Class CertificateRepository

  • All Implemented Interfaces:
    IRepository

    public class CertificateRepository
    extends Repository
    A classrepresents a certificate repository. It stores all the issued certificate.
    Version:
    $Revision$, $Date$
    Author:
    thomask, kanda
    • Field Detail

      • logger

        public static org.slf4j.Logger logger
      • PROP_CERT_BASE_DN

        public static final java.lang.String PROP_CERT_BASE_DN
        See Also:
        Constant Field Values
      • PROP_TRANS_MAXRECORDS

        public static final java.lang.String PROP_TRANS_MAXRECORDS
        See Also:
        Constant Field Values
      • PROP_TRANS_PAGESIZE

        public static final java.lang.String PROP_TRANS_PAGESIZE
        See Also:
        Constant Field Values
      • certStatusUpdateTask

        public com.netscape.cmscore.dbs.CertStatusUpdateTask certStatusUpdateTask
      • retrieveModificationsTask

        public com.netscape.cmscore.dbs.RetrieveModificationsTask retrieveModificationsTask
      • serialNumberUpdateTask

        public com.netscape.cmscore.dbs.SerialNumberUpdateTask serialNumberUpdateTask
    • Constructor Detail

      • CertificateRepository

        public CertificateRepository​(DBSubsystem dbSubsystem,
                                     java.lang.String certRepoBaseDN,
                                     int increment,
                                     java.lang.String baseDN)
                              throws EDBException
        Constructs a certificate repository.
        Throws:
        EDBException
    • Method Detail

      • createCertRecord

        public ICertRecord createCertRecord​(java.math.BigInteger id,
                                            java.security.cert.Certificate cert,
                                            MetaInfo meta)
        Creates certificate record.
        Parameters:
        id - serial number
        cert - certificate
        meta - meta information
        Returns:
        certificate record
      • getEnableRandomSerialNumbers

        public boolean getEnableRandomSerialNumbers()
        Retrieves serial number management mode.
        Returns:
        serial number management mode, "true" indicates random serial number management, "false" indicates sequential serial number management.
      • setEnableRandomSerialNumbers

        public void setEnableRandomSerialNumbers​(boolean random,
                                                 boolean updateMode,
                                                 boolean forceModeChange)
        Sets serial number management mode for certificates..
        Parameters:
        random - "true" sets random serial number management, "false" sequential
        updateMode - "true" updates "description" attribute in certificate repository
        forceModeChange - "true" forces certificate repository mode change
      • updateCounter

        public void updateCounter()
      • removeCertRecords

        public void removeCertRecords​(java.math.BigInteger beginS,
                                      java.math.BigInteger endS)
                               throws EBaseException
        Removes certificate records with this repository.
        Parameters:
        beginS - BigInteger with radix 16
        endS - BigInteger with radix 16
        Throws:
        EBaseException
      • setConsistencyCheck

        public void setConsistencyCheck​(boolean ConsistencyCheck)
      • setSkipIfInConsistent

        public void setSkipIfInConsistent​(boolean SkipIfInconsistent)
      • setTransitMaxRecords

        public void setTransitMaxRecords​(int max)
      • setTransitRecordPageSize

        public void setTransitRecordPageSize​(int size)
      • addCRLIssuingPoint

        public void addCRLIssuingPoint​(java.lang.String id,
                                       ICRLIssuingPoint crlIssuingPoint)
        register CRL Issuing Point
      • setCertStatusUpdateInterval

        public void setCertStatusUpdateInterval​(IRepository requestRepository,
                                                int interval,
                                                boolean listenToCloneModifications)
        Sets certificate status update internal. interval value: (in seconds) 0 - disable >0 - enable
        Parameters:
        requestRepo - request repository
        interval - update interval
        listenToCloneModifications - enable listening to clone modifications
      • setSerialNumberUpdateInterval

        public void setSerialNumberUpdateInterval​(IRepository requestRepository,
                                                  int interval)
        interval value: (in seconds) 0 - disable >0 - enable
      • updateCertStatus

