util/Date` | the `Date` to check (or `null`)
| **See also:** - `https://developer.android.com/reference/java/security/cert/X509CertSelector#setPrivateKeyValid(java.util.Date)` ### getSerialNumber Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public BigInteger getSerialNumber () ``` Returns the serialNumber criterion. The specified serial number must match the certificate serial number in the `X509Certificate`. If `null`, any certificate serial number will do.
| Returns || |---|---| | `https://developer.android.com/reference/java/math/BigInteger` | the certificate serial number to match (or `null`)
| **See also:** - `https://developer.android.com/reference/java/security/cert/X509CertSelector#setSerialNumber(java.math.BigInteger)` ### getSubject Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public X500Principal getSubject () ``` Returns the subject criterion as an `X500Principal`. This distinguished name must match the subject distinguished name in the `X509Certificate`. If `null`, the subject criterion is disabled and any subject distinguished name will do.
| Returns || |---|---| | `https://developer.android.com/reference/javax/security/auth/x500/X500Principal` | the required subject distinguished name as X500Principal (or `null`)
| ### getSubjectAlternativeNames Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public Collection> getSubjectAlternativeNames () ``` Returns a copy of the subjectAlternativeNames criterion. The `X509Certificate` must contain all or at least one of the specified subjectAlternativeNames, depending on the value of the matchAllNames flag (see `https://developer.android.com/reference/java/security/cert/X509CertSelector#getMatchAllSubjectAltNames()`). If the value returned is `null`, no subjectAlternativeNames check will be performed. If the value returned is not `null`, it is a `Collection` with one entry for each name to be included in the subject alternative name criterion. Each entry is a `List` whose first entry is an `Integer` (the name type, 0-8) and whose second entry is a `String` or a byte array (the name, in string or ASN.1 DER encoded form, respectively). There can be multiple names of the same type. Note that the `Collection` returned may contain duplicate names (same name and name type). Each subject alternative name in the `Collection` may be specified either as a `String` or as an ASN.1 encoded byte array. For more details about the formats used, see `https://developer.android.com/reference/java/security/cert/X509CertSelector#addSubjectAlternativeName(int,%20java.lang.String)` and `https://developer.android.com/reference/java/security/cert/X509CertSelector#addSubjectAlternativeName(int,%20byte[])`. Note that a deep copy is performed on the `Collection` to protect against subsequent modifications.
| Returns || |---|---| | `https://developer.android.com/reference/java/util/Collection>` | a `Collection` of names (or `null`)
| **See also:** - `https://developer.android.com/reference/java/security/cert/X509CertSelector#setSubjectAlternativeNames(java.util.Collection>)` ### getSubjectAsBytes Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public byte[] getSubjectAsBytes () ``` Returns the subject criterion as a byte array. This distinguished name must match the subject distinguished name in the `X509Certificate`. If `null`, the subject criterion is disabled and any subject distinguished name will do. If the value returned is not `null`, it is a byte array containing a single DER encoded distinguished name, as defined in X.501. The ASN.1 notation for this structure is supplied in the documentation for `https://developer.android.com/reference/java/security/cert/X509CertSelector#setSubject(byte[])`. Note that the byte array returned is cloned to protect against subsequent modifications.
| Returns || |---|---| | `byte[]` | a byte array containing the required subject distinguished name in ASN.1 DER format (or `null`)
| | Throws || |---|---| | `https://developer.android.com/reference/java/io/IOException` | if an encoding error occurs | ### getSubjectAsString Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public String getSubjectAsString () ``` **Denigrated** , use [getSubject()](https://developer.android.com/reference/java/security/cert/X509CertSelector#getSubject()) or [getSubjectAsBytes()](https://developer.android.com/reference/java/security/cert/X509CertSelector#getSubjectAsBytes()) instead. This method should not be relied on as it can fail to match some certificates because of a loss of encoding information in the RFC 2253 String form of some distinguished names. Returns the subject criterion as a `String`. This distinguished name must match the subject distinguished name in the `X509Certificate`. If `null`, the subject criterion is disabled and any subject distinguished name will do. If the value returned is not `null`, it is a distinguished name, in RFC 2253 format.
