Package org.mozilla.jss
Class CryptoManager
- java.lang.Object
-
- org.mozilla.jss.CryptoManager
-
- All Implemented Interfaces:
TokenSupplier
public final class CryptoManager extends java.lang.Object implements TokenSupplier
This class is the starting poing for the crypto package. Use it to initialize the subsystem and to lookup certs, keys, and tokens. Initialization is done with static methods, and must be done before an instance can be created. All other operations are done with instance methods.
-
-
Nested Class Summary
Nested Classes Modifier and Type Class Description static class
CryptoManager.CertUsage
note: this is obsolete in NSS CertUsage options for validationstatic class
CryptoManager.OCSPPolicy
-
Constructor Summary
Constructors Modifier Constructor Description protected
CryptoManager()
Constructor, for internal use only.
-
Method Summary
All Methods Static Methods Instance Methods Concrete Methods Deprecated Methods Modifier and Type Method Description X509Certificate[]
buildCertificateChain(X509Certificate leaf)
Given a certificate, constructs its certificate chain.void
configureOCSP(boolean ocspCheckingEnabled, java.lang.String ocspResponderURL, java.lang.String ocspResponderCertNickname)
Enables OCSP, note when you Initialize JSS for the first time, for backwards compatibility, the initialize will enable OCSP if you previously set values.ocspCheckingEnabled and values.ocspResponderURL/values.ocspResponderCertNickname configureOCSP will allow changing of the the OCSPResponder at runtime.JSSSecureRandom
createPseudoRandomNumberGenerator()
Retrieves a FIPS-140-2 validated random number generator.byte[]
exportCertsToPKCS7(X509Certificate[] certs)
Exports one or more certificates into a PKCS #7 certificate container.X509Certificate
findCertByIssuerAndSerialNumber(byte[] derIssuer, INTEGER serialNumber)
Looks up a certificate by issuer and serial number.X509Certificate
findCertByNickname(java.lang.String nickname)
Looks up a certificate given its nickname.protected X509Certificate
findCertByNicknameNative(java.lang.String nickname)
X509Certificate[]
findCertsByNickname(java.lang.String nickname)
Returns all certificates with the given nickname.protected X509Certificate[]
findCertsByNicknameNative(java.lang.String nickname)
PrivateKey
findPrivKeyByCert(X509Certificate cert)
Looks up the PrivateKey matching the given certificate.protected PrivateKey
findPrivKeyByCertNative(X509Certificate cert)
boolean
FIPSEnabled()
Determines whether FIPS-140-2 compliance is active.java.util.Enumeration<CryptoToken>
getAllTokens()
Retrieves all tokens.X509Certificate[]
getCACerts()
Retrieves all CA certificates in the trust database.java.util.Enumeration<CryptoToken>
getExternalTokens()
Retrieves all tokens except those built into NSS.static CryptoManager
getInstance()
Retrieve the single instance of CryptoManager.CryptoToken
getInternalCryptoToken()
Retrieves the internal cryptographic services token.CryptoToken
getInternalKeyStorageToken()
Retrieves the internal key storage token.static boolean
getJSSDebug()
static int
getJSSMajorVersion()
static int
getJSSMinorVersion()
static int
getJSSPatchVersion()
static java.lang.String
getJSSVersion()
java.util.Enumeration<PK11Module>
getModules()
Retrieves all installed cryptographic modules.static int
getOCSPPolicy()
Gets the current ocsp Policy.static CryptoManager.OCSPPolicy
getOCSPPolicyEnum()
Gets the current OCSP Policy.PasswordCallback
getPasswordCallback()
Returns the currently registered password callback.X509Certificate[]
getPermCerts()
Retrieves all certificates in the trust database.JSSSecureRandom
getSecureRNG()
Retrieves a FIPS-140-2 validated random number generator.CryptoToken
getThreadToken()
Returns the default token for the current thread.CryptoToken
getTokenByName(java.lang.String name)
Looks up the CryptoToken with the given name.java.util.Enumeration<CryptoToken>
getTokensSupportingAlgorithm(Algorithm alg)
Retrieves all tokens that support the given algorithm.X509Certificate
importCACertPackage(byte[] certPackage)