        public void updateCertStatus()
                              throws EBaseException
        Updates certificate status now. This is a blocking method.
        Throws:
        EBaseException - failed to update
      • getDN

        public java.lang.String getDN()
        Retrieves DN of this repository.
      • setRequestDN

        public void setRequestDN​(java.lang.String requestDN)
      • getRequestDN

        public java.lang.String getRequestDN()
      • getDBSubsystem

        public DBSubsystem getDBSubsystem()
        Retrieves backend database handle.
      • addCertificateRecord

        public void addCertificateRecord​(ICertRecord record)
                                  throws EBaseException
        Adds a certificate record to the repository. Each certificate record contains four parts: certificate, meta-attributes, issue information and revocation information.
        Parameters:
        cert - X.509 certificate
        Throws:
        EBaseException - failed to add new certificate to the repository
      • addRevokedCertRecord

        public void addRevokedCertRecord​(CertRecord record)
                                  throws EBaseException
        Used by the Clone Master (CLA) to add a revoked certificate record to the repository.

        Parameters:
        record - a CertRecord
        Throws:
        EBaseException - failed to add new certificate to the repository
      • transitValidCertificates

        public void transitValidCertificates()
                                      throws EBaseException
        This transits a certificate status from VALID to EXPIRED if a certificate becomes expired.
        Throws:
        EBaseException
      • transitRevokedExpiredCertificates

        public void transitRevokedExpiredCertificates()
                                               throws EBaseException
        This transits a certificate status from REVOKED to REVOKED_EXPIRED if an revoked certificate becomes expired.
        Throws:
        EBaseException
      • transitInvalidCertificates

        public void transitInvalidCertificates()
                                        throws EBaseException
        This transits a certificate status from INVALID to VALID if a certificate becomes valid.
        Throws:
        EBaseException
      • getX509Certificate

        public org.mozilla.jss.netscape.security.x509.X509CertImpl getX509Certificate​(java.math.BigInteger serialNo)
                                                                               throws EBaseException
        Reads the certificate identified by the given serial no.
        Parameters:
        serialNo - serial number of certificate
        Returns:
        certificate
        Throws:
        EBaseException - failed to retrieve certificate
      • deleteCertificateRecord

        public void deleteCertificateRecord​(java.math.BigInteger serialNo)
                                     throws EBaseException
        Deletes certificate from this repository.
        Parameters:
        serialNo - serial number of certificate
        Throws:
        EBaseException - failed to delete
      • readCertificateRecord

        public ICertRecord readCertificateRecord​(java.math.BigInteger serialNo)
                                          throws EBaseException
        Reads certificate from repository.
        Parameters:
        serialNo - serial number of certificate
        Returns:
        certificate record
        Throws:
        EBaseException - failed to retrieve certificate
      • checkCertificateRecord

        public boolean checkCertificateRecord​(java.math.BigInteger serialNo)
                                       throws EBaseException
        Throws:
        EBaseException
      • modifyCertificateRecord

        public void modifyCertificateRecord​(java.math.BigInteger serialNo,
                                            ModificationSet mods)
                                     throws EBaseException
        Modifies certificate record.
        Parameters:
        serialNo - serial number of record
        mods - modifications
        Throws:
        EBaseException - failed to modify
      • containsCertificate

        public boolean containsCertificate​(java.math.BigInteger serialNo)
                                    throws EBaseException
        Checks if the certificate exists in this repository.
        Parameters:
        serialNo - serial number of certificate
        Returns:
        true if it exists
        Throws:
        EBaseException - failed to check
      • markAsRevoked

        public void markAsRevoked​(java.math.BigInteger id,
                                  IRevocationInfo info)
                           throws EBaseException
        Marks certificate as revoked. isAlreadyRevoked - boolean to indicate that the cert was revoked ( possibly onHold ) When a cert was originally revoked (possibly onHold), some of the ldap attributes already exist, so "MOD_REPLACE" is needed instead of "MOD_ADD"
        Parameters:
        id - serial number
        info - revocation information
        Throws:
        EBaseException - failed to mark
      • markAsRevoked

