Index (Frames) | Index (No Frames) | Package | Package Tree | Tree
java.security.cert

Class X509Certificate

java.lang.Object
|
+--java.security.cert.Certificate
   |
   +--java.security.cert.X509Certificate

All Implemented Interfaces:

X509Extension


public abstract class X509Certificate

extends Certificate

implements X509Extension

X509Certificate is the abstract class for X.509 certificates. This provides a stanard class interface for accessing all the attributes of X.509 certificates. In June 1996, the basic X.509 v3 format was finished by ISO/IEC and ANSI X.9. The ASN.1 DER format is below: Certificate ::= SEQUENCE { tbsCertificate TBSCertificate, signatureAlgorithm AlgorithmIdentifier, signatureValue BIT STRING } These certificates are widely used in various Internet protocols to support authentication. It is used in Privacy Enhanced Mail (PEM), Transport Layer Security (TLS), Secure Sockets Layer (SSL), code signing for trusted software distribution, and Secure Electronic Transactions (SET). The certificates are managed and vouched for by Certificate Authorities (CAs). CAs are companies or groups that create certificates by placing the data in the X.509 certificate format and signing it with their private key. CAs serve as trusted third parties by certifying that the person or group specified in the certificate is who they say they are. The ASN.1 defintion for tbsCertificate is TBSCertificate ::= SEQUENCE { version [0] EXPLICIT Version DEFAULT v1, serialNumber CertificateSerialNumber, signature AlgorithmIdentifier, issuer Name, validity Validity, subject Name, subjectPublicKeyInfo SubjectPublicKeyInfo, issuerUniqueID [1] IMPLICIT UniqueIdentifier OPTIONAL, -- If present, version shall be v2 or v3 subjectUniqueID [2] IMPLICIT UniqueIdentifier OPTIONAL, -- If present, version shall be v2 or v3 extensions [3] EXPLICIT Extensions OPTIONAL -- If present, version shall be v3 } Version ::= INTEGER { v1(0), v2(1), v3(2) } CertificateSerialNumber ::= INTEGER Validity ::= SEQUENCE { notBefore Time, notAfter Time } Time ::= CHOICE { utcTime UTCTime, generalTime GeneralizedTime } UniqueIdentifier ::= BIT STRING SubjectPublicKeyInfo ::= SEQUENCE { algorithm AlgorithmIdentifier, subjectPublicKey BIT STRING } Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension Extension ::= SEQUENCE { extnID OBJECT IDENTIFIER, critical BOOLEAN DEFAULT FALSE, extnValue OCTET STRING } Certificates are created with the CertificateFactory. For more information about X.509 certificates, consult rfc2459.

Since:Author:

Constructor Summary

X509Certificate()

Constructs a new certificate of the specified type.

Method Summary

voidcheckValidity()

Checks the validity of the X.509 certificate.
voidcheckValidity(java.util.Date date)

Checks the validity of the X.509 certificate for the specified time and date.
intgetBasicConstraints()

Returns the certificate constraints path length from the critical BasicConstraints extension, (OID = 2.5.29.19).
java.security.PrincipalgetIssuerDN()

Returns the issuer (issuer distinguished name) of the Certificate.
boolean[]getIssuerUniqueID()

Returns the issuer unique ID for this certificate.
boolean[]getKeyUsage()

Returns a boolean array representing the KeyUsage extension for the certificate.
java.util.DategetNotAfter()

Returns the date that this certificate is not to be used after, notAfter.
java.util.DategetNotBefore()

Returns the date that this certificate is not to be used before, notBefore.
java.math.BigIntegergetSerialNumber()

Gets the serial number for serial Number in this Certifcate.
java.lang.StringgetSigAlgName()

Returns the signature algorithm used to sign the CRL.
java.lang.StringgetSigAlgOID()

Returns the OID for the signature algorithm used.
byte[]getSigAlgParams()

Returns the AlgorithmParameters in the encoded form for the signature algorithm used.
byte[]getSignature()

Returns the signature in its raw DER encoded format.
java.security.PrincipalgetSubjectDN()

Returns the subject (subject distinguished name) of the Certificate.
boolean[]getSubjectUniqueID()

Returns the subject unique ID for this certificate.
byte[]getTBSCertificate()

Returns the tbsCertificate from the certificate.
intgetVersion()

Returns the version of this certificate.

Constructor Details

X509Certificate

protected X509Certificate()

Constructs a new certificate of the specified type.


Method Details

checkValidity

public void checkValidity()

Checks the validity of the X.509 certificate. It is valid if the current date and time are within the period specified by the certificate. The ASN.1 DER encoding is: validity Validity, Validity ::= SEQUENCE { notBefore Time, notAfter Time } Time ::= CHOICE { utcTime UTCTime, generalTime GeneralizedTime } Consult rfc2459 for more information.

Throws:


checkValidity

public void checkValidity(java.util.Date date)

Checks the validity of the X.509 certificate for the specified time and date. It is valid if the specified date and time are within the period specified by the certificate.

Parameters:

Throws:


getBasicConstraints

public int getBasicConstraints()

Returns the certificate constraints path length from the critical BasicConstraints extension, (OID = 2.5.29.19). The basic constraints extensions is used to determine if the subject of the certificate is a Certificate Authority (CA) and how deep the certification path may exist. The pathLenConstraint only takes affect if cA is set to true. "A value of zero indicates that only an end-entity certificate may follow in the path." (rfc2459) The ASN.1 DER encoding is: id-ce-basicConstraints OBJECT IDENTIFIER ::= { id-ce 19 } BasicConstraints ::= SEQUENCE { cA BOOLEAN DEFAULT FALSE, pathLenConstraint INTEGER (0..MAX) OPTIONAL } Consult rfc2459 for more information.