Imports a chain of certificates, none of which is a user certificate.X509Certificate
importCertPackage(byte[] certPackage, java.lang.String nickname)
Imports a chain of certificates.InternalCertificate
importCertToPerm(X509Certificate cert, java.lang.String nickname)
Imports a single certificate into the permanent certificate database.void
importCRL(byte[] crl, java.lang.String url)
Imports a CRL, and stores it into the cert7.db Validate CRL then import it to the dbase.X509Certificate
importDERCert(byte[] cert, CertificateUsage usage, boolean permanent, java.lang.String nickname)
Imports a single DER-encoded certificate into the permanent or temporary certificate database.X509Certificate
importUserCACertPackage(byte[] certPackage, java.lang.String nickname)
Imports a chain of certificates.static void
initialize(java.lang.String configDir)
Initialize the security subsystem.static void
initialize(InitializationValues values)
Initialize the security subsystem.boolean
isCertValid(byte[] certPackage, boolean checkSig, CryptoManager.CertUsage certUsage)
Verify a certificate in memory.int
isCertValid(java.lang.String nickname, boolean checkSig)
Verify a certificate that exists in the given cert database, check if is valid and that we trust the issuer.boolean
isCertValid(java.lang.String nickname, boolean checkSig, CertificateUsage certificateUsage)
Deprecated.Use verifyCertificate() insteadboolean
isCertValid(java.lang.String nickname, boolean checkSig, CryptoManager.CertUsage certUsage)
note: this method calls obsolete function in NSS Verify a certificate that exists in the given cert database, check if is valid and that we trust the issuer.static boolean
isInitialized()
void
OCSPCacheSettings(int ocsp_cache_size, int ocsp_min_cache_entry_duration, int ocsp_max_cache_entry_duration)
change OCSP cache settingsstatic void
setOCSPPolicy(CryptoManager.OCSPPolicy policy)
Sets the current ocsp Policy.void
setOCSPTimeout(int ocsp_timeout)
set OCSP timeout valuevoid
setPasswordCallback(PasswordCallback pwcb)
This function sets the global password callback.void
setThreadToken(CryptoToken token)
Sets the default token for the current thread.void
shutdown()
Shutdowns this CryptoManager instance and the associated NSS initialization.void
shutdownNative()
void
verifyCertificate(java.lang.String nickname, boolean checkSig, CertificateUsage certificateUsage)
Verify a certificate that exists in the given cert database, check if it's valid and that we trust the issuer.void
verifyCertificate(X509Certificate cert, boolean checkSig, CertificateUsage certificateUsage)
Verify an X509Certificate by checking if it's valid and that we trust the issuer.
-
-
-
Method Detail
-
getInternalCryptoToken
public CryptoToken getInternalCryptoToken()
Retrieves the internal cryptographic services token. This is the token built into NSS that performs bulk cryptographic operations.In FIPS mode, the internal cryptographic services token is the same as the internal key storage token.
- Specified by:
getInternalCryptoToken
in interfaceTokenSupplier
- Returns:
- The internal cryptographic services token.
-
getInternalKeyStorageToken
public CryptoToken getInternalKeyStorageToken()
Retrieves the internal key storage token. This is the token provided by NSS to store private keys. The keys stored in this token are stored in an encrypted key database.In FIPS mode, the internal key storage token is the same as the internal cryptographic services token.
- Returns:
- The internal key storage token.
-
getTokenByName
public CryptoToken getTokenByName(java.lang.String name) throws NoSuchTokenException
Looks up the CryptoToken with the given name. Searches all loaded cryptographic modules for the token.- Parameters:
name
- The name of the token.- Returns:
- The token.
- Throws:
NoSuchTokenException
- If no token is found with the given name.
-
getTokensSupportingAlgorithm
public java.util.Enumeration<CryptoToken> getTokensSupportingAlgorithm(Algorithm alg)
Retrieves all tokens that support the given algorithm.- Parameters:
alg
- Algorithm.- Returns:
- Enumeration of tokens.
