public class RevokedCertificate
extends java.security.cert.X509CRLEntry
implements java.io.Serializable
A revoked certificate denotes a certificate that has been expired for some reason (e.g. the name of the subject has changed, the private key can no more being treated to be only known by the subject, ...) prior to the regular ending of its validity period.
Revoked certificates are collected in certificate revocation lists (CRLs) maintained by certificate issuing certification authorities (CAs). CRLs are publicly available and have to be refreshed in certain time intervals. Each certificate included in a revocation list can be identified by its serial number. The recvocation list is signed by the maintaining CA.
A profile for X.509v2 revocation lists is presented together with the X.509v3 certificate format in RFC 3280, where revoked certificates are defined as the following ASN.1 structure:
revokedCertificates SEQUENCE OF SEQUENCE {
userCertificate CertificateSerialNumber,
revocationDate Time,
crlEntryExtensions Extensions OPTIONAL
-- if present, must be v2
} OPTIONAL
where:
CertificateSerialNumber ::= INTEGER
Time ::= CHOICE {
utcTime UTCTime,
generalTime GeneralizedTime }
Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension
Extension ::= SEQUENCE {
extnID OBJECT IDENTIFIER,
critical BOOLEAN DEFAULT FALSE,
extnValue OCTET STRING }
The serial number is used for uniquely identifying some particular certificate within a given revocation list. The revocation date specifies the date on which the revocation of the listed certificate becomes meaning. Dates through the year 2049 shall be encoded as UTCTime, and dates in 2050 or later as GeneralizedTime.
The crlEntryExtensions field may be used for including some additional
information. An extension may be a defined standard entry extension (e.g.
reasonCode for specifying the reason for revocation), or it may be
a private entry extension providing some community-specific information.
If an entry extension is marked as critical, but the CRL handling software
cannot properly parse this extension, the CRL validation must fail. Non-Critical
entry extensions can be ignored, if they cannot be handled (i.e. of unknown state).
The X509CRL class maintaines revoked
certificate in a hashtable using the certificate's serial number as key. A revoked
certifcate represents a CRL entry.
For adding a CRL entry extension to a revoked certificate, use the addExtension method, e.g.:
//Create a revoked certificate from a X509Certificate and set the revocation date
//to the current date; the X509Certificate is read in from a file:
GregorianCalendar date = (GregorianCalendar)Calendar.getInstance();
InputStream fis = new FileInputStream("cert.der");
X509Certificate cert = new X509Certificate(fis);
fis.close();
RevokedCertificate rev_cert = new RevokedCertificate(cert, date.getTime());
//add the reason code CRL entry extension to the revoked certificate:
ReasonCode reasonCode = new ReasonCode(ReasonCode.keyCompromise);
rev_cert.addExtension(reasonCode);
X509CRL,
X509Certificate,
Serialized Form| Constructor and Description |
|---|
RevokedCertificate(ASN1Object obj)
Creates a revoked certificate from an ASN1Object.
|
RevokedCertificate(java.math.BigInteger serialNumber,
java.util.Date revocationDate)
Creates a revoked certificate from a serial number and a date.
|
RevokedCertificate(byte[] derEncoded)
Creates a revoked certificate from a DER encoded ASN1Object.
|
RevokedCertificate(X509Certificate cert,
java.util.Date revocationDate)
Creates a revoked certificate from a certificate and a date.
|
| Modifier and Type | Method and Description |
|---|---|
void |
addExtension(V3Extension e)
Adds the given extension to this revoked certificate.
|
java.lang.Object |
clone()
Returns a clone of this RevokedCertificate.
|
int |
countExtensions()
Returns the number of extensions included into this revoked certificate.
|
java.util.Set |
getCriticalExtensionOIDs()
Returns a Set of the OID strings identifying the extension(s) that are marked CRITICAL in
this revoced certificate.
|
byte[] |
getEncoded()
Returns this RevokedCertificate as DER encoded ASN.1 data structure
|
V3Extension |
getExtension(ObjectID oid)
Returns a specific extension, identyfied by its object identifier.
