Java Doc for X509Certificate.java in  » 6.0-JDK-Core » security » java » security » cert » Java Source Code / Java DocumentationJava Source Code and Java Documentation

Abstract class for X.509 certificates. This provides a standard way to access all the attributes of an X.509 certificate.

In June of 1996, the basic X.509 v3 format was completed by ISO/IEC and ANSI X9, which is described below in ASN.1:

 Certificate  ::=  SEQUENCE  {
 tbsCertificate       TBSCertificate,
 signatureAlgorithm   AlgorithmIdentifier,
 signature            BIT STRING  }
 

These certificates are widely used to support authentication and other functionality in Internet security systems. Common applications include Privacy Enhanced Mail (PEM), Transport Layer Security (SSL), code signing for trusted software distribution, and Secure Electronic Transactions (SET).

These certificates are managed and vouched for by Certificate Authorities (CAs). CAs are services which create certificates by placing data in the X.509 standard format and then digitally signing that data. CAs act as trusted third parties, making introductions between principals who have no direct knowledge of each other. CA certificates are either signed by themselves, or by some other CA such as a "root" CA.

More information can be found in RFC 3280: Internet X.509 Public Key Infrastructure Certificate and CRL Profile.

The ASN.1 definition of tbsCertificate is:

 TBSCertificate  ::=  SEQUENCE  {
 version         [0]  EXPLICIT Version DEFAULT v1,
 serialNumber         CertificateSerialNumber,
 signature            AlgorithmIdentifier,
 issuer               Name,
 validity             Validity,
 subject              Name,
 subjectPublicKeyInfo SubjectPublicKeyInfo,
 issuerUniqueID  [1]  IMPLICIT UniqueIdentifier OPTIONAL,
 -- If present, version must be v2 or v3
 subjectUniqueID [2]  IMPLICIT UniqueIdentifier OPTIONAL,
 -- If present, version must be v2 or v3
 extensions      [3]  EXPLICIT Extensions OPTIONAL
 -- If present, version must be v3
 }
 

Certificates are instantiated using a certificate factory. The following is an example of how to instantiate an X.509 certificate:

 
 InputStream inStream = null;
 try {
 inStream = new FileInputStream("fileName-of-cert");
 CertificateFactory cf = CertificateFactory.getInstance("X.509");
 X509Certificate cert = (X509Certificate)cf.generateCertificate(inStream);
 } finally {
 if (inStream != null) {
 inStream.close();
 }
 }
 

The basic constraints extension identifies whether the subject of the certificate is a Certificate Authority (CA) and how deep a certification path may exist through that CA.

The ASN.1 definition of the IssuerAltName extension is:

 IssuerAltName ::= GeneralNames
 

If this certificate does not contain an IssuerAltName extension, null is returned.

 KeyUsage ::= BIT STRING {
 digitalSignature        (0),
 nonRepudiation          (1),
 keyEncipherment         (2),
 dataEncipherment        (3),
 keyAgreement            (4),
 keyCertSign             (5),
 cRLSign                 (6),
 encipherOnly            (7),
 decipherOnly            (8) }
 

The ASN.1 definition of the SubjectAltName extension is:

 SubjectAltName ::= GeneralNames
 GeneralNames :: = SEQUENCE SIZE (1..MAX) OF GeneralName
 GeneralName ::= CHOICE {
 otherName                       [0]     OtherName,
 rfc822Name                      [1]     IA5String,
 dNSName                         [2]     IA5String,
 x400Address                     [3]     ORAddress,
 directoryName                   [4]     Name,
 ediPartyName                    [5]     EDIPartyName,
 uniformResourceIdentifier       [6]     IA5String,
 iPAddress                       [7]     OCTET STRING,
 registeredID                    [8]     OBJECT IDENTIFIER}
 

If this certificate does not contain a SubjectAltName extension, null is returned.

