public class CertificateFactory extends Object
CertPath
)
and certificate revocation list (CRL) objects from their encodings.
For encodings consisting of multiple certificates, use
generateCertificates
when you want to
parse a collection of possibly unrelated certificates. Otherwise,
use generateCertPath
when you want to generate
a CertPath
(a certificate chain) and subsequently
validate it with a CertPathValidator
.
A certificate factory for X.509 must return certificates that are an
instance of java.security.cert.X509Certificate
, and CRLs
that are an instance of java.security.cert.X509CRL
.
The following example reads a file with Base64 encoded certificates,
which are each bounded at the beginning by -----BEGIN CERTIFICATE-----, and
bounded at the end by -----END CERTIFICATE-----. We convert the
FileInputStream
(which does not support mark
and reset
) to a BufferedInputStream
(which
supports those methods), so that each call to
generateCertificate
consumes only one certificate, and the
read position of the input stream is positioned to the next certificate in
the file:
FileInputStream fis = new FileInputStream(filename);
BufferedInputStream bis = new BufferedInputStream(fis);
CertificateFactory cf = CertificateFactory.getInstance("X.509");
while (bis.available() > 0) {
Certificate cert = cf.generateCertificate(bis);
System.out.println(cert.toString());
}
The following example parses a PKCS#7-formatted certificate reply stored in a file and extracts all the certificates from it:
FileInputStream fis = new FileInputStream(filename); CertificateFactory cf = CertificateFactory.getInstance("X.509"); Collection c = cf.generateCertificates(fis); Iterator i = c.iterator(); while (i.hasNext()) { Certificate cert = (Certificate)i.next(); System.out.println(cert); }
Every implementation of the Java platform is required to support the
following standard CertificateFactory
type:
X.509
CertPath
encodings:
PKCS7
PkiPath
Certificate
,
X509Certificate
,
CertPath
,
CRL
,
X509CRL
Modifier | Constructor | Description |
---|---|---|
protected |
CertificateFactory(CertificateFactorySpi certFacSpi,
Provider provider,
String type) |
Creates a CertificateFactory object of the given type, and encapsulates
the given provider implementation (SPI object) in it.
|
Modifier and Type | Method | Description |
---|---|---|
Certificate |
generateCertificate(InputStream inStream) |
Generates a certificate object and initializes it with
the data read from the input stream
inStream . |
Collection<? extends Certificate> |
generateCertificates(InputStream inStream) |
Returns a (possibly empty) collection view of the certificates read
from the given input stream
inStream . |
CertPath |
generateCertPath(InputStream inStream) |
Generates a
CertPath object and initializes it with
the data read from the InputStream inStream. |
CertPath |
generateCertPath(InputStream inStream,
String encoding) |
Generates a
CertPath object and initializes it with
the data read from the InputStream inStream. |
CertPath |
generateCertPath(List<? extends Certificate> certificates) |
Generates a
CertPath object and initializes it with
a List of Certificate s. |
CRL |
generateCRL(InputStream inStream) |
Generates a certificate revocation list (CRL) object and initializes it
with the data read from the input stream
inStream . |
Collection<? extends CRL> |
generateCRLs(InputStream inStream) |
Returns a (possibly empty) collection view of the CRLs read
from the given input stream
inStream . |
Iterator<String> |
getCertPathEncodings() |
Returns an iteration of the
CertPath encodings supported
by this certificate factory, with the default encoding first. |
static CertificateFactory |
getInstance(String type) |
Returns a certificate factory object that implements the
specified certificate type.
|
static CertificateFactory |
getInstance(String type,
String provider) |
Returns a certificate factory object for the specified
certificate type.
|
static CertificateFactory |
getInstance(String type,
Provider provider) |
Returns a certificate factory object for the specified
certificate type.
|
Provider |
getProvider() |
Returns the provider of this certificate factory.
|
String |
getType() |
Returns the name of the certificate type associated with this
certificate factory.
|
protected CertificateFactory(CertificateFactorySpi certFacSpi, Provider provider, String type)
certFacSpi
- the provider implementation.provider
- the provider.type
- the certificate type.public static final CertificateFactory getInstance(String type) throws CertificateException
This method traverses the list of registered security Providers, starting with the most preferred Provider. A new CertificateFactory object encapsulating the CertificateFactorySpi implementation from the first Provider that supports the specified type is returned.
