Overview Package Class Use Tree Deprecated Index Help

Prev Class Next Class Frames NoFrames All Classes

Summary: Nested Field Constr Method Detail: Field Constr Method

java.security.cert

Class X509Certificate

public abstract class X509Certificate extends Certificate implements X509Extension

X509Certificate is the abstract class for X.509 certificates. This provides a stanard class interface for accessing all the attributes of X.509 certificates.

In June 1996, the basic X.509 v3 format was finished by ISO/IEC and ANSI X.9. The ASN.1 DER format is below: 

 Certificate  ::=  SEQUENCE  {
   tbsCertificate       TBSCertificate,
   signatureAlgorithm   AlgorithmIdentifier,
   signatureValue       BIT STRING  }

These certificates are widely used in various Internet protocols to support authentication. It is used in Privacy Enhanced Mail (PEM), Transport Layer Security (TLS), Secure Sockets Layer (SSL), code signing for trusted software distribution, and Secure Electronic Transactions (SET).

The certificates are managed and vouched for by Certificate Authorities (CAs). CAs are companies or groups that create certificates by placing the data in the X.509 certificate format and signing it with their private key. CAs serve as trusted third parties by certifying that the person or group specified in the certificate is who they say they are.

The ASN.1 defintion for tbsCertificate is 

 TBSCertificate  ::=  SEQUENCE  {
   version         [0]  EXPLICIT Version DEFAULT v1,
   serialNumber         CertificateSerialNumber,
   signature            AlgorithmIdentifier,
   issuer               Name,
   validity             Validity,
   subject              Name,
   subjectPublicKeyInfo SubjectPublicKeyInfo,
   issuerUniqueID  [1]  IMPLICIT UniqueIdentifier OPTIONAL,
                        -- If present, version shall be v2 or v3
   subjectUniqueID [2]  IMPLICIT UniqueIdentifier OPTIONAL,
                        -- If present, version shall be v2 or v3
   extensions      [3]  EXPLICIT Extensions OPTIONAL
                        -- If present, version shall be v3
 }

 Version  ::=  INTEGER  {  v1(0), v2(1), v3(2)  }

 CertificateSerialNumber  ::=  INTEGER

 Validity ::= SEQUENCE {
   notBefore      Time,
   notAfter       Time }

 Time ::= CHOICE {
   utcTime        UTCTime,
   generalTime    GeneralizedTime }

 UniqueIdentifier  ::=  BIT STRING

 SubjectPublicKeyInfo  ::=  SEQUENCE  {
   algorithm            AlgorithmIdentifier,
   subjectPublicKey     BIT STRING  }

 Extensions  ::=  SEQUENCE SIZE (1..MAX) OF Extension

 Extension  ::=  SEQUENCE  {
   extnID      OBJECT IDENTIFIER,
   critical    BOOLEAN DEFAULT FALSE,
   extnValue   OCTET STRING  }
Certificates are created with the CertificateFactory.

References:

  1. Olivier Dubuisson, Philippe Fouquart (Translator) ASN.1 - Communication between heterogeneous systems, (C) September 2000, Morgan Kaufmann Publishers, ISBN 0-12-6333361-0. Available on-line at http://www.oss.com/asn1/dubuisson.html
  2. R. Housley et al, RFC 3280: Internet X.509 Public Key Infrastructure Certificate and CRL Profile.

