All Classes and Interfaces
Class
Description
JFR event emitted when an ACME challenge validation attempt completes.
Explicit evidence-producing ACME challenge-provider SPI.
Explicit evidence-producing ACME challenge-provider SPI.
Supported challenge mechanisms.
Exact immutable challenge input; values are sensitive and must never be logged.
Exact immutable challenge input; values are sensitive and must never be logged.
Immutable canonical DNS identifier.
Supported ACME identifier kinds.
Finite provider result without raw network, DNS, token or response data.
Finite provider result without raw network, DNS, token or response data.
Typed ACME record facade over the realm's sole transactional control authority.
Immutable atomically committed order graph.
One exact prior-to-next ACME compare-and-set transition.
Results of one atomic ACME graph transition.
Secret-confining external-account-binding verification SPI.
Secret-confining external-account-binding verification SPI.
Finite EAB policy output without secret material.
Finite EAB policy output without secret material.
Exact bounded EAB verification request.
Exact bounded EAB verification request.
Strict narrow ACME flattened-JWS verifier supporting only ES256.
Resolved durable account public key with exact revision commitment.
Account lookup used only after strict KID framing.
Safe finite protocol failure, never carrying provider or parser details.
Required protected-header account-key mode.
Verified JWS data safe to pass to one closed endpoint decoder.
Bounded process-local one-time ACME replay-nonce authority.
Deterministic explicitly enabled ACME ServiceLoader composition.
Bounded restart-local ACME rate and finalization admission authority.
Transport-neutral durable ACME state machine and constrained PKI integration.
Safe immutable directory-registration input.
Closed durable ACME domain records.
Durable protocol-scoped ACME account.
Exclusion-only evidence for one authenticated account key, retained across
rollover.
Account lifecycle.
Durable identifier authorization owned by one account order.
Immutable validator evidence; no control operation may construct it.
Authorization lifecycle.
Durable explicitly triggered challenge attempt.
Challenge lifecycle.
Supported proof challenges.
Immutable directory policy revision bound to one exact PKI authority.
Directory lifecycle.
Durable validation result.
One canonical DNS identifier with an explicit wildcard bit.
Supported identifier kinds.
Durable ACME order frozen to one directory revision and issuance selection.
Order lifecycle.
Lifecycle owner for the isolated optional ACME HTTPS listener.
Exact bounded ACME wire-size calculations shared by configuration and transport.
Explicit mutually exclusive administrative authentication deployment mode.
Composes direct mutual-TLS authentication or separately authenticated proxy
transport with independently validated forwarded end-client identity.
Immutable trusted administrative actor passed from gateway authorization to
control dispatch.
One closed administrative namespace spanning PKI and server-control families.
Server security-control operation family.
Existing transport-neutral PKI operation family.
Server-owned inputs for one semantic signing acceptance.
JFR event emitted for every request handled by the administrative HTTPS handler.
Durable exact-operation multi-party approval service.
Individual immutable approval choice.
One attributable immutable decision.
Immutable approval policy.
Durable approval authority record.
Approval lifecycle states.
Explicit certificate/request/status projection boundary for auditor data views.
Full binary content projection; byte content is never redacted in place.
Full non-PII metadata projection.
Explicit PII-enabled projection, separately authorized from content.
Redacted metadata projection containing indicators rather than PII.
Safe source metadata from which authorized projections are produced.
JFR event emitted when an audit record is written to the durable audit sink.
Immutable process policy controlling which logical authorities one realm
context may expose.
Closed authority-exposure modes.
Deterministic side-effect-free default-deny authorization engine.
Safe decision codes that reveal no protected-object existence.
Finite safe authorization result.
One complete authorization input.
Transport-owned binary streams opened only after full gateway authorization
and approval.
Explicit, opt-in budgets for remote backup transfer.
Durable, scoped, mandatory-expiry emergency authorization service.
Active grants plus their identities for authorization and use auditing.
Durable break-glass record.
Break-glass lifecycle states.
Immutable realm-bound certificate and mathematical key commitments used only
for enrollment separation.
Immutable binding that maps a CMP path suffix to a CA authority, an issuance profile,
and a required PKIMessage protection policy.