| Returns || |---|---| | `https://developer.android.com/reference/java/lang/String` | the required subject distinguished name in RFC 2253 format (or `null`)
| ### getSubjectKeyIdentifier Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public byte[] getSubjectKeyIdentifier () ``` Returns the subjectKeyIdentifier criterion. The `X509Certificate` must contain a SubjectKeyIdentifier extension with the specified value. If `null`, no subjectKeyIdentifier check will be done. Note that the byte array returned is cloned to protect against subsequent modifications.
| Returns || |---|---| | `byte[]` | the key identifier (or `null`)
| **See also:** - `https://developer.android.com/reference/java/security/cert/X509CertSelector#setSubjectKeyIdentifier(byte[])` ### getSubjectPublicKey Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public PublicKey getSubjectPublicKey () ``` Returns the subjectPublicKey criterion. The `X509Certificate` must contain the specified subject public key. If `null`, no subjectPublicKey check will be done.
| Returns || |---|---| | `https://developer.android.com/reference/java/security/PublicKey` | the subject public key to check for (or `null`)
| **See also:** - `https://developer.android.com/reference/java/security/cert/X509CertSelector#setSubjectPublicKey(byte[])` ### getSubjectPublicKeyAlgID Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public String getSubjectPublicKeyAlgID () ``` Returns the subjectPublicKeyAlgID criterion. The `X509Certificate` must contain a subject public key with the specified algorithm. If `null`, no subjectPublicKeyAlgID check will be done.
| Returns || |---|---| | `https://developer.android.com/reference/java/lang/String` | the object identifier (OID) of the signature algorithm to check for (or `null`). An OID is represented by a set of nonnegative integers separated by periods.
| **See also:** - `https://developer.android.com/reference/java/security/cert/X509CertSelector#setSubjectPublicKeyAlgID(java.lang.String)` ### match Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public boolean match (Certificate cert) ``` Decides whether a `Certificate` should be selected.
| Parameters || |---|---| | `cert` | `Certificate`: the `Certificate` to be checked
| | Returns || |---|---| | `boolean` | `true` if the `Certificate` should be selected, `false` otherwise
| ### setAuthorityKeyIdentifier Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public void setAuthorityKeyIdentifier (byte[] authorityKeyID) ``` Sets the authorityKeyIdentifier criterion. The `X509Certificate` must contain an AuthorityKeyIdentifier extension for which the contents of the extension value matches the specified criterion value. If the criterion value is `null`, no authorityKeyIdentifier check will be done. If `authorityKeyID` is not `null`, it should contain a single DER encoded value corresponding to the contents of the extension value (not including the object identifier, criticality setting, and encapsulating OCTET STRING) for an AuthorityKeyIdentifier extension. The ASN.1 notation for this structure follows. AuthorityKeyIdentifier ::= SEQUENCE { keyIdentifier [0] KeyIdentifier OPTIONAL, authorityCertIssuer [1] GeneralNames OPTIONAL, authorityCertSerialNumber [2] CertificateSerialNumber OPTIONAL } KeyIdentifier ::= OCTET STRING Authority key identifiers are not parsed by the `X509CertSelector`. Instead, the values are compared using a byte-by-byte comparison. When the `keyIdentifier` field of `AuthorityKeyIdentifier` is populated, the value is usually taken from the `SubjectKeyIdentifier` extension in the issuer's certificate. Note, however, that the result of `X509Certificate.getExtensionValue()` on the issuer's certificate may NOT be used directly as the input to `setAuthorityKeyIdentifier`. This is because the SubjectKeyIdentifier contains only a KeyIdentifier OCTET STRING, and not a SEQUENCE of KeyIdentifier, GeneralNames, and CertificateSerialNumber. In order to use the extension value of the issuer certificate's `SubjectKeyIdentifier` extension, it will be necessary to extract the value of the embedded `KeyIdentifier` OCTET STRING, then DER encode this OCTET STRING inside a SEQUENCE. For more details on SubjectKeyIdentifier, see `https://developer.android.com/reference/java/security/cert/X509CertSelector#setSubjectKeyIdentifier(byte[])`. Note also that the byte array supplied here is cloned to protect against subsequent modifications.