Since: 1.2

Constructor Summary
protected X509Certificate()
Constructs a new certificate of the specified type.
Method Summary
abstract voidcheckValidity()
Checks the validity of the X.509 certificate.
abstract voidcheckValidity(Date date)
Checks the validity of the X.509 certificate for the specified time and date.
abstract intgetBasicConstraints()
Returns the certificate constraints path length from the critical BasicConstraints extension, (OID = 2.5.29.19).
List<String>getExtendedKeyUsage()
Returns the ExtendedKeyUsage extension of this certificate, or null if there is no extension present.
Collection<List<?>>getIssuerAlternativeNames()
Returns the alternative names for this certificate's issuer, or null if there are none.
abstract PrincipalgetIssuerDN()
Returns the issuer (issuer distinguished name) of the Certificate.
abstract boolean[]getIssuerUniqueID()
Returns the issuer unique ID for this certificate.
X500PrincipalgetIssuerX500Principal()
Returns the X.500 distinguished name of this certificate's issuer.
abstract boolean[]getKeyUsage()
Returns a boolean array representing the KeyUsage extension for the certificate.
abstract DategetNotAfter()
Returns the date that this certificate is not to be used after, notAfter.
abstract DategetNotBefore()
Returns the date that this certificate is not to be used before, notBefore.
abstract BigIntegergetSerialNumber()
Gets the serial number for serial Number in this Certifcate.
abstract StringgetSigAlgName()
Returns the signature algorithm used to sign the CRL.
abstract StringgetSigAlgOID()
Returns the OID for the signature algorithm used.
abstract byte[]getSigAlgParams()
Returns the AlgorithmParameters in the encoded form for the signature algorithm used.
abstract byte[]getSignature()
Returns the signature in its raw DER encoded format.
Collection<List<?>>getSubjectAlternativeNames()
Returns the alternative names for this certificate's subject (the owner), or null if there are none.
abstract PrincipalgetSubjectDN()
Returns the subject (subject distinguished name) of the Certificate.
abstract boolean[]getSubjectUniqueID()
Returns the subject unique ID for this certificate.
X500PrincipalgetSubjectX500Principal()
Returns the X.500 distinguished name of this certificate's subject.
abstract byte[]getTBSCertificate()
Returns the tbsCertificate from the certificate.
abstract intgetVersion()
Returns the version of this certificate.

Constructor Detail

X509Certificate

protected X509Certificate()
Constructs a new certificate of the specified type.

Method Detail

checkValidity

public abstract void checkValidity()
Checks the validity of the X.509 certificate. It is valid if the current date and time are within the period specified by the certificate. The ASN.1 DER encoding is: validity Validity, Validity ::= SEQUENCE { notBefore Time, notAfter Time } Time ::= CHOICE { utcTime UTCTime, generalTime GeneralizedTime } Consult rfc2459 for more information.

Throws: CertificateExpiredException if the certificate expired CertificateNotYetValidException if the certificate is not yet valid

checkValidity

public abstract void checkValidity(Date date)
Checks the validity of the X.509 certificate for the specified time and date. It is valid if the specified date and time are within the period specified by the certificate.

Throws: CertificateExpiredException if the certificate expired based on the date CertificateNotYetValidException if the certificate is not yet valid based on the date

getBasicConstraints

public abstract int getBasicConstraints()
Returns the certificate constraints path length from the critical BasicConstraints extension, (OID = 2.5.29.19). The basic constraints extensions is used to determine if the subject of the certificate is a Certificate Authority (CA) and how deep the certification path may exist. The pathLenConstraint only takes affect if cA is set to true. "A value of zero indicates that only an end-entity certificate may follow in the path." (rfc2459) The ASN.1 DER encoding is: id-ce-basicConstraints OBJECT IDENTIFIER ::= { id-ce 19 } BasicConstraints ::= SEQUENCE { cA BOOLEAN DEFAULT FALSE, pathLenConstraint INTEGER (0..MAX) OPTIONAL } Consult rfc2459 for more information.

Returns: the length of the path constraint if BasicConstraints is present and cA is TRUE. Otherwise returns -1.

getExtendedKeyUsage

public List<String> getExtendedKeyUsage()
Returns the ExtendedKeyUsage extension of this certificate, or null if there is no extension present. The returned value is a {@link java.util.List} strings representing the object identifiers of the extended key usages. This extension has the OID 2.5.29.37.

The ASN.1 definition for this extension is: 

 
 ExtendedKeyUsage ::= SEQUENCE SIZE (1..MAX) OF KeyPurposeId

 KeyPurposeId ::= OBJECT IDENTIFIER

Returns: The list of extension OIDs, or null if there are none present in this certificate.

