1 |
/* X509Certificate.java --- X.509 Certificate class |
/* X509Certificate.java --- X.509 Certificate class |
2 |
Copyright (C) 1999 Free Software Foundation, Inc. |
Copyright (C) 1999,2003 Free Software Foundation, Inc. |
3 |
|
|
4 |
This file is part of GNU Classpath. |
This file is part of GNU Classpath. |
5 |
|
|
37 |
|
|
38 |
|
|
39 |
package java.security.cert; |
package java.security.cert; |
40 |
|
|
41 |
import java.math.BigInteger; |
import java.math.BigInteger; |
42 |
import java.security.Principal; |
import java.security.Principal; |
43 |
import java.security.PublicKey; |
import java.security.PublicKey; |
48 |
import java.util.Date; |
import java.util.Date; |
49 |
|
|
50 |
/** |
/** |
51 |
X509Certificate is the abstract class for X.509 certificates. |
* X509Certificate is the abstract class for X.509 certificates. |
52 |
This provides a stanard class interface for accessing all |
* This provides a stanard class interface for accessing all |
53 |
the attributes of X.509 certificates. |
* the attributes of X.509 certificates. |
54 |
|
* |
55 |
In June 1996, the basic X.509 v3 format was finished by |
* <p>In June 1996, the basic X.509 v3 format was finished by |
56 |
ISO/IEC and ANSI X.9. The ASN.1 DER format is below: |
* ISO/IEC and ANSI X.9. The ASN.1 DER format is below: |
57 |
|
* |
58 |
Certificate ::= SEQUENCE { |
* <blockquote><pre> |
59 |
tbsCertificate TBSCertificate, |
* Certificate ::= SEQUENCE { |
60 |
signatureAlgorithm AlgorithmIdentifier, |
* tbsCertificate TBSCertificate, |
61 |
signatureValue BIT STRING } |
* signatureAlgorithm AlgorithmIdentifier, |
62 |
|
* signatureValue BIT STRING } |
63 |
These certificates are widely used in various Internet |
* </pre></blockquote> |
64 |
protocols to support authentication. It is used in |
* |
65 |
Privacy Enhanced Mail (PEM), Transport Layer Security (TLS), |
* <p>These certificates are widely used in various Internet |
66 |
Secure Sockets Layer (SSL), code signing for trusted software |
* protocols to support authentication. It is used in |
67 |
distribution, and Secure Electronic Transactions (SET). |
* Privacy Enhanced Mail (PEM), Transport Layer Security (TLS), |
68 |
|
* Secure Sockets Layer (SSL), code signing for trusted software |
69 |
The certificates are managed and vouched for by |
* distribution, and Secure Electronic Transactions (SET). |
70 |
<I>Certificate Authorities</I> (CAs). CAs are companies or |
* |
71 |
groups that create certificates by placing the data in the |
* <p>The certificates are managed and vouched for by |
72 |
X.509 certificate format and signing it with their private |
* <I>Certificate Authorities</I> (CAs). CAs are companies or |
73 |
key. CAs serve as trusted third parties by certifying that |
* groups that create certificates by placing the data in the |
74 |
the person or group specified in the certificate is who |
* X.509 certificate format and signing it with their private |
75 |
they say they are. |
* key. CAs serve as trusted third parties by certifying that |
76 |
|
* the person or group specified in the certificate is who |
77 |
The ASN.1 defintion for <I>tbsCertificate</I> is |
* they say they are. |
78 |
|
* |
79 |
TBSCertificate ::= SEQUENCE { |
* <p>The ASN.1 defintion for <I>tbsCertificate</I> is |
80 |
version [0] EXPLICIT Version DEFAULT v1, |
* |
81 |
serialNumber CertificateSerialNumber, |
* <blockquote><pre> |
82 |
signature AlgorithmIdentifier, |
* TBSCertificate ::= SEQUENCE { |
83 |
issuer Name, |
* version [0] EXPLICIT Version DEFAULT v1, |
84 |
validity Validity, |
* serialNumber CertificateSerialNumber, |
85 |
subject Name, |
* signature AlgorithmIdentifier, |
86 |
subjectPublicKeyInfo SubjectPublicKeyInfo, |
* issuer Name, |
87 |
issuerUniqueID [1] IMPLICIT UniqueIdentifier OPTIONAL, |
* validity Validity, |
88 |
-- If present, version shall be v2 or v3 |
* subject Name, |
89 |
subjectUniqueID [2] IMPLICIT UniqueIdentifier OPTIONAL, |
* subjectPublicKeyInfo SubjectPublicKeyInfo, |
90 |
-- If present, version shall be v2 or v3 |
