private void checkBasicConstraints(X509Certificate currCert) throws CertPathValidatorException {
  String msg="basic constraints";
  if (debug != null) {
    debug.println("---checking " + msg + "...");
    debug.println("i = " + i + ", maxPathLength = "+ maxPathLength);
  }
  if (i < certPathLength) {
    int pathLenConstraint=-1;
    if (currCert.getVersion() < 3) {
      if (i == 1) {
        if (X509CertImpl.isSelfIssued(currCert)) {
          pathLenConstraint=Integer.MAX_VALUE;
        }
      }
    }
 else {
      pathLenConstraint=currCert.getBasicConstraints();
    }
    if (pathLenConstraint == -1) {
      throw new CertPathValidatorException(msg + " check failed: this is not a CA certificate",null,null,-1,PKIXReason.NOT_CA_CERT);
    }
    if (!X509CertImpl.isSelfIssued(currCert)) {
      if (maxPathLength <= 0) {
        throw new CertPathValidatorException(msg + " check failed: pathLenConstraint violated - " + "this cert must be the last cert in the "+ "certification path",null,null,-1,PKIXReason.PATH_TOO_LONG);
      }
      maxPathLength--;
    }
    if (pathLenConstraint < maxPathLength)     maxPathLength=pathLenConstraint;
  }
  if (debug != null) {
    debug.println("after processing, maxPathLength = " + maxPathLength);
    debug.println(msg + " verified.");
  }
}

private void checkBasicConstraints ( X509Certificate currCert ) throws CertPathValidatorException { String msg = "basic constraints" ; if ( debug != null ) { debug . println ( "---checking " + msg + "..." ) ; debug . println ( "i = " + i + ", maxPathLength = " + maxPathLength ) ; } if ( i < certPathLength ) { int pathLenConstraint = - 1 ; if ( currCert . getVersion ( ) < 3 ) { if ( i == 1 ) { if ( X509CertImpl . isSelfIssued ( currCert ) ) { pathLenConstraint = Integer . MAX_VALUE ; } } } else { pathLenConstraint = currCert . getBasicConstraints ( ) ; } if ( pathLenConstraint == - 1 ) { throw new CertPathValidatorException ( msg + " check failed: this is not a CA certificate" , null , null , - 1 , PKIXReason . NOT_CA_CERT ) ; } if ( ! X509CertImpl . isSelfIssued ( currCert ) ) { if ( maxPathLength <= 0 ) { throw new CertPathValidatorException ( msg + " check failed: pathLenConstraint violated - " + "this cert must be the last cert in the " + "certification path" , null , null , - 1 , PKIXReason . PATH_TOO_LONG ) ; } maxPathLength -- ; } if ( pathLenConstraint < maxPathLength ) maxPathLength = pathLenConstraint ; } if ( debug != null ) { debug . println ( "after processing, maxPathLength = " + maxPathLength ) ; debug . println ( msg + " verified." ) ; } }
internal method to check that a given cert meets basic constraints .
