/* X509Certificate.java --- X.509 Certificate class
Copyright (C) 1999 Free Software Foundation, Inc.
This file is part of GNU Classpath.
GNU Classpath is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2, or (at your option)
any later version.
GNU Classpath is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
General Public License for more details.
You should have received a copy of the GNU General Public License
along with GNU Classpath; see the file COPYING. If not, write to the
Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
02111-1307 USA.
As a special exception, if you link this library with other files to
produce an executable, this library does not by itself cause the
resulting executable to be covered by the GNU General Public License.
This exception does not however invalidate any other reasons why the
executable file might be covered by the GNU General Public License. */
package java.security.cert;
import java.math.BigInteger;
import java.security.Principal;
import java.security.PublicKey;
import java.security.NoSuchAlgorithmException;
import java.security.InvalidKeyException;
import java.security.NoSuchProviderException;
import java.security.SignatureException;
import java.util.Date;
/**
X509Certificate is the abstract class for X.509 certificates.
This provides a stanard class interface for accessing all
the attributes of X.509 certificates.
In June 1996, the basic X.509 v3 format was finished by
ISO/IEC and ANSI X.9. The ASN.1 DER format is below:
Certificate ::= SEQUENCE {
tbsCertificate TBSCertificate,
signatureAlgorithm AlgorithmIdentifier,
signatureValue BIT STRING }
These certificates are widely used in various Internet
protocols to support authentication. It is used in
Privacy Enhanced Mail (PEM), Transport Layer Security (TLS),
Secure Sockets Layer (SSL), code signing for trusted software
distribution, and Secure Electronic Transactions (SET).
The certificates are managed and vouched for by
Certificate Authorities (CAs). CAs are companies or
groups that create certificates by placing the data in the
X.509 certificate format and signing it with their private
key. CAs serve as trusted third parties by certifying that
the person or group specified in the certificate is who
they say they are.
The ASN.1 defintion for tbsCertificate is
TBSCertificate ::= SEQUENCE {
version [0] EXPLICIT Version DEFAULT v1,
serialNumber CertificateSerialNumber,
signature AlgorithmIdentifier,
issuer Name,
validity Validity,
subject Name,
subjectPublicKeyInfo SubjectPublicKeyInfo,
issuerUniqueID [1] IMPLICIT UniqueIdentifier OPTIONAL,
-- If present, version shall be v2 or v3
subjectUniqueID [2] IMPLICIT UniqueIdentifier OPTIONAL,
-- If present, version shall be v2 or v3
extensions [3] EXPLICIT Extensions OPTIONAL
-- If present, version shall be v3
}
Version ::= INTEGER { v1(0), v2(1), v3(2) }
CertificateSerialNumber ::= INTEGER
Validity ::= SEQUENCE {
notBefore Time,
notAfter Time }
Time ::= CHOICE {
utcTime UTCTime,
generalTime GeneralizedTime }
UniqueIdentifier ::= BIT STRING
SubjectPublicKeyInfo ::= SEQUENCE {
algorithm AlgorithmIdentifier,
subjectPublicKey BIT STRING }
Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension
Extension ::= SEQUENCE {
extnID OBJECT IDENTIFIER,
critical BOOLEAN DEFAULT FALSE,
extnValue OCTET STRING }
Certificates are created with the CertificateFactory.
For more information about X.509 certificates, consult
rfc2459.
@since JDK 1.2
@author Mark Benvenuto
*/
public abstract class X509Certificate extends Certificate implements X509Extension
{
/**
Constructs a new certificate of the specified type.
*/
protected X509Certificate()
{
super( "X.509" );
}
/**
Checks the validity of the X.509 certificate. It is valid
if the current date and time are within the period specified
by the certificate.
The ASN.1 DER encoding is:
validity Validity,
Validity ::= SEQUENCE {
notBefore Time,
notAfter Time }
Time ::= CHOICE {
utcTime UTCTime,
generalTime GeneralizedTime }
Consult rfc2459 for more information.
@throws CertificateExpiredException if the certificate expired
@throws CertificateNotYetValidException if the certificate is
not yet valid
*/
public abstract void checkValidity()
throws CertificateExpiredException,
CertificateNotYetValidException;
/**
Checks the validity of the X.509 certificate for the
specified time and date. It is valid if the specified
date and time are within the period specified by
the certificate.
@throws CertificateExpiredException if the certificate expired
based on the date
@throws CertificateNotYetValidException if the certificate is
not yet valid based on the date
*/
public abstract void checkValidity(Date date)
throws CertificateExpiredException,
CertificateNotYetValidException;
/**
Returns the version of this certificate.
The ASN.1 DER encoding is:
version [0] EXPLICIT Version DEFAULT v1,
Version ::= INTEGER { v1(0), v2(1), v3(2) }
Consult rfc2459 for more information.
@return version number of certificate
*/
public abstract int getVersion();
/**
Gets the serial number for serial Number in
this Certifcate. It must be a unique number
unique other serial numbers from the granting CA.
The ASN.1 DER encoding is:
serialNumber CertificateSerialNumber,
CertificateSerialNumber ::= INTEGER
Consult rfc2459 for more information.
@return the serial number for this X509CRLEntry.
*/
public abstract BigInteger getSerialNumber();
/**
Returns the issuer (issuer distinguished name) of the
Certificate. The issuer is the entity who signed
and issued the Certificate.
