Bouncy Castle PKIX, CMS, EAC, TSP, PKCS, OCSP, CMP, and CRMF APIs 1.77 · org.bouncycastle.est.ESTService

Modifier and Type	Field and Description
protected static final String	CACERTS
private final ESTClientProvider	clientProvider
protected static final String	CSRATTRS
protected static final String	FULLCMC
protected static final Set<String>	illegalParts
private static final Pattern	pathInValid
private final String	server
protected static final String	SERVERGEN
protected static final String	SIMPLE_ENROLL
protected static final String	SIMPLE_REENROLL

Access	Constructor and Description
pack-priv	ESTService(String serverAuthority, String label, ESTClientProvider clientProvider)

Method Summary

Modifier and Type	Method and Description
private String	annotateRequest(byte[] data)
protected EnrollmentResponse	Returns: The enrolled certificate. enroll(boolean reenroll, PKCS10CertificationRequest The certification request. certificationRequest, ESTAuth The http auth provider, basic auth or digest auth, can be null. auth, boolean if true, request server key generation certGen) Perform a simple enrollment operation.
public EnrollmentResponse	Returns: Enrollment response. enrollPop(boolean True = re enroll. reEnroll, final PKCS10CertificationRequestBuilder The request builder. builder, final ContentSigner The content signer. contentSigner, ESTAuth Auth modes. auth, boolean if true will request server key generation. certGen) Implements Enroll with PoP.
private ASN1InputStream	getASN1InputStream(InputStream respStream, Long contentLength)
public CACertsResponse	Returns: A store of X509Certificates. getCACerts() Query the EST server for ca certificates.
public CSRRequestResponse	Returns: A CSRRequestResponse with the attributes. getCSRAttributes() Fetch he CSR Attributes from the server.
protected EnrollmentResponse	Returns: An EnrollmentResponse. handleEnrollResponse(ESTResponse The response. resp) Handles an enrollment response, deals with status codes and setting of delays.
public EnrollmentResponse	Returns: A new ESTEnrollmentResponse simpleEnroll(EnrollmentResponse The prior response. priorResponse) Reissue an existing request where the server had previously returned a 202.
public EnrollmentResponse	Returns: The enrolled certificate. simpleEnroll(boolean true for enrollment. reenroll, PKCS10CertificationRequest The certification request. certificationRequest, ESTAuth The http auth provider, basic auth or digest auth, can be null. auth) Perform a simple enrollment operation.
public EnrollmentResponse	Returns: Enrollment response. simpleEnrollPoP(boolean True = re enroll. reEnroll, final PKCS10CertificationRequestBuilder The request builder. builder, final ContentSigner The content signer. contentSigner, ESTAuth Auth modes. auth) Implements Enroll with PoP.
public EnrollmentResponse	Returns: Enrollment Response simpleEnrollPopWithServersideCreation(final PKCS10CertificationRequestBuilder The request builder. builder, final ContentSigner The content signer contentSigner, ESTAuth Auth modes auth) Simple enrollment with PoP and server side creation of keys.
public EnrollmentResponse	Returns: The enrolled certificate. simpleEnrollWithServersideCreation(PKCS10CertificationRequest The certification request. certificationRequest, ESTAuth The http auth provider, basic auth or digest auth, can be null. auth) Perform a simple enrollment operation.
public static X509CertificateHolder[]	Returns: An arrar of certificates/ storeToArray(Store<X509CertificateHolder> The store. store) Utility method to extract all the X509Certificates from a store and return them in an array.
public static X509CertificateHolder[]	Returns: An array of X509Certificates. storeToArray(Store<X509CertificateHolder> The store. store, Selector<X509CertificateHolder> The selector. selector) Utility method to extract all the X509Certificates from a store using a filter and to return them as an array.
private String	verifyLabel(String label)
private String	verifyServer(String server)