 version  [0] EXPLICIT Version DEFAULT v1

 Version ::=  INTEGER  {  v1(0), v2(1), v3(2)  }
 

The validity period consists of two date/time values: the first and last dates (and times) on which the certificate is valid. It is defined in ASN.1 as:

 validity             Validity

 Validity ::= SEQUENCE {
 notBefore      CertificateValidityDate,
 notAfter       CertificateValidityDate }

 CertificateValidityDate ::= CHOICE {
 utcTime        UTCTime,
 generalTime    GeneralizedTime }
 

The basic constraints extension identifies whether the subject of the certificate is a Certificate Authority (CA) and how deep a certification path may exist through that CA. The pathLenConstraint field (see below) is meaningful only if cA is set to TRUE. In this case, it gives the maximum number of CA certificates that may follow this certificate in a certification path. A value of zero indicates that only an end-entity certificate may follow in the path.

The ASN.1 definition for this is:

 BasicConstraints ::= SEQUENCE {
 cA                  BOOLEAN DEFAULT FALSE,
 pathLenConstraint   INTEGER (0..MAX) OPTIONAL }
 

 ExtKeyUsageSyntax ::= SEQUENCE SIZE (1..MAX) OF KeyPurposeId

 KeyPurposeId ::= OBJECT IDENTIFIER

 

This method was added to version 1.4 of the Java 2 Platform Standard Edition. In order to maintain backwards compatibility with existing service providers, this method is not abstract and it provides a default implementation. Subclasses should override this method with a correct implementation. the ExtendedKeyUsage extension of this certificate,as an unmodifiable list of object identifiers representedas Strings. Returns null if this certificate does notcontain an ExtendedKeyUsage extension.
throws:
  CertificateParsingException - if the extension cannot be decoded
since:
   1.4

The ASN.1 definition of the IssuerAltName extension is:

 IssuerAltName ::= GeneralNames
 

If this certificate does not contain an IssuerAltName extension, null is returned. Otherwise, a Collection is returned with an entry representing each GeneralName included in the extension. Each entry is a List whose first entry is an Integer (the name type, 0-8) and whose second entry is a String or a byte array (the name, in string or ASN.1 DER encoded form, respectively). For more details about the formats used for each name type, see the getSubjectAlternativeNames method.

Note that the Collection returned may contain more than one name of the same type. Also, note that the returned Collection is immutable and any entries containing byte arrays are cloned to protect against subsequent modifications.

This method was added to version 1.4 of the Java 2 Platform Standard Edition. In order to maintain backwards compatibility with existing service providers, this method is not abstract and it provides a default implementation. Subclasses should override this method with a correct implementation. an immutable Collection of issuer alternative names (or null)
throws:
  CertificateParsingException - if the extension cannot be decoded
since:
   1.4

Gets the issuer (issuer distinguished name) value from the certificate. The issuer name identifies the entity that signed (and issued) the certificate.

The issuer name field contains an X.500 distinguished name (DN). The ASN.1 definition for this is:

 issuer    Name

 Name ::= CHOICE { RDNSequence }
 RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
 RelativeDistinguishedName ::=
 SET OF AttributeValueAssertion
 AttributeValueAssertion ::= SEQUENCE {
 AttributeType,
 AttributeValue }
 AttributeType ::= OBJECT IDENTIFIER
 AttributeValue ::= ANY
 

The ASN.1 definition for this is:

 issuerUniqueID  [1]  IMPLICIT UniqueIdentifier OPTIONAL

 UniqueIdentifier  ::=  BIT STRING
 

It is recommended that subclasses override this method. an X500Principal representing the issuerdistinguished name
since:
   1.4

 KeyUsage ::= BIT STRING {
 digitalSignature        (0),
 nonRepudiation          (1),
 keyEncipherment         (2),
 dataEncipherment        (3),
 keyAgreement            (4),
 keyCertSign             (5),
 cRLSign                 (6),
 encipherOnly            (7),
 decipherOnly            (8) }
 

 validity             Validity

 Validity ::= SEQUENCE {
 notBefore      CertificateValidityDate,
 notAfter       CertificateValidityDate }

