org.eclipse.milo.opcua.stack.core.util

Class CertificateUtil

java.lang.Object

org.eclipse.milo.opcua.stack.core.util.CertificateUtil

public class CertificateUtil
extends Object

Field Summary

Fields

Modifier and Type	Field and Description
static int	SUBJECT_ALT_NAME_DNS_NAME
static int	SUBJECT_ALT_NAME_IP_ADDRESS
static int	SUBJECT_ALT_NAME_URI

Constructor Summary

Constructors

Constructor and Description
CertificateUtil()

Method Summary

Modifier and Type	Method and Description
static X509Certificate	decodeCertificate(byte[] certificateBytes) Decode a DER-encoded X.509 certificate.
static X509Certificate	decodeCertificate(InputStream inputStream) Decode a DER-encoded X.509 certificate.
static List<X509Certificate>	decodeCertificates(byte[] certificateBytes) Decode either a sequence of DER-encoded X.509 certificates or a PKCS#7 certificate chain.
static List<X509Certificate>	decodeCertificates(InputStream inputStream) Decode either a sequence of DER-encoded X.509 certificates or a PKCS#7 certificate chain.
static org.bouncycastle.pkcs.PKCS10CertificationRequest	generateCsr(KeyPair keyPair, String subjectName, String sanUri, List<String> sanDnsNames, List<String> sanIpAddresses, String signatureAlgorithm) Generate a PKCS10CertificationRequest.
static org.bouncycastle.pkcs.PKCS10CertificationRequest	generateCsr(KeyPair keyPair, org.bouncycastle.asn1.x500.X500Name subject, String sanUri, List<String> sanDnsNames, List<String> sanIpAddresses, String signatureAlgorithm) Generate a PKCS10CertificationRequest.
static org.bouncycastle.pkcs.PKCS10CertificationRequest	generateCsr(KeyPair keyPair, X509Certificate certificate) Generate a PKCS10CertificationRequest for the provided certificate and keyPair.
static ByteString	getCertificateChainBytes(List<X509Certificate> certificateChain)
static String	getCsrPem(org.bouncycastle.pkcs.PKCS10CertificationRequest csr) Get a PEM-encoded String containing a PKCS #10 certificate signing request.
static List<String>	getSanDnsNames(X509Certificate certificate) Get the DNS names from the certificate's Subject Alternative Name extension, if it's present.
static List<String>	getSanIpAddresses(X509Certificate certificate) Get the IP addresses from the certificate's Subject Alternative Name extension, if it's present.
static Optional<String>	getSanUri(X509Certificate certificate) Get the URI from the certificate's Subject Alternative Name extension, if it's present.
static List<Object>	getSubjectAltNameField(X509Certificate certificate, int field) Extract the value of a given SubjectAltName field from a X509Certificate.
static ByteString	thumbprint(X509Certificate certificate)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

SUBJECT_ALT_NAME_DNS_NAME

public static final int SUBJECT_ALT_NAME_DNS_NAME

See Also:

Constant Field Values

SUBJECT_ALT_NAME_IP_ADDRESS

public static final int SUBJECT_ALT_NAME_IP_ADDRESS

See Also:

Constant Field Values

SUBJECT_ALT_NAME_URI

public static final int SUBJECT_ALT_NAME_URI

See Also:

Constant Field Values

Constructor Detail

CertificateUtil

public CertificateUtil()

Method Detail

decodeCertificate

public static X509Certificate decodeCertificate(byte[] certificateBytes)
                                         throws UaException

Decode a DER-encoded X.509 certificate.

Parameters:

certificateBytes - DER-encoded certificate bytes.

Returns:

an X509Certificate

Throws:

UaException - if decoding the certificate fails.

decodeCertificate

public static X509Certificate decodeCertificate(InputStream inputStream)
                                         throws UaException

Decode a DER-encoded X.509 certificate.

Parameters:

inputStream - InputStream containing DER-encoded certificate bytes.

Returns:

an X509Certificate

Throws:

UaException - if decoding the certificate fails.

decodeCertificates

public static List<X509Certificate> decodeCertificates(byte[] certificateBytes)
                                                throws UaException

Decode either a sequence of DER-encoded X.509 certificates or a PKCS#7 certificate chain.

Parameters:

certificateBytes - the byte[] to decode from.

Returns:

a List of certificates deocded from certificateBytes.

Throws:

UaException - if decoding fails.

decodeCertificates

public static List<X509Certificate> decodeCertificates(InputStream inputStream)
                                                throws UaException

Decode either a sequence of DER-encoded X.509 certificates or a PKCS#7 certificate chain.

