Class LtvOptions

    • Constructor Detail

      • LtvOptions

        public LtvOptions()
    • Method Detail

      • isFetchOcsp

        public boolean isFetchOcsp()
        Query each certificate's OCSP responder (from its Authority Information Access extension). Default true.
      • setFetchOcsp

        public LtvOptions setFetchOcsp​(boolean fetchOcsp)
      • isFetchCrl

        public boolean isFetchCrl()
        Download each certificate's CRL (from its CRL Distribution Points extension). Default true.
      • setFetchCrl

        public LtvOptions setFetchCrl​(boolean fetchCrl)
      • isCrlOnlyAsFallback

        public boolean isCrlOnlyAsFallback()
        When both isFetchOcsp() and this are true: false (default) fetches OCSP and CRL independently for every certificate, embedding both as redundant revocation evidence (the usual PAdES-LT recommendation); true only downloads a certificate's CRL when its OCSP responder was unreachable/absent, trading completeness for fewer requests.
      • setCrlOnlyAsFallback

        public LtvOptions setCrlOnlyAsFallback​(boolean crlOnlyAsFallback)
      • getConnectTimeoutMillis

        public int getConnectTimeoutMillis()
      • setConnectTimeoutMillis

        public LtvOptions setConnectTimeoutMillis​(int connectTimeoutMillis)
      • getReadTimeoutMillis

        public int getReadTimeoutMillis()
      • setReadTimeoutMillis

        public LtvOptions setReadTimeoutMillis​(int readTimeoutMillis)
      • isIncludeRootCertificate

        public boolean isIncludeRootCertificate()
        Whether to also fetch/embed revocation info for the last (self-signed root/trust-anchor) certificate in the chain. Default false: a trust anchor is trusted by its own presence in the verifier's trust store, not by a signature over it, so most CAs don't even publish OCSP/CRL for their own root, and PAdES-LT validators don't require one.
      • setIncludeRootCertificate

        public LtvOptions setIncludeRootCertificate​(boolean includeRootCertificate)