CMP PKIMessage protection policy required by a CMP endpoint.
Signals a CMP protocol-level error that maps to an HTTP error response.
Authenticated CMP enrollment, replacement, revocation and CA discovery.
Immutable CMP wire continuation, independent of signing acceptance.
Durable protocol confirmation, independent of domain credential confirmation.
Authenticated immutable reservation.
Metadata committed atomically with every fixed response slot.
Lifecycle owner for the optional CMP RFC 4210/9480 HTTPS listener (RFC 6712 transport).
Immutable realm configuration for credential-confirmation proof challenges.
Synchronous stateless gate that freezes confirmation before leaf disclosure.
Explicit administrative audit identity, distinct from credential ownership.
JFR event emitted when a CRL or OCSP status object is generated.
Certificate Transparency pipeline stage that runs between request approval and final
certificate signing (Mode B — external CT log submission).
Client for a single Certificate Transparency log endpoint.
Submits a pre-certificate to multiple CT logs in parallel using virtual threads.
Thrown when pre-certificate submission to a CT log fails.
Durable disclosure authority and capability-based retrieval decision service.
Persisted commitment-only capability authority.
Safe retrieval result that reveals no protected-object existence.
Configuration-driven safe defaults.
Durable one-time delivery classification without retaining the raw token.
One-time raw-token issuance result.
Public-object classes with independent default policies.
Typed disclosure owner, keeping ACME accounts outside administrative principals.
Closed owner categories.
Persisted disclosure states, independent of issuance and publication.
Durable policy bound to exact object and profile/policy commitment.
Realm-owned durable enrollment admission, independent approval and exact signing
continuation.
Verified adapter input; this API does not authenticate wire messages.
Bounded ciphertext borrower; the caller must close it on every HTTP outcome.
Closed immutable protocol binding with an explicit enrollment policy.
Realm-owned, thread-safe durable endpoint registry.
Closed protocols sharing the durable enrollment endpoint authority.
Exact persisted endpoint snapshot suitable for binding an approval request.
Conservative, exclusion-only aliases derived from configured end-client
credential commitments.
Immutable sorted aliases bound to one realm; at most 20,000 entries permits
union of one frozen and one current configuration snapshot.
Durable server-keygen reservation and encrypted delivery lifecycle.
Durable phases distinguish an interrupted generation from an attached enrollment.
Immutable enrollment profile.
Durable, thread-safe enrollment profile registry owned by one realm.
Lifecycle state of an enrollment profile.
Thread-safe realm owner of dedicated enrollment keyrings and immutable
authority-scoped credentials.
Immutable, separately versioned enrollment resource and credential configuration.
Selection for newly admitted transactions; retained transactions keep their ID.
Explicit transaction budgets, including terminal replay records.
Immutable authority-scoped protocol credentials.
Optional client-encrypted server-keygen delivery storage.
Reference to existing material in a configured encrypted keyring.
Dedicated, preprovisioned encrypted keyring.
Explicit CMP PBM work, salt and algorithm limits.
Explicitly supported PBM digest families.
One CMP PBM requester, isolated to this credential set and authority.
Explicitly supported PBM MAC families.
Protocols requiring explicitly provisioned message credentials.
Response signer with a leaf-to-anchor DER certificate chain.
Immutable linear-time matcher for bounded enrollment subject constraints.
Immutable durable enrollment state.
Frozen client-encrypted key delivery, included in issuance and approval commitments.
One verified independent administrative decision.
Frozen verified original request reference and complete issuance selection.
Existing enrollment operation kinds with separate replay domains.
Protocol family determines admission and recovery binding semantics.
Authenticated protocol actor, distinct from an administrative principal.
Frozen endpoint identity.
Durable states; uncertain or accepted work never silently expires.
Immutable binding that maps an EST URL label to a CA authority, an issuance profile,
and a server-keygen policy.
HTTP handler for the EST RFC 7030 protocol.
Signals an EST protocol-level error that maps to an HTTP error response.
Immutable EST server-key-generation status with deferred encrypted delivery.
Thread-confined encrypted multipart delivery.
EST RFC 7030 protocol service.
Immutable EST enrollment response.
Lifecycle owner for the optional EST RFC 7