public class X509Support
extends java.lang.Object
| Modifier and Type | Field and Description |
|---|---|
static java.lang.String |
CN_OID
Common Name (CN) OID.
|
static java.lang.Integer |
DIRECTORY_ALT_NAME
RFC 2459 Directory Name Subject Alt Name type.
|
static java.lang.Integer |
DNS_ALT_NAME
RFC 2459 DNS Subject Alt Name type.
|
static java.lang.Integer |
EDI_PARTY_ALT_NAME
RFC 2459 EDI Party Name Subject Alt Name type.
|
static java.lang.Integer |
IP_ADDRESS_ALT_NAME
RFC 2459 IP Address Subject Alt Name type.
|
static java.lang.Integer |
OTHER_ALT_NAME
RFC 2459 Other Subject Alt Name type.
|
static java.lang.Integer |
REGISTERED_ID_ALT_NAME
RFC 2459 Registered ID Subject Alt Name type.
|
static java.lang.Integer |
RFC822_ALT_NAME
RFC 2459 RFC 822 (email address) Subject Alt Name type.
|
static java.lang.String |
SKI_OID
Subject Key Identifier (SKI) OID.
|
static java.lang.Integer |
URI_ALT_NAME
RFC 2459 URI Subject Alt Name type.
|
static java.lang.Integer |
X400ADDRESS_ALT_NAME
RFC 2459 X.400 Address Subject Alt Name type.
|
| Modifier | Constructor and Description |
|---|---|
protected |
X509Support()
Constructed.
|
| Modifier and Type | Method and Description |
|---|---|
private static java.lang.Object |
convertAltNameType(java.lang.Integer nameType,
org.bouncycastle.asn1.ASN1Primitive nameValue)
Convert types returned by Bouncy Castle X509ExtensionUtil.getSubjectAlternativeNames(X509Certificate) to be
consistent with what is documented for: java.security.cert.X509Certificate#getSubjectAlternativeNames.
|
static java.security.cert.X509Certificate |
decodeCertificate(byte[] cert)
Decodes a single X.509 certificate in DER or PEM format.
|
static java.security.cert.X509Certificate |
decodeCertificate(java.io.File cert)
Decodes a single X.509 certificate in DER or PEM format.
|
static java.security.cert.X509Certificate |
decodeCertificate(java.lang.String base64Cert)
Decode a single Java certificate from base64 encoded form without PEM headers and footers.
|
static java.util.Collection<java.security.cert.X509Certificate> |
decodeCertificates(byte[] certs)
Decodes X.509 certificates in DER or PEM format.
|
static java.util.Collection<java.security.cert.X509Certificate> |
decodeCertificates(java.io.File certs)
Decodes X.509 certificates in DER or PEM format.
|
static java.security.cert.X509CRL |
decodeCRL(java.lang.String base64CRL)
Decode CRL in base64 encoded form without PEM headers and footers.
|
static java.util.Collection<java.security.cert.X509CRL> |
decodeCRLs(byte[] crls)
Decodes CRLs in DER or PKCS#7 format.
|
static java.util.Collection<java.security.cert.X509CRL> |
decodeCRLs(java.io.File crls)
Decodes CRLs in DER or PKCS#7 format.
|
static java.security.cert.X509Certificate |
determineEntityCertificate(java.util.Collection<java.security.cert.X509Certificate> certs,
java.security.PrivateKey privateKey)
Determines the certificate, from the collection, associated with the private key.
|
static java.util.List |
getAltNames(java.security.cert.X509Certificate certificate,
java.lang.Integer[] nameTypes)
Gets the list of alternative names of a given name type.
|
static java.util.List<java.lang.String> |
getCommonNames(javax.security.auth.x500.X500Principal dn)
Gets the commons names that appear within the given distinguished name.
|
static java.lang.String |
getIdentifiersToken(X509Credential credential,
X500DNHandler handler)
Gets a formatted string representing identifier information from the supplied credential.
|
private static org.slf4j.Logger |
getLogger()
Get an SLF4J Logger.
|
static byte[] |
getSubjectKeyIdentifier(java.security.cert.X509Certificate certificate)
Get the plain (non-DER encoded) value of the Subject Key Identifier extension of an X.509 certificate, if
present.
|
static java.util.List |
getSubjectNames(java.security.cert.X509Certificate certificate,
java.lang.Integer[] altNameTypes)
Gets the common name components of the issuer and all the subject alt names of a given type.
|
static byte[] |
getX509Digest(java.security.cert.X509Certificate certificate,
java.lang.String jcaAlgorithm)
Get the XML Signature-compliant digest of an X.509 certificate.
