Interface X509Extension

Method Detail

• hasUnsupportedCriticalExtension

  boolean hasUnsupportedCriticalExtension()

  Check if there is a critical extension that is not supported.

  Returns:

  true if a critical extension is found that is not supported, otherwise false.

• getCriticalExtensionOIDs

  Set<String> getCriticalExtensionOIDs()

  Gets a Set of the OID strings for the extension(s) marked CRITICAL in the certificate/CRL managed by the object implementing this interface. Here is sample code to get a Set of critical extensions from an X509Certificate and print the OIDs:

  
   InputStream inStrm = null;
   X509Certificate cert = null;
   try {
       inStrm = new FileInputStream("DER-encoded-Cert");
       CertificateFactory cf = CertificateFactory.getInstance("X.509");
       cert = (X509Certificate)cf.generateCertificate(inStrm);
   } finally {
       if (inStrm != null) {
           inStrm.close();
       }
   }
  
  
   Set critSet = cert.getCriticalExtensionOIDs();
   if (critSet != null && !critSet.isEmpty()) {
       System.out.println("Set of critical extensions:");
       for (String oid : critSet) {
           System.out.println(oid);
       }
   }
   

  Returns:

  a Set (or an empty Set if none are marked critical) of the extension OID strings for extensions that are marked critical. If there are no extensions present at all, then this method returns null.

• getNonCriticalExtensionOIDs

  Set<String> getNonCriticalExtensionOIDs()

  Gets a Set of the OID strings for the extension(s) marked NON-CRITICAL in the certificate/CRL managed by the object implementing this interface. Here is sample code to get a Set of non-critical extensions from an X509CRL revoked certificate entry and print the OIDs:

  
   InputStream inStrm = null;
   CertificateFactory cf = null;
   X509CRL crl = null;
   try {
       inStrm = new FileInputStream("DER-encoded-CRL");
       cf = CertificateFactory.getInstance("X.509");
       crl = (X509CRL)cf.generateCRL(inStrm);
   } finally {
       if (inStrm != null) {
           inStrm.close();
       }
   }
  
  
   byte[] certData = <DER-encoded certificate data>
   ByteArrayInputStream bais = new ByteArrayInputStream(certData);
   X509Certificate cert = (X509Certificate)cf.generateCertificate(bais);
   bais.close();
   X509CRLEntry badCert =
                crl.getRevokedCertificate(cert.getSerialNumber());
  
  
   if (badCert != null) {
       Set nonCritSet = badCert.getNonCriticalExtensionOIDs();
  
       if (nonCritSet != null)
           for (String oid : nonCritSet) {
               System.out.println(oid);
           }
   }
   

  Returns:

  a Set (or an empty Set if none are marked non-critical) of the extension OID strings for extensions that are marked non-critical. If there are no extensions present at all, then this method returns null.

• getExtensionValue

  byte[] getExtensionValue(String oid)

  Gets the DER-encoded OCTET string for the extension value (extnValue) identified by the passed-in oid String. The oid string is represented by a set of nonnegative whole numbers separated by periods.

  For example:
  

  OID (Object Identifier)	Extension Name
  2.5.29.14	SubjectKeyIdentifier
  2.5.29.15	KeyUsage
  2.5.29.16	PrivateKeyUsage
  2.5.29.17	SubjectAlternativeName
  2.5.29.18	IssuerAlternativeName
  2.5.29.19	BasicConstraints
  2.5.29.30	NameConstraints
  2.5.29.33	PolicyMappings
  2.5.29.35	AuthorityKeyIdentifier
  2.5.29.36	PolicyConstraints

    

  Parameters:

  oid - the Object Identifier value for the extension.

  Returns:

  the DER-encoded octet string of the extension value or null if it is not present.