java.lang.Object
net.i2p.crypto.CertUtil
public final class CertUtilextends Object
Java X.509 certificate utilities, consolidated from various places.

  • Field Details

    • CERT_DIR

      private static final String CERT_DIR
      Directory the certificates are kept in.
      See Also:

    • REVOCATION_DIR

      private static final String REVOCATION_DIR
      Directory the revocations are kept in.
      See Also:

    • LINE_LENGTH

      private static final int LINE_LENGTH
      Line length used when writing a certificate.
      See Also:

    • CHECK

      private static final long CHECK
      CertUtil.main() warns about a certificate that expires within this much time from now - six months.
      See Also:

  • Constructor Details

    • CertUtil

      private CertUtil()
      Utility class.

  • Method Details

    • saveCert

      public static boolean saveCert(Certificate cert, File file)
      Write a certificate to a file in base64 format.
      Parameters:
      cert - the certificate to save
      file - the file to write to
      Returns:
      true if the file was written, false on an encoding or IO error

    • exportPrivateKey

      public static void exportPrivateKey(PrivateKey pk, Certificate[] certs, OutputStream out) throws IOException, GeneralSecurityException
      Writes the private key and all certs in base64 format. Does NOT close the stream. Throws on all errors.
      Parameters:
      pk - non-null
      certs - certificate chain, null or empty to export pk only
      out - the output stream to write to
      Throws:
      InvalidKeyException - if the key does not support encoding
      CertificateEncodingException - if a cert does not support encoding
      IOException - if the write fails
      GeneralSecurityException - on any other security error

    • exportCert

      public static void exportCert(Certificate cert, OutputStream out) throws IOException, CertificateEncodingException
      Modified from: http://www.exampledepot.com/egs/java.security.cert/ExportCert.html

      Writes a certificate in base64 format. Does NOT close the stream. Throws on all errors.

      Parameters:
      cert - the certificate to export
      out - the output stream to write to
      Throws:
      IOException - if the write fails
      CertificateEncodingException - if the certificate cannot be encoded

    • exportPrivateKey

      private static void exportPrivateKey(PrivateKey pk, OutputStream out) throws IOException, InvalidKeyException
      Modified from: http://www.exampledepot.com/egs/java.security.cert/ExportCert.html

      Writes a private key in base64 format. Does NOT close the stream. Throws on all errors.

      Parameters:
      pk - the private key to export
      out - where to write the PEM block, not closed
      Throws:
      IOException - if the write to out fails
      InvalidKeyException - if the key does not support encoding

    • writePEM

      private static void writePEM(byte[] buf, String what, OutputStream out) throws IOException
      Modified from: http://www.exampledepot.com/egs/java.security.cert/ExportCert.html

      Writes data in base64 format. Does NOT close the stream. Throws on all errors.

      Parameters:
      buf - the data to base64-encode into the PEM body
      what - the PEM label, e.g. "PRIVATE KEY", used in the BEGIN and END lines
      out - where to write the PEM block, not closed
      Throws:
      IOException - if the write to out fails

    • getSubjectAlternativeNames

      public static Set<String> getSubjectAlternativeNames(X509Certificate cert)
      Get the set of Subject Alternative Names, including DNSNames, RFC822Names, IPv4 and v6 addresses as strings.

      see X509Certificate.getSubjectAlternativeNames().

      Parameters:
      cert - the certificate to extract names from
      Returns:
      non-null, empty on error or none found

    • getSubjectValue

      public static String getSubjectValue(X509Certificate cert, String type)
      Get a value out of the subject distinguished name.

      Warning - unsupported in Android (no javax.naming), returns null.

      Parameters:
      cert - certificate whose subject X500Principal is searched
      type - the DN attribute to read, e.g. "CN"
      Returns:
      the subject value

    • getIssuerValue

      public static String getIssuerValue(X509Certificate cert, String type)
      Get a value out of the issuer distinguished name.

      Warning - unsupported in Android (no javax.naming), returns null.

      Parameters:
      cert - certificate whose issuer X500Principal is searched
      type - the DN attribute to read, e.g. "CN"
      Returns:
      the issuer value

    • getValue

      private static String getValue(X500Principal p, String type)
      Get a value out of a X500Principal.

      Warning - unsupported in Android (no javax.naming), returns null.

      Parameters:
      p - the X500Principal
      type - the DN attribute to read, e.g. "CN"
      Returns:
      the attribute value, or null if absent, p is null, or on Android

    • error

      private static void error(String msg, Throwable t)
      Records a certificate error for display.
      Parameters:
      msg - what went wrong
      t - the exception, may be null

    • log

      private static void log(I2PAppContext ctx, int level, String msg, Throwable t)
      Logs a certificate message at a given level.
      Parameters:
      ctx - the context to log through
      level - the log level
      msg - a description of what happened
      t - the exception, may be null

    • loadKey

      public static PublicKey loadKey(File kd) throws IOException, GeneralSecurityException
      Get the Java public key from a X.509 certificate file. Throws if the certificate is invalid (e.g. expired).

