X509CertImpl

The X509CertImpl class represents an X.509 certificate. These certificates are widely used to support authentication and other functionality in Internet security systems. Common applications include Privacy Enhanced Mail (PEM), Transport Layer Security (SSL), code signing for trusted software distribution, and Secure Electronic Transactions (SET). There is a commercial infrastructure ready to manage large scale deployments of X.509 identity certificates.

<P>These certificates are managed and vouched for by <em>Certificate Authorities</em> (CAs). CAs are services which create certificates by placing data in the X.509 standard format and then digitally signing that data. Such signatures are quite difficult to forge. CAs act as trusted third parties, making introductions between agents who have no direct knowledge of each other. CA certificates are either signed by themselves, or by some other CA such as a "root" CA.

<P>RFC 1422 is very informative, though it does not describe much of the recent work being done with X.509 certificates. That includes a 1996 version (X.509v3) and a variety of enhancements being made to facilitate an explosion of personal certificates used as "Internet Drivers' Licences", or with SET for credit card transactions.

<P>More recent work includes the IETF PKIX Working Group efforts, especially RFC2459.

@author Dave Brownell @author Amit Kapoor @author Hemma Prafullchandra @see X509CertInfo

class X509CertImpl : X509Certificate , DerEncoder {

enum string NAME;

enum string INFO;

enum string ALG_ID;

enum string SIGNATURE;

enum string SIGNED_CERT;

enum string SUBJECT_DN;

enum string ISSUER_DN;

enum string SERIAL_ID;

enum string PUBLIC_KEY;

enum string VERSION;

enum string SIG_ALG;

enum string SIG;

X509CertInfo info;

AlgorithmId algId;

byte[] signature;

this(byte[] certData);

this(InputStream stream);

this(X509CertInfo certInfo);

this(DerValue derVal);

void encode(OutputStream outputStream);

void derEncode(OutputStream outputStream);

byte[] getEncoded();

byte[] getEncodedInternal();

void verify(PublicKey key);

void verify(PublicKey key, string sigProvider);

void verify(PublicKey key, Provider sigProvider);

static void verify(X509Certificate cert, PublicKey key, Provider sigProvider);

void sign(PrivateKey key, string algorithm);

void sign(PrivateKey key, string algorithm, string provider);

void checkValidity();

void checkValidity(Date date);

Object get(string name);

void set(string name, Object obj);

void remove(string name);

Enumeration!string getElements();

string getName();

string toString();

PublicKey getPublicKey();

int getVersion();

BigInteger getSerialNumber();

SerialNumber getSerialNumberObject();

Principal getSubjectDN();

X500Principal getSubjectX500Principal();

Principal getIssuerDN();

X500Principal getIssuerX500Principal();

Date getNotBefore();

Date getNotAfter();

byte[] getTBSCertificate();

byte[] getSignature();

string getSigAlgName();

string getSigAlgOID();

byte[] getSigAlgParams();

bool[] getIssuerUniqueID();

bool[] getSubjectUniqueID();

KeyIdentifier getAuthKeyId();

KeyIdentifier getSubjectKeyId();

bool hasUnsupportedCriticalExtension();

Set!string getCriticalExtensionOIDs();

Set!string getNonCriticalExtensionOIDs();

Extension getExtension(ObjectIdentifier oid);

Extension getUnparseableExtension(ObjectIdentifier oid);

byte[] getExtensionValue(string oid);

bool[] getKeyUsage();

List!string getExtendedKeyUsage();

static List!string getExtendedKeyUsage(X509Certificate cert);

int getBasicConstraints();

static X500Principal getSubjectX500Principal(X509Certificate cert);

static X500Principal getIssuerX500Principal(X509Certificate cert);

static byte[] getEncodedInternal(Certificate cert);

static X509CertImpl toImpl(X509Certificate cert);

static bool isSelfIssued(X509Certificate cert);

static bool isSelfSigned(X509Certificate cert, string sigProvider);

string getFingerprint(string algorithm);

static string getFingerprint(string algorithm, X509Certificate cert);