| Parameters || |---|---| | `authorityKeyID` | `byte`: the authority key identifier (or `null`)
| **See also:** - `https://developer.android.com/reference/java/security/cert/X509CertSelector#getAuthorityKeyIdentifier()` ### setBasicConstraints Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public void setBasicConstraints (int minMaxPathLen) ``` Sets the basic constraints constraint. If the value is greater than or equal to zero, `X509Certificates` must include a basicConstraints extension with a pathLen of at least this value. If the value is -2, only end-entity certificates are accepted. If the value is -1, no check is done. This constraint is useful when building a certification path forward (from the target toward the trust anchor. If a partial path has been built, any candidate certificate must have a maxPathLen value greater than or equal to the number of certificates in the partial path.
| Parameters || |---|---| | `minMaxPathLen` | `int`: the value for the basic constraints constraint
| | Throws || |---|---| | `https://developer.android.com/reference/java/lang/IllegalArgumentException` | if the value is less than -2 | **See also:** - `https://developer.android.com/reference/java/security/cert/X509CertSelector#getBasicConstraints()` ### setCertificate Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public void setCertificate (X509Certificate cert) ``` Sets the certificateEquals criterion. The specified `X509Certificate` must be equal to the `X509Certificate` passed to the `match` method. If `null`, then this check is not applied. This method is particularly useful when it is necessary to match a single certificate. Although other criteria can be specified in conjunction with the certificateEquals criterion, it is usually not practical or necessary.
| Parameters || |---|---| | `cert` | `X509Certificate`: the `X509Certificate` to match (or `null`)
| **See also:** - `https://developer.android.com/reference/java/security/cert/X509CertSelector#getCertificate()` ### setCertificateValid Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public void setCertificateValid (Date certValid) ``` Sets the certificateValid criterion. The specified date must fall within the certificate validity period for the `X509Certificate`. If `null`, no certificateValid check will be done. Note that the `Date` supplied here is cloned to protect against subsequent modifications.
| Parameters || |---|---| | `certValid` | `Date`: the `Date` to check (or `null`)
| **See also:** - `https://developer.android.com/reference/java/security/cert/X509CertSelector#getCertificateValid()` ### setExtendedKeyUsage Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public void setExtendedKeyUsage (Set keyPurposeSet) ``` Sets the extendedKeyUsage criterion. The `X509Certificate` must allow the specified key purposes in its extended key usage extension. If `keyPurposeSet` is empty or `null`, no extendedKeyUsage check will be done. Note that an `X509Certificate` that has no extendedKeyUsage extension implicitly allows all key purposes. Note that the `Set` is cloned to protect against subsequent modifications.
| Parameters || |---|---| | `keyPurposeSet` | `Set`: a `Set` of key purpose OIDs in string format (or `null`). Each OID is represented by a set of nonnegative integers separated by periods.
| | Throws || |---|---| | `https://developer.android.com/reference/java/io/IOException` | if the OID is invalid, such as the first component being not 0, 1 or 2 or the second component being greater than 39. | **See also:** - `https://developer.android.com/reference/java/security/cert/X509CertSelector#getExtendedKeyUsage()` ### setIssuer Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public void setIssuer (byte[] issuerDN) ``` Sets the issuer criterion. The specified distinguished name must match the issuer distinguished name in the `X509Certificate`. If `null` is specified, the issuer criterion is disabled and any issuer distinguished name will do. If `issuerDN` is not `null`, it should contain a single DER encoded distinguished name, as defined in X.501. The ASN.1 notation for this structure is as follows. Name ::= CHOICE { RDNSequence } RDNSequence ::= SEQUENCE OF RelativeDistinguishedName RelativeDistinguishedName ::= SET SIZE (1 .. MAX) OF AttributeTypeAndValue AttributeTypeAndValue ::= SEQUENCE { type AttributeType, value AttributeValue } AttributeType ::= OBJECT IDENTIFIER AttributeValue ::= ANY DEFINED BY AttributeType .... DirectoryString ::= CHOICE { teletexString TeletexString (SIZE (1..MAX)), printableString PrintableString (SIZE (1..MAX)), universalString UniversalString (SIZE (1..MAX)), utf8String UTF8String (SIZE (1.. MAX)), bmpString BMPString (SIZE (1..MAX)) } Note that the byte array specified here is cloned to protect against subsequent modifications.
