gt:             for (int j = 0; j < mappings.size(); j++)
context: package noconflict.org.bouncycastle.jce.provider;
  
  import java.io.IOException;
  import java.math.BigInteger;
  import java.security.GeneralSecurityException;
  import java.security.PublicKey;
  import java.security.cert.CertPath;
  import java.security.cert.CertPathBuilder;
  import java.security.cert.CertPathBuilderException;
  import java.security.cert.CertPathValidatorException;
  import java.security.cert.CertificateExpiredException;
  import java.security.cert.CertificateNotYetValidException;
  import java.security.cert.PKIXCertPathChecker;
  import java.security.cert.X509CRL;
  import java.security.cert.X509Certificate;
  import java.security.cert.X509Extension;
  import java.util.ArrayList;
  import java.util.Collection;
  import java.util.Date;
  import java.util.Enumeration;
  import java.util.HashMap;
  import java.util.HashSet;
  import java.util.Iterator;
  import java.util.List;
  import java.util.Map;
  import java.util.Set;
  import java.util.Vector;
  
  import javax.security.auth.x500.X500Principal;
  
  import noconflict.org.bouncycastle.asn1.ASN1EncodableVector;
  import noconflict.org.bouncycastle.asn1.ASN1InputStream;
  import noconflict.org.bouncycastle.asn1.ASN1Sequence;
  import noconflict.org.bouncycastle.asn1.ASN1TaggedObject;
  import noconflict.org.bouncycastle.asn1.DEREncodable;
  import noconflict.org.bouncycastle.asn1.DERInteger;
  import noconflict.org.bouncycastle.asn1.DERObject;
  import noconflict.org.bouncycastle.asn1.DERObjectIdentifier;
  import noconflict.org.bouncycastle.asn1.DERSequence;
  import noconflict.org.bouncycastle.asn1.x509.BasicConstraints;
  import noconflict.org.bouncycastle.asn1.x509.CRLDistPoint;
  import noconflict.org.bouncycastle.asn1.x509.CRLReason;
  import noconflict.org.bouncycastle.asn1.x509.DistributionPoint;
  import noconflict.org.bouncycastle.asn1.x509.DistributionPointName;
  import noconflict.org.bouncycastle.asn1.x509.GeneralName;
  import noconflict.org.bouncycastle.asn1.x509.GeneralNames;
  import noconflict.org.bouncycastle.asn1.x509.GeneralSubtree;
  import noconflict.org.bouncycastle.asn1.x509.IssuingDistributionPoint;
  import noconflict.org.bouncycastle.asn1.x509.NameConstraints;
  import noconflict.org.bouncycastle.asn1.x509.PolicyInformation;
  import noconflict.org.bouncycastle.asn1.x509.X509Extensions;
  import noconflict.org.bouncycastle.asn1.x509.X509Name;
  import noconflict.org.bouncycastle.jce.exception.ExtCertPathValidatorException;
  import noconflict.org.bouncycastle.util.Arrays;
  import noconflict.org.bouncycastle.x509.ExtendedPKIXBuilderParameters;
  import noconflict.org.bouncycastle.x509.ExtendedPKIXParameters;
  import noconflict.org.bouncycastle.x509.X509CRLStoreSelector;
  import noconflict.org.bouncycastle.x509.X509CertStoreSelector;
  
  public class RFC3280CertPathUtilities
  {
      private static final PKIXCRLUtil CRL_UTIL = new PKIXCRLUtil();
  
      /**
       * If the complete CRL includes an issuing distribution point (IDP) CRL
       * extension check the following:
       * <p/>
       * (i) If the distribution point name is present in the IDP CRL extension
       * and the distribution field is present in the DP, then verify that one of
       * the names in the IDP matches one of the names in the DP. If the
       * distribution point name is present in the IDP CRL extension and the
       * distribution field is omitted from the DP, then verify that one of the
       * names in the IDP matches one of the names in the cRLIssuer field of the
       * DP.
       * </p>
       * <p/>
       * (ii) If the onlyContainsUserCerts boolean is asserted in the IDP CRL
       * extension, verify that the certificate does not include the basic
       * constraints extension with the cA boolean asserted.
       * </p>
       * <p/>
       * (iii) If the onlyContainsCACerts boolean is asserted in the IDP CRL
       * extension, verify that the certificate includes the basic constraints
       * extension with the cA boolean asserted.
       * </p>
       * <p/>
       * (iv) Verify that the onlyContainsAttributeCerts boolean is not asserted.
       * </p>
       *
       * @param dp   The distribution point.
       * @param cert The certificate.
       * @param crl  The CRL.
       * @throws AnnotatedException if one of the conditions is not met or an error occurs.
       */
      protected static void processCRLB2(
          DistributionPoint dp,
          Object cert,
          X509CRL crl)
          throws AnnotatedException
      {
          IssuingDistributionPoint idp = null;
          try
          {
              idp = IssuingDistributionPoint.getInstance(CertPathValidatorUtilities.getExtensionValue(crl,
                  RFC3280CertPathUtilities.ISSUING_DISTRIBUTION_POINT));
          }
          catch (Exception e)
          {
              throw new AnnotatedException("Issuing distribution point extension could not be decoded.", e);
          }
          // (b) (2) (i)
          // distribution point name is present
          if (idp != null)
          {
              if (idp.getDistributionPoint() != null)
              {
                  // make list of names
                  DistributionPointName dpName = IssuingDistributionPoint.getInstance(idp).getDistributionPoint();
                  List names = new ArrayList();
  
