Extension (Bouncy Castle Library 1.85 API Specification)
Date: 2026-07-12

org.bouncycastle.asn1.x509

## Class Extension

- java.lang.Object
- - org.bouncycastle.asn1.ASN1Object
  - - org.bouncycastle.asn1.x509.Extension

- All Implemented Interfaces:
    ASN1Encodable, Encodable

      public class Extension
      extends ASN1Object

  an object for the elements in the X.509 V3 extension block.

- - ### Field Summary

    Fields
    Modifier and Type | Field and Description
    --- | ---
    `static ASN1ObjectIdentifier` | `altSignatureAlgorithm` the algorithm identifier for the alternative digital signature algorithm.
    `static ASN1ObjectIdentifier` | `altSignatureValue` alternative signature shall be created by the issuer using its alternative private key.
    `static ASN1ObjectIdentifier` | `auditIdentity` Audit identity extension in attribute certificates.
    `static ASN1ObjectIdentifier` | `authorityInfoAccess` Authority Info Access
    `static ASN1ObjectIdentifier` | `authorityKeyIdentifier` Authority Key Identifier
    `static ASN1ObjectIdentifier` | `basicConstraints` Basic Constraints
    `static ASN1ObjectIdentifier` | `biometricInfo` BiometricInfo
    `static ASN1ObjectIdentifier` | `certificateIssuer` Certificate Issuer
    `static ASN1ObjectIdentifier` | `certificatePolicies` Certificate Policies
    `static ASN1ObjectIdentifier` | `cRLDistributionPoints` CRL Distribution Points
    `static ASN1ObjectIdentifier` | `cRLNumber` CRL Number
    `static ASN1ObjectIdentifier` | `deltaCertificateDescriptor` delta certificate extension - prototype value will change!
    `static ASN1ObjectIdentifier` | `deltaCRLIndicator` Delta CRL indicator
    `static ASN1ObjectIdentifier` | `expiredCertsOnCRL` Expired Certificates on CRL extension
    `static ASN1ObjectIdentifier` | `extendedKeyUsage` Extended Key Usage
    `static ASN1ObjectIdentifier` | `freshestCRL` Freshest CRL
    `static ASN1ObjectIdentifier` | `inhibitAnyPolicy` Inhibit Any Policy
    `static ASN1ObjectIdentifier` | `instructionCode` Hold Instruction Code
    `static ASN1ObjectIdentifier` | `invalidityDate` Invalidity Date
    `static ASN1ObjectIdentifier` | `issuerAlternativeName` Issuer Alternative Name
    `static ASN1ObjectIdentifier` | `issuingDistributionPoint` Issuing Distribution Point
    `static ASN1ObjectIdentifier` | `keyUsage` Key Usage
    `static ASN1ObjectIdentifier` | `logoType` Logo Type
    `static ASN1ObjectIdentifier` | `nameConstraints` Name Constraints
    `static ASN1ObjectIdentifier` | `noRevAvail` NoRevAvail extension in attribute certificates.
    `static ASN1ObjectIdentifier` | `policyConstraints` Policy Constraints
    `static ASN1ObjectIdentifier` | `policyMappings` Policy Mappings
    `static ASN1ObjectIdentifier` | `privateKeyUsagePeriod` Private Key Usage Period
    `static ASN1ObjectIdentifier` | `qCStatements` QCStatements
    `static ASN1ObjectIdentifier` | `reasonCode` Reason code
    `static ASN1ObjectIdentifier` | `relatedCertificate` RelatedCertificate extension - RFC 9763 sec. 3.
    `static ASN1ObjectIdentifier` | `subjectAlternativeName` Subject Alternative Name
    `static ASN1ObjectIdentifier` | `subjectAltPublicKeyInfo` the subject’s alternative public key information
    `static ASN1ObjectIdentifier` | `subjectDirectoryAttributes` Subject Directory Attributes
    `static ASN1ObjectIdentifier` | `subjectInfoAccess` Subject Info Access
    `static ASN1ObjectIdentifier` | `subjectKeyIdentifier` Subject Key Identifier
    `static ASN1ObjectIdentifier` | `targetInformation` TargetInformation extension in attribute certificates.

  - ### Constructor Summary

    Constructors
    Constructor and Description
    `Extension(ASN1ObjectIdentifier extnId, ASN1Boolean critical, ASN1OctetString value)` Constructor using an ASN1Boolean and an OCTET STRING for the value.
    `Extension(ASN1ObjectIdentifier extnId, boolean critical, ASN1OctetString value)` Constructor using an OCTET STRING for the value.
    `Extension(ASN1ObjectIdentifier extnId, boolean critical, byte[] value)` Constructor using a byte[] for the value.

