|
|||||||||
| Home >> All >> java >> security >> [ cert overview ] | PREV CLASS NEXT CLASS | ||||||||
SUMMARY:  JAVADOC |  SOURCE |  DOWNLOAD | NESTED | FIELD | CONSTR | METHOD |
DETAIL: FIELD | CONSTR | METHOD | ||||||||
java.security.cert
Class X509Certificate
java.lang.Objectjava.security.cert.Certificate
- All Implemented Interfaces:
- java.io.Serializable, X509Extension
- public abstract class X509Certificate
- extends Certificate
- implements X509Extension
- extends Certificate
X509Certificate is the abstract class for X.509 certificates. This provides a stanard class interface for accessing all the attributes of X.509 certificates.
In June 1996, the basic X.509 v3 format was finished by ISO/IEC and ANSI X.9. The ASN.1 DER format is below:
Certificate ::= SEQUENCE {
tbsCertificate TBSCertificate,
signatureAlgorithm AlgorithmIdentifier,
signatureValue BIT STRING }
These certificates are widely used in various Internet protocols to support authentication. It is used in Privacy Enhanced Mail (PEM), Transport Layer Security (TLS), Secure Sockets Layer (SSL), code signing for trusted software distribution, and Secure Electronic Transactions (SET).
The certificates are managed and vouched for by Certificate Authorities (CAs). CAs are companies or groups that create certificates by placing the data in the X.509 certificate format and signing it with their private key. CAs serve as trusted third parties by certifying that the person or group specified in the certificate is who they say they are.
The ASN.1 defintion for tbsCertificate is
TBSCertificate ::= SEQUENCE {
version [0] EXPLICIT Version DEFAULT v1,
serialNumber CertificateSerialNumber,
signature AlgorithmIdentifier,
issuer Name,
validity Validity,
subject Name,
subjectPublicKeyInfo SubjectPublicKeyInfo,
issuerUniqueID [1] IMPLICIT UniqueIdentifier OPTIONAL,
-- If present, version shall be v2 or v3
subjectUniqueID [2] IMPLICIT UniqueIdentifier OPTIONAL,
-- If present, version shall be v2 or v3
extensions [3] EXPLICIT Extensions OPTIONAL
-- If present, version shall be v3
}
Version ::= INTEGER { v1(0), v2(1), v3(2) }
CertificateSerialNumber ::= INTEGER
Validity ::= SEQUENCE {
notBefore Time,
notAfter Time }
Time ::= CHOICE {
utcTime UTCTime,
generalTime GeneralizedTime }
UniqueIdentifier ::= BIT STRING
SubjectPublicKeyInfo ::= SEQUENCE {
algorithm AlgorithmIdentifier,
subjectPublicKey BIT STRING }
Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension
Extension ::= SEQUENCE {
extnID OBJECT IDENTIFIER,
critical BOOLEAN DEFAULT FALSE,
extnValue OCTET STRING }
References:
- Olivier Dubuisson, Philippe Fouquart (Translator) ASN.1 - Communication between heterogeneous systems, (C) September 2000, Morgan Kaufmann Publishers, ISBN 0-12-6333361-0. Available on-line at http://www.oss.com/asn1/dubuisson.html
- R. Housley et al, RFC 3280: Internet X.509 Public Key Infrastructure Certificate and CRL Profile.