}

Constructors

this this(): Default constructor.
this this(byte[] certData): Unmarshals a certificate from its encoded form, parsing the encoded bytes. This form of constructor is used by agents which need to examine and use certificate contents. That is, this is one of the more commonly used constructors. Note that the buffer must include only a certificate, and no "garbage" may be left at the end. If you need to ignore data at the end of a certificate, use another constructor.
this this(InputStream stream): unmarshals an X.509 certificate from an input stream. If the certificate is RFC1421 hex-encoded, then it must begin with the line X509Factory.BEGIN_CERT and end with the line X509Factory.END_CERT.
this this(X509CertInfo certInfo): Construct an initialized X509 Certificate. The certificate is stored in raw form and has to be signed to be useful.
this this(DerValue derVal): Unmarshal a certificate from its encoded form, parsing a DER value. This form of constructor is used by agents which need to examine and use certificate contents.

Members

Functions

checkValidity void checkValidity(): Checks that the certificate is currently valid, i.e. the current time is within the specified validity period.
checkValidity void checkValidity(Date date): Checks that the specified date is within the certificate's validity period, or basically if the certificate would be valid at the specified date/time.
derEncode void derEncode(OutputStream outputStream): DER encode this object onto an output stream. Implements the <code>DerEncoder</code> interface.
encode void encode(OutputStream outputStream): Appends the certificate to an output stream.
get Object get(string name): Return the requested attribute from the certificate.
getAuthKeyId KeyIdentifier getAuthKeyId(): Undocumented in source. Be warned that the author may not have intended to support it.
getBasicConstraints int getBasicConstraints(): Get the certificate constraints path length from the the critical BasicConstraints extension, (oid = 2.5.29.19). @return the length of the constraint.
getCriticalExtensionOIDs Set!string getCriticalExtensionOIDs(): Gets a Set of the extension(s) marked CRITICAL in the certificate. In the returned set, each extension is represented by its OID string.
getElements Enumeration!string getElements(): Return an enumeration of names of attributes existing within this attribute.
getEncoded byte[] getEncoded(): Returns the encoded form of this certificate. It is assumed that each certificate type would have only a single form of encoding; for example, X.509 certificates would be encoded as ASN.1 DER.
getEncodedInternal byte[] getEncodedInternal(): Returned the encoding as an uncloned byte array. Callers must guarantee that they neither modify it nor expose it to untrusted code.
getExtendedKeyUsage List!string getExtendedKeyUsage(): This method are the overridden implementation of getExtendedKeyUsage method in X509Certificate in the Sun provider. It is better performance-wise since it returns cached values.
getExtension Extension getExtension(ObjectIdentifier oid): Gets the extension identified by the given ObjectIdentifier
getExtensionValue byte[] getExtensionValue(string oid): Gets the DER encoded extension identified by the given oid string.
getFingerprint string getFingerprint(string algorithm): Undocumented in source. Be warned that the author may not have intended to support it.
getIssuerDN Principal getIssuerDN(): Gets the issuer distinguished name from the certificate.
getIssuerUniqueID bool[] getIssuerUniqueID(): Gets the Issuer Unique Identity from the certificate.
getIssuerX500Principal X500Principal getIssuerX500Principal(): Get issuer name as X500Principal. Overrides implementation in X509Certificate with a slightly more efficient version that is also aware of X509CertImpl mutability.
getKeyUsage bool[] getKeyUsage(): Get a bool array representing the bits of the KeyUsage extension, (oid = 2.5.29.15). @return the bit values of this extension as an array of booleans.
getName string getName(): Return the name of this attribute.
getNonCriticalExtensionOIDs Set!string getNonCriticalExtensionOIDs(): Gets a Set of the extension(s) marked NON-CRITICAL in the certificate. In the returned set, each extension is represented by its OID string.
