X509Extension
Stay organized with collections
Save and categorize content based on your preferences.
Known Indirect Subclasses
X509CRL |
Abstract class for an X.509 Certificate Revocation List (CRL). |
X509CRLEntry |
Abstract class for a revoked certificate in a CRL (Certificate
Revocation List). |
X509Certificate |
Abstract class for X.509 certificates. |
|
Interface for an X.509 extension.
The extensions defined for X.509 v3
Certificates
and v2
CRLs
(Certificate Revocation
Lists) provide methods
for associating additional attributes with users or public keys,
for managing the certification hierarchy, and for managing CRL
distribution. The X.509 extensions format also allows communities
to define private extensions to carry information unique to those
communities.
Each extension in a certificate/CRL may be designated as
critical or non-critical. A certificate/CRL-using system (an application
validating a certificate/CRL) must reject the certificate/CRL if it
encounters a critical extension it does not recognize. A non-critical
extension may be ignored if it is not recognized.
The ASN.1 definition for this is:
Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension
Extension ::= SEQUENCE {
extnId OBJECT IDENTIFIER,
critical BOOLEAN DEFAULT FALSE,
extnValue OCTET STRING
-- contains a DER encoding of a value
-- of the type registered for use with
-- the extnId object identifier value
}
Since not all extensions are known, the
getExtensionValue
method returns the DER-encoded OCTET STRING of the
extension value (i.e., the
extnValue
). This can then
be handled by a
Class that understands the extension.
Public Method Summary
abstract
Set<String>
|
getCriticalExtensionOIDs()
Gets a Set of the OID strings for the extension(s) marked
CRITICAL in the certificate/CRL managed by the object
implementing this interface.
|
abstract
byte[]
|
getExtensionValue( String oid)
Gets the DER-encoded OCTET string for the extension value
(extnValue) identified by the passed-in oid
String.
|
abstract
Set<String>
|
getNonCriticalExtensionOIDs()
Gets a Set of the OID strings for the extension(s) marked
NON-CRITICAL in the certificate/CRL managed by the object
implementing this interface.
|
abstract
boolean
|
|
Public Methods
public
abstract
Set<String>
getCriticalExtensionOIDs
()
Gets a Set of the OID strings for the extension(s) marked
CRITICAL in the certificate/CRL managed by the object
implementing this interface.
Here is sample code to get a Set of critical extensions from an
X509Certificate and print the OIDs:
X509Certificate cert = null;
try (InputStream inStrm = new FileInputStream("DER-encoded-Cert")) {
CertificateFactory cf = CertificateFactory.getInstance("X.509");
cert = (X509Certificate)cf.generateCertificate(inStrm);
}
Set<String> critSet = cert.getCriticalExtensionOIDs();
if (critSet != null && !critSet.isEmpty()) {
System.out.println("Set of critical extensions:");
for (String oid : critSet) {
System.out.println(oid);
}
}
Returns
- a Set (or an empty Set if none are marked critical) of
the extension OID strings for extensions that are marked critical.
If there are no extensions present at all, then this method returns
null.
public
abstract
byte[]
getExtensionValue
(String oid)
Gets the DER-encoded OCTET string for the extension value
(extnValue) identified by the passed-in oid
String.
The oid
string is
represented by a set of nonnegative whole numbers separated
by periods.
For example:
OID (Object Identifier) |
Extension Name |
2.5.29.14 |
SubjectKeyIdentifier |
2.5.29.15 |
KeyUsage |
2.5.29.16 |
PrivateKeyUsage |
2.5.29.17 |
SubjectAlternativeName |
2.5.29.18 |
IssuerAlternativeName |
2.5.29.19 |
BasicConstraints |
2.5.29.30 |
NameConstraints |
2.5.29.33 |
PolicyMappings |
2.5.29.35 |
AuthorityKeyIdentifier |
2.5.29.36 |
PolicyConstraints |
Parameters
oid |
the Object Identifier value for the extension. |
Returns
- the DER-encoded octet string of the extension value or
null if it is not present.
public
abstract
Set<String>
getNonCriticalExtensionOIDs
()
Gets a Set of the OID strings for the extension(s) marked
NON-CRITICAL in the certificate/CRL managed by the object
implementing this interface.
Here is sample code to get a Set of non-critical extensions from an
X509CRL revoked certificate entry and print the OIDs:
CertificateFactory cf = null;
X509CRL crl = null;
try (InputStream inStrm = new FileInputStream("DER-encoded-CRL")) {
cf = CertificateFactory.getInstance("X.509");
crl = (X509CRL)cf.generateCRL(inStrm);
}
byte[] certData = <DER-encoded certificate data>
ByteArrayInputStream bais = new ByteArrayInputStream(certData);
X509Certificate cert = (X509Certificate)cf.generateCertificate(bais);
X509CRLEntry badCert =
crl.getRevokedCertificate(cert.getSerialNumber());
if (badCert != null) {
Set<String> nonCritSet = badCert.getNonCriticalExtensionOIDs();
if (nonCritSet != null)
for (String oid : nonCritSet) {
System.out.println(oid);
}
}
Returns
- a Set (or an empty Set if none are marked non-critical) of
the extension OID strings for extensions that are marked non-critical.
