Class C509Certificate

java.lang.Object
org.bouncycastle.cbor.c509.C509Certificate
public class C509Certificate extends Object
A C509 certificate (Section 3 of draft-ietf-cose-cbor-encoded-cert-20): 
C509Certificate = [ TBSCertificate, issuerSignatureValue: any ]
where the ten elements of the TBSCertificate group are inlined into the array, and for a natively signed certificate the signature is computed over their encoding as a CBOR sequence (RFC 8742).

Two certificate types are supported: natively signed C509 certificates (TYPE_NATIVE), where the signature covers the CBOR itself, and CBOR re-encoded X.509 v3 DER certificates (TYPE_REENCODED_X509), where the signature is copied from the DER encoding and remains verifiable only over the reconstructed DER, available from toX509Certificate().

All fields are validated and their X.509 views materialized at parse time, and only deterministically encoded input in the forms this class itself produces is accepted, so for every accepted encoding getInstance(enc).getEncoded() is byte identical to enc. Conversion from X.509 with fromX509Certificate(Certificate, C509ConversionOptions) is gated on exact invertibility: if re-encoding the resulting C509 certificate does not reproduce the input DER byte for byte, the conversion is refused rather than allowed to produce a certificate whose signature could never verify.

  • Field Details

    • TYPE_NATIVE

      public static final int TYPE_NATIVE
      Natively signed C509 certificate (c509CertificateType = 2).
      See Also:

    • TYPE_REENCODED_X509

      public static final int TYPE_REENCODED_X509
      CBOR re-encoded X.509 v3 DER certificate (c509CertificateType = 3).
      See Also:

    • NO_EXPIRATION_DATE

      public static final long NO_EXPIRATION_DATE
      The validityNotAfter value standing for the GeneralizedTime 99991231235959Z, "no well-defined expiration date" (RFC 5280 Section 4.1.2.5), carried in C509 as the CBOR simple value null.
      See Also:

  • Method Details

    • getInstance

      public static C509Certificate getInstance(byte[] encoding) throws IOException
      Parse a C509 certificate from its CBOR encoding.
      Throws:
      IOException

    • create

      public static C509Certificate create(byte[] tbsCertificate, byte[] signature) throws IOException
      Assemble a certificate from an encoded TBSCertificate (see createTBSCertificate(int, BigInteger, AlgorithmIdentifier, X500Name, Date, Date, X500Name, SubjectPublicKeyInfo, Extensions, C509ConversionOptions)) and the newly created signature over it.
      Parameters:
      tbsCertificate - the encoding of the TBSCertificate CBOR sequence.
      signature - the signature value in its X.509 form (for ECDSA the DER SEQUENCE of the two INTEGERs, as produced by a ContentSigner).
      Throws:
      IOException

    • create

      public static C509Certificate create(byte[] tbsCertificate, byte[] signature, C509ConversionOptions options) throws IOException
      Assemble a certificate from an encoded TBSCertificate and the newly created signature over it, with the options controlling the ECDSA signature component width.
      Throws:
      IOException

    • toDate

      public static Date toDate(long seconds)
      Convert a C509 validity value in POSIX seconds, as returned by getNotBefore() and getNotAfter(), to a Date.
      Parameters:
      seconds - a validity value in POSIX seconds.
      Throws:
      IllegalArgumentException - if the value lies outside the X.509 time domain, which the validity values of a parsed or generated certificate cannot.

    • createTBSCertificate

      public static byte[] createTBSCertificate(int certificateType, BigInteger serialNumber, org.bouncycastle.asn1.x509.AlgorithmIdentifier issuerSignatureAlgorithm, org.bouncycastle.asn1.x500.X500Name issuer, Date notBefore, Date notAfter, org.bouncycastle.asn1.x500.X500Name subject, org.bouncycastle.asn1.x509.SubjectPublicKeyInfo subjectPublicKeyInfo, org.bouncycastle.asn1.x509.Extensions extensions, C509ConversionOptions options) throws IOException
      Encode the TBSCertificate group for a certificate about to be signed. For a natively signed certificate the returned encoding is exactly the byte string the signature is computed over.
      Parameters:
      certificateType - TYPE_NATIVE or TYPE_REENCODED_X509.
      serialNumber - the certificate serial number, which must not be negative.
      issuerSignatureAlgorithm - the X.509 signature algorithm.
      issuer - the issuer name, or null when identical to the subject.
      notBefore - start of validity.
      notAfter - end of validity, null standing for no well-defined expiration.
      subject - the subject name.
      subjectPublicKeyInfo - the subject public key.
      extensions - the certificate extensions, or null for none.
      Throws:
      IOException

