Package com.codename1.backend.security.pki

package com.codename1.backend.security.pki

Certificates, certification requests and key stores, read and written in the same Java on the JVM and in a native build.

  • Pem reads and writes PEM text; Certificate reads X.509 DER or PEM.
  • CertificateValidator validates a chain against trust anchors the application gives. There is no default trust store.
  • CertificationRequest creates and reads PKCS#10 requests.
  • Pkcs12 reads and writes .p12/.pfx key stores.
  • Keys are PKCS#8 DER (private) and SubjectPublicKeyInfo DER (public), the forms com.codename1.backend.Crypto signs, verifies and agrees keys with; Crypto.generateEcKey and Crypto.ecdh make and use P-256 and P-384 keys.

The algorithm profile, the same on every runtime:

Use Supported Refused
Certificate and request signatures RSA PKCS#1 v1.5 with SHA-256/384/512; RSASSA-PSS with SHA-256, MGF1-SHA-256, 32 byte salt; ECDSA P-256/SHA-256 and P-384/SHA-384 SHA-1, MD5, other PSS parameters, ECDSA with a digest that does not match its curve
Keys RSA 2048 to 8192 bits; EC on P-256 and P-384 Other curves, DSA, Ed25519
Key agreement ECDH on P-256 and P-384 X25519
PKCS#12 encryption PBES2 with PBKDF2-HMAC-SHA-256 or -SHA-1 and AES-128/192/256-CBC RC2, 3DES (-legacy)
PKCS#12 integrity HMAC-SHA-1/256/384/512 MAC Public-key integrity, no MAC
Encoding DER BER indefinite lengths

Chain validation checks signatures, validity periods, basic constraints, key usage, path length, unknown critical extensions, and optionally the host name and extended key usage of the leaf. It does not check revocation, name constraints or certificate policies; a certificate that marks either of the last two critical is refused.

  • Class
    Description
    Certificate
    An X.509 v3 certificate, read from DER or PEM.
    CertificateException
    A certificate, a chain or a key store that cannot be used: unreadable, outside the supported profile, or refused by validation.
    CertificateValidator
    Validates a certificate chain against trust anchors the application names.
    CertificationRequest
    A PKCS#10 certification request: what a CA (an ACME server, a corporate CA, openssl x509 -req) is sent to issue a certificate for a key.
    DistinguishedName
    An X.500 distinguished name, as a certificate's subject and issuer carry it.
    Pem
    PEM, the base64 text form of DER that openssl reads and writes: one or more blocks between -----BEGIN <label>----- and -----END <label>-----.
    Pem.Block
    One PEM block: its label and its DER content.
    Pkcs12
    A PKCS#12 key store (.p12, .pfx) holding one private key and its certificate chain, or only certificates.