Note that the list of registered providers may be retrieved via
the Security.getProviders()
method.
jdk.security.provider.preferred
Security
property to determine
the preferred provider order for the specified algorithm. This
may be different than the order of providers returned by
Security.getProviders()
.type
- the name of the requested certificate type.
See the CertificateFactory section in the
Java Cryptography Architecture Standard Algorithm Name Documentation
for information about standard certificate types.CertificateException
- if no Provider
supports a
CertificateFactorySpi
implementation for the
specified typeNullPointerException
- if type
is null
Provider
public static final CertificateFactory getInstance(String type, String provider) throws CertificateException, NoSuchProviderException
A new CertificateFactory object encapsulating the CertificateFactorySpi implementation from the specified provider is returned. The specified provider must be registered in the security provider list.
Note that the list of registered providers may be retrieved via
the Security.getProviders()
method.
type
- the certificate type.
See the CertificateFactory section in the
Java Cryptography Architecture Standard Algorithm Name Documentation
for information about standard certificate types.provider
- the name of the provider.CertificateException
- if a CertificateFactorySpi
implementation for the specified algorithm is not
available from the specified providerIllegalArgumentException
- if the provider name is null
or emptyNoSuchProviderException
- if the specified provider is not
registered in the security provider listNullPointerException
- if type
is null
Provider
public static final CertificateFactory getInstance(String type, Provider provider) throws CertificateException
A new CertificateFactory object encapsulating the CertificateFactorySpi implementation from the specified Provider object is returned. Note that the specified Provider object does not have to be registered in the provider list.
type
- the certificate type.
See the CertificateFactory section in the
Java Cryptography Architecture Standard Algorithm Name Documentation
for information about standard certificate types.provider
- the provider.CertificateException
- if a CertificateFactorySpi
implementation for the specified algorithm is not available
from the specified Provider
objectIllegalArgumentException
- if the provider
is
null
NullPointerException
- if type
is null
Provider
public final Provider getProvider()
public final String getType()
public final Certificate generateCertificate(InputStream inStream) throws CertificateException
inStream
.
In order to take advantage of the specialized certificate format
supported by this certificate factory,
the returned certificate object can be typecast to the corresponding
certificate class. For example, if this certificate
factory implements X.509 certificates, the returned certificate object
can be typecast to the X509Certificate
class.
In the case of a certificate factory for X.509 certificates, the
certificate provided in inStream
must be DER-encoded and
may be supplied in binary or printable (Base64) encoding. If the
certificate is provided in Base64 encoding, it must be bounded at
the beginning by -----BEGIN CERTIFICATE-----, and must be bounded at
the end by -----END CERTIFICATE-----.
Note that if the given input stream does not support
mark
and
reset
, this method will
consume the entire input stream. Otherwise, each call to this
method consumes one certificate and the read position of the
input stream is positioned to the next available byte after
the inherent end-of-certificate marker. If the data in the input stream
does not contain an inherent end-of-certificate marker (other
than EOF) and there is trailing data after the certificate is parsed, a
CertificateException
is thrown.
inStream
- an input stream with the certificate data.CertificateException
- on parsing errors.public final Iterator<String> getCertPathEncodings()
CertPath
encodings supported
by this certificate factory, with the default encoding first. See
the CertPath Encodings section in the
Java Cryptography Architecture Standard Algorithm Name Documentation
for information about standard encoding names and their formats.
Attempts to modify the returned Iterator
via its
remove
method result in an
UnsupportedOperationException
.
