java.security.cert
Class CertificateFactory
- java.lang.Object
java.security.cert.CertificateFactory
- public class CertificateFactory
- extends Object
CertPath
)
and certificate revocation list (CRL) objects from their encodings.
For encodings consisting of multiple certificates, use
generateCertificates
when you want to
parse a collection of possibly unrelated certificates. Otherwise,
use generateCertPath
when you want to generate
a CertPath
(a certificate chain) and subsequently
validate it with a CertPathValidator
.
A certificate factory for X.509 must return certificates that are an
instance of java.security.cert.X509Certificate
, and CRLs
that are an instance of java.security.cert.X509CRL
.
The following example reads a file with Base64 encoded certificates,
which are each bounded at the beginning by -----BEGIN CERTIFICATE-----, and
bounded at the end by -----END CERTIFICATE-----. We convert the
FileInputStream
(which does not support mark
and reset
) to a BufferedInputStream
(which
supports those methods), so that each call to
generateCertificate
consumes only one certificate, and the
read position of the input stream is positioned to the next certificate in
the file:
FileInputStream fis = new FileInputStream(filename); BufferedInputStream bis = new BufferedInputStream(fis); CertificateFactory cf = CertificateFactory.getInstance("X.509"); while (bis.available() > 0) { Certificate cert = cf.generateCertificate(bis); System.out.println(cert.toString()); }
The following example parses a PKCS#7-formatted certificate reply stored in a file and extracts all the certificates from it:
FileInputStream fis = new FileInputStream(filename); CertificateFactory cf = CertificateFactory.getInstance("X.509"); Collection c = cf.generateCertificates(fis); Iterator i = c.iterator(); while (i.hasNext()) { Certificate cert = (Certificate)i.next(); System.out.println(cert); }
Constructor Summary
Modifier | Constructor and Description |
---|---|
|
CertificateFactory(CertificateFactorySpi certFacSpi,Provider provider,String type)
Creates a CertificateFactory object of the given type, and encapsulates
the given provider implementation (SPI object) in it.
|
Method Summary
Modifier and Type | Method and Description |
---|---|
generateCertificate(InputStream inStream)
Generates a certificate object and initializes it with
the data read from the input stream
inStream .
|
|
|
generateCertificates(InputStream inStream)
Returns a (possibly empty) collection view of the certificates read
from the given input stream
inStream .
|
generateCertPath(InputStream inStream)
Generates a
CertPath object and initializes it
with the data read from the InputStream inStream.
|
|
generateCertPath(InputStream inStream,String encoding)
Generates a
CertPath object and initializes it with the
data read from the InputStream inStream.
|
|
generateCertPath(List<? extends Certificate> certificates)
Generates a
CertPath object and initializes it with a
List of Certificate s.
|
|
generateCRL(InputStream inStream)
Generates a certificate revocation list (CRL) object and initializes it
with the data read from the input stream
inStream .
|
|
|
generateCRLs(InputStream inStream)
Returns a (possibly empty) collection view of the CRLs read
from the given input stream
inStream .
|
getCertPathEncodings()
Returns an iteration of the
CertPath encodings supported by
this certificate factory, with the default encoding first.
|
|
|
getInstance(String type)
Returns a certificate factory object that implements the
specified certificate type.
|
|
getInstance(String type,Provider provider)
Returns a certificate factory object for the specified
certificate type.
|
|
getInstance(String type,String provider)
Returns a certificate factory object for the specified
certificate type.
|
getProvider()
Returns the provider of this certificate factory.
|
|
getType()
Returns the name of the certificate type associated with this
certificate factory.
|
Methods inherited from class java.lang.Object |
---|
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
Constructor Detail
CertificateFactory
- protected CertificateFactory(CertificateFactorySpi certFacSpi,
- Provider provider,
- String type)
certFacSpi
- the provider implementation. provider
- the provider. type
- the certificate type. Method Detail
getInstance
- public static final CertificateFactory getInstance( String type)
- throws CertificateException
This method traverses the list of registered security Providers, starting with the most preferred Provider. A new CertificateFactory object encapsulating the CertificateFactorySpi implementation from the first Provider that supports the specified type is returned.
Note that the list of registered providers may be retrieved via
the Security.getProviders()
method.
type
- the name of the requested certificate type.
See Appendix A in the
Java Certification Path API Programmer's Guide
for information about standard certificate types. CertificateException
- if no Provider supports a
CertificateFactorySpi implementation for the
specified type. getInstance
- public static final CertificateFactory getInstance( String type,
- String provider)
- throws CertificateException
- NoSuchProviderException
A new CertificateFactory object encapsulating the CertificateFactorySpi implementation from the specified provider is returned. The specified provider must be registered in the security provider list.
Note that the list of registered providers may be retrieved via
the Security.getProviders()
method.
type
- the certificate type.
See Appendix A in the
Java Certification Path API Programmer's Guide
for information about standard certificate types. provider
- the name of the provider. CertificateException
- if a CertificateFactorySpi
implementation for the specified algorithm is not
available from the specified provider. NoSuchProviderException
- if the specified provider is not
registered in the security provider list. IllegalArgumentException
- if the provider name is null
or empty. getInstance
- public static final CertificateFactory getInstance( String type,
- Provider provider)
- throws CertificateException
A new CertificateFactory object encapsulating the CertificateFactorySpi implementation from the specified Provider object is returned. Note that the specified Provider object does not have to be registered in the provider list.
type
- the certificate type.