-
getAllTokens
public java.util.Enumeration<CryptoToken> getAllTokens()
Retrieves all tokens. This is an enumeration of all tokens on all modules.- Returns:
- All tokens accessible from JSS. Each item of the enumeration
is a
CryptoToken
- See Also:
CryptoToken
-
getExternalTokens
public java.util.Enumeration<CryptoToken> getExternalTokens()
Retrieves all tokens except those built into NSS. This excludes the internal token and the internal key storage token (which are one and the same in FIPS mode).- Returns:
- All tokens accessible from JSS, except for the built-in internal tokens.
-
getModules
public java.util.Enumeration<PK11Module> getModules()
Retrieves all installed cryptographic modules.- Returns:
- An enumeration of all installed PKCS #11 modules. Each
item in the enumeration is a
PK11Module
. - See Also:
PK11Module
-
isInitialized
public static boolean isInitialized()
-
getInstance
public static CryptoManager getInstance() throws NotInitializedException
Retrieve the single instance of CryptoManager. This cannot be called before initialization.- Returns:
- CryptoManager instance.
- Throws:
NotInitializedException
- Ifinitialize(InitializationValues
has not yet been called.- See Also:
initialize(InitializationValues)
-
FIPSEnabled
public boolean FIPSEnabled()
Determines whether FIPS-140-2 compliance is active.- Returns:
- true if the security library is in FIPS-140-2 compliant mode.
-
setPasswordCallback
public void setPasswordCallback(PasswordCallback pwcb)
This function sets the global password callback. It is not thread-safe to change this.The callback may be NULL, in which case password callbacks will fail gracefully.
- Parameters:
pwcb
- Password callback.
-
getPasswordCallback
public PasswordCallback getPasswordCallback()
Returns the currently registered password callback.- Returns:
- Password callback.
-
initialize
public static void initialize(java.lang.String configDir) throws KeyDatabaseException, CertDatabaseException, AlreadyInitializedException, java.security.GeneralSecurityException
Initialize the security subsystem. Opens the databases, loads all PKCS #11 modules, initializes the internal random number generator. Theinitialize
methods that take arguments should be called only once, otherwise they will throw an exception. It is OK to call them after callinginitialize()
.- Parameters:
configDir
- The directory containing the security databases.- Throws:
KeyDatabaseException
- Unable to open the key database, or it was currupted.CertDatabaseException
- Unable to open the certificate database, or it was currupted.AlreadyInitializedException
- If the security subsystem is already initialized.java.security.GeneralSecurityException
- If other security error occurred.
-
initialize
public static void initialize(InitializationValues values) throws KeyDatabaseException, CertDatabaseException, AlreadyInitializedException, java.security.GeneralSecurityException
Initialize the security subsystem. Opens the databases, loads all PKCS #11 modules, initializes the internal random number generator. Theinitialize
methods that take arguments should be called only once, otherwise they will throw an exception. It is OK to call them after callinginitialize()
.- Parameters:
values
- The options with which to initialize CryptoManager.- Throws:
KeyDatabaseException
- Unable to open the key database, or it was corrupted.CertDatabaseException
- Unable to open the certificate database, or it was currupted.AlreadyInitializedException
- If security subsystem is already initialized.java.security.GeneralSecurityException
- If other security error occurred.
-
getCACerts
public X509Certificate[] getCACerts()
Retrieves all CA certificates in the trust database. This is a fairly expensive operation in that it involves traversing the entire certificate database.- Returns:
- An array of all CA certificates stored permanently in the trust database.
-
getPermCerts
public X509Certificate[] getPermCerts()
Retrieves all certificates in the trust database. This is a fairly expensive operation in that it involves traversing the entire certificate database.- Returns:
- An array of all certificates stored permanently in the trust database.
