com.prosyst.mprm.admin.certificate

Interface Certificate

public interface Certificate

This interface represents X.509 Certificate. It provides:

• X.509 certificate information embedded into the certificate - issuer, subject, sertial number and so on.
• mPRM specific properties bound to certificate - domains it can be used into, properties associated with the certificate.
• Certificate chain of the certitificate - the certificate chain is the longest part of the real certificate chain that contains certificates from the Certificate Manager Repository and starts with the isssuer of the certificate.
• KeyPair associated with the certificate (if it is available)
• Grouping of related certificates.
• Functionality related to this certificate - managing revoked certificates ...

Every certificate has an associated domains representatd as String-s. mPRM Certificate Manager specifies three standard domains:

• mPRM_TLS_CLIENT - the certificates in the domain are used by mPRM TLS Client.
• mPRM_TLS_SERVER - the certificates in the domain are used by mPRM TLS Server.
• mPRM_RAC - the certificates in the domain are used by mPRM Certificate RAC Login Verifier when verifies the client certificate.

Additianaly to stanard defined by Certificate Manager domains an application can add a domain by adding a certificate into domain with specific name.
A certificate applicable (in) to a domain can be used for verifying, signing (if it has keyPair) operations into this domain.

Every certificate has associated properties that can be used for bounding to certificate's 'meaning'. For instance the properties can contain:

• User friendly certificate name.
• Permissions this certificate can delegate to the bundles it has signed.
• Detailed description of certificate.
• Notes regarding certificate.

It is responsibility of an application that uses certificate to specifies certificate properties, to adds them to the certificates and to use them in its own way.

Generally there are two types of certificates kept into Certificate Manager Repository:

• Trusted Certificates - certificates that doesn't possess private keys that can be used only for certificate verifications.
• Own Certificates - certificates that possesses private keys and can be used not only for certificate verification but for signing operations too.

This interface represents both types of certificates.

mPRM Certificate Manager allows certificates to be groupped. Every certificate has a group. By default it is GENERAL_GROUP. It is up to user to moves certificates form one group to another. A group can be created by adding certificate to a group wit such name. Note: all set/add methods which fire events, may modified the Certificate Instance AFTER the event is received. So if one track properties changed (for instance) with event means, should get into CertificateListener.event() the new properties from the event, instead of geting them from the Certificate instance (which may still be not updated with the new properties).

Field Summary

Fields

Modifier and Type	Field and Description
static int	BASE64_ENCODING Base64 encoded DER format of a certificate.
static int	DER_ENCODING DER encoding of a certificate.
static java.lang.String	DOMAIN The export manager on the backend will register Key/Trust Managers per domain with this property into the registration properties.
static java.lang.String	GENERAL_GROUP The default certificate group.
static java.lang.String	mPRM_RAS Certificate domain dedicated to be used by RAS verifier which check credentials of a RAC user.
static java.lang.String	mPRM_TLS_CLIENT Certificate domain dedicated to be used by TLS Client.
static java.lang.String	mPRM_TLS_SERVER Certificate domain dedicated to be used by TLS Server.

