X509CRLImpl

<p> An implementation for X509 CRL (Certificate Revocation List). <p> The X.509 v2 CRL format is described below in ASN.1: <pre> CertificateList ::= SEQUENCE { tbsCertList TBSCertList, signatureAlgorithm AlgorithmIdentifier, signature BIT STRING } </pre> More information can be found in <a href="http://www.ietf.org/rfc/rfc3280.txt">RFC 3280: Internet X.509 Public Key Infrastructure Certificate and CRL Profile</a>. <p> The ASN.1 definition of <code>tbsCertList</code> is: <pre> TBSCertList ::= SEQUENCE { version Version OPTIONAL, -- if present, must be v2 signature AlgorithmIdentifier, issuer Name, thisUpdate ChoiceOfTime, nextUpdate ChoiceOfTime OPTIONAL, revokedCertificates SEQUENCE OF SEQUENCE { userCertificate CertificateSerialNumber, revocationDate ChoiceOfTime, crlEntryExtensions Extensions OPTIONAL -- if present, must be v2 } OPTIONAL, crlExtensions [0] EXPLICIT Extensions OPTIONAL -- if present, must be v2 } </pre>

@author Hemma Prafullchandra @see X509CRL

class X509CRLImpl : X509CRL , DerEncoder {

this(byte[] crlData);

this(DerValue val);

this(InputStream inStrm);

this(X500Name issuer, Date thisDate, Date nextDate);

this(X500Name issuer, Date thisDate, Date nextDate, X509CRLEntry[] badCerts);

this(X500Name issuer, Date thisDate, Date nextDate, X509CRLEntry[] badCerts, CRLExtensions crlExts);

bool opEquals(Object other);

size_t toHash();

byte[] getEncodedInternal();

byte[] getEncoded();

void encodeInfo(OutputStream outputStream);

void verify(PublicKey key);

void verify(PublicKey key, string sigProvider);

void verify(PublicKey key, Provider sigProvider);

static void verify(X509CRL crl, PublicKey key, Provider sigProvider);

void sign(PrivateKey key, string algorithm);

void sign(PrivateKey key, string algorithm, string provider);

string toString();

bool isRevoked(Certificate cert);

int getVersion();

Principal getIssuerDN();

X500Principal getIssuerX500Principal();

Date getThisUpdate();

Date getNextUpdate();

X509CRLEntry getRevokedCertificate(BigInteger serialNumber);

X509CRLEntry getRevokedCertificate(X509Certificate cert);

Set!X509CRLEntry getRevokedCertificates();

byte[] getTBSCertList();

byte[] getSignature();

string getSigAlgName();

string getSigAlgOID();

byte[] getSigAlgParams();

AlgorithmId getSigAlgId();

KeyIdentifier getAuthKeyId();

bool hasUnsupportedCriticalExtension();

Set!string getCriticalExtensionOIDs();

Set!string getNonCriticalExtensionOIDs();

byte[] getExtensionValue(string oid);

Object getExtension(ObjectIdentifier oid);

static X500Principal getIssuerX500Principal(X509CRL crl);

static byte[] getEncodedInternal(X509CRL crl);

static X509CRLImpl toImpl(X509CRL crl);

void derEncode(OutputStream ot);

}

Constructors

this this(byte[] crlData): Unmarshals an X.509 CRL from its encoded form, parsing the encoded bytes. This form of constructor is used by agents which need to examine and use CRL contents. Note that the buffer must include only one CRL, and no "garbage" may be left at the end.
this this(DerValue val): Unmarshals an X.509 CRL from an DER value.
this this(InputStream inStrm): Unmarshals an X.509 CRL from an input stream. Only one CRL is expected at the end of the input stream.
this this(X500Name issuer, Date thisDate, Date nextDate): Initial CRL constructor, no revoked certs, and no extensions.
this this(X500Name issuer, Date thisDate, Date nextDate, X509CRLEntry[] badCerts): CRL constructor, revoked certs, no extensions.
this this(X500Name issuer, Date thisDate, Date nextDate, X509CRLEntry[] badCerts, CRLExtensions crlExts): CRL constructor, revoked certs and extensions.

