com.prosyst.mprm.admin.certificate

Interface CertificateManager

public interface CertificateManager

This interface is used to manage a repository of certificates.

Field Summary

Fields

Modifier and Type	Field and Description
static java.lang.String	BIT_LENGTH The key for the bit length of the key of the certificate that should be issued.
static java.lang.String	COMMON_NAME The key for the Common Name of the certificate that should be issued
static java.lang.String	COUNTRY_NAME The key for the Country Name of the certificate that should be issued
static java.lang.String	DIGEST_ALGORITHM Deprecated.
static java.lang.String	DOMAIN_COMPONENT The key for the Domain Component of the certificate that should be issued
static java.lang.String	DSA Constant that is value of PK_ALGORITHM and stands for DSA public key algorithm
static java.lang.String	E_MAIL The key for the e-mail of the certificate that should be issued
static java.lang.String	ISSUER The key for the unique name of issuer of the certificate that should be issued
static java.lang.String	LOCALITY_NAME The key for the Locality Name of the certificate that should be issued
static java.lang.String	MD2 Deprecated.
static java.lang.String	MD5 Deprecated.
static java.lang.String	ORGANIZATION_NAME The key for the Organization Name of the certificate that should be issued
static java.lang.String	ORGANIZATION_UNIT_NAME The key for the Organization Unit Name of the certificate that should be issued
static java.lang.String	PASSWORD_FOR_KPH The key for the password for password protected key pair holders.
static java.lang.String	PK_ALGORITHM The key for the public key algorithm of the key of the certificate that should be issued
static java.lang.String	RSA Constant that is value of PK_ALGORITHM and stands for RSA public key algorithm
static java.lang.String	SEC_CTX_CERTIFICATE The key for the certificate name the key pair holder should represent.
static java.lang.String	SERIAL_NUMBER The key for the serial number of the certificate that should be issued
static java.lang.String	SHA1 Deprecated.
static java.lang.String	SIGNATURE_ALGORITHM The key for the signature algorithm that should be used when issue certificate.
static java.lang.String	STATE_OR_PROVINCE_NAME The key for the State Or Province Name of the certificate that should be issued
static java.lang.String	STREET The key for the Street Name of the certificate that should be issued
static java.lang.String	UID The key for the UID of the certificate that should be issued
static java.lang.String	VALID_NOT_AFTER The key for the end validity date of the certificate that should be issued
static java.lang.String	VALID_NOT_BEFORE The key for the start validity date of the certificate that should be issued

Method Summary

Modifier and Type	Method and Description
java.lang.String	addCertificate(Certificate certificate) Adds a certificate to the Certificate Repository with certain properties.
void	addCertificateListener(CertificateListener listener) Adds certificate listener that will be notified for changes into the Certificate Repository.
void	addDomain(java.lang.String domain) Adds a new domain into the Certificate Repository.
java.lang.String	createCertificate(java.util.Dictionary keyAndCertificateProps) Creates key pair and certificate with given key properties and adds it into the Certificate Repository.
java.io.InputStream	createSecurityCtx(java.util.Dictionary keyProps, java.lang.String[] trustedCertificatesUniqueNames, java.lang.String password, java.lang.String provider, java.lang.String type, java.util.Properties kshRegProps, java.util.Properties kmRegProps, java.util.Properties tmRegProps, boolean async) Create security context.
java.io.InputStream	exportKeyStore(java.lang.String[] certificateUniqueNames, boolean includeKeyPairs, java.lang.String password, java.lang.String keyPassword, java.lang.String provider, java.lang.String type, boolean asynchronious) Imports a key store into specified groups, and domain.
Certificate	getCertificate(java.lang.String uniqueName) Gets an existing Certificate from the Certificate Repository.
Enumerator	getCertificates(java.lang.String domain, java.lang.String group) Returns an Enumerator containing certificates unique names from the Certificate Repository that are into specified domain and into the group.
java.lang.String	getCertificateUniqueName(byte[] certificate) Gets certificate unique name by specified certificate material.
java.lang.String[]	getDomains() Returns array of all certificate domains the Certificate Repository has certificates in.
java.lang.String[]	getGroups() Returns the certificate groups in the Certificate Repository.
java.lang.String	getIssuerCertificate(byte[] subjectCertificate, java.lang.String domain, java.lang.String group) Returns uniqueName of the issuer of this certificate into certain domain.
Enumerator	getOwnCertificates(java.lang.String domain, java.lang.String group) Returns an Enumerator containing certificates unique names from the Certificate Repository that are into specified domain, into the group AND have private keys (i.e.
java.util.Dictionary	getProperties(java.lang.String uniqueName) Returns properties for a certificate with passed unique name.
Enumerator	getTrustedCertificates(java.lang.String domain, java.lang.String group) Returns an Enumerator containing certificates unique names from the Certificate Repository that are into specified domain, into the group AND have NOT private keys (i.e.
void	importKeyStore(java.io.InputStream is, java.lang.String group, java.lang.String[] domain, java.lang.String password, java.lang.String keyPassword, java.lang.String provider, java.lang.String type) Imports a key store into specified grops, and domain.
boolean	isExpired(java.lang.String uniqueName, java.util.Date date) Check a certificate of it is expired just by its unique name.
Certificate	openCertificate(byte[] certificate) Utility method that packs a certificate into a user friendly shell.
void	removeCertificate(java.lang.String uniqueName) Deletes a certificate from the Certificate Repository if it is removable.
void	removeCertificateListener(CertificateListener listener) Removes previously added certificate listener form listeners.
void	removeDomain(java.lang.String domain) Removes a domain from the Certificate Repository.
void	removeExpiredCertificates(java.util.Date date) Removes certificates form the Certificate Repository that are expired / will expire before the expiration date.