        public void markAsRevoked​(java.math.BigInteger id,
                                  IRevocationInfo info,
                                  boolean isAlreadyRevoked)
                           throws EBaseException
        Marks certificate as revoked.
        Parameters:
        id - serial number
        info - revocation information
        isAlreadyOnHold - boolean to indicate if the cert was revoked onHold
        Throws:
        EBaseException - failed to mark
      • unmarkRevoked

        public void unmarkRevoked​(java.math.BigInteger id,
                                  IRevocationInfo info,
                                  java.util.Date revokedOn,
                                  java.lang.String revokedBy)
                           throws EBaseException
        Unmark a revoked certificates.
        Parameters:
        id - serial number
        info - revocation information
        revokedOn - revocation date
        revokedBy - userid
        Throws:
        EBaseException - failed to unmark
      • updateStatus

        public void updateStatus​(java.math.BigInteger id,
                                 java.lang.String status)
                          throws EBaseException
        Updates certificate status.
        Parameters:
        id - serial number
        status - certificate status
        Throws:
        EBaseException - failed to update status
      • searchCertificates

        public java.util.Enumeration<java.lang.Object> searchCertificates​(java.lang.String filter,
                                                                          int maxSize,
                                                                          java.lang.String sortAttribute)
                                                                   throws EBaseException
        Finds a list of certificate records that satisifies the filter.
        Parameters:
        filter - search filter
        maxSize - max size to return
        sortAttribute - Attribute of ICertRecord to sort the results
        Returns:
        a list of certificates
        Throws:
        EBaseException - failed to search
      • searchCertificates

        public java.util.Enumeration<java.lang.Object> searchCertificates​(java.lang.String filter,
                                                                          int maxSize)
                                                                   throws EBaseException
        Finds a list of certificate records that satisifies the filter. Here is a list of filter attribute can be used:
           certRecordId
           certMetaInfo
           certStatus
           certCreateTime
           certModifyTime
           x509Cert.notBefore
           x509Cert.notAfter
           x509Cert.subject
         
        The filter should follow RFC1558 LDAP filter syntax. For example,
           (&(certRecordId=5)(x509Cert.notBefore=934398398))
         
        Parameters:
        filter - search filter
        maxSize - max size to return
        Returns:
        a list of certificates
        Throws:
        EBaseException - failed to search
      • searchCertificates

        public java.util.Enumeration<ICertRecord> searchCertificates​(java.lang.String filter,
                                                                     int maxSize,
                                                                     int timeLimit)
                                                              throws EBaseException
        Finds a list of certificate records that satisifies the filter.
        Parameters:
        filter - search filter
        maxSize - max size to return
        timeLimit - timeout value
        Returns:
        a list of certificates
        Throws:
        EBaseException - failed to search
      • searchCertificates

        public java.util.Enumeration<ICertRecord> searchCertificates​(java.lang.String filter,
                                                                     int maxSize,
                                                                     int timeLimit,
                                                                     java.lang.String sortAttribute)
                                                              throws EBaseException
        Finds a list of certificate records that satisifies the filter.
        Parameters:
        filter - search filter
        maxSize - max size to return
        timeLimit - timeout value
        sortAttribute - Attribute of ICertRecord to sort the results
        Returns:
        a list of certificates
        Throws:
        EBaseException - failed to search
      • findCertRecs

        public java.util.Enumeration<java.lang.Object> findCertRecs​(java.lang.String filter)
                                                             throws EBaseException
        Deprecated.
        replaced by findCertificatesInList
        Finds certificate records.
        Parameters:
        filter - search filter
        Returns:
        a list of certificate records
        Throws:
        EBaseException - failed to retrieve cert records
      • findCertRecs

        public java.util.Enumeration<java.lang.Object> findCertRecs​(java.lang.String filter,
                                                                    java.lang.String[] attrs)
                                                             throws EBaseException
        Throws:
        EBaseException
      • findCertificates

