Package com.itextpdf.signatures
Class CertificateUtil
java.lang.Object
com.itextpdf.signatures.CertificateUtil
This class contains a series of static methods that
allow you to retrieve information from a Certificate.
-
Field Summary
FieldsModifier and TypeFieldDescriptionprivate static final IBouncyCastleFactory
private static final org.slf4j.Logger
-
Constructor Summary
Constructors -
Method Summary
Modifier and TypeMethodDescriptionstatic boolean
checkIfIssuersMatch
(ICertificateID certID, X509Certificate issuerCert) Checks if the issuer of the provided certID (specified in the OCSP response) and provided issuer of the certificate in question matches, i.e.private static IBasicOCSPResponse
createOcsp
(IASN1Sequence seq) Helper method that creates theIBasicOCSPResponse
object from the response bytes.static IDERSet
createRevocationInfoChoices
(Collection<CRL> crls, Collection<IBasicOCSPResponse> ocsps, Collection<IASN1Sequence> otherRevocationInfoFormats) Creates the revocation info (crls field) for SignedData structure: RevocationInfoChoices ::= SET OF RevocationInfoChoice RevocationInfoChoice ::= CHOICE { crl CertificateList, other [1] IMPLICIT OtherRevocationInfoFormat } OtherRevocationInfoFormat ::= SEQUENCE { otherRevInfoFormat OBJECT IDENTIFIER, otherRevInfo ANY DEFINED BY otherRevInfoFormat } CertificateList ::= SEQUENCE { tbsCertList TBSCertList, signatureAlgorithm AlgorithmIdentifier, signatureValue BIT STRING }static Certificate
Generates a certificate object and initializes it with the data read from the input stream inStream.static CRL
Gets the CRL object using a CRL URL.static CRL
getCRL
(X509Certificate certificate) Gets a CRL from an X509 certificate.static String
getCRLURL
(X509Certificate certificate) Gets the URL of the Certificate Revocation List for a Certificatestatic IDistributionPoint
getDistributionPointByName
(X509Certificate certificate, IDistributionPointName issuingDistributionPointName) Gets the Distribution Point from the certificate by name specified in the Issuing Distribution Point from the Certificate Revocation List for a Certificate.private static IDistributionPoint[]
getDistributionPoints
(X509Certificate certificate) static IASN1Primitive
getExtensionValue
(CRL crl, String oid) Gets CRL extension value.static IASN1Primitive
getExtensionValue
(X509Certificate certificate, String oid) Gets certificate extension value.static byte[]
getExtensionValueByOid
(X509Certificate certificate, String id) Retrieves certificate extension value by its OID.private static IASN1Primitive
getExtensionValueFromByteArray
(byte[] extensionValue) Converts extension value represented as byte array toIASN1Primitive
object.static String
getIssuerCertURL
(CRL crl) Retrieves the URL for the issuer certificate for the given CRL.static String
getIssuerCertURL
(X509Certificate certificate) Retrieves the URL for the issuer lists certificates for the given certificate.static String
getOCSPURL
(X509Certificate certificate) Retrieves the OCSP URL from the given certificate.private static String
Gets a String from an ASN1Primitivestatic String
getTSAURL
(X509Certificate certificate) Gets the URL of the TSA if it's available on the certificateprivate static String
getValueFromAIAExtension
(IASN1Primitive extensionValue, String accessMethod) Retrieves accessLocation value for specified accessMethod from the Authority Information Access extension.(package private) static boolean
isIssuerCertificate
(X509Certificate subjectCertificate, X509Certificate issuerCertificate) Checks if the certificate is signed by provided issuer certificate.static boolean
isSelfSigned
(X509Certificate certificate) Checks if the certificate is self-signed.static boolean
isSignatureValid
(IBasicOCSPResp ocspResp, Certificate responderCert) Checks if an OCSP response is genuine.static CRL
parseCrlFromStream
(InputStream input) Parses a CRL from an InputStream.static void
retrieveRevocationInfoFromSignedData
(IASN1TaggedObject taggedObj, Collection<CRL> crls, Collection<IBasicOCSPResponse> ocsps, Collection<IASN1Sequence> otherRevocationInfoFormats) Try to retrieve CRL and OCSP responses from the signed data crls field.