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

CACERTS	back to summary
protected static final String CACERTS

clientProvider	back to summary
private final ESTClientProvider clientProvider

CSRATTRS	back to summary
protected static final String CSRATTRS

FULLCMC	back to summary
protected static final String FULLCMC

illegalParts	back to summary
protected static final Set<String> illegalParts

pathInValid	back to summary
private static final Pattern pathInValid

server	back to summary
private final String server

SERVERGEN	back to summary
protected static final String SERVERGEN

SIMPLE_ENROLL	back to summary
protected static final String SIMPLE_ENROLL

SIMPLE_REENROLL	back to summary
protected static final String SIMPLE_REENROLL

ESTService	back to summary
pack-priv ESTService(String serverAuthority, String label, ESTClientProvider clientProvider)

Method Detail

annotateRequest	back to summary
private String annotateRequest(byte[] data)

enroll	back to summary
protected EnrollmentResponse enroll(boolean reenroll, PKCS10CertificationRequest certificationRequest, ESTAuth auth, boolean certGen) throws IOException Perform a simple enrollment operation. This method accepts an ESPHttpAuth instance to provide basic or digest authentication. If authentication is to be performed as part of TLS then this instances client keystore and their keystore password need to be specified. Parameters certificationRequest:PKCS10CertificationRequest The certification request. auth:ESTAuth The http auth provider, basic auth or digest auth, can be null. certGen:boolean if true, request server key generation Returns:EnrollmentResponse The enrolled certificate.

enroll

back to summary

protected EnrollmentResponse enroll(boolean reenroll, PKCS10CertificationRequest certificationRequest, ESTAuth auth, boolean certGen) throws IOException

Perform a simple enrollment operation.

This method accepts an ESPHttpAuth instance to provide basic or digest authentication.

If authentication is to be performed as part of TLS then this instances client keystore and their keystore password need to be specified.

Parameters

certificationRequest:PKCS10CertificationRequest: The certification request.
auth:ESTAuth: The http auth provider, basic auth or digest auth, can be null.
certGen:boolean: if true, request server key generation

Returns:EnrollmentResponse

The enrolled certificate.

enrollPop	back to summary
public EnrollmentResponse enrollPop(boolean reEnroll, final PKCS10CertificationRequestBuilder builder, final ContentSigner contentSigner, ESTAuth auth, boolean certGen) throws IOException Implements Enroll with PoP. Request will have the tls-unique attribute added to it before it is signed and completed. Parameters reEnroll:boolean True = re enroll. builder:PKCS10CertificationRequestBuilder The request builder. contentSigner:ContentSigner The content signer. auth:ESTAuth Auth modes. certGen:boolean if true will request server key generation. Returns:EnrollmentResponse Enrollment response.

enrollPop

back to summary

public EnrollmentResponse enrollPop(boolean reEnroll, final PKCS10CertificationRequestBuilder builder, final ContentSigner contentSigner, ESTAuth auth, boolean certGen) throws IOException

Implements Enroll with PoP. Request will have the tls-unique attribute added to it before it is signed and completed.

Parameters

reEnroll:boolean: True = re enroll.
builder:PKCS10CertificationRequestBuilder: The request builder.
contentSigner:ContentSigner: The content signer.
auth:ESTAuth: Auth modes.
certGen:boolean: if true will request server key generation.

Returns:EnrollmentResponse

Enrollment response.

getASN1InputStream	back to summary
private ASN1InputStream getASN1InputStream(InputStream respStream, Long contentLength)

getCACerts	back to summary
public CACertsResponse getCACerts() throws ESTException Query the EST server for ca certificates. RFC7030 leans heavily on the verification phases of TLS for both client and server verification. It does however define a bootstrapping mode where if the client does not have the necessary ca certificates to validate the server it can defer to an external source, such as a human, to formally accept the ca certs. If callers are using bootstrapping they must examine the CACertsResponse and validate it externally. Returns:CACertsResponse A store of X509Certificates.

getCACerts

back to summary

public CACertsResponse getCACerts() throws ESTException

Query the EST server for ca certificates.

RFC7030 leans heavily on the verification phases of TLS for both client and server verification.

It does however define a bootstrapping mode where if the client does not have the necessary ca certificates to validate the server it can defer to an external source, such as a human, to formally accept the ca certs.