  - ### Method Summary

    All Methods Static Methods Instance Methods Concrete Methods
    Modifier and Type | Method and Description
    --- | ---
    `static Extension` | `create(ASN1ObjectIdentifier extnId, boolean critical, ASN1Encodable value)` Helper method to create an extension from any ASN.1 encodable object.
    `boolean` | `equals(java.lang.Object o)`
    `ASN1ObjectIdentifier` | `getExtnId()`
    `ASN1OctetString` | `getExtnValue()`
    `static Extension` | `getInstance(java.lang.Object obj)`
    `ASN1Encodable` | `getParsedValue()`
    `int` | `hashCode()`
    `boolean` | `isCritical()`
    `ASN1Primitive` | `toASN1Primitive()` Method providing a primitive representation of this object suitable for encoding.

    - ### Methods inherited from class org.bouncycastle.asn1.ASN1Object

      `encodeTo, encodeTo, getEncoded, getEncoded, hasEncodedTagValue`

    - ### Methods inherited from class java.lang.Object

      `clone, finalize, getClass, notify, notifyAll, toString, wait, wait, wait`

- - ### Field Detail

    - #### subjectDirectoryAttributes

          public static final ASN1ObjectIdentifier subjectDirectoryAttributes

      Subject Directory Attributes

    - #### subjectKeyIdentifier

          public static final ASN1ObjectIdentifier subjectKeyIdentifier

      Subject Key Identifier

    - #### keyUsage

          public static final ASN1ObjectIdentifier keyUsage

      Key Usage

    - #### privateKeyUsagePeriod

          public static final ASN1ObjectIdentifier privateKeyUsagePeriod

      Private Key Usage Period

    - #### subjectAlternativeName

          public static final ASN1ObjectIdentifier subjectAlternativeName

      Subject Alternative Name

    - #### issuerAlternativeName

          public static final ASN1ObjectIdentifier issuerAlternativeName

      Issuer Alternative Name

    - #### basicConstraints

          public static final ASN1ObjectIdentifier basicConstraints

      Basic Constraints

    - #### cRLNumber

          public static final ASN1ObjectIdentifier cRLNumber

      CRL Number

    - #### reasonCode

          public static final ASN1ObjectIdentifier reasonCode

      Reason code

    - #### instructionCode

          public static final ASN1ObjectIdentifier instructionCode

      Hold Instruction Code

    - #### invalidityDate

          public static final ASN1ObjectIdentifier invalidityDate

      Invalidity Date

    - #### deltaCRLIndicator

          public static final ASN1ObjectIdentifier deltaCRLIndicator

      Delta CRL indicator

    - #### issuingDistributionPoint

          public static final ASN1ObjectIdentifier issuingDistributionPoint

      Issuing Distribution Point

    - #### certificateIssuer

          public static final ASN1ObjectIdentifier certificateIssuer

      Certificate Issuer

    - #### nameConstraints

          public static final ASN1ObjectIdentifier nameConstraints

      Name Constraints

    - #### cRLDistributionPoints

          public static final ASN1ObjectIdentifier cRLDistributionPoints

      CRL Distribution Points

    - #### certificatePolicies

          public static final ASN1ObjectIdentifier certificatePolicies

      Certificate Policies

    - #### policyMappings

          public static final ASN1ObjectIdentifier policyMappings

      Policy Mappings

    - #### authorityKeyIdentifier

          public static final ASN1ObjectIdentifier authorityKeyIdentifier

      Authority Key Identifier

    - #### policyConstraints

          public static final ASN1ObjectIdentifier policyConstraints

      Policy Constraints

    - #### extendedKeyUsage

          public static final ASN1ObjectIdentifier extendedKeyUsage

      Extended Key Usage

    - #### freshestCRL

          public static final ASN1ObjectIdentifier freshestCRL

      Freshest CRL

    - #### inhibitAnyPolicy

          public static final ASN1ObjectIdentifier inhibitAnyPolicy

      Inhibit Any Policy

    - #### authorityInfoAccess

          public static final ASN1ObjectIdentifier authorityInfoAccess

      Authority Info Access

    - #### subjectInfoAccess

          public static final ASN1ObjectIdentifier subjectInfoAccess

      Subject Info Access

    - #### logoType

          public static final ASN1ObjectIdentifier logoType

      Logo Type

    - #### biometricInfo

          public static final ASN1ObjectIdentifier biometricInfo

      BiometricInfo

    - #### qCStatements

          public static final ASN1ObjectIdentifier qCStatements

      QCStatements

    - #### auditIdentity

          public static final ASN1ObjectIdentifier auditIdentity

      Audit identity extension in attribute certificates.