Method Summary

Modifier and Type	Method and Description
void	addToDomain(java.lang.String domain) Adds the certificate as applicable certificate for the domain, not removing it form domains it already is applicable to.
Enumerator	getAdminRevokedCertificates() Gets revoked from Admin certificates' serial numbers for the issuer certificate with the specified key, which are set as revoked by the CRL.
java.lang.String[]	getCertificateChain() Gets the certificate chain of this certificate.
Enumerator	getCRLRevokedCertificates() Gets revoked from CRL certificates' serial numbers for the issuer certificate with the specified key, which are set as revoked by the CRL.
java.lang.String[]	getDomains() Returns domains certificate can be applicable to.
byte[]	getEncoded(int encodingFormat) Returns X.509 certificate binary encoding of the certificate (in DER or BASE64 format).
java.lang.String	getGroup() Returns the certificate group.
java.lang.String	getIssuer() Returns issuer of this certificate.
java.util.Properties	getIssuerInfo() Returns the issuer info into key <-> value format.
byte[]	getKeyPair() Returns public and private key of the presented certificate.
java.util.Dictionary	getProperties() Gets properties for the certificate.
byte[]	getPublicKey() Returns public key associated with this certificate.
java.lang.String	getRevocationListURL() Gets revocation URL value for the certificate with the given uniqueName.
java.lang.String	getSerialNumber() Returns hexadecimal representation of the serial number.
java.lang.String	getSignatureAlgorithm() Returns the string representation of the algorithm used for signing this certificate.
java.lang.String	getSubject() Returns certificate's subject.
java.util.Properties	getSubjectInfo() Returns the subject info into key <-> value format.
java.lang.String	getUniqueName() Returns the unique name (id) of this certificate.
java.util.Date	getValidNotAfter() Returns the end date of certificate validity as long number.
java.util.Date	getValidNotBefore() Returns the start date of certificate validity as long number.
boolean	hasKeyPair() Returns if the certificate has key pair into the Certificate Repository.
boolean	isCRLOk() Returns if CRL of a certificate into Certificate Repository is Ok, i.e.
boolean	isRevoked(java.lang.String serialNumber) Checks if certificate with this serial number (issued by this) is revoked.
void	moveToGroup(java.lang.String groupName) Moves certificate to specified group.
void	removeAdminRevokedCertificate(java.lang.String serialNumber) Removes explicitly set as revoked from the Administrator certificate, from revoked list.
void	removeFromDomain(java.lang.String domain) Remove certificate as applicable to this domain.
void	revokeCertificate(java.lang.String serialNumber) Revokes a certificate with this serial number issued by this certificate.
void	setDomains(java.lang.String[] domains) Sets that the domains certificate is applicable to.
void	setKeyPair(byte[] keyPair) Sets key pair for the certifcaite.
void	setProperties(java.util.Dictionary properties) Sets properties for the certificate.
void	setRevocationListURL(java.lang.String crlURL) Set revocation URL value for the certificate with the given uniqueName.

Field Detail

DOMAIN

static final java.lang.String DOMAIN

The export manager on the backend will register Key/Trust Managers per domain with this property into the registration properties. Its value will be the domain name.

See Also:

Constant Field Values

mPRM_TLS_CLIENT

static final java.lang.String mPRM_TLS_CLIENT

Certificate domain dedicated to be used by TLS Client.

See Also:

Constant Field Values

mPRM_TLS_SERVER

static final java.lang.String mPRM_TLS_SERVER

Certificate domain dedicated to be used by TLS Server.

See Also:

Constant Field Values

mPRM_RAS

static final java.lang.String mPRM_RAS

Certificate domain dedicated to be used by RAS verifier which check credentials of a RAC user.

See Also:

Constant Field Values

GENERAL_GROUP

static final java.lang.String GENERAL_GROUP

The default certificate group.

See Also:

Constant Field Values

DER_ENCODING

static final int DER_ENCODING

DER encoding of a certificate.

See Also:

Constant Field Values

BASE64_ENCODING

static final int BASE64_ENCODING

Base64 encoded DER format of a certificate.

See Also:

Constant Field Values

Method Detail

getEncoded

byte[] getEncoded(int encodingFormat)
           throws ManagementException

Returns X.509 certificate binary encoding of the certificate (in DER or BASE64 format).

Parameters:

encodingFormat - currently supported formats are DER_ENCODING and BASE64_ENCODING

Returns:

the certificate corresponding to this handler in byte array form. If handler is for already removed form Certificate inventory certificate the method can return null.

Throws:

ManagementException - if an exception occurs.

getIssuer

java.lang.String getIssuer()

Returns issuer of this certificate. The name is in RFC 2253 format.

Returns:

issuer info as string

getSerialNumber

java.lang.String getSerialNumber()

Returns hexadecimal representation of the serial number.

Returns:

certificate serial number.

getSubject

java.lang.String getSubject()

Returns certificate's subject. The name is in RFC 2253 format.

Returns:

subject info as string.

getValidNotBefore

java.util.Date getValidNotBefore()

Returns the start date of certificate validity as long number.