Returns:


getIssuerDN

public Principal getIssuerDN()

Returns the issuer (issuer distinguished name) of the Certificate. The issuer is the entity who signed and issued the Certificate. The ASN.1 DER encoding is: issuer Name, Name ::= CHOICE { RDNSequence } RDNSequence ::= SEQUENCE OF RelativeDistinguishedName RelativeDistinguishedName ::= SET OF AttributeTypeAndValue AttributeTypeAndValue ::= SEQUENCE { type AttributeType, value AttributeValue } AttributeType ::= OBJECT IDENTIFIER AttributeValue ::= ANY DEFINED BY AttributeType DirectoryString ::= CHOICE { teletexString TeletexString (SIZE (1..MAX)), printableString PrintableString (SIZE (1..MAX)), universalString UniversalString (SIZE (1..MAX)), utf8String UTF8String (SIZE (1.. MAX)), bmpString BMPString (SIZE (1..MAX)) } Consult rfc2459 for more information.

Returns:


getIssuerUniqueID

public boolean[] getIssuerUniqueID()

Returns the issuer unique ID for this certificate. The ASN.1 DER encoding is: issuerUniqueID [1] IMPLICIT UniqueIdentifier OPTIONAL, -- If present, version shall be v2 or v3 UniqueIdentifier ::= BIT STRING Consult rfc2459 for more information.

Returns:


getKeyUsage

public boolean[] getKeyUsage()

Returns a boolean array representing the KeyUsage extension for the certificate. The KeyUsage (OID = 2.5.29.15) defines the purpose of the key in the certificate. The ASN.1 DER encoding is: id-ce-keyUsage OBJECT IDENTIFIER ::= { id-ce 15 } KeyUsage ::= BIT STRING { digitalSignature (0), nonRepudiation (1), keyEncipherment (2), dataEncipherment (3), keyAgreement (4), keyCertSign (5), cRLSign (6), encipherOnly (7), decipherOnly (8) } Consult rfc2459 for more information.

Returns:


getNotAfter

public Date getNotAfter()

Returns the date that this certificate is not to be used after, notAfter.

Returns:


getNotBefore

public Date getNotBefore()

Returns the date that this certificate is not to be used before, notBefore. The ASN.1 DER encoding is: validity Validity, Validity ::= SEQUENCE { notBefore Time, notAfter Time } Time ::= CHOICE { utcTime UTCTime, generalTime GeneralizedTime } Consult rfc2459 for more information.

Returns:


getSerialNumber

public BigInteger getSerialNumber()

Gets the serial number for serial Number in this Certifcate. It must be a unique number unique other serial numbers from the granting CA. The ASN.1 DER encoding is: serialNumber CertificateSerialNumber, CertificateSerialNumber ::= INTEGER Consult rfc2459 for more information.

Returns:


getSigAlgName

public String getSigAlgName()

Returns the signature algorithm used to sign the CRL. An examples is "SHA-1/DSA". The ASN.1 DER encoding is: signatureAlgorithm AlgorithmIdentifier, AlgorithmIdentifier ::= SEQUENCE { algorithm OBJECT IDENTIFIER, parameters ANY DEFINED BY algorithm OPTIONAL } Consult rfc2459 for more information. The algorithm name is determined from the OID.

Returns:


getSigAlgOID

public String getSigAlgOID()

Returns the OID for the signature algorithm used. Example "1.2.840.10040.4.3" is return for SHA-1 with DSA.\ The ASN.1 DER encoding for the example is: id-dsa-with-sha1 ID ::= { iso(1) member-body(2) us(840) x9-57 (10040) x9cm(4) 3 } Consult rfc2459 for more information.

Returns:


getSigAlgParams

public byte[] getSigAlgParams()

Returns the AlgorithmParameters in the encoded form for the signature algorithm used. If access to the parameters is need, create an instance of AlgorithmParameters.

Returns:


getSignature

public byte[] getSignature()

Returns the signature in its raw DER encoded format. The ASN.1 DER encoding is: signatureValue BIT STRING Consult rfc2459 for more information.

Returns:


getSubjectDN

public Principal getSubjectDN()

Returns the subject (subject distinguished name) of the Certificate. The subject is the entity who the Certificate identifies. The ASN.1 DER encoding is: subject Name, Consult rfc2459 for more information.

Returns:


getSubjectUniqueID

public boolean[] getSubjectUniqueID()

Returns the subject unique ID for this certificate. The ASN.1 DER encoding is: subjectUniqueID [2] IMPLICIT UniqueIdentifier OPTIONAL, -- If present, version shall be v2 or v3 UniqueIdentifier ::= BIT STRING Consult rfc2459 for more information.

Returns:


getTBSCertificate

public byte[] getTBSCertificate()

Returns the tbsCertificate from the certificate.

Returns:

Throws:


getVersion

public int getVersion()

Returns the version of this certificate. The ASN.1 DER encoding is: version [0] EXPLICIT Version DEFAULT v1, Version ::= INTEGER { v1(0), v2(1), v3(2) } Consult rfc2459 for more information.

Returns: