Module org.eclipse.milo.opcua.stack.core
Package org.eclipse.milo.opcua.stack.core.util

Class CertificateUtil

java.lang.Object
org.eclipse.milo.opcua.stack.core.util.CertificateUtil
public class CertificateUtil extends Object

  • Field Details

    • SUBJECT_ALT_NAME_DNS_NAME

      public static final int SUBJECT_ALT_NAME_DNS_NAME
      See Also:

    • SUBJECT_ALT_NAME_IP_ADDRESS

      public static final int SUBJECT_ALT_NAME_IP_ADDRESS
      See Also:

    • SUBJECT_ALT_NAME_URI

      public static final int SUBJECT_ALT_NAME_URI
      See Also:

  • Constructor Details

    • CertificateUtil

      public CertificateUtil()

  • Method Details

    • decodeCertificate

      public static X509Certificate decodeCertificate(byte[] certificateBytes) throws UaException
      Decode a DER-encoded X.509 certificate.
      Parameters:
      certificateBytes - DER-encoded certificate bytes.
      Returns:
      an X509Certificate
      Throws:
      UaException - if decoding the certificate fails.

    • decodeCertificate

      public static X509Certificate decodeCertificate(InputStream inputStream) throws UaException
      Decode a DER-encoded X.509 certificate.
      Parameters:
      inputStream - InputStream containing DER-encoded certificate bytes.
      Returns:
      an X509Certificate
      Throws:
      UaException - if decoding the certificate fails.

    • decodeCertificates

      public static List<X509Certificate> decodeCertificates(byte[] certificateBytes) throws UaException
      Decode either a sequence of DER-encoded X.509 certificates or a PKCS#7 certificate chain.
      Parameters:
      certificateBytes - the byte[] to decode from.
      Returns:
      a List of certificates deocded from certificateBytes.
      Throws:
      UaException - if decoding fails.

    • decodeCertificates

      public static List<X509Certificate> decodeCertificates(InputStream inputStream) throws UaException
      Decode either a sequence of DER-encoded X.509 certificates or a PKCS#7 certificate chain.
      Parameters:
      inputStream - the InputStream to decode from.
      Returns:
      a List of certificates decoded from inputStream.
      Throws:
      UaException - if decoding fails.

    • generateCsr

      public static org.bouncycastle.pkcs.PKCS10CertificationRequest generateCsr(KeyPair keyPair, X509Certificate certificate) throws Exception
      Generate a PKCS10CertificationRequest for the provided certificate and keyPair.
      Parameters:
      keyPair - the KeyPair for certificate.
      certificate - the X509Certificate to request signing for.
      Returns:
      a PKCS10CertificationRequest.
      Throws:
      Exception - if creating the signing request fails for any reason.

    • generateCsr

      public static org.bouncycastle.pkcs.PKCS10CertificationRequest generateCsr(KeyPair keyPair, String subjectName, String sanUri, List<String> sanDnsNames, List<String> sanIpAddresses, String signatureAlgorithm) throws Exception
      Generate a PKCS10CertificationRequest.
      Parameters:
      keyPair - the KeyPair containing Public and Private keys.
      subjectName - the subject name, in RFC 4519 style. (CN=foo,O=bar)
      sanUri - the URI to request in the SAN.
      sanDnsNames - the DNS names to request in the SAN.
      sanIpAddresses - the IP addresses to request in the SAN.
      signatureAlgorithm - the signature algorithm to use when generating the signature to validate the certificate.
      Returns:
      a PKCS10CertificationRequest.
      Throws:
      Exception - if creating the signing request fails for any reason.

    • generateCsr

      public static org.bouncycastle.pkcs.PKCS10CertificationRequest generateCsr(KeyPair keyPair, org.bouncycastle.asn1.x500.X500Name subject, String sanUri, List<String> sanDnsNames, List<String> sanIpAddresses, String signatureAlgorithm) throws Exception
      Generate a PKCS10CertificationRequest.
      Parameters:
      keyPair - the KeyPair containing Public and Private keys.
      subject - the subject name X500Name.
      sanUri - the URI to request in the SAN.
      sanDnsNames - the DNS names to request in the SAN.
      sanIpAddresses - the IP addresses to request in the SAN.
      signatureAlgorithm - the signature algorithm to use when generating the signature to validate the certificate.
      Returns:
      a PKCS10CertificationRequest.
      Throws:
      Exception - if creating the signing request fails for any reason.

    • getCsrPem

      public static String getCsrPem(org.bouncycastle.pkcs.PKCS10CertificationRequest csr) throws IOException
      Get a PEM-encoded String containing a PKCS #10 certificate signing request.
      Parameters:
      csr - the X509Certificate to request signing for.
      Returns:
      a PEM-encoded String containing a PKCS #10 CSR.
      Throws:
      IOException - if creating the signing request fails for any reason.

    • getSubjectAltNameField

      public static List<Object> getSubjectAltNameField(X509Certificate certificate, int field)
      Extract the value of a given SubjectAltName field from a X509Certificate.
      Parameters:
      certificate - the certificate.
      field - the field number.
      Returns:
      an Optional containing the value in the field.
      See Also:

    • getSanUri

      public static Optional<String> getSanUri(X509Certificate certificate)
      Get the URI from the certificate's Subject Alternative Name extension, if it's present.
      Parameters:
      certificate - the certificate to get the URI from.
      Returns:
      the value of the SAN URI, if present.

    • getSanDnsNames

      public static List<String> getSanDnsNames(X509Certificate certificate)
      Get the DNS names from the certificate's Subject Alternative Name extension, if it's present.
      Parameters:
      certificate - the certificate to get the DNS names from.
      Returns:
      the values of the SAN DNS names, or empty list if none are present.

    • getSanIpAddresses

      public static List<String> getSanIpAddresses(X509Certificate certificate)
      Get the IP addresses from the certificate's Subject Alternative Name extension, if it's present.
      Parameters:
      certificate - the certificate to get the IP addresses from.
      Returns:
      the values of the SAN IP addresses, or empty list if none are present.

    • thumbprint

      public static ByteString thumbprint(X509Certificate certificate) throws UaException
      Throws:
      UaException

    • getCertificateChainBytes

      public static ByteString getCertificateChainBytes(List<X509Certificate> certificateChain) throws UaException
      Throws:
      UaException