Field Detail

RSA

static final java.lang.String RSA

Constant that is value of PK_ALGORITHM and stands for RSA public key algorithm

See Also:

Constant Field Values

DSA

static final java.lang.String DSA

Constant that is value of PK_ALGORITHM and stands for DSA public key algorithm

See Also:

Constant Field Values

ISSUER

static final java.lang.String ISSUER

The key for the unique name of issuer of the certificate that should be issued

See Also:

Constant Field Values

PK_ALGORITHM

static final java.lang.String PK_ALGORITHM

The key for the public key algorithm of the key of the certificate that should be issued

See Also:

Constant Field Values

BIT_LENGTH

static final java.lang.String BIT_LENGTH

The key for the bit length of the key of the certificate that should be issued.

See Also:

Constant Field Values

SERIAL_NUMBER

static final java.lang.String SERIAL_NUMBER

The key for the serial number of the certificate that should be issued

See Also:

Constant Field Values

SIGNATURE_ALGORITHM

static final java.lang.String SIGNATURE_ALGORITHM

The key for the signature algorithm that should be used when issue certificate.

See Also:

Constant Field Values

VALID_NOT_BEFORE

static final java.lang.String VALID_NOT_BEFORE

The key for the start validity date of the certificate that should be issued

See Also:

Constant Field Values

VALID_NOT_AFTER

static final java.lang.String VALID_NOT_AFTER

The key for the end validity date of the certificate that should be issued

See Also:

Constant Field Values

COMMON_NAME

static final java.lang.String COMMON_NAME

The key for the Common Name of the certificate that should be issued

See Also:

Constant Field Values

LOCALITY_NAME

static final java.lang.String LOCALITY_NAME

The key for the Locality Name of the certificate that should be issued

See Also:

Constant Field Values

STATE_OR_PROVINCE_NAME

static final java.lang.String STATE_OR_PROVINCE_NAME

The key for the State Or Province Name of the certificate that should be issued

See Also:

Constant Field Values

ORGANIZATION_NAME

static final java.lang.String ORGANIZATION_NAME

The key for the Organization Name of the certificate that should be issued

See Also:

Constant Field Values

ORGANIZATION_UNIT_NAME

static final java.lang.String ORGANIZATION_UNIT_NAME

The key for the Organization Unit Name of the certificate that should be issued

See Also:

Constant Field Values

COUNTRY_NAME

static final java.lang.String COUNTRY_NAME

The key for the Country Name of the certificate that should be issued

See Also:

Constant Field Values

STREET

static final java.lang.String STREET

The key for the Street Name of the certificate that should be issued

See Also:

Constant Field Values

DOMAIN_COMPONENT

static final java.lang.String DOMAIN_COMPONENT

The key for the Domain Component of the certificate that should be issued

See Also:

Constant Field Values

UID

static final java.lang.String UID

The key for the UID of the certificate that should be issued

See Also:

Constant Field Values

E_MAIL

static final java.lang.String E_MAIL

The key for the e-mail of the certificate that should be issued

See Also:

Constant Field Values

DIGEST_ALGORITHM

static final java.lang.String DIGEST_ALGORITHM

Deprecated.

