private void verifyNameConstraints ( X509Certificate currCert ) throws CertPathValidatorException { String msg = "name constraints" ; if ( debug != null ) { debug . println ( "---checking " + msg + "..." ) ; } // check name constraints only if there is a previous name constraint // and either the currCert is the final cert or the currCert is not // self-issued if ( prevNC != null && ( ( i == certPathLength ) || ! X509CertImpl . isSelfIssued ( currCert ) ) ) { if ( debug != null ) { debug . println ( "prevNC = " + prevNC + ", currDN = " + currCert . getSubjectX500Principal ( ) ) ; } try { if ( ! prevNC . verify ( currCert ) ) { throw new CertPathValidatorException ( msg + " check failed" , null , null , - 1 , PKIXReason . INVALID_NAME ) ; } } catch ( IOException ioe ) { throw new CertPathValidatorException ( ioe ) ; } } // merge name constraints regardless of whether cert is self-issued prevNC = mergeNameConstraints ( currCert , prevNC ) ; if ( debug != null ) debug . println ( msg + " verified." ) ; }
Internal method to check the name constraints against a cert