-
importCertPackage
public X509Certificate importCertPackage(byte[] certPackage, java.lang.String nickname) throws java.security.cert.CertificateEncodingException, NicknameConflictException, UserCertConflictException, NoSuchItemOnTokenException, TokenException
Imports a chain of certificates. The leaf certificate may be a a user certificate, that is, a certificate that belongs to the current user and whose private key is available for use. If the leaf certificate is a user certificate, it is stored on the token that contains the corresponding private key, and is assigned the given nickname.- Parameters:
certPackage
- An encoded certificate or certificate chain. Acceptable encodings are binary PKCS #7 SignedData objects and DER-encoded certificates, which may or may not be wrapped in a Base-64 encoding package surrounded by "-----BEGIN CERTIFICATE-----
" and "-----END CERTIFICATE-----
".nickname
- The nickname for the user certificate. It must be unique. It is ignored if there is no user certificate.- Returns:
- The leaf certificate from the chain.
- Throws:
java.security.cert.CertificateEncodingException
- If the package encoding was not recognized.NicknameConflictException
- If the leaf certificate is a user certificate, and another certificate already has the given nickname.UserCertConflictException
- If the leaf certificate is a user certificate, but it has already been imported.NoSuchItemOnTokenException
- If the leaf certificate is a user certificate, but the matching private key cannot be found.TokenException
- If an error occurs importing a leaf certificate into a token.
-
importUserCACertPackage
public X509Certificate importUserCACertPackage(byte[] certPackage, java.lang.String nickname) throws java.security.cert.CertificateEncodingException, NicknameConflictException, UserCertConflictException, NoSuchItemOnTokenException, TokenException
Imports a chain of certificates. The leaf of the chain is a CA certificate AND a user certificate (this would only be called by a CA installing its own certificate).- Parameters:
certPackage
- An encoded certificate or certificate chain. Acceptable encodings are binary PKCS #7 SignedData objects and DER-encoded certificates, which may or may not be wrapped in a Base-64 encoding package surrounded by "-----BEGIN CERTIFICATE-----
" and "-----END CERTIFICATE-----
".nickname
- The nickname for the user certificate. It must be unique.- Returns:
- The leaf certificate from the chain.
- Throws:
java.security.cert.CertificateEncodingException
- If the package encoding was not recognized.NicknameConflictException
- If the leaf certificate another certificate already has the given nickname.UserCertConflictException
- If the leaf certificate has already been imported.NoSuchItemOnTokenException
- If the the private key matching the leaf certificate cannot be found.TokenException
- If an error occurs importing the leaf certificate into a token.
-
importCACertPackage
public X509Certificate importCACertPackage(byte[] certPackage) throws java.security.cert.CertificateEncodingException, TokenException
Imports a chain of certificates, none of which is a user certificate.- Parameters:
certPackage
- An encoded certificate or certificate chain. Acceptable encodings are binary PKCS #7 SignedData objects and DER-encoded certificates, which may or may not be wrapped in a Base-64 encoding package surrounded by "-----BEGIN CERTIFICATE-----
" and "-----END CERTIFICATE-----
".- Returns:
- The leaf certificate from the chain.
- Throws:
java.security.cert.CertificateEncodingException
- If the package encoding was not recognized.TokenException
- If an error occurs importing a leaf certificate into a token.
-
importCertToPerm
public InternalCertificate importCertToPerm(X509Certificate cert, java.lang.String nickname) throws TokenException, InvalidNicknameException
Imports a single certificate into the permanent certificate database.- Parameters:
cert
- the certificate you want to addnickname
- the nickname you want to refer to the certificate as (must not be null)- Returns:
- Certificate object.
- Throws:
TokenException
- If an error occurred in the token.InvalidNicknameException
- If the nickname is invalid.
-
importDERCert
public X509Certificate importDERCert(byte[] cert, CertificateUsage usage, boolean permanent, java.lang.String nickname)
Imports a single DER-encoded certificate into the permanent or temporary certificate database.
-
importCRL
public void importCRL(byte[] crl, java.lang.String url) throws CRLImportException, TokenException
Imports a CRL, and stores it into the cert7.db Validate CRL then import it to the dbase. If there is already a CRL with the same CA in the dbase, it will be replaced if derCRL is more up to date.- Parameters:
crl
- the DER-encoded CRL.url
- the URL where this CRL can be retrieved from (for future updates). [ note that CRLs are not retrieved automatically ]. Can be null- Throws:
CRLImportException
- If the package encoding was not recognized.TokenException
- If an error occurred in the token.