    • fromX509Certificate

      public static C509Certificate fromX509Certificate(byte[] derEncoding) throws IOException
      Convert a DER-encoded X.509 v3 certificate to a CBOR re-encoded C509 certificate (type 3) using the default conversion options.
      Throws:
      IOException

    • fromX509Certificate

      public static C509Certificate fromX509Certificate(org.bouncycastle.asn1.x509.Certificate x509Certificate, C509ConversionOptions options) throws IOException
      Convert a DER-encoded X.509 v3 certificate to a CBOR re-encoded C509 certificate (type 3).

      The conversion is gated on exact invertibility: after converting, the X.509 certificate is reconstructed and compared byte for byte with the input, and any difference (a certificate that is not DER, or uses a construct the C509 profile cannot carry, such as a multi-valued RDN) fails the conversion with an IOException rather than producing a certificate whose copied signature could never verify.

      Throws:
      IOException

    • toX509Certificate

      public org.bouncycastle.asn1.x509.Certificate toX509Certificate()
      Reconstruct the X.509 certificate a CBOR re-encoded C509 certificate stands for. For a type 3 certificate the result is byte for byte the DER certificate that was re-encoded, and its signature verifies in the usual X.509 way.
      Throws:
      IllegalStateException - if this is a natively signed certificate - its signature only covers the CBOR encoding, so no verifiable X.509 view of it exists.

    • getEncoded

      public byte[] getEncoded() throws IOException
      Return the complete CBOR encoding of this certificate.
      Throws:
      IOException

    • getTBSCertificateEncoded

      public byte[] getTBSCertificateEncoded() throws IOException
      Return the encoding of the TBSCertificate group as a CBOR sequence - for a natively signed certificate, the exact bytes the signature covers.
      Throws:
      IOException

    • getCertificateType

      public int getCertificateType()
      Return the certificate type (TYPE_NATIVE or TYPE_REENCODED_X509).

    • getSerialNumber

      public BigInteger getSerialNumber()
      Return the certificate serial number.

    • getIssuerSignatureAlgorithm

      public C509AlgorithmIdentifier getIssuerSignatureAlgorithm()
      Return the issuer signature algorithm.

    • getIssuer

      public org.bouncycastle.asn1.x500.X500Name getIssuer()
      Return the issuer name. In the C509 encoding an issuer identical to the subject is carried as null; this accessor resolves that back to the subject name.

    • isSelfIssued

      public boolean isSelfIssued()
      Return true if the issuer field is carried as null, standing for an issuer identical to the subject (Section 3.1.4).

    • getNotBefore

      public long getNotBefore()
      Return the start of validity, in POSIX seconds.

    • getNotAfter

      public long getNotAfter()
      Return the end of validity, in POSIX seconds; NO_EXPIRATION_DATE stands for no well-defined expiration date.

    • getSubject

      public org.bouncycastle.asn1.x500.X500Name getSubject()
      Return the subject name.

    • getSubjectPublicKeyAlgorithm

      public C509AlgorithmIdentifier getSubjectPublicKeyAlgorithm()
      Return the subject public key algorithm.

    • getSubjectPublicKeyInfo

      public org.bouncycastle.asn1.x509.SubjectPublicKeyInfo getSubjectPublicKeyInfo()
      Return the subject public key. For a re-encoded certificate whose point was compressed with the 0xfe/0xfd markers, the point has been expanded back to the uncompressed form the DER encoding held.

    • getExtensions

      public C509Extensions getExtensions()
      Return the extensions.

    • getSignature

      public byte[] getSignature()
      Return the signature value in its X.509 form: for an ECDSA style algorithm the DER SEQUENCE of the two INTEGERs, otherwise the BIT STRING value field unchanged. This is the form a ContentVerifier checks.

    • equals

      public boolean equals(Object o)
      Overrides:
      equals in class Object

    • hashCode

      public int hashCode()
      Overrides:
      hashCode in class Object