|
byte[] |
getExtensionValue(java.lang.String oid)
Returns a byte array representing the DER encoding of the
extension value identified by the passed-in OID string.
|
java.util.Set |
getNonCriticalExtensionOIDs()
Returns a Set of the OID strings identifying the extension(s) that are marked NON-CRITICAL
in this revoced certificate.
|
ReasonCode |
getReasonCode()
Returns the reason code.
|
java.util.Date |
getRevocationDate()
Returns the revocation date of the revoked certificate.
|
java.math.BigInteger |
getSerialNumber()
Returns the serial number of the revoked certificate.
|
boolean |
hasExtensions()
Checks if there are extensions included into this revoked certificate.
|
boolean |
hasUnsupportedCriticalExtension()
Returns true if there are unsupported critical extensions.
|
java.util.Enumeration |
listExtensions()
Returns an enumeration of all entry extensions included into this revoked certificate.
|
void |
removeAllExtensions()
Removes all extensions from this revoked certificate.
|
boolean |
removeExtension(ObjectID oid)
Removes the extension specified by its object identifier.
|
ASN1Object |
toASN1Object()
Returns the revoked certificate as ASN1Object.
|
java.lang.String |
toString()
Returns a string that represents this revoked certificate.
|
java.lang.String |
toString(boolean detailed)
Returns a string with - if requested - detailed information about this
revoked certificate.
|
public RevokedCertificate(byte[] derEncoded)
throws java.security.cert.CRLException
The given byte[] array is DER decoded into an ASN1Object and is parsed for required serial number and revocation date, and - if included - CRL entry extensions.
This constructor may be used for parsing an already existing
RevokedCertificate, supplied as ASN1Object that may have been created by
calling the toASN1Object method.
derEncoded - the revoked certificate as a DER encoded byte arrayjava.security.cert.CRLException - if the DER encoded byte array can not be parsedpublic RevokedCertificate(ASN1Object obj) throws java.security.cert.CRLException
The given ASN1Object is parsed for required serial number and revocation date, and - if included - CRL entry extensions.
This constructor may be used for parsing an already existing
RevokedCertificate, supplied as ASN1Object that may have been created by
calling the toASN1Object method.
obj - the revoked certificate as ASN1Objectjava.security.cert.CRLException - if the ASN1Object can not be parsedpublic RevokedCertificate(X509Certificate cert, java.util.Date revocationDate)
cert - the certificate, which should be revokedrevocationDate - the date when the certificate becomes invalidpublic RevokedCertificate(java.math.BigInteger serialNumber,
java.util.Date revocationDate)
serialNumber - the serial number of the certificate to revokerevocationDate - the date when the certificate becomes invalidpublic ASN1Object toASN1Object() throws java.security.cert.CRLException
java.security.cert.CRLException - if the ASN1Object could not be createdpublic byte[] getEncoded()
throws java.security.cert.CRLException
getEncoded in class java.security.cert.X509CRLEntryjava.security.cert.CRLException - if the RevokedCertificate cannot be encoded correctlypublic java.math.BigInteger getSerialNumber()
getSerialNumber in class java.security.cert.X509CRLEntrypublic java.util.Date getRevocationDate()
getRevocationDate in class java.security.cert.X509CRLEntrypublic java.util.Set getCriticalExtensionOIDs()
getCriticalExtensionOIDs in interface java.security.cert.X509ExtensionnullgetNonCriticalExtensionOIDs()public java.util.Set getNonCriticalExtensionOIDs()
getNonCriticalExtensionOIDs in interface java.security.cert.X509Extensionnull.getCriticalExtensionOIDs()public byte[] getExtensionValue(java.lang.String oid)
The oid string is represented by a set of positive
whole numbers separated by periods, e.g. "2.5.29.21" for the
ReasonCode extension.