        public java.util.Enumeration<org.mozilla.jss.netscape.security.x509.X509CertImpl> findCertificates​(java.lang.String filter)
                                                                                                    throws EBaseException
        Finds all certificates given a filter.
        Parameters:
        filter - search filter
        Returns:
        a list of certificates
        Throws:
        EBaseException - failed to search
      • findCertRecords

        public java.util.Enumeration<ICertRecord> findCertRecords​(java.lang.String filter)
                                                           throws EBaseException
        Finds a list of certificate records that satisifies the filter. If you are going to process everything in the list, use this.
        Parameters:
        filter - search filter
        Returns:
        a list of certificates
        Throws:
        EBaseException - failed to search
      • findCertRecordsInList

        public ICertRecordList findCertRecordsInList​(java.lang.String filter,
                                                     java.lang.String[] attrs,
                                                     int pageSize)
                                              throws EBaseException
        Finds certificate records. Here is a list of filter attribute can be used:
           certRecordId
           certMetaInfo
           certStatus
           certCreateTime
           certModifyTime
           x509Cert.notBefore
           x509Cert.notAfter
           x509Cert.subject
         
        The filter should follow RFC1558 LDAP filter syntax. For example,
           (&(certRecordId=5)(x509Cert.notBefore=934398398))
         
        Parameters:
        filter - search filter
        attrs - selected attribute
        pageSize - page size
        Returns:
        a list of certificates
        Throws:
        EBaseException - failed to search
      • findCertRecordsInList

        public ICertRecordList findCertRecordsInList​(java.lang.String filter,
                                                     java.lang.String[] attrs,
                                                     java.lang.String sortKey,
                                                     int pageSize)
                                              throws EBaseException
        Finds a list of certificate records that satisifies the filter.
        Parameters:
        filter - search filter
        attrs - selected attribute
        sortKey - key to use for sorting the returned elements
        pageSize - page size
        Returns:
        a list of certificates
        Throws:
        EBaseException - failed to search
      • findCertRecordsInList

        public ICertRecordList findCertRecordsInList​(java.lang.String filter,
                                                     java.lang.String[] attrs,
                                                     java.lang.String jumpTo,
                                                     java.lang.String sortKey,
                                                     int pageSize)
                                              throws EBaseException
        Finds a list of certificate records that satisifies the filter.
        Parameters:
        filter - search filter
        attrs - selected attribute
        jumpTo - jump to index
        sortKey - key to use for sorting the returned elements
        pageSize - page size
        Returns:
        a list of certificates
        Throws:
        EBaseException - failed to search
      • findCertRecordsInList

        public ICertRecordList findCertRecordsInList​(java.lang.String filter,
                                                     java.lang.String[] attrs,
                                                     java.lang.String jumpTo,
                                                     boolean hardJumpTo,
                                                     java.lang.String sortKey,
                                                     int pageSize)
                                              throws EBaseException
        Finds a list of certificate records that satisifies the filter.
        Parameters:
        filter - search filter
        attrs - selected attribute
        jumpTo - jump to index
        hardJumpTo -
        sortKey - key to use for sorting the returned elements
        pageSize - page size
        Returns:
        a list of certificates
        Throws:
        EBaseException - failed to search
      • findCertRecordsInListRawJumpto

        public ICertRecordList findCertRecordsInListRawJumpto​(java.lang.String filter,
                                                              java.lang.String[] attrs,
                                                              java.lang.String jumpTo,
                                                              java.lang.String sortKey,
                                                              int pageSize)
                                                       throws EBaseException
        Finds a list of certificate records that satisifies the filter.
        Parameters:
        filter - search filter
        attrs - selected attribute
        jumpTo - jump to index
        sortKey - key to use for sorting the returned elements
        pageSize - page size
        Returns:
        a list of certificates
        Throws:
        EBaseException - failed to search
      • markCertificateAsRenewable

        public void markCertificateAsRenewable​(ICertRecord record)
                                        throws EBaseException
        Marks certificate as renewable.
        Parameters:
        record - certificate record to modify
        Throws:
        EBaseException - failed to update
      • markCertificateAsNotRenewable

