org.codice.ddf.security.certificate.generator

Class CertificateSigningRequest

java.lang.Object

org.codice.ddf.security.certificate.generator.CertificateSigningRequest

public class CertificateSigningRequest
extends Object

Model of a X509 certificate signing request. These values must be set:

• notAfter - certificate expiration date
• subjectName - typically a server's FQDN.
• certificateAuthority - instance of CertificateAuthority who will signed this request

These values may be optionally set:

• serialNumber - arbitrary serial number

See Also:

RFC 5280, Internet X.509 Public Key Infrastructure Certificate

Field Summary

Fields

Modifier and Type	Field and Description
protected org.joda.time.DateTime	notAfter
protected org.joda.time.DateTime	notBefore
protected BigInteger	serialNumber
protected KeyPair	subjectKeyPair
static int	VALID_YEARS

Constructor Summary

Constructors

Constructor and Description
CertificateSigningRequest()

Method Summary

Modifier and Type	Method and Description
void	addSubjectAlternativeNames(String... names) Adds subject alternative names.
org.joda.time.DateTime	getNotAfter()
org.joda.time.DateTime	getNotBefore()
long	getSerialNumber()
Set<org.bouncycastle.asn1.x509.GeneralName>	getSubjectAlternativeNames() Gets the subject alternative names.
org.bouncycastle.asn1.x500.X500Name	getSubjectName()
PrivateKey	getSubjectPrivateKey()
PublicKey	getSubjectPublicKey()
void	setCommonName(String name) Create a distinguished name for the certificate's subject.
void	setDistinguishedName(String... name)
void	setNotAfter(org.joda.time.DateTime date) The validity period for a certificate is the period of time from notBefore through notAfter, inclusive.
void	setNotBefore(org.joda.time.DateTime date) The validity period for a certificate is the period of time from notBefore through notAfter, inclusive.
void	setSerialNumber(BigInteger serialNumber)
void	setSerialNumber(long number) Set the serial number of the certificate.
void	setSubjectKeyPair(KeyPair keyPair) Set the subject's public and private keypair.
void	setSubjectName(org.bouncycastle.asn1.x500.X500Name subjectName)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

VALID_YEARS

public static final int VALID_YEARS

See Also:

Constant Field Values

notBefore

protected org.joda.time.DateTime notBefore

notAfter

protected org.joda.time.DateTime notAfter

subjectKeyPair

protected KeyPair subjectKeyPair

serialNumber

protected BigInteger serialNumber

Constructor Detail

CertificateSigningRequest

public CertificateSigningRequest()

Method Detail

getSubjectPrivateKey

public PrivateKey getSubjectPrivateKey()

getSubjectPublicKey

public PublicKey getSubjectPublicKey()

setCommonName

public void setCommonName(String name)

Create a distinguished name for the certificate's subject. Currently, only the common name (sub-attribute of the distinguished name) is supported. The common name should be the fully qualified domain name of the certificate's subject (i.e. the server). For example, server.subdomain.domain.tld.

Parameters:

name - subject's common name attribute (

setDistinguishedName

public void setDistinguishedName(String... name)

setSerialNumber

public void setSerialNumber(long number)

Set the serial number of the certificate. The serial number is arbitrary, but should not be negative.

Parameters:

number - arbitrary serial number

setSubjectKeyPair

public void setSubjectKeyPair(KeyPair keyPair)

Set the subject's public and private keypair. Only the public key is used. However, the the most common use case is to generate a new keypair when creating a certificate. The client code will need to retrieve the the private key for later use. This method is provided for situations when an existing keypair should be used to generate the certificate.

Parameters:

keyPair - RSA public/private keys

getNotBefore

public org.joda.time.DateTime getNotBefore()

setNotBefore

public void setNotBefore(org.joda.time.DateTime date)

The validity period for a certificate is the period of time from notBefore through notAfter, inclusive.

Parameters:

date - expiration date of the certificate

getNotAfter

public org.joda.time.DateTime getNotAfter()

setNotAfter

public void setNotAfter(org.joda.time.DateTime date)

The validity period for a certificate is the period of time from notBefore through notAfter, inclusive.

Parameters:

date - effective date

getSubjectName

public org.bouncycastle.asn1.x500.X500Name getSubjectName()

setSubjectName

public void setSubjectName(org.bouncycastle.asn1.x500.X500Name subjectName)

getSerialNumber

public long getSerialNumber()

setSerialNumber

public void setSerialNumber(BigInteger serialNumber)

addSubjectAlternativeNames

public void addSubjectAlternativeNames(String... names)

Adds subject alternative names. The operation is idempotent, so duplicate SANs will not appear on the CSR. Note however that the order that SANs get added do influence the final result.

Parameters:

names - a set of alternative names to add in a format similar to OpenSSL X509 configuration

Throws:

IllegalArgumentException - if the list or any elements are null or again if any elements failed to be properly parsed

getSubjectAlternativeNames

public Set<org.bouncycastle.asn1.x509.GeneralName> getSubjectAlternativeNames()

Gets the subject alternative names.

Returns:

a set of all subject alternative names in the order they were added