-
exportCertsToPKCS7
public byte[] exportCertsToPKCS7(X509Certificate[] certs) throws java.security.cert.CertificateEncodingException
Exports one or more certificates into a PKCS #7 certificate container. This is just a SignedData object whose certificates field contains the given certificates but whose content field is empty.- Parameters:
certs
- One or more certificates that should be exported into the PKCS #7 object. The leaf certificate should be the first in the chain. The output ofbuildCertificateChain
would be appropriate here.- Returns:
- A byte array containing a PKCS #7 SignedData object.
- Throws:
java.security.cert.CertificateEncodingException
- If the array is empty, or an error occurred encoding the certificates.- See Also:
buildCertificateChain(org.mozilla.jss.crypto.X509Certificate)
-
findCertByNickname
public X509Certificate findCertByNickname(java.lang.String nickname) throws ObjectNotFoundException, TokenException
Looks up a certificate given its nickname.- Parameters:
nickname
- The nickname of the certificate to look for.- Returns:
- The certificate matching this nickname, if one is found.
- Throws:
ObjectNotFoundException
- If no certificate could be found with the given nickname.TokenException
- If an error occurs in the security library.
-
findCertsByNickname
public X509Certificate[] findCertsByNickname(java.lang.String nickname) throws TokenException
Returns all certificates with the given nickname.- Parameters:
nickname
- The nickname of the certificate to look for.- Returns:
- The certificates matching this nickname. The array may be empty if no matching certs were found.
- Throws:
TokenException
- If an error occurs in the security library.
-
findCertByIssuerAndSerialNumber
public X509Certificate findCertByIssuerAndSerialNumber(byte[] derIssuer, INTEGER serialNumber) throws ObjectNotFoundException, TokenException
Looks up a certificate by issuer and serial number. The internal database and all PKCS #11 modules are searched.- Parameters:
derIssuer
- The DER encoding of the certificate issuer name. The issuer name has ASN.1 type Name, which is defined in X.501.serialNumber
- The certificate serial number.- Returns:
- Certificate object.
- Throws:
ObjectNotFoundException
- If the certificate is not found in the internal certificate database or on any PKCS #11 token.TokenException
- If an error occurs in the security library.
-
findCertByNicknameNative
protected X509Certificate findCertByNicknameNative(java.lang.String nickname) throws ObjectNotFoundException, TokenException
-
findCertsByNicknameNative
protected X509Certificate[] findCertsByNicknameNative(java.lang.String nickname) throws TokenException
- Throws:
TokenException
-
buildCertificateChain
public X509Certificate[] buildCertificateChain(X509Certificate leaf) throws java.security.cert.CertificateException, TokenException
Given a certificate, constructs its certificate chain. It may or may not chain up to a trusted root.- Parameters:
leaf
- The certificate that is the starting point of the chain.- Returns:
- An array of certificates, starting at the leaf and ending with the highest certificate on the chain that was found.
- Throws:
java.security.cert.CertificateException
- If the certificate is not recognized by the underlying provider.TokenException
- If an error occurred in the token.
-
findPrivKeyByCert
public PrivateKey findPrivKeyByCert(X509Certificate cert) throws ObjectNotFoundException, TokenException
Looks up the PrivateKey matching the given certificate.- Parameters:
cert
- Certificate.- Returns:
- Private key.
- Throws:
ObjectNotFoundException
- If no private key can be found matching the given certificate.TokenException
- If an error occurs in the security library.
-
findPrivKeyByCertNative
protected PrivateKey findPrivKeyByCertNative(X509Certificate cert) throws ObjectNotFoundException, TokenException
-
createPseudoRandomNumberGenerator
public JSSSecureRandom createPseudoRandomNumberGenerator()
Retrieves a FIPS-140-2 validated random number generator.- Returns:
- A JSS SecureRandom implemented with FIPS-validated NSS.
-
getSecureRNG
public JSSSecureRandom getSecureRNG()
Retrieves a FIPS-140-2 validated random number generator.- Specified by:
getSecureRNG
in interfaceTokenSupplier
- Returns:
- A JSS SecureRandom implemented with FIPS-validated NSS.
