com.adaptris.security.certificate

Interface CertificateHandler

public interface CertificateHandler

A wrapper around a certificate object.

This interface exposes some simple methods that can be used to get information out of a certificate

A certificate can be imagined as some kind of "digital identity card" attesting that a particular public key belongs to a particular entity. Certificates have a limited period of validity and are digitally signed by some trusted authority. Certificates can be verified by anyone having access to the signing authority public key. Each certification authority has to take care to label every handled certificate with a unique serial number for unequivocally identifying it. Certification authorities also have to maintain certification revocation lists of certificates that heve been expired for some reason and are no longer valid.

If the System property defined by Constants.IGNORE_REV is set to true, then any CRLDistribution points in a given certificate are ignored for the purposes of checking validity and revocation status. This behaviour can be overridden by using the appropriate value for setCheckRevocation(boolean)

Method Summary

Modifier and Type	Method and Description
java.security.cert.Certificate	getCertificate() Get the certificate contained within this handler for further manual querying.
java.lang.String	getIssuer() Get the Issuer of this certificate.
java.lang.String	getKeyAlgorithm() Extract the KeyAlgorithm from the certificate.
java.util.Calendar	getLastRevocationCheck() Return a Calendar object that indicates the date that a revocation check was last performed.
java.security.PublicKey	getPublicKey() Extract the PublicKey from the given Certificate.
java.lang.String	getSignatureAlgorithm() This method extracts the Signature Algorithm from the given Certificate.
java.lang.String	getSignatureAlgorithmObjectId() This method extracts the Signature Algorithm OID from the given Certificate.
boolean	isExpired() Check expiry on the certificate.
boolean	isRevoked() Check revocation status on the certificate.
boolean	isValid() Check the overall validity of this certificate.
void	setCheckRevocation(boolean b) Set the flag for checking revocation.

Method Detail

getPublicKey

java.security.PublicKey getPublicKey()

Extract the PublicKey from the given Certificate.

Returns:

the Public Key

getSignatureAlgorithm

java.lang.String getSignatureAlgorithm()

This method extracts the Signature Algorithm from the given Certificate.

Generally the signature will be stored in the certificate as a string, with the string representing some specific ASN.1 Object identifier

Returns:

sigAlg e.g. "MD5withRSA"

getSignatureAlgorithmObjectId

java.lang.String getSignatureAlgorithmObjectId()

This method extracts the Signature Algorithm OID from the given Certificate.

Sometimes it is possible to get a signature algorithm name that is not recognised by the Security Provider. e.g. "MD5withRSAencryption" is not known by the IAIK provider. In instances like this, this method can be used to get the ASN.1 Object Identifier for the signature algorithm. The returned ASN.1 Object Id string can be used with most providers. e.g. 1.2.840.10040.4.3 would be returned for a "SHA1withDSA" signature algorithm

A concise definition of an ASN.1 Object ID is that "It consists of a sequence of integer components and is used for identifying some abstract information object (for instance an algorithm, an attribute type, or even a registration authority that defines other object identifiers)."

Returns:

sigAlg e.g. "1.2.840.10040.4.3"

getKeyAlgorithm

java.lang.String getKeyAlgorithm()

Extract the KeyAlgorithm from the certificate.

This will return the algorithm type stored in the publickey.

Returns:

the String form of the algorithm type in the public key

isExpired

boolean isExpired()

Check expiry on the certificate.

If a certificate is not yet valid, then it should be considered to be expired.

Returns:

true if the certificate has expired

isRevoked

boolean isRevoked()
           throws AdaptrisSecurityException

Check revocation status on the certificate.

Check if a certificate has been revoked by the CA

This depends on whether the checkRevocation flag has been set and also if there is information available within the certificate to actually get a Certificate revocation list. As revocation lists are held centrally the CA, it is a requirement that the process in question has http access to the host specified in the CRL distribution point.

Returns:

true if the certificate has been revoked, false otherwise

Throws:

AdaptrisSecurityException - on error

See Also:

setCheckRevocation(boolean)

setCheckRevocation

void setCheckRevocation(boolean b)

Set the flag for checking revocation.

Checking revocation could take some time, so with this option being set ,an isRevoked() call will only actually check for revocation on some pre-determined schedule currently set at once a day.isRevoked() is implicitly called if an isValid() call is made.

Parameters:

b - true or false

See Also:

isRevoked(), isValid(), getLastRevocationCheck()

isValid

boolean isValid()
         throws AdaptrisSecurityException

Check the overall validity of this certificate.

This involves checking expiry and revocation as required.

Returns:

true if the certificate is valid.

Throws:

AdaptrisSecurityException - on error

getCertificate

java.security.cert.Certificate getCertificate()

Get the certificate contained within this handler for further manual querying.

Returns:

the certificate

getIssuer

java.lang.String getIssuer()

Get the Issuer of this certificate.

Returns:

the issuer

getLastRevocationCheck

java.util.Calendar getLastRevocationCheck()

Return a Calendar object that indicates the date that a revocation check was last performed.

This is dependent on a number of things...

• setCheckRevocation(true)
• isRevoked() having been previously invoked

Returns:

a Calendar object, or null if a revocation check was never made.

See Also:

isRevoked(), isValid(), setCheckRevocation(boolean), Calendar