Package eu.europa.esig.dss.spi

Class CertificateExtensionsUtils

java.lang.Object

eu.europa.esig.dss.spi.CertificateExtensionsUtils

public class CertificateExtensionsUtils
extends Object

This class contains utility methods for extraction certificate extension (whether critical or not)

Method Summary

Modifier and Type	Method	Description
static AuthorityInformationAccess	getAuthorityInformationAccess(CertificateToken certificateToken)	Returns the authority information access, when present
static AuthorityKeyIdentifier	getAuthorityKeyIdentifier(CertificateToken certificateToken)	Returns the subject key identifier, when present
static BasicConstraints	getBasicConstraints(CertificateToken certificateToken)	Returns a basic constraints extension, when present
static List<String>	getCAIssuersAccessUrls(CertificateToken certificate)	Returns the CA issuers URIs extracted from authorityInfoAccess.caIssuers field
static CertificateExtensions	getCertificateExtensions(CertificateToken certificateToken)	This method extracts the certificate extensions from the given certificateToken
static CertificatePolicies	getCertificatePolicies(CertificateToken certificateToken)	Returns the certificate policies, when present
static List<String>	getCRLAccessUrls(CertificateToken certificate)	Returns the CRL distribution URIs extracted from cRLDistributionPoints field
static CRLDistributionPoints	getCRLDistributionPoints(CertificateToken certificateToken)	Returns the CRL distribution points, when present
static ExtendedKeyUsages	getExtendedKeyUsage(CertificateToken certificateToken)	Returns the extended key usage, when present
static InhibitAnyPolicy	getInhibitAnyPolicy(CertificateToken certificateToken)	Returns an inhibit anyPolicy extension, when present
static KeyUsage	getKeyUsage(CertificateToken certificateToken)	Returns the key usage, when present
static NameConstraints	getNameConstraints(CertificateToken certificateToken)	Returns a name constraints extension, when present
static List<String>	getOCSPAccessUrls(CertificateToken certificate)	Returns the OCSP URIs extracted from authorityInfoAccess.ocsp field
static OCSPNoCheck	getOcspNoCheck(CertificateToken certificateToken)	Returns the ocsp-nocheck extension value, when present
static PolicyConstraints	getPolicyConstraints(CertificateToken certificateToken)	Returns a policy constraints extension, when present
static QcStatements	getQcStatements(CertificateToken certificateToken)	Returns the qc-statements extension value, when present
static SubjectAlternativeNames	getSubjectAlternativeNames(CertificateToken certificateToken)	Returns a subject alternative names, when present
static SubjectKeyIdentifier	getSubjectKeyIdentifier(CertificateToken certificateToken)	Returns the subject key identifier, when present
static ValidityAssuredShortTerm	getValAssuredSTCerts(CertificateToken certificateToken)	Returns the ext-etsi-valassured-ST-certs extension value, when present
static boolean	hasOcspNoCheckExtension(CertificateToken certificateToken)	Checks if the certificate contains ocsp-nocheck extension indicating if the revocation data should be checked for an OCSP signing certificate. RFC 6960
static boolean	hasValAssuredShortTermCertsExtension(CertificateToken certificateToken)	Checks if the certificate contains ext-etsi-valassured-ST-certs extension indicating that the validity of the certificate is assured because the certificate is a "short-term certificate".
static boolean	isAuthorityInformationAccess(String oid)	This method verifies whether oid corresponds to the authority information access extension OID
static boolean	isAuthorityKeyIdentifier(String oid)	This method verifies whether oid corresponds to the authority key identifier extension OID
static boolean	isBasicConstraints(String oid)	This method verifies whether oid corresponds to the basic constraints extension OID
static boolean	isCertificatePolicies(String oid)	This method verifies whether oid corresponds to the certificate policies extension OID
static boolean	isCRLDistributionPoints(String oid)	This method verifies whether oid corresponds to the CRL distribution points extension OID
static boolean	isExtendedKeyUsage(String oid)	This method verifies whether oid corresponds to the extended key usage extension OID
static boolean	isInhibitAnyPolicy(String oid)	This method verifies whether oid corresponds to the policy constraints extension OID
static boolean	isKeyUsage(String oid)	This method verifies whether oid corresponds to the key usage extension OID
static boolean	isNameConstraints(String oid)	This method verifies whether oid corresponds to the name constraints extension OID
static boolean	isOcspNoCheck(String oid)	This method verifies whether oid corresponds to the ocsp-nocheck extension OID
static boolean	isPolicyConstraints(String oid)	This method verifies whether oid corresponds to the policy constraints extension OID
static boolean	isQcStatements(String oid)	This method verifies whether oid corresponds to the qc-statements extension OID
static boolean	isSubjectAlternativeNames(String oid)	This method verifies whether oid corresponds to the subject alternative names extension OID
static boolean	isSubjectKeyIdentifier(String oid)	This method verifies whether oid corresponds to the subject key identifier extension OID
static boolean	isValidityAssuredShortTerm(String oid)	This method verifies whether oid corresponds to the ext-etsi-valassured-ST-certs extension OID

