Interface CertificateBuilder

public interface CertificateBuilder
A fluent builder for an unsigned X.509 v3 certificate body or a signed standard X509Certificate.

The builder collects the certificate fields and extensions, then produces the final certificate by streaming the tbsCertificate through a caller supplied ContentSigner — so the private key never enters the builder. Typed setters are provided for the common extensions; arbitrary extensions can be added with addExtension(CertificateExtension). For deferred signing, buildTbs(AlgorithmIdentifier) returns the exact canonical unsigned body without a signer invocation.

Instances are single-use and not thread-safe.

  • Method Details

    • serialNumber

      CertificateBuilder serialNumber(BigInteger serialNumber)
      Sets the certificate serial number (required, positive).
      Parameters:
      serialNumber - the serial number
      Returns:
      this builder

    • subject

      CertificateBuilder subject(X500Principal subject)
      Sets the subject distinguished name (required).
      Parameters:
      subject - the subject DN
      Returns:
      this builder

    • issuer

      CertificateBuilder issuer(X500Principal issuer)
      Sets the issuer distinguished name (required).
      Parameters:
      issuer - the issuer DN
      Returns:
      this builder

    • validity

      CertificateBuilder validity(Instant notBefore, Instant notAfter)
      Sets the validity window (required).
      Parameters:
      notBefore - inclusive start of validity
      notAfter - inclusive end of validity
      Returns:
      this builder

    • publicKey

      CertificateBuilder publicKey(PublicKey subjectPublicKey)
      Sets the subject public key (required, unless publicKeyInfo(byte[]) is used).
      Parameters:
      subjectPublicKey - the subject public key
      Returns:
      this builder

    • publicKeyInfo

      CertificateBuilder publicKeyInfo(byte[] subjectPublicKeyInfoDer)
      Sets the subject public key from the exact DER of a SubjectPublicKeyInfo, preserving the original encoding byte-for-byte (required, unless publicKey(PublicKey) is used).
      Parameters:
      subjectPublicKeyInfoDer - the exact SPKI DER
      Returns:
      this builder

    • basicConstraints

      CertificateBuilder basicConstraints(BasicConstraints basicConstraints, boolean critical)
      Adds a BasicConstraints extension.
      Parameters:
      basicConstraints - the basic-constraints value
      critical - whether the extension is critical
      Returns:
      this builder

    • keyUsage

      CertificateBuilder keyUsage(Set<KeyUsage> keyUsage, boolean critical)
      Adds a KeyUsage extension.
      Parameters:
      keyUsage - the set of key-usage bits
      critical - whether the extension is critical
      Returns:
      this builder

    • extendedKeyUsage

      CertificateBuilder extendedKeyUsage(ExtendedKeyUsage extendedKeyUsage, boolean critical)
      Adds an ExtendedKeyUsage extension.
      Parameters:
      extendedKeyUsage - the extended key usage value
      critical - whether the extension is critical
      Returns:
      this builder

    • subjectAlternativeNames

      CertificateBuilder subjectAlternativeNames(List<GeneralName> names, boolean critical)
      Adds a SubjectAlternativeName extension.
      Parameters:
      names - the general names
      critical - whether the extension is critical
      Returns:
      this builder

    • subjectKeyIdentifier

      CertificateBuilder subjectKeyIdentifier()
      Adds a SubjectKeyIdentifier derived from the subject public key.
      Returns:
      this builder

    • authorityKeyIdentifier

      CertificateBuilder authorityKeyIdentifier(byte[] keyIdentifier)
      Adds an AuthorityKeyIdentifier carrying the given key identifier.
      Parameters:
      keyIdentifier - the issuer subject-key-identifier bytes
      Returns:
      this builder

    • addExtension

      CertificateBuilder addExtension(CertificateExtension extension)
      Adds an arbitrary extension.
      Parameters:
      extension - the extension to add
      Returns:
      this builder

    • buildTbs

      byte[] buildTbs(AlgorithmIdentifier signatureAlgorithm)
      Encodes the configured unsigned X.509 v3 TBSCertificate as canonical DER. The supplied identifier is embedded exactly as the certificate signature algorithm. This method performs no signing and invokes no content signer.

      Required fields and extensions are the same as for build(ContentSigner). Local time and auxiliary memory are linear in the resulting TBS byte size.

      Parameters:
      signatureAlgorithm - exact signature algorithm and parameter representation
      Returns:
      newly allocated canonical DER of the unsigned certificate body
      Throws:
      NullPointerException - if the algorithm or a required field is missing
      IllegalArgumentException - if fields or extensions cannot form a certificate body
      IllegalStateException - if DER encoding fails

    • buildAlternativeSignatureTbs

      default byte[] buildAlternativeSignatureTbs()
      Encodes the standardized alternative-signature input, omitting both the TBSCertificate.signature field and the AltSignatureValue extension. Other configured fields and extension order are preserved. The alternative algorithm and subject alternative public key extensions must be supplied by the caller. No signer is invoked. Time and auxiliary memory are linear in the encoded body size.
      Returns:
      newly allocated canonical DER pre-TBS sequence
      Throws:
      UnsupportedOperationException - if this provider lacks this capability
      IllegalArgumentException - if configured fields or extensions are invalid
      NullPointerException - if a required field is missing
      IllegalStateException - if encoding fails

    • build

      X509Certificate build(ContentSigner signer)
      Signs the assembled tbsCertificate with the given signer and returns the resulting certificate.
      Parameters:
      signer - the content signer supplying the signature and algorithm
      Returns:
      the signed certificate