getNotAfter Date getNotAfter(): Gets the notAfter date from the validity period of the certificate.
getNotBefore Date getNotBefore(): Gets the notBefore date from the validity period of the certificate.
getPublicKey PublicKey getPublicKey(): Gets the publickey from this certificate.
getSerialNumber BigInteger getSerialNumber(): Gets the serial number from the certificate.
getSerialNumberObject SerialNumber getSerialNumberObject(): Gets the serial number from the certificate as a SerialNumber object.
getSigAlgName string getSigAlgName(): Gets the signature algorithm name for the certificate signature algorithm. For example, the string "SHA-1/DSA" or "DSS".
getSigAlgOID string getSigAlgOID(): Gets the signature algorithm OID string from the certificate. For example, the string "1.2.840.10040.4.3"
getSigAlgParams byte[] getSigAlgParams(): Gets the DER encoded signature algorithm parameters from this certificate's signature algorithm.
getSignature byte[] getSignature(): Gets the raw Signature bits from the certificate.
getSubjectDN Principal getSubjectDN(): Gets the subject distinguished name from the certificate.
getSubjectKeyId KeyIdentifier getSubjectKeyId(): Returns the subject's key identifier, or null
getSubjectUniqueID bool[] getSubjectUniqueID(): Gets the Subject Unique Identity from the certificate.
getSubjectX500Principal X500Principal getSubjectX500Principal(): Get subject name as X500Principal. Overrides implementation in X509Certificate with a slightly more efficient version that is also aware of X509CertImpl mutability.
getTBSCertificate byte[] getTBSCertificate(): Gets the DER encoded certificate informations, the <code>tbsCertificate</code> from this certificate. This can be used to verify the signature independently.
getUnparseableExtension Extension getUnparseableExtension(ObjectIdentifier oid): Undocumented in source. Be warned that the author may not have intended to support it.
getVersion int getVersion(): Gets the version number from the certificate.
hasUnsupportedCriticalExtension bool hasUnsupportedCriticalExtension(): Return true if a critical extension is found that is not supported, otherwise return false.
remove void remove(string name): Delete the requested attribute from the certificate.
set void set(string name, Object obj): Set the requested attribute in the certificate.
sign void sign(PrivateKey key, string algorithm): Creates an X.509 certificate, and signs it using the given key (associating a signature algorithm and an X.500 name). This operation is used to implement the certificate generation functionality of a certificate authority.
sign void sign(PrivateKey key, string algorithm, string provider): Creates an X.509 certificate, and signs it using the given key (associating a signature algorithm and an X.500 name). This operation is used to implement the certificate generation functionality of a certificate authority.
toString string toString(): Returns a printable representation of the certificate. This does not contain all the information available to distinguish this from any other certificate. The certificate must be fully constructed before this function may be called.
verify void verify(PublicKey key): Throws an exception if the certificate was not signed using the verification key provided. Successfully verifying a certificate does <em>not</em> indicate that one should trust the entity which it represents.
verify void verify(PublicKey key, string sigProvider): Throws an exception if the certificate was not signed using the verification key provided. Successfully verifying a certificate does <em>not</em> indicate that one should trust the entity which it represents.
verify void verify(PublicKey key, Provider sigProvider): Throws an exception if the certificate was not signed using the verification key provided. This method uses the signature verification engine supplied by the specified provider. Note that the specified Provider object does not have to be registered in the provider list. Successfully verifying a certificate does <em>not</em> indicate that one should trust the entity which it represents.

