2 * Licensed to the Apache Software Foundation (ASF) under one or more
3 * contributor license agreements. See the NOTICE file distributed with
4 * this work for additional information regarding copyright ownership.
5 * The ASF licenses this file to You under the Apache License, Version 2.0
6 * (the "License"); you may not use this file except in compliance with
7 * the License. You may obtain a copy of the License at
9 * http://www.apache.org/licenses/LICENSE-2.0
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
18 package java.security.cert;
20 import java.io.ByteArrayInputStream;
21 import java.math.BigInteger;
22 import java.security.Principal;
23 import java.util.Collection;
24 import java.util.Date;
25 import java.util.List;
26 import javax.security.auth.x500.X500Principal;
29 * Abstract base class for X.509 certificates.
31 * This represents a standard way for accessing the attributes of X.509
34 * The basic X.509 v3 format described in ASN.1:
37 * Certificate ::= SEQUENCE {
38 * tbsCertificate TBSCertificate,
39 * signatureAlgorithm AlgorithmIdentifier,
40 * signature BIT STRING }
42 * TBSCertificate ::= SEQUENCE {
43 * version [0] EXPLICIT Version DEFAULT v1,
44 * serialNumber CertificateSerialNumber,
45 * signature AlgorithmIdentifier,
49 * subjectPublicKeyInfo SubjectPublicKeyInfo,
50 * issuerUniqueID [1] IMPLICIT UniqueIdentifier OPTIONAL,
51 * -- If present, version must be v2 or v3
52 * subjectUniqueID [2] IMPLICIT UniqueIdentifier OPTIONAL,
53 * -- If present, version must be v2 or v3
54 * extensions [3] EXPLICIT Extensions OPTIONAL
55 * -- If present, version must be v3
59 * For more information consult RFC 2459
60 * "Internet X.509 Public Key Infrastructure Certificate and CRL Profile" at <a
62 * ="http://www.ietf.org/rfc/rfc2459.txt">http://www.ietf.org/rfc/rfc2459.txt
65 public abstract class X509Certificate
66 extends Certificate implements X509Extension {
68 private static final long serialVersionUID = -2491127588187038216L;
71 * Creates a new {@code X509Certificate}.
73 protected X509Certificate() {
78 * Checks whether the certificate is currently valid.
80 * The validity defined in ASN.1:
85 * Validity ::= SEQUENCE {
86 * notBefore CertificateValidityDate,
87 * notAfter CertificateValidityDate }
89 * CertificateValidityDate ::= CHOICE {
91 * generalTime GeneralizedTime }
94 * @throws CertificateExpiredException
95 * if the certificate has expired.
96 * @throws CertificateNotYetValidException
97 * if the certificate is not yet valid.
99 public abstract void checkValidity()
100 throws CertificateExpiredException, CertificateNotYetValidException;
103 * Checks whether the certificate is valid at the specified date.
106 * the date to check the validity against.
107 * @throws CertificateExpiredException
108 * if the certificate has expired.
109 * @throws CertificateNotYetValidException
110 * if the certificate is not yet valid.
111 * @see #checkValidity()
113 public abstract void checkValidity(Date date)
114 throws CertificateExpiredException, CertificateNotYetValidException;
117 * Returns the certificates {@code version} (version number).
119 * The version defined is ASN.1:
122 * Version ::= INTEGER { v1(0), v2(1), v3(2) }
125 * @return the version number.
127 public abstract int getVersion();
130 * Returns the {@code serialNumber} of the certificate.
132 * The ASN.1 definition of {@code serialNumber}:
135 * CertificateSerialNumber ::= INTEGER
138 * @return the serial number.
140 public abstract BigInteger getSerialNumber();
143 * Returns the {@code issuer} (issuer distinguished name) as an
144 * implementation specific {@code Principal} object.
146 * The ASN.1 definition of {@code issuer}:
154 * RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
156 * RelativeDistinguishedName ::= SET OF AttributeTypeAndValue
158 * AttributeTypeAndValue ::= SEQUENCE {
159 * type AttributeType,
160 * value AttributeValue }
162 * AttributeType ::= OBJECT IDENTIFIER
164 * AttributeValue ::= ANY DEFINED BY AttributeType
167 * <b>replaced by:</b> {@link #getIssuerX500Principal()}.
169 * @return the {@code issuer} as an implementation specific {@code
172 public abstract Principal getIssuerDN() ;
175 * Returns the {@code issuer} (issuer distinguished name) as an {@code
178 * @return the {@code issuer} (issuer distinguished name).
180 public X500Principal getIssuerX500Principal() {
183 // TODO if there is no X.509 certificate provider installed
184 // should we try to access Harmony X509CertImpl via classForName?
185 CertificateFactory factory = CertificateFactory
186 .getInstance("X.509");
188 X509Certificate cert = (X509Certificate) factory
189 .generateCertificate(new ByteArrayInputStream(getEncoded()));
191 return cert.getIssuerX500Principal();
193 } catch (Exception e) {
194 throw new RuntimeException("Failed to get X500Principal issuer", e);
199 * Returns the {@code subject} (subject distinguished name) as an
200 * implementation specific {@code Principal} object.
202 * The ASN.1 definition of {@code subject}:
210 * RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
212 * RelativeDistinguishedName ::= SET OF AttributeTypeAndValue
214 * AttributeTypeAndValue ::= SEQUENCE {
215 * type AttributeType,
216 * value AttributeValue }
218 * AttributeType ::= OBJECT IDENTIFIER
220 * AttributeValue ::= ANY DEFINED BY AttributeType
224 * <b>replaced by:</b> {@link #getSubjectX500Principal()}.
