Class CrmfRequest

java.lang.Object
zeroecho.pkix.cmp.CrmfRequest
public final class CrmfRequest extends Object
Immutable structural projection of one canonical CRMF CertReqMsg.

The supported grammar requires a nonnegative request ID of at most 64 bits, a subject and public key in the signed CertRequest, and signing-key proof without poposkInput. Optional version 2 and requested extensions are retained, as is a single standard oldCertID control when present; other controls, registration information and other template fields are rejected. Parsing does not verify the proof or grant issuance authority. Callers must verify signature() over signedRequest() using the exact subjectPublicKeyInfo() and their algorithm policy.

Input is limited to one MiB and 64 nesting levels. Parsing and owned storage are O(N) in encoded length, with a bounded structural stack.

  • Field Details

    • MAXIMUM_ENCODED_BYTES

      public static final int MAXIMUM_ENCODED_BYTES
      Maximum complete CertReqMsg size in bytes.
      See Also:

  • Method Details

    • parse

      public static CrmfRequest parse(byte[] der)
      Parses one bounded canonical DER CertReqMsg with the supported signing proof.
      Parameters:
      der - caller-owned exact CertReqMsg, copied before parsing
      Returns:
      immutable structural projection without a proof-validity assertion
      Throws:
      IllegalArgumentException - if size, DER, or the supported grammar is invalid

    • encoded

      public byte[] encoded()
      Returns the exact request bytes.
      Returns:
      defensive DER snapshot

    • requestId

      public BigInteger requestId()
      Returns the retained CRMF request identity.
      Returns:
      immutable nonnegative request ID

    • subject

      public X500Principal subject()
      Returns the requested subject.
      Returns:
      immutable subject DN

    • subjectPublicKeyInfo

      public byte[] subjectPublicKeyInfo()
      Returns the proof's public key.
      Returns:
      defensive SubjectPublicKeyInfo DER

    • signatureAlgorithm

      public AlgorithmIdentifier signatureAlgorithm()
      Returns the proof algorithm.
      Returns:
      immutable signature algorithm identifier

    • signedRequest

      public byte[] signedRequest()
      Returns the exact signed CertRequest.
      Returns:
      defensive canonical DER snapshot

    • signature

      public byte[] signature()
      Returns the signing-key proof bytes.
      Returns:
      defensive signature snapshot

    • requestedExtensions

      public List<CertificateExtension> requestedExtensions()
      Returns requested extensions without policy approval.
      Returns:
      immutable extension list

    • oldCertificate

      public Optional<CrmfRequest.CertificateReference> oldCertificate()
      Returns the signed standard predecessor reference, if supplied.
      Returns:
      immutable structural reference without ownership or validity assertion

    • toString

      public String toString()
      Returns a diagnostic representation without request data.
      Overrides:
      toString in class Object