public class X509CertSelector extends Object implements CertSelector, Cloneable
CertSelector
for X.509 certificates,
which allows a number of criteria to be set when accepting certificates,
from validity dates, to issuer and subject distinguished names, to some
of the various X.509 extensions.
Use of this class requires extensive knowledge of the Internet Engineering Task Force's Public Key Infrastructure (X.509). The primary document describing this standard is RFC 3280: Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile.
Note that this class is not thread-safe. If multiple threads will use or modify this class then they need to synchronize on the object.
Constructor and Description |
---|
X509CertSelector()
Creates a new X.509 certificate selector.
|
Modifier and Type | Method and Description |
---|---|
void |
addPathToName(int id,
byte[] name) |
void |
addPathToName(int id,
String name) |
void |
addSubjectAlternativeName(int id,
byte[] name)
Add a name, as DER-encoded bytes, to the subject alternative names
criterion.
|
void |
addSubjectAlternativeName(int id,
String name)
Add a name to the subject alternative names criterion.
|
Object |
clone()
Default clone() method performs a "shallow" cloning of the instance.
|
byte[] |
getAuthorityKeyIdentifier()
Returns the authority key identifier criterion, or
null if
this value was not set. |
int |
getBasicConstraints()
Returns the basic constraints criterion, or -1 if this value is not set.
|
X509Certificate |
getCertificate()
Returns the certificate criterion, or
null if this value
was not set. |
Date |
getCertificateValid()
Returns the date at which certificates must be valid, or
null
if this criterion was not set. |
Set |
getExtendedKeyUsage()
Returns the set of extended key purpose IDs, as an unmodifiable set
of OID strings.
|
byte[] |
getIssuerAsBytes()
Returns the issuer criterion as a sequence of DER bytes, or
null if this value was not set. |
String |
getIssuerAsString()
Returns the issuer criterion as a string, or
null if this
value was not set. |
boolean[] |
getKeyUsage()
Returns the public key usage criterion, or
null if this
value is not set. |
boolean |
getMatchAllSubjectAltNames()
Returns whether or not all specified alternative names must match.
|
byte[] |
getNameConstraints()
Returns the name constraints criterion, or
null if this
value is not set. |
Collection |
getPathToNames() |
Set |
getPolicy() |
Date |
getPrivateKeyValid()
This method, and its related X.509 certificate extension — the
private key usage period — is not supported under the Internet
PKI for X.509 certificates (PKIX), described in RFC 3280.
|
BigInteger |
getSerialNumber()
Returns the serial number criterion, or
null if this
value was not set. |
Collection |
getSubjectAlternativeNames() |
byte[] |
getSubjectAsBytes()
Returns the subject criterion as a sequence of DER bytes, or
null if this value is not set. |
String |
getSubjectAsString()
Returns the subject criterion as a string, of
null if
this value was not set. |
byte[] |
getSubjectKeyIdentifier()
Returns the subject key identifier criterion, or
null if
this value was not set. |
PublicKey |
getSubjectPublicKey()
Returns the subject public key criterion, or
null if this
value is not set. |
String |
getSubjectPublicKeyAlgID()
Returns the public key algorithm ID that matching certificates must have,
or
null if this criterion was not set. |
boolean |
match(Certificate certificate)
Match a certificate.
|
void |
setAuthorityKeyIdentifier(byte[] authKeyId)
Sets the authority key identifier criterion, or
null to clear
this criterion. |
void |
setBasicConstraints(int basicConstraints)
Sets the basic constraints criterion.
|
void |
setCertificate(X509Certificate cert)
Sets the certificate criterion.
|
void |
setCertificateValid(Date certValid)
Sets the date at which certificates must be valid.
|
void |
setExtendedKeyUsage(Set keyPurposeSet)
Sets the extended key usage criterion, as a set of OID strings.
|
void |
setIssuer(byte[] name)
Sets the issuer, specified as the DER encoding of the issuer's
distinguished name.
|
void |
setIssuer(String name)
Sets the issuer, specified as a string representation of the issuer's
distinguished name.
|
void |
setKeyUsage(boolean[] keyUsage)
Sets the public key usage criterion.
|
void |
setMatchAllSubjectAltNames(boolean matchAllNames)
Sets whether or not all subject alternative names must be matched.
|
void |
setNameConstraints(byte[] nameConstraints)
Sets the name constraints criterion; specify
null to
clear this criterion. |
void |
setPathToNames(Collection names) |
void |
setPolicy(Set policy) |
void |
setPrivateKeyValid(Date UNUSED)
This method, and its related X.509 certificate extension — the
private key usage period — is not supported under the Internet
PKI for X.509 certificates (PKIX), described in RFC 3280.
|
void |
setSerialNumber(BigInteger serialNo)
Sets the serial number of the desired certificate.
|
void |
setSubject(byte[] name)
Sets the subject, specified as the DER encoding of the subject's
distinguished name.
|
void |
setSubject(String name)
Sets the subject, specified as a string representation of the
subject's distinguished name.
|
void |
setSubjectAlternativeNames(Collection altNames)
Sets the subject alternative names critertion.
|
void |
setSubjectKeyIdentifier(byte[] subjectKeyId)
Sets the subject key identifier criterion, or
null to clear
this criterion. |
void |
setSubjectPublicKey(byte[] key)
Sets the subject public key criterion as a DER-encoded key.