226 * @return the {@code subject} (subject distinguished name).
228 public abstract Principal getSubjectDN();
231 * Returns the {@code subject} (subject distinguished name) as an {@code
234 * @return the {@code subject} (subject distinguished name)
236 public X500Principal getSubjectX500Principal() {
239 // TODO if there is no X.509 certificate provider installed
240 // should we try to access Harmony X509CertImpl via classForName?
241 CertificateFactory factory = CertificateFactory
242 .getInstance("X.509");
244 X509Certificate cert = (X509Certificate) factory
245 .generateCertificate(new ByteArrayInputStream(getEncoded()));
247 return cert.getSubjectX500Principal();
248 } catch (Exception e) {
249 throw new RuntimeException("Failed to get X500Principal subject", e);
254 * Returns the {@code notBefore} date from the validity period of the
257 * @return the start of the validity period.
259 public abstract Date getNotBefore();
262 * Returns the {@code notAfter} date of the validity period of the
265 * @return the end of the validity period.
267 public abstract Date getNotAfter();
270 * Returns the {@code tbsCertificate} information from this certificate in
271 * DER-encoded format.
273 * @return the DER-encoded certificate information.
274 * @throws CertificateEncodingException
275 * if an error occurs in encoding
277 public abstract byte[] getTBSCertificate()
278 throws CertificateEncodingException;
281 * Returns the raw signature bits from the certificate.
283 * @return the raw signature bits from the certificate.
285 public abstract byte[] getSignature();
288 * Returns the name of the algorithm for the certificate signature.
290 * @return the signature algorithm name.
292 public abstract String getSigAlgName();
295 * Returns the OID of the signature algorithm from the certificate.
297 * @return the OID of the signature algorithm.
299 public abstract String getSigAlgOID();
302 * Returns the parameters of the signature algorithm in DER-encoded format.
304 * @return the parameters of the signature algorithm, or {@code null} if
307 public abstract byte[] getSigAlgParams();
310 * Returns the {@code issuerUniqueID} from the certificate.
312 * @return the {@code issuerUniqueID} or {@code null} if there's none in the
315 public abstract boolean[] getIssuerUniqueID();
318 * Returns the {@code subjectUniqueID} from the certificate.
320 * @return the {@code subjectUniqueID} or null if there's none in the
323 public abstract boolean[] getSubjectUniqueID();
326 * Returns the {@code KeyUsage} extension as a {@code boolean} array.
328 * The ASN.1 definition of {@code KeyUsage}:
331 * KeyUsage ::= BIT STRING {
332 * digitalSignature (0),
333 * nonRepudiation (1),
334 * keyEncipherment (2),
335 * dataEncipherment (3),
344 * @return the {@code KeyUsage} extension or {@code null} if there's none in
347 public abstract boolean[] getKeyUsage();
350 * Returns a read-only list of OID strings representing the {@code
351 * ExtKeyUsageSyntax} field of the extended key usage extension.
353 * @return the extended key usage extension, or {@code null} if there's none
354 * in the certificate.
355 * @throws CertificateParsingException
356 * if the extension decoding fails.
358 public List<String> getExtendedKeyUsage()
359 throws CertificateParsingException {
364 * Returns the path length of the certificate constraints from the {@code
365 * BasicContraints} extension.
367 * @return the path length of the certificate constraints if the extension
368 * is present or {@code -1} if the extension is not present. {@code
369 * Integer.MAX_VALUE} if there's not limit.
371 public abstract int getBasicConstraints();
374 * Returns a read-only list of the subject alternative names from the
375 * {@code SubjectAltName} extension.
377 * The ASN.1 definition of {@code SubjectAltName}:
380 * SubjectAltName ::= GeneralNames
382 * GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName
384 * GeneralName ::= CHOICE {
385 * otherName [0] AnotherName,
386 * rfc822Name [1] IA5String,
387 * dNSName [2] IA5String,
388 * x400Address [3] ORAddress,
389 * directoryName [4] Name,
390 * ediPartyName [5] EDIPartyName,
391 * uniformResourceIdentifier [6] IA5String,
392 * iPAddress [7] OCTET STRING,
393 * registeredID [8] OBJECT IDENTIFIER }
397 * @return the subject alternative names or {@code null} if there are none
398 * in the certificate.
399 * @throws CertificateParsingException
400 * if decoding of the extension fails.
402 public Collection<List<?>> getSubjectAlternativeNames()
403 throws CertificateParsingException {
408 * Returns a read-only list of the issuer alternative names from the {@code
409 * IssuerAltName} extension.
411 * The ASN.1 definition of {@code IssuerAltName}:
414 * IssuerAltName ::= GeneralNames
416 * GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName
418 * GeneralName ::= CHOICE {
419 * otherName [0] AnotherName,
420 * rfc822Name [1] IA5String,
421 * dNSName [2] IA5String,
422 * x400Address [3] ORAddress,
423 * directoryName [4] Name,
424 * ediPartyName [5] EDIPartyName,
425 * uniformResourceIdentifier [6] IA5String,
426 * iPAddress [7] OCTET STRING,
427 * registeredID [8] OBJECT IDENTIFIER }
431 * @return the issuer alternative names of {@code null} if there are none in
433 * @throws CertificateParsingException
434 * if decoding of the extension fails.
436 public Collection<List<?>> getIssuerAlternativeNames()
437 throws CertificateParsingException {