Returns:

end of validity

getValidNotAfter

java.util.Date getValidNotAfter()

Returns the end date of certificate validity as long number.

Returns:

start of validity

getSignatureAlgorithm

java.lang.String getSignatureAlgorithm()

Returns the string representation of the algorithm used for signing this certificate.

Returns:

the signature algorithm of this certificate.

Throws:

if - an exception occurs.

getPublicKey

byte[] getPublicKey()
             throws ManagementException

Returns public key associated with this certificate.

Throws:

ManagementExeption - if a system error occured or the user has no privileges to receive the requested info.

ManagementException

getCertificateChain

java.lang.String[] getCertificateChain()

Gets the certificate chain of this certificate. The first is the issuer of this certificate. The last element of the returned array is the ROOT certificate (if present into the Certificate Manager Repository).

Returns:

an array of all certificates unique names included in the chain of this one.

setKeyPair

void setKeyPair(byte[] keyPair)
         throws ManagementException

Sets key pair for the certifcaite. The logged user must imply the role Permission - Certificates - Admin to call this method.

Parameters:

keyPair - key pair encoded as byte array.

Throws:

ManagementException - is thrown if an error has occurred while modifying the Certificate Repository or the logged user does not imply the proper role.

ManagementException

hasKeyPair

boolean hasKeyPair()

Returns if the certificate has key pair into the Certificate Repository.

Returns:

if has key pair.

getKeyPair

byte[] getKeyPair()
           throws ManagementException

Returns public and private key of the presented certificate. The key pair will be returned if and only if the logged user is administrator, otherwise an Management Exception shall be thown. The logged user must imply the role Permission - Certificates - Admin to call this method.

Throws:

ManagementException - is thrown if an error has occurred while modifying the Certificate Repository or the logged user does not imply the proper role.

getIssuerInfo

java.util.Properties getIssuerInfo()
                            throws ManagementException

Returns the issuer info into key <-> value format.

Returns:

the issuer info as dictionary.

Throws:

ManagementException

getSubjectInfo

java.util.Properties getSubjectInfo()
                             throws ManagementException

Returns the subject info into key <-> value format.

Returns:

the subject info as dictionary.

Throws:

ManagementException

getUniqueName

java.lang.String getUniqueName()
                        throws ManagementException

Returns the unique name (id) of this certificate.

Returns:

returns the key (id) of this certificate

Throws:

ManagementException - if an exception occurs

getGroup

java.lang.String getGroup()

Returns the certificate group.

Returns:

the certificate group.

moveToGroup

void moveToGroup(java.lang.String groupName)
          throws ManagementException

Moves certificate to specified group. There are two possible additional consequences (exept moving) that can occur:

• If the group certificate is moved to doesn't exists - the group with specified name is created.
• If the group certificate is removed form remains without certificates the group is removed.
The logged user must imply the role Permission - Certificates - Admin to call this method.

Parameters:

groupName - the group name certificate should be moved to.

Throws:

ManagementException - if an exception occurs.

setDomains

void setDomains(java.lang.String[] domains)
         throws ManagementException

Sets that the domains certificate is applicable to. The logged user must imply the role Permission - Certificates - Admin to call this method.

Parameters:

domains - domains the certificate is applicable to.

Throws:

ManagementException - is thrown if an error has occurred while modifying the Certificate Repository or the logged user does not imply the proper role.

addToDomain

void addToDomain(java.lang.String domain)
          throws ManagementException

Adds the certificate as applicable certificate for the domain, not removing it form domains it already is applicable to. If the domain doesn't exists it is created. The logged user must imply the role Permission - Certificates - Admin to call this method.

Parameters:

domain - a domain.

Throws:

ManagementException - if the certificate is already into the domain or an exception occurs.

removeFromDomain

void removeFromDomain(java.lang.String domain)
               throws ManagementException

Remove certificate as applicable to this domain. If in result the domain remains without any certificates the domain is removed. The logged user must imply the role Permission - Certificates - Admin to call this method.

Parameters:

domain - a domain.

