Interface X509Extension

All Known Implementing Classes:

X509Certificate, X509CRL, X509CRLEntry

public interface X509Extension

Extensions  ::=  SEQUENCE SIZE (1..MAX) OF Extension

 Extension  ::=  SEQUENCE  {
     extnId        OBJECT IDENTIFIER,
     critical      BOOLEAN DEFAULT FALSE,
     extnValue     OCTET STRING
                   -- contains a DER encoding of a value
                   -- of the type registered for use with
                   -- the extnId object identifier value
 }

Methods

hasUnsupportedCriticalExtension

boolean hasUnsupportedCriticalExtension()

Check if there is a critical extension that is not supported.

Returns:

true if a critical extension is found that is not supported, otherwise false.

getCriticalExtensionOIDs

Set<String> getCriticalExtensionOIDs()

Gets a Set of the OID strings for the extension(s) marked CRITICAL in the certificate/CRL managed by the object implementing this interface. Here is sample code to get a Set of critical extensions from an X509Certificate and print the OIDs:

X509Certificate cert = null;
 try (InputStream inStrm = new FileInputStream("DER-encoded-Cert")) {
     CertificateFactory cf = CertificateFactory.getInstance("X.509");
     cert = (X509Certificate)cf.generateCertificate(inStrm);
 }

 Set<String> critSet = cert.getCriticalExtensionOIDs();
 if (critSet != null && !critSet.isEmpty()) {
     System.out.println("Set of critical extensions:");
     for (String oid : critSet) {
         System.out.println(oid);
     }
 }

Returns:

a Set (or an empty Set if none are marked critical) of the extension OID strings for extensions that are marked critical. If there are no extensions present at all, then this method returns null.

getNonCriticalExtensionOIDs

Set<String> getNonCriticalExtensionOIDs()

Gets a Set of the OID strings for the extension(s) marked NON-CRITICAL in the certificate/CRL managed by the object implementing this interface. Here is sample code to get a Set of non-critical extensions from an X509CRL revoked certificate entry and print the OIDs:

CertificateFactory cf = null;
 X509CRL crl = null;
 try (InputStream inStrm = new FileInputStream("DER-encoded-CRL")) {
     cf = CertificateFactory.getInstance("X.509");
     crl = (X509CRL)cf.generateCRL(inStrm);
 }

 byte[] certData = <DER-encoded certificate data>
 ByteArrayInputStream bais = new ByteArrayInputStream(certData);
 X509Certificate cert = (X509Certificate)cf.generateCertificate(bais);
 X509CRLEntry badCert =
              crl.getRevokedCertificate(cert.getSerialNumber());

 if (badCert != null) {
     Set<String> nonCritSet = badCert.getNonCriticalExtensionOIDs();
     if (nonCritSet != null)
         for (String oid : nonCritSet) {
             System.out.println(oid);
         }
 }

Returns:

a Set (or an empty Set if none are marked non-critical) of the extension OID strings for extensions that are marked non-critical. If there are no extensions present at all, then this method returns null.

getExtensionValue

byte[] getExtensionValue(String oid)

Parameters:

oid - the Object Identifier value for the extension.

Returns:

the DER-encoded octet string of the extension value or null if it is not present.