public class OpenSSLX509Certificate extends X509Certificate
Certificate.CertificateRep| Modifier and Type | Method and Description |
|---|---|
void |
checkValidity()
Checks whether the certificate is currently valid.
|
void |
checkValidity(Date date)
Checks whether the certificate is valid at the specified date.
|
boolean |
equals(Object other)
Compares the argument to the certificate, and returns
true if they
represent the same object using a class specific comparison. |
protected void |
finalize()
Invoked when the garbage collector has detected that this instance is no longer reachable.
|
static OpenSSLX509Certificate |
fromCertificate(Certificate cert) |
static List<OpenSSLX509Certificate> |
fromPkcs7DerInputStream(InputStream is) |
static List<OpenSSLX509Certificate> |
fromPkcs7PemInputStream(InputStream is) |
static OpenSSLX509Certificate |
fromX509Der(byte[] encoded) |
static OpenSSLX509Certificate |
fromX509DerInputStream(InputStream is) |
static OpenSSLX509Certificate |
fromX509PemInputStream(InputStream is) |
int |
getBasicConstraints()
Returns the path length of the certificate constraints from the
BasicContraints extension. |
long |
getContext()
Returns the raw pointer to the X509 context for use in JNI calls.
|
Set<String> |
getCriticalExtensionOIDs()
Returns the set of OIDs of the extension(s) marked as CRITICAL, that this
implementation manages.
|
byte[] |
getEncoded()
Returns the encoded representation for this certificate.
|
List<String> |
getExtendedKeyUsage()
Returns a read-only list of OID strings representing the
ExtKeyUsageSyntax field of the extended key usage extension. |
byte[] |
getExtensionValue(String oid)
Returns the extension value as DER-encoded OCTET string for the specified
OID.
|
Collection<List<?>> |
getIssuerAlternativeNames()
Returns a read-only list of the issuer alternative names from the
IssuerAltName extension. |
Principal |
getIssuerDN()
Returns the
issuer (issuer distinguished name) as an
implementation specific Principal object. |
boolean[] |
getIssuerUniqueID()
Returns the
issuerUniqueID from the certificate. |
X500Principal |
getIssuerX500Principal()
Returns the
issuer (issuer distinguished name) as an X500Principal. |
boolean[] |
getKeyUsage()
Returns the
KeyUsage extension as a boolean array. |
Set<String> |
getNonCriticalExtensionOIDs()
Returns the set of OIDs of the extension(s) marked as NON-CRITICAL, that
this implementation manages.
|
Date |
getNotAfter()
Returns the
notAfter date of the validity period of the
certificate. |
Date |
getNotBefore()
Returns the
notBefore date from the validity period of the
certificate. |
PublicKey |
getPublicKey()
Returns the public key corresponding to this certificate.
|
BigInteger |
getSerialNumber()
Returns the
serialNumber of the certificate. |
String |
getSigAlgName()
Returns the name of the algorithm for the certificate signature.
|
String |
getSigAlgOID()
Returns the OID of the signature algorithm from the certificate.
|
byte[] |
getSigAlgParams()
Returns the parameters of the signature algorithm in DER-encoded format.
|
byte[] |
getSignature()
Returns the raw signature bits from the certificate.
|
Collection<List<?>> |
getSubjectAlternativeNames()
Returns a read-only list of the subject alternative names from the
SubjectAltName extension. |
Principal |
getSubjectDN()
Returns the
subject (subject distinguished name) as an
implementation specific Principal object. |
boolean[] |
getSubjectUniqueID()
Returns the
subjectUniqueID from the certificate. |
X500Principal |
getSubjectX500Principal()
Returns the
subject (subject distinguished name) as an X500Principal. |
byte[] |
getTBSCertificate()
Returns the
tbsCertificate information from this certificate in
DER-encoded format. |
int |
getVersion()
Returns the certificates
version (version number). |
int |
hashCode()
Returns an integer hash code for the certificate.