* issuerUniqueID [1] IMPLICIT UniqueIdentifier OPTIONAL, |
91 |
extensions [3] EXPLICIT Extensions OPTIONAL |
* -- If present, version shall be v2 or v3 |
92 |
-- If present, version shall be v3 |
* subjectUniqueID [2] IMPLICIT UniqueIdentifier OPTIONAL, |
93 |
} |
* -- If present, version shall be v2 or v3 |
94 |
|
* extensions [3] EXPLICIT Extensions OPTIONAL |
95 |
Version ::= INTEGER { v1(0), v2(1), v3(2) } |
* -- If present, version shall be v3 |
96 |
|
* } |
97 |
CertificateSerialNumber ::= INTEGER |
* |
98 |
|
* Version ::= INTEGER { v1(0), v2(1), v3(2) } |
99 |
Validity ::= SEQUENCE { |
* |
100 |
notBefore Time, |
* CertificateSerialNumber ::= INTEGER |
101 |
notAfter Time } |
* |
102 |
|
* Validity ::= SEQUENCE { |
103 |
Time ::= CHOICE { |
* notBefore Time, |
104 |
utcTime UTCTime, |
* notAfter Time } |
105 |
generalTime GeneralizedTime } |
* |
106 |
|
* Time ::= CHOICE { |
107 |
UniqueIdentifier ::= BIT STRING |
* utcTime UTCTime, |
108 |
|
* generalTime GeneralizedTime } |
109 |
SubjectPublicKeyInfo ::= SEQUENCE { |
* |
110 |
algorithm AlgorithmIdentifier, |
* UniqueIdentifier ::= BIT STRING |
111 |
subjectPublicKey BIT STRING } |
* |
112 |
|
* SubjectPublicKeyInfo ::= SEQUENCE { |
113 |
Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension |
* algorithm AlgorithmIdentifier, |
114 |
|
* subjectPublicKey BIT STRING } |
115 |
Extension ::= SEQUENCE { |
* |
116 |
extnID OBJECT IDENTIFIER, |
* Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension |
117 |
critical BOOLEAN DEFAULT FALSE, |
* |
118 |
extnValue OCTET STRING } |
* Extension ::= SEQUENCE { |
119 |
|
* extnID OBJECT IDENTIFIER, |
120 |
|
* critical BOOLEAN DEFAULT FALSE, |
121 |
Certificates are created with the CertificateFactory. |
* extnValue OCTET STRING } |
122 |
For more information about X.509 certificates, consult |
* </pre></blockquote> |
123 |
rfc2459. |
* |
124 |
|
* Certificates are created with the CertificateFactory. |
125 |
@since JDK 1.2 |
* |
126 |
|
* <p>References: |
127 |
@author Mark Benvenuto |
* |
128 |
*/ |
* <ol> |
129 |
|
* <li>Olivier Dubuisson, Philippe Fouquart (Translator) <i>ASN.1 - |
130 |
|
* Communication between heterogeneous systems</i>, (C) September 2000, |
131 |
|
* Morgan Kaufmann Publishers, ISBN 0-12-6333361-0. Available on-line at |
132 |
|
* <a |
133 |
|
* href="http://www.oss.com/asn1/dubuisson.html">http://www.oss.com/asn1/dubuisson.html</a></li> |
134 |
|
* <li>R. Housley et al, <i><a href="http://www.ietf.org/rfc/rfc3280.txt">RFC |
135 |
|
* 3280: Internet X.509 Public Key Infrastructure Certificate and CRL |
136 |
|
* Profile</a></i>.</li> |
137 |
|
* </ol> |
138 |
|
* |
139 |
|
* @since JDK 1.2 |
140 |
|
* @author Mark Benvenuto |
141 |
|
* @author Casey Marshall (rsdio@metastatic.org) |
142 |
|
*/ |
143 |
public abstract class X509Certificate extends Certificate implements X509Extension |
public abstract class X509Certificate extends Certificate implements X509Extension |
144 |
{ |
{ |
145 |
|
|
146 |
/** |
/** |
147 |
Constructs a new certificate of the specified type. |
* Constructs a new certificate of the specified type. |
148 |
*/ |
*/ |
149 |
protected X509Certificate() |
protected X509Certificate() |
150 |
{ |
{ |
151 |
super( "X.509" ); |
super( "X.509" ); |
466 |
*/ |
*/ |
467 |
public abstract int getBasicConstraints(); |
public abstract int getBasicConstraints(); |
468 |
|
|
469 |
|
// 1.4 instance methods. |
470 |
|
// ------------------------------------------------------------------------ |
471 |
|
|
472 |
|
/** |
473 |
|
* Returns the <code>ExtendedKeyUsage</code> extension of this |
474 |
|
* certificate, or null if there is no extension present. The returned |
475 |
|
* value is a {@link java.util.List} strings representing the object |
476 |
|
* identifiers of the extended key usages. This extension has the OID |
477 |
|
* 2.5.29.37. |
478 |
|
* |
479 |
|
* <p>The ASN.1 definition for this extension is: |
480 |
|
* |
481 |
|
* <blockquote><pre> |
482 |
|
* ExtendedKeyUsage ::= SEQUENCE SIZE (1..MAX) OF KeyPurposeId |
483 |
|
* |
484 |
|
* KeyPurposeId ::= OBJECT IDENTIFIER |