See Appendix A in the
Java Certification Path API Programmer's Guide
for information about standard certificate types. provider
- the provider. CertificateException
- if a CertificateFactorySpi
implementation for the specified algorithm is not available
from the specified Provider object. IllegalArgumentException
- if the provider
is
null. generateCertPath
- public final CertPath generateCertPath( InputStream inStream)
- throws CertificateException
CertPath
object and initializes it
with the data read from the InputStream
inStream. The data
is assumed to be in the default encoding. The name of the default
encoding is the first element of the Iterator
returned
by the getCertPathEncodings
method.
inStream
- an InputStream
containing the data CertPath
initialized with the data from the
InputStream
CertificateException
- if an exception occurs
while decoding generateCertPath
- public final CertPath generateCertPath( InputStream inStream,
- String encoding)
- throws CertificateException
CertPath
object and initializes it with the
data read from the InputStream
inStream. The data is
assumed to be in the specified encoding. See Appendix A in the
Java Certification Path API Programmer's Guide
for information about standard encoding names and their formats.
inStream
- an InputStream
containing the data encoding
- the encoding used for the data CertPath
initialized with the data from the
InputStream
CertificateException
- if an exception occurs while decoding or
the encoding requested is not supported generateCertPath
- public final CertPath generateCertPath( List<? extends Certificate> certificates)
- throws CertificateException
CertPath
object and initializes it with a
List
of Certificate
s.
The certificates supplied must be of a type supported by the
CertPathFactory
. They will be copied out of the supplied
List
object.
certificates
- a List
of Certificate
s CertPath
initialized with the supplied list of
certificates CertificateException
- if an exception occurs getCertPathEncodings
CertPath
encodings supported by
this certificate factory, with the default encoding first. See
Appendix A in the
Java Certification Path API Programmer's Guide for information about
standard encoding names and their formats.
Attempts to modify the returned Iterator
via its remove
method result
in an UnsupportedOperationException
.
Iterator
over the names of the supported CertPath
encodings (as String
s) getProvider
- public final Provider getProvider( )
getType
- public final String getType()
generateCertificate
- public final Certificate generateCertificate( InputStream inStream)
- throws CertificateException
inStream
.
In order to take advantage of the specialized certificate format
supported by this certificate factory,
the returned certificate object can be typecast to the corresponding
certificate class. For example, if this certificate
factory implements X.509 certificates, the returned certificate object
can be typecast to the X509Certificate
class.
In the case of a certificate factory for X.509 certificates, the
certificate provided in inStream
must be DER-encoded and
may be supplied in binary or printable (Base64) encoding. If the
certificate is provided in Base64 encoding, it must be bounded at
the beginning by -----BEGIN CERTIFICATE-----, and must be bounded at
the end by -----END CERTIFICATE-----.
Note that if the given input stream does not support
mark
and
reset
, this method will
consume the entire input stream. Otherwise, each call to this
method consumes one certificate and the read position of the
input stream is positioned to the next available byte after
the inherent end-of-certificate marker. If the data in the input stream
does not contain an inherent end-of-certificate marker (other
than EOF) and there is trailing data after the certificate is parsed, a
CertificateException
is thrown.
inStream
- an input stream with the certificate data. CertificateException
- on parsing errors. generateCertificates
- public final Collection<? extends Certificate> generateCertificates( InputStream inStream)
- throws CertificateException
inStream
.
In order to take advantage of the specialized certificate format
supported by this certificate factory, each element in
the returned collection view can be typecast to the corresponding
certificate class. For example, if this certificate
factory implements X.509 certificates, the elements in the returned
collection can be typecast to the X509Certificate
class.
In the case of a certificate factory for X.509 certificates,
inStream
may contain a sequence of DER-encoded certificates
in the formats described for
generateCertificate
.
In addition, inStream
may contain a PKCS#7 certificate
chain. This is a PKCS#7 SignedData object, with the only
significant field being certificates. In particular, the
signature and the contents are ignored. This format allows multiple
certificates to be downloaded at once. If no certificates are present,
an empty collection is returned.
Note that if the given input stream does not support
mark
and
reset
, this method will
consume the entire input stream.
inStream
- the input stream with the certificates. CertificateException
- on parsing errors. generateCRL
- public final CRL generateCRL(InputStream inStream)
- throws CRLException
inStream
.
In order to take advantage of the specialized CRL format
supported by this certificate factory,
the returned CRL object can be typecast to the corresponding
CRL class. For example, if this certificate
factory implements X.509 CRLs, the returned CRL object
can be typecast to the X509CRL
class.
Note that if the given input stream does not support
mark
and
reset
, this method will
consume the entire input stream. Otherwise, each call to this
method consumes one CRL and the read position of the input stream
is positioned to the next available byte after the the inherent
end-of-CRL marker. If the data in the
input stream does not contain an inherent end-of-CRL marker (other
than EOF) and there is trailing data after the CRL is parsed, a
CRLException
is thrown.
inStream
- an input stream with the CRL data. CRLException
- on parsing errors. generateCRLs
- public final Collection<? extends CRL> generateCRLs( InputStream inStream)
- throws CRLException
inStream
.
In order to take advantage of the specialized CRL format
supported by this certificate factory, each element in
the returned collection view can be typecast to the corresponding
CRL class. For example, if this certificate
factory implements X.509 CRLs, the elements in the returned
collection can be typecast to the X509CRL
class.
In the case of a certificate factory for X.509 CRLs,
inStream
may contain a sequence of DER-encoded CRLs.
In addition, inStream
may contain a PKCS#7 CRL
set. This is a PKCS#7 SignedData object, with the only
significant field being crls. In particular, the
signature and the contents are ignored. This format allows multiple
CRLs to be downloaded at once. If no CRLs are present,
an empty collection is returned.
Note that if the given input stream does not support
mark
and
reset
, this method will
consume the entire input stream.
inStream
- the input stream with the CRLs. CRLException
- on parsing errors.