|
void |
setSubjectPublicKey(PublicKey key)
Sets the subject public key criterion as an opaque representation.
|
void |
setSubjectPublicKeyAlgID(String sigId)
Sets the public key algorithm ID that matching certificates must have.
|
String |
toString()
Default String representation: overriden by many classes.
|
public X509CertSelector()
X509Certificate
).public X509Certificate getCertificate()
null
if this value
was not set.public void setCertificate(X509Certificate cert)
cert
- The certificate.public BigInteger getSerialNumber()
null
if this
value was not set.public void setSerialNumber(BigInteger serialNo)
serialNo
- The serial number.public String getIssuerAsString()
null
if this
value was not set.public byte[] getIssuerAsBytes() throws IOException
null
if this value was not set.IOException
public void setIssuer(String name) throws IOException
name
- The string representation of the issuer's distinguished name.IOException
- If the given name is incorrectly formatted.public void setIssuer(byte[] name) throws IOException
name
- The DER encoding of the issuer's distinguished name.IOException
- If the given name is incorrectly formatted.public String getSubjectAsString()
null
if
this value was not set.public byte[] getSubjectAsBytes() throws IOException
null
if this value is not set.IOException
public void setSubject(String name) throws IOException
name
- The string representation of the subject's distinguished name.IOException
- If the given name is incorrectly formatted.public void setSubject(byte[] name) throws IOException
name
- The DER encoding of the subject's distinguished name.IOException
- If the given name is incorrectly formatted.public byte[] getSubjectKeyIdentifier()
null
if
this value was not set. Note that the byte array is cloned to prevent
modification.public void setSubjectKeyIdentifier(byte[] subjectKeyId)
null
to clear
this criterion. Note that the byte array is cloned to prevent modification.subjectKeyId
- The subject key identifier.public byte[] getAuthorityKeyIdentifier()
null
if
this value was not set. Note that the byte array is cloned to prevent
modification.public void setAuthorityKeyIdentifier(byte[] authKeyId)
null
to clear
this criterion. Note that the byte array is cloned to prevent modification.subjectKeyId
- The subject key identifier.public Date getCertificateValid()
null
if this criterion was not set.public void setCertificateValid(Date certValid)
null
to clear this criterion.certValid
- The certificate validity date.public Date getPrivateKeyValid()
Do not use this method. It is not deprecated, as it is not deprecated
in the Java standard, but it is basically a no-operation and simply
returns null
.
public void setPrivateKeyValid(Date UNUSED)
Do not use this method. It is not deprecated, as it is not deprecated in the Java standard, but it is basically a no-operation.
UNUSED
- Is silently ignored.public String getSubjectPublicKeyAlgID()
null
if this criterion was not set.public void setSubjectPublicKeyAlgID(String sigId) throws IOException
null
to clear this criterion.sigId
- The public key ID.IOException
- If the specified ID is not a valid object identifier.public PublicKey getSubjectPublicKey()
null
if this
value is not set.public void setSubjectPublicKey(PublicKey key)
null
to clear this criterion.key
- The public key.public void setSubjectPublicKey(byte[] key) throws IOException
null
to clear this value.key
- The DER-encoded key bytes.IOException
- If the argument is not a valid DER-encoded key.public boolean[] getKeyUsage()
null
if this
value is not set. Note that the array is cloned to prevent modification.public void setKeyUsage(boolean[] keyUsage)
null
to clear
this value.keyUsage
- The public key usage.public Set getExtendedKeyUsage()
null
if this criterion is not
set.public void setExtendedKeyUsage(Set keyPurposeSet) throws IOException
null
to clear this value.keyPurposeSet
- The set of key purpose OIDs.IOException
- If any element of the set is not a valid OID string.public boolean getMatchAllSubjectAltNames()
public void setMatchAllSubjectAltNames(boolean matchAllNames)
matchAllNames
- Whether or not all alternative names must be
matched.public void setSubjectAlternativeNames(Collection altNames) throws IOException
List
that contains exactly two
elements: the first an Integer
, representing the type of
name, and the second either a String
or a byte array,
representing the name itself.altNames
- The alternative names.IOException
- If any element of the argument is invalid.public void addSubjectAlternativeName(int id, String name) throws IOException
id
- The type of name this is. Must be in the range [0,8].name
- The name.IOException
- If the id is out of range, or if the name
is null.public void addSubjectAlternativeName(int id, byte[] name) throws IOException
id
- The type of name this is.IOException
public byte[] getNameConstraints()
null
if this
value is not set. Note that the byte array is cloned to prevent
modification.public void setNameConstraints(byte[] nameConstraints) throws IOException
null
to
clear this criterion. Note that if non-null, the argument will be
cloned to prevent modification.nameConstraints
- The new name constraints.IOException
- If the argument is not a valid DER-encoded
name constraints.public int getBasicConstraints()
public void setBasicConstraints(int basicConstraints)
basicConstraints
- The new basic constraints value.public void setPolicy(Set policy) throws IOException
IOException
public void setPathToNames(Collection names) throws IOException
IOException
public void addPathToName(int id, String name) throws IOException
IOException
public void addPathToName(int id, byte[] name) throws IOException
IOException
public Collection getSubjectAlternativeNames()
public Set getPolicy()
public Collection getPathToNames()
public boolean match(Certificate certificate)
true
if the given certificate matches.match
in interface CertSelector
certificate
- The certificate to check.public String toString()
Object