Static functions

getEncodedInternal byte[] getEncodedInternal(Certificate cert): Returned the encoding of the given certificate for internal use. Callers must guarantee that they neither modify it nor expose it to untrusted code. Uses getEncodedInternal() if the certificate is instance of X509CertImpl, getEncoded() otherwise.
getExtendedKeyUsage List!string getExtendedKeyUsage(X509Certificate cert): This static method is the default implementation of the getExtendedKeyUsage method in X509Certificate. A X509Certificate provider generally should overwrite this to provide among other things caching for better performance.
getFingerprint string getFingerprint(string algorithm, X509Certificate cert): Gets the requested finger print of the certificate. The result only contains 0-9 and A-F. No small case, no colon.
getIssuerX500Principal X500Principal getIssuerX500Principal(X509Certificate cert): Extract the issuer X500Principal from an X509Certificate. Called from java.security.cert.X509Certificate.getIssuerX500Principal().
getSubjectX500Principal X500Principal getSubjectX500Principal(X509Certificate cert): Extract the subject X500Principal from an X509Certificate. Called from java.security.cert.X509Certificate.getSubjectX500Principal().
isSelfIssued bool isSelfIssued(X509Certificate cert): Utility method to test if a certificate is self-issued. This is the case iff the subject and issuer X500Principals are equal.
isSelfSigned bool isSelfSigned(X509Certificate cert, string sigProvider): Utility method to test if a certificate is self-signed. This is the case iff the subject and issuer X500Principals are equal AND the certificate's subject key can be used to verify the certificate. In case of exception, returns false.
toImpl X509CertImpl toImpl(X509Certificate cert): Utility method to convert an arbitrary instance of X509Certificate to a X509CertImpl. Does a cast if possible, otherwise reparses the encoding.
verify void verify(X509Certificate cert, PublicKey key, Provider sigProvider): This static method is the default implementation of the verify(PublicKey key, Provider sigProvider) method in X509Certificate. Called from java.security.cert.X509Certificate.verify(PublicKey key, Provider sigProvider)

Variables

ALG_ID enum string ALG_ID;: Undocumented in source.
INFO enum string INFO;: Undocumented in source.
ISSUER_DN enum string ISSUER_DN;: Undocumented in source.
NAME enum string NAME;: Public attribute names.
PUBLIC_KEY enum string PUBLIC_KEY;: Undocumented in source.
SERIAL_ID enum string SERIAL_ID;: Undocumented in source.
SIG enum string SIG;: Undocumented in source.
SIGNATURE enum string SIGNATURE;: Undocumented in source.
SIGNED_CERT enum string SIGNED_CERT;: Undocumented in source.
SIG_ALG enum string SIG_ALG;: Undocumented in source.
SUBJECT_DN enum string SUBJECT_DN;: The following are defined for ease-of-use. These are the most frequently retrieved attributes.
VERSION enum string VERSION;: Undocumented in source.
algId AlgorithmId algId;: Undocumented in source.
info X509CertInfo info;: Undocumented in source.
signature byte[] signature;: Undocumented in source.