Throws: CertificateParsingException If this extension cannot be parsed from its encoded form.

getIssuerAlternativeNames

public Collection<List<?>> getIssuerAlternativeNames()
Returns the alternative names for this certificate's issuer, or null if there are none.

This is an X.509 extension with OID 2.5.29.18, and is defined by the ASN.1 construction: 

 IssuerAltNames ::= GeneralNames

The GeneralNames construct and the form of the returned collection are the same as with {@link #getSubjectAlternativeNames()}.

Returns: The collection of alternative names, or null if there are none.

Throws: CertificateParsingException If the encoded extension cannot be parsed.

Since: JDK 1.4

getIssuerDN

public abstract Principal getIssuerDN()
Returns the issuer (issuer distinguished name) of the Certificate. The issuer is the entity who signed and issued the Certificate. The ASN.1 DER encoding is: issuer Name, Name ::= CHOICE { RDNSequence } RDNSequence ::= SEQUENCE OF RelativeDistinguishedName RelativeDistinguishedName ::= SET OF AttributeTypeAndValue AttributeTypeAndValue ::= SEQUENCE { type AttributeType, value AttributeValue } AttributeType ::= OBJECT IDENTIFIER AttributeValue ::= ANY DEFINED BY AttributeType DirectoryString ::= CHOICE { teletexString TeletexString (SIZE (1..MAX)), printableString PrintableString (SIZE (1..MAX)), universalString UniversalString (SIZE (1..MAX)), utf8String UTF8String (SIZE (1.. MAX)), bmpString BMPString (SIZE (1..MAX)) } Consult rfc2459 for more information.

Returns: the issuer in the Principal class

getIssuerUniqueID

public abstract boolean[] getIssuerUniqueID()
Returns the issuer unique ID for this certificate. The ASN.1 DER encoding is: issuerUniqueID [1] IMPLICIT UniqueIdentifier OPTIONAL, -- If present, version shall be v2 or v3 UniqueIdentifier ::= BIT STRING Consult rfc2459 for more information.

Returns: bit representation of issuerUniqueID

getIssuerX500Principal

public X500Principal getIssuerX500Principal()
Returns the X.500 distinguished name of this certificate's issuer.

Returns: The issuer's X.500 distinguished name.

Since: JDK 1.4

getKeyUsage

public abstract boolean[] getKeyUsage()
Returns a boolean array representing the KeyUsage extension for the certificate. The KeyUsage (OID = 2.5.29.15) defines the purpose of the key in the certificate. The ASN.1 DER encoding is: id-ce-keyUsage OBJECT IDENTIFIER ::= { id-ce 15 } KeyUsage ::= BIT STRING { digitalSignature (0), nonRepudiation (1), keyEncipherment (2), dataEncipherment (3), keyAgreement (4), keyCertSign (5), cRLSign (6), encipherOnly (7), decipherOnly (8) } Consult rfc2459 for more information.

Returns: bit representation of KeyUsage

getNotAfter

public abstract Date getNotAfter()
Returns the date that this certificate is not to be used after, notAfter.

Returns: the date notAfter

getNotBefore

public abstract Date getNotBefore()
Returns the date that this certificate is not to be used before, notBefore. The ASN.1 DER encoding is: validity Validity, Validity ::= SEQUENCE { notBefore Time, notAfter Time } Time ::= CHOICE { utcTime UTCTime, generalTime GeneralizedTime } Consult rfc2459 for more information.

Returns: the date notBefore

getSerialNumber

public abstract BigInteger getSerialNumber()
Gets the serial number for serial Number in this Certifcate. It must be a unique number unique other serial numbers from the granting CA. The ASN.1 DER encoding is: serialNumber CertificateSerialNumber, CertificateSerialNumber ::= INTEGER Consult rfc2459 for more information.

Returns: the serial number for this X509CRLEntry.

getSigAlgName

public abstract String getSigAlgName()
Returns the signature algorithm used to sign the CRL. An examples is "SHA-1/DSA". The ASN.1 DER encoding is: signatureAlgorithm AlgorithmIdentifier, AlgorithmIdentifier ::= SEQUENCE { algorithm OBJECT IDENTIFIER, parameters ANY DEFINED BY algorithm OPTIONAL } Consult rfc2459 for more information. The algorithm name is determined from the OID.

