net.i2p.crypto

## Class CertUtil

- java.lang.Object
- - net.i2p.crypto.CertUtil

-     public final class CertUtil
      extends Object

  Java X.509 certificate utilities, consolidated from various places.

- - ### Constructor Summary

    Constructors
    Constructor and Description
    `CertUtil()`

  - ### Method Summary

    All Methods Static Methods Concrete Methods
    Modifier and Type | Method and Description
    --- | ---
    `static void` | `exportCert(Certificate cert, OutputStream out)` Modified from: http://www.exampledepot.com/egs/java.security.cert/ExportCert.html Writes a certificate in base64 format.
    `static void` | `exportCRL(X509CRL crl, OutputStream out)` Writes a CRL in base64 format.
    `static void` | `exportPrivateKey(PrivateKey pk, Certificate[] certs, OutputStream out)` Writes the private key and all certs in base64 format.
    `static String` | `getIssuerValue(X509Certificate cert, String type)` Get a value out of the issuer distinguished name.
    `static Set<String>` | `getSubjectAlternativeNames(X509Certificate cert)` Get the set of Subject Alternative Names, including DNSNames, RFC822Names, IPv4 and v6 addresses as strings.
    `static String` | `getSubjectValue(X509Certificate cert, String type)` Get a value out of the subject distinguished name.
    `static boolean` | `isRevoked(Certificate cert)` Is the certificate revoked? This loads the CRLs from disk.
    `static boolean` | `isRevoked(CertStore store, Certificate cert)` Is the certificate revoked?
    `static boolean` | `isRevoked(I2PAppContext ctx, Certificate cert)` Is the certificate revoked? This loads the CRLs from disk.
    `static X509Certificate` | `loadCert(File kd)` Get the certificate from a X.509 certificate file.
    `static List<X509Certificate>` | `loadCerts(InputStream in)` Get one or more certificates from an input stream.
    `static X509CRL` | `loadCRL(InputStream in)` Load a CRL.
    `static CertStore` | `loadCRLs()` Load CRLs from standard locations.
    `static CertStore` | `loadCRLs(I2PAppContext ctx)` Load CRLs from standard locations.
    `static PublicKey` | `loadKey(File kd)` Get the Java public key from a X.509 certificate file.
    `static PrivateKey` | `loadPrivateKey(InputStream in)` Get a single Private Key from an input stream.
    `static void` | `main(String[] args)`
    `static boolean` | `saveCert(Certificate cert, File file)` Write a certificate to a file in base64 format.
    `static boolean` | `saveCRL(X509CRL crl, File file)` Write a CRL to a file in base64 format.

    - ### Methods inherited from class java.lang.Object

      `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

- - ### Constructor Detail

    - #### CertUtil

          public CertUtil()

  - ### Method Detail

    - #### exportCert

          public static void exportCert(Certificate cert,
                                        OutputStream out)
                                 throws IOException,
                                        CertificateEncodingException

      Modified from: http://www.exampledepot.com/egs/java.security.cert/ExportCert.html Writes a certificate in base64 format. Does NOT close the stream. Throws on all errors.
      Throws:
        `IOException`
        `CertificateEncodingException`

    - #### exportCRL

          public static void exportCRL(X509CRL crl,
                                       OutputStream out)
                                throws IOException,
                                       CRLException

      Writes a CRL in base64 format. Does NOT close the stream. Throws on all errors.
      Throws:
        `CRLException` - if the crl does not support encoding
        `IOException`

    - #### exportPrivateKey

          public static void exportPrivateKey(PrivateKey pk,
                                              Certificate[] certs,
                                              OutputStream out)
                                       throws IOException,
                                              GeneralSecurityException

      Writes the private key and all certs in base64 format. Does NOT close the stream. Throws on all errors.
      Parameters:
        `pk` - non-null
        `certs` - certificate chain, null or empty to export pk only
      Throws:
        `InvalidKeyException` - if the key does not support encoding
        `CertificateEncodingException` - if a cert does not support encoding
        `IOException`
        `GeneralSecurityException`

    - #### getIssuerValue

          public static String getIssuerValue(X509Certificate cert,
                                              String type)