                  if (dpName.getType() == DistributionPointName.FULL_NAME)
                  {
                      GeneralName[] genNames = GeneralNames.getInstance(dpName.getName()).getNames();
                      for (int j = 0; j < genNames.length; j++)
                      {
                          names.add(genNames[j]);
                      }
                  }
                  if (dpName.getType() == DistributionPointName.NAME_RELATIVE_TO_CRL_ISSUER)
                  {
                      ASN1EncodableVector vec = new ASN1EncodableVector();
                      try
                      {
                          Enumeration e = ASN1Sequence.getInstance(
                              ASN1Sequence.fromByteArray(CertPathValidatorUtilities.getIssuerPrincipal(crl)
                                  .getEncoded())).getObjects();
                          while (e.hasMoreElements())
                          {
                              vec.add((DEREncodable)e.nextElement());
                          }
                      }
                      catch (IOException e)
                      {
                          throw new AnnotatedException("Could not read CRL issuer.", e);
                      }
                      vec.add(dpName.getName());
                      names.add(new GeneralName(X509Name.getInstance(new DERSequence(vec))));
                  }
                  boolean matches = false;
                  // verify that one of the names in the IDP matches one
                  // of the names in the DP.
                  if (dp.getDistributionPoint() != null)
                  {
                      dpName = dp.getDistributionPoint();
                      GeneralName[] genNames = null;
                      if (dpName.getType() == DistributionPointName.FULL_NAME)
                      {
                          genNames = GeneralNames.getInstance(dpName.getName()).getNames();
                      }
                      if (dpName.getType() == DistributionPointName.NAME_RELATIVE_TO_CRL_ISSUER)
                      {
                          if (dp.getCRLIssuer() != null)
                          {
                              genNames = dp.getCRLIssuer().getNames();
                          }
                          else
                          {
                              genNames = new GeneralName[1];
                              try
                              {
                                  genNames[0] = new GeneralName(new X509Name(
                                      (ASN1Sequence)ASN1Sequence.fromByteArray(CertPathValidatorUtilities
                                          .getEncodedIssuerPrincipal(cert).getEncoded())));
                              }
                              catch (IOException e)
                              {
                                  throw new AnnotatedException("Could not read certificate issuer.", e);
                              }
                          }
                          for (int j = 0; j < genNames.length; j++)
                          {
                              Enumeration e = ASN1Sequence.getInstance(genNames[j].getName().getDERObject()).getObjects();
                              ASN1EncodableVector vec = new ASN1EncodableVector();
                              while (e.hasMoreElements())
                              {
                                  vec.add((DEREncodable)e.nextElement());
                              }
                              vec.add(dpName.getName());
                              genNames[j] = new GeneralName(new X509Name(new DERSequence(vec)));
                          }
                      }
                      if (genNames != null)
                      {
                          for (int j = 0; j < genNames.length; j++)
                          {
                              if (names.contains(genNames[j]))
                              {
                                  matches = true;
                                  break;
                              }
                          }
                      }
                      if (!matches)
                      {
                          throw new AnnotatedException(
                              "No match for certificate CRL issuing distribution point name to cRLIssuer CRL distribution point.");
                      }
                  }
                  // verify that one of the names in
                  // the IDP matches one of the names in the cRLIssuer field of
                  // the DP
                  else
                  {
                      if (dp.getCRLIssuer() == null)
                      {
                          throw new AnnotatedException("Either the cRLIssuer or the distributionPoint field must "
                              + "be contained in DistributionPoint.");
                      }
                      GeneralName[] genNames = dp.getCRLIssuer().getNames();
                      for (int j = 0; j < genNames.length; j++)
                      {
                          if (names.contains(genNames[j]))
                          {
                              matches = true;
                              break;
                          }
                      }
                      if (!matches)
                      {
                          throw new AnnotatedException(
                              "No match for certificate CRL issuing distribution point name to cRLIssuer CRL distribution point.");
                      }
                  }
              }
              BasicConstraints bc = null;
              try
              {
                  bc = BasicConstraints.getInstance(CertPathValidatorUtilities.getExtensionValue((X509Extension)cert,
                      BASIC_CONSTRAINTS));
              }
              catch (Exception e)
              {
                  throw new AnnotatedException("Basic constraints extension could not be decoded.", e);
              }
  
