Class C509CertificationRequest

java.lang.Object
org.bouncycastle.cbor.c509.C509CertificationRequest
public class C509CertificationRequest extends Object
A C509 certification request (Section 4 of draft-ietf-cose-cbor-encoded-cert-20): 
C509CertificationRequest = [ TBSCertificationRequest, subjectSignatureValue: any ]
where the six elements of the TBSCertificationRequest group are inlined into the array. As with certificates, type 2 is natively signed (the signature covers the TBSCertificationRequest CBOR sequence) and type 3 is an invertible re-encoding of a DER RFC 2986 certification request whose signature is copied and remains verifiable over the reconstructed DER.

  • Field Details

    • TYPE_NATIVE

      public static final int TYPE_NATIVE
      Natively signed C509 certification request (c509CertificationRequestType = 2).
      See Also:

    • TYPE_REENCODED_PKCS10

      public static final int TYPE_REENCODED_PKCS10
      CBOR re-encoding of an RFC 2986 certification request (c509CertificationRequestType = 3).
      See Also:

  • Method Details

    • getInstance

      public static C509CertificationRequest getInstance(byte[] encoding) throws IOException
      Parse a C509 certification request from its CBOR encoding.
      Throws:
      IOException

    • create

      public static C509CertificationRequest create(byte[] tbsCertificationRequest, byte[] signature) throws IOException
      Assemble a certification request from an encoded TBSCertificationRequest (see createTBSCertificationRequest(int, AlgorithmIdentifier, X500Name, SubjectPublicKeyInfo, Extensions, String, C509ConversionOptions)) and the newly created signature over it.
      Throws:
      IOException

    • create

      public static C509CertificationRequest create(byte[] tbsCertificationRequest, byte[] signature, C509ConversionOptions options) throws IOException
      Assemble a certification request from an encoded TBSCertificationRequest and the newly created signature over it, with the options controlling the ECDSA signature component width.
      Throws:
      IOException

    • createTBSCertificationRequest

      public static byte[] createTBSCertificationRequest(int requestType, org.bouncycastle.asn1.x509.AlgorithmIdentifier subjectSignatureAlgorithm, org.bouncycastle.asn1.x500.X500Name subject, org.bouncycastle.asn1.x509.SubjectPublicKeyInfo subjectPublicKeyInfo, org.bouncycastle.asn1.x509.Extensions extensionRequest, String challengePassword, C509ConversionOptions options) throws IOException
      Encode the TBSCertificationRequest group for a request about to be signed. For a natively signed request the returned encoding is exactly the byte string the signature is computed over.
      Parameters:
      requestType - TYPE_NATIVE or TYPE_REENCODED_PKCS10.
      subjectSignatureAlgorithm - the X.509 signature (or RFC 6955 proof-of-possession) algorithm.
      subject - the subject name.
      subjectPublicKeyInfo - the subject public key.
      extensionRequest - extensions requested of the CA (RFC 2985 extensionRequest), or null for none.
      challengePassword - a challenge password (RFC 2985), or null for none.
      Throws:
      IOException

    • fromCertificationRequest

      public static C509CertificationRequest fromCertificationRequest(byte[] derEncoding) throws IOException
      Convert a DER-encoded RFC 2986 certification request to a CBOR re-encoded C509 certification request (type 3) using the default conversion options.
      Throws:
      IOException

    • fromCertificationRequest

      public static C509CertificationRequest fromCertificationRequest(org.bouncycastle.asn1.pkcs.CertificationRequest request, C509ConversionOptions options) throws IOException
      Convert a DER-encoded RFC 2986 certification request to a CBOR re-encoded C509 certification request (type 3). As with certificates the conversion is gated on exact invertibility - if re-encoding the result does not reproduce the input DER byte for byte, the conversion is refused.
      Throws:
      IOException

    • toCertificationRequest

      public org.bouncycastle.asn1.pkcs.CertificationRequest toCertificationRequest() throws IOException
      Reconstruct the RFC 2986 certification request a CBOR re-encoded C509 certification request stands for.
      Throws:
      IllegalStateException - if this is a natively signed request.
      IOException - if an attribute (such as a privateKeyPossessionStatement, which embeds C509 structures) has no DER reconstruction.

    • getEncoded

      public byte[] getEncoded() throws IOException
      Return the complete CBOR encoding of this certification request.
      Throws:
      IOException

    • getTBSCertificationRequestEncoded

      public byte[] getTBSCertificationRequestEncoded() throws IOException
      Return the encoding of the TBSCertificationRequest group as a CBOR sequence - for a natively signed request, the exact bytes the signature covers.
      Throws:
      IOException

    • getRequestType

      public int getRequestType()
      Return the request type (TYPE_NATIVE or TYPE_REENCODED_PKCS10).

    • getSubjectSignatureAlgorithm

      public C509AlgorithmIdentifier getSubjectSignatureAlgorithm()
      Return the subject signature algorithm.

    • getSubject

      public org.bouncycastle.asn1.x500.X500Name getSubject()
      Return the subject name.

    • getSubjectPublicKeyAlgorithm

      public C509AlgorithmIdentifier getSubjectPublicKeyAlgorithm()
      Return the subject public key algorithm.

    • getSubjectPublicKeyInfo

      public org.bouncycastle.asn1.x509.SubjectPublicKeyInfo getSubjectPublicKeyInfo()
      Return the subject public key.

    • getAttributes

      public C509Attribute[] getAttributes()
      Return the request attributes.

    • getSignature

      public byte[] getSignature()
      Return the signature value in its X.509 form: for an ECDSA style algorithm the DER SEQUENCE of the two INTEGERs, otherwise the BIT STRING value field unchanged.