If there are no extensions present at all, then this method returns
null.
public
abstract
boolean
hasUnsupportedCriticalExtension
()
Check if there is a critical extension that is not supported.
Returns
true
if a critical extension is found that is
not supported, otherwise false
.
Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2024-07-10 UTC.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Missing the information I need","missingTheInformationINeed","thumb-down"],["Too complicated / too many steps","tooComplicatedTooManySteps","thumb-down"],["Out of date","outOfDate","thumb-down"],["Samples / code issue","samplesCodeIssue","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2024-07-10 UTC."],[[["\u003cp\u003eThe \u003ccode\u003eX509Extension\u003c/code\u003e interface defines methods for handling extensions in X.509 v3 certificates and v2 CRLs (Certificate Revocation Lists), allowing for the inclusion of additional attributes and management of the certification hierarchy.\u003c/p\u003e\n"],["\u003cp\u003eExtensions can be marked as critical or non-critical, with critical extensions requiring recognition by certificate/CRL-using systems to avoid rejection.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003egetExtensionValue\u003c/code\u003e method provides access to the DER-encoded OCTET STRING of an extension value, which can be processed by classes understanding the specific extension type.\u003c/p\u003e\n"],["\u003cp\u003eThe interface includes methods to retrieve sets of critical and non-critical extension OIDs and to check for the presence of unsupported critical extensions.\u003c/p\u003e\n"]]],[],null,["# X509Extension\n\npublic interface **X509Extension** \n\n|---|---|---|\n| Known Indirect Subclasses [X509CRL](../../../../reference/java/security/cert/X509CRL.html), [X509CRLEntry](../../../../reference/java/security/cert/X509CRLEntry.html), [X509Certificate](../../../../reference/java/security/cert/X509Certificate.html) |----------------------------------------------------------------------------------|----------------------------------------------------------------------------------| | [X509CRL](../../../../reference/java/security/cert/X509CRL.html) | Abstract class for an X.509 Certificate Revocation List (CRL). | | [X509CRLEntry](../../../../reference/java/security/cert/X509CRLEntry.html) | Abstract class for a revoked certificate in a CRL (Certificate Revocation List). | | [X509Certificate](../../../../reference/java/security/cert/X509Certificate.html) | Abstract class for X.509 certificates. | |||\n\nInterface for an X.509 extension.\n\nThe extensions defined for X.509 v3\n[Certificates](../../../../reference/java/security/cert/X509Certificate.html) and v2\n[CRLs](../../../../reference/java/security/cert/X509CRL.html) (Certificate Revocation\nLists) provide methods\nfor associating additional attributes with users or public keys,\nfor managing the certification hierarchy, and for managing CRL\ndistribution. The X.509 extensions format also allows communities\nto define private extensions to carry information unique to those\ncommunities.\n\nEach extension in a certificate/CRL may be designated as\ncritical or non-critical. A certificate/CRL-using system (an application\nvalidating a certificate/CRL) must reject the certificate/CRL if it\nencounters a critical extension it does not recognize. A non-critical\nextension may be ignored if it is not recognized.\n\n\nThe ASN.1 definition for this is: \n\n```\n Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension\n\n Extension ::= SEQUENCE {\n extnId OBJECT IDENTIFIER,\n critical BOOLEAN DEFAULT FALSE,\n extnValue OCTET STRING\n -- contains a DER encoding of a value\n -- of the type registered for use with\n -- the extnId object identifier value\n }\n \n```\nSince not all extensions are known, the `getExtensionValue` method returns the DER-encoded OCTET STRING of the extension value (i.e., the `extnValue`). This can then be handled by a *Class* that understands the extension.