The key for the digest algorithm that should be used when issue certificate.

See Also:

Constant Field Values

MD2

static final java.lang.String MD2

Deprecated.

Constant that stands for MD2 digest algorithm (used for certificate generation)

See Also:

Constant Field Values

MD5

static final java.lang.String MD5

Deprecated.

Constant that stands for MD5 digest algorithm (used for certificate generation)

See Also:

Constant Field Values

SHA1

static final java.lang.String SHA1

Deprecated.

Constant that stands for SHA1 digest algorithm (used for certificate generation)

See Also:

Constant Field Values

PASSWORD_FOR_KPH

static final java.lang.String PASSWORD_FOR_KPH

The key for the password for password protected key pair holders.

See Also:

Constant Field Values

SEC_CTX_CERTIFICATE

static final java.lang.String SEC_CTX_CERTIFICATE

The key for the certificate name the key pair holder should represent. If it is passed - no key and certificate will be generated.

See Also:

Constant Field Values

Method Detail

openCertificate

Certificate openCertificate(byte[] certificate)
                     throws ManagementException

Utility method that packs a certificate into a user friendly shell. It contains just info that can be got from encoded certificate. Note that after opening the certificate its unique name is not obtained. So the method Certificate.getUniqueName() will return null.

Parameters:

certificate - byte array certificate form.

Returns:

parsed certificate.

Throws:

ManagementException - if an exception occurs.

getCertificateUniqueName

java.lang.String getCertificateUniqueName(byte[] certificate)
                                   throws ManagementException

Gets certificate unique name by specified certificate material.

Parameters:

certificate - certificate material

Returns:

unique name that is handle to the certificate. If certificate is not found into the Certificate Repository returns null

Throws:

ManagementException - is thrown if an error has occurred while modifying the Certificate Repository.

addCertificate

java.lang.String addCertificate(Certificate certificate)
                         throws ManagementException

Adds a certificate to the Certificate Repository with certain properties. The logged user must imply the role Permission - Certificates - Admin to call this method.

Parameters:

certificate - Certificate certificate that to be added. Certificate can be obtained using method CertificateManager.openCertificate(byte[])

Returns:

the unique name of the certificate. Using this unique name certificate can be obtain from the Certificate Repository by calling getCertificate(String uniqueName)

Throws:

ManagementException - is thrown if an error has occurred while modifying the Certificate Repository or the logged user does not imply the proper role.

getCertificate

Certificate getCertificate(java.lang.String uniqueName)
                    throws ManagementException

Gets an existing Certificate from the Certificate Repository. The logged user must imply the role Permission - Certificates - Monitor to call this method.

Parameters:

uniqueName - the certificate's handler. It is unique into the Certificate Repository scope.

Returns:

a Certificate object that represents certificate.

Throws:

ManagementException - is thrown if an error has occurred while retrieving data from Certificate Repository, certificate is not found into the Certificate Repository or the logged user does not imply the proper role.

removeCertificate

void removeCertificate(java.lang.String uniqueName)
                throws ManagementException

Deletes a certificate from the Certificate Repository if it is removable. A certificate is not removable if it is imported from an LDAP server. The logged must imply the role Permission - Certificates - Admin in order to call this method.

Parameters:

uniqueName - the unique name of the certificate that is to be removed.

Throws:

ManagementException - is thrown if an error has occurred while modifying the Certificate Repository, trying to remove imported LDAP certificate (a not removable certificate) or the logged user does not imply the proper role.

removeExpiredCertificates

void removeExpiredCertificates(java.util.Date date)
                        throws ManagementException

Removes certificates form the Certificate Repository that are expired / will expire before the expiration date. The logged user must imply the role Permission - Certificates - Admin to call this method.

Parameters:

date - the expiration date the certificates are checked for expiration against.

Throws:

ManagementException - is thrown if an error has occurred while modifying the Certificate Repository or the logged user does not imply the proper role.

getGroups

java.lang.String[] getGroups()
                      throws ManagementException

Returns the certificate groups in the Certificate Repository.

Returns:

certificate groups.

Throws:

ManagementException

getDomains

java.lang.String[] getDomains()
                       throws ManagementException

Returns array of all certificate domains the Certificate Repository has certificates in. The logged user must imply the role Permission - Certificates - Monitor to call this method.

Returns:

certificate domains.

Throws:

ManagementException - is thrown if an error has occurred while retrieving data from the Certificate Repository or the logged user does not imply the proper role.

addDomain

void addDomain(java.lang.String domain)
        throws ManagementException

Adds a new domain into the Certificate Repository. The logged user must imply the role Permission - Certificates - Admin to call this method.

Parameters:

domain - domain name

Throws:

ManagementException - is thrown if domain already exists or an error has occurred while retrieving data from the Certificate Repository or the logged user does not imply the proper role.

removeDomain

void removeDomain(java.lang.String domain)
           throws ManagementException

Removes a domain from the Certificate Repository. The logged user must imply the role Permission - Certificates - Admin to call this method.

Parameters:

domain - domain name

Throws:

ManagementException - is thrown if an error has occurred while retrieving data from the Certificate Repository or the logged user does not imply the proper role.

getCertificates

Enumerator getCertificates(java.lang.String domain,
                           java.lang.String group)
                    throws ManagementException

Returns an Enumerator containing certificates unique names from the Certificate Repository that are into specified domain and into the group. If there have not any, returns null. This method can be used for listing certificates by filter.
All certificates can be obtained by invocation of method with (null, null)
All certificates into specific domain "A" can be obtained with invocation with ("A", null)
All certificates into specific group "B" can be obtain by invocation with (null, "B")
The logged user must imply the role Permission - Certificates - Monitor to call this method.

Parameters:

domain - a certificate must belongs to domain in order to be included into result. Passing domain null means that certificate in result may belongs to any domain (or may not belongs to any domain) - no domain restriction to the result will be applied.

group - the group the certificates in result should belong. null means that certificate in the result can belongs to any groups.

Returns:

all certificates, found in the certificate repository. The type of the objects in the returned Enumerator is String.If no certificates are found, then null is returned.

Throws:

ManagementException - is thrown if an error has occurred while retrieving data from the Certificate Repository or the logged user does not imply the proper role.

getOwnCertificates

Enumerator getOwnCertificates(java.lang.String domain,
                              java.lang.String group)
                       throws ManagementException

Returns an Enumerator containing certificates unique names from the Certificate Repository that are into specified domain, into the group AND have private keys (i.e. belongs to mPRM). If there have not any, returns null. This method can be used for listing certificates by filter.
All own certificates can be obtained by invocation of method with (null, null)
All own certificates into specific domain "A" can be obtained with invocation with ("A", null)
All own certificates into specific group "B" can be obtain by invocation with (null, "B")
The logged user must imply the role Permission - Certificates - Monitor to call this method. Note that nevertheless a user with Permission - Certificates - Monitor can obtain unique id of a certificate with private key, and can obtain X509Certificate instance, it can not obtain private key from certificate without having Permission - Certificates - Admin role.

Parameters:

domain - a certificate must belongs to domain in order to be included into result. Passing domain null means that certificate in result may belongs to any domain (or may not belongs to any domain) - no domain restriction to the result will be applied.

group - the group the certificates in result should belong. null means that certificate in the result can belongs to any groups.

Returns:

all certificates, found in the certificate repository. The type of the objects in the returned Enumerator is String. If no certificates are found, then null is returned.

Throws:

ManagementException - is thrown if an error has occurred while retrieving data from the Certificate Repository or the logged user does not imply the proper role.

getTrustedCertificates

Enumerator getTrustedCertificates(java.lang.String domain,
                                  java.lang.String group)
                           throws ManagementException

Returns an Enumerator containing certificates unique names from the Certificate Repository that are into specified domain, into the group AND have NOT private keys (i.e. does not belongs to mPRM). If there have not any, returns null. This method can be used for listing certificates by filter.
All own certificates can be obtained by invocation of method with (null, null)
All own certificates into specific domain "A" can be obtained with invocation with ("A", null)
All own certificates into specific group "B" can be obtain by invocation with (null, "B")
The logged user must imply the role Permission - Certificates - Monitor to call this method. Note that nevertheless a user with Permission - Certificates - Monitor can obtain unique id of a certificate with private key, and can obtain X509Certificate instance, it can not obtain private key from certificate without having Permission - Certificates - Admin role.

