java.lang.Objectjavax.security.cert.Certificate
javax.security.cert.X509Certificate
public abstract class X509Certificate
Abstract class for X.509 v1 certificates. This provides a standard way to access all the version 1 attributes of an X.509 certificate. Attributes that are specific to X.509 v2 or v3 are not available through this interface. Future API evolution will provide full access to complete X.509 v3 attributes.
The basic X.509 format was defined by ISO/IEC and ANSI X9 and is described below in ASN.1:
Certificate ::= SEQUENCE { tbsCertificate TBSCertificate, signatureAlgorithm AlgorithmIdentifier, signature BIT STRING }
These certificates are widely used to support authentication and other functionality in Internet security systems. Common applications include Privacy Enhanced Mail (PEM), Transport Layer Security (SSL), code signing for trusted software distribution, and Secure Electronic Transactions (SET).
These certificates are managed and vouched for by Certificate Authorities (CAs). CAs are services which create certificates by placing data in the X.509 standard format and then digitally signing that data. CAs act as trusted third parties, making introductions between principals who have no direct knowledge of each other. CA certificates are either signed by themselves, or by some other CA such as a "root" CA.
The ASN.1 definition of tbsCertificate is:
TBSCertificate ::= SEQUENCE { version [0] EXPLICIT Version DEFAULT v1, serialNumber CertificateSerialNumber, signature AlgorithmIdentifier, issuer Name, validity Validity, subject Name, subjectPublicKeyInfo SubjectPublicKeyInfo, }
Here is sample code to instantiate an X.509 certificate:
InputStream inStream = new FileInputStream("fileName-of-cert"); X509Certificate cert = X509Certificate.getInstance(inStream); inStream.close();OR
byte[] certData = <certificate read from a file, say> X509Certificate cert = X509Certificate.getInstance(certData);
In either case, the code that instantiates an X.509 certificate consults the Java security properties file to locate the actual implementation or instantiates a default implementation.
The Java security properties file is located in the file named
<JAVA_HOME>/lib/security/java.security.
<JAVA_HOME>/lib/security/java.security, where
<JAVA_HOME> refers to the
value of the java.home system property, and specifies the
directory where the
JRE is
JDK was
installed. In the Security properties file, a default implementation for X.509 v1 may be given such as:
cert.provider.x509v1=com.sun.security.cert.internal.x509.X509V1CertImpl
The value of this cert.provider.x509v1 property has to be changed to instatiate another implementation. If this security property is not set, a default implementation will be used. Currently, due to possible security restrictions on access to Security properties, this value is looked up and cached at class initialization time and will fallback on a default implementation if the Security property is not accessible.
Note: The classes in the package javax.security.cert exist for compatibility with earlier versions of the Java Secure Sockets Extension (JSSE). New applications should instead use the standard J2SE certificate classes located in java.security.cert.
Constructor Summary | |
---|---|
X509Certificate
() |
Method Summary | |
---|---|
abstract void |
checkValidity
() Checks that the certificate is currently valid. |
abstract void |
checkValidity
(
Date
date) Checks that the specified date is within the certificate's validity period. |
static X509Certificate |
getInstance
(byte[] certData) Instantiates an X509Certificate object, and initializes it with the specified byte array. |
static X509Certificate |
getInstance
(
InputStream
inStream) Instantiates an X509Certificate object, and initializes it with the data read from the input stream inStream. |
abstract Principal |
getIssuerDN
() Gets the issuer (issuer distinguished name) value from the certificate. |
abstract Date |
getNotAfter
() Gets the notAfter date from the validity period of the certificate. |
abstract Date |
getNotBefore
() Gets the notBefore date from the validity period of the certificate. |
abstract BigInteger |
getSerialNumber
() Gets the serialNumber value from the certificate. |
abstract String |
getSigAlgName
() Gets the signature algorithm name for the certificate signature algorithm. |
abstract String |
getSigAlgOID
() Gets the signature algorithm OID string from the certificate. |
abstract byte[] |
getSigAlgParams
() Gets the DER-encoded signature algorithm parameters from this certificate's signature algorithm. |
abstract Principal |
getSubjectDN
() Gets the subject (subject distinguished name) value from the certificate. |
abstract int |
getVersion
() Gets the version (version number) value from the certificate. |
Methods inherited from class javax.security.cert. Certificate |
---|
equals , getEncoded , getPublicKey , hashCode , toString , verify , verify |
Methods inherited from class java.lang. Object |
---|
clone , finalize , getClass , notify , notifyAll , wait , wait , wait |
Constructor Detail |
---|
public X509Certificate()
Method Detail |
---|
public static final X509Certificate getInstance(InputStream inStream) throws CertificateException
Note: Only one DER-encoded certificate is expected to be in the input stream. Also, all X509Certificate subclasses must provide a constructor of the form:
public <subClass>(InputStream inStream) ...
public static final X509Certificate getInstance(byte[] certData) throws CertificateException
Note: All X509Certificate subclasses must provide a constructor of the form:
public <subClass>(InputStream inStream) ...
public abstract void checkValidity() throws CertificateExpiredException, CertificateNotYetValidException
The validity period consists of two date/time values: the first and last dates (and times) on which the certificate is valid. It is defined in ASN.1 as:
validity ValidityValidity ::= SEQUENCE { notBefore CertificateValidityDate, notAfter CertificateValidityDate }
CertificateValidityDate ::= CHOICE { utcTime UTCTime, generalTime GeneralizedTime }
public abstract void checkValidity(Date date) throws CertificateExpiredException, CertificateNotYetValidException
public abstract int getVersion()
version [0] EXPLICIT Version DEFAULT v1Version ::= INTEGER { v1(0), v2(1), v3(2) }
public abstract BigInteger getSerialNumber()
serialNumber CertificateSerialNumberCertificateSerialNumber ::= INTEGER
public abstract Principal getIssuerDN()
The issuer name field contains an X.500 distinguished name (DN). The ASN.1 definition for this is:
issuer NameThe Name describes a hierarchical name composed of attributes, such as country name, and corresponding values, such as US. The type of the AttributeValue component is determined by the AttributeType; in general it will be a directoryString. A directoryString is usually one of PrintableString, TeletexString or UniversalString.Name ::= CHOICE { RDNSequence } RDNSequence ::= SEQUENCE OF RelativeDistinguishedName RelativeDistinguishedName ::= SET OF AttributeValueAssertion AttributeValueAssertion ::= SEQUENCE { AttributeType, AttributeValue } AttributeType ::= OBJECT IDENTIFIER AttributeValue ::= ANY
public abstract Principal getSubjectDN()
subject Name
See getIssuerDN for Name and other relevant definitions.
public abstract Date getNotBefore()
validity ValidityValidity ::= SEQUENCE { notBefore CertificateValidityDate, notAfter CertificateValidityDate }
CertificateValidityDate ::= CHOICE { utcTime UTCTime, generalTime GeneralizedTime }
public abstract Date getNotAfter()
public abstract String getSigAlgName()
signatureAlgorithm AlgorithmIdentifierAlgorithmIdentifier ::= SEQUENCE { algorithm OBJECT IDENTIFIER, parameters ANY DEFINED BY algorithm OPTIONAL } -- contains a value of the type -- registered for use with the -- algorithm object identifier value
The algorithm name is determined from the algorithm OID string.
public abstract String getSigAlgOID()
See getSigAlgName for relevant ASN.1 definitions.
public abstract byte[] getSigAlgParams()
See getSigAlgName for relevant ASN.1 definitions.