|
boolean |
hasUnsupportedCriticalExtension()
Returns whether this instance has an extension marked as CRITICAL that it
cannot support.
|
String |
toString()
Returns a string containing a concise, human-readable description of the
certificate.
|
void |
verify(PublicKey key)
Verifies that this certificate was signed with the given public key.
|
void |
verify(PublicKey key,
String sigProvider)
Verifies that this certificate was signed with the given public key.
|
OpenSSLX509Certificate |
withDeletedExtension(String oid)
Delete an extension.
|
getType, writeReplacepublic static OpenSSLX509Certificate fromX509DerInputStream(InputStream is) throws org.conscrypt.OpenSSLX509CertificateFactory.ParsingException
org.conscrypt.OpenSSLX509CertificateFactory.ParsingExceptionpublic static OpenSSLX509Certificate fromX509Der(byte[] encoded)
public static List<OpenSSLX509Certificate> fromPkcs7DerInputStream(InputStream is) throws org.conscrypt.OpenSSLX509CertificateFactory.ParsingException
org.conscrypt.OpenSSLX509CertificateFactory.ParsingExceptionpublic static OpenSSLX509Certificate fromX509PemInputStream(InputStream is) throws org.conscrypt.OpenSSLX509CertificateFactory.ParsingException
org.conscrypt.OpenSSLX509CertificateFactory.ParsingExceptionpublic static List<OpenSSLX509Certificate> fromPkcs7PemInputStream(InputStream is) throws org.conscrypt.OpenSSLX509CertificateFactory.ParsingException
org.conscrypt.OpenSSLX509CertificateFactory.ParsingExceptionpublic static OpenSSLX509Certificate fromCertificate(Certificate cert) throws CertificateEncodingException
CertificateEncodingExceptionpublic Set<String> getCriticalExtensionOIDs()
X509Extensionnull if no extensions are
present.public byte[] getExtensionValue(String oid)
X509Extensionoid - the object identifier to get the extension value for.null
if no extension for the specified OID can be found.public Set<String> getNonCriticalExtensionOIDs()
X509Extensionnull if no
extensions are present.public boolean hasUnsupportedCriticalExtension()
X509Extensiontrue if an unsupported CRITICAL extension is present,
false otherwise.public void checkValidity()
throws CertificateExpiredException,
CertificateNotYetValidException
X509CertificateThe validity defined in ASN.1:
validity Validity
Validity ::= SEQUENCE {
notBefore CertificateValidityDate,
notAfter CertificateValidityDate }
CertificateValidityDate ::= CHOICE {
utcTime UTCTime,
generalTime GeneralizedTime }
checkValidity in class X509CertificateCertificateExpiredException - if the certificate has expired.CertificateNotYetValidException - if the certificate is not yet valid.public void checkValidity(Date date) throws CertificateExpiredException, CertificateNotYetValidException
X509CertificatecheckValidity in class X509Certificatedate - the date to check the validity against.CertificateExpiredException - if the certificate has expired.CertificateNotYetValidException - if the certificate is not yet valid.X509Certificate.checkValidity()public int getVersion()
X509Certificateversion (version number).
The version defined is ASN.1:
Version ::= INTEGER { v1(0), v2(1), v3(2) }
getVersion in class X509Certificatepublic BigInteger getSerialNumber()
X509CertificateserialNumber of the certificate.
The ASN.1 definition of serialNumber:
CertificateSerialNumber ::= INTEGER
getSerialNumber in class X509Certificatepublic Principal getIssuerDN()
X509Certificateissuer (issuer distinguished name) as an
implementation specific Principal object.
The ASN.1 definition of issuer:
issuer Name
Name ::= CHOICE {
RDNSequence }
RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
RelativeDistinguishedName ::= SET OF AttributeTypeAndValue
AttributeTypeAndValue ::= SEQUENCE {
type AttributeType,
value AttributeValue }
AttributeType ::= OBJECT IDENTIFIER
AttributeValue ::= ANY DEFINED BY AttributeType
replaced by: X509Certificate.getIssuerX500Principal().getIssuerDN in class X509Certificateissuer as an implementation specific Principal.public Principal getSubjectDN()
X509Certificatesubject (subject distinguished name) as an
implementation specific Principal object.
