-
- All Known Implementing Classes:
- X509Certificate, X509CRL, X509CRLEntry
public interface X509Extension
Interface for an X.509 extension.The extensions defined for X.509 v3
Certificates
and v2CRLs
(Certificate Revocation Lists) provide methods for associating additional attributes with users or public keys, for managing the certification hierarchy, and for managing CRL distribution. The X.509 extensions format also allows communities to define private extensions to carry information unique to those communities.Each extension in a certificate/CRL may be designated as critical or non-critical. A certificate/CRL-using system (an application validating a certificate/CRL) must reject the certificate/CRL if it encounters a critical extension it does not recognize. A non-critical extension may be ignored if it is not recognized.
The ASN.1 definition for this is:
Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension Extension ::= SEQUENCE { extnId OBJECT IDENTIFIER, critical BOOLEAN DEFAULT FALSE, extnValue OCTET STRING -- contains a DER encoding of a value -- of the type registered for use with -- the extnId object identifier value }
Since not all extensions are known, thegetExtensionValue
method returns the DER-encoded OCTET STRING of the extension value (i.e., theextnValue
). This can then be handled by a Class that understands the extension.
-
-
Method Summary
Methods Modifier and Type Method and Description Set<String>
getCriticalExtensionOIDs()
Gets a Set of the OID strings for the extension(s) marked CRITICAL in the certificate/CRL managed by the object implementing this interface.byte[]
getExtensionValue(String oid)
Gets the DER-encoded OCTET string for the extension value (extnValue) identified by the passed-inoid
String.Set<String>
getNonCriticalExtensionOIDs()
Gets a Set of the OID strings for the extension(s) marked NON-CRITICAL in the certificate/CRL managed by the object implementing this interface.boolean
hasUnsupportedCriticalExtension()
Check if there is a critical extension that is not supported.
-
-
-
Method Detail
-
hasUnsupportedCriticalExtension
boolean hasUnsupportedCriticalExtension()
Check if there is a critical extension that is not supported.- Returns:
- true if a critical extension is found that is not supported, otherwise false.
-
getCriticalExtensionOIDs
Set<String> getCriticalExtensionOIDs()
Gets a Set of the OID strings for the extension(s) marked CRITICAL in the certificate/CRL managed by the object implementing this interface. Here is sample code to get a Set of critical extensions from an X509Certificate and print the OIDs:InputStream inStrm = null; X509Certificate cert = null; try { inStrm = new FileInputStream("DER-encoded-Cert"); CertificateFactory cf = CertificateFactory.getInstance("X.509"); cert = (X509Certificate)cf.generateCertificate(inStrm); } finally { if (inStrm != null) { inStrm.close(); } }
Set
critSet = cert.getCriticalExtensionOIDs(); if (critSet != null && !critSet.isEmpty()) { System.out.println("Set of critical extensions:"); for (String oid : critSet) { System.out.println(oid); } } - Returns:
- a Set (or an empty Set if none are marked critical) of the extension OID strings for extensions that are marked critical. If there are no extensions present at all, then this method returns null.
-
getNonCriticalExtensionOIDs
Set<String> getNonCriticalExtensionOIDs()
Gets a Set of the OID strings for the extension(s) marked NON-CRITICAL in the certificate/CRL managed by the object implementing this interface. Here is sample code to get a Set of non-critical extensions from an X509CRL revoked certificate entry and print the OIDs:InputStream inStrm = null; CertificateFactory cf = null; X509CRL crl = null; try { inStrm = new FileInputStream("DER-encoded-CRL"); cf = CertificateFactory.getInstance("X.509"); crl = (X509CRL)cf.generateCRL(inStrm); } finally { if (inStrm != null) { inStrm.close(); } }
byte[] certData = <DER-encoded certificate data> ByteArrayInputStream bais = new ByteArrayInputStream(certData); X509Certificate cert = (X509Certificate)cf.generateCertificate(bais); bais.close(); X509CRLEntry badCert = crl.getRevokedCertificate(cert.getSerialNumber());
if (badCert != null) { Set
nonCritSet = badCert.getNonCriticalExtensionOIDs(); if (nonCritSet != null) for (String oid : nonCritSet) { System.out.println(oid); } }
- Returns:
- a Set (or an empty Set if none are marked non-critical) of the extension OID strings for extensions that are marked non-critical. If there are no extensions present at all, then this method returns null.
-
getExtensionValue
byte[] getExtensionValue(String oid)
Gets the DER-encoded OCTET string for the extension value (extnValue) identified by the passed-inoid
String. Theoid
string is represented by a set of nonnegative whole numbers separated by periods.For example:
OID (Object Identifier) Extension Name 2.5.29.14 SubjectKeyIdentifier 2.5.29.15 KeyUsage 2.5.29.16 PrivateKeyUsage 2.5.29.17 SubjectAlternativeName 2.5.29.18 IssuerAlternativeName 2.5.29.19 BasicConstraints 2.5.29.30 NameConstraints 2.5.29.33 PolicyMappings 2.5.29.35 AuthorityKeyIdentifier 2.5.29.36 PolicyConstraints - Parameters:
oid
- the Object Identifier value for the extension.- Returns:
- the DER-encoded octet string of the extension value or null if it is not present.
-
-
Deutsche Übersetzung
Sie haben gebeten, diese Seite auf Deutsch zu besuchen. Momentan ist nur die Oberfläche übersetzt, aber noch nicht der gesamte Inhalt.Wenn Sie mir bei Übersetzungen helfen wollen, ist Ihr Beitrag willkommen. Alles, was Sie tun müssen, ist, sich auf der Website zu registrieren und mir eine Nachricht zu schicken, in der Sie gebeten werden, Sie der Gruppe der Übersetzer hinzuzufügen, die Ihnen die Möglichkeit gibt, die gewünschten Seiten zu übersetzen. Ein Link am Ende jeder übersetzten Seite zeigt an, dass Sie der Übersetzer sind und einen Link zu Ihrem Profil haben.
Vielen Dank im Voraus.
Dokument erstellt 11/06/2005, zuletzt geändert 04/03/2020
Quelle des gedruckten Dokuments:https://www.gaudry.be/de/java-api-rf-java/security/cert/X509Extension.html
Die Infobro ist eine persönliche Seite, deren Inhalt in meiner alleinigen Verantwortung liegt. Der Text ist unter der CreativeCommons-Lizenz (BY-NC-SA) verfügbar. Weitere Informationen auf die Nutzungsbedingungen und dem Autor.
Referenzen
Diese Verweise und Links verweisen auf Dokumente, die während des Schreibens dieser Seite konsultiert wurden, oder die zusätzliche Informationen liefern können, aber die Autoren dieser Quellen können nicht für den Inhalt dieser Seite verantwortlich gemacht werden.
Der Autor Diese Website ist allein dafür verantwortlich, wie die verschiedenen Konzepte und Freiheiten, die mit den Nachschlagewerken gemacht werden, hier dargestellt werden. Denken Sie daran, dass Sie mehrere Quellinformationen austauschen müssen, um das Risiko von Fehlern zu reduzieren.