An implementation for X509 CRL (Certificate Revocation List).
The X.509 v2 CRL format is described below in ASN.1:
CertificateList ::= SEQUENCE {
tbsCertList TBSCertList,
signatureAlgorithm AlgorithmIdentifier,
signature BIT STRING }
More information can be found in
RFC 5280: Internet X.509
Public Key Infrastructure Certificate and CRL Profile.
The ASN.1 definition of tbsCertList is:
TBSCertList ::= SEQUENCE {
version Version OPTIONAL,
-- if present, must be v2
signature AlgorithmIdentifier,
issuer Name,
thisUpdate ChoiceOfTime,
nextUpdate ChoiceOfTime OPTIONAL,
revokedCertificates SEQUENCE OF SEQUENCE {
userCertificate CertificateSerialNumber,
revocationDate ChoiceOfTime,
crlEntryExtensions Extensions OPTIONAL
-- if present, must be v2
} OPTIONAL,
crlExtensions [0] EXPLICIT Extensions OPTIONAL
-- if present, must be v2
}
X509CRL
| Modifier and Type | Class and Description |
|---|---|
| public static class | |
| private static class | X509CRLImpl.
Immutable X.509 Certificate Issuer DN and serial number pair |
| Modifier and Type | Field and Description |
|---|---|
| private X509CRLImpl. | |
| private static final boolean | |
| private AlgorithmId | |
| private byte[] | |
| private byte[] | |
| private byte[] | |
| private String | verifiedProvider
If verifiedPublicKey is not null, name of the provider used to successfully verify the signature of this CRL, or the empty String if no provider was explicitly specified. |
| private PublicKey | verifiedPublicKey
PublicKey that has previously been used to successfully verify the signature of this CRL. |
| Access | Constructor and Description |
|---|---|
| public | X509CRLImpl(X509CRLImpl.
Constructor simply setting all (non-cache) fields. |
| public | X509CRLImpl(byte[]
the encoded bytes, with no trailing padding. crlData)Unmarshals an X.509 CRL from its encoded form, parsing the encoded bytes. |
| public | X509CRLImpl(DerValue
a DER value holding at least one CRL val)Unmarshals an X.509 CRL from an DER value. |
| public | X509CRLImpl(InputStream
an input stream holding at least one CRL inStrm)Unmarshals an X.509 CRL from an input stream. |
| Modifier and Type | Method and Description |
|---|---|
| public void | encode(DerOutputStream out)
Implements sun. DER encode this object and write the results to a stream. |
| public KeyIdentifier | Returns: AuthorityKeyIdentifier or null (if no AuthorityKeyIdentifierExtension)return the AuthorityKeyIdentifier, if any. |
| public AuthorityKeyIdentifierExtension | Returns: AuthorityKeyIdentifierExtension or null (if no such extension)return the AuthorityKeyIdentifierExtension, if any. |
| public BigInteger | Returns: number or null (if no such extension)return the base CRL number from the DeltaCRLIndicatorExtension, if any. |
| public Set | Returns: a set of the extension oid strings in the CRL that are marked critical.Implements java. Gets a Set of the extension(s) marked CRITICAL in the CRL. |
| public BigInteger | Returns: number or null (if no such extension)return the CRL number from the CRLNumberExtension, if any. |
| public CRLNumberExtension | Returns: CRLNumberExtension or null (if no such extension)return the CRLNumberExtension, if any. |
| public DeltaCRLIndicatorExtension | Returns: DeltaCRLIndicatorExtension or null (if no such extension)return the DeltaCRLIndicatorExtension, if any. |
| public byte[] | getEncoded()
Implements abstract java. Returns the ASN.1 DER encoded form of this CRL. |
| public byte[] | |
| public static byte[] | |
| public Object | Returns: Object of type<extension> or null, if not foundObjectIdentifier of extension desired oid)get an extension |
| public byte[] | Returns: the der encoded octet string of the extension value.the Object Identifier value for the extension. oid)Implements java. Gets the DER encoded OCTET string for the extension value
( |
| public IssuerAlternativeNameExtension | Returns: IssuerAlternativeNameExtension or null (if no such extension)return the IssuerAlternativeNameExtension, if any. |
| public Principal | Returns: the issuer name.Implements abstract java. Gets the issuer distinguished name from this CRL. |
| public X500Principal | getIssuerX500Principal()
Overrides java. Return the issuer as X500Principal. |
| public static X500Principal | |
| public IssuingDistributionPointExtension | Returns: IssuingDistributionPointExtension or null (if no such extension)return the IssuingDistributionPointExtension, if any. |
| public Date | Returns: the nextUpdate date from the CRL, or null if not present.Implements abstract java. Gets the nextUpdate date from the CRL. |
| public Set | Returns: a set of the extension oid strings in the CRL that are NOT marked critical.Implements java. Gets a Set of the extension(s) marked NON-CRITICAL in the CRL. |
| public X509CRLEntry | Returns: the entry with the given serial number, ornull if