| Parameters || |---|---| | `issuerDN` | `byte`: a byte array containing the distinguished name in ASN.1 DER encoded form (or `null`)
| | Throws || |---|---| | `https://developer.android.com/reference/java/io/IOException` | if an encoding error occurs (incorrect form for DN) | ### setIssuer Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public void setIssuer (X500Principal issuer) ``` Sets the issuer criterion. The specified distinguished name must match the issuer distinguished name in the `X509Certificate`. If `null`, any issuer distinguished name will do.
| Parameters || |---|---| | `issuer` | `X500Principal`: a distinguished name as X500Principal (or `null`)
| ### setIssuer Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public void setIssuer (String issuerDN) ``` **Denigrated** , use [setIssuer(X500Principal)](https://developer.android.com/reference/java/security/cert/X509CertSelector#setIssuer(javax.security.auth.x500.X500Principal)) or [setIssuer(byte\[\])](https://developer.android.com/reference/java/security/cert/X509CertSelector#setIssuer(byte[])) instead. This method should not be relied on as it can fail to match some certificates because of a loss of encoding information in the [RFC 2253](http://www.ietf.org/rfc/rfc2253.txt) String form of some distinguished names. Sets the issuer criterion. The specified distinguished name must match the issuer distinguished name in the `X509Certificate`. If `null`, any issuer distinguished name will do. If `issuerDN` is not `null`, it should contain a distinguished name, in RFC 2253 format.
| Parameters || |---|---| | `issuerDN` | `String`: a distinguished name in RFC 2253 format (or `null`)
| | Throws || |---|---| | `https://developer.android.com/reference/java/io/IOException` | if a parsing error occurs (incorrect form for DN) | ### setKeyUsage Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public void setKeyUsage (boolean[] keyUsage) ``` Sets the keyUsage criterion. The `X509Certificate` must allow the specified keyUsage values. If `null`, no keyUsage check will be done. Note that an `X509Certificate` that has no keyUsage extension implicitly allows all keyUsage values. Note that the boolean array supplied here is cloned to protect against subsequent modifications.
| Parameters || |---|---| | `keyUsage` | `boolean`: a boolean array in the same format as the boolean array returned by `https://developer.android.com/reference/java/security/cert/X509Certificate#getKeyUsage()`. Or `null`.
| **See also:** - `https://developer.android.com/reference/java/security/cert/X509CertSelector#getKeyUsage()` ### setMatchAllSubjectAltNames Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public void setMatchAllSubjectAltNames (boolean matchAllNames) ``` Enables/disables matching all of the subjectAlternativeNames specified in the `https://developer.android.com/reference/java/security/cert/X509CertSelector#setSubjectAlternativeNames(java.util.Collection>)` or `https://developer.android.com/reference/java/security/cert/X509CertSelector#addSubjectAlternativeName(int,%20byte[])` methods. If enabled, the `X509Certificate` must contain all of the specified subject alternative names. If disabled, the `X509Certificate` must contain at least one of the specified subject alternative names. The matchAllNames flag is `true` by default.
| Parameters || |---|---| | `matchAllNames` | `boolean`: if `true`, the flag is enabled; if `false`, the flag is disabled.
| **See also:** - `https://developer.android.com/reference/java/security/cert/X509CertSelector#getMatchAllSubjectAltNames()` ### setNameConstraints Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public void setNameConstraints (byte[] bytes) ``` Sets the name constraints criterion. The `X509Certificate` must have subject and subject alternative names that meet the specified name constraints. The name constraints are specified as a byte array. This byte array should contain the DER encoded form of the name constraints, as they would appear in the NameConstraints structure defined in RFC 5280 and X.509. The ASN.1 definition of this structure appears below. NameConstraints ::= SEQUENCE { permittedSubtrees [0] GeneralSubtrees OPTIONAL, excludedSubtrees [1] GeneralSubtrees OPTIONAL } GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree GeneralSubtree ::= SEQUENCE { base GeneralName, minimum [0] BaseDistance DEFAULT 0, maximum [1] BaseDistance OPTIONAL } BaseDistance ::= INTEGER (0..MAX) GeneralName ::= CHOICE { otherName [0] OtherName, rfc822Name [1] IA5String, dNSName [2] IA5String, x400Address [3] ORAddress, directoryName [4] Name, ediPartyName [5] EDIPartyName, uniformResourceIdentifier [6] IA5String, iPAddress [7] OCTET STRING, registeredID [8] OBJECT IDENTIFIER} Note that the byte array supplied here is cloned to protect against subsequent modifications.
