org.bouncycastle.asn1.x509 (Bouncy Castle Library 1.85 API Specification)
Date: 2026-07-12

# Package org.bouncycastle.asn1.x509

Support classes useful for encoding and processing X.509 certificates.

See: Description

- Interface Summary
  Interface | Description
  --- | ---
  NameConstraintValidator |
  X509AttributeIdentifiers |
  X509ObjectIdentifiers |

- Class Summary
  Class | Description
  --- | ---
  AccessDescription | The AccessDescription object.
  AlgorithmIdentifier |
  AltSignatureAlgorithm | X.509 Section 9.8.3.
  AltSignatureValue | X.509 Section 9.8.4.
  AttCertIssuer |
  AttCertValidityPeriod |
  Attribute |
  AttributeCertificate |
  AttributeCertificateInfo |
  AuthorityInformationAccess | The AuthorityInformationAccess object.
  AuthorityKeyIdentifier | The AuthorityKeyIdentifier object.
  BasicConstraints |
  CertDiscoveryMethod | The method used to retrieve a related certificate, as defined by draft-ietf-lamps-certdiscovery (Certificate Discovery in PKIX).
  Certificate | an X509Certificate structure.
  CertificateList | PKIX RFC-2459 The X.509 v2 CRL syntax is as follows.
  CertificatePair | This class helps to support crossCerfificatePairs in a LDAP directory according RFC 2587 crossCertificatePairATTRIBUTE::={ WITH SYNTAX CertificatePair EQUALITY MATCHING RULE certificatePairExactMatch ID joint-iso-ccitt(2) ds(5) attributeType(4) crossCertificatePair(40)} The forward elements of the crossCertificatePair attribute of a CA's directory entry shall be used to store all, except self-issued certificates issued to this CA.
  CertificatePolicies |
  CertPolicyId | CertPolicyId, used in the CertificatePolicies and PolicyMappings X509V3 Extensions.
  CRLDistPoint |
  CRLNumber | The CRLNumber object.
  CRLReason | The CRLReason enumeration.
  DeltaCertificateDescriptor | DeltaCertificateDescriptor ::= SEQUENCE { serialNumber CertificateSerialNumber, signature [0] EXPLICIT AlgorithmIdentifier {SIGNATURE_ALGORITHM, {...}}
  DigestInfo | The DigestInfo object.
  DisplayText | `DisplayText` class, used in `CertificatePolicies` X509 V3 extensions (in policy qualifiers).
  DistributionPoint | The DistributionPoint object.
  DistributionPointName | The DistributionPointName object.
  DSAParameter |
  EDIPartyName | EDIPartyName ::= Sequence { nameAssigner [0] DirectoryString OPTIONAL, partyName [1] DirectoryString }
  ExtendedKeyUsage | The extendedKeyUsage object.
  Extension | an object for the elements in the X.509 V3 extension block.
  Extensions | Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension Extension ::= SEQUENCE { extnId EXTENSION.
  ExtensionsGenerator | Generator for X.509 extensions
  GeneralName | The GeneralName object.
  GeneralNames |
  GeneralNamesBuilder |
  GeneralSubtree | Class for containing a restriction object subtrees in NameConstraints.
  Holder | The Holder object.
  IetfAttrSyntax | Implementation of `IetfAttrSyntax` as specified by RFC3281.
  IssuerSerial |
  IssuingDistributionPoint | IssuingDistributionPoint ::= SEQUENCE { distributionPoint [0] DistributionPointName OPTIONAL, onlyContainsUserCerts [1] BOOLEAN DEFAULT FALSE, onlyContainsCACerts [2] BOOLEAN DEFAULT FALSE, onlySomeReasons [3] ReasonFlags OPTIONAL, indirectCRL [4] BOOLEAN DEFAULT FALSE, onlyContainsAttributeCerts [5] BOOLEAN DEFAULT FALSE }
  KeyPurposeId | The KeyPurposeId object.
  KeyUsage | The KeyUsage object.
  MTCCertificationAuthority | ASN.1 structure for the `id-pe-mtcCertificationAuthority` extension defined in Section 5.5 of draft-ietf-plants-merkle-tree-certs: MTCCertificationAuthority ::= SEQUENCE { logHash AlgorithmIdentifier{DIGEST-ALGORITHM, {...}}, sigAlg AlgorithmIdentifier{SIGNATURE-ALGORITHM, {...}}, minSerial INTEGER (0..mtcMaxSerial), maxSerial INTEGER (0..mtcMaxSerial) } `logHash` is the hash algorithm used by all issuance logs operated by this CA.
  NameConstraints |
  NoticeReference | `NoticeReference` class, used in `CertificatePolicies` X509 V3 extensions (in policy qualifiers).
  ObjectDigestInfo | ObjectDigestInfo ASN.1 structure used in v2 attribute certificates.
  OtherName | The OtherName object.
  PKIXNameConstraintValidator |
  PolicyConstraints | PKIX RFC 5280 id-ce-policyConstraints OBJECT IDENTIFIER ::= { id-ce 36 } PolicyConstraints ::= SEQUENCE { requireExplicitPolicy [0] SkipCerts OPTIONAL, inhibitPolicyMapping [1] SkipCerts OPTIONAL } SkipCerts ::= INTEGER (0..MAX)
  PolicyInformation |
  PolicyMappings | PolicyMappings V3 extension, described in RFC3280.
  PolicyQualifierId | PolicyQualifierId, used in the CertificatePolicies X509V3 extension.
  PolicyQualifierInfo | Policy qualifiers, used in the X509V3 CertificatePolicies extension.
  PrivateKeyPossessionStatement | PrivateKeyPossessionStatement ::= SEQUENCE { signer IssuerAndSerialNumber, cert Certificate OPTIONAL }
  PrivateKeyStatement | Deprecated use PrivateKeyPossessionStatement
  PrivateKeyUsagePeriod | PrivateKeyUsagePeriod ::= SEQUENCE { notBefore [0] GeneralizedTime OPTIONAL, notAfter [1] GeneralizedTime OPTIONAL }
  ReasonFlags | The ReasonFlags object.
  RelatedCertificate | RFC 9763 sec. 3 `RelatedCertificate` certificate extension value.
  RelatedCertificateDescriptor | Descriptor for a related certificate, as defined by draft-ietf-lamps-certdiscovery (Certificate Discovery in PKIX).
  RoleSyntax | Implementation of the RoleSyntax object as specified by the RFC3281.
  RSAPublicKeyStructure | Deprecated use org.bouncycastle.asn1.pkcs.RSAPublicKey
  SubjectAltPublicKeyInfo | X.509 Section 9.8.2.
  SubjectDirectoryAttributes | This extension may contain further X.500 attributes of the subject.
  SubjectKeyIdentifier | The SubjectKeyIdentifier object.
  SubjectPublicKeyInfo | The object that contains the public key stored in a certificate.
  Target | Target structure used in target information extension for attribute certificates from RFC 3281.
  TargetInformation | Target information extension for attributes certificates according to RFC 3281.
  Targets | Targets structure used in target information extension for attribute certificates from RFC 3281.
  TBSCertificate | The TBSCertificate object.
  TBSCertificateLogEntry | Represents the ASN.1 structure TBSCertificateLogEntry.
  TBSCertificateStructure | Deprecated use TBSCertificate
  TBSCertList | PKIX RFC-2459 - TBSCertList object.
  TBSCertList.CRLEntry |
  Time |
  UserNotice | `UserNotice` class, used in `CertificatePolicies` X509 extensions (in policy qualifiers).
  V1TBSCertificateGenerator | Generator for Version 1 TBSCertificateStructures.
  V2AttributeCertificateInfoGenerator | Generator for Version 2 AttributeCertificateInfo AttributeCertificateInfo ::= SEQUENCE { version AttCertVersion -- version is v2, holder Holder, issuer AttCertIssuer, signature AlgorithmIdentifier, serialNumber CertificateSerialNumber, attrCertValidityPeriod AttCertValidityPeriod, attributes SEQUENCE OF Attribute, issuerUniqueID UniqueIdentifier OPTIONAL, extensions Extensions OPTIONAL }
  V2Form |
  V2TBSCertListGenerator | Generator for Version 2 TBSCertList structures.
  V3TBSCertificateGenerator | Generator for Version 3 TBSCertificateStructures.
  Validity |
  X509CertificateStructure | Deprecated use org.bouncycastle.asn1.x509.Certificate
  X509DefaultEntryConverter | The default converter for X509 DN entries when going from their string value to ASN.1 strings.
  X509Extension | Deprecated use Extension
  X509Extensions | Deprecated use `Extension` and `Extensions`
  X509ExtensionsGenerator | Deprecated use org.bouncycastle.asn1.x509.ExtensionsGenerator
  X509Name | Deprecated use org.bouncycastle.asn1.x500.X500Name.
  X509NameEntryConverter | It turns out that the number of standard ways the fields in a DN should be encoded into their ASN.1 counterparts is rapidly approaching the number of machines on the internet.
  X509NameTokenizer | Deprecated use X500NameTokenizer

- Exception Summary
  Exception | Description
  --- | ---
  NameConstraintValidatorException |

## Package org.bouncycastle.asn1.x509 Description

Support classes useful for encoding and processing X.509 certificates.