codec.util
Interface CertificateSource

All Known Subinterfaces:

Signable

All Known Implementing Classes:

Certificates, SignedAndEnvelopedData, SignedData, CertificateStore

public interface CertificateSource

Classes implementing this interface are meant to retrieve certificates based on either an issuer distinguished name and a serial number or the subject distinguished name.

Distinguished names are principals and should implement the Principal interface.

Digital signatures in general should include information on the principal who did the signing, as well as on the the principal who attests the validity of the relationship between the claimed identity and the public key that can be used to verify the signature.

Since each subject may own several certificates, for a given signature the corresponding certificate may not reliably be identified by its subject's identity. In that case, the certificate needs to be retrieved based on:

• the principal who issued the certificate, and
• the serial number of the certificate

If, however, a message should be sent to a principal whose certificate is not known, but its distinguished name, then retrieval must be based on the distinguished name of that principal (for instance requesting the certificate from an LDAP directory service).

In principle, the java.security.KeyStore is the first choice for certificate storage. However, this interface does not support retrieval based on distinguished names, but based on an alias that is not globally unique and cannot be bound to the certificate.

This interface may also be used for LDAP based certificate services. In other words, a service that retrieves certificates based on a X.501 or RFC1779 distinguished name from a LDAP directory service.

Version:

"$Id: CertificateSource.java,v 1.4 2001/02/25 15:06:31 vroth Exp $"

Author:

Volker Roth

See Also:

CertificateException

Field Summary

static int	ALL Matches all key usage bits including all-zero key usage bits (effectively disables checking of key usage bits).
static int	DATA_ENCIPHERMENT Matches certificates with the dataEncipherment bit set.
static int	KEY_AGREEMENT Matches certificates with the keyAgreement bit set.
static int	KEY_CERT_SIGN Matches certificates with the keyCertSign bit set.
static int	KEY_ENCIPHERMENT Matches certificates with the keyEncipherment bit set.
static int	NON_REPUDIATION Matches certificates with the nonRepudiation bit set.

Method Summary

Iterator	certificates(Principal subject) Retrieves certificates based on the distinguished name of the certificate's subject.
Iterator	certificates(Principal subject, int keyUsage) Retrieves certificates based on the distinguished name of the certificate's subject and a number of key usage bits.
X509Certificate	getCertificate(Principal issuer, BigInteger serial) This method retrieves a certificate based on the distinguished name of the certificate's issuer as well as its serial number, as assigned by the issuer.

Field Detail

ALL

public static final int ALL

Matches all key usage bits including all-zero key usage bits (effectively disables checking of key usage bits).

NON_REPUDIATION

public static final int NON_REPUDIATION

Matches certificates with the nonRepudiation bit set.

KEY_ENCIPHERMENT

public static final int KEY_ENCIPHERMENT

Matches certificates with the keyEncipherment bit set.

DATA_ENCIPHERMENT

public static final int DATA_ENCIPHERMENT

Matches certificates with the dataEncipherment bit set.

KEY_AGREEMENT

public static final int KEY_AGREEMENT

Matches certificates with the keyAgreement bit set.

KEY_CERT_SIGN

public static final int KEY_CERT_SIGN

Matches certificates with the keyCertSign bit set.

Method Detail

getCertificate

public X509Certificate getCertificate(Principal issuer,
                                      BigInteger serial)

This method retrieves a certificate based on the distinguished name of the certificate's issuer as well as its serial number, as assigned by the issuer.

Parameters:

issuer - The issuer distinguished name.

serial - The serial number.

Returns:

The certificate or null if it is not found.

certificates

public Iterator certificates(Principal subject)

Retrieves certificates based on the distinguished name of the certificate's subject.

Parameters:

subject - The subject DN of the certificate that should be retrieved.

Returns:

An Iterator of all known certificates with the given subject DN.

See Also:

CertificateIterator

certificates

public Iterator certificates(Principal subject,
                             int keyUsage)

Retrieves certificates based on the distinguished name of the certificate's subject and a number of key usage bits.

Parameters:

subject - The subject DN of the certificate that should be retrieved. A value of null matches every subject DN.

keyUsage - The mask of key usage bits; at least one of these bits must be set in the key usage extension of matching certificates. A value of 0 disables key usage checking.

Returns:

An Iterator of all known certificates with the given subject DN that match at least one of the given key usage bits.

See Also:

CertificateIterator