              if (cert instanceof X509Certificate)
              {
                  // (b) (2) (ii)
                  if (idp.onlyContainsUserCerts() && (bc != null && bc.isCA()))
                  {
                      throw new AnnotatedException("CA Cert CRL only contains user certificates.");
                  }
  
                  // (b) (2) (iii)
                  if (idp.onlyContainsCACerts() && (bc == null || !bc.isCA()))
                  {
                      throw new AnnotatedException("End CRL only contains CA certificates.");
                  }
              }
  
              // (b) (2) (iv)
              if (idp.onlyContainsAttributeCerts())
              {
                  throw new AnnotatedException("onlyContainsAttributeCerts boolean is asserted.");
              }
          }
      }
  
      /**
       * If the DP includes cRLIssuer, then verify that the issuer field in the
       * complete CRL matches cRLIssuer in the DP and that the complete CRL
       * contains an issuing distribution point extension with the indirectCRL
       * boolean asserted. Otherwise, verify that the CRL issuer matches the
       * certificate issuer.
       *
       * @param dp   The distribution point.
       * @param cert The certificate ot attribute certificate.
       * @param crl  The CRL for <code>cert</code>.
       * @throws AnnotatedException if one of the above conditions does not apply or an error
       *                            occurs.
       */
      protected static void processCRLB1(
          DistributionPoint dp,
          Object cert,
          X509CRL crl)
          throws AnnotatedException
      {
          DERObject idp = CertPathValidatorUtilities.getExtensionValue(crl, ISSUING_DISTRIBUTION_POINT);
          boolean isIndirect = false;
          if (idp != null)
          {
              if (IssuingDistributionPoint.getInstance(idp).isIndirectCRL())
              {
                  isIndirect = true;
              }
          }
          byte[] issuerBytes = CertPathValidatorUtilities.getIssuerPrincipal(crl).getEncoded();
  
          boolean matchIssuer = false;
          if (dp.getCRLIssuer() != null)
          {
              GeneralName genNames[] = dp.getCRLIssuer().getNames();
              for (int j = 0; j < genNames.length; j++)
              {
                  if (genNames[j].getTagNo() == GeneralName.directoryName)
                  {
                      try
                      {
                          if (Arrays.areEqual(genNames[j].getName().getDERObject().getEncoded(), issuerBytes))
                          {
                              matchIssuer = true;
                          }
                      }
                      catch (IOException e)
                      {
                          throw new AnnotatedException(
                              "CRL issuer information from distribution point cannot be decoded.", e);
                      }
                  }
              }
              if (matchIssuer && !isIndirect)
              {
                  throw new AnnotatedException("Distribution point contains cRLIssuer field but CRL is not indirect.");
              }
              if (!matchIssuer)
              {
                  throw new AnnotatedException("CRL issuer of CRL does not match CRL issuer of distribution point.");
              }
          }
          else
          {
              if (CertPathValidatorUtilities.getIssuerPrincipal(crl).equals(
                  CertPathValidatorUtilities.getEncodedIssuerPrincipal(cert)))
              {
                  matchIssuer = true;
              }
          }
          if (!matchIssuer)
          {
              throw new AnnotatedException("Cannot find matching CRL issuer for certificate.");
          }
      }
  
      protected static ReasonsMask processCRLD(
          X509CRL crl,
          DistributionPoint dp)
          throws AnnotatedException
      {
          IssuingDistributionPoint idp = null;
          try
          {
              idp = IssuingDistributionPoint.getInstance(CertPathValidatorUtilities.getExtensionValue(crl,
                  RFC3280CertPathUtilities.ISSUING_DISTRIBUTION_POINT));
          }
          catch (Exception e)
          {
              throw new AnnotatedException("Issuing distribution point extension could not be decoded.", e);
          }
          // (d) (1)
          if (idp != null && idp.getOnlySomeReasons() != null && dp.getReasons() != null)
          {
              return new ReasonsMask(dp.getReasons().intValue()).intersect(new ReasonsMask(idp.getOnlySomeReasons()
                  .intValue()));
          }
          // (d) (4)
          if ((idp == null || idp.getOnlySomeReasons() == null) && dp.getReasons() == null)
          {
              return ReasonsMask.allReasons;
          }
          // (d) (2) and (d)(3)
          return (dp.getReasons() == null
              ? ReasonsMask.allReasons
              : new ReasonsMask(dp.getReasons().intValue())).intersect(idp == null
              ? ReasonsMask.allReasons
              : new ReasonsMask(idp.getOnlySomeReasons().intValue()));
  