- Since:
- JDK 1.2
| Nested Class Summary |
| Nested classes inherited from class java.security.cert.Certificate |
Certificate.CertificateRep |
| Field Summary | |
private static long |
serialVersionUID
|
| Fields inherited from class java.security.cert.Certificate |
|
| Constructor Summary | |
protected |
X509Certificate()
Constructs a new certificate of the specified type. |
| Method Summary | |
abstract void |
checkValidity()
Checks the validity of the X.509 certificate. |
abstract void |
checkValidity(java.util.Date date)
Checks the validity of the X.509 certificate for the specified time and date. |
abstract int |
getBasicConstraints()
Returns the certificate constraints path length from the critical BasicConstraints extension, (OID = 2.5.29.19). |
java.util.List |
getExtendedKeyUsage()
Returns the ExtendedKeyUsage extension of this
certificate, or null if there is no extension present. |
java.util.Collection |
getIssuerAlternativeNames()
Returns the alternative names for this certificate's issuer, or null if there are none. |
abstract java.security.Principal |
getIssuerDN()
Returns the issuer (issuer distinguished name) of the Certificate. |
abstract boolean[] |
getIssuerUniqueID()
Returns the issuer unique ID for this certificate. |
javax.security.auth.x500.X500Principal |
getIssuerX500Principal()
Returns the X.500 distinguished name of this certificate's issuer. |
abstract boolean[] |
getKeyUsage()
Returns a boolean array representing the KeyUsage extension for the certificate. |
abstract java.util.Date |
getNotAfter()
Returns the date that this certificate is not to be used after, notAfter. |
abstract java.util.Date |
getNotBefore()
Returns the date that this certificate is not to be used before, notBefore. |
abstract java.math.BigInteger |
getSerialNumber()
Gets the serial number for serial Number in this Certifcate. |
abstract java.lang.String |
getSigAlgName()
Returns the signature algorithm used to sign the CRL. |
abstract java.lang.String |
getSigAlgOID()
Returns the OID for the signature algorithm used. |
abstract byte[] |
getSigAlgParams()
Returns the AlgorithmParameters in the encoded form for the signature algorithm used. |
abstract byte[] |
getSignature()
Returns the signature in its raw DER encoded format. |
java.util.Collection |
getSubjectAlternativeNames()
Returns the alternative names for this certificate's subject (the owner), or null if there are none. |
abstract java.security.Principal |
getSubjectDN()
Returns the subject (subject distinguished name) of the Certificate. |
abstract boolean[] |
getSubjectUniqueID()
Returns the subject unique ID for this certificate. |
javax.security.auth.x500.X500Principal |
getSubjectX500Principal()
Returns the X.500 distinguished name of this certificate's subject. |
abstract byte[] |
getTBSCertificate()
Returns the tbsCertificate from the certificate. |
abstract int |
getVersion()
Returns the version of this certificate. |
| Methods inherited from class java.security.cert.Certificate |
equals, getEncoded, getPublicKey, getType, hashCode, toString, verify, verify, writeReplace |
| Methods inherited from class java.lang.Object |
clone, finalize, getClass, notify, notifyAll, wait, wait, wait |
| Methods inherited from interface java.security.cert.X509Extension |
getCriticalExtensionOIDs, getExtensionValue, getNonCriticalExtensionOIDs, hasUnsupportedCriticalExtension |
| Field Detail |
serialVersionUID
private static final long serialVersionUID
- See Also:
- Constant Field Values
| Constructor Detail |
X509Certificate
protected X509Certificate()
- Constructs a new certificate of the specified type.
| Method Detail |
checkValidity
public abstract void checkValidity()
throws CertificateExpiredException,
CertificateNotYetValidException
- Checks the validity of the X.509 certificate. It is valid
if the current date and time are within the period specified
by the certificate.
The ASN.1 DER encoding is:
validity Validity,
Validity ::= SEQUENCE {
notBefore Time,
notAfter Time }
Time ::= CHOICE {
utcTime UTCTime,
generalTime GeneralizedTime }
Consult rfc2459 for more information.
checkValidity
public abstract void checkValidity(java.util.Date date) throws CertificateExpiredException, CertificateNotYetValidException
- Checks the validity of the X.509 certificate for the
specified time and date. It is valid if the specified
date and time are within the period specified by
the certificate.
getVersion
public abstract int getVersion()
- Returns the version of this certificate.
The ASN.1 DER encoding is:
version [0] EXPLICIT Version DEFAULT v1,
Version ::= INTEGER { v1(0), v2(1), v3(2) }
Consult rfc2459 for more information.
getSerialNumber
public abstract java.math.BigInteger getSerialNumber()
- Gets the serial number for serial Number in
this Certifcate. It must be a unique number
unique other serial numbers from the granting CA.
