Class CertificationRequest

java.lang.Object

com.codename1.backend.security.pki.CertificationRequest

public final class CertificationRequest
extends Object

A PKCS#10 certification request: what a CA (an ACME server, a corporate CA, openssl x509 -req) is sent to issue a certificate for a key.

byte[] key = Crypto.generateEcKey(Crypto.P256);
CertificationRequest csr = CertificationRequest.create(
        DistinguishedName.parse("CN=api.example.com"), key,
        Arrays.asList("api.example.com", "www.example.com"));
String pem = csr.toPem();

The request is signed with SHA-256 for an RSA key or a P-256 key, and with SHA-384 for a P-384 key. DNS names go in a subject alternative name extension request, which is where every CA reads them from.

Method Summary

Modifier and Type	Method	Description
static CertificationRequest	create(DistinguishedName subject, byte[] privateKey, List<String> dnsNames)	Creates and signs a request.
static CertificationRequest	decode(byte[] der)	Reads a request from its DER.
static CertificationRequest	fromPem(String pem)	The first CERTIFICATE REQUEST block of pem.
List<String>	getDnsNames()	The DNS names of the subject alternative name extension request.
byte[]	getEncoded()	The DER of this request.
byte[]	getPublicKey()	The public key, as SubjectPublicKeyInfo DER.
DistinguishedName	getSubject()	The subject the request asks for.
String	toPem()	The request as one PEM block.
boolean	verify()	Whether the request is signed by the key it carries, which proves the requester holds the private key.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

create

public static CertificationRequest create(DistinguishedName subject,
 byte[] privateKey,
 List<String> dnsNames)
                                   throws IOException

Creates and signs a request.

Parameters:

subject - the subject; may be empty when dnsNames says who it is for

privateKey - the PKCS#8 key the certificate will be for, RSA, P-256 or P-384. It must carry its public key, as every key Crypto generates and openssl writes does.

dnsNames - the DNS names to request; null or empty for none

Throws:

IOException

decode

public static CertificationRequest decode(byte[] der)
                                   throws IOException

Reads a request from its DER.

Throws:

IOException

fromPem

public static CertificationRequest fromPem(String pem)
                                    throws IOException

The first CERTIFICATE REQUEST block of pem. NEW CERTIFICATE REQUEST, which some older tools write, is read too.

Throws:

IOException

getEncoded

public byte[] getEncoded()

The DER of this request.

toPem

public String toPem()

The request as one PEM block.

getSubject

public DistinguishedName getSubject()

The subject the request asks for.

getPublicKey

public byte[] getPublicKey()

The public key, as SubjectPublicKeyInfo DER.

getDnsNames

public List<String> getDnsNames()

The DNS names of the subject alternative name extension request.

verify

public boolean verify()
               throws IOException

Whether the request is signed by the key it carries, which proves the requester holds the private key.

Throws:

IOException - when the signature algorithm is outside the profile