Java Doc for X509Extension.java in  » 6.0-JDK-Modules » j2me » java » security » cert » Java Source Code / Java DocumentationJava Source Code and Java Documentation

The extensions defined for X.509 v3 X509Certificate Certificates and v2 X509CRL CRLs (Certificate Revocation Lists) provide methods for associating additional attributes with users or public keys, for managing the certification hierarchy, and for managing CRL distribution. The X.509 extensions format also allows communities to define private extensions to carry information unique to those communities.

Each extension in a certificate/CRL may be designated as critical or non-critical. A certificate/CRL-using system (an application validating a certificate/CRL) must reject the certificate/CRL if it encounters a critical extension it does not recognize. A non-critical extension may be ignored if it is not recognized.

The ASN.1 definition for this is:

 Extensions  ::=  SEQUENCE SIZE (1..MAX) OF Extension
 Extension  ::=  SEQUENCE  {
 extnId        OBJECT IDENTIFIER,
 critical      BOOLEAN DEFAULT FALSE,
 extnValue     OCTET STRING
 -- contains a DER encoding of a value
 -- of the type registered for use with
 -- the extnId object identifier value
 }
 

For example:

OID (Object Identifier)	Extension Name
2.5.29.14	SubjectKeyIdentifier
2.5.29.15	KeyUsage
2.5.29.16	PrivateKeyUsage
2.5.29.17	SubjectAlternativeName
2.5.29.18	IssuerAlternativeName
2.5.29.19	BasicConstraints
2.5.29.30	NameConstraints
2.5.29.33	PolicyMappings
2.5.29.35	AuthorityKeyIdentifier
2.5.29.36	PolicyConstraints

Parameters:
  oid - the Object Identifier value for the extension.

 InputStream inStrm = new FileInputStream("DER-encoded-Cert");
 CertificateFactory cf = CertificateFactory.getInstance("X.509");
 X509Certificate cert = (X509Certificate)cf.generateCertificate(inStrm);
 inStrm.close();

 Set critSet = cert.getCriticalExtensionOIDs();
 if (critSet != null && !critSet.isEmpty()) {
 System.out.println("Set of critical extensions:");
 for (Iterator i = critSet.iterator(); i.hasNext();) {
 String oid = (String)i.next();
 System.out.println(oid);
 }
 }
 

For example:

OID (Object Identifier)	Extension Name
2.5.29.14	SubjectKeyIdentifier
2.5.29.15	KeyUsage
2.5.29.16	PrivateKeyUsage
2.5.29.17	SubjectAlternativeName
2.5.29.18	IssuerAlternativeName
2.5.29.19	BasicConstraints
2.5.29.30	NameConstraints
2.5.29.33	PolicyMappings
2.5.29.35	AuthorityKeyIdentifier
2.5.29.36	PolicyConstraints

Parameters:
  oid - the Object Identifier value for the extension. the DER-encoded octet string of the extension value ornull if it is not present.

 InputStream inStrm = new FileInputStream("DER-encoded-CRL");
 CertificateFactory cf = CertificateFactory.getInstance("X.509");
 X509CRL crl = (X509CRL)cf.generateCRL(inStrm);
 inStrm.close();

 byte[] certData = <DER-encoded certificate data>
 ByteArrayInputStream bais = new ByteArrayInputStream(certData);
 X509Certificate cert = (X509Certificate)cf.generateCertificate(bais);
 bais.close();
 X509CRLEntry badCert =
 crl.getRevokedCertificate(cert.getSerialNumber());

 if (badCert != null) {
 Set nonCritSet = badCert.getNonCriticalExtensionOIDs();

 if (nonCritSet != null)
 for (Iterator i = nonCritSet.iterator(); i.hasNext();) {
 String oid = (String)i.next();
 System.out.println(oid);
 }
 }