The ASN.1 definition of subject:
subject Name
Name ::= CHOICE {
RDNSequence }
RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
RelativeDistinguishedName ::= SET OF AttributeTypeAndValue
AttributeTypeAndValue ::= SEQUENCE {
type AttributeType,
value AttributeValue }
AttributeType ::= OBJECT IDENTIFIER
AttributeValue ::= ANY DEFINED BY AttributeType
replaced by: X509Certificate.getSubjectX500Principal().
getSubjectDN in class X509Certificatesubject (subject distinguished name).public Date getNotBefore()
X509CertificatenotBefore date from the validity period of the
certificate.getNotBefore in class X509Certificatepublic Date getNotAfter()
X509CertificatenotAfter date of the validity period of the
certificate.getNotAfter in class X509Certificatepublic byte[] getTBSCertificate()
throws CertificateEncodingException
X509CertificatetbsCertificate information from this certificate in
DER-encoded format.getTBSCertificate in class X509CertificateCertificateEncodingException - if an error occurs in encodingpublic byte[] getSignature()
X509CertificategetSignature in class X509Certificatepublic String getSigAlgName()
X509CertificategetSigAlgName in class X509Certificatepublic String getSigAlgOID()
X509CertificategetSigAlgOID in class X509Certificatepublic byte[] getSigAlgParams()
X509CertificategetSigAlgParams in class X509Certificatenull if
none are used.public boolean[] getIssuerUniqueID()
X509CertificateissuerUniqueID from the certificate.getIssuerUniqueID in class X509CertificateissuerUniqueID or null if there's none in the
certificate.public boolean[] getSubjectUniqueID()
X509CertificatesubjectUniqueID from the certificate.getSubjectUniqueID in class X509CertificatesubjectUniqueID or null if there's none in the
certificate.public boolean[] getKeyUsage()
X509CertificateKeyUsage extension as a boolean array.
The ASN.1 definition of KeyUsage:
KeyUsage ::= BIT STRING {
digitalSignature (0),
nonRepudiation (1),
keyEncipherment (2),
dataEncipherment (3),
keyAgreement (4),
keyCertSign (5),
cRLSign (6),
encipherOnly (7),
decipherOnly (8) }
getKeyUsage in class X509CertificateKeyUsage extension or null if there's none in
the certificate.public int getBasicConstraints()
X509CertificateBasicContraints extension.
If the certificate has no basic constraints or is not a
certificate authority, -1 is returned. If the
certificate is a certificate authority without a path length,
Integer.MAX_VALUE is returned. Otherwise, the
certificate authority's path length is returned.getBasicConstraints in class X509Certificatepublic byte[] getEncoded()
throws CertificateEncodingException
CertificategetEncoded in class CertificateCertificateEncodingException - if the encoding fails.public void verify(PublicKey key) throws CertificateException, NoSuchAlgorithmException, InvalidKeyException, NoSuchProviderException, SignatureException
Certificateverify in class Certificatekey - PublicKey public key for which verification should be
performed.CertificateException - if encoding errors are detected.NoSuchAlgorithmException - if an unsupported algorithm is detected.InvalidKeyException - if an invalid key is detected.NoSuchProviderException - if there is no default provider.SignatureException - if signature errors are detected.public void verify(PublicKey key, String sigProvider) throws CertificateException, NoSuchAlgorithmException, InvalidKeyException, NoSuchProviderException, SignatureException
Certificateverify in class Certificatekey - PublicKey public key for which verification should be
performed.sigProvider - String the name of the signature provider.CertificateException - if encoding errors are detected.NoSuchAlgorithmException - if an unsupported algorithm is detected.InvalidKeyException - if an invalid key is detected.NoSuchProviderException - if the specified provider does not exists.SignatureException - if signature errors are detected.public String toString()
CertificatetoString in class Certificatepublic PublicKey getPublicKey()
CertificategetPublicKey in class Certificatepublic X500Principal getIssuerX500Principal()
X509Certificateissuer (issuer distinguished name) as an X500Principal.getIssuerX500Principal in class X509Certificateissuer (issuer distinguished name).public X500Principal getSubjectX500Principal()
X509Certificatesubject (subject distinguished name) as an X500Principal.getSubjectX500Principal in class X509Certificatesubject (subject distinguished name)public List<String> getExtendedKeyUsage() throws CertificateParsingException
X509CertificateExtKeyUsageSyntax field of the extended key usage extension.getExtendedKeyUsage in class X509Certificatenull if there's none
in the certificate.CertificateParsingException - if the extension decoding fails.public Collection<List<?>> getSubjectAlternativeNames() throws CertificateParsingException
X509CertificateSubjectAltName extension.
