java.security.cert
Class X509CRL
java.lang.Object
|
+--java.security.cert.CRL
|
+--java.security.cert.X509CRL
All Implemented Interfaces:
X509Extension
The X509CRL class is the abstract class used to manage
X.509 Certificate Revocation Lists. The CRL is a list of
time stamped entries which indicate which lists have been
revoked. The list is signed by a Certificate Authority (CA)
and made publically available in a repository.
Each revoked certificate in the CRL is identified by its
certificate serial number. When a piece of code uses a
certificate, the certificates validity is checked by
validating its signature and determing that it is not
only a recently acquired CRL. The recently aquired CRL
is depends on the local policy in affect. The CA issues
a new CRL periodically and entries are removed as the
certificate expiration date is reached
A description of the X.509 v2 CRL follows below from rfc2459.
"The X.509 v2 CRL syntax is as follows. For signature calculation,
the data that is to be signed is ASN.1 DER encoded. ASN.1 DER
encoding is a tag, length, value encoding system for each element.
CertificateList ::= SEQUENCE {
tbsCertList TBSCertList,
signatureAlgorithm AlgorithmIdentifier,
signatureValue BIT STRING }
TBSCertList ::= SEQUENCE {
version Version OPTIONAL,
-- if present, shall be v2
signature AlgorithmIdentifier,
issuer Name,
thisUpdate Time,
nextUpdate Time OPTIONAL,
revokedCertificates SEQUENCE OF SEQUENCE {
userCertificate CertificateSerialNumber,
revocationDate Time,
crlEntryExtensions Extensions OPTIONAL
-- if present, shall be v2
} OPTIONAL,
crlExtensions [0] EXPLICIT Extensions OPTIONAL
-- if present, shall be v2
}"
Since:Author:X509CRL
protected X509CRL()
Constructs a new X509CRL.
equals
public boolean equals(java.lang.Object other)
Compares this X509CRL to other. It checks if the
object if instanceOf X509CRL and then checks if
the encoded form matches.
Parameters:
Returns:
- true if equal, false otherwise
getEncoded
public byte[] getEncoded()
Gets the DER ASN.1 encoded format for this X.509 CRL.
Returns:
- byte array containg encoded form
Throws:
getIssuerDN
public Principal getIssuerDN()
Returns the issuer (issuer distinguished name) of the CRL.
The issuer is the entity who signed and issued the
Certificate Revocation List.
The ASN.1 DER encoding is:
issuer Name,
Name ::= CHOICE {
RDNSequence }
RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
RelativeDistinguishedName ::=
SET OF AttributeTypeAndValue
AttributeTypeAndValue ::= SEQUENCE {
type AttributeType,
value AttributeValue }
AttributeType ::= OBJECT IDENTIFIER
AttributeValue ::= ANY DEFINED BY AttributeType
DirectoryString ::= CHOICE {
teletexString TeletexString (SIZE (1..MAX)),
printableString PrintableString (SIZE (1..MAX)),
universalString UniversalString (SIZE (1..MAX)),
utf8String UTF8String (SIZE (1.. MAX)),
bmpString BMPString (SIZE (1..MAX)) }
Consult rfc2459 for more information.
Returns:
- the issuer in the Principal class
getNextUpdate
public Date getNextUpdate()
getRevokedCertificate
public X509CRLEntry getRevokedCertificate(java.math.BigInteger serialNumber)
Gets the requeste dX509Entry for the specified
certificate serial number.
Parameters:
Returns:
- a X509CRLEntry representing the X.509 CRL entry
getRevokedCertificates
public Set getRevokedCertificates()
Returns a Set of revoked certificates.
Returns:
- a set of revoked certificates.
getSigAlgName
public String getSigAlgName()
Returns the signature algorithm used to sign the CRL.
An examples is "SHA-1/DSA".
The ASN.1 DER encoding is:
signatureAlgorithm AlgorithmIdentifier,
AlgorithmIdentifier ::= SEQUENCE {
algorithm OBJECT IDENTIFIER,
parameters ANY DEFINED BY algorithm OPTIONAL }
Consult rfc2459 for more information.
The algorithm name is determined from the OID.
Returns:
- a string with the signature algorithm name
getSigAlgOID
public String getSigAlgOID()
Returns the OID for the signature algorithm used.
Example "1.2.840.10040.4.3" is return for SHA-1 with DSA.\
The ASN.1 DER encoding for the example is:
id-dsa-with-sha1 ID ::= {
iso(1) member-body(2) us(840) x9-57 (10040)
x9cm(4) 3 }
Consult rfc2459 for more information.
Returns:
- a string containing the OID.
getSigAlgParams
public byte[] getSigAlgParams()
Returns the AlgorithmParameters in the encoded form
for the signature algorithm used.
If access to the parameters is need, create an
instance of AlgorithmParameters.
Returns:
- byte array containing algorithm parameters, null
if no parameters are present in CRL
getSignature
public byte[] getSignature()
Returns the signature for the CRL.
The ASN.1 DER encoding is:
signatureValue BIT STRING
Consult rfc2459 for more information.
getTBSCertList
public byte[] getTBSCertList()
Returns the DER ASN.1 encoded tbsCertList which is
the basic information of the list and associated certificates
in the encoded state. See top for more information.
The ASN.1 DER encoding is:
tbsCertList TBSCertList,
Consult rfc2459 for more information.
Returns:
- byte array representing tbsCertList
getThisUpdate
public Date getThisUpdate()
Returns the thisUpdate date of the CRL.
The ASN.1 DER encoding is:
thisUpdate Time,
Time ::= CHOICE {
utcTime UTCTime,
generalTime GeneralizedTime }
Consult rfc2459 for more information.
Returns:
getVersion
public int getVersion()
Gets the version of this CRL.
The ASN.1 encoding is:
version Version OPTIONAL,
-- if present, shall be v2
Version ::= INTEGER { v1(0), v2(1), v3(2) }
Consult rfc2459 for more information.
Returns:
- the version number, Ex: 1 or 2
hashCode
public int hashCode()
Returns a hash code for this X509CRL in its encoded
form.
Returns:
- A hash code of this class
verify
public void verify(java.security.PublicKey key)
Verifies that this CRL was properly signed with the
PublicKey that corresponds to its private key.
Parameters:
Throws:
verify
public void verify(java.security.PublicKey key, java.lang.String sigProvider)
Verifies that this CRL was properly signed with the
PublicKey that corresponds to its private key and uses
the signature engine provided by the provider.
Parameters:
Throws: