eu.emi.security.authn.x509.impl
Class CertificateUtils

java.lang.Object
  extended by eu.emi.security.authn.x509.impl.CertificateUtils

public class CertificateUtils
extends Object

Utility class with methods simplifying typical certificate related operations.

Author:
K. Benedyczak, J. Hahkala

Nested Class Summary
static class CertificateUtils.Encoding
          Definition of the encoding that can be used for reading or writing certificates or keys.
 
Field Summary
static Charset ASCII
           
static String DEFAULT_KEYSTORE_ALIAS
           
 
Constructor Summary
CertificateUtils()
           
 
Method Summary
static void configureSecProvider()
          Configures security providers which are used by the library.
static X509Certificate[] convertToX509Chain(Certificate[] chain)
          Performs a trivial conversion by use of casting of a Certificate array into X509Certificate array
static String format(X509Certificate[] certChain, FormatMode mode)
          Produces a human readable text representation of the provided certificate chain.
static String format(X509Certificate cert, FormatMode mode)
          Produces a human readable text representation of the provided certificate.
static X509Certificate loadCertificate(InputStream is, CertificateUtils.Encoding format)
          Loads a single certificate from the provided input stream.
static X509Certificate[] loadCertificateChain(InputStream is, CertificateUtils.Encoding format)
          Loads a chain of certificates from the provided input stream.
static KeyStore loadPEMKeystore(InputStream is, char[] password, char[] ksPassword)
          Loads certificates and private keys from the PEM input stream (usually from file).
static PrivateKey loadPrivateKey(InputStream is, CertificateUtils.Encoding format, char[] password)
          Loads a private key from the provided input stream.
static void saveCertificate(OutputStream os, X509Certificate cert, CertificateUtils.Encoding format)
          Saves the provided certificate to the output file, using the requested encoding.
static void saveCertificateChain(OutputStream os, X509Certificate[] chain, CertificateUtils.Encoding format)
          Saves the provided certificate chain to the output file, using the requested encoding.
static void savePEMKeystore(OutputStream os, KeyStore ks, String alias, String encryptionAlg, char[] keyPassword, char[] encryptionPassword)
          Saves the chosen private key entry from the provided keystore as a plain text PEM data.
static void savePrivateKey(OutputStream os, PrivateKey pk, CertificateUtils.Encoding format, String encryptionAlg, char[] encryptionPassword)
          Saves the provided private key to the output file, using the requested encoding.
 
Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
 

Field Detail

DEFAULT_KEYSTORE_ALIAS

public static final String DEFAULT_KEYSTORE_ALIAS
See Also:
Constant Field Values

ASCII

public static final Charset ASCII
Constructor Detail

CertificateUtils

public CertificateUtils()
Method Detail

configureSecProvider

public static void configureSecProvider()
Configures security providers which are used by the library. Can be called multiple times (subsequent calls won't have any effect).

This method must be called before any other usage of the code from canl API.


convertToX509Chain

public static X509Certificate[] convertToX509Chain(Certificate[] chain)
                                            throws ClassCastException
Performs a trivial conversion by use of casting of a Certificate array into X509Certificate array

Parameters:
chain - to convert
Returns:
converted chain
Throws:
ClassCastException - if at least one entry in the source chain is not an X509Certificate

format

public static String format(X509Certificate cert,
                            FormatMode mode)
Produces a human readable text representation of the provided certificate. It uses X509Formatter internally.

Parameters:
cert - input certificate
mode - controls how detailed the string representation should be
Returns:
the text representation

format

public static String format(X509Certificate[] certChain,
                            FormatMode mode)
Produces a human readable text representation of the provided certificate chain. It uses X509Formatter internally.

Parameters:
certChain - input certificates
mode - controls how detailed the string representation should be
Returns:
the text representation

loadCertificate

public static X509Certificate loadCertificate(InputStream is,
                                              CertificateUtils.Encoding format)
                                       throws IOException
Loads a single certificate from the provided input stream.

Parameters:
is - input stream to read encoded certificate from
format - encoding type
Returns:
loaded certificate
Throws:
IOException - if certificate can not be read or parsed

loadPrivateKey

public static PrivateKey loadPrivateKey(InputStream is,
                                        CertificateUtils.Encoding format,
                                        char[] password)
                                 throws IOException
Loads a private key from the provided input stream. The input stream must be encoded in the PKCS8 format (PEM or DER). Additionally in case of PEM encoding the legacy OpenSSL format for storing private keys is supported. Such PEM header names has algorithm {RSA|DSA|EC} placed before the PRIVATE KEY string.