The ASN.1 definition of SubjectAltName:
SubjectAltName ::= GeneralNames
GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName
GeneralName ::= CHOICE {
otherName [0] AnotherName,
rfc822Name [1] IA5String,
dNSName [2] IA5String,
x400Address [3] ORAddress,
directoryName [4] Name,
ediPartyName [5] EDIPartyName,
uniformResourceIdentifier [6] IA5String,
iPAddress [7] OCTET STRING,
registeredID [8] OBJECT IDENTIFIER }
getSubjectAlternativeNames in class X509Certificatenull if there are none
in the certificate.CertificateParsingException - if decoding of the extension fails.public Collection<List<?>> getIssuerAlternativeNames() throws CertificateParsingException
X509CertificateIssuerAltName extension.
The ASN.1 definition of IssuerAltName:
IssuerAltName ::= GeneralNames
GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName
GeneralName ::= CHOICE {
otherName [0] AnotherName,
rfc822Name [1] IA5String,
dNSName [2] IA5String,
x400Address [3] ORAddress,
directoryName [4] Name,
ediPartyName [5] EDIPartyName,
uniformResourceIdentifier [6] IA5String,
iPAddress [7] OCTET STRING,
registeredID [8] OBJECT IDENTIFIER }
getIssuerAlternativeNames in class X509Certificatenull if there are none in
the certificate.CertificateParsingException - if decoding of the extension fails.public boolean equals(Object other)
Certificatetrue if they
represent the same object using a class specific comparison. The
implementation in Object returns true only if the argument is the
exact same object as the callee (==).equals in class Certificateother - the object to compare with this object.true if the object is the same as this object, false if it is different from this object.Certificate.hashCode()public int hashCode()
Certificatetrue when passed to equals must return the same
value for this method.hashCode in class CertificateCertificate.equals(java.lang.Object)public long getContext()
OpenSSLX509Certificate instance and must not be destroyed or
freed by users of this API.public OpenSSLX509Certificate withDeletedExtension(String oid)
protected void finalize()
throws Throwable
ObjectNote that objects that override finalize are significantly more expensive than
objects that don't. Finalizers may be run a long time after the object is no longer
reachable, depending on memory pressure, so it's a bad idea to rely on them for cleanup.
Note also that finalizers are run on a single VM-wide finalizer thread,
so doing blocking work in a finalizer is a bad idea. A finalizer is usually only necessary
for a class that has a native peer and needs to call a native method to destroy that peer.
Even then, it's better to provide an explicit close method (and implement
Closeable), and insist that callers manually dispose of instances. This
works well for something like files, but less well for something like a BigInteger
where typical calling code would have to deal with lots of temporaries. Unfortunately,
code that creates lots of temporaries is the worst kind of code from the point of view of
the single finalizer thread.
If you must use finalizers, consider at least providing your own
ReferenceQueue and having your own thread process that queue.
Unlike constructors, finalizers are not automatically chained. You are responsible for
calling super.finalize() yourself.
Uncaught exceptions thrown by finalizers are ignored and do not terminate the finalizer thread. See Effective Java Item 7, "Avoid finalizers" for more.