Inherited Members

From X509Certificate

checkValidity void checkValidity(): Checks that the certificate is currently valid. It is if the current date and time are within the validity period given in the certificate. <p> The validity period consists of two date/time values: the first and last dates (and times) on which the certificate is valid. It is defined in ASN.1 as: <pre> validity Validity
checkValidity void checkValidity(Date date): Checks that the given date is within the certificate's validity period. In other words, this determines whether the certificate would be valid at the given date/time.
getVersion int getVersion(): Gets the {@code version} (version number) value from the certificate. The ASN.1 definition for this is: <pre> version [0] EXPLICIT Version DEFAULT v1
getSerialNumber BigInt getSerialNumber(): Gets the {@code serialNumber} value from the certificate. The serial number is an integer assigned by the certification authority to each certificate. It must be unique for each certificate issued by a given CA (i.e., the issuer name and serial number identify a unique certificate). The ASN.1 definition for this is: <pre> serialNumber CertificateSerialNumber
getIssuerDN Principal getIssuerDN(): <strong>Denigrated</strong>, replaced by {@linkplain #getIssuerX500Principal()}. This method returns the {@code issuer} as an implementation specific Principal object, which should not be relied upon by portable code.
getIssuerX500Principal X500Principal getIssuerX500Principal(): Returns the issuer (issuer distinguished name) value from the certificate as an {@code X500Principal}. <p> It is recommended that subclasses override this method.
getSubjectDN Principal getSubjectDN(): <strong>Denigrated</strong>, replaced by {@linkplain #getSubjectX500Principal()}. This method returns the {@code subject} as an implementation specific Principal object, which should not be relied upon by portable code.
getSubjectX500Principal X500Principal getSubjectX500Principal(): Returns the subject (subject distinguished name) value from the certificate as an {@code X500Principal}. If the subject value is empty, then the {@code getName()} method of the returned {@code X500Principal} object returns an empty string (""). <p> It is recommended that subclasses override this method.
getNotBefore Date getNotBefore(): Gets the {@code notBefore} date from the validity period of the certificate. The relevant ASN.1 definitions are: <pre> validity Validity
getNotAfter Date getNotAfter(): Gets the {@code notAfter} date from the validity period of the certificate. See {@link #getNotBefore() getNotBefore} for relevant ASN.1 definitions.
getTBSCertificate byte[] getTBSCertificate(): Gets the DER-encoded certificate information, the {@code tbsCertificate} from this certificate. This can be used to verify the signature independently.
getSignature byte[] getSignature(): Gets the {@code signature} value (the raw signature bits) from the certificate. The ASN.1 definition for this is: <pre> signature BIT STRING </pre>
getSigAlgName string getSigAlgName(): Gets the signature algorithm name for the certificate signature algorithm. An example is the string "SHA256withRSA". The ASN.1 definition for this is: <pre> signatureAlgorithm AlgorithmIdentifier
getSigAlgOID string getSigAlgOID(): Gets the signature algorithm OID string from the certificate. An OID is represented by a set of nonnegative whole numbers separated by periods. For example, the string "1.2.840.10040.4.3" identifies the SHA-1 with DSA signature algorithm defined in <a href="http://www.ietf.org/rfc/rfc3279.txt">RFC 3279: Algorithms and Identifiers for the Internet X.509 Public Key Infrastructure Certificate and CRL Profile</a>.
getSigAlgParams byte[] getSigAlgParams(): Gets the DER-encoded signature algorithm parameters from this certificate's signature algorithm. In most cases, the signature algorithm parameters are null; the parameters are usually supplied with the certificate's key. If access to individual parameter values is needed then use {@link java.security.AlgorithmParameters AlgorithmParameters} and instantiate with the name returned by {@link #getSigAlgName() getSigAlgName}.
getIssuerUniqueID bool[] getIssuerUniqueID(): Gets the {@code issuerUniqueID} value from the certificate. The issuer unique identifier is present in the certificate to handle the possibility of reuse of issuer names over time. RFC 3280 recommends that names not be reused and that conforming certificates not make use of unique identifiers. Applications conforming to that profile should be capable of parsing unique identifiers and making comparisons.
getSubjectUniqueID bool[] getSubjectUniqueID(): Gets the {@code subjectUniqueID} value from the certificate.
getKeyUsage bool[] getKeyUsage(): Gets a bool array representing bits of the {@code KeyUsage} extension, (OID = 2.5.29.15). The key usage extension defines the purpose (e.g., encipherment, signature, certificate signing) of the key contained in the certificate. The ASN.1 definition for this is: <pre> KeyUsage ::= BIT STRING { digitalSignature (0), nonRepudiation (1), keyEncipherment (2), dataEncipherment (3), keyAgreement (4), keyCertSign (5), cRLSign (6), encipherOnly (7), decipherOnly (8) } </pre> RFC 3280 recommends that when used, this be marked as a critical extension.
getBasicConstraints int getBasicConstraints(): Gets the certificate constraints path length from the critical {@code BasicConstraints} extension, (OID = 2.5.29.19). <p> The basic constraints extension identifies whether the subject of the certificate is a Certificate Authority (CA) and how deep a certification path may exist through that CA. The {@code pathLenConstraint} field (see below) is meaningful only if {@code cA} is set to TRUE. In this case, it gives the maximum number of CA certificates that may follow this certificate in a certification path. A value of zero indicates that only an end-entity certificate may follow in the path. <p> The ASN.1 definition for this is: <pre> BasicConstraints ::= SEQUENCE { cA BOOLEAN DEFAULT FALSE, pathLenConstraint INTEGER (0..MAX) OPTIONAL } </pre>
verify void verify(PublicKey key, Provider sigProvider): Verifies that this certificate was signed using the private key that corresponds to the specified key. This method uses the signature verification engine supplied by the specified provider. Note that the specified Provider object does not have to be registered in the provider list.

From DerEncoder

derEncode void derEncode(OutputStream ot): DER encode this object and write the results to a stream.

Meta

Source

See Implementation

hunt security x509 X509CertImpl aliases

BigInteger

classes

X509CertImpl