Parameters:

inputStream - the InputStream to decode from.

Returns:

a List of certificates decoded from inputStream.

Throws:

UaException - if decoding fails.

generateCsr

public static org.bouncycastle.pkcs.PKCS10CertificationRequest generateCsr(KeyPair keyPair,
                                                                           X509Certificate certificate)
                                                                    throws Exception

Generate a PKCS10CertificationRequest for the provided certificate and keyPair.

Parameters:

keyPair - the KeyPair for certificate.

certificate - the X509Certificate to request signing for.

Returns:

a PKCS10CertificationRequest.

Throws:

Exception - if creating the signing request fails for any reason.

generateCsr

public static org.bouncycastle.pkcs.PKCS10CertificationRequest generateCsr(KeyPair keyPair,
                                                                           String subjectName,
                                                                           String sanUri,
                                                                           List<String> sanDnsNames,
                                                                           List<String> sanIpAddresses,
                                                                           String signatureAlgorithm)
                                                                    throws Exception

Generate a PKCS10CertificationRequest.

Parameters:

keyPair - the KeyPair containing Public and Private keys.

subjectName - the subject name, in RFC 4519 style. (CN=foo,O=bar)

sanUri - the URI to request in the SAN.

sanDnsNames - the DNS names to request in the SAN.

sanIpAddresses - the IP addresses to request in the SAN.

signatureAlgorithm - the signature algorithm to use when generating the signature to validate the certificate.

Returns:

a PKCS10CertificationRequest.

Throws:

Exception - if creating the signing request fails for any reason.

generateCsr

public static org.bouncycastle.pkcs.PKCS10CertificationRequest generateCsr(KeyPair keyPair,
                                                                           org.bouncycastle.asn1.x500.X500Name subject,
                                                                           String sanUri,
                                                                           List<String> sanDnsNames,
                                                                           List<String> sanIpAddresses,
                                                                           String signatureAlgorithm)
                                                                    throws Exception

Generate a PKCS10CertificationRequest.

Parameters:

keyPair - the KeyPair containing Public and Private keys.

subject - the subject name X500Name.

sanUri - the URI to request in the SAN.

sanDnsNames - the DNS names to request in the SAN.

sanIpAddresses - the IP addresses to request in the SAN.

signatureAlgorithm - the signature algorithm to use when generating the signature to validate the certificate.

Returns:

a PKCS10CertificationRequest.

Throws:

Exception - if creating the signing request fails for any reason.

getCsrPem

public static String getCsrPem(org.bouncycastle.pkcs.PKCS10CertificationRequest csr)
                        throws IOException

Get a PEM-encoded String containing a PKCS #10 certificate signing request.

Parameters:

csr - the X509Certificate to request signing for.

Returns:

a PEM-encoded String containing a PKCS #10 CSR.

Throws:

IOException - if creating the signing request fails for any reason.

getSubjectAltNameField

public static List<Object> getSubjectAltNameField(X509Certificate certificate,
                                                  int field)

Extract the value of a given SubjectAltName field from a X509Certificate.

Parameters:

certificate - the certificate.

field - the field number.

Returns:

an Optional containing the value in the field.

See Also:

SUBJECT_ALT_NAME_IP_ADDRESS, SUBJECT_ALT_NAME_DNS_NAME, SUBJECT_ALT_NAME_URI

getSanUri

public static Optional<String> getSanUri(X509Certificate certificate)

Get the URI from the certificate's Subject Alternative Name extension, if it's present.

Parameters:

certificate - the certificate to get the URI from.

Returns:

the value of the SAN URI, if present.

getSanDnsNames

public static List<String> getSanDnsNames(X509Certificate certificate)

Get the DNS names from the certificate's Subject Alternative Name extension, if it's present.

Parameters:

certificate - the certificate to get the DNS names from.

Returns:

the values of the SAN DNS names, or empty list if none are present.

getSanIpAddresses

public static List<String> getSanIpAddresses(X509Certificate certificate)

Get the IP addresses from the certificate's Subject Alternative Name extension, if it's present.

Parameters:

certificate - the certificate to get the IP addresses from.

Returns:

the values of the SAN IP addresses, or empty list if none are present.

thumbprint

public static ByteString thumbprint(X509Certificate certificate)
                             throws UaException

Throws:

UaException

getCertificateChainBytes

public static ByteString getCertificateChainBytes(List<X509Certificate> certificateChain)
                                           throws UaException

Throws:

UaException