CertificateBuilder Class — netty Architecture

Source Code

pkitesting/src/main/java/io/netty/pkitesting/CertificateBuilder.java lines 106–1339

public final class CertificateBuilder {

    static final String OID_X509_NAME_CONSTRAINTS = "2.5.29.30";
    static final String OID_PKIX_KP = "1.3.6.1.5.5.7.3";
    static final String OID_PKIX_KP_SERVER_AUTH = OID_PKIX_KP + ".1";
    static final String OID_PKIX_KP_CLIENT_AUTH = OID_PKIX_KP + ".2";
    static final String OID_PKIX_KP_CODE_SIGNING = OID_PKIX_KP + ".3";
    static final String OID_PKIX_KP_EMAIL_PROTECTION = OID_PKIX_KP + ".4";
    static final String OID_PKIX_KP_TIME_STAMPING = OID_PKIX_KP + ".8";
    static final String OID_PKIX_KP_OCSP_SIGNING = OID_PKIX_KP + ".9";
    static final String OID_KERBEROS_KEY_PURPOSE_CLIENT_AUTH = "1.3.6.1.5.2.3.4";
    static final String OID_MICROSOFT_SMARTCARD_LOGIN = "1.3.6.1.4.1.311.20.2.2";
    private static final GeneralName[] EMPTY_GENERAL_NAMES = new GeneralName[0];
    private static final DistributionPoint[] EMPTY_DIST_POINTS = new DistributionPoint[0];
    private static final AlgorithmParameterSpec UNSUPPORTED_SPEC = new AlgorithmParameterSpec() {
    };
    private static final String UNSUPPORTED_SIGN = "UNSUPPORTED_SIGN";

    Provider provider;
    SecureRandom random;
    Algorithm algorithm = Algorithm.ecp256;
    Instant notBefore = Instant.now().minus(1, ChronoUnit.DAYS);
    Instant notAfter = Instant.now().plus(1, ChronoUnit.DAYS);
    List<BuilderCallback> modifierCallbacks = new ArrayList<>();
    List<GeneralName> subjectAlternativeNames = new ArrayList<>();
    List<DistributionPoint> crlDistributionPoints = new ArrayList<>();
    BigInteger serial;
    X500Principal subject;
    boolean isCertificateAuthority;
    OptionalInt pathLengthConstraint = OptionalInt.empty();
    KeyPair keyPair;
    Set<String> extendedKeyUsage = new TreeSet<>();
    Extension keyUsage;

    /**
     * Create a new certificate builder with a default configuration.
     * Unless specified otherwise, the builder will produce bundles that use the
     * {@linkplain Algorithm#ecp256 NIST EC-P 256} key algorithm,
     * and the certificates will be valid as of yesterday and expire tomorrow.
     */
    public CertificateBuilder() {
    }

    /**
     * Produce a copy of the current state in this certificate builder.
     * @return A copy of this certificate builder.
     */
    public CertificateBuilder copy() {
        CertificateBuilder copy = new CertificateBuilder();
        copy.random = random;
        copy.algorithm = algorithm;
        copy.notBefore = notBefore;
        copy.notAfter = notAfter;
        copy.modifierCallbacks = new ArrayList<>(modifierCallbacks);
        copy.subjectAlternativeNames = new ArrayList<>(subjectAlternativeNames);
        copy.crlDistributionPoints = new ArrayList<>(crlDistributionPoints);
        copy.serial = serial;
        copy.subject = subject;
        copy.isCertificateAuthority = isCertificateAuthority;
        copy.pathLengthConstraint = pathLengthConstraint;
        copy.keyPair = keyPair;
        copy.keyUsage = keyUsage;
        copy.extendedKeyUsage = new TreeSet<>(extendedKeyUsage);
        copy.provider = provider;
        return copy;
    }

    /**
     * Set the {@link Provider} instance to use when generating keys.
     * @param provider The provider instance to use.
     * @return This certificate builder.
     */
    public CertificateBuilder provider(Provider provider) {
        this.provider = provider;
        return this;
    }

    /**
     * Set the {@link SecureRandom} instance to use when generating keys.
     * @param secureRandom The secure random instance to use.
     * @return This certificate builder.