Interface CrlBuilder

public interface CrlBuilder
A fluent builder for a signed X.509 CRL that yields a standard X509CRL.

Entries may be added individually or streamed from an Iterator so that very large revocation sets are encoded without materializing them in memory. The tbsCertList is signed by a caller supplied ContentSigner.

Instances are single-use and not thread-safe.

  • Method Details

    • issuer

      CrlBuilder issuer(X500Principal issuer)
      Sets the CRL issuer distinguished name (required).
      Parameters:
      issuer - the issuer DN
      Returns:
      this builder

    • thisUpdate

      CrlBuilder thisUpdate(Instant thisUpdate)
      Sets thisUpdate (required).
      Parameters:
      thisUpdate - the time of this CRL
      Returns:
      this builder

    • nextUpdate

      CrlBuilder nextUpdate(Instant nextUpdate)
      Sets nextUpdate (optional but recommended).
      Parameters:
      nextUpdate - the time of the next scheduled CRL
      Returns:
      this builder

    • crlNumber

      CrlBuilder crlNumber(BigInteger crlNumber)
      Adds the CRLNumber extension.
      Parameters:
      crlNumber - the monotonically increasing CRL number
      Returns:
      this builder

    • authorityKeyIdentifier

      CrlBuilder authorityKeyIdentifier(byte[] keyIdentifier)
      Adds the AuthorityKeyIdentifier extension.
      Parameters:
      keyIdentifier - the issuer subject-key-identifier bytes
      Returns:
      this builder

    • deltaCrlIndicator

      CrlBuilder deltaCrlIndicator(BigInteger baseCrlNumber)
      Marks this as a delta CRL by adding the DeltaCRLIndicator extension.
      Parameters:
      baseCrlNumber - the base CRL number this delta is relative to
      Returns:
      this builder

    • addEntry

      CrlBuilder addEntry(CrlEntry entry)
      Adds one revoked-certificate entry.
      Parameters:
      entry - the entry to add
      Returns:
      this builder

    • addEntries

      CrlBuilder addEntries(Iterator<CrlEntry> entries)
      Adds all entries produced by the given iterator, in order.
      Parameters:
      entries - a (possibly large) stream of entries
      Returns:
      this builder

    • addExtension

      CrlBuilder addExtension(CertificateExtension extension)
      Adds an arbitrary CRL extension.
      Parameters:
      extension - the extension to add
      Returns:
      this builder

    • build

      X509CRL build(ContentSigner signer)
      Signs the assembled tbsCertList with the given signer and returns the resulting CRL.
      Parameters:
      signer - the content signer supplying the signature and algorithm
      Returns:
      the signed CRL