      }
  
      protected static final String CERTIFICATE_POLICIES = X509Extensions.CertificatePolicies.getId();
  
      protected static final String POLICY_MAPPINGS = X509Extensions.PolicyMappings.getId();
  
      protected static final String INHIBIT_ANY_POLICY = X509Extensions.InhibitAnyPolicy.getId();
  
      protected static final String ISSUING_DISTRIBUTION_POINT = X509Extensions.IssuingDistributionPoint.getId();
  
      protected static final String FRESHEST_CRL = X509Extensions.FreshestCRL.getId();
  
      protected static final String DELTA_CRL_INDICATOR = X509Extensions.DeltaCRLIndicator.getId();
  
      protected static final String POLICY_CONSTRAINTS = X509Extensions.PolicyConstraints.getId();
  
      protected static final String BASIC_CONSTRAINTS = X509Extensions.BasicConstraints.getId();
  
      protected static final String CRL_DISTRIBUTION_POINTS = X509Extensions.CRLDistributionPoints.getId();
  
      protected static final String SUBJECT_ALTERNATIVE_NAME = X509Extensions.SubjectAlternativeName.getId();
  
      protected static final String NAME_CONSTRAINTS = X509Extensions.NameConstraints.getId();
  
      protected static final String AUTHORITY_KEY_IDENTIFIER = X509Extensions.AuthorityKeyIdentifier.getId();
  
      protected static final String KEY_USAGE = X509Extensions.KeyUsage.getId();
  
      protected static final String CRL_NUMBER = X509Extensions.CRLNumber.getId();
  
      protected static final String ANY_POLICY = "2.5.29.32.0";
  
      /*
       * key usage bits
       */
      protected static final int KEY_CERT_SIGN = 5;
  
      protected static final int CRL_SIGN = 6;
  
      /**
       * Obtain and validate the certification path for the complete CRL issuer.
       * If a key usage extension is present in the CRL issuer's certificate,
       * verify that the cRLSign bit is set.
       *
       * @param crl                CRL which contains revocation information for the certificate
       *                           <code>cert</code>.
       * @param cert               The attribute certificate or certificate to check if it is
       *                           revoked.
       * @param defaultCRLSignCert The issuer certificate of the certificate <code>cert</code>.
       * @param defaultCRLSignKey  The public key of the issuer certificate
       *                           <code>defaultCRLSignCert</code>.
       * @param paramsPKIX         paramsPKIX PKIX parameters.
       * @param certPathCerts      The certificates on the certification path.
       * @return A <code>Set</code> with all keys of possible CRL issuer
       *         certificates.
       * @throws AnnotatedException if the CRL is not valid or the status cannot be checked or
       *                            some error occurs.
       */
      protected static Set processCRLF(
          X509CRL crl,
          Object cert,
          X509Certificate defaultCRLSignCert,
          PublicKey defaultCRLSignKey,
          ExtendedPKIXParameters paramsPKIX,
          List certPathCerts)
          throws AnnotatedException
      {
          // (f)
  
          // get issuer from CRL
          X509CertStoreSelector selector = new X509CertStoreSelector();
          try
          {
              byte[] issuerPrincipal = CertPathValidatorUtilities.getIssuerPrincipal(crl).getEncoded();
              selector.setSubject(issuerPrincipal);
          }
          catch (IOException e)
          {
              throw new AnnotatedException(
                  "Subject criteria for certificate selector to find issuer certificate for CRL could not be set.", e);
          }
  
          // get CRL signing certs
          Collection coll;
          try
          {
              coll = CertPathValidatorUtilities.findCertificates(selector, paramsPKIX.getStores());
              coll.addAll(CertPathValidatorUtilities.findCertificates(selector, paramsPKIX.getAdditionalStores()));
              coll.addAll(CertPathValidatorUtilities.findCertificates(selector, paramsPKIX.getCertStores()));
          }
          catch (AnnotatedException e)
          {
              throw new AnnotatedException("Issuer certificate for CRL cannot be searched.", e);
          }
  
          coll.add(defaultCRLSignCert);
  
          Iterator cert_it = coll.iterator();
  