    - #### noRevAvail

          public static final ASN1ObjectIdentifier noRevAvail

      NoRevAvail extension in attribute certificates.

    - #### relatedCertificate

          public static final ASN1ObjectIdentifier relatedCertificate

      RelatedCertificate extension - RFC 9763 sec. 3.

      SHOULD NOT be marked critical. Carries a `RelatedCertificate` SEQUENCE binding the certificate to a separately-issued related certificate by hash; used during post-quantum migration to assert that a traditional and a post-quantum end-entity certificate belong to the same subject.

    - #### targetInformation

          public static final ASN1ObjectIdentifier targetInformation

      TargetInformation extension in attribute certificates.

    - #### expiredCertsOnCRL

          public static final ASN1ObjectIdentifier expiredCertsOnCRL

      Expired Certificates on CRL extension

    - #### subjectAltPublicKeyInfo

          public static final ASN1ObjectIdentifier subjectAltPublicKeyInfo

      the subject’s alternative public key information

    - #### altSignatureAlgorithm

          public static final ASN1ObjectIdentifier altSignatureAlgorithm

      the algorithm identifier for the alternative digital signature algorithm.

    - #### altSignatureValue

          public static final ASN1ObjectIdentifier altSignatureValue

      alternative signature shall be created by the issuer using its alternative private key.

    - #### deltaCertificateDescriptor

          public static final ASN1ObjectIdentifier deltaCertificateDescriptor

      delta certificate extension - prototype value will change!

  - ### Constructor Detail

    - #### Extension

          public Extension(ASN1ObjectIdentifier extnId,
                           ASN1Boolean critical,
                           ASN1OctetString value)

      Constructor using an ASN1Boolean and an OCTET STRING for the value.
      Parameters:
        `extnId` - the OID associated with this extension.
        `critical` - will evaluate to true if the extension is critical, false otherwise.
        `value` - the extension's value wrapped in an OCTET STRING.

    - #### Extension

          public Extension(ASN1ObjectIdentifier extnId,
                           boolean critical,
                           byte[] value)

      Constructor using a byte[] for the value.
      Parameters:
        `extnId` - the OID associated with this extension.
        `critical` - true if the extension is critical, false otherwise.
        `value` - the extension's value as a byte[] to be wrapped in an OCTET STRING.

    - #### Extension

          public Extension(ASN1ObjectIdentifier extnId,
                           boolean critical,
                           ASN1OctetString value)

      Constructor using an OCTET STRING for the value.
      Parameters:
        `extnId` - the OID associated with this extension.
        `critical` - true if the extension is critical, false otherwise.
        `value` - the extension's value wrapped in an OCTET STRING.

  - ### Method Detail

    - #### create

          public static Extension create(ASN1ObjectIdentifier extnId,
                                         boolean critical,
                                         ASN1Encodable value)
                                  throws java.io.IOException

      Helper method to create an extension from any ASN.1 encodable object.
      Parameters:
        `extnId` - the OID associated with this extension.
        `critical` - true if the extension is critical, false otherwise.
        `value` - the value to be encoded into the extension's OCTET STRING.
      Returns:
        a new Extension with the encoding of value in the bytes of the extension's OCTET STRING.
      Throws:
        `java.io.IOException` - if the value cannot be encoded into bytes.

    - #### getInstance

          public static Extension getInstance(java.lang.Object obj)

    - #### getExtnId

          public ASN1ObjectIdentifier getExtnId()

    - #### isCritical

          public boolean isCritical()

    - #### getExtnValue

          public ASN1OctetString getExtnValue()

    - #### getParsedValue

          public ASN1Encodable getParsedValue()

    - #### hashCode

          public int hashCode()

      Overrides:
        `hashCode` in class `ASN1Object`

    - #### equals

          public boolean equals(java.lang.Object o)

      Overrides:
        `equals` in class `ASN1Object`

    - #### toASN1Primitive

          public ASN1Primitive toASN1Primitive()

      Description copied from class: `ASN1Object`
      Method providing a primitive representation of this object suitable for encoding.
      Specified by:
        `toASN1Primitive` in interface `ASN1Encodable`
      Specified by:
        `toASN1Primitive` in class `ASN1Object`
      Returns:
        a primitive representation of this object.