Parameters:

domain - a certificate must belongs to domain in order to be included into result. Passing domain null means that certificate in result may belongs to any domain (or may not belongs to any domain) - no domain restriction to the result will be applied.

group - the group the certificates in result should belong. null means that certificate in the result can belongs to any groups.

Returns:

all certificates, found in the certificate repository. The type of the objects in the returned Enumerator is String. If no certificates are found, then null is returned.

Throws:

ManagementException - is thrown if an error has occurred while retrieving data from the Certificate Repository or the logged user does not imply the proper role.

getIssuerCertificate

java.lang.String getIssuerCertificate(byte[] subjectCertificate,
                                      java.lang.String domain,
                                      java.lang.String group)
                               throws ManagementException

Returns uniqueName of the issuer of this certificate into certain domain. In fact this method almost check if certificate is trusted into specified domain. If returned is not null subject certificate may be assumed as trusted for this domain if it has not expired (this method doesn't provide expiration checking) and if the returned issuer certificate has not expired. The logged user must imply the role Permission - Certificates - Monitor to call this method.

Parameters:

subjectCertificate - byte array representation of the subject certificate.

domain - the domain the issuer certificate is searched into. If null the issuer is searched into all certificates.

group - the group the certificates in result should belong. null means that certificate in the result can belongs to any groups.

Returns:

the issuer's certificate unique name. If such doesn't exists into repository, not match domain or subject certificate is revoked returns null.

Throws:

ManagementException - if an exception occurs or the logged user does not imply the proper role.

isExpired

boolean isExpired(java.lang.String uniqueName,
                  java.util.Date date)
           throws ManagementException

Check a certificate of it is expired just by its unique name. This method is useful when an issuer unique name is got with getIssuerCertificate(Certificate subjectCertificate, String domain) and one want to check its expiration status for certain time without creating an instance of it. The logged user must imply the role Permission - Certificates - Monitor to call this method.

Parameters:

uniqueName - unique name of certificate that should be checked for expiration.

date - the date certificate expiration should be checking against.

Returns:

if certificate has been expired / will be expired at this date. The date can be in future.

Throws:

ManagementException - if an exception occurs, certificate is not found into the Certificate Repository or the logged user does not imply the proper role.

getProperties

java.util.Dictionary getProperties(java.lang.String uniqueName)
                            throws ManagementException

Returns properties for a certificate with passed unique name. The logged user must imply the role Permission - Certificates - Monitor to call this method.

Parameters:

uniqueName - the unique name of the certificate.

Returns:

properties for the certificate.

Throws:

ManagementException - if an exception occurs, certificate is not found into the Certificate Repository or the logged user does not imply the proper role.

importKeyStore

void importKeyStore(java.io.InputStream is,
                    java.lang.String group,
                    java.lang.String[] domain,
                    java.lang.String password,
                    java.lang.String keyPassword,
                    java.lang.String provider,
                    java.lang.String type)
             throws ManagementException

Imports a key store into specified grops, and domain. The logged user must imply the role Permission - Certificates - Admin to call this method. Note: Sun JDK 1.4.2_05+ provides SunJSSA provider which registers PKCS12 keystore. This one can be used for import export actions.

Parameters:

is - input stream that contains the key store. It should be in format proper to be loaded with KeyStore.load() method of the provider specified with provider and type.

group - the group the certificates should be imported to. If null the certificates are imported to GENERAL_GROUP.

domain - the domain that the imported certificates should be applied to.

password - password for decrypting the key store.

keyPassword - password for decrypting the keys of store.

provider - key store provider.

type - type key store type.