| Parameters || |---|---| | `bytes` | `byte`: a byte array containing the ASN.1 DER encoding of a NameConstraints extension to be used for checking name constraints. Only the value of the extension is included, not the OID or criticality flag. Can be `null`, in which case no name constraints check will be performed.
| | Throws || |---|---| | `https://developer.android.com/reference/java/io/IOException` | if a parsing error occurs | **See also:** - `https://developer.android.com/reference/java/security/cert/X509CertSelector#getNameConstraints()` ### setPathToNames Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public void setPathToNames (Collection> names) ``` Sets the pathToNames criterion. The `X509Certificate` must not include name constraints that would prohibit building a path to the specified names. This method allows the caller to specify, with a single method call, the complete set of names which the `X509Certificates`'s name constraints must permit. The specified value replaces the previous value for the pathToNames criterion. This constraint is useful when building a certification path forward (from the target toward the trust anchor. If a partial path has been built, any candidate certificate must not include name constraints that would prohibit building a path to any of the names in the partial path. The `names` parameter (if not `null`) is a `Collection` with one entry for each name to be included in the pathToNames criterion. Each entry is a `List` whose first entry is an `Integer` (the name type, 0-8) and whose second entry is a `String` or a byte array (the name, in string or ASN.1 DER encoded form, respectively). There can be multiple names of the same type. If `null` is supplied as the value for this argument, no pathToNames check will be performed. Each name in the `Collection` may be specified either as a `String` or as an ASN.1 encoded byte array. For more details about the formats used, see `https://developer.android.com/reference/java/security/cert/X509CertSelector#addPathToName(int,%20java.lang.String)` and `https://developer.android.com/reference/java/security/cert/X509CertSelector#addPathToName(int,%20byte[])`. **Note:** for distinguished names, specify the byte array form instead of the String form. See the note in `https://developer.android.com/reference/java/security/cert/X509CertSelector#addPathToName(int,%20java.lang.String)` for more information. Note that the `names` parameter can contain duplicate names (same name and name type), but they may be removed from the `Collection` of names returned by the `https://developer.android.com/reference/java/security/cert/X509CertSelector#getPathToNames()` method. Note that a deep copy is performed on the `Collection` to protect against subsequent modifications.
| Parameters || |---|---| | `names` | `Collection`: a `Collection` with one entry per name (or `null`)
| | Throws || |---|---| | `https://developer.android.com/reference/java/io/IOException` | if a parsing error occurs | **See also:** - `https://developer.android.com/reference/java/security/cert/X509CertSelector#getPathToNames()` ### setPolicy Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public void setPolicy (Set certPolicySet) ``` Sets the policy constraint. The `X509Certificate` must include at least one of the specified policies in its certificate policies extension. If `certPolicySet` is empty, then the `X509Certificate` must include at least some specified policy in its certificate policies extension. If `certPolicySet` is `null`, no policy check will be performed. Note that the `Set` is cloned to protect against subsequent modifications.
| Parameters || |---|---| | `certPolicySet` | `Set`: a `Set` of certificate policy OIDs in string format (or `null`). Each OID is represented by a set of nonnegative integers separated by periods.
| | Throws || |---|---| | `https://developer.android.com/reference/java/io/IOException` | if a parsing error occurs on the OID such as the first component is not 0, 1 or 2 or the second component is greater than 39. | **See also:** - `https://developer.android.com/reference/java/security/cert/X509CertSelector#getPolicy()` ### setPrivateKeyValid Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public void setPrivateKeyValid (Date privateKeyValid) ``` Sets the privateKeyValid criterion. The specified date must fall within the private key validity period for the `X509Certificate`. If `null`, no privateKeyValid check will be done. Note that the `Date` supplied here is cloned to protect against subsequent modifications.
| Parameters || |---|---| | `privateKeyValid` | `Date`: the `Date` to check (or `null`)
| **See also:** - `https://developer.android.com/reference/java/security/cert/X509CertSelector#getPrivateKeyValid()` ### setSerialNumber Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public void setSerialNumber (BigInteger serial) ``` Sets the serialNumber criterion. The specified serial number must match the certificate serial number in the `X509Certificate`. If `null`, any certificate serial number will do.