no such entry exists in the CRL.Implements abstract java. Gets the CRL entry with the given serial number from this CRL. |
| public X509CRLEntry | getRevokedCertificate(X509Certificate cert)
Overrides java. Gets the CRL entry for the given certificate. |
| public Set | Returns: all the revoked certificates ornull if there are
none.Implements abstract java. Gets all the revoked certificates from the CRL. |
| public AlgorithmId | |
| public String | Returns: the signature algorithm name.Implements abstract java. Gets the signature algorithm name for the CRL signature algorithm. |
| public String | Returns: the signature algorithm oid string.Implements abstract java. Gets the signature algorithm OID string from the CRL. |
| public byte[] | Returns: the DER encoded signature algorithm parameters, or null if no parameters are present.Implements abstract java. Gets the DER encoded signature algorithm parameters from this CRL's signature algorithm. |
| public byte[] | Returns: the signature.Implements abstract java. Gets the raw Signature bits from the CRL. |
| public byte[] | Returns: the DER encoded CRL information.Implements abstract java. Gets the DER encoded CRL information, the
|
| public Date | Returns: the thisUpdate date from the CRL.Implements abstract java. Gets the thisUpdate date from the CRL. |
| public int | Returns: the version number, i.e. 1 or 2.Implements abstract java. Gets the version number from this CRL. |
| public boolean | hasUnsupportedCriticalExtension()
Implements java. Return true if a critical extension is found that is not supported, otherwise return false. |
| public X509CRLImpl. | |
| public boolean | Returns: true if the given certificate is on this CRL, false otherwise.the certificate to check for. cert)Implements abstract java. Checks whether the given certificate is on this CRL. |
| public static X509CRLImpl | Returns: a newly signed CRLthe TBSCertList to sign info,the private key used for signing. key, String the name of the signature algorithm used. algorithm)Creates a new X.509 CRL, which is signed using the given key. |
| public static X509CRLImpl | Returns: a newly signed CRLthe TBSCertList to sign info,the private key used for signing. key, String the name of the signature algorithm used. algorithm, String (optional) the name of the provider. provider)Creates a new X.509 CRL, which is signed using the given key. |
| private void | |
| public static X509CRLImpl | |
| public String | Returns: value of this CRL in a printable form.Implements abstract java. Returns a printable string of this CRL. |
| public String | |
| public void | verify(PublicKey
the PublicKey used to carry out the verification. key)Implements abstract java. Verifies that this CRL was signed using the private key that corresponds to the given public key. |
| public synchronized void | verify(PublicKey
the PublicKey used to carry out the verification. key, String the name of the signature provider. sigProvider)Implements abstract java. Verifies that this CRL was signed using the private key that corresponds to the given public key, and that the signature verification was computed by the given provider. |
| public synchronized void | verify(PublicKey
the PublicKey used to carry out the verification. key, Provider the signature provider. sigProvider)Overrides java. Verifies that this CRL was signed using the private key that corresponds to the given public key, and that the signature verification was computed by the given provider. |
| info | back to summary |
|---|---|
| private X509CRLImpl. | |
| isExplicit | back to summary |
|---|---|
| private static final boolean isExplicit | |
| sigAlgId | back to summary |
|---|---|
| private AlgorithmId sigAlgId | |
| signature | back to summary |
|---|---|
| private byte[] signature | |
| signedCRL | back to summary |
|---|---|
| private byte[] signedCRL | |
| tbsCertList | back to summary |
|---|---|
| private byte[] tbsCertList | |
| verifiedProvider | back to summary |
|---|---|
| private String verifiedProvider If verifiedPublicKey is not null, name of the provider used to successfully verify the signature of this CRL, or the empty String if no provider was explicitly specified. | |
| verifiedPublicKey | back to summary |
|---|---|
| private PublicKey verifiedPublicKey PublicKey that has previously been used to successfully verify the signature of this CRL. Null if the CRL has not yet been verified (successfully). | |
| X509CRLImpl | back to summary |
|---|---|
| public X509CRLImpl(X509CRLImpl. Constructor simply setting all (non-cache) fields. Only used in
| |
| X509CRLImpl | back to summary |
|---|---|
| public X509CRLImpl(byte[] crlData) throws CRLException Unmarshals an X.509 CRL from its encoded form, parsing the encoded bytes. This form of constructor is used by agents which need to examine and use CRL contents. Note that the buffer must include only one CRL, and no "garbage" may be left at the end.