-
Field Details
-
FACTORY
-
LOGGER
private static final org.slf4j.Logger LOGGER
-
-
Constructor Details
-
CertificateUtil
public CertificateUtil()
-
-
Method Details
-
getCRL
public static CRL getCRL(X509Certificate certificate) throws CertificateException, CRLException, IOException Gets a CRL from an X509 certificate.- Parameters:
certificate
- the X509Certificate to extract the CRL from- Returns:
- CRL or null if there's no CRL available
- Throws:
IOException
- thrown when the URL couldn't be opened properly.CertificateException
- thrown if there's no X509 implementation in the provider.CRLException
- thrown when encountering errors when parsing the CRL.
-
getCRLURL
Gets the URL of the Certificate Revocation List for a Certificate- Parameters:
certificate
- the Certificate- Returns:
- the String where you can check if the certificate was revoked
-
getDistributionPointByName
public static IDistributionPoint getDistributionPointByName(X509Certificate certificate, IDistributionPointName issuingDistributionPointName) Gets the Distribution Point from the certificate by name specified in the Issuing Distribution Point from the Certificate Revocation List for a Certificate.- Parameters:
certificate
- the certificate to retrieve Distribution PointsissuingDistributionPointName
- distributionPointName retrieved from the IDP of the CRL- Returns:
- distribution point withthe same name as specified in the IDP.
-
getCRL
Gets the CRL object using a CRL URL.- Parameters:
url
- the URL where the CRL is located- Returns:
- CRL object
- Throws:
IOException
- thrown when the URL couldn't be opened properly.CertificateException
- thrown if there's no X509 implementation in the provider.CRLException
- thrown when encountering errors when parsing the CRL.
-
parseCrlFromStream
Parses a CRL from an InputStream.- Parameters:
input
- the InputStream holding the unparsed CRL- Returns:
- the parsed CRL object.
- Throws:
CertificateException
- thrown if there's no X509 implementation in the provider.CRLException
- thrown when encountering errors when parsing the CRL.
-
getIssuerCertURL
Retrieves the URL for the issuer certificate for the given CRL.- Parameters:
crl
- the CRL response- Returns:
- the URL or null.
-
getOCSPURL
Retrieves the OCSP URL from the given certificate.- Parameters:
certificate
- the certificate- Returns:
- the URL or null
-
getIssuerCertURL
Retrieves the URL for the issuer lists certificates for the given certificate.- Parameters:
certificate
- the certificate- Returns:
- the URL or null.
-
getTSAURL
Gets the URL of the TSA if it's available on the certificate- Parameters:
certificate
- a certificate- Returns:
- a TSA URL
-
generateCertificate
Generates a certificate object and initializes it with the data read from the input stream inStream.- Parameters:
data
- the input stream with the certificates.- Returns:
- a certificate object initialized with the data from the input stream.
- Throws:
CertificateException
- on parsing errors.
-
retrieveRevocationInfoFromSignedData
public static void retrieveRevocationInfoFromSignedData(IASN1TaggedObject taggedObj, Collection<CRL> crls, Collection<IBasicOCSPResponse> ocsps, Collection<IASN1Sequence> otherRevocationInfoFormats) throws IOException, CertificateException Try to retrieve CRL and OCSP responses from the signed data crls field.- Parameters:
taggedObj
- signed data crls field asIASN1TaggedObject
.crls
- collection to store retrieved CRL responses.ocsps
- collection ofIBasicOCSPResponse
wrappers to store retrieved OCSP responses.otherRevocationInfoFormats
- collection of revocation info other than OCSP and CRL responses, e.g. SCVP Request and Response, stored asIASN1Sequence
.- Throws:
IOException
- if some I/O error occurred.CertificateException
- if CertificateFactory instance wasn't created.