        public void markCertificateAsNotRenewable​(ICertRecord record)
                                           throws EBaseException
        Marks certificate as not renewable.
        Parameters:
        record - certificate record to modify
        Throws:
        EBaseException - failed to update
      • markCertificateAsRenewed

        public void markCertificateAsRenewed​(java.lang.String serialNo)
                                      throws EBaseException
        Marks certificate as renewed.
        Parameters:
        serialNo - certificate record to modify
        Throws:
        EBaseException - failed to update
      • markCertificateAsRenewalNotified

        public void markCertificateAsRenewalNotified​(java.lang.String serialNo)
                                              throws EBaseException
        Marks certificate as renewed and notified.
        Parameters:
        serialNo - certificate record to modify
        Throws:
        EBaseException - failed to update
      • getRenewableCertificates

        public java.util.Hashtable<java.lang.String,​RenewableCertificateCollection> getRenewableCertificates​(java.lang.String renewalTime)
                                                                                                            throws EBaseException
        Retrieves renewable certificates.
        Parameters:
        renewalTime - renewal time
        Returns:
        certificates
        Throws:
        EBaseException - failed to retrieve
      • getX509Certificates

        public org.mozilla.jss.netscape.security.x509.X509CertImpl[] getX509Certificates​(java.lang.String subjectDN,
                                                                                         int validityType)
                                                                                  throws EBaseException
        Gets all valid and unexpired certificates pertaining to a subject DN.
        Parameters:
        subjectDN - The distinguished name of the subject.
        validityType - The type of certificates to get.
        Returns:
        An array of certificates.
        Throws:
        EBaseException - on error.
      • getX509Certificates

        public org.mozilla.jss.netscape.security.x509.X509CertImpl[] getX509Certificates​(java.lang.String filter)
                                                                                  throws EBaseException
        Throws:
        EBaseException
      • getValidCertificates

        public java.util.Enumeration<ICertRecord> getValidCertificates​(java.lang.String from,
                                                                       java.lang.String to)
                                                                throws EBaseException
        Retrieves valid certificates.
        Parameters:
        from - starting serial number
        to - ending serial number
        Returns:
        a list of certificates
        Throws:
        EBaseException - failed to retrieve
      • getAllValidCertificates

        public java.util.Enumeration<ICertRecord> getAllValidCertificates()
                                                                   throws EBaseException
        Retrives all valid certificates excluding ones already revoked.
        Throws:
        EBaseException
      • getValidNotPublishedCertificates

        public java.util.Enumeration<ICertRecord> getValidNotPublishedCertificates​(java.lang.String from,
                                                                                   java.lang.String to)
                                                                            throws EBaseException
        Retrieves valid and not published certificates.
        Parameters:
        from - starting serial number
        to - ending serial number
        Returns:
        a list of certificates
        Throws:
        EBaseException - failed to retrieve
      • getAllValidNotPublishedCertificates

        public java.util.Enumeration<ICertRecord> getAllValidNotPublishedCertificates()
                                                                               throws EBaseException
        Retrives all valid not published certificates excluding ones already revoked.
        Throws:
        EBaseException
      • getExpiredCertificates

        public java.util.Enumeration<ICertRecord> getExpiredCertificates​(java.lang.String from,
                                                                         java.lang.String to)
                                                                  throws EBaseException
        Retrieves expired certificates.
        Parameters:
        from - starting serial number
        to - ending serial number
        Returns:
        a list of certificates
        Throws:
        EBaseException - failed to retrieve
      • getExpiredPublishedCertificates

        public java.util.Enumeration<ICertRecord> getExpiredPublishedCertificates​(java.lang.String from,
                                                                                  java.lang.String to)
                                                                           throws EBaseException
        Retrieves expired and published certificates.
        Parameters:
        from - starting serial number
        to - ending serial number
        Returns:
        a list of certificates
        Throws:
        EBaseException - failed to retrieve
      • getAllExpiredPublishedCertificates

        public java.util.Enumeration<ICertRecord> getAllExpiredPublishedCertificates()
                                                                              throws EBaseException
        Retrives all expired publishedcertificates.
        Throws:
        EBaseException
      • getInvalidCertsByNotBeforeDate