Returns: a string with the signature algorithm name

getSigAlgOID

public abstract String getSigAlgOID()
Returns the OID for the signature algorithm used. Example "1.2.840.10040.4.3" is return for SHA-1 with DSA.\ The ASN.1 DER encoding for the example is: id-dsa-with-sha1 ID ::= { iso(1) member-body(2) us(840) x9-57 (10040) x9cm(4) 3 } Consult rfc2459 for more information.

Returns: a string containing the OID.

getSigAlgParams

public abstract byte[] getSigAlgParams()
Returns the AlgorithmParameters in the encoded form for the signature algorithm used. If access to the parameters is need, create an instance of AlgorithmParameters.

Returns: byte array containing algorithm parameters, null if no parameters are present in certificate

getSignature

public abstract byte[] getSignature()
Returns the signature in its raw DER encoded format. The ASN.1 DER encoding is: signatureValue BIT STRING Consult rfc2459 for more information.

Returns: byte array representing signature

getSubjectAlternativeNames

public Collection<List<?>> getSubjectAlternativeNames()
Returns the alternative names for this certificate's subject (the owner), or null if there are none.

This is an X.509 extension with OID 2.5.29.17 and is defined by the ASN.1 construction: 

 SubjectAltNames ::= GeneralNames

 GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName

 GeneralName ::= CHOICE {
   otherName                 [0]   OtherName,
   rfc822Name                [1]   IA5String,
   dNSName                   [2]   IA5String,
   x400Address               [3]   ORAddress,
   directoryName             [4]   Name,
   ediPartyName              [5]   EDIPartyName,
   uniformResourceIdentifier [6]   IA5String,
   iPAddress                 [7]   OCTET STRING,
   registeredID              [8]   OBJECT IDENTIFIER
 }

The returned collection contains one or more two-element Lists, with the first object being an Integer representing the choice above (with value 0 through 8) and the second being an (a) String if the GeneralName is a rfc822Name, dNSName, uniformResourceIdentifier, iPAddress, or registeredID, or (b) a byte array of the DER encoded form for any others.

Returns: The collection of alternative names, or null if there are none.

Throws: CertificateParsingException If the encoded extension cannot be parsed.

Since: JDK 1.4

getSubjectDN

public abstract Principal getSubjectDN()
Returns the subject (subject distinguished name) of the Certificate. The subject is the entity who the Certificate identifies. The ASN.1 DER encoding is: subject Name, Consult rfc2459 for more information.

Returns: the issuer in the Principal class

getSubjectUniqueID

public abstract boolean[] getSubjectUniqueID()
Returns the subject unique ID for this certificate. The ASN.1 DER encoding is: subjectUniqueID [2] IMPLICIT UniqueIdentifier OPTIONAL, -- If present, version shall be v2 or v3 UniqueIdentifier ::= BIT STRING Consult rfc2459 for more information.

Returns: bit representation of subjectUniqueID

getSubjectX500Principal

public X500Principal getSubjectX500Principal()
Returns the X.500 distinguished name of this certificate's subject.

Returns: The subject's X.500 distinguished name.

Since: JDK 1.4

getTBSCertificate

public abstract byte[] getTBSCertificate()
Returns the tbsCertificate from the certificate.

Returns: the DER encoded tbsCertificate

Throws: CertificateEncodingException if encoding error occurred

getVersion

public abstract int getVersion()
Returns the version of this certificate. The ASN.1 DER encoding is: version [0] EXPLICIT Version DEFAULT v1, Version ::= INTEGER { v1(0), v2(1), v3(2) } Consult rfc2459 for more information.

Returns: version number of certificate

Overview Package Class Use Tree Deprecated Index Help

Prev Class Next Class Frames NoFrames All Classes

Summary: Nested Field Constr Method Detail: Field Constr Method