Iterator
over the names of the supported
CertPath
encodings (as String
s)public final CertPath generateCertPath(InputStream inStream) throws CertificateException
CertPath
object and initializes it with
the data read from the InputStream
inStream. The data
is assumed to be in the default encoding. The name of the default
encoding is the first element of the Iterator
returned by
the getCertPathEncodings
method.inStream
- an InputStream
containing the dataCertPath
initialized with the data from the
InputStream
CertificateException
- if an exception occurs while decodingpublic final CertPath generateCertPath(InputStream inStream, String encoding) throws CertificateException
CertPath
object and initializes it with
the data read from the InputStream
inStream. The data
is assumed to be in the specified encoding. See
the CertPath Encodings section in the
Java Cryptography Architecture Standard Algorithm Name Documentation
for information about standard encoding names and their formats.inStream
- an InputStream
containing the dataencoding
- the encoding used for the dataCertPath
initialized with the data from the
InputStream
CertificateException
- if an exception occurs while decoding or
the encoding requested is not supportedpublic final CertPath generateCertPath(List<? extends Certificate> certificates) throws CertificateException
CertPath
object and initializes it with
a List
of Certificate
s.
The certificates supplied must be of a type supported by the
CertificateFactory
. They will be copied out of the supplied
List
object.
certificates
- a List
of Certificate
sCertPath
initialized with the supplied list of
certificatesCertificateException
- if an exception occurspublic final Collection<? extends Certificate> generateCertificates(InputStream inStream) throws CertificateException
inStream
.
In order to take advantage of the specialized certificate format
supported by this certificate factory, each element in
the returned collection view can be typecast to the corresponding
certificate class. For example, if this certificate
factory implements X.509 certificates, the elements in the returned
collection can be typecast to the X509Certificate
class.
In the case of a certificate factory for X.509 certificates,
inStream
may contain a sequence of DER-encoded certificates
in the formats described for
generateCertificate
.
In addition, inStream
may contain a PKCS#7 certificate
chain. This is a PKCS#7 SignedData object, with the only
significant field being certificates. In particular, the
signature and the contents are ignored. This format allows multiple
certificates to be downloaded at once. If no certificates are present,
an empty collection is returned.
Note that if the given input stream does not support
mark
and
reset
, this method will
consume the entire input stream.
inStream
- the input stream with the certificates.CertificateException
- on parsing errors.public final CRL generateCRL(InputStream inStream) throws CRLException
inStream
.
In order to take advantage of the specialized CRL format
supported by this certificate factory,
the returned CRL object can be typecast to the corresponding
CRL class. For example, if this certificate
factory implements X.509 CRLs, the returned CRL object
can be typecast to the X509CRL
class.
Note that if the given input stream does not support
mark
and
reset
, this method will
consume the entire input stream. Otherwise, each call to this
method consumes one CRL and the read position of the input stream
is positioned to the next available byte after the inherent
end-of-CRL marker. If the data in the
input stream does not contain an inherent end-of-CRL marker (other
than EOF) and there is trailing data after the CRL is parsed, a
CRLException
is thrown.
inStream
- an input stream with the CRL data.CRLException
- on parsing errors.public final Collection<? extends CRL> generateCRLs(InputStream inStream) throws CRLException
inStream
.
In order to take advantage of the specialized CRL format
supported by this certificate factory, each element in
the returned collection view can be typecast to the corresponding
CRL class. For example, if this certificate
factory implements X.509 CRLs, the elements in the returned
collection can be typecast to the X509CRL
class.
In the case of a certificate factory for X.509 CRLs,
inStream
may contain a sequence of DER-encoded CRLs.
In addition, inStream
may contain a PKCS#7 CRL
set. This is a PKCS#7 SignedData object, with the only
significant field being crls. In particular, the
signature and the contents are ignored. This format allows multiple
CRLs to be downloaded at once. If no CRLs are present,
an empty collection is returned.
Note that if the given input stream does not support
mark
and
reset
, this method will
consume the entire input stream.
inStream
- the input stream with the CRLs.CRLException
- on parsing errors. Submit a bug or feature
For further API reference and developer documentation, see Java SE Documentation. That documentation contains more detailed, developer-targeted descriptions, with conceptual overviews, definitions of terms, workarounds, and working code examples.
Copyright © 1993, 2017, Oracle and/or its affiliates. 500 Oracle Parkway
Redwood Shores, CA 94065 USA. All rights reserved.
DRAFT 9-internal+0-adhoc.mlchung.jdk9-jdeps