|
public static final java.lang.String CN_OID
public static final java.lang.String SKI_OID
public static final java.lang.Integer OTHER_ALT_NAME
public static final java.lang.Integer RFC822_ALT_NAME
public static final java.lang.Integer DNS_ALT_NAME
public static final java.lang.Integer X400ADDRESS_ALT_NAME
public static final java.lang.Integer DIRECTORY_ALT_NAME
public static final java.lang.Integer EDI_PARTY_ALT_NAME
public static final java.lang.Integer URI_ALT_NAME
public static final java.lang.Integer IP_ADDRESS_ALT_NAME
public static final java.lang.Integer REGISTERED_ID_ALT_NAME
@Nullable
public static java.security.cert.X509Certificate determineEntityCertificate(@Nullable
java.util.Collection<java.security.cert.X509Certificate> certs,
@Nullable
java.security.PrivateKey privateKey)
throws SecurityException
certs - certificates to checkprivateKey - entity's private keySecurityException - thrown if the public or private keys checked are of an unsupported type@Nullable
public static java.util.List<java.lang.String> getCommonNames(@Nullable
javax.security.auth.x500.X500Principal dn)
The returned list provides the names in the order they appeared in the DN, according to RFC 1779/2253 encoding. In this encoding the "most specific" name would typically appear in the left-most position, and would appear first in the returned list.
dn - the DN to extract the common names from@Nullable
public static java.util.List getAltNames(@Nullable
java.security.cert.X509Certificate certificate,
@Nullable
java.lang.Integer[] nameTypes)
certificate - the certificate to extract the alternative names fromnameTypes - the name types@Nullable
public static java.util.List getSubjectNames(@Nullable
java.security.cert.X509Certificate certificate,
@Nullable
java.lang.Integer[] altNameTypes)
certificate - certificate to extract names fromaltNameTypes - type of alt names to extract@Nullable
public static byte[] getSubjectKeyIdentifier(@Nonnull
java.security.cert.X509Certificate certificate)
certificate - an X.509 certificate possibly containing a subject key identifier@Nonnull
public static byte[] getX509Digest(@Nonnull
java.security.cert.X509Certificate certificate,
@Nonnull
java.lang.String jcaAlgorithm)
throws SecurityException
certificate - an X.509 certificatejcaAlgorithm - JCA algorithm identifierSecurityException - is algorithm is unsupported or encoding is not possible@Nullable
public static java.util.Collection<java.security.cert.X509Certificate> decodeCertificates(@Nonnull
java.io.File certs)
throws java.security.cert.CertificateException
certs - encoded certsjava.security.cert.CertificateException - thrown if the certificates cannot be decoded@Nullable
public static java.util.Collection<java.security.cert.X509Certificate> decodeCertificates(@Nonnull
byte[] certs)
throws java.security.cert.CertificateException
certs - encoded certsjava.security.cert.CertificateException - thrown if the certificates cannot be decoded@Nullable
public static java.security.cert.X509Certificate decodeCertificate(@Nonnull
java.io.File cert)
throws java.security.cert.CertificateException
cert - encoded certjava.security.cert.CertificateException - thrown if the certificate can not be decoded@Nullable
public static java.security.cert.X509Certificate decodeCertificate(@Nonnull
byte[] cert)
throws java.security.cert.CertificateException
cert - encoded certjava.security.cert.CertificateException - thrown if the certificate cannot be decoded@Nullable
public static java.security.cert.X509Certificate decodeCertificate(@Nonnull
java.lang.String base64Cert)
throws java.security.cert.CertificateException
base64Cert - base64-encoded certificatejava.security.cert.CertificateException - thrown if there is an error constructing certificate@Nullable
public static java.util.Collection<java.security.cert.X509CRL> decodeCRLs(@Nonnull
java.io.File crls)
throws java.security.cert.CRLException
crls - encoded CRLsjava.security.cert.CRLException - thrown if the CRLs can not be decoded@Nullable
public static java.util.Collection<java.security.cert.X509CRL> decodeCRLs(@Nonnull
byte[] crls)
throws java.security.cert.CRLException
crls - encoded CRLsjava.security.cert.CRLException - thrown if the CRLs can not be decoded@Nullable
public static java.security.cert.X509CRL decodeCRL(@Nonnull
java.lang.String base64CRL)
throws java.security.cert.CertificateException,
java.security.cert.CRLException
base64CRL - base64-encoded CRLjava.security.cert.CertificateException - thrown if there is an error constructing certificatejava.security.cert.CRLException - thrown if there is an error constructing CRL@Nonnull
public static java.lang.String getIdentifiersToken(@Nonnull
X509Credential credential,
@Nullable
X500DNHandler handler)
This could for example be used in logging messages.
Often it will be the case that a given credential that is being evaluated will NOT have a value for the entity ID property. So extract the certificate subject DN, and if present, the credential's entity ID.
credential - the credential for which to produce a token.handler - the X.500 DN handler to use. If null, a new instance of InternalX500DNHandler will be
used.@Nullable
private static java.lang.Object convertAltNameType(@Nonnull
java.lang.Integer nameType,
@Nonnull
org.bouncycastle.asn1.ASN1Primitive nameValue)
nameType - the alt name typenameValue - the alt name value@Nonnull private static org.slf4j.Logger getLogger()