Currently supported key encryption algorithms are DES and 3 DES. RC2 is unsupported.

Parameters:
is - input stream to read encoded key from
format - encoding type (PEM or DER)
password - key's encryption password (can be null is file is not encrypted)
Returns:
loaded key
Throws:
IOException - if key can not be read or parsed

loadCertificateChain

public static X509Certificate[] loadCertificateChain(InputStream is,
                                                     CertificateUtils.Encoding format)
                                              throws IOException
Loads a chain of certificates from the provided input stream.

Parameters:
is - input stream to read encoded certificates from
format - encoding type
Returns:
loaded certificates array
Throws:
IOException - if certificates can not be read or parsed

loadPEMKeystore

public static KeyStore loadPEMKeystore(InputStream is,
                                       char[] password,
                                       char[] ksPassword)
                                throws IOException
Loads certificates and private keys from the PEM input stream (usually from file). Order of entries is not relevant. However it is assumed that the input contains:
  1. one private key K,
  2. one certificate C corresponding to the private key K,
  3. zero or more certificates that if present form a chain of the certificate C.
If more then one certificate is found then this method tries to sort them to form a consistent chain (inability to do so is thrown as an exception) and assumes that the last certificate in chain is the user's certificate corresponding to the private key.

Parameters:
is - input stream to read from
password - private key's encryption password or null if key is not encrypted.
ksPassword - password which is used to encrypt the private key in the keystore. Can not be null.
Returns:
KeyStore with one private key typed entry, with alias DEFAULT_KEYSTORE_ALIAS of the JKS type. If password is != null then it is also used to crypt the key in the keystore. If it is null then #
Throws:
IOException - if input can not be read or parsed

saveCertificate

public static void saveCertificate(OutputStream os,
                                   X509Certificate cert,
                                   CertificateUtils.Encoding format)
                            throws IOException
Saves the provided certificate to the output file, using the requested encoding.

Parameters:
os - where to write the encoded certificate to
cert - certificate to save
format - format to use
Throws:
IOException - if the data can not be written

savePrivateKey

public static void savePrivateKey(OutputStream os,
                                  PrivateKey pk,
                                  CertificateUtils.Encoding format,
                                  String encryptionAlg,
                                  char[] encryptionPassword)
                           throws IOException,
                                  IllegalArgumentException
Saves the provided private key to the output file, using the requested encoding.

Parameters:
os - where to write the encoded key to
pk - key to save
format - format to use
encryptionAlg - encryption algorithm to be used. See PKCS8Generator constants for available names. Use null if output must not be encrypted.
encryptionPassword - encryption password to be used.
Throws:
IOException - if the data can not be written
IllegalArgumentException - if encryptionAlg is unsupported

saveCertificateChain

public static void saveCertificateChain(OutputStream os,
                                        X509Certificate[] chain,
                                        CertificateUtils.Encoding format)
                                 throws IOException
Saves the provided certificate chain to the output file, using the requested encoding.

Parameters:
os - where to write the encoded certificate to
chain - certificate chain to save
format - format to use
Throws:
IOException - if the data can not be written

savePEMKeystore

public static void savePEMKeystore(OutputStream os,
                                   KeyStore ks,
                                   String alias,
                                   String encryptionAlg,
                                   char[] keyPassword,
                                   char[] encryptionPassword)
                            throws IOException,
                                   KeyStoreException,
                                   IllegalArgumentException,
                                   UnrecoverableKeyException,
                                   NoSuchAlgorithmException
Saves the chosen private key entry from the provided keystore as a plain text PEM data. The produced PEM contains the private key first and then all certificates which are stored in the provided keystore under the given alias. The order from the keystore is preserved.

Parameters:
os - where to write the encoded data to
ks - keystore to read from
alias - alias of the private key entry in the keystore
keyPassword - password of the private key in the keystore
encryptionAlg - encryption algorithm to be used. See PKCS8Generator constants for available names. Use null if output must not be encrypted.
encryptionPassword - encryption password to be used.
Throws:
IOException - if the data can not be written
KeyStoreException - if the provided alias does not exist in the keystore or if it does not correspond to the private key entry.
IllegalArgumentException - if encriptionAlg is unsupported or alias is wrong
NoSuchAlgorithmException
UnrecoverableKeyException


Copyright © 2012 European Middleware Initiative. All Rights Reserved.