| Parameters || |---|---| | `serial` | `BigInteger`: the certificate serial number to match (or `null`)
| **See also:** - `https://developer.android.com/reference/java/security/cert/X509CertSelector#getSerialNumber()` ### setSubject Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public void setSubject (X500Principal subject) ``` Sets the subject criterion. The specified distinguished name must match the subject distinguished name in the `X509Certificate`. If `null`, any subject distinguished name will do.
| Parameters || |---|---| | `subject` | `X500Principal`: a distinguished name as X500Principal (or `null`)
| ### setSubject Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public void setSubject (byte[] subjectDN) ``` Sets the subject criterion. The specified distinguished name must match the subject distinguished name in the `X509Certificate`. If `null`, any subject distinguished name will do. If `subjectDN` is not `null`, it should contain a single DER encoded distinguished name, as defined in X.501. For the ASN.1 notation for this structure, see `https://developer.android.com/reference/java/security/cert/X509CertSelector#setIssuer(byte[])`.
| Parameters || |---|---| | `subjectDN` | `byte`: a byte array containing the distinguished name in ASN.1 DER format (or `null`)
| | Throws || |---|---| | `https://developer.android.com/reference/java/io/IOException` | if an encoding error occurs (incorrect form for DN) | ### setSubject Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public void setSubject (String subjectDN) ``` **Denigrated** , use [setSubject(X500Principal)](https://developer.android.com/reference/java/security/cert/X509CertSelector#setSubject(javax.security.auth.x500.X500Principal)) or [setSubject(byte\[\])](https://developer.android.com/reference/java/security/cert/X509CertSelector#setSubject(byte[])) instead. This method should not be relied on as it can fail to match some certificates because of a loss of encoding information in the RFC 2253 String form of some distinguished names. Sets the subject criterion. The specified distinguished name must match the subject distinguished name in the `X509Certificate`. If `null`, any subject distinguished name will do. If `subjectDN` is not `null`, it should contain a distinguished name, in RFC 2253 format.
| Parameters || |---|---| | `subjectDN` | `String`: a distinguished name in RFC 2253 format (or `null`)
| | Throws || |---|---| | `https://developer.android.com/reference/java/io/IOException` | if a parsing error occurs (incorrect form for DN) | ### setSubjectAlternativeNames Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public void setSubjectAlternativeNames (Collection> names) ``` Sets the subjectAlternativeNames criterion. The `X509Certificate` must contain all or at least one of the specified subjectAlternativeNames, depending on the value of the matchAllNames flag (see `https://developer.android.com/reference/java/security/cert/X509CertSelector#setMatchAllSubjectAltNames(boolean)`). This method allows the caller to specify, with a single method call, the complete set of subject alternative names for the subjectAlternativeNames criterion. The specified value replaces the previous value for the subjectAlternativeNames criterion. The `names` parameter (if not `null`) is a `Collection` with one entry for each name to be included in the subject alternative name criterion. Each entry is a `List` whose first entry is an `Integer` (the name type, 0-8) and whose second entry is a `String` or a byte array (the name, in string or ASN.1 DER encoded form, respectively). There can be multiple names of the same type. If `null` is supplied as the value for this argument, no subjectAlternativeNames check will be performed. Each subject alternative name in the `Collection` may be specified either as a `String` or as an ASN.1 encoded byte array. For more details about the formats used, see `https://developer.android.com/reference/java/security/cert/X509CertSelector#addSubjectAlternativeName(int,%20java.lang.String)` and `https://developer.android.com/reference/java/security/cert/X509CertSelector#addSubjectAlternativeName(int,%20byte[])`. **Note:** for distinguished names, specify the byte array form instead of the String form. See the note in `https://developer.android.com/reference/java/security/cert/X509CertSelector#addSubjectAlternativeName(int,%20java.lang.String)` for more information. Note that the `names` parameter can contain duplicate names (same name and name type), but they may be removed from the `Collection` of names returned by the `https://developer.android.com/reference/java/security/cert/X509CertSelector#getSubjectAlternativeNames()` method. Note that a deep copy is performed on the `Collection` to protect against subsequent modifications.