| |
| X509CRLImpl | back to summary |
|---|---|
| public X509CRLImpl(DerValue val) throws CRLException Unmarshals an X.509 CRL from an DER value.
| |
| X509CRLImpl | back to summary |
|---|---|
| public X509CRLImpl(InputStream inStrm) throws CRLException Unmarshals an X.509 CRL from an input stream. Only one CRL is expected at the end of the input stream.
| |
| encode | back to summary |
|---|---|
| public void encode(DerOutputStream out) Implements sun. Doc from sun. DER encode this object and write the results to a stream.
| |
| getAuthKeyId | back to summary |
|---|---|
| public KeyIdentifier getAuthKeyId() return the AuthorityKeyIdentifier, if any.
| |
| getAuthKeyIdExtension | back to summary |
|---|---|
| public AuthorityKeyIdentifierExtension getAuthKeyIdExtension() return the AuthorityKeyIdentifierExtension, if any.
| |
| getBaseCRLNumber | back to summary |
|---|---|
| public BigInteger getBaseCRLNumber() return the base CRL number from the DeltaCRLIndicatorExtension, if any.
| |
| getCriticalExtensionOIDs | back to summary |
|---|---|
| public Set Implements java. Gets a Set of the extension(s) marked CRITICAL in the CRL. In the returned set, each extension is represented by its OID string. | |
| getCRLNumber | back to summary |
|---|---|
| public BigInteger getCRLNumber() return the CRL number from the CRLNumberExtension, if any.
| |
| getCRLNumberExtension | back to summary |
|---|---|
| public CRLNumberExtension getCRLNumberExtension() return the CRLNumberExtension, if any.
| |
| getDeltaCRLIndicatorExtension | back to summary |
|---|---|
| public DeltaCRLIndicatorExtension getDeltaCRLIndicatorExtension() return the DeltaCRLIndicatorExtension, if any.
| |
| getEncoded | back to summary |
|---|---|
| public byte[] getEncoded() throws CRLException Implements abstract java. Returns the ASN.1 DER encoded form of this CRL.
| |
| getEncodedInternal | back to summary |
|---|---|
| public byte[] getEncodedInternal() throws CRLException Returned the encoding as an uncloned byte array. Callers must guarantee that they neither modify it nor expose it to untrusted code. | |
| getEncodedInternal | back to summary |
|---|---|
| public static byte[] getEncodedInternal(X509CRL crl) throws CRLException Returned the encoding of the given certificate for internal use. Callers must guarantee that they neither modify it nor expose it to untrusted code. Uses getEncodedInternal() if the certificate is instance of X509CertImpl, getEncoded() otherwise. | |
| getExtension | back to summary |
|---|---|
| public Object getExtension(ObjectIdentifier oid) get an extension
| |
| getExtensionValue | back to summary |
|---|---|
| public byte[] getExtensionValue(String oid) Implements java. Gets the DER encoded OCTET string for the extension value
(
| |
| getIssuerAltNameExtension | back to summary |
|---|---|
| public IssuerAlternativeNameExtension getIssuerAltNameExtension() return the IssuerAlternativeNameExtension, if any.
| |
| getIssuerDN | back to summary |
|---|---|
| public Principal getIssuerDN() Implements abstract java. Gets the issuer distinguished name from this CRL. The issuer name identifies the entity who has signed (and issued the CRL). The issuer name field contains an X.500 distinguished name (DN). The ASN.1 definition for this is:
issuer Name
Name ::= CHOICE { RDNSequence }
RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
RelativeDistinguishedName ::=
SET OF AttributeValueAssertion
AttributeValueAssertion ::= SEQUENCE {
AttributeType,
AttributeValue }
AttributeType ::= OBJECT IDENTIFIER
AttributeValue ::= ANY
The Name describes a hierarchical name composed of attributes,
such as country name, and corresponding values, such as US.
