Interface ContentSigner

public interface ContentSigner

A streaming producer of a signature over to-be-signed content, used by the ZeroEcho PKIX builders to sign certificates, CRLs, CSRs, and OCSP responses.

The contract is deliberately minimal and toolkit-independent: a signer declares the signature AlgorithmIdentifier that will appear in the produced object, exposes an OutputStream into which the builder writes the exact to-be-signed DER, and yields the raw signature bytes on completion. This lets a caller keep the private key wherever it lives — in a local KeyStore, an HSM, or a remote signing service — without exposing key material to the builder.

Lifecycle

An instance is single-use: the builder writes the content, closes the stream if appropriate, then calls signature() exactly once. Implementations need not be thread-safe.

Method Summary

Modifier and Type	Method	Description
AlgorithmIdentifier	algorithm()	Returns the signature algorithm identifier that will be recorded in the signed object's signatureAlgorithm field.
OutputStream	contentStream()	Returns the stream into which the to-be-signed bytes are written.
byte[]	signature()	Finalizes and returns the raw signature over the bytes written to contentStream().

Method Details

algorithm

AlgorithmIdentifier algorithm()

Returns the signature algorithm identifier that will be recorded in the signed object's signatureAlgorithm field.

Returns:

the signature algorithm identifier

contentStream

OutputStream contentStream()

Returns the stream into which the to-be-signed bytes are written.

The builder writes the exact DER of the tbsCertificate, tbsCertList, certificationRequestInfo, or tbsResponseData to this stream before requesting the signature.

Returns:

the to-be-signed content output stream

signature

byte[] signature()

Finalizes and returns the raw signature over the bytes written to contentStream().

Returns:

the raw signature bytes