public class CertificateFactory
extends java.lang.Object
CertPath) and certificate revocation list (CRL) objects from their encodings.
For encodings consisting of multiple certificates, use generateCertificates when you want to parse a
collection of possibly unrelated certificates. Otherwise, use generateCertPath when you want to generate a
CertPath (a certificate chain) and subsequently validate it with a CertPathValidator.
A certificate factory for X.509 must return certificates that are an instance of
java.security.cert.X509Certificate, and CRLs that are an instance of java.security.cert.X509CRL.
The following example reads a file with Base64 encoded certificates, which are each bounded at the beginning by
-----BEGIN CERTIFICATE-----, and bounded at the end by -----END CERTIFICATE-----. We convert the
FileInputStream (which does not support mark and reset) to a BufferedInputStream
(which supports those methods), so that each call to generateCertificate consumes only one certificate, and
the read position of the input stream is positioned to the next certificate in the file:
FileInputStream fis = new FileInputStream(filename);
BufferedInputStream bis = new BufferedInputStream(fis);
CertificateFactory cf = CertificateFactory.getInstance("X.509");
while (bis.available() > 0) {
Certificate cert = cf.generateCertificate(bis);
System.out.println(cert.toString());
}
The following example parses a PKCS#7-formatted certificate reply stored in a file and extracts all the certificates from it:
FileInputStream fis = new FileInputStream(filename);
CertificateFactory cf = CertificateFactory.getInstance("X.509");
Collection c = cf.generateCertificates(fis);
Iterator i = c.iterator();
while (i.hasNext()) {
Certificate cert = (Certificate) i.next();
System.out.println(cert);
}
Every implementation of the Java platform is required to support the following standard CertificateFactory
type:
X.509CertPath encodings:
PKCS7PkiPathCertificate,
X509Certificate| Constructor and Description |
|---|
CertificateFactory() |
| Modifier and Type | Method and Description |
|---|---|
Certificate |
generateCertificate(java.io.InputStream inStream)
Generates a certificate object and initializes it with the data read from the input stream
inStream. |
static CertificateFactory |
getInstance(java.lang.String type)
Returns a certificate factory object that implements the specified certificate type.
|
java.lang.String |
getType()
Returns the name of the certificate type associated with this certificate factory.
|
public static final CertificateFactory getInstance(java.lang.String type) throws CertificateException
This method traverses the list of registered security Providers, starting with the most preferred Provider. A new CertificateFactory object encapsulating the CertificateFactorySpi implementation from the first Provider that supports the specified type is returned.
type - the name of the requested certificate type. See the CertificateFactory section in the
Java
Cryptography Architecture Standard Algorithm Name Documentation for information about standard
certificate types.CertificateException - if no Provider supports a CertificateFactorySpi implementation for the specified type.public final java.lang.String getType()
public final Certificate generateCertificate(java.io.InputStream inStream) throws CertificateException
inStream.
In order to take advantage of the specialized certificate format supported by this certificate factory, the
returned certificate object can be typecast to the corresponding certificate class. For example, if this
certificate factory implements X.509 certificates, the returned certificate object can be typecast to the
X509Certificate class.
In the case of a certificate factory for X.509 certificates, the certificate provided in inStream must be
DER-encoded and may be supplied in binary or printable (Base64) encoding. If the certificate is provided in
Base64 encoding, it must be bounded at the beginning by -----BEGIN CERTIFICATE-----, and must be bounded at the
end by -----END CERTIFICATE-----.
Note that if the given input stream does not support mark and
reset, this method will consume the entire input stream. Otherwise, each call
to this method consumes one certificate and the read position of the input stream is positioned to the next
available byte after the inherent end-of-certificate marker. If the data in the input stream does not contain an
inherent end-of-certificate marker (other than EOF) and there is trailing data after the certificate is parsed, a
CertificateException is thrown.
inStream - an input stream with the certificate data.CertificateException - on parsing errors.