The type of the component AttributeValue is determined by the
AttributeType; in general it will be a directoryString.
A directoryString is usually one of PrintableString,
TeletexString or UniversalString.
| |
| getIssuerX500Principal | back to summary |
|---|---|
| public X500Principal getIssuerX500Principal() Overrides java. Return the issuer as X500Principal. Overrides method in X509CRL to provide a slightly more efficient version. | |
| getIssuerX500Principal | back to summary |
|---|---|
| public static X500Principal getIssuerX500Principal(X509CRL crl) Extract the issuer X500Principal from an X509CRL. Parses the encoded form of the CRL to preserve the principal's ASN.1 encoding. Called by java.security.cert.X509CRL.getIssuerX500Principal(). | |
| getIssuingDistributionPointExtension | back to summary |
|---|---|
| public IssuingDistributionPointExtension getIssuingDistributionPointExtension() return the IssuingDistributionPointExtension, if any.
| |
| getNextUpdate | back to summary |
|---|---|
| public Date getNextUpdate() Implements abstract java. Gets the nextUpdate date from the CRL.
| |
| getNonCriticalExtensionOIDs | back to summary |
|---|---|
| public Set Implements java. Gets a Set of the extension(s) marked NON-CRITICAL in the CRL. In the returned set, each extension is represented by its OID string. | |
| getRevokedCertificate | back to summary |
|---|---|
| public X509CRLEntry getRevokedCertificate(BigInteger serialNumber) Implements abstract java. Gets the CRL entry with the given serial number from this CRL.
| |
| getRevokedCertificate | back to summary |
|---|---|
| public X509CRLEntry getRevokedCertificate(X509Certificate cert) Overrides java. Gets the CRL entry for the given certificate. | |
| getRevokedCertificates | back to summary |
|---|---|
| public Set Implements abstract java. Gets all the revoked certificates from the CRL. A Set of X509CRLEntry.
| |
| getSigAlgId | back to summary |
|---|---|
| public AlgorithmId getSigAlgId() Gets the signature AlgorithmId from the CRL.
| |
| getSigAlgName | back to summary |
|---|---|
| public String getSigAlgName() Implements abstract java. Gets the signature algorithm name for the CRL signature algorithm. For example, the string "SHA1withDSA". The ASN.1 definition for this is:
AlgorithmIdentifier ::= SEQUENCE {
algorithm OBJECT IDENTIFIER,
parameters ANY DEFINED BY algorithm OPTIONAL }
-- contains a value of the type
-- registered for use with the
-- algorithm object identifier value
| |
| getSigAlgOID | back to summary |
|---|---|
| public String getSigAlgOID() Implements abstract java. Gets the signature algorithm OID string from the CRL.
An OID is represented by a set of positive whole number separated
by ".", that means,
| |
| getSigAlgParams | back to summary |
|---|---|
| public byte[] getSigAlgParams() Implements abstract java. Gets the DER encoded signature algorithm parameters from this CRL's signature algorithm. In most cases, the signature algorithm parameters are null, the parameters are usually supplied with the Public Key.
| |
| getSignature | back to summary |
|---|---|
| public byte[] getSignature() Implements abstract java. Gets the raw Signature bits from the CRL.
| |
| getTBSCertList | back to summary |
|---|---|
| public byte[] getTBSCertList() throws CRLException Implements abstract java. Gets the DER encoded CRL information, the
| |
| getThisUpdate | back to summary |
|---|---|
| public Date getThisUpdate() Implements abstract java. Gets the thisUpdate date from the CRL. The ASN.1 definition for this is:
| |
| getVersion | back to summary |
|---|---|
| public int getVersion() Implements abstract java. Gets the version number from this CRL. The ASN.1 definition for this is:
Version ::= INTEGER { v1(0), v2(1), v3(2) }
-- v3 does not apply to CRLs but appears for consistency
-- with definition of Version for certs
| |
| hasUnsupportedCriticalExtension | back to summary |
|---|---|
| public boolean hasUnsupportedCriticalExtension() Implements java. Return true if a critical extension is found that is not supported, otherwise return false. | |
| info | back to summary |
|---|---|
| public X509CRLImpl. | |
| isRevoked | back to summary |
|---|---|
| public boolean isRevoked(Certificate cert) Implements abstract java. Checks whether the given certificate is on this CRL.