Throws:

ManagementException - is thrown if an error has occurred while modifying the Certificate Repository or the logged user does not imply the proper role.

getDomains

java.lang.String[] getDomains()

Returns domains certificate can be applicable to.

Returns:

domains the certificate is applicable to.

setRevocationListURL

void setRevocationListURL(java.lang.String crlURL)
                   throws ManagementException

Set revocation URL value for the certificate with the given uniqueName. The logged user must imply the role Permission - Certificates - Admin to call this method.

Parameters:

crlURL - URL where the revocation list can be found

Throws:

ManagementException - is thrown if an error has occurred while modifying the Certificate Repository or the logged user does not imply the proper role.

getRevocationListURL

java.lang.String getRevocationListURL()

Gets revocation URL value for the certificate with the given uniqueName.

Returns:

Certitificate Reovkation List URL associated to this certificate.

revokeCertificate

void revokeCertificate(java.lang.String serialNumber)
                throws ManagementException

Revokes a certificate with this serial number issued by this certificate. The logged user must imply the role Permission - Certificates - Admin to call this method.

Parameters:

serialNumber - the serial number of the issued certificate which will be set as revoked

Throws:

ManagementException - is thrown if an error has occurred while changing the database.

isCRLOk

boolean isCRLOk()
         throws java.lang.Exception

Returns if CRL of a certificate into Certificate Repository is Ok, i.e. if certificate's CRL is properly processed.

Returns:

if the CRL is ok. if the certificate has no CRL the method will return true.

Throws:

java.lang.Exception

isRevoked

boolean isRevoked(java.lang.String serialNumber)
           throws ManagementException

Checks if certificate with this serial number (issued by this) is revoked.

Parameters:

serialNumber - the serial number of the checked certificate in hex format.

Returns:

if certificate is revoked.

Throws:

ManagementException - is thrown if an error has occurred while retrieving data from the database.

removeAdminRevokedCertificate

void removeAdminRevokedCertificate(java.lang.String serialNumber)
                            throws ManagementException

Removes explicitly set as revoked from the Administrator certificate, from revoked list. The logged user must imply the role Permission - Certificates - Admin to call this method.

Parameters:

serialNumber - the serial number of the subject certificate which to remove.

Throws:

ManagementException - is thrown if an error has occurred while reading the database.

getCRLRevokedCertificates

Enumerator getCRLRevokedCertificates()
                              throws ManagementException

Gets revoked from CRL certificates' serial numbers for the issuer certificate with the specified key, which are set as revoked by the CRL. Returns Enumerator containing the serial numbers as String objects. If no such returns null.

Returns:

subject certificate's serial numbers of backend revoked certificates. If there aren't any null will be returned

Throws:

ManagementException - is thrown if an error has occurred while retrieving data from the database.

getAdminRevokedCertificates

Enumerator getAdminRevokedCertificates()
                                throws ManagementException

Gets revoked from Admin certificates' serial numbers for the issuer certificate with the specified key, which are set as revoked by the CRL. Returns Enumerator containing the serial numbers as String objects. If no such returns null.

Returns:

subject certificate's serial numbers of backend revoked certificates. If there aren't any null will be returned

Throws:

ManagementException - is thrown if an error has occurred while retrieving data from the database.

setProperties

void setProperties(java.util.Dictionary properties)
            throws ManagementException

Sets properties for the certificate. The logged user must imply the role Permission - Certificates - Admin to call this method.

Parameters:

properties - properties for the certificate (String <-> String[] or String).

Throws:

ManagementException - is thrown if an error has occurred while modifying the Certificate Repository or the logged user does not imply the proper role.

getProperties

java.util.Dictionary getProperties()
                            throws ManagementException

Gets properties for the certificate. Note: the returned dictionary MUST not be modified! The logged user must imply the role Permission - Certificates - Monitor to call this method.

Returns:

properties of the certificate (String <-> String[] or String). This dictionary MUST not be changed from users.

Throws:

ManagementException - is thrown if an error has occurred while modifying the Certificate Repository or the logged user does not imply the proper role.