Members

Functions

derEncode void derEncode(OutputStream ot): Undocumented in source. Be warned that the author may not have intended to support it.
encodeInfo void encodeInfo(OutputStream outputStream): Encodes the "to-be-signed" CRL to the OutputStream.
getAuthKeyId KeyIdentifier getAuthKeyId(): return the AuthorityKeyIdentifier, if any.
getCriticalExtensionOIDs Set!string getCriticalExtensionOIDs(): Gets a Set of the extension(s) marked CRITICAL in the CRL. In the returned set, each extension is represented by its OID string.
getEncoded byte[] getEncoded(): Returns the ASN.1 DER encoded form of this CRL.
getEncodedInternal byte[] getEncodedInternal(): Returned the encoding as an uncloned byte array. Callers must guarantee that they neither modify it nor expose it to untrusted code.
getExtension Object getExtension(ObjectIdentifier oid): get an extension
getExtensionValue byte[] getExtensionValue(string oid): Gets the DER encoded OCTET string for the extension value (<code>extnValue</code>) identified by the passed in oid string. The <code>oid</code> string is represented by a set of positive whole number separated by ".", that means,<br> <positive whole number>.<positive whole number>.<...>
getIssuerDN Principal getIssuerDN(): Gets the issuer distinguished name from this CRL. The issuer name identifies the entity who has signed (and issued the CRL). The issuer name field contains an X.500 distinguished name (DN). The ASN.1 definition for this is: <pre> issuer Name
getIssuerX500Principal X500Principal getIssuerX500Principal(): Return the issuer as X500Principal. Overrides method in X509CRL to provide a slightly more efficient version.
getNextUpdate Date getNextUpdate(): Gets the nextUpdate date from the CRL.
getNonCriticalExtensionOIDs Set!string getNonCriticalExtensionOIDs(): Gets a Set of the extension(s) marked NON-CRITICAL in the CRL. In the returned set, each extension is represented by its OID string.
getRevokedCertificate X509CRLEntry getRevokedCertificate(BigInteger serialNumber): Gets the CRL entry with the given serial number from this CRL.
getRevokedCertificate X509CRLEntry getRevokedCertificate(X509Certificate cert): Gets the CRL entry for the given certificate.
getRevokedCertificates Set!X509CRLEntry getRevokedCertificates(): Gets all the revoked certificates from the CRL. A Set of X509CRLEntry.
getSigAlgId AlgorithmId getSigAlgId(): Gets the signature AlgorithmId from the CRL.
getSigAlgName string getSigAlgName(): Gets the signature algorithm name for the CRL signature algorithm. For example, the string "SHA1withDSA". The ASN.1 definition for this is: <pre> AlgorithmIdentifier ::= SEQUENCE { algorithm OBJECT IDENTIFIER, parameters ANY DEFINED BY algorithm OPTIONAL } -- contains a value of the type -- registered for use with the -- algorithm object identifier value </pre>
getSigAlgOID string getSigAlgOID(): Gets the signature algorithm OID string from the CRL. An OID is represented by a set of positive whole number separated by ".", that means,<br> <positive whole number>.<positive whole number>.<...> For example, the string "1.2.840.10040.4.3" identifies the SHA-1 with DSA signature algorithm defined in <a href="http://www.ietf.org/rfc/rfc3279.txt">RFC 3279: Algorithms and Identifiers for the Internet X.509 Public Key Infrastructure Certificate and CRL Profile</a>.
getSigAlgParams byte[] getSigAlgParams(): Gets the DER encoded signature algorithm parameters from this CRL's signature algorithm. In most cases, the signature algorithm parameters are null, the parameters are usually supplied with the Public Key.
getSignature byte[] getSignature(): Gets the raw Signature bits from the CRL.
getTBSCertList byte[] getTBSCertList(): Gets the DER encoded CRL information, the <code>tbsCertList</code> from this CRL. This can be used to verify the signature independently.
getThisUpdate Date getThisUpdate(): Gets the thisUpdate date from the CRL. The ASN.1 definition for this is:
getVersion int getVersion(): Gets the version number from this CRL. The ASN.1 definition for this is: <pre> Version ::= INTEGER { v1(0), v2(1), v3(2) } -- v3 does not apply to CRLs but appears for consistency -- with definition of Version for certs </pre> @return the version number, i.e. 1 or 2.
hasUnsupportedCriticalExtension bool hasUnsupportedCriticalExtension(): Return true if a critical extension is found that is not supported, otherwise return false.
isRevoked bool isRevoked(Certificate cert): Checks whether the given certificate is on this CRL.
opEquals bool opEquals(Object other): Compares this CRL for equality with the given object. If the {@code other} object is an {@code instanceof} {@code X509CRL}, then its encoded form is retrieved and compared with the encoded form of this CRL.
sign void sign(PrivateKey key, string algorithm): Encodes an X.509 CRL, and signs it using the given key.
sign void sign(PrivateKey key, string algorithm, string provider): Encodes an X.509 CRL, and signs it using the given key.
toHash size_t toHash(): Returns a hashcode value for this CRL from its encoded form.
toString string toString(): Returns a printable string of this CRL.
verify void verify(PublicKey key): Verifies that this CRL was signed using the private key that corresponds to the given key.
verify void verify(PublicKey key, string sigProvider): Verifies that this CRL was signed using the private key that corresponds to the given key, and that the signature verification was computed by the given provider.
verify void verify(PublicKey key, Provider sigProvider): Verifies that this CRL was signed using the private key that corresponds to the given key, and that the signature verification was computed by the given provider. Note that the specified Provider object does not have to be registered in the provider list.