| |
| newSigned | back to summary |
|---|---|
| public static X509CRLImpl newSigned(X509CRLImpl. Creates a new X.509 CRL, which is signed using the given key.
| |
| newSigned | back to summary |
|---|---|
| public static X509CRLImpl newSigned(X509CRLImpl. Creates a new X.509 CRL, which is signed using the given key.
| |
| parse | back to summary |
|---|---|
| private void parse(DerValue val) throws CRLException, IOException | |
| toImpl | back to summary |
|---|---|
| public static X509CRLImpl toImpl(X509CRL crl) throws CRLException Utility method to convert an arbitrary instance of X509CRL to a X509CRLImpl. Does a cast if possible, otherwise reparses the encoding. | |
| toString | back to summary |
|---|---|
| public String toString() Implements abstract java. Returns a printable string of this CRL.
| |
| toStringWithAlgName | back to summary |
|---|---|
| public String toStringWithAlgName(String name) | |
| verify | back to summary |
|---|---|
| public void verify(PublicKey key) throws CRLException, NoSuchAlgorithmException, InvalidKeyException, NoSuchProviderException, SignatureException Implements abstract java. Verifies that this CRL was signed using the private key that corresponds to the given public key.
| |
| verify | back to summary |
|---|---|
| public synchronized void verify(PublicKey key, String sigProvider) throws CRLException, NoSuchAlgorithmException, InvalidKeyException, NoSuchProviderException, SignatureException Implements abstract java. Verifies that this CRL was signed using the private key that corresponds to the given public key, and that the signature verification was computed by the given provider.
| |
| verify | back to summary |
|---|---|
| public synchronized void verify(PublicKey key, Provider sigProvider) throws CRLException, NoSuchAlgorithmException, InvalidKeyException, SignatureException Overrides java. Verifies that this CRL was signed using the private key that corresponds to the given public key, and that the signature verification was computed by the given provider. Note that the specified Provider object does not have to be registered in the provider list.
| |
| Modifier and Type | Field and Description |
|---|---|
| private CRLExtensions | |
| private AlgorithmId | |
| private X500Name | |
| private X500Principal | |
| private Date | |
| private final List | |
| private final Map | |
| private Date | |
| private int |
| Access | Constructor and Description |
|---|---|
| public | TBSCertList(X500Name
the name of the CA issuing this CRL. issuer, Date the Date of this issue. thisDate, Date the Date of the next CRL. nextDate)Initial TBSCertList constructor, no revoked certs, and no extensions. |
| public | TBSCertList(X500Name
the name of the CA issuing this CRL. issuer, Date the Date of this issue. thisDate, Date the Date of the next CRL. nextDate, X509CRLEntry[] the array of CRL entries. badCerts)TBSCertList constructor, revoked certs, no extensions. |
| public | TBSCertList(X500Name
the name of the CA issuing this CRL. issuer, Date the Date of this issue. thisDate, Date the Date of the next CRL. nextDate, X509CRLEntry[] the array of CRL entries. badCerts, CRLExtensions the CRL extensions. crlExts)TBSCertList constructor, revoked certs and extensions. |
| public |
| Modifier and Type | Method and Description |
|---|---|
| public byte[] | |
| private X500Principal | Returns: the X500Principal in a CertificateIssuerExtension, or prevCertIssuer if it does not existthe entry to check entry, X500Principal the previous entry's certificate issuer prevCertIssuer)Returns the X500 certificate issuer DN of a CRL entry. |
| public X500Principal |
| extensions | back to summary |
|---|---|
| private CRLExtensions extensions | |
| infoSigAlgId | back to summary |
|---|---|
| private AlgorithmId infoSigAlgId | |
| issuer | back to summary |
|---|---|
| private X500Name issuer | |
| issuerPrincipal | back to summary |
|---|---|
| private X500Principal issuerPrincipal | |
| nextUpdate | back to summary |
|---|---|
| private Date nextUpdate | |
| revokedList | back to summary |
|---|---|
| private final List<X509CRLEntry> revokedList | |
| revokedMap | back to summary |
|---|---|
| private final Map<X509CRLImpl. | |
| thisUpdate | back to summary |
|---|---|
| private Date thisUpdate | |
| version | back to summary |
|---|---|
| private int version | |
| TBSCertList | back to summary |
|---|---|
| public TBSCertList(X500Name issuer, Date thisDate, Date nextDate) Initial TBSCertList constructor, no revoked certs, and no extensions. | |
| TBSCertList | back to summary |
|---|---|
| public TBSCertList(X500Name issuer, Date thisDate, Date nextDate, X509CRLEntry[] badCerts) throws CRLException TBSCertList constructor, revoked certs, no extensions.