If callers are using bootstrapping they must examine the CACertsResponse and validate it externally.

Returns:CACertsResponse: A store of X509Certificates.

getCSRAttributes	back to summary
public CSRRequestResponse getCSRAttributes() throws ESTException Fetch he CSR Attributes from the server. Returns:CSRRequestResponse A CSRRequestResponse with the attributes.

getCSRAttributes

back to summary

public CSRRequestResponse getCSRAttributes() throws ESTException

Fetch he CSR Attributes from the server.

Returns:CSRRequestResponse: A CSRRequestResponse with the attributes.

handleEnrollResponse	back to summary
protected EnrollmentResponse handleEnrollResponse(ESTResponse resp) throws IOException Handles an enrollment response, deals with status codes and setting of delays. Parameters resp:ESTResponse The response. Returns:EnrollmentResponse An EnrollmentResponse.

handleEnrollResponse

back to summary

protected EnrollmentResponse handleEnrollResponse(ESTResponse resp) throws IOException

Handles an enrollment response, deals with status codes and setting of delays.

Parameters

resp:ESTResponse: The response.

Returns:EnrollmentResponse

An EnrollmentResponse.

simpleEnroll	back to summary
public EnrollmentResponse simpleEnroll(EnrollmentResponse priorResponse) throws Exception Reissue an existing request where the server had previously returned a 202. Parameters priorResponse:EnrollmentResponse The prior response. Returns:EnrollmentResponse A new ESTEnrollmentResponse

simpleEnroll

back to summary

public EnrollmentResponse simpleEnroll(EnrollmentResponse priorResponse) throws Exception

Reissue an existing request where the server had previously returned a 202.

Parameters

priorResponse:EnrollmentResponse: The prior response.

Returns:EnrollmentResponse

A new ESTEnrollmentResponse

simpleEnroll	back to summary
public EnrollmentResponse simpleEnroll(boolean reenroll, PKCS10CertificationRequest certificationRequest, ESTAuth auth) throws IOException Perform a simple enrollment operation. This method accepts an ESPHttpAuth instance to provide basic or digest authentication. If authentication is to be performed as part of TLS then this instances client keystore and their keystore password need to be specified. Parameters reenroll:boolean true for enrollment. certificationRequest:PKCS10CertificationRequest The certification request. auth:ESTAuth The http auth provider, basic auth or digest auth, can be null. Returns:EnrollmentResponse The enrolled certificate.

simpleEnroll

back to summary

public EnrollmentResponse simpleEnroll(boolean reenroll, PKCS10CertificationRequest certificationRequest, ESTAuth auth) throws IOException

Perform a simple enrollment operation.

This method accepts an ESPHttpAuth instance to provide basic or digest authentication.

If authentication is to be performed as part of TLS then this instances client keystore and their keystore password need to be specified.

Parameters

reenroll:boolean: true for enrollment.
certificationRequest:PKCS10CertificationRequest: The certification request.
auth:ESTAuth: The http auth provider, basic auth or digest auth, can be null.

Returns:EnrollmentResponse

The enrolled certificate.

simpleEnrollPoP	back to summary
public EnrollmentResponse simpleEnrollPoP(boolean reEnroll, final PKCS10CertificationRequestBuilder builder, final ContentSigner contentSigner, ESTAuth auth) throws IOException Implements Enroll with PoP. Request will have the tls-unique attribute added to it before it is signed and completed. Parameters reEnroll:boolean True = re enroll. builder:PKCS10CertificationRequestBuilder The request builder. contentSigner:ContentSigner The content signer. auth:ESTAuth Auth modes. Returns:EnrollmentResponse Enrollment response.

simpleEnrollPoP

back to summary

public EnrollmentResponse simpleEnrollPoP(boolean reEnroll, final PKCS10CertificationRequestBuilder builder, final ContentSigner contentSigner, ESTAuth auth) throws IOException

Implements Enroll with PoP. Request will have the tls-unique attribute added to it before it is signed and completed.