-
getJSSMajorVersion
public static int getJSSMajorVersion()
-
getJSSMinorVersion
public static int getJSSMinorVersion()
-
getJSSPatchVersion
public static int getJSSPatchVersion()
-
getJSSVersion
public static final java.lang.String getJSSVersion()
-
getJSSDebug
public static boolean getJSSDebug()
-
setThreadToken
public void setThreadToken(CryptoToken token)
Sets the default token for the current thread. This token will be used when JSS is called through the JCA interface, which has no means of specifying which token to use.If no token is set, the InternalKeyStorageToken will be used. Setting this thread's token to
null
will also cause the InternalKeyStorageToken to be used.- Specified by:
setThreadToken
in interfaceTokenSupplier
- Parameters:
token
- The token to use for crypto operations. Specifyingnull
will cause the InternalKeyStorageToken to be used.
-
getThreadToken
public CryptoToken getThreadToken()
Returns the default token for the current thread. This token will be used when JSS is called through the JCA interface, which has no means of specifying which token to use.If no token is set, the InternalKeyStorageToken will be used. Setting this thread's token to
null
will also cause the InternalKeyStorageToken to be used.- Specified by:
getThreadToken
in interfaceTokenSupplier
- Returns:
- The default token for this thread. If it has not been specified, it will be the InternalKeyStorageToken.
-
isCertValid
public int isCertValid(java.lang.String nickname, boolean checkSig) throws ObjectNotFoundException, InvalidNicknameException
Verify a certificate that exists in the given cert database, check if is valid and that we trust the issuer. Verify time against Now.- Parameters:
nickname
- The nickname of the certificate to verify.checkSig
- verify the signature of the certificate- Returns:
- currCertificateUsage which contains current usage bit map as defined in CertificateUsage
- Throws:
InvalidNicknameException
- If the nickname is nullObjectNotFoundException
- If no certificate could be found with the given nickname.
-
isCertValid
@Deprecated public boolean isCertValid(java.lang.String nickname, boolean checkSig, CertificateUsage certificateUsage) throws ObjectNotFoundException, InvalidNicknameException
Deprecated.Use verifyCertificate() insteadVerify a certificate that exists in the given cert database, check if is valid and that we trust the issuer. Verify time against Now.- Parameters:
nickname
- The nickname of the certificate to verify.checkSig
- verify the signature of the certificatecertificateUsage
- see certificateUsage defined to verify Certificate; to retrieve current certificate usage, call the isCertValid() above- Returns:
- true for success; false otherwise
- Throws:
InvalidNicknameException
- If the nickname is nullObjectNotFoundException
- If no certificate could be found with the given nickname.
-
verifyCertificate
public void verifyCertificate(java.lang.String nickname, boolean checkSig, CertificateUsage certificateUsage) throws ObjectNotFoundException, InvalidNicknameException, java.security.cert.CertificateException
Verify a certificate that exists in the given cert database, check if it's valid and that we trust the issuer. Verify time against now.- Parameters:
nickname
- nickname of the certificate to verify.checkSig
- verify the signature of the certificatecertificateUsage
- see certificate usage defined to verify certificate- Throws:
InvalidNicknameException
- If the nickname is null.ObjectNotFoundException
- If no certificate could be found with the given nickname.java.security.cert.CertificateException
- If certificate is invalid.
-
verifyCertificate
public void verifyCertificate(X509Certificate cert, boolean checkSig, CertificateUsage certificateUsage) throws ObjectNotFoundException, InvalidNicknameException, java.security.cert.CertificateException
Verify an X509Certificate by checking if it's valid and that we trust the issuer. Verify time against now.- Parameters:
cert
- the certificate to verifycheckSig
- verify the signature of the certificatecertificateUsage
- see certificate usage defined to verify certificate- Throws:
InvalidNicknameException
- If the nickname is null.ObjectNotFoundException
- If no certificate could be found with the given nickname.java.security.cert.CertificateException
- If certificate is invalid.