      This DOES check for revocation.

      Parameters:
      kd - the certificate file
      Returns:
      non-null, throws on all errors including certificate invalid
      Throws:
      IOException - if the file cannot be read
      GeneralSecurityException - if the certificate is invalid

    • loadCert

      public static X509Certificate loadCert(File kd) throws IOException, GeneralSecurityException
      Get the certificate from a X.509 certificate file. Throws if the certificate is invalid (e.g. expired).

      This does NOT check for revocation. This verifies the signature assuming the cert is self-signed. A non-self-issued (chain) cert that fails self-verification only logs a warning, as of 0.9.54; a self-issued cert with a bad signature throws. We do NOT fetch additional certs or attempt to validate a cert up the chain.

      Parameters:
      kd - the certificate file
      Returns:
      non-null, throws on all errors including certificate invalid
      Throws:
      IOException - if the file cannot be read
      GeneralSecurityException - if the certificate is invalid

    • loadPrivateKey

      public static PrivateKey loadPrivateKey(InputStream in) throws IOException, GeneralSecurityException
      Get a single Private Key from an input stream. Does NOT close the stream.
      Parameters:
      in - the input stream to read from
      Returns:
      non-null, non-empty, throws on all errors including certificate invalid
      Throws:
      IOException - if the read fails
      GeneralSecurityException - if the key is invalid

    • loadCerts

      public static List<X509Certificate> loadCerts(InputStream in) throws IOException, GeneralSecurityException
      Get one or more certificates from an input stream. Throws if any certificate is invalid (e.g. expired). Does NOT close the stream.

      This does NOT check for revocation.

      Parameters:
      in - the input stream to read from
      Returns:
      non-null, non-empty, throws on all errors including certificate invalid
      Throws:
      IOException - if the read fails
      GeneralSecurityException - if any certificate is invalid

    • saveCRL

      public static boolean saveCRL(X509CRL crl, File file)
      Write a CRL to a file in base64 format.
      Parameters:
      crl - the CRL to save
      file - the file to write to
      Returns:
      true if the file was written, false on a CRL or IO error

    • exportCRL

      public static void exportCRL(X509CRL crl, OutputStream out) throws IOException, CRLException
      Writes a CRL in base64 format. Does NOT close the stream. Throws on all errors.
      Parameters:
      crl - the CRL to export
      out - the output stream to write to
      Throws:
      IOException - if the write fails
      CRLException - if the crl does not support encoding

    • isRevoked

      public static boolean isRevoked(Certificate cert)
      Is the certificate revoked? This loads the CRLs from disk. For efficiency, call loadCRLs() and then pass to isRevoked().
      Parameters:
      cert - the certificate to check
      Returns:
      true if revoked

    • isRevoked

      public static boolean isRevoked(I2PAppContext ctx, Certificate cert)
      Is the certificate revoked? This loads the CRLs from disk. For efficiency, call loadCRLs() and then pass to isRevoked(Certificate).
      Parameters:
      ctx - context used to locate and parse the CRLs
      cert - the certificate to check
      Returns:
      true if revoked

    • isRevoked

      public static boolean isRevoked(CertStore store, Certificate cert)
      Is the certificate revoked?
      Parameters:
      store - the cert store containing CRLs
      cert - the certificate to check
      Returns:
      true if revoked

    • loadCRLs

      public static CertStore loadCRLs()
      Load CRLs from standard locations.
      Returns:
      non-null, possibly empty

    • loadCRLs

      public static CertStore loadCRLs(I2PAppContext ctx)
      Load CRLs from standard locations.
      Parameters:
      ctx - the application context
      Returns:
      non-null, possibly empty

    • loadCRLs

      private static void loadCRLs(Set<X509CRL> crls, File dir)
      Load CRLs from the directory into the set.
      Parameters:
      crls - the set to add CRLs to
      dir - the directory to load from

    • loadCRL

      private static X509CRL loadCRL(File file) throws IOException, GeneralSecurityException
      Load a CRL.
      Parameters:
      file - the CRL file to read
      Returns:
      non-null, possibly empty
      Throws:
      IOException - if the file cannot be opened or read
      GeneralSecurityException - if the CRL cannot be parsed

    • loadCRL

      public static X509CRL loadCRL(InputStream in) throws GeneralSecurityException
      Load a CRL. Does NOT Close the stream.
      Parameters:
      in - the input stream to read from
      Returns:
      non-null
      Throws:
      GeneralSecurityException - if the CRL cannot be loaded

    • main

      public static final void main(String[] args)
      For testing purposes.
      Parameters:
      args - a command verb followed by a file path; args[0] selects the operation and args[1] is the file it is applied to

    • checkAll

      private static int checkAll(File dir)
      For use in the build process.
      Parameters:
      dir - the data directory holding the certificates and the revocation subdirectory
      Returns:
      0 for success, nonzero for failure