      Get a value out of the issuer distinguished name. Warning - unsupported in Android (no javax.naming), returns null.
      Parameters:
        `type` - e.g. "CN"
      Returns:
        value or null if not found

    - #### getSubjectAlternativeNames

          public static Set<String> getSubjectAlternativeNames(X509Certificate cert)

      Get the set of Subject Alternative Names, including DNSNames, RFC822Names, IPv4 and v6 addresses as strings. see X509Certificate.getSubjectAlternativeNames()
      Returns:
        non-null, empty on error or none found

    - #### getSubjectValue

          public static String getSubjectValue(X509Certificate cert,
                                               String type)

      Get a value out of the subject distinguished name. Warning - unsupported in Android (no javax.naming), returns null.
      Parameters:
        `type` - e.g. "CN"
      Returns:
        value or null if not found

    - #### isRevoked

          public static boolean isRevoked(Certificate cert)

      Is the certificate revoked? This loads the CRLs from disk. For efficiency, call loadCRLs() and then pass to isRevoked().

    - #### isRevoked

          public static boolean isRevoked(CertStore store,
                                          Certificate cert)

      Is the certificate revoked?
      Parameters:
        `store` - the cert store containing CRLs
        `cert` - the certificate to check
      Returns:
        true if revoked

    - #### isRevoked

          public static boolean isRevoked(I2PAppContext ctx,
                                          Certificate cert)

      Is the certificate revoked? This loads the CRLs from disk. For efficiency, call loadCRLs() and then pass to isRevoked().

    - #### loadCert

          public static X509Certificate loadCert(File kd)
                                          throws IOException,
                                                 GeneralSecurityException

      Get the certificate from a X.509 certificate file. Throws if the certificate is invalid (e.g. expired). This does NOT check for revocation. This verifies the signature, assuming it is self-signed, but will not throw an exception, will log a warning only, as of 0.9.54. We do NOT fetch additional certs or attempt to validate a cert up the chain.
      Returns:
        non-null, throws on all errors including certificate invalid
      Throws:
        `IOException`
        `GeneralSecurityException`

    - #### loadCerts

          public static List<X509Certificate> loadCerts(InputStream in)
                                                 throws IOException,
                                                        GeneralSecurityException

      Get one or more certificates from an input stream. Throws if any certificate is invalid (e.g. expired). Does NOT close the stream. This does NOT check for revocation.
      Returns:
        non-null, non-empty, throws on all errors including certificate invalid
      Throws:
        `IOException`
        `GeneralSecurityException`

    - #### loadCRL

          public static X509CRL loadCRL(InputStream in)
                                 throws GeneralSecurityException

      Load a CRL. Does NOT Close the stream.
      Returns:
        non-null
      Throws:
        `GeneralSecurityException`

    - #### loadCRLs

          public static CertStore loadCRLs()

      Load CRLs from standard locations.
      Returns:
        non-null, possibly empty

    - #### loadCRLs

          public static CertStore loadCRLs(I2PAppContext ctx)

      Load CRLs from standard locations.
      Returns:
        non-null, possibly empty

    - #### loadKey

          public static PublicKey loadKey(File kd)
                                   throws IOException,
                                          GeneralSecurityException

      Get the Java public key from a X.509 certificate file. Throws if the certificate is invalid (e.g. expired). This DOES check for revocation.
      Returns:
        non-null, throws on all errors including certificate invalid
      Throws:
        `IOException`
        `GeneralSecurityException`

    - #### loadPrivateKey

          public static PrivateKey loadPrivateKey(InputStream in)
                                           throws IOException,
                                                  GeneralSecurityException

      Get a single Private Key from an input stream. Does NOT close the stream.
      Returns:
        non-null, non-empty, throws on all errors including certificate invalid
      Throws:
        `IOException`
        `GeneralSecurityException`

    - #### main

          public static final void main(String[] args)

    - #### saveCert

          public static boolean saveCert(Certificate cert,
                                         File file)

      Write a certificate to a file in base64 format.
      Returns:
        success

    - #### saveCRL

          public static boolean saveCRL(X509CRL crl,
                                        File file)

      Write a CRL to a file in base64 format.
      Returns:
        success