-
isCertValid
public boolean isCertValid(java.lang.String nickname, boolean checkSig, CryptoManager.CertUsage certUsage) throws ObjectNotFoundException, InvalidNicknameException
note: this method calls obsolete function in NSS Verify a certificate that exists in the given cert database, check if is valid and that we trust the issuer. Verify time against Now.- Parameters:
nickname
- The nickname of the certificate to verify.checkSig
- verify the signature of the certificatecertUsage
- see exposed certUsage defines to verify Certificate- Returns:
- true for success; false otherwise
- Throws:
InvalidNicknameException
- If the nickname is nullObjectNotFoundException
- If no certificate could be found with the given nickname.
-
isCertValid
public boolean isCertValid(byte[] certPackage, boolean checkSig, CryptoManager.CertUsage certUsage) throws TokenException, java.security.cert.CertificateEncodingException
Verify a certificate in memory. Check if valid and that we trust the issuer. Verify time against Now.- Parameters:
certPackage
- certificate in memorycheckSig
- verify the signature of the certificatecertUsage
- see exposed certUsage defines to verify Certificate- Returns:
- true for success; false otherwise
- Throws:
TokenException
- unable to insert temporary certificate into database.java.security.cert.CertificateEncodingException
- If the package encoding was not recognized.
-
getOCSPPolicy
public static int getOCSPPolicy()
Gets the current ocsp Policy. Currently we only support 2 modes OCSP_LEAF_AND_CHAIN_POLICY. And OCSP_NORMAL_POLICY, which is current processing , by default. If we have AIA based OCSP enabled we will check all certs in the chain. using PKIX cert verfication calls in the various cert auth callbacks we have.- Returns:
- - The current ocsp policy in effect.
-
getOCSPPolicyEnum
public static CryptoManager.OCSPPolicy getOCSPPolicyEnum()
Gets the current OCSP Policy.- Returns:
- - The current OCSP policy in effect.
- See Also:
getOCSPPolicy()
-
setOCSPPolicy
public static void setOCSPPolicy(CryptoManager.OCSPPolicy policy)
Sets the current ocsp Policy. Currently we only support one mode OCSP_LEAF_AND_CHAIN_POLICY. If we have AIA based OCSP enabled we will check all certs in the chain. using PKIX cert verfication calls in the various cert auth callbacks we have.- Parameters:
policy
- - Either cert and chain or normal default processing.
-
configureOCSP
public void configureOCSP(boolean ocspCheckingEnabled, java.lang.String ocspResponderURL, java.lang.String ocspResponderCertNickname) throws java.security.GeneralSecurityException
Enables OCSP, note when you Initialize JSS for the first time, for backwards compatibility, the initialize will enable OCSP if you previously set values.ocspCheckingEnabled and values.ocspResponderURL/values.ocspResponderCertNickname configureOCSP will allow changing of the the OCSPResponder at runtime.- Parameters:
ocspCheckingEnabled
- true or false to enable/disable OCSPocspResponderURL
- - url of the OCSP responderocspResponderCertNickname
- - the nickname of the OCSP signer certificate or the CA certificate found in the cert DB- Throws:
java.security.GeneralSecurityException
- If a security error has occurred.
-
OCSPCacheSettings
public void OCSPCacheSettings(int ocsp_cache_size, int ocsp_min_cache_entry_duration, int ocsp_max_cache_entry_duration) throws java.security.GeneralSecurityException
change OCSP cache settings- Parameters:
ocsp_cache_size
- max cache entriesocsp_min_cache_entry_duration
- minimum seconds to next fetch attemptocsp_max_cache_entry_duration
- maximum seconds to next fetch attempt- Throws:
java.security.GeneralSecurityException
- If a security error has occurred.
-
setOCSPTimeout
public void setOCSPTimeout(int ocsp_timeout) throws java.security.GeneralSecurityException
set OCSP timeout value- Parameters:
ocsp_timeout
- OCSP timeout in seconds- Throws:
java.security.GeneralSecurityException
- If a security error has occurred.
-
shutdown
public void shutdown() throws java.lang.Exception
Shutdowns this CryptoManager instance and the associated NSS initialization.- Throws:
java.lang.Exception
-
shutdownNative
public void shutdownNative()
-
-