          List validCerts = new ArrayList();
          List validKeys = new ArrayList();
  
          while (cert_it.hasNext())
          {
              X509Certificate signingCert = (X509Certificate)cert_it.next();
  
              /*
               * CA of the certificate, for which this CRL is checked, has also
               * signed CRL, so skip the path validation, because is already done
               */
              if (signingCert.equals(defaultCRLSignCert))
              {
                  validCerts.add(signingCert);
                  validKeys.add(defaultCRLSignKey);
                  continue;
              }
              try
              {
                  CertPathBuilder builder = CertPathBuilder.getInstance("PKIX", BouncyCastleProvider.PROVIDER_NAME);
                  selector = new X509CertStoreSelector();
                  selector.setCertificate(signingCert);
                  ExtendedPKIXParameters temp = (ExtendedPKIXParameters)paramsPKIX.clone();
                  temp.setTargetCertConstraints(selector);
                  ExtendedPKIXBuilderParameters params = (ExtendedPKIXBuilderParameters)ExtendedPKIXBuilderParameters
                      .getInstance(temp);
                  /*
                   * if signingCert is placed not higher on the cert path a
                   * dependency loop results. CRL for cert is checked, but
                   * signingCert is needed for checking the CRL which is dependent
                   * on checking cert because it is higher in the cert path and so
                   * signing signingCert transitively. so, revocation is disabled,
                   * forgery attacks of the CRL are detected in this outer loop
                   * for all other it must be enabled to prevent forgery attacks
                   */
                  if (certPathCerts.contains(signingCert))
                  {
                      params.setRevocationEnabled(false);
                  }
                  else
                  {
                      params.setRevocationEnabled(true);
                  }
                  List certs = builder.build(params).getCertPath().getCertificates();
                  validCerts.add(signingCert);
                  validKeys.add(CertPathValidatorUtilities.getNextWorkingKey(certs, 0));
              }
              catch (CertPathBuilderException e)
              {
                  throw new AnnotatedException("Internal error.", e);
              }
              catch (CertPathValidatorException e)
              {
                  throw new AnnotatedException("Public key of issuer certificate of CRL could not be retrieved.", e);
              }
              catch (Exception e)
              {
                  throw new RuntimeException(e.getMessage());
              }
          }
  
          Set checkKeys = new HashSet();
  
          AnnotatedException lastException = null;
          for (int i = 0; i < validCerts.size(); i++)
          {
              X509Certificate signCert = (X509Certificate)validCerts.get(i);
              boolean[] keyusage = signCert.getKeyUsage();
  
              if (keyusage != null && (keyusage.length < 7 || !keyusage[CRL_SIGN]))
              {
                  lastException = new AnnotatedException(
                      "Issuer certificate key usage extension does not permit CRL signing.");
              }
              else
              {
                  checkKeys.add(validKeys.get(i));
              }
          }
  
          if (checkKeys.isEmpty() && lastException == null)
          {
              throw new AnnotatedException("Cannot find a valid issuer certificate.");
          }
          if (checkKeys.isEmpty() && lastException != null)
          {
              throw lastException;
          }
  
          return checkKeys;
      }
  
      protected static PublicKey processCRLG(
          X509CRL crl,
          Set keys)
          throws AnnotatedException
      {
          Exception lastException = null;
          for (Iterator it = keys.iterator(); it.hasNext();)
          {
              PublicKey key = (PublicKey)it.next();
              try
              {
                  crl.verify(key);
                  return key;
              }
              catch (Exception e)
              {
                  lastException = e;
              }
          }
          throw new AnnotatedException("Cannot verify CRL.", lastException);
      }
  
      protected static X509CRL processCRLH(
          Set deltacrls,
          PublicKey key)
          throws AnnotatedException
      {
          Exception lastException = null;
  
          for (Iterator it = deltacrls.iterator(); it.hasNext();)
          {
              X509CRL crl = (X509CRL)it.next();
              try
              {
                  crl.verify(key);
                  return crl;
              }
              catch (Exception e)
              {
                  lastException = e;
              }
          }
  
          if (lastException != null)
          {
              throw new AnnotatedException("Cannot verify delta CRL.", lastException);
          }
          return null;
      }
  