Parameters

reEnroll:boolean: True = re enroll.
builder:PKCS10CertificationRequestBuilder: The request builder.
contentSigner:ContentSigner: The content signer.
auth:ESTAuth: Auth modes.

Returns:EnrollmentResponse

Enrollment response.

simpleEnrollPopWithServersideCreation	back to summary
public EnrollmentResponse simpleEnrollPopWithServersideCreation(final PKCS10CertificationRequestBuilder builder, final ContentSigner contentSigner, ESTAuth auth) throws IOException Simple enrollment with PoP and server side creation of keys. Parameters builder:PKCS10CertificationRequestBuilder The request builder. contentSigner:ContentSigner The content signer auth:ESTAuth Auth modes Returns:EnrollmentResponse Enrollment Response

simpleEnrollPopWithServersideCreation

back to summary

public EnrollmentResponse simpleEnrollPopWithServersideCreation(final PKCS10CertificationRequestBuilder builder, final ContentSigner contentSigner, ESTAuth auth) throws IOException

Simple enrollment with PoP and server side creation of keys.

Parameters

builder:PKCS10CertificationRequestBuilder: The request builder.
contentSigner:ContentSigner: The content signer
auth:ESTAuth: Auth modes

Returns:EnrollmentResponse

Enrollment Response

simpleEnrollWithServersideCreation	back to summary
public EnrollmentResponse simpleEnrollWithServersideCreation(PKCS10CertificationRequest certificationRequest, ESTAuth auth) throws IOException Perform a simple enrollment operation. This method accepts an ESPHttpAuth instance to provide basic or digest authentication. If authentication is to be performed as part of TLS then this instances client keystore and their keystore password need to be specified. Parameters certificationRequest:PKCS10CertificationRequest The certification request. auth:ESTAuth The http auth provider, basic auth or digest auth, can be null. Returns:EnrollmentResponse The enrolled certificate.

simpleEnrollWithServersideCreation

back to summary

public EnrollmentResponse simpleEnrollWithServersideCreation(PKCS10CertificationRequest certificationRequest, ESTAuth auth) throws IOException

Perform a simple enrollment operation.

This method accepts an ESPHttpAuth instance to provide basic or digest authentication.

If authentication is to be performed as part of TLS then this instances client keystore and their keystore password need to be specified.

Parameters

certificationRequest:PKCS10CertificationRequest: The certification request.
auth:ESTAuth: The http auth provider, basic auth or digest auth, can be null.

Returns:EnrollmentResponse

The enrolled certificate.

storeToArray	back to summary
public static X509CertificateHolder[] storeToArray(Store<X509CertificateHolder> store) Utility method to extract all the X509Certificates from a store and return them in an array. Parameters store:Store<X509CertificateHolder> The store. Returns:X509CertificateHolder[] An arrar of certificates/

storeToArray

back to summary

public static X509CertificateHolder[] storeToArray(Store<X509CertificateHolder> store)

Utility method to extract all the X509Certificates from a store and return them in an array.

Parameters

store:Store<X509CertificateHolder>: The store.

Returns:X509CertificateHolder[]

An arrar of certificates/

storeToArray	back to summary
public static X509CertificateHolder[] storeToArray(Store<X509CertificateHolder> store, Selector<X509CertificateHolder> selector) Utility method to extract all the X509Certificates from a store using a filter and to return them as an array. Parameters store:Store<X509CertificateHolder> The store. selector:Selector<X509CertificateHolder> The selector. Returns:X509CertificateHolder[] An array of X509Certificates.

storeToArray

back to summary

public static X509CertificateHolder[] storeToArray(Store<X509CertificateHolder> store, Selector<X509CertificateHolder> selector)

Utility method to extract all the X509Certificates from a store using a filter and to return them as an array.

Parameters

store:Store<X509CertificateHolder>: The store.
selector:Selector<X509CertificateHolder>: The selector.

Returns:X509CertificateHolder[]

An array of X509Certificates.

verifyLabel	back to summary
private String verifyLabel(String label)

verifyServer	back to summary
private String verifyServer(String server)

public Class ESTService

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail