com.entrust.toolkit.x509.extensions

Class CertificateTransparencyRedaction

java.lang.Object

iaik.x509.V3Extension

com.entrust.toolkit.x509.extensions.CertificateTransparencyRedaction

public class CertificateTransparencyRedaction
extends V3Extension

Certificate Transparency introduces the concept of domain name redaction. The purpose is to prevent domain name details from being leaked from the public LOG. For example, if there was a domain topsecret.example.com and the certificate requestor didn’t want the world to know about the name of the topsecret name, Certificate Transparency allows the SubjectAltName to contain (private).example.com. This means the X.509 pre-certificate that requires redaction needs to have a different subjectAltName extension than the final certificate. When a Precertificate contains one or more redacted labels, a non-critical extension (OID 1.3.6.1.4.1.11129.2.4.6, whose extnValue OCTET STRING contains an ASN.1 SEQUENCE OF INTEGERs) MUST be added to the corresponding certificate: the first INTEGER indicates the number of labels redacted in the Precertificate's first DNS-ID; the second INTEGER does the same for the Precertificate's second DNS-ID; etc. There MUST NOT be more INTEGERs than there are DNS-IDs. If there are fewer INTEGERs than there are DNS-IDs, the shortfall is made up by implicitly repeating the last INTEGER. Each INTEGER MUST have a value of zero or more. The purpose of this extension is to enable TLS clients to accurately reconstruct the Precertificate from the certificate without having to perform any guesswork.

Field Summary

Fields

Modifier and Type	Field and Description
static ObjectID	oid
static java.lang.String	REDACTION_TOKEN The String that replaces the redacted labels

Fields inherited from class iaik.x509.V3Extension

critical

Constructor Summary

Constructors

Constructor and Description
CertificateTransparencyRedaction() The default constructor to the V3Extension
CertificateTransparencyRedaction(int[] redactionList) The constuctor for Certificate Transparency redaction

Method Summary

Methods

Modifier and Type	Method and Description
ObjectID	getObjectID() Return the Object Identifier
int[]	getRedactedList()
int	hashCode() The Hash code use for storage in a hash table
void	init(ASN1Object asn) This method initializes the redaction extension by decoding it from the ASN.1 sequence
SubjectAltName	processRedaction(SubjectAltName san) Process the redaction by apply it to the supplied SubjectAltName class and return a new SubjectAltName that has been redacted.
SubjectAltName	processRedaction(SubjectAltName san, java.lang.String token) Process the redaction by apply it to the supplied SubjectAltName class and return a new SubjectAltName that has been redacted.
ASN1Object	toASN1Object() This method encodes the redaction extension into an ASN.1 sequence of Integers.

Methods inherited from class iaik.x509.V3Extension

getName, isCritical, setCritical

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, notify, notifyAll, toString, wait, wait, wait

Field Detail

oid

public static final ObjectID oid

REDACTION_TOKEN

public static final java.lang.String REDACTION_TOKEN

The String that replaces the redacted labels

See Also:

Constant Field Values

Constructor Detail

CertificateTransparencyRedaction

public CertificateTransparencyRedaction()

The default constructor to the V3Extension

CertificateTransparencyRedaction

public CertificateTransparencyRedaction(int[] redactionList)

The constuctor for Certificate Transparency redaction

Parameters:

redactionList - The ordered list of integers representing the SAN entries that need to be redacted

Method Detail

init

public void init(ASN1Object asn)
          throws X509ExtensionException

This method initializes the redaction extension by decoding it from the ASN.1 sequence

Specified by:

init in class V3Extension

Parameters:

asn - the extension value as ASN1Object

Throws:

X509ExtensionException - if the extension could not parse the ASN1Object

toASN1Object

public ASN1Object toASN1Object()
                        throws X509ExtensionException

This method encodes the redaction extension into an ASN.1 sequence of Integers. Since this is a V3Extension, it gets encoded into an OCTET_STRING.

Specified by:

toASN1Object in class V3Extension

Returns:

the value of the extension as ASN1Object

Throws:

X509ExtensionException - if the extension could not be created

processRedaction

public SubjectAltName processRedaction(SubjectAltName san)

Process the redaction by apply it to the supplied SubjectAltName class and return a new SubjectAltName that has been redacted. Uses the String

 (PRIVATE)
 

as the redaction token.

Parameters:

san - The SubjectAltName to redact

Returns:

A new SubjectAltName that has been redacted based on the contents of this redacted list.

processRedaction

public SubjectAltName processRedaction(SubjectAltName san,
                              java.lang.String token)

Process the redaction by apply it to the supplied SubjectAltName class and return a new SubjectAltName that has been redacted.

Parameters:

san - The SubjectAltName to redact

token - The redaction token

Returns:

A new SubjectAltName that has been redacted based on the contents of this redacted list.

getRedactedList

public int[] getRedactedList()

Returns:

the redacted list of integers

getObjectID

public ObjectID getObjectID()

Return the Object Identifier

Specified by:

getObjectID in class V3Extension

Returns:

the object ID from the extension this class implements

hashCode

public int hashCode()

The Hash code use for storage in a hash table

Specified by:

hashCode in class V3Extension

Returns:

a hash code for this extension