Throws:

ManagementException - if an exception occurs, certificate is not found into the Certificate Repository, the logged user does not imply the proper role or the provider does not exists or does not support the type.

exportKeyStore

java.io.InputStream exportKeyStore(java.lang.String[] certificateUniqueNames,
                                   boolean includeKeyPairs,
                                   java.lang.String password,
                                   java.lang.String keyPassword,
                                   java.lang.String provider,
                                   java.lang.String type,
                                   boolean asynchronious)
                            throws ManagementException

Imports a key store into specified groups, and domain. The logged user must imply the role Permission - Certificates - Admin to call this method with includeKeyPairs = true and Permission - Certificates - Monitor with false.

Parameters:

certificateUniqueNames - the unique names of the certificates to be exported.

includeKeyPairs - if the exported key store should contains key pairs (for certificates that have such) or not (to contain only certificates).

password - password for encrypting the key store.

keyPassword - password for encrypting the keys of store.

provider - key store provider.

type - type key store type.

asynchronious - if to execute action asynchronously with method call and to fill the input stream result asynchronously (the returned input stream may continue to receive data after it is returned by the method) with the method execution or to execute action synchronously and to return filled input stream. The asynchronous execution may gain better performance but may hide exceptions.

Returns:

input stream that contains the keys. It will be in format proper for loading it with KeyStore.load() method of the provider specified with provider and type.

Throws:

ManagementException - if an exception occurs, certificate is not found into the Certificate Repository, the logged user does not imply the proper role or the provider does not exists or does not support the requested type.

createSecurityCtx

java.io.InputStream createSecurityCtx(java.util.Dictionary keyProps,
                                      java.lang.String[] trustedCertificatesUniqueNames,
                                      java.lang.String password,
                                      java.lang.String provider,
                                      java.lang.String type,
                                      java.util.Properties kshRegProps,
                                      java.util.Properties kmRegProps,
                                      java.util.Properties tmRegProps,
                                      boolean async)
                               throws ManagementException

Create security context. It is a key store (if kshRegProps == null and kmRegProps == null and tsRegProps == null or a bundle that may be installed on an OSGi framework that contains credentials and registers the services it is configured to register.

Parameters:

keyProps - the properties used for creation of the security context.

trustedCertificatesUniqueNames - the unique names of certificates from the Certificate Repository that should be trusted. May be null

password - the password for keystore protection.

provider - the keystore provider.

type - the keystore type.

kshRegProps - if not null a com.prosyst.mprm.util.keystore.osgi.KeyStoreHolder service with these registration properties will be registered.

kmRegProps - if not null a javax.security.ssl.X509KeyManager service with these registration properties will be registered.

tmRegProps - if not null a javax.security.ssl.X509TrustManager service with these registration properties will be registered.

async -

Returns:

the input stream of the certificate

Throws:

ManagementException

createCertificate

java.lang.String createCertificate(java.util.Dictionary keyAndCertificateProps)
                            throws ManagementException

Creates key pair and certificate with given key properties and adds it into the Certificate Repository. If there is specified issuer certificate unique id into key and certificate properties (with CertificateManager.ISSUER property key) then the certificate is signed by the specified issuer, otherwise a selfsigned certificate is created. The property CertificateManager.BIT_LENGTH value must be the string representation of the length or java.lang.Integer. The values of properties CertificateManager.VALID_NOT_BEFORE and CertificateManager.VALID_NOT_BEFORE must the long equivalents of the date (Date.getTime()) (encoded as string or java.lang.Long) or java.util.Date. The value of CertificateManager.SERIAL_NUMBER must be a java.math.BigInteger

Parameters:

keyAndCertificateProps - properties for private key and certificate creation.

Returns:

the unique name (certificate handler) for the imported certification authority.

Throws:

ManagementException

addCertificateListener

void addCertificateListener(CertificateListener listener)
                     throws ManagementException

Adds certificate listener that will be notified for changes into the Certificate Repository. The logged user must imply the role Permission - Certificates - Monitor to call this method.

Parameters:

listener - certificate listener to be added.

Throws:

ManagementException - if an exception occurs, certificate is not found into the Certificate Repository or the logged user does not imply the proper role.

removeCertificateListener

void removeCertificateListener(CertificateListener listener)

Removes previously added certificate listener form listeners. If listener is currently not added as listener (not added or already removed) the method doesn't throw exception but returns silently.

Parameters:

listener - listener to be removed.