Static functions

getEncodedInternal byte[] getEncodedInternal(X509CRL crl): Returned the encoding of the given certificate for internal use. Callers must guarantee that they neither modify it nor expose it to untrusted code. Uses getEncodedInternal() if the certificate is instance of X509CertImpl, getEncoded() otherwise.
getIssuerX500Principal X500Principal getIssuerX500Principal(X509CRL crl): Extract the issuer X500Principal from an X509CRL. Parses the encoded form of the CRL to preserve the principal's ASN.1 encoding.
toImpl X509CRLImpl toImpl(X509CRL crl): Utility method to convert an arbitrary instance of X509CRL to a X509CRLImpl. Does a cast if possible, otherwise reparses the encoding.
verify void verify(X509CRL crl, PublicKey key, Provider sigProvider): This static method is the default implementation of the verify(PublicKey key, Provider sigProvider) method in X509CRL. Called from java.security.cert.X509CRL.verify(PublicKey key, Provider sigProvider)

Inherited Members

From X509CRL

getEncoded byte[] getEncoded(): Returns the ASN.1 DER-encoded form of this CRL.
verify void verify(PublicKey key): Verifies that this CRL was signed using the private key that corresponds to the given public key.
verify void verify(PublicKey key, string sigProvider): Verifies that this CRL was signed using the private key that corresponds to the given public key. This method uses the signature verification engine supplied by the given provider.
verify void verify(PublicKey key, Provider sigProvider): Verifies that this CRL was signed using the private key that corresponds to the given public key. This method uses the signature verification engine supplied by the given provider. Note that the specified Provider object does not have to be registered in the provider list.
getVersion int getVersion(): Gets the {@code version} (version number) value from the CRL. The ASN.1 definition for this is: <pre> version Version OPTIONAL, -- if present, must be v2
getIssuerDN Principal getIssuerDN(): <strong>Denigrated</strong>, replaced by {@linkplain #getIssuerX500Principal()}. This method returns the {@code issuer} as an implementation specific Principal object, which should not be relied upon by portable code.
getIssuerX500Principal X500Principal getIssuerX500Principal(): Returns the issuer (issuer distinguished name) value from the CRL as an {@code X500Principal}. <p> It is recommended that subclasses override this method.
getThisUpdate Date getThisUpdate(): Gets the {@code thisUpdate} date from the CRL. The ASN.1 definition for this is: <pre> thisUpdate ChoiceOfTime ChoiceOfTime ::= CHOICE { utcTime UTCTime, generalTime GeneralizedTime } </pre>
getNextUpdate Date getNextUpdate(): Gets the {@code nextUpdate} date from the CRL.
getRevokedCertificate X509CRLEntry getRevokedCertificate(BigInteger serialNumber): Gets the CRL entry, if any, with the given certificate serialNumber.
getRevokedCertificate X509CRLEntry getRevokedCertificate(X509Certificate certificate): Get the CRL entry, if any, for the given certificate.
getRevokedCertificates Set!X509CRLEntry getRevokedCertificates(): Gets all the entries from this CRL. This returns a Set of X509CRLEntry objects.
getTBSCertList byte[] getTBSCertList(): Gets the DER-encoded CRL information, the {@code tbsCertList} from this CRL. This can be used to verify the signature independently.
getSignature byte[] getSignature(): Gets the {@code signature} value (the raw signature bits) from the CRL. The ASN.1 definition for this is: <pre> signature BIT STRING </pre>
getSigAlgName string getSigAlgName(): Gets the signature algorithm name for the CRL signature algorithm. An example is the string "SHA256withRSA". The ASN.1 definition for this is: <pre> signatureAlgorithm AlgorithmIdentifier
getSigAlgOID string getSigAlgOID(): Gets the signature algorithm OID string from the CRL. An OID is represented by a set of nonnegative whole numbers separated by periods. For example, the string "1.2.840.10040.4.3" identifies the SHA-1 with DSA signature algorithm defined in <a href="http://www.ietf.org/rfc/rfc3279.txt">RFC 3279: Algorithms and Identifiers for the Internet X.509 Public Key Infrastructure Certificate and CRL Profile</a>.
getSigAlgParams byte[] getSigAlgParams(): Gets the DER-encoded signature algorithm parameters from this CRL's signature algorithm. In most cases, the signature algorithm parameters are null; the parameters are usually supplied with the public key. If access to individual parameter values is needed then use {@link java.security.AlgorithmParameters AlgorithmParameters} and instantiate with the name returned by {@link #getSigAlgName() getSigAlgName}.

From DerEncoder

derEncode void derEncode(OutputStream ot): DER encode this object and write the results to a stream.

Meta

Source

See Implementation

hunt security x509 X509CRLImpl aliases

BigInteger

classes

X509CRLImpl