      protected static Set processCRLA1i(
          Date currentDate,
          ExtendedPKIXParameters paramsPKIX,
          X509Certificate cert,
          X509CRL crl)
          throws AnnotatedException
      {
          Set set = new HashSet();
          if (paramsPKIX.isUseDeltasEnabled())
          {
              CRLDistPoint freshestCRL = null;
              try
              {
                  freshestCRL = CRLDistPoint
                      .getInstance(CertPathValidatorUtilities.getExtensionValue(cert, FRESHEST_CRL));
              }
              catch (AnnotatedException e)
              {
                  throw new AnnotatedException("Freshest CRL extension could not be decoded from certificate.", e);
              }
              if (freshestCRL == null)
              {
                  try
                  {
                      freshestCRL = CRLDistPoint.getInstance(CertPathValidatorUtilities.getExtensionValue(crl,
                          FRESHEST_CRL));
                  }
                  catch (AnnotatedException e)
                  {
                      throw new AnnotatedException("Freshest CRL extension could not be decoded from CRL.", e);
                  }
              }
              if (freshestCRL != null)
              {
                  try
                  {
                      CertPathValidatorUtilities.addAdditionalStoresFromCRLDistributionPoint(freshestCRL, paramsPKIX);
                  }
                  catch (AnnotatedException e)
                  {
                      throw new AnnotatedException(
                          "No new delta CRL locations could be added from Freshest CRL extension.", e);
                  }
                  // get delta CRL(s)
                  try
                  {
                      set.addAll(CertPathValidatorUtilities.getDeltaCRLs(currentDate, paramsPKIX, crl));
                  }
                  catch (AnnotatedException e)
                  {
                      throw new AnnotatedException("Exception obtaining delta CRLs.", e);
                  }
              }
          }
          return set;
      }
  
      protected static Set[] processCRLA1ii(
          Date currentDate,
          ExtendedPKIXParameters paramsPKIX,
          X509Certificate cert,
          X509CRL crl)
          throws AnnotatedException
      {
          Set deltaSet = new HashSet();
          X509CRLStoreSelector crlselect = new X509CRLStoreSelector();
          crlselect.setCertificateChecking(cert);
  
          try
          {
              crlselect.addIssuerName(crl.getIssuerX500Principal().getEncoded());
          }
          catch (IOException e)
          {
              throw new AnnotatedException("Cannot extract issuer from CRL." + e, e);
          }
  
          crlselect.setCompleteCRLEnabled(true);
          Set completeSet = CRL_UTIL.findCRLs(crlselect, paramsPKIX, currentDate);
  
          if (paramsPKIX.isUseDeltasEnabled())
          {
              // get delta CRL(s)
              try
              {
                  deltaSet.addAll(CertPathValidatorUtilities.getDeltaCRLs(currentDate, paramsPKIX, crl));
              }
              catch (AnnotatedException e)
              {
                  throw new AnnotatedException("Exception obtaining delta CRLs.", e);
              }
          }
          return new Set[]
              {
                  completeSet,
                  deltaSet};
      }
  
  
  
      /**
       * If use-deltas is set, verify the issuer and scope of the delta CRL.
       *
       * @param deltaCRL    The delta CRL.
       * @param completeCRL The complete CRL.
       * @param pkixParams  The PKIX paramaters.
       * @throws AnnotatedException if an exception occurs.
       */
      protected static void processCRLC(
          X509CRL deltaCRL,
          X509CRL completeCRL,
          ExtendedPKIXParameters pkixParams)
          throws AnnotatedException
      {
          if (deltaCRL == null)
          {
              return;
          }
          IssuingDistributionPoint completeidp = null;
          try
          {
              completeidp = IssuingDistributionPoint.getInstance(CertPathValidatorUtilities.getExtensionValue(
                  completeCRL, RFC3280CertPathUtilities.ISSUING_DISTRIBUTION_POINT));
          }
          catch (Exception e)
          {
              throw new AnnotatedException("Issuing distribution point extension could not be decoded.", e);
          }
  
          if (pkixParams.isUseDeltasEnabled())
          {
              // (c) (1)
              if (!deltaCRL.getIssuerX500Principal().equals(completeCRL.getIssuerX500Principal()))
              {
                  throw new AnnotatedException("Complete CRL issuer does not match delta CRL issuer.");
              }
  
              // (c) (2)
              IssuingDistributionPoint deltaidp = null;
              try
              {
                  deltaidp = IssuingDistributionPoint.getInstance(CertPathValidatorUtilities.getExtensionValue(
                      deltaCRL, ISSUING_DISTRIBUTION_POINT));
              }
              catch (Exception e)
              {
                  throw new AnnotatedException(
                      "Issuing distribution point extension from delta CRL could not be decoded.", e);
              }
  
              boolean match = false;
              if (completeidp == null)
              {
                  if (deltaidp == null)
                  {
                      match = true;
                  }
              }
              else
              {
                  if (completeidp.equals(deltaidp))
                  {
                      match = true;
                  }
              }
              if (!match)
              {
                  throw new AnnotatedException(
                      "Issuing distribution point extension from delta CRL and complete CRL does not match.");
              }
  