        public ICertRecordList getInvalidCertsByNotBeforeDate​(java.util.Date date,
                                                              int pageSize)
                                                       throws EBaseException
        Gets Invalid certs orderes by noAfter date, jumps to records where notAfter date is greater than current.
        Parameters:
        date - reference date
        pageSize - page size
        Returns:
        a list of certificate records
        Throws:
        EBaseException - failed to retrieve
      • getValidCertsByNotAfterDate

        public ICertRecordList getValidCertsByNotAfterDate​(java.util.Date date,
                                                           int pageSize)
                                                    throws EBaseException
        Gets valid certs orderes by noAfter date, jumps to records where notAfter date is greater than current.
        Parameters:
        date - reference date
        pageSize - page size
        Returns:
        a list of certificate records
        Throws:
        EBaseException - failed to retrieve
      • getRevokedCertsByNotAfterDate

        public ICertRecordList getRevokedCertsByNotAfterDate​(java.util.Date date,
                                                             int pageSize)
                                                      throws EBaseException
        Gets Revoked certs orderes by noAfter date, jumps to records where notAfter date is greater than current.
        Parameters:
        date - reference date
        pageSize - page size
        Returns:
        a list of certificate records
        Throws:
        EBaseException - failed to retrieve
      • getRevokedCertificates

        public java.util.Enumeration<ICertRecord> getRevokedCertificates​(java.lang.String from,
                                                                         java.lang.String to)
                                                                  throws EBaseException
        Retrieves revoked certificates.
        Parameters:
        from - starting serial number
        to - ending serial number
        Returns:
        a list of certificates
        Throws:
        EBaseException - failed to retrieve
      • getAllRevokedCertificates

        public java.util.Enumeration<ICertRecord> getAllRevokedCertificates()
                                                                     throws EBaseException
        Retrieves all revoked certificates including ones that have expired or that are not yet valid.
        Returns:
        a list of revoked certificates
        Throws:
        EBaseException - failed to search
      • getRevokedPublishedCertificates

        public java.util.Enumeration<ICertRecord> getRevokedPublishedCertificates​(java.lang.String from,
                                                                                  java.lang.String to)
                                                                           throws EBaseException
        Retrieves revoked and published certificates.
        Parameters:
        from - starting serial number
        to - ending serial number
        Returns:
        a list of certificates
        Throws:
        EBaseException - failed to retrieve
      • getAllRevokedPublishedCertificates

        public java.util.Enumeration<ICertRecord> getAllRevokedPublishedCertificates()
                                                                              throws EBaseException
        Retrives all revoked published certificates including ones already expired or not yet valid.
        Throws:
        EBaseException
      • getRevokedCertificates

        public java.util.Enumeration<ICertRecord> getRevokedCertificates​(java.util.Date asOfDate)
                                                                  throws EBaseException
        Retrieves all revoked certificates that have not expired.
        Parameters:
        asOfDate - as of date
        Returns:
        a list of revoked certificates
        Throws:
        EBaseException - failed to retrieve
      • getAllRevokedNonExpiredCertificates

        public java.util.Enumeration<ICertRecord> getAllRevokedNonExpiredCertificates()
                                                                               throws EBaseException
        Retrieves all revoked but not expired certificates.
        Returns:
        a list of revoked certificates
        Throws:
        EBaseException - failed to search
      • getModifications

        public void getModifications​(netscape.ldap.LDAPEntry entry)
        Retrieves modified certificate records.
        Parameters:
        entry - LDAPEntry with modified data
      • isCertificateRevoked

        public RevocationInfo isCertificateRevoked​(org.mozilla.jss.netscape.security.x509.X509CertImpl cert)
                                            throws EBaseException
        Checks if the presented certificate belongs to the repository and is revoked.
        Parameters:
        cert - certificate to verify.
        Returns:
        RevocationInfo if the presented certificate is revoked otherwise null.
        Throws:
        EBaseException
      • shutdown

        public void shutdown()