The ASN.1 DER encoding is:
serialNumber CertificateSerialNumber,
CertificateSerialNumber ::= INTEGER
Consult rfc2459 for more information.
getIssuerDN
public abstract java.security.Principal getIssuerDN()
- Returns the issuer (issuer distinguished name) of the
Certificate. The issuer is the entity who signed
and issued the Certificate.
The ASN.1 DER encoding is:
issuer Name,
Name ::= CHOICE {
RDNSequence }
RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
RelativeDistinguishedName ::=
SET OF AttributeTypeAndValue
AttributeTypeAndValue ::= SEQUENCE {
type AttributeType,
value AttributeValue }
AttributeType ::= OBJECT IDENTIFIER
AttributeValue ::= ANY DEFINED BY AttributeType
DirectoryString ::= CHOICE {
teletexString TeletexString (SIZE (1..MAX)),
printableString PrintableString (SIZE (1..MAX)),
universalString UniversalString (SIZE (1..MAX)),
utf8String UTF8String (SIZE (1.. MAX)),
bmpString BMPString (SIZE (1..MAX)) }
Consult rfc2459 for more information.
getSubjectDN
public abstract java.security.Principal getSubjectDN()
- Returns the subject (subject distinguished name) of the
Certificate. The subject is the entity who the Certificate
identifies.
The ASN.1 DER encoding is:
subject Name,
Consult rfc2459 for more information.
getNotBefore
public abstract java.util.Date getNotBefore()
- Returns the date that this certificate is not to be used
before, notBefore.
The ASN.1 DER encoding is:
validity Validity,
Validity ::= SEQUENCE {
notBefore Time,
notAfter Time }
Time ::= CHOICE {
utcTime UTCTime,
generalTime GeneralizedTime }
Consult rfc2459 for more information.
getNotAfter
public abstract java.util.Date getNotAfter()
- Returns the date that this certificate is not to be used
after, notAfter.
getTBSCertificate
public abstract byte[] getTBSCertificate()
throws CertificateEncodingException
- Returns the tbsCertificate from the certificate.
getSignature
public abstract byte[] getSignature()
- Returns the signature in its raw DER encoded format.
The ASN.1 DER encoding is:
signatureValue BIT STRING
Consult rfc2459 for more information.
getSigAlgName
public abstract java.lang.String getSigAlgName()
- Returns the signature algorithm used to sign the CRL.
An examples is "SHA-1/DSA".
The ASN.1 DER encoding is:
signatureAlgorithm AlgorithmIdentifier,
AlgorithmIdentifier ::= SEQUENCE {
algorithm OBJECT IDENTIFIER,
parameters ANY DEFINED BY algorithm OPTIONAL }
Consult rfc2459 for more information.
The algorithm name is determined from the OID.
getSigAlgOID
public abstract java.lang.String getSigAlgOID()
- Returns the OID for the signature algorithm used.
Example "1.2.840.10040.4.3" is return for SHA-1 with DSA.\
The ASN.1 DER encoding for the example is:
id-dsa-with-sha1 ID ::= {
iso(1) member-body(2) us(840) x9-57 (10040)
x9cm(4) 3 }
Consult rfc2459 for more information.
getSigAlgParams
public abstract byte[] getSigAlgParams()
- Returns the AlgorithmParameters in the encoded form
for the signature algorithm used.
If access to the parameters is need, create an
instance of AlgorithmParameters.
getIssuerUniqueID
public abstract boolean[] getIssuerUniqueID()
- Returns the issuer unique ID for this certificate.
The ASN.1 DER encoding is:
issuerUniqueID [1] IMPLICIT UniqueIdentifier OPTIONAL,
-- If present, version shall be v2 or v3
UniqueIdentifier ::= BIT STRING
Consult rfc2459 for more information.
getSubjectUniqueID
public abstract boolean[] getSubjectUniqueID()
- Returns the subject unique ID for this certificate.
The ASN.1 DER encoding is:
subjectUniqueID [2] IMPLICIT UniqueIdentifier OPTIONAL,
-- If present, version shall be v2 or v3
UniqueIdentifier ::= BIT STRING
Consult rfc2459 for more information.
getKeyUsage
public abstract boolean[] getKeyUsage()
- Returns a boolean array representing the KeyUsage
extension for the certificate. The KeyUsage (OID = 2.5.29.15)
defines the purpose of the key in the certificate.