              // (c) (3)
              DERObject completeKeyIdentifier = null;
              try
              {
                  completeKeyIdentifier = CertPathValidatorUtilities.getExtensionValue(
                      completeCRL, AUTHORITY_KEY_IDENTIFIER);
              }
              catch (AnnotatedException e)
              {
                  throw new AnnotatedException(
                      "Authority key identifier extension could not be extracted from complete CRL.", e);
              }
  
              DERObject deltaKeyIdentifier = null;
              try
              {
                  deltaKeyIdentifier = CertPathValidatorUtilities.getExtensionValue(
                      deltaCRL, AUTHORITY_KEY_IDENTIFIER);
              }
              catch (AnnotatedException e)
              {
                  throw new AnnotatedException(
                      "Authority key identifier extension could not be extracted from delta CRL.", e);
              }
  
              if (completeKeyIdentifier == null)
              {
                  throw new AnnotatedException("CRL authority key identifier is null.");
              }
  
              if (deltaKeyIdentifier == null)
              {
                  throw new AnnotatedException("Delta CRL authority key identifier is null.");
              }
  
              if (!completeKeyIdentifier.equals(deltaKeyIdentifier))
              {
                  throw new AnnotatedException(
                      "Delta CRL authority key identifier does not match complete CRL authority key identifier.");
              }
          }
      }
  
      protected static void processCRLI(
          Date validDate,
          X509CRL deltacrl,
          Object cert,
          CertStatus certStatus,
          ExtendedPKIXParameters pkixParams)
          throws AnnotatedException
      {
          if (pkixParams.isUseDeltasEnabled() && deltacrl != null)
          {
              CertPathValidatorUtilities.getCertStatus(validDate, deltacrl, cert, certStatus);
          }
      }
  
      protected static void processCRLJ(
          Date validDate,
          X509CRL completecrl,
          Object cert,
          CertStatus certStatus)
          throws AnnotatedException
      {
          if (certStatus.getCertStatus() == CertStatus.UNREVOKED)
          {
              CertPathValidatorUtilities.getCertStatus(validDate, completecrl, cert, certStatus);
          }
      }
  
      protected static PKIXPolicyNode prepareCertB(
          CertPath certPath,
          int index,
          List[] policyNodes,
          PKIXPolicyNode validPolicyTree,
          int policyMapping)
          throws CertPathValidatorException
      {
          List certs = certPath.getCertificates();
          X509Certificate cert = (X509Certificate)certs.get(index);
          int n = certs.size();
          // i as defined in the algorithm description
          int i = n - index;
          // (b)
          //
          ASN1Sequence pm = null;
          try
          {
              pm = DERSequence.getInstance(CertPathValidatorUtilities.getExtensionValue(cert,
                  RFC3280CertPathUtilities.POLICY_MAPPINGS));
          }
          catch (AnnotatedException ex)
          {
              throw new ExtCertPathValidatorException("Policy mappings extension could not be decoded.", ex, certPath,
                  index);
          }
          PKIXPolicyNode _validPolicyTree = validPolicyTree;
          if (pm != null)
          {
              ASN1Sequence mappings = (ASN1Sequence)pm;
              Map m_idp = new HashMap();
              Set s_idp = new HashSet();
  
              for (int j = 0; j < mappings.size(); j++)
              {
                  ASN1Sequence mapping = (ASN1Sequence)mappings.getObjectAt(j);
                  String id_p = ((DERObjectIdentifier)mapping.getObjectAt(0)).getId();
                  String sd_p = ((DERObjectIdentifier)mapping.getObjectAt(1)).getId();
                  Set tmp;
  
                  if (!m_idp.containsKey(id_p))
                  {
                      tmp = new HashSet();
                      tmp.add(sd_p);
                      m_idp.put(id_p, tmp);
                      s_idp.add(id_p);
                  }
                  else
                  {
                      tmp = (Set)m_idp.get(id_p);
                      tmp.add(sd_p);
                  }
              }
  
              Iterator it_idp = s_idp.iterator();
              while (it_idp.hasNext())
              {
                  String id_p = (String)it_idp.next();
  