 CertificateValidityDate ::= CHOICE {
 utcTime        UTCTime,
 generalTime    GeneralizedTime }
 

 serialNumber     CertificateSerialNumber

 CertificateSerialNumber  ::=  INTEGER
 

 signatureAlgorithm   AlgorithmIdentifier

 AlgorithmIdentifier  ::=  SEQUENCE  {
 algorithm               OBJECT IDENTIFIER,
 parameters              ANY DEFINED BY algorithm OPTIONAL  }
 -- contains a value of the type
 -- registered for use with the
 -- algorithm object identifier value
 

The algorithm name is determined from the algorithm OID string. the signature algorithm name.

See X509Certificate.getSigAlgName() getSigAlgName for relevant ASN.1 definitions. the signature algorithm OID string.

See X509Certificate.getSigAlgName() getSigAlgName for relevant ASN.1 definitions. the DER-encoded signature algorithm parameters, ornull if no parameters are present.

 signature     BIT STRING  
 

The ASN.1 definition of the SubjectAltName extension is:

 SubjectAltName ::= GeneralNames
 GeneralNames :: = SEQUENCE SIZE (1..MAX) OF GeneralName
 GeneralName ::= CHOICE {
 otherName                       [0]     OtherName,
 rfc822Name                      [1]     IA5String,
 dNSName                         [2]     IA5String,
 x400Address                     [3]     ORAddress,
 directoryName                   [4]     Name,
 ediPartyName                    [5]     EDIPartyName,
 uniformResourceIdentifier       [6]     IA5String,
 iPAddress                       [7]     OCTET STRING,
 registeredID                    [8]     OBJECT IDENTIFIER}
 

If this certificate does not contain a SubjectAltName extension, null is returned. Otherwise, a Collection is returned with an entry representing each GeneralName included in the extension. Each entry is a List whose first entry is an Integer (the name type, 0-8) and whose second entry is a String or a byte array (the name, in string or ASN.1 DER encoded form, respectively).

RFC 822, DNS, and URI names are returned as Strings, using the well-established string formats for those types (subject to the restrictions included in RFC 3280). IPv4 address names are returned using dotted quad notation. IPv6 address names are returned in the form "a1:a2:...:a8", where a1-a8 are hexadecimal values representing the eight 16-bit pieces of the address. OID names are returned as Strings represented as a series of nonnegative integers separated by periods. And directory names (distinguished names) are returned in RFC 2253 string format. No standard string format is defined for otherNames, X.400 names, EDI party names, or any other type of names. They are returned as byte arrays containing the ASN.1 DER encoded form of the name.

Note that the Collection returned may contain more than one name of the same type. Also, note that the returned Collection is immutable and any entries containing byte arrays are cloned to protect against subsequent modifications.

This method was added to version 1.4 of the Java 2 Platform Standard Edition. In order to maintain backwards compatibility with existing service providers, this method is not abstract and it provides a default implementation. Subclasses should override this method with a correct implementation. an immutable Collection of subject alternative names (or null)
throws:
  CertificateParsingException - if the extension cannot be decoded
since:
   1.4

Gets the subject (subject distinguished name) value from the certificate. If the subject value is empty, then the getName() method of the returned Principal object returns an empty string ("").

The ASN.1 definition for this is:

 subject    Name
 

See X509Certificate.getIssuerDN() getIssuerDN for Name and other relevant definitions. a Principal whose name is the subject name.

The ASN.1 definition for this is:

 subjectUniqueID  [2]  IMPLICIT UniqueIdentifier OPTIONAL

 UniqueIdentifier  ::=  BIT STRING
 

It is recommended that subclasses override this method. an X500Principal representing the subjectdistinguished name
since:
   1.4

 version  [0] EXPLICIT Version DEFAULT v1

 Version ::=  INTEGER  {  v1(0), v2(1), v3(2)  }