All Packages Class Hierarchy This Package Previous Next Index
java.lang.Object | +----java.security.cert.Certificate | +----java.security.cert.X509Certificate
Abstract class for X.509 certificates. This provides a standard way to access all the attributes of an X.509 certificate.
In June of 1996, the basic X.509 v3 format was completed by ISO/IEC and ANSI X9, which is described below in ASN.1:
Certificate ::= SEQUENCE { tbsCertificate TBSCertificate, signatureAlgorithm AlgorithmIdentifier, signature BIT STRING }
These certificates are widely used to support authentication and other functionality in Internet security systems. Common applications include Privacy Enhanced Mail (PEM), Transport Layer Security (SSL), code signing for trusted software distribution, and Secure Electronic Transactions (SET).
These certificates are managed and vouched for by Certificate Authorities (CAs). CAs are services which create certificates by placing data in the X.509 standard format and then digitally signing that data. CAs act as trusted third parties, making introductions between principals who have no direct knowledge of each other. CA certificates are either signed by themselves, or by some other CA such as a "root" CA.
A good decription and profiling is provided in the IETF PKIX WG draft, Part I: X.509 Certificate and CRL Profile, <draft-ietf-pkix-ipki-part1-06.txt>.
The ASN.1 definition of tbsCertificate
is:
TBSCertificate ::= SEQUENCE { version [0] EXPLICIT Version DEFAULT v1, serialNumber CertificateSerialNumber, signature AlgorithmIdentifier, issuer Name, validity Validity, subject Name, subjectPublicKeyInfo SubjectPublicKeyInfo, issuerUniqueID [1] IMPLICIT UniqueIdentifier OPTIONAL, -- If present, version must be v2 or v3 subjectUniqueID [2] IMPLICIT UniqueIdentifier OPTIONAL, -- If present, version must be v2 or v3 extensions [3] EXPLICIT Extensions OPTIONAL -- If present, version must be v3 }
Here is sample code to instantiate an X.509 certificate:
InputStream inStream = new FileInputStream("fileName-of-cert"); X509Certificate cert = X509Certificate.getInstance(inStream); inStream.close();OR
byte[] certData = <certificate read from a file, say> X509Certificate cert = X509Certificate.getInstance(certData);
In either case, the code that instantiates an X.509 certificate
consults the Java security properties file to locate the actual
implementation. The default implementation for the
java.security.cert
package is the Sun X.509 v3
implementation, from what is known to the java.security
APIs as the "SUN" provider.
The Java security properties file is located in the file named <JAVA_HOME>/lib/security/java.security, where <JAVA_HOME> refers to the directory where the JDK was installed. In the Security properties file, the default implementation for X.509 v3 is given as:
cert.provider.x509=sun.security.x509.X509CertImpl
The value of this cert.provider.x509
property has to be
changed to instatiate another implementation.
BasicConstraints
extension, (OID = 2.5.29.19).
inStream
.
issuer
(issuer distinguished name) value from
the certificate.
issuerUniqueID
value from the certificate.
KeyUsage
extension, (OID = 2.5.29.15).
notAfter
date from the validity period of
the certificate.
notBefore
date from the validity period of
the certificate.
serialNumber
value from the certificate.
signature
value (the raw signature bits) from
the certificate.
subject
(subject distinguished name) value
from the certificate.
subjectUniqueID
value from the certificate.
tbsCertificate
from this certificate.
version
(version number) value from the certificate.
public X509Certificate()
public static final X509Certificate getInstance(InputStream inStream) throws CertificateException
inStream
.
The implementation (X509Certificate is an abstract class) is
provided by the class specified as the value of the
cert.provider.x509
property in the security properties file.
Note: Only one DER-encoded
certificate is expected to be in the input stream.
Also, all X509Certificate
subclasses must provide a constructor of the form:
public <subClass>(InputStream inStream) ...
public static final X509Certificate getInstance(byte[] certData) throws CertificateException
cert.provider.x509
property in the security properties file.
Note: All X509Certificate
subclasses must provide a constructor of the form:
public <subClass>(InputStream inStream) ...
certData
.public abstract void checkValidity() throws CertificateExpiredException, CertificateNotYetValidException
The validity period consists of two date/time values: the first and last dates (and times) on which the certificate is valid. It is defined in ASN.1 as:
validity ValidityValidity ::= SEQUENCE { notBefore CertificateValidityDate, notAfter CertificateValidityDate }
CertificateValidityDate ::= CHOICE { utcTime UTCTime, generalTime GeneralizedTime }
public abstract void checkValidity(Date date) throws CertificateExpiredException, CertificateNotYetValidException
date
supplied.date
supplied.public abstract int getVersion()
version
(version number) value from the certificate.
The ASN.1 definition for this is:
version [0] EXPLICIT Version DEFAULT v1Version ::= INTEGER { v1(0), v2(1), v3(2) }
public abstract BigInteger getSerialNumber()
serialNumber
value from the certificate.