| |
| TBSCertList | back to summary |
|---|---|
| public TBSCertList(X500Name issuer, Date thisDate, Date nextDate, X509CRLEntry[] badCerts, CRLExtensions crlExts) throws CRLException TBSCertList constructor, revoked certs and extensions.
| |
| TBSCertList | back to summary |
|---|---|
| public TBSCertList(DerValue value) throws IOException, CRLException Constructs from the encoding.
| |
| encodeInfo | back to summary |
|---|---|
| public byte[] encodeInfo() throws CRLException Encodes the "to-be-signed" TBSCertList to the OutputStream.
| |
| getCertIssuer | back to summary |
|---|---|
| private X500Principal getCertIssuer(X509CRLEntryImpl entry, X500Principal prevCertIssuer) throws CRLException Returns the X500 certificate issuer DN of a CRL entry.
| |
| getIssuerX500Principal | back to summary |
|---|---|
| public X500Principal getIssuerX500Principal() Return the issuer as X500Principal. | |
| Modifier and Type | Field and Description |
|---|---|
| pack-priv volatile int | |
| pack-priv final X500Principal | |
| pack-priv final BigInteger |
| Access | Constructor and Description |
|---|---|
| pack-priv | X509IssuerSerial(X500Principal
the issuer DN issuer, BigInteger the serial number serial)Create an X509IssuerSerial. |
| pack-priv |
| Modifier and Type | Method and Description |
|---|---|
| public int | compareTo(X509CRLImpl.
Implements java. Compares this object with the specified object for order. |
| public boolean | Returns: true if equal, false otherwisethe other object to compare with o)Overrides java. Compares this X509Serial with another and returns true if they are equivalent. |
| pack-priv X500Principal | |
| pack-priv BigInteger | |
| public int | Returns: a hash code value for this X509IssuerSerialOverrides java. Returns a hash code value for this X509IssuerSerial. |
| hashcode | back to summary |
|---|---|
| pack-priv volatile int hashcode | |
| issuer | back to summary |
|---|---|
| pack-priv final X500Principal issuer | |
| serial | back to summary |
|---|---|
| pack-priv final BigInteger serial | |
| X509IssuerSerial | back to summary |
|---|---|
| pack-priv X509IssuerSerial(X500Principal issuer, BigInteger serial) Create an X509IssuerSerial.
| |
| X509IssuerSerial | back to summary |
|---|---|
| pack-priv X509IssuerSerial(X509Certificate cert) Construct an X509IssuerSerial from an X509Certificate. | |
| compareTo | back to summary |
|---|---|
| public int compareTo(X509CRLImpl. Implements java. Doc from java. Compares this object with the specified object for order. Returns a negative integer, zero, or a positive integer as this object is less than, equal to, or greater than the specified object. The implementor must ensure The implementor must also ensure that the relation is transitive:
Finally, the implementor must ensure that
| |
| equals | back to summary |
|---|---|
| public boolean equals(Object o) Overrides java. Compares this X509Serial with another and returns true if they are equivalent. | |
| getIssuer | back to summary |
|---|---|
| pack-priv X500Principal getIssuer() Returns the issuer.
| |
| getSerial | back to summary |
|---|---|
| pack-priv BigInteger getSerial() Returns the serial number.
| |
| hashCode | back to summary |
|---|---|
| public int hashCode() Overrides java. Returns a hash code value for this X509IssuerSerial.
| |