java.security.cert

Package Specification

• Cryptography Architecture
• RFC 3280: Internet X.509 Public Key Infrastructure Certificate and CRL Profile

Related Documentation

• http://www.ietf.org/rfc/rfc3280.txt
• PKI API Programmer's Guide
• X.509 Certificates and CRLs

Abstract class for managing a variety of identity certificates. An identity certificate is a binding of a principal to a public key which is vouched for by another principal.

For encodings consisting of multiple certificates, use generateCertificates when you want to parse a collection of possibly unrelated certificates.

This is an abstract class that defines the methods common to all CertPaths.

This class uses a provider-based architecture. To create a CertPathBuilder, call one of the static getInstance methods, passing in the algorithm name of the CertPathBuilder desired and optionally the name of the provider desired.

Once a CertPathBuilder object has been created, certification paths can be constructed by calling the CertPathBuilder.build build method and passing it an algorithm-specific set of parameters.

A CertPathBuilderException provides support for wrapping exceptions.

This class uses a provider-based architecture. To create a CertPathValidator, call one of the static getInstance methods, passing in the algorithm name of the CertPathValidator desired and optionally the name of the provider desired.

The purpose of this interface is to group (and provide type safety for) all certification path validator results.

This class uses a provider-based architecture. To create a CertStore, call one of the static getInstance methods, passing in the type of CertStore desired, any applicable initialization parameters and optionally the name of the provider desired.

A CertStoreException provides support for wrapping exceptions.

The purpose of this interface is to group (and provide type safety for) all CertStore parameter specifications.

This class is used to provide necessary configuration parameters to implementations of the Collection CertStore algorithm.

Concurrent Access

Unless otherwise specified, the methods defined in this interface are not thread-safe.

This class is used to provide necessary configuration parameters (server name and port number) to implementations of the LDAP CertStore algorithm.

Concurrent Access

Unless otherwise specified, the methods defined in this class are not thread-safe.

A PKIX CertPathBuilder uses these parameters to CertPathBuilder.build build a CertPath which has been validated according to the PKIX certification path validation algorithm.

To instantiate a PKIXBuilderParameters object, an application must specify one or more most-trusted CAs as defined by the PKIX certification path validation algorithm.

One of the outputs of the PKIX certification path validation algorithm is a valid policy tree, which includes the policies that were determined to be valid, how this determination was reached, and any policy qualifiers encountered.

The ASN.1 definition is as follows:

 PolicyQualifierInfo ::= SEQUENCE {
 policyQualifierId       PolicyQualifierId,
 qualifier               ANY DEFINED BY policyQualifierId }
 

A certificate policies extension, if present in an X.509 version 3 certificate, contains a sequence of one or more policy information terms, each of which consists of an object identifier (OID) and optional qualifiers.

This class represents a "most-trusted CA", which is used as a trust anchor for validating X.509 certification paths.

Abstract class for X.509 certificates.

Abstract class for an X.509 Certificate Revocation List (CRL). A CRL is a time-stamped list identifying revoked certificates. It is signed by a Certificate Authority (CA) and made freely available in a public repository.

Abstract class for a revoked certificate in a CRL (Certificate Revocation List).

The extensions defined for X.509 v3 X509Certificate Certificates and v2 X509CRL CRLs (Certificate Revocation Lists) provide methods for associating additional attributes with users or public keys, for managing the certification hierarchy, and for managing CRL distribution.