The serial number is an integer assigned by the certification
authority to each certificate. It must be unique for each
certificate issued by a given CA (i.e., the issuer name and
serial number identify a unique certificate).
The ASN.1 definition for this is:
serialNumber CertificateSerialNumberCertificateSerialNumber ::= INTEGER
public abstract Principal getIssuerDN()
issuer
(issuer distinguished name) value from
the certificate. The issuer name identifies the entity that signed (and
issued) the certificate.
The issuer name field contains an X.500 distinguished name (DN). The ASN.1 definition for this is:
issuer NameTheName ::= CHOICE { RDNSequence } RDNSequence ::= SEQUENCE OF RelativeDistinguishedName RelativeDistinguishedName ::= SET OF AttributeValueAssertion AttributeValueAssertion ::= SEQUENCE { AttributeType, AttributeValue } AttributeType ::= OBJECT IDENTIFIER AttributeValue ::= ANY
Name
describes a hierarchical name composed of attributes,
such as country name, and corresponding values, such as US.
The type of the AttributeValue
component is determined by the
AttributeType
; in general it will be a
directoryString
. A directoryString
is usually
one of PrintableString
,
TeletexString
or UniversalString
.
public abstract Principal getSubjectDN()
subject
(subject distinguished name) value
from the certificate.
The ASN.1 definition for this is:
subject Name
See getIssuerDN for Name
and other relevant definitions.
public abstract Date getNotBefore()
notBefore
date from the validity period of
the certificate.
The relevant ASN.1 definitions are:
validity ValidityValidity ::= SEQUENCE { notBefore CertificateValidityDate, notAfter CertificateValidityDate }
CertificateValidityDate ::= CHOICE { utcTime UTCTime, generalTime GeneralizedTime }
public abstract Date getNotAfter()
notAfter
date from the validity period of
the certificate. See getNotBefore
for relevant ASN.1 definitions.
public abstract byte[] getTBSCertificate() throws CertificateEncodingException
tbsCertificate
from this certificate.
This can be used to verify the signature independently.
public abstract byte[] getSignature()
signature
value (the raw signature bits) from
the certificate.
The ASN.1 definition for this is:
signature BIT STRING
public abstract String getSigAlgName()
signatureAlgorithm AlgorithmIdentifierAlgorithmIdentifier ::= SEQUENCE { algorithm OBJECT IDENTIFIER, parameters ANY DEFINED BY algorithm OPTIONAL } -- contains a value of the type -- registered for use with the -- algorithm object identifier value
The algorithm name is determined from the algorithm
OID string.
public abstract String getSigAlgOID()
See getSigAlgName for relevant ASN.1 definitions.
public abstract byte[] getSigAlgParams()
See getSigAlgName for relevant ASN.1 definitions.
public abstract boolean[] getIssuerUniqueID()
issuerUniqueID
value from the certificate.
The issuer unique identifier is present in the certificate
to handle the possibility of reuse of issuer names over time.
The PKIX Part I recommends that names not be reused and that
conforming certificates not make use of unique identifiers.
Applications conforming to that profile should be capable of
parsing unique identifiers and making comparisons.
The ASN.1 definition for this is:
issuerUniqueID [1] IMPLICIT UniqueIdentifier OPTIONALUniqueIdentifier ::= BIT STRING
public abstract boolean[] getSubjectUniqueID()
subjectUniqueID
value from the certificate.
The ASN.1 definition for this is:
subjectUniqueID [2] IMPLICIT UniqueIdentifier OPTIONALUniqueIdentifier ::= BIT STRING
public abstract boolean[] getKeyUsage()
KeyUsage
extension, (OID = 2.5.29.15).
The key usage extension defines the purpose (e.g., encipherment,
signature, certificate signing) of the key contained in the
certificate.
The ASN.1 definition for this is:
KeyUsage ::= BIT STRING { digitalSignature (0), nonRepudiation (1), keyEncipherment (2), dataEncipherment (3), keyAgreement (4), keyCertSign (5), cRLSign (6), encipherOnly (7), decipherOnly (8) }The PKIX part I draft recommends that when used, this be marked as a critical extension.
public abstract int getBasicConstraints()
BasicConstraints
extension, (OID = 2.5.29.19).
The basic constraints extension identifies whether the subject
of the certificate is a Certificate Authority (CA) and
how deep a certification path may exist through that CA. The
pathLenConstraint
field (see below) is meaningful
only if cA
is set to TRUE. In this case, it gives the maximum
number of CA certificates that may follow this certificate in a
certification path. A value of zero indicates that only an end-entity
certificate may follow in the path.
Note that for the PKIX profile this extension is always marked
critical if cA
is TRUE, meaning this certificate belongs
to a Certificate Authority.
The ASN.1 definition for this is:
BasicConstraints ::= SEQUENCE { cA BOOLEAN DEFAULT FALSE, pathLenConstraint INTEGER (0..MAX) OPTIONAL }
cA
value is TRUE.
Otherwise returns -1.All Packages Class Hierarchy This Package Previous Next Index