\n\n\u003cbr /\u003e\n\n### Public Method Summary\n\n|-------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| abstract [Set](../../../../reference/java/util/Set.html)\\\u003c[String](../../../../reference/java/lang/String.html)\\\u003e | [getCriticalExtensionOIDs](../../../../reference/java/security/cert/X509Extension.html#getCriticalExtensionOIDs())() Gets a Set of the OID strings for the extension(s) marked CRITICAL in the certificate/CRL managed by the object implementing this interface. |\n| abstract byte\\[\\] | [getExtensionValue](../../../../reference/java/security/cert/X509Extension.html#getExtensionValue(java.lang.String))([String](../../../../reference/java/lang/String.html) oid) Gets the DER-encoded OCTET string for the extension value (*extnValue* ) identified by the passed-in `oid` String. |\n| abstract [Set](../../../../reference/java/util/Set.html)\\\u003c[String](../../../../reference/java/lang/String.html)\\\u003e | [getNonCriticalExtensionOIDs](../../../../reference/java/security/cert/X509Extension.html#getNonCriticalExtensionOIDs())() Gets a Set of the OID strings for the extension(s) marked NON-CRITICAL in the certificate/CRL managed by the object implementing this interface. |\n| abstract boolean | [hasUnsupportedCriticalExtension](../../../../reference/java/security/cert/X509Extension.html#hasUnsupportedCriticalExtension())() Check if there is a critical extension that is not supported. |\n\nPublic Methods\n--------------\n\n#### public abstract [Set](../../../../reference/java/util/Set.html)\\\u003c[String](../../../../reference/java/lang/String.html)\\\u003e\n**getCriticalExtensionOIDs**\n()\n\nGets a Set of the OID strings for the extension(s) marked\nCRITICAL in the certificate/CRL managed by the object\nimplementing this interface.\n\nHere is sample code to get a Set of critical extensions from an\nX509Certificate and print the OIDs: \n\n X509Certificate cert = null;\n try (InputStream inStrm = new FileInputStream(\"DER-encoded-Cert\")) {\n CertificateFactory cf = CertificateFactory.getInstance(\"X.509\");\n cert = (X509Certificate)cf.generateCertificate(inStrm);\n }\n\n Set\u003cString\u003e critSet = cert.getCriticalExtensionOIDs();\n if (critSet != null && !critSet.isEmpty()) {\n System.out.println(\"Set of critical extensions:\");\n for (String oid : critSet) {\n System.out.println(oid);\n }\n }\n \n\u003cbr /\u003e\n\n##### Returns\n\n- a Set (or an empty Set if none are marked critical) of the extension OID strings for extensions that are marked critical. If there are no extensions present at all, then this method returns null. \n\n#### public abstract byte\\[\\]\n**getExtensionValue**\n([String](../../../../reference/java/lang/String.html) oid)\n\nGets the DER-encoded OCTET string for the extension value\n(*extnValue* ) identified by the passed-in `oid`\nString.\nThe `oid` string is\nrepresented by a set of nonnegative whole numbers separated\nby periods.\n\nFor example: \n\n| OID *(Object Identifier)* | Extension Name |\n|---------------------------|------------------------|\n| 2.5.29.14 | SubjectKeyIdentifier |\n| 2.5.29.15 | KeyUsage |\n| 2.5.29.16 | PrivateKeyUsage |\n| 2.5.29.17 | SubjectAlternativeName |\n| 2.5.29.18 | IssuerAlternativeName |\n| 2.5.29.19 | BasicConstraints |\n| 2.5.29.30 | NameConstraints |\n| 2.5.29.33 | PolicyMappings |\n| 2.5.29.35 | AuthorityKeyIdentifier |\n| 2.5.29.36 | PolicyConstraints |\n\n\u003cbr /\u003e\n\n##### Parameters\n\n| oid | the Object Identifier value for the extension. |\n|-----|------------------------------------------------|\n\n##### Returns\n\n- the DER-encoded octet string of the extension value or null if it is not present. \n\n#### public abstract [Set](../../../../reference/java/util/Set.html)\\\u003c[String](../../../../reference/java/lang/String.html)\\\u003e\n**getNonCriticalExtensionOIDs**\n()\n\nGets a Set of the OID strings for the extension(s) marked\nNON-CRITICAL in the certificate/CRL managed by the object\nimplementing this interface.\n\nHere is sample code to get a Set of non-critical extensions from an\nX509CRL revoked certificate entry and print the OIDs: \n\n CertificateFactory cf = null;\n X509CRL crl = null;\n try (InputStream inStrm = new FileInputStream(\"DER-encoded-CRL\")) {\n cf = CertificateFactory.getInstance(\"X.509\");\n crl = (X509CRL)cf.generateCRL(inStrm);\n }\n\n byte[] certData = \u003cDER-encoded certificate data\u003e\n ByteArrayInputStream bais = new ByteArrayInputStream(certData);\n X509Certificate cert = (X509Certificate)cf.generateCertificate(bais);\n X509CRLEntry badCert =\n crl.getRevokedCertificate(cert.getSerialNumber());\n\n if (badCert != null) {\n Set\u003cString\u003e nonCritSet = badCert.getNonCriticalExtensionOIDs();\n if (nonCritSet != null)\n for (String oid : nonCritSet) {\n System.out.println(oid);\n }\n }\n \n\u003cbr /\u003e\n\n##### Returns\n\n- a Set (or an empty Set if none are marked non-critical) of the extension OID strings for extensions that are marked non-critical. If there are no extensions present at all, then this method returns null. \n\n#### public abstract boolean\n**hasUnsupportedCriticalExtension**\n()\n\nCheck if there is a critical extension that is not supported. \n\n##### Returns\n\n- `true` if a critical extension is found that is not supported, otherwise `false`."]]