In ASN.1, the Extensions field is defined as a SEQUENCE of Extension:
Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension
Extension ::= SEQUENCE {
extnID OBJECT IDENTIFIER,
critical BOOLEAN DEFAULT FALSE,
extnValue OCTET STRING }
where critical specifies whether an extension has to be treated
as being critical or not; the default value is FALSE. An extension can be identified by
its object identifier, given in the extnID field. The value of the extension
is represented as ASN.1 encoded OCTET STRING data structure in the extnValue
field.
The byte value returned by this method represents the DER encoding of the extnValue (OCTET_STRING) from above, and the value of this OCTET STRING represents the DER encoding of the specific extension's ASN.1 representation itsself.
Attention: For compatibility reasons to the standard JCA certificate API this method has been changed to return the OCTET STRING value as described above. Prior versions of this class have returned the DER encoding of the specific extension's ASN.1 representation itsself.
getExtensionValue in interface java.security.cert.X509Extensionoid - the Object identifier of the extension to be searched for, as Stringnull
if it is not presentpublic boolean hasExtensions()
hasExtensions in class java.security.cert.X509CRLEntrytrue if extensions are included, false if notpublic boolean hasUnsupportedCriticalExtension()
hasUnsupportedCriticalExtension in interface java.security.cert.X509Extensionpublic void addExtension(V3Extension e) throws X509ExtensionException
The extension to be added shall be an implemented
V3Extension.
Extensions are managed by the X509Extensions class which maintaines two hashtables, one
for recording critical extensions, and the other for non-critical extensions.
This method only calls the addExtension method of the X509Extensions class for
putting the given extension into the proper hashtable. Note that only the DER
encoded extension value is written to the hashtable using the OID of the extension
as key. If an extension with the same object ID already exists, it is replaced.
For instance:
ReasonCode reasonCode = new ReasonCode(ReasonCode.keyCompromise); revokedCertificate.addExtension(reasonCode);
For reading back some extension from one of the hashtables, use the
getExtension(ObjectID)
method. Only at this time actually the appropriate implementation class is
created and initialized through the DER encoded extension value derived from
the corresponding hashtable.
e - the extension to add to the list of extensionsX509ExtensionException - if an error occurs while DER encoding the extensionV3Extensionpublic boolean removeExtension(ObjectID oid)
objectID - the object ID of the extension to removetrue if the extension successfully has been removed
false otherwisepublic void removeAllExtensions()
public java.util.Enumeration listExtensions()
The returned enumeration may contain unknown extensions (instances of
UnknownExtension)
if there are any extensions included in this certificate, for which there
exists no registered implementation, and it may contain error extensions
(instances of ErrorExtension) indicating extensions which cannot be
parsed properly because of some kind of error.
Notice that this method only calls the
listExtensions
method of the X509Extensions
class for actually instantiating implementations for the included extensions and
initializing them with the appertaining extension values previously written to
proper hashtables. If any extension cannot be parsed properly, an
ErrorExtension is created from it and written to the enumeration list
returned by this method.
null if there are no
extensions present at allpublic int countExtensions()
public V3Extension getExtension(ObjectID oid) throws X509ExtensionInitException
This method only calls the getExtension(ObjectID)
method of the X509Extensions class for actually instantiating an implementation
for the requested extension and initializing it with the appertaining extension
value previously written to a proper hashtable. If the extension cannot be initialized
for some reason, an X509ExtensionInitException is thrown. If the requested extension is
an unknown extension, which is not supported by a registered implementation,
this method creates and returns an UnknownExtension which may be queried for obtaining as much information
as possible about the unknown extension.
objectID - the object ID of the extensionnull if the requested
extension is not presentX509ExtensionInitException - if the extension can not be initializedX509Extensions.getExtension(iaik.asn1.ObjectID)public java.lang.Object clone()
clone in class java.lang.Objectpublic java.lang.String toString()
toString in class java.security.cert.X509CRLEntrypublic java.lang.String toString(boolean detailed)
detailed - - whether or not to give detailed information about this
revoked certificate.public ReasonCode getReasonCode()
The reason code exists in the 'reasonCode' CRL entry extension and identifies the reason for the certificate revocation.
null if the 'reasonCode' extension
does not exist or is improperly formatted