485 |
|
* </pre></blockquote> |
486 |
|
* |
487 |
|
* @return The list of extension OIDs, or null if there are none |
488 |
|
* present in this certificate. |
489 |
|
* @throws CertificateParsingException If this extension cannot be |
490 |
|
* parsed from its encoded form. |
491 |
|
*/ |
492 |
|
public java.util.List getExtendedKeyUsage() |
493 |
|
throws CertificateParsingException |
494 |
|
{ |
495 |
|
throw new UnsupportedOperationException(); |
496 |
|
} |
497 |
|
|
498 |
|
/** |
499 |
|
* Returns the alternative names for this certificate's subject (the |
500 |
|
* owner), or null if there are none. |
501 |
|
* |
502 |
|
* <p>This is an X.509 extension with OID 2.5.29.17 and is defined by |
503 |
|
* the ASN.1 construction: |
504 |
|
* |
505 |
|
* <blockquote><pre> |
506 |
|
* SubjectAltNames ::= GeneralNames |
507 |
|
* |
508 |
|
* GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName |
509 |
|
* |
510 |
|
* GeneralName ::= CHOICE { |
511 |
|
* otherName [0] OtherName, |
512 |
|
* rfc822Name [1] IA5String, |
513 |
|
* dNSName [2] IA5String, |
514 |
|
* x400Address [3] ORAddress, |
515 |
|
* directoryName [4] Name, |
516 |
|
* ediPartyName [5] EDIPartyName, |
517 |
|
* uniformResourceIdentifier [6] IA5String, |
518 |
|
* iPAddress [7] OCTET STRING, |
519 |
|
* registeredID [8] OBJECT IDENTIFIER |
520 |
|
* } |
521 |
|
* </pre></blockquote> |
522 |
|
* |
523 |
|
* <p>The returned collection contains one or more two-element Lists, |
524 |
|
* with the first object being an Integer representing the choice |
525 |
|
* above (with value 0 through 8) and the second being an (a) String |
526 |
|
* if the <code>GeneralName</code> is a rfc822Name, dNSName, |
527 |
|
* uniformResourceIdentifier, iPAddress, or registeredID, or (b) a |
528 |
|
* byte array of the DER encoded form for any others. |
529 |
|
* |
530 |
|
* @return The collection of alternative names, or null if there are |
531 |
|
* none. |
532 |
|
* @throws CertificateParsingException If the encoded extension cannot |
533 |
|
* be parsed. |
534 |
|
* @since JDK 1.4 |
535 |
|
*/ |
536 |
|
public java.util.Collection getSubjectAlternativeNames() |
537 |
|
throws CertificateParsingException |
538 |
|
{ |
539 |
|
throw new UnsupportedOperationException(); |
540 |
|
} |
541 |
|
|
542 |
|
/** |
543 |
|
* Returns the alternative names for this certificate's issuer, or |
544 |
|
* null if there are none. |
545 |
|
* |
546 |
|
* <p>This is an X.509 extension with OID 2.5.29.18, and is defined by |
547 |
|
* the ASN.1 construction: |
548 |
|
* |
549 |
|
* <blockquote><pre> |
550 |
|
* IssuerAltNames ::= GeneralNames |
551 |
|
* </pre></blockquote> |
552 |
|
* |
553 |
|
* <p>The <code>GeneralNames</code> construct and the form of the |
554 |
|
* returned collection are the same as with {@link |
555 |
|
* #getSubjectAlternativeNames()}. |
556 |
|
* |
557 |
|
* @return The collection of alternative names, or null if there are |
558 |
|
* none. |
559 |
|
* @throws CertificateParsingException If the encoded extension cannot |
560 |
|
* be parsed. |
561 |
|
* @since JDK 1.4 |
562 |
|
*/ |
563 |
|
public java.util.Collection getIssuerAlternativeNames() |
564 |
|
throws CertificateParsingException |
565 |
|
{ |
566 |
|
throw new UnsupportedOperationException(); |
567 |
|
} |
568 |
|
|
569 |
|
/** |
570 |
|
* Returns the X.500 distinguished name of this certificate's subject. |
571 |
|
* |
572 |
|
* @return The subject's X.500 distinguished name. |
573 |
|
* @since JDK 1.4 |
574 |
|
*/ |
575 |
|
public javax.security.auth.x500.X500Principal getSubjectX500Principal() |
576 |
|
{ |
577 |
|
throw new UnsupportedOperationException(); |
578 |
|
} |
579 |
|
|
580 |
|
/** |
581 |
|
* Returns the X.500 distinguished name of this certificate's issuer. |
582 |
|
* |
583 |
|
* @return The issuer's X.500 distinguished name. |
584 |
|
* @since JDK 1.4 |
585 |
|
*/ |
586 |
|
public javax.security.auth.x500.X500Principal getIssuerX500Principal() |
587 |
|
{ |
588 |
|
throw new UnsupportedOperationException(); |
589 |
|
} |
590 |
} |
} |