The ASN.1 DER encoding is:
id-ce-keyUsage OBJECT IDENTIFIER ::= { id-ce 15 }
KeyUsage ::= BIT STRING {
digitalSignature (0),
nonRepudiation (1),
keyEncipherment (2),
dataEncipherment (3),
keyAgreement (4),
keyCertSign (5),
cRLSign (6),
encipherOnly (7),
decipherOnly (8) }
Consult rfc2459 for more information.
getBasicConstraints
public abstract int getBasicConstraints()
- Returns the certificate constraints path length from the
critical BasicConstraints extension, (OID = 2.5.29.19).
The basic constraints extensions is used to determine if
the subject of the certificate is a Certificate Authority (CA)
and how deep the certification path may exist. The
pathLenConstraint only takes affect if cA
is set to true. "A value of zero indicates that only an
end-entity certificate may follow in the path." (rfc2459)
The ASN.1 DER encoding is:
id-ce-basicConstraints OBJECT IDENTIFIER ::= { id-ce 19 }
BasicConstraints ::= SEQUENCE {
cA BOOLEAN DEFAULT FALSE,
pathLenConstraint INTEGER (0..MAX) OPTIONAL }
Consult rfc2459 for more information.
getExtendedKeyUsage
public java.util.List getExtendedKeyUsage() throws CertificateParsingException
- Returns the
ExtendedKeyUsageextension of this certificate, or null if there is no extension present. The returned value is a java.util.List strings representing the object identifiers of the extended key usages. This extension has the OID 2.5.29.37.The ASN.1 definition for this extension is:
ExtendedKeyUsage ::= SEQUENCE SIZE (1..MAX) OF KeyPurposeId KeyPurposeId ::= OBJECT IDENTIFIER
getSubjectAlternativeNames
public java.util.Collection getSubjectAlternativeNames() throws CertificateParsingException
- Returns the alternative names for this certificate's subject (the
owner), or null if there are none.
This is an X.509 extension with OID 2.5.29.17 and is defined by the ASN.1 construction:
SubjectAltNames ::= GeneralNames GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName GeneralName ::= CHOICE { otherName [0] OtherName, rfc822Name [1] IA5String, dNSName [2] IA5String, x400Address [3] ORAddress, directoryName [4] Name, ediPartyName [5] EDIPartyName, uniformResourceIdentifier [6] IA5String, iPAddress [7] OCTET STRING, registeredID [8] OBJECT IDENTIFIER }The returned collection contains one or more two-element Lists, with the first object being an Integer representing the choice above (with value 0 through 8) and the second being an (a) String if the
GeneralNameis a rfc822Name, dNSName, uniformResourceIdentifier, iPAddress, or registeredID, or (b) a byte array of the DER encoded form for any others.- Since:
- JDK 1.4
getIssuerAlternativeNames
public java.util.Collection getIssuerAlternativeNames() throws CertificateParsingException
- Returns the alternative names for this certificate's issuer, or
null if there are none.
This is an X.509 extension with OID 2.5.29.18, and is defined by the ASN.1 construction:
IssuerAltNames ::= GeneralNames
The
GeneralNamesconstruct and the form of the returned collection are the same as withgetSubjectAlternativeNames()55 .- Since:
- JDK 1.4
getSubjectX500Principal
public javax.security.auth.x500.X500Principal getSubjectX500Principal()
- Returns the X.500 distinguished name of this certificate's subject.
- Since:
- JDK 1.4
getIssuerX500Principal
public javax.security.auth.x500.X500Principal getIssuerX500Principal()
- Returns the X.500 distinguished name of this certificate's issuer.
- Since:
- JDK 1.4
|
|||||||||
| Home >> All >> java >> security >> [ cert overview ] | PREV CLASS NEXT CLASS | ||||||||
|
SUMMARY: JAVADOC | SOURCE | DOWNLOAD | NESTED | FIELD | CONSTR | METHOD |
DETAIL: FIELD | CONSTR | METHOD | ||||||||