-
createRevocationInfoChoices
public static IDERSet createRevocationInfoChoices(Collection<CRL> crls, Collection<IBasicOCSPResponse> ocsps, Collection<IASN1Sequence> otherRevocationInfoFormats) throws CRLException, IOException Creates the revocation info (crls field) for SignedData structure: RevocationInfoChoices ::= SET OF RevocationInfoChoice RevocationInfoChoice ::= CHOICE { crl CertificateList, other [1] IMPLICIT OtherRevocationInfoFormat } OtherRevocationInfoFormat ::= SEQUENCE { otherRevInfoFormat OBJECT IDENTIFIER, otherRevInfo ANY DEFINED BY otherRevInfoFormat } CertificateList ::= SEQUENCE { tbsCertList TBSCertList, signatureAlgorithm AlgorithmIdentifier, signatureValue BIT STRING }- Parameters:
crls
- collection of CRL revocation status information.ocsps
- collection of OCSP revocation status information.otherRevocationInfoFormats
- collection of revocation info other than OCSP and CRL responses, e.g. SCVP Request and Response, stored asIASN1Sequence
.- Returns:
crls [1] RevocationInfoChoices
field of SignedData structure. Null if SignedData has no revocation data.- Throws:
CRLException
- if an encoding error occurs.IOException
- if an I/O error occurs.- See Also:
-
checkIfIssuersMatch
public static boolean checkIfIssuersMatch(ICertificateID certID, X509Certificate issuerCert) throws AbstractOperatorCreationException, AbstractOCSPException, CertificateEncodingException, IOException Checks if the issuer of the provided certID (specified in the OCSP response) and provided issuer of the certificate in question matches, i.e. checks that issuerNameHash and issuerKeyHash fields of the certID is the hash of the issuer's name and public key.SingleResp contains the basic information of the status of the certificate identified by the certID. The issuer name and serial number identify a unique certificate, so if serial numbers of the certificate in question and certID serial number are equals and issuers match, then SingleResp contains the information about the status of the certificate in question.
- Parameters:
certID
- certID specified in the OCSP responseissuerCert
- the issuer of the certificate in question- Returns:
- true if the issuers are the same, false otherwise.
- Throws:
AbstractOperatorCreationException
- in case some digest calculator creation error.AbstractOCSPException
- in case some digest calculator creation error.CertificateEncodingException
- if an encoding error occurs.IOException
- if input-output exception occurs.
-
getExtensionValueByOid
Retrieves certificate extension value by its OID.- Parameters:
certificate
- to get extension fromid
- extension OID to retrieve- Returns:
- encoded extension value.
-
isSignatureValid
Checks if an OCSP response is genuine.- Parameters:
ocspResp
-IBasicOCSPResp
the OCSP response wrapperresponderCert
- the responder certificate- Returns:
- true if the OCSP response verifies against the responder certificate.
-
isIssuerCertificate
static boolean isIssuerCertificate(X509Certificate subjectCertificate, X509Certificate issuerCertificate) Checks if the certificate is signed by provided issuer certificate.- Parameters:
subjectCertificate
- a certificate to checkissuerCertificate
- an issuer certificate to check- Returns:
- true if the first passed certificate is signed by next passed certificate.
-
isSelfSigned
Checks if the certificate is self-signed.- Parameters:
certificate
- a certificate to check- Returns:
- true if the certificate is self-signed.
-
getExtensionValue
public static IASN1Primitive getExtensionValue(X509Certificate certificate, String oid) throws IOException Gets certificate extension value.- Parameters:
certificate
- the certificate from which we need the ExtensionValueoid
- the Object Identifier value for the extension- Returns:
- the extension value as an
IASN1Primitive
object. - Throws:
IOException
- on processing exception.
-
getExtensionValue
Gets CRL extension value.- Parameters:
crl
- the CRL from which we need the ExtensionValueoid
- the Object Identifier value for the extension- Returns:
- the extension value as an
IASN1Primitive
object. - Throws:
IOException
- on processing exception.
-
getExtensionValueFromByteArray
private static IASN1Primitive getExtensionValueFromByteArray(byte[] extensionValue) throws IOException Converts extension value represented as byte array toIASN1Primitive
object.- Parameters:
extensionValue
- the extension value as byte array- Returns:
- the extension value as an
IASN1Primitive
object. - Throws:
IOException
- on processing exception.
-
getStringFromGeneralName
Gets a String from an ASN1Primitive- Parameters:
names
- theIASN1Primitive
primitive wrapper- Returns:
- a human-readable String
-
getValueFromAIAExtension
Retrieves accessLocation value for specified accessMethod from the Authority Information Access extension.- Parameters:
extensionValue
- Authority Information Access extension valueaccessMethod
- accessMethod OID; usually id-ad-caIssuers or id-ad-ocsp- Returns:
- the location (URI) of the information.
-
createOcsp
Helper method that creates theIBasicOCSPResponse
object from the response bytes.- Parameters:
seq
- response bytes.- Returns:
IBasicOCSPResponse
object.- Throws:
IOException
- if some I/O error occurred.
-
getDistributionPoints
-