| Parameters || |---|---| | `names` | `Collection`: a `Collection` of names (or `null`)
| | Throws || |---|---| | `https://developer.android.com/reference/java/io/IOException` | if a parsing error occurs | **See also:** - `https://developer.android.com/reference/java/security/cert/X509CertSelector#getSubjectAlternativeNames()` ### setSubjectKeyIdentifier Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public void setSubjectKeyIdentifier (byte[] subjectKeyID) ``` Sets the subjectKeyIdentifier criterion. The `X509Certificate` must contain a SubjectKeyIdentifier extension for which the contents of the extension matches the specified criterion value. If the criterion value is `null`, no subjectKeyIdentifier check will be done. If `subjectKeyID` is not `null`, it should contain a single DER encoded value corresponding to the contents of the extension value (not including the object identifier, criticality setting, and encapsulating OCTET STRING) for a SubjectKeyIdentifier extension. The ASN.1 notation for this structure follows. SubjectKeyIdentifier ::= KeyIdentifier KeyIdentifier ::= OCTET STRING Since the format of subject key identifiers is not mandated by any standard, subject key identifiers are not parsed by the `X509CertSelector`. Instead, the values are compared using a byte-by-byte comparison. Note that the byte array supplied here is cloned to protect against subsequent modifications.
| Parameters || |---|---| | `subjectKeyID` | `byte`: the subject key identifier (or `null`)
| **See also:** - `https://developer.android.com/reference/java/security/cert/X509CertSelector#getSubjectKeyIdentifier()` ### setSubjectPublicKey Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public void setSubjectPublicKey (byte[] key) ``` Sets the subjectPublicKey criterion. The `X509Certificate` must contain the specified subject public key. If `null`, no subjectPublicKey check will be done. Because this method allows the public key to be specified as a byte array, it may be used for unknown key types. If `key` is not `null`, it should contain a single DER encoded SubjectPublicKeyInfo structure, as defined in X.509. The ASN.1 notation for this structure is as follows. SubjectPublicKeyInfo ::= SEQUENCE { algorithm AlgorithmIdentifier, subjectPublicKey BIT STRING } AlgorithmIdentifier ::= SEQUENCE { algorithm OBJECT IDENTIFIER, parameters ANY DEFINED BY algorithm OPTIONAL } -- contains a value of the type -- registered for use with the -- algorithm object identifier value Note that the byte array supplied here is cloned to protect against subsequent modifications.
| Parameters || |---|---| | `key` | `byte`: a byte array containing the subject public key in ASN.1 DER form (or `null`)
| | Throws || |---|---| | `https://developer.android.com/reference/java/io/IOException` | if an encoding error occurs (incorrect form for subject public key) | **See also:** - `https://developer.android.com/reference/java/security/cert/X509CertSelector#getSubjectPublicKey()` ### setSubjectPublicKey Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public void setSubjectPublicKey (PublicKey key) ``` Sets the subjectPublicKey criterion. The `X509Certificate` must contain the specified subject public key. If `null`, no subjectPublicKey check will be done.
| Parameters || |---|---| | `key` | `PublicKey`: the subject public key to check for (or `null`)
| **See also:** - `https://developer.android.com/reference/java/security/cert/X509CertSelector#getSubjectPublicKey()` ### setSubjectPublicKeyAlgID Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public void setSubjectPublicKeyAlgID (String oid) ``` Sets the subjectPublicKeyAlgID criterion. The `X509Certificate` must contain a subject public key with the specified algorithm. If `null`, no subjectPublicKeyAlgID check will be done.
| Parameters || |---|---| | `oid` | `String`: The object identifier (OID) of the algorithm to check for (or `null`). An OID is represented by a set of nonnegative integers separated by periods.
| | Throws || |---|---| | `https://developer.android.com/reference/java/io/IOException` | if the OID is invalid, such as the first component being not 0, 1 or 2 or the second component being greater than 39. | **See also:** - `https://developer.android.com/reference/java/security/cert/X509CertSelector#getSubjectPublicKeyAlgID()` ### toString Added in [API level 1](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public String toString () ``` Return a printable representation of the `CertSelector`.
| Returns || |---|---| | `https://developer.android.com/reference/java/lang/String` | a `String` describing the contents of the `CertSelector`
|