The ASN.1 DER encoding is:
issuer Name,
Name ::= CHOICE {
RDNSequence }
RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
RelativeDistinguishedName ::=
SET OF AttributeTypeAndValue
AttributeTypeAndValue ::= SEQUENCE {
type AttributeType,
value AttributeValue }
AttributeType ::= OBJECT IDENTIFIER
AttributeValue ::= ANY DEFINED BY AttributeType
DirectoryString ::= CHOICE {
teletexString TeletexString (SIZE (1..MAX)),
printableString PrintableString (SIZE (1..MAX)),
universalString UniversalString (SIZE (1..MAX)),
utf8String UTF8String (SIZE (1.. MAX)),
bmpString BMPString (SIZE (1..MAX)) }
Consult rfc2459 for more information.
@return the issuer in the Principal class
*/
public abstract Principal getIssuerDN();
/**
Returns the subject (subject distinguished name) of the
Certificate. The subject is the entity who the Certificate
identifies.
The ASN.1 DER encoding is:
subject Name,
Consult rfc2459 for more information.
@return the issuer in the Principal class
*/
public abstract Principal getSubjectDN();
/**
Returns the date that this certificate is not to be used
before, notBefore.
The ASN.1 DER encoding is:
validity Validity,
Validity ::= SEQUENCE {
notBefore Time,
notAfter Time }
Time ::= CHOICE {
utcTime UTCTime,
generalTime GeneralizedTime }
Consult rfc2459 for more information.
@return the date notBefore
*/
public abstract Date getNotBefore();
/**
Returns the date that this certificate is not to be used
after, notAfter.
@return the date notAfter
*/
public abstract Date getNotAfter();
/**
Returns the tbsCertificate from the certificate.
@return the DER encoded tbsCertificate
@throws CertificateEncodingException if encoding error occured
*/
public abstract byte[] getTBSCertificate() throws CertificateEncodingException;
/**
Returns the signature in its raw DER encoded format.
The ASN.1 DER encoding is:
signatureValue BIT STRING
Consult rfc2459 for more information.
@return byte array representing signature
*/
public abstract byte[] getSignature();
/**
Returns the signature algorithm used to sign the CRL.
An examples is "SHA-1/DSA".
The ASN.1 DER encoding is:
signatureAlgorithm AlgorithmIdentifier,
AlgorithmIdentifier ::= SEQUENCE {
algorithm OBJECT IDENTIFIER,
parameters ANY DEFINED BY algorithm OPTIONAL }
Consult rfc2459 for more information.
The algorithm name is determined from the OID.
@return a string with the signature algorithm name
*/
public abstract String getSigAlgName();
/**
Returns the OID for the signature algorithm used.
Example "1.2.840.10040.4.3" is return for SHA-1 with DSA.\
The ASN.1 DER encoding for the example is:
id-dsa-with-sha1 ID ::= {
iso(1) member-body(2) us(840) x9-57 (10040)
x9cm(4) 3 }
Consult rfc2459 for more information.
@return a string containing the OID.
*/
public abstract String getSigAlgOID();
/**
Returns the AlgorithmParameters in the encoded form
for the signature algorithm used.
If access to the parameters is need, create an
instance of AlgorithmParameters.
@return byte array containing algorithm parameters, null
if no parameters are present in certificate
*/
public abstract byte[] getSigAlgParams();
/**
Returns the issuer unique ID for this certificate.
The ASN.1 DER encoding is:
issuerUniqueID [1] IMPLICIT UniqueIdentifier OPTIONAL,
-- If present, version shall be v2 or v3
UniqueIdentifier ::= BIT STRING
Consult rfc2459 for more information.
@return bit representation of issuerUniqueID
*/
public abstract boolean[] getIssuerUniqueID();
/**
Returns the subject unique ID for this certificate.
The ASN.1 DER encoding is:
subjectUniqueID [2] IMPLICIT UniqueIdentifier OPTIONAL,
-- If present, version shall be v2 or v3
UniqueIdentifier ::= BIT STRING
Consult rfc2459 for more information.
@return bit representation of subjectUniqueID
*/
public abstract boolean[] getSubjectUniqueID();
/**
Returns a boolean array representing the KeyUsage
extension for the certificate. The KeyUsage (OID = 2.5.29.15)
defines the purpose of the key in the certificate.
The ASN.1 DER encoding is:
id-ce-keyUsage OBJECT IDENTIFIER ::= { id-ce 15 }
KeyUsage ::= BIT STRING {
digitalSignature (0),
nonRepudiation (1),
keyEncipherment (2),
dataEncipherment (3),
keyAgreement (4),
keyCertSign (5),
cRLSign (6),
encipherOnly (7),
decipherOnly (8) }
Consult rfc2459 for more information.
@return bit representation of KeyUsage
*/
public abstract boolean[] getKeyUsage();
/**
Returns the certificate constraints path length from the
critical BasicConstraints extension, (OID = 2.5.29.19).
The basic constraints extensions is used to determine if
the subject of the certificate is a Certificate Authority (CA)
and how deep the certification path may exist. The
pathLenConstraint only takes affect if cA
is set to true. "A value of zero indicates that only an
end-entity certificate may follow in the path." (rfc2459)
The ASN.1 DER encoding is:
id-ce-basicConstraints OBJECT IDENTIFIER ::= { id-ce 19 }
BasicConstraints ::= SEQUENCE {
cA BOOLEAN DEFAULT FALSE,
pathLenConstraint INTEGER (0..MAX) OPTIONAL }
Consult rfc2459 for more information.
@return the length of the path constraint if BasicConstraints
is present and cA is TRUE. Otherwise returns -1.
*/
public abstract int getBasicConstraints();
}