                  //
                  // (1)
                  //
                  if (policyMapping > 0)
                  {
                      boolean idp_found = false;
                      Iterator nodes_i = policyNodes[i].iterator();
                      while (nodes_i.hasNext())
                      {
                          PKIXPolicyNode node = (PKIXPolicyNode)nodes_i.next();
                          if (node.getValidPolicy().equals(id_p))
                          {
                              idp_found = true;
                              node.expectedPolicies = (Set)m_idp.get(id_p);
                              break;
                          }
                      }
  
                      if (!idp_found)
                      {
                          nodes_i = policyNodes[i].iterator();
                          while (nodes_i.hasNext())
                          {
                              PKIXPolicyNode node = (PKIXPolicyNode)nodes_i.next();
                              if (RFC3280CertPathUtilities.ANY_POLICY.equals(node.getValidPolicy()))
                              {
                                  Set pq = null;
                                  ASN1Sequence policies = null;
                                  try
                                  {
                                      policies = (ASN1Sequence)CertPathValidatorUtilities.getExtensionValue(cert,
                                          RFC3280CertPathUtilities.CERTIFICATE_POLICIES);
                                  }
                                  catch (AnnotatedException e)
                                  {
                                      throw new ExtCertPathValidatorException(
                                          "Certificate policies extension could not be decoded.", e, certPath, index);
                                  }
                                  Enumeration e = policies.getObjects();
                                  while (e.hasMoreElements())
                                  {
                                      PolicyInformation pinfo = null;
                                      try
                                      {
                                          pinfo = PolicyInformation.getInstance(e.nextElement());
                                      }
                                      catch (Exception ex)
                                      {
                                          throw new CertPathValidatorException(
                                              "Policy information could not be decoded.", ex, certPath, index);
                                      }
                                      if (RFC3280CertPathUtilities.ANY_POLICY.equals(pinfo.getPolicyIdentifier().getId()))
                                      {
                                          try
                                          {
                                              pq = CertPathValidatorUtilities
                                                  .getQualifierSet(pinfo.getPolicyQualifiers());
                                          }
                                          catch (CertPathValidatorException ex)
                                          {
  
                                              throw new ExtCertPathValidatorException(
                                                  "Policy qualifier info set could not be decoded.", ex, certPath,
                                                  index);
                                          }
                                          break;
                                      }
                                  }
                                  boolean ci = false;
                                  if (cert.getCriticalExtensionOIDs() != null)
                                  {
                                      ci = cert.getCriticalExtensionOIDs().contains(
                                          RFC3280CertPathUtilities.CERTIFICATE_POLICIES);
                                  }
  
                                  PKIXPolicyNode p_node = (PKIXPolicyNode)node.getParent();
                                  if (RFC3280CertPathUtilities.ANY_POLICY.equals(p_node.getValidPolicy()))
                                  {
                                      PKIXPolicyNode c_node = new PKIXPolicyNode(new ArrayList(), i, (Set)m_idp
                                          .get(id_p), p_node, pq, id_p, ci);
                                      p_node.addChild(c_node);
                                      policyNodes[i].add(c_node);
                                  }
                                  break;
                              }
                          }
                      }
  
                      //
                      // (2)
                      //
                  }
                  else if (policyMapping <= 0)
                  {
                      Iterator nodes_i = policyNodes[i].iterator();
                      while (nodes_i.hasNext())
                      {
                          PKIXPolicyNode node = (PKIXPolicyNode)nodes_i.next();
                          if (node.getValidPolicy().equals(id_p))
                          {
                              PKIXPolicyNode p_node = (PKIXPolicyNode)node.getParent();
                              p_node.removeChild(node);
                              nodes_i.remove();
                              for (int k = (i - 1); k >= 0; k--)
                              {
                                  List nodes = policyNodes[k];
                                  for (int l = 0; l < nodes.size(); l++)
                                  {
                                      PKIXPolicyNode node2 = (PKIXPolicyNode)nodes.get(l);
                                      if (!node2.hasChildren())
                                      {
                                          _validPolicyTree = CertPathValidatorUtilities.removePolicyNode(
                                              _validPolicyTree, policyNodes, node2);
                                          if (_validPolicyTree == null)
                                          {
                                              break;
                                          }
                                      }
                                  }
                              }
                          }
                      }
                  }
              }
          }
          return _validPolicyTree;
      }
  
      protected static void prepareNextCertA(
          CertPath certPath,
          int index)
          throws CertPathValidatorException
      {
          List certs = certPath.getCertificates();
          X509Certificate cert = (X509Certificate)certs.get(index);
          //
          //
          // (a) check the policy mappings
          //
          ASN1Sequence pm = null;
          try
          {
              pm = DERSequence.getInstance(CertPathValidatorUtilities.getExtensionValue(cert,
                  RFC3280CertPathUtilities.POLICY_MAPPINGS));
          }
          catch (AnnotatedException ex)
          {
              throw new ExtCertPathValidatorException("Policy mappings extension could not be decoded.", ex, certPath,
                  index);
          }
          if (pm != null)
          {
              ASN1Sequence mappings = pm;
  
  