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

getCertificateExtensions

public static CertificateExtensions getCertificateExtensions(CertificateToken certificateToken)

This method extracts the certificate extensions from the given certificateToken

Parameters:

certificateToken - CertificateToken to get certificate extension from

Returns:

CertificateExtensions

isSubjectAlternativeNames

public static boolean isSubjectAlternativeNames(String oid)

This method verifies whether oid corresponds to the subject alternative names extension OID

Parameters:

oid - String

Returns:

TRUE if OID corresponds to the subject alternative names extension OID, FALSE otherwise

isAuthorityKeyIdentifier

public static boolean isAuthorityKeyIdentifier(String oid)

This method verifies whether oid corresponds to the authority key identifier extension OID

Parameters:

oid - String

Returns:

TRUE if OID corresponds to the authority key identifier extension OID, FALSE otherwise

isSubjectKeyIdentifier

public static boolean isSubjectKeyIdentifier(String oid)

This method verifies whether oid corresponds to the subject key identifier extension OID

Parameters:

oid - String

Returns:

TRUE if OID corresponds to the subject key identifier extension OID, FALSE otherwise

isAuthorityInformationAccess

public static boolean isAuthorityInformationAccess(String oid)

This method verifies whether oid corresponds to the authority information access extension OID

Parameters:

oid - String

Returns:

TRUE if OID corresponds to the authority information access extension OID, FALSE otherwise

isCRLDistributionPoints

public static boolean isCRLDistributionPoints(String oid)

This method verifies whether oid corresponds to the CRL distribution points extension OID

Parameters:

oid - String

Returns:

TRUE if OID corresponds to the CRL distribution points extension OID, FALSE otherwise

isBasicConstraints

public static boolean isBasicConstraints(String oid)

This method verifies whether oid corresponds to the basic constraints extension OID

Parameters:

oid - String

Returns:

TRUE if OID corresponds to the basic constraints extension OID, FALSE otherwise

isNameConstraints

public static boolean isNameConstraints(String oid)

This method verifies whether oid corresponds to the name constraints extension OID

Parameters:

oid - String

Returns:

TRUE if OID corresponds to the name constraints extension OID, FALSE otherwise

isPolicyConstraints

public static boolean isPolicyConstraints(String oid)

This method verifies whether oid corresponds to the policy constraints extension OID

Parameters:

oid - String

Returns:

TRUE if OID corresponds to the policy constraints extension OID, FALSE otherwise

isKeyUsage

public static boolean isKeyUsage(String oid)

This method verifies whether oid corresponds to the key usage extension OID

Parameters:

oid - String

Returns:

TRUE if OID corresponds to the key usage extension OID, FALSE otherwise

isExtendedKeyUsage

public static boolean isExtendedKeyUsage(String oid)

This method verifies whether oid corresponds to the extended key usage extension OID

Parameters:

oid - String

Returns:

TRUE if OID corresponds to the extended key usage extension OID, FALSE otherwise

isInhibitAnyPolicy

public static boolean isInhibitAnyPolicy(String oid)

This method verifies whether oid corresponds to the policy constraints extension OID

Parameters:

oid - String

Returns:

TRUE if OID corresponds to the policy constraints extension OID, FALSE otherwise

isCertificatePolicies

public static boolean isCertificatePolicies(String oid)

This method verifies whether oid corresponds to the certificate policies extension OID

Parameters:

oid - String

Returns:

TRUE if OID corresponds to the certificate policies extension OID, FALSE otherwise

isOcspNoCheck

public static boolean isOcspNoCheck(String oid)

This method verifies whether oid corresponds to the ocsp-nocheck extension OID

Parameters:

oid - String

Returns:

TRUE if OID corresponds to the ocsp-nocheck extension OID, FALSE otherwise

isValidityAssuredShortTerm

public static boolean isValidityAssuredShortTerm(String oid)

This method verifies whether oid corresponds to the ext-etsi-valassured-ST-certs extension OID

Parameters:

oid - String

Returns:

TRUE if OID corresponds to the ext-etsi-valassured-ST-certs extension OID, FALSE otherwise

isQcStatements

public static boolean isQcStatements(String oid)

This method verifies whether oid corresponds to the qc-statements extension OID

Parameters:

oid - String

Returns:

TRUE if OID corresponds to the qc-statements extension OID, FALSE otherwise

getSubjectAlternativeNames

public static SubjectAlternativeNames getSubjectAlternativeNames(CertificateToken certificateToken)

Returns a subject alternative names, when present

Parameters:

certificateToken - CertificateToken

Returns:

SubjectAlternativeNames

getAuthorityInformationAccess

public static AuthorityInformationAccess getAuthorityInformationAccess(CertificateToken certificateToken)

Returns the authority information access, when present

Parameters:

certificateToken - CertificateToken

Returns:

AuthorityInformationAccess

getCAIssuersAccessUrls

public static List<String> getCAIssuersAccessUrls(CertificateToken certificate)

Returns the CA issuers URIs extracted from authorityInfoAccess.caIssuers field

Parameters:

certificate - CertificateToken

Returns:

a list of CA issuers URIs, or empty list if the extension is not present.

getOCSPAccessUrls

public static List<String> getOCSPAccessUrls(CertificateToken certificate)

Returns the OCSP URIs extracted from authorityInfoAccess.ocsp field

Parameters:

certificate - CertificateToken

Returns:

a list of OCSP URIs, or empty list if the extension is not present.

getAuthorityKeyIdentifier

public static AuthorityKeyIdentifier getAuthorityKeyIdentifier(CertificateToken certificateToken)

Returns the subject key identifier, when present

Parameters:

certificateToken - CertificateToken

Returns:

SubjectKeyIdentifier

getSubjectKeyIdentifier

public static SubjectKeyIdentifier getSubjectKeyIdentifier(CertificateToken certificateToken)

Returns the subject key identifier, when present

Parameters:

certificateToken - CertificateToken

Returns:

SubjectKeyIdentifier

getCRLDistributionPoints

public static CRLDistributionPoints getCRLDistributionPoints(CertificateToken certificateToken)

Returns the CRL distribution points, when present

Parameters:

certificateToken - CertificateToken

Returns:

CRLDistributionPoints

getCRLAccessUrls

public static List<String> getCRLAccessUrls(CertificateToken certificate)

Returns the CRL distribution URIs extracted from cRLDistributionPoints field

Parameters:

certificate - CertificateToken

Returns:

a list of CA issuers URIs, or empty list if the extension is not present.

getBasicConstraints

public static BasicConstraints getBasicConstraints(CertificateToken certificateToken)

Returns a basic constraints extension, when present

Parameters:

certificateToken - CertificateToken

Returns:

BasicConstraints

getNameConstraints

public static NameConstraints getNameConstraints(CertificateToken certificateToken)

Returns a name constraints extension, when present

Parameters:

certificateToken - CertificateToken

Returns:

NameConstraints

getPolicyConstraints

public static PolicyConstraints getPolicyConstraints(CertificateToken certificateToken)

Returns a policy constraints extension, when present

Parameters:

certificateToken - CertificateToken

Returns:

PolicyConstraints

getInhibitAnyPolicy

public static InhibitAnyPolicy getInhibitAnyPolicy(CertificateToken certificateToken)

Returns an inhibit anyPolicy extension, when present

Parameters:

certificateToken - CertificateToken

Returns:

PolicyConstraints

getKeyUsage

public static KeyUsage getKeyUsage(CertificateToken certificateToken)

Returns the key usage, when present

Parameters:

certificateToken - CertificateToken

Returns:

KeyUsage

getExtendedKeyUsage

public static ExtendedKeyUsages getExtendedKeyUsage(CertificateToken certificateToken)

Returns the extended key usage, when present

Parameters:

certificateToken - CertificateToken

Returns:

ExtendedKeyUsages

getCertificatePolicies

public static CertificatePolicies getCertificatePolicies(CertificateToken certificateToken)

Returns the certificate policies, when present

Parameters:

certificateToken - CertificateToken

Returns:

CertificatePolicies

getOcspNoCheck

public static OCSPNoCheck getOcspNoCheck(CertificateToken certificateToken)

Returns the ocsp-nocheck extension value, when present

Parameters:

certificateToken - CertificateToken

Returns:

OCSPNoCheck

hasOcspNoCheckExtension

public static boolean hasOcspNoCheckExtension(CertificateToken certificateToken)

Checks if the certificate contains ocsp-nocheck extension indicating if the revocation data should be checked for an OCSP signing certificate.
RFC 6960

Parameters:

certificateToken - the certificate to be checked

Returns:

true if the certificate has the id_pkix_ocsp_nocheck extension

getValAssuredSTCerts

public static ValidityAssuredShortTerm getValAssuredSTCerts(CertificateToken certificateToken)

Returns the ext-etsi-valassured-ST-certs extension value, when present

Parameters:

certificateToken - CertificateToken

Returns:

ValidityAssuredShortTerm

hasValAssuredShortTermCertsExtension

public static boolean hasValAssuredShortTermCertsExtension(CertificateToken certificateToken)

Checks if the certificate contains ext-etsi-valassured-ST-certs extension indicating that the validity of the certificate is assured because the certificate is a "short-term certificate". That is, the time as indicated in the certificate attribute from notBefore through notAfter, inclusive, is shorter than the maximum time to process a revocation request as specified by the certificate practice statement or certificate policy.

Parameters:

certificateToken - CertificateToken

Returns:

TRUE if the certificate has ext-etsi-valassured-ST-certs extension, FALSE otherwise

getQcStatements

public static QcStatements getQcStatements(CertificateToken certificateToken)

Returns the qc-statements extension value, when present

Parameters:

certificateToken - CertificateToken

Returns:

QcStatements