All Packages  Class Hierarchy  This Package  Previous  Next  Index  

Interface java.security.cert.X509Extension

public interface X509Extension

The extensions defined for X.509 v3 Certificates and v2 CRLs (Certificate Revocation Lists) provide methods for associating additional attributes with users or public keys, for managing the certification hierarchy, and for managing CRL distribution. The X.509 extensions format also allows communities to define private extensions to carry information unique to those communities.

Each extension in a certificate/CRL may be designated as critical or non-critical. A certificate/CRL-using system (an application validating a certificate/CRL) must reject the certificate/CRL if it encounters a critical extension it does not recognize. A non-critical extension may be ignored if it is not recognized.

The ASN.1 definition for this is:

 Extensions  ::=  SEQUENCE SIZE (1..MAX) OF Extension

 Extension  ::=  SEQUENCE  {
     extnId        OBJECT IDENTIFIER,
     critical      BOOLEAN DEFAULT FALSE,
     extnValue     OCTET STRING
                   -- contains a DER encoding of a value
                   -- of the type registered for use with
                   -- the extnId object identifier value
 }
 

getCriticalExtensionOIDs()

Gets a Set of the OID strings for the extension(s) marked CRITICAL in the certificate managed by the object implementing this interface.

getExtensionValue(String)

Gets the DER-encoded OCTET string for the extension value (extnValue) identified by the passed-in oid String.

getNonCriticalExtensionOIDs()

Gets a Set of the OID strings for the extension(s) marked NON-CRITICAL in the certificate managed by the object implementing this interface.

public abstract Set getCriticalExtensionOIDs()

Gets a Set of the OID strings for the extension(s) marked CRITICAL in the certificate managed by the object implementing this interface. Here is sample code to get a Set of critical extensions from an X509Certificate and print the OIDs:

 InputStream inStrm = new FileInputStream("DER-encoded-Cert");
 X509Certificate cert = X509Certificate.getInstance(inStrm);
 inStrm.close();


 Set critSet = cert.getCriticalExtensionOIDs();
 System.out.println("Set of critical extensions");
 for (Iterator i = critSet.iterator(); i.hasNext();) {
     String oid = (String)i.next();
     System.out.println(oid);
 }   
 

Returns:

a Set (or an empty Set if none are marked critical) of the extension OID strings for extensions that are marked critical. If there are no extensions present at all, then this method returns null.

public abstract Set getNonCriticalExtensionOIDs()

Gets a Set of the OID strings for the extension(s) marked NON-CRITICAL in the certificate managed by the object implementing this interface. Here is sample code to get a Set of non-critical extensions from an X509CRL revoked certificate entry and print the OIDs:

 InputStream inStrm = new FileInputStream("DER-encoded-CRL");
 X509CRL crl = X509CRL.getInstance(inStrm);
 inStrm.close();


 byte[] certData = <DER-encoded certificate data>
 X509Certificate cert = X509Certificate.getInstance(certData); 
 RevokedCertificate badCert =
              crl.getRevokedCertificate(cert.getSerialNumber());


 if (badCert != null) {
     Set nonCritSet = badCert.getNonCriticalExtensionOIDs();

 
     for (Iterator i = nonCritSet.iterator(); i.hasNext();) {
         String oid = (String)i.next();
         System.out.println(oid);
     }   
 }
 

Returns:

a Set (or an empty Set if none are marked non-critical) of the extension OID strings for extensions that are marked non-critical. If there are no extensions present at all, then this method returns null.

public abstract byte[] getExtensionValue(String oid)

Gets the DER-encoded OCTET string for the extension value (extnValue) identified by the passed-in oid String. The oid string is represented by a set of positive whole numbers separated by periods.

For example:

OID	Extension Name
2.5.29.14	SubjectKeyIdentifier
2.5.29.15	KeyUsage
2.5.29.16	PrivateKeyUsage
2.5.29.17	SubjectAlternativeName
2.5.29.18	IssuerAlternativeName
2.5.29.19	BasicConstraints
2.5.29.30	NameConstraints
2.5.29.33	PolicyMappings
2.5.29.36	PolicyConstraints
2.5.29.35	AuthorityKeyIdentifier

Parameters:

oid - the Object Identifier value for the extension.

Returns:

the DER-encoded octet string of the extension value or null if it is not present.

All Packages  Class Hierarchy  This Package  Previous  Next  Index