Android系统证书校验原理

TBSCertList  ::=  SEQUENCE  {
version                 Version OPTIONAL,
-- if present, must be v2
signature               AlgorithmIdentifier,
issuer                  Name,
thisUpdate              ChoiceOfTime,
nextUpdate              ChoiceOfTime OPTIONAL,
revokedCertificates     SEQUENCE OF SEQUENCE  {
userCertificate         CertificateSerialNumber,
revocationDate          ChoiceOfTime,
crlEntryExtensions      Extensions OPTIONAL
-- if present, must be v2
}  OPTIONAL,
crlExtensions           [0]  EXPLICIT Extensions OPTIONAL
-- if present, must be v2
}

/**
     * Verifies that this CRL was signed using the
     * private key that corresponds to the given public key,
     * and that the signature verification was computed by
     * the given provider.
     *
     * @param key the PublicKey used to carry out the verification.
     * @param sigProvider the name of the signature provider.
     *
     * @exception NoSuchAlgorithmException on unsupported signature
     * algorithms.
     * @exception InvalidKeyException on incorrect key.
     * @exception NoSuchProviderException on incorrect provider.
     * @exception SignatureException on signature errors.
     * @exception CRLException on encoding errors.
     */
    public synchronized void verify(PublicKey key, String sigProvider)
            throws CRLException, NoSuchAlgorithmException, InvalidKeyException,
            NoSuchProviderException, SignatureException {


        if (sigProvider == null) {
            sigProvider = "";
        }
        if ((verifiedPublicKey != null) && verifiedPublicKey.equals(key)) {
            // this CRL has already been successfully verified using
            // this public key. Make sure providers match, too.
            if (sigProvider.equals(verifiedProvider)) {
                return;
            }
        }
        if (signedCRL == null) {
            throw new CRLException("Uninitialized CRL");
        }
        Signature   sigVerf = null;
        if (sigProvider.length() == 0) {
            sigVerf = Signature.getInstance(sigAlgId.getName());
        } else {
            sigVerf = Signature.getInstance(sigAlgId.getName(), sigProvider);
        }
        sigVerf.initVerify(key);


        if (tbsCertList == null) {
            throw new CRLException("Uninitialized CRL");
        }


        sigVerf.update(tbsCertList, 0, tbsCertList.length);


        if (!sigVerf.verify(signature)) {
            throw new SignatureException("Signature does not match.");
        }
        verifiedPublicKey = key;
        verifiedProvider = sigProvider;
    }

 /**
    * Verifies the passed-in signature.
    *
    * <p>A call to this method resets this signature object to the state
    * it was in when previously initialized for verification via a
    * call to {@code initVerify(PublicKey)}. That is, the object is
    * reset and available to verify another signature from the identity
    * whose public key was specified in the call to {@code initVerify}.
    *
    * @param signature the signature bytes to be verified.
    *
    * @return true if the signature was verified, false if not.
    *
    * @exception SignatureException if this signature object is not
    * initialized properly, the passed-in signature is improperly
    * encoded or of the wrong type, if this signature algorithm is unable to
    * process the input data provided, etc.
    */
   public final boolean verify(byte[] signature) throws SignatureException {
       if (state == VERIFY) {
           return engineVerify(signature);
       }
       throw new SignatureException("object not initialized for " +
                                    "verification");
   }