001/*
002 * Copyright 2017-2024 Ping Identity Corporation
003 * All Rights Reserved.
004 */
005/*
006 * Copyright 2017-2024 Ping Identity Corporation
007 *
008 * Licensed under the Apache License, Version 2.0 (the "License");
009 * you may not use this file except in compliance with the License.
010 * You may obtain a copy of the License at
011 *
012 *    http://www.apache.org/licenses/LICENSE-2.0
013 *
014 * Unless required by applicable law or agreed to in writing, software
015 * distributed under the License is distributed on an "AS IS" BASIS,
016 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
017 * See the License for the specific language governing permissions and
018 * limitations under the License.
019 */
020/*
021 * Copyright (C) 2017-2024 Ping Identity Corporation
022 *
023 * This program is free software; you can redistribute it and/or modify
024 * it under the terms of the GNU General Public License (GPLv2 only)
025 * or the terms of the GNU Lesser General Public License (LGPLv2.1 only)
026 * as published by the Free Software Foundation.
027 *
028 * This program is distributed in the hope that it will be useful,
029 * but WITHOUT ANY WARRANTY; without even the implied warranty of
030 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
031 * GNU General Public License for more details.
032 *
033 * You should have received a copy of the GNU General Public License
034 * along with this program; if not, see <http://www.gnu.org/licenses>.
035 */
036package com.unboundid.util.ssl.cert;
037
038
039
040import com.unboundid.asn1.ASN1OctetString;
041import com.unboundid.util.Debug;
042import com.unboundid.util.NotMutable;
043import com.unboundid.util.NotNull;
044import com.unboundid.util.OID;
045import com.unboundid.util.StaticUtils;
046import com.unboundid.util.ThreadSafety;
047import com.unboundid.util.ThreadSafetyLevel;
048
049import static com.unboundid.util.ssl.cert.CertMessages.*;
050
051
052
053/**
054 * This class provides an implementation of the subject key identifier X.509
055 * certificate extension as described in
056 * <A HREF="https://www.ietf.org/rfc/rfc5280.txt">RFC 5280</A> section 4.2.1.2.
057 * The OID for this extension is 2.5.29.14.  The value is an octet string and is
058 * intended to identify the public key used by a certificate.  The actual format
059 * of the key identifier is not specified, although RFC 5280 does specify a
060 * couple of possibilities.
061 */
062@NotMutable()
063@ThreadSafety(level=ThreadSafetyLevel.COMPLETELY_THREADSAFE)
064public final class SubjectKeyIdentifierExtension
065       extends X509CertificateExtension
066{
067  /**
068   * The OID (2.5.29.14) for subject key identifier extensions.
069   */
070  @NotNull public static final OID SUBJECT_KEY_IDENTIFIER_OID =
071       new OID("2.5.29.14");
072
073
074
075  /**
076   * The name of the message digest algorithm that will be used to generate a
077   * certificate's subject key identifier from its public key.  Note that we're
078   * using SHA-1 rather than something better (like SHA-256) because it appears
079   * that the Microsoft CA cannot handle a 256-bit identifier but will accept a
080   * 160-bit identifier.
081   */
082  @NotNull static final String SUBJECT_KEY_IDENTIFIER_DIGEST_ALGORITHM =
083       "SHA-1";
084
085
086
087  /**
088   * The serial version UID for this serializable class.
089   */
090  private static final long serialVersionUID = -7175921866230880172L;
091
092
093
094  // The key identifier for this extension.
095  @NotNull private final ASN1OctetString keyIdentifier;
096
097
098
099  /**
100   * Creates a new subject key identifier extension with the provided
101   * information.
102   *
103   * @param  isCritical     Indicates whether this extension should be
104   *                        considered critical.
105   * @param  keyIdentifier  The key identifier for this extension.  It must not
106   *                        be {@code null}.
107   */
108  SubjectKeyIdentifierExtension(final boolean isCritical,
109                                @NotNull final ASN1OctetString keyIdentifier)
110  {
111    super(SUBJECT_KEY_IDENTIFIER_OID, isCritical,
112         keyIdentifier.encode());
113
114    this.keyIdentifier = keyIdentifier;
115  }
116
117
118
119  /**
120   * Creates a new subject key identifier extension from the provided generic
121   * extension.
122   *
123   * @param  extension  The extension to decode as a subject key identifier
124   *                    extension.
125   *
126   * @throws  CertException  If the provided extension cannot be decoded as a
127   *                         subject alternative name extension.
128   */
129  SubjectKeyIdentifierExtension(
130       @NotNull final X509CertificateExtension extension)
131       throws CertException
132  {
133    super(extension);
134
135    try
136    {
137      keyIdentifier = ASN1OctetString.decodeAsOctetString(extension.getValue());
138    }
139    catch (final Exception e)
140    {
141      Debug.debugException(e);
142      throw new CertException(
143           ERR_SUBJECT_KEY_ID_EXTENSION_CANNOT_PARSE.get(
144                String.valueOf(extension), StaticUtils.getExceptionMessage(e)),
145           e);
146    }
147  }
148
149
150
151  /**
152   * Retrieves the key identifier for this extension.
153   *
154   * @return  The key identifier for this extension.
155   */
156  @NotNull()
157  public ASN1OctetString getKeyIdentifier()
158  {
159    return keyIdentifier;
160  }
161
162
163
164  /**
165   * {@inheritDoc}
166   */
167  @Override()
168  @NotNull()
169  public String getExtensionName()
170  {
171    return INFO_SUBJECT_KEY_IDENTIFIER_EXTENSION_NAME.get();
172  }
173
174
175
176  /**
177   * {@inheritDoc}
178   */
179  @Override()
180  public void toString(@NotNull final StringBuilder buffer)
181  {
182    buffer.append("SubjectKeyIdentifierExtension(oid='");
183    buffer.append(getOID());
184    buffer.append(", isCritical=");
185    buffer.append(isCritical());
186    buffer.append(", identifierBytes='");
187    StaticUtils.toHex(keyIdentifier.getValue(), ":", buffer);
188    buffer.append("')");
189  }
190}