java.security.cert

Interface X509Extension

  • All Known Implementing Classes:
    X509Certificate, X509CRL, X509CRLEntry

    public interface X509Extension
    Interface for an X.509 extension.

    The extensions defined for X.509 v3 Certificates and v2 CRLs (Certificate Revocation Lists) provide methods for associating additional attributes with users or public keys, for managing the certification hierarchy, and for managing CRL distribution. The X.509 extensions format also allows communities to define private extensions to carry information unique to those communities.

    Each extension in a certificate/CRL may be designated as critical or non-critical. A certificate/CRL-using system (an application validating a certificate/CRL) must reject the certificate/CRL if it encounters a critical extension it does not recognize. A non-critical extension may be ignored if it is not recognized.

    The ASN.1 definition for this is:

     Extensions  ::=  SEQUENCE SIZE (1..MAX) OF Extension
    
     Extension  ::=  SEQUENCE  {
         extnId        OBJECT IDENTIFIER,
         critical      BOOLEAN DEFAULT FALSE,
         extnValue     OCTET STRING
                       -- contains a DER encoding of a value
                       -- of the type registered for use with
                       -- the extnId object identifier value
     }
     
    Since not all extensions are known, the getExtensionValue method returns the DER-encoded OCTET STRING of the extension value (i.e., the extnValue). This can then be handled by a Class that understands the extension.
    • Method Summary

      Methods 
      Modifier and Type Method and Description
      Set<String> getCriticalExtensionOIDs()
      Gets a Set of the OID strings for the extension(s) marked CRITICAL in the certificate/CRL managed by the object implementing this interface.
      byte[] getExtensionValue(String oid)
      Gets the DER-encoded OCTET string for the extension value (extnValue) identified by the passed-in oid String.
      Set<String> getNonCriticalExtensionOIDs()
      Gets a Set of the OID strings for the extension(s) marked NON-CRITICAL in the certificate/CRL managed by the object implementing this interface.
      boolean hasUnsupportedCriticalExtension()
      Check if there is a critical extension that is not supported.

        

    • Method Detail

      • hasUnsupportedCriticalExtension

        boolean hasUnsupportedCriticalExtension()
        Check if there is a critical extension that is not supported.
        Returns:
        true if a critical extension is found that is not supported, otherwise false.
      • getCriticalExtensionOIDs

        Set<String> getCriticalExtensionOIDs()
        Gets a Set of the OID strings for the extension(s) marked CRITICAL in the certificate/CRL managed by the object implementing this interface. Here is sample code to get a Set of critical extensions from an X509Certificate and print the OIDs:
        
         InputStream inStrm = null;
         X509Certificate cert = null;
         try {
             inStrm = new FileInputStream("DER-encoded-Cert");
             CertificateFactory cf = CertificateFactory.getInstance("X.509");
             cert = (X509Certificate)cf.generateCertificate(inStrm);
         } finally {
             if (inStrm != null) {
                 inStrm.close();
             }
         }

        Set critSet = cert.getCriticalExtensionOIDs(); if (critSet != null && !critSet.isEmpty()) { System.out.println("Set of critical extensions:"); for (String oid : critSet) { System.out.println(oid); } }

        Returns:
        a Set (or an empty Set if none are marked critical) of the extension OID strings for extensions that are marked critical. If there are no extensions present at all, then this method returns null.
      • getNonCriticalExtensionOIDs

        Set<String> getNonCriticalExtensionOIDs()
        Gets a Set of the OID strings for the extension(s) marked NON-CRITICAL in the certificate/CRL managed by the object implementing this interface. Here is sample code to get a Set of non-critical extensions from an X509CRL revoked certificate entry and print the OIDs:
        
         InputStream inStrm = null;
         CertificateFactory cf = null;
         X509CRL crl = null;
         try {
             inStrm = new FileInputStream("DER-encoded-CRL");
             cf = CertificateFactory.getInstance("X.509");
             crl = (X509CRL)cf.generateCRL(inStrm);
         } finally {
             if (inStrm != null) {
                 inStrm.close();
             }
         }

        byte[] certData = <DER-encoded certificate data> ByteArrayInputStream bais = new ByteArrayInputStream(certData); X509Certificate cert = (X509Certificate)cf.generateCertificate(bais); bais.close(); X509CRLEntry badCert = crl.getRevokedCertificate(cert.getSerialNumber());

        if (badCert != null) { Set nonCritSet = badCert.getNonCriticalExtensionOIDs();

        if (nonCritSet != null) for (String oid : nonCritSet) { System.out.println(oid); } }

        Returns:
        a Set (or an empty Set if none are marked non-critical) of the extension OID strings for extensions that are marked non-critical. If there are no extensions present at all, then this method returns null.
      • getExtensionValue

        byte[] getExtensionValue(String oid)
        Gets the DER-encoded OCTET string for the extension value (extnValue) identified by the passed-in oid String. The oid string is represented by a set of nonnegative whole numbers separated by periods.

        For example:
        OID (Object Identifier) Extension Name
        2.5.29.14 SubjectKeyIdentifier
        2.5.29.15 KeyUsage
        2.5.29.16 PrivateKeyUsage
        2.5.29.17 SubjectAlternativeName
        2.5.29.18 IssuerAlternativeName
        2.5.29.19 BasicConstraints
        2.5.29.30 NameConstraints
        2.5.29.33 PolicyMappings
        2.5.29.35 AuthorityKeyIdentifier
        2.5.29.36 PolicyConstraints

          

        Parameters:
        oid - the Object Identifier value for the extension.
        Returns:
        the DER-encoded octet string of the extension value or null if it is not present.

Traduction non disponible

Les API Java ne sont pas encore traduites en français sur l'infobrol. Seule la version anglaise est disponible pour l'instant.

Version en cache

06/11/2024 00:32:52 Cette version de la page est en cache (à la date du 06/11/2024 00:32:52) afin d'accélérer le traitement. Vous pouvez activer le mode utilisateur dans le menu en haut pour afficher la dernère version de la page.

Document créé le 30/08/2006, dernière modification le 04/03/2020
Source du document imprimé : https://www.gaudry.be/java-api-rf-java/security/cert/x509extension.html

L'infobrol est un site personnel dont le contenu n'engage que moi. Le texte est mis à disposition sous licence CreativeCommons(BY-NC-SA). Plus d'info sur les conditions d'utilisation et sur l'auteur.

Références

  1. Consulter le document html Langue du document :fr Manuel PHP : https://docs.oracle.com, X509Extension

Ces références et liens indiquent des documents consultés lors de la rédaction de cette page, ou qui peuvent apporter un complément d'information, mais les auteurs de ces sources ne peuvent être tenus responsables du contenu de cette page.
L'auteur de ce site est seul responsable de la manière dont sont présentés ici les différents concepts, et des libertés qui sont prises avec les ouvrages de référence. N'oubliez pas que vous devez croiser les informations de sources multiples afin de diminuer les risques d'erreurs.

Table des matières Haut