edu.emory.mathcs.util.security
Class CertUtils

java.lang.Object
  extended byedu.emory.mathcs.util.security.CertUtils

public class CertUtils
extends java.lang.Object

Set of methods simplifying manipulation of X.509 certificates and keystores.

Version:
1.0
Author:
Dawid Kurzyniec

Method Summary
static java.security.cert.CertPath convertToCertPath(java.security.cert.X509Certificate[] certs)
          Converts specified list of certificates into a certificate path, using default X.509 certificate factory.
static java.security.KeyStore createKeystore()
          Creates an empty keystore of the default type.
static java.security.KeyStore createKeystore(java.lang.String type)
          Creates an empty keystore of the specified type.
static java.security.cert.CertPathValidator createPKIXValidator()
          Returns an instance of PKIX certificate path validator.
static java.util.Collection createTrustAnchors(java.util.Collection certs)
          Generate a collection of trust anchors representing specified certificates.
static java.util.Collection createTrustAnchors(java.util.Collection certs, byte[] nameConstraints)
          Generate a collection of trust anchors representing specified certificates, using specified nameConstraints.
static java.security.cert.X509Certificate decodeX509Cert(byte[] encoded)
          Decode the X.509 certificate out of its default byte encoding.
static byte[] encodeX509Cert(java.security.cert.X509Certificate cert)
          Encode the X.509 certificate to its default byte encoding.
static java.lang.String getCN(java.security.cert.X509Certificate cert)
           
static java.util.Collection getJSSETrustAnchors()
          Returns the collection of default JSSE trust anchors.
static java.util.List getKeystoreCerts(java.security.KeyStore ks)
          Returns a list of certificates kept in the specified keystore.
static java.security.cert.CertificateFactory getX509CertFactory()
          Returns a default X.509 certificate factory.
static java.security.cert.X509Certificate[] getX509Certs(java.util.Collection trustAnchors)
          Retrieve X.509 certificates represented by the specified trust anchors.
static java.security.KeyStore loadKeystore(java.io.File file, char[] passwd)
          Load keystore of the default type from the specified file, using the specified password.
static java.security.KeyStore loadKeystore(java.io.File file, char[] passwd, java.lang.String type)
          Load keystore of the specified type from the specified file, using the specified password.
static void verifySSLServerHostname(java.security.cert.X509Certificate cert, java.lang.String hostname)
           
 
Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
 

Method Detail

getX509CertFactory

public static java.security.cert.CertificateFactory getX509CertFactory()
Returns a default X.509 certificate factory.

Returns:
default X.509 certificate factory

createKeystore

public static java.security.KeyStore createKeystore()
Creates an empty keystore of the default type.

Returns:
newly created keystore

createKeystore

public static java.security.KeyStore createKeystore(java.lang.String type)
                                             throws java.security.KeyStoreException
Creates an empty keystore of the specified type.

Returns:
newly created keystore
Throws:
java.security.KeyStoreException - if keystore could not be created

loadKeystore

public static java.security.KeyStore loadKeystore(java.io.File file,
                                                  char[] passwd)
                                           throws java.io.IOException,
                                                  java.security.cert.CertificateException,
                                                  java.security.NoSuchAlgorithmException
Load keystore of the default type from the specified file, using the specified password.

Parameters:
file - file to read keystore from
passwd - keystore password
Returns:
keystore loaded from the file
Throws:
java.io.IOException - if there is an I/O or format problem with the keystore data
java.security.cert.CertificateException - if any of the certificates in the keystore could not be loaded
java.security.NoSuchAlgorithmException - if the algorithm used to check the integrity of the keystore cannot be found

loadKeystore

public static java.security.KeyStore loadKeystore(java.io.File file,
                                                  char[] passwd,
                                                  java.lang.String type)
                                           throws java.io.IOException,
                                                  java.security.KeyStoreException,
                                                  java.security.cert.CertificateException,
                                                  java.security.NoSuchAlgorithmException
Load keystore of the specified type from the specified file, using the specified password.

Parameters:
file - file to read keystore from
type - keystore type
passwd - keystore password
Returns:
keystore loaded from the file
Throws:
java.io.IOException - if there is an I/O or format problem with the keystore data
java.security.cert.CertificateException - if any of the certificates in the keystore could not be loaded
java.security.NoSuchAlgorithmException - if the algorithm used to check the integrity of the keystore cannot be found
java.security.KeyStoreException

getKeystoreCerts

public static java.util.List getKeystoreCerts(java.security.KeyStore ks)
Returns a list of certificates kept in the specified keystore.

Parameters:
ks - the keystore
Returns:
list of certificates kept in the keystore

createTrustAnchors

public static java.util.Collection createTrustAnchors(java.util.Collection certs)
Generate a collection of trust anchors representing specified certificates.

Parameters:
certs - certificates
Returns:
trust anchors representing the certificates

createTrustAnchors

public static java.util.Collection createTrustAnchors(java.util.Collection certs,
                                                      byte[] nameConstraints)
Generate a collection of trust anchors representing specified certificates, using specified nameConstraints.

Parameters:
certs - certificates
nameConstraints - a byte array containing the ASN.1 DER encoding of a NameConstraints extension to be used for checking name constraints.
Returns:
trust anchors representing the certificates

getJSSETrustAnchors

public static java.util.Collection getJSSETrustAnchors()
Returns the collection of default JSSE trust anchors. Uses the following truststore search order:
1) system property javax.net.ssl.trustStore,
2) ${java.home}/lib/security/jssecacerts,
3) ${java.home}/lib/security/cacerts

Returns:
the collection of default JSSE trust anchors.

getX509Certs

public static java.security.cert.X509Certificate[] getX509Certs(java.util.Collection trustAnchors)
Retrieve X.509 certificates represented by the specified trust anchors.

Parameters:
trustAnchors - the collection of trust anchors
Returns:
certificates represented by the trust anchors

createPKIXValidator

public static java.security.cert.CertPathValidator createPKIXValidator()
Returns an instance of PKIX certificate path validator.

Returns:
an instance of PKIX certificate path validator

convertToCertPath

public static java.security.cert.CertPath convertToCertPath(java.security.cert.X509Certificate[] certs)
Converts specified list of certificates into a certificate path, using default X.509 certificate factory.

Parameters:
certs - certificates to turn into a certificate path
Returns:
newly created certificate path

decodeX509Cert

public static java.security.cert.X509Certificate decodeX509Cert(byte[] encoded)
                                                         throws java.security.cert.CertificateException
Decode the X.509 certificate out of its default byte encoding.

Parameters:
encoded - the encoded certificate
Returns:
the decoded certificate
Throws:
java.security.cert.CertificateException - if the supplied parameter is not a valid encoding of an X.509 certificate

encodeX509Cert

public static byte[] encodeX509Cert(java.security.cert.X509Certificate cert)
Encode the X.509 certificate to its default byte encoding.

Parameters:
cert - the certificate
Returns:
the encoded certificate

verifySSLServerHostname

public static void verifySSLServerHostname(java.security.cert.X509Certificate cert,
                                           java.lang.String hostname)
                                    throws java.security.cert.CertificateException
Throws:
java.security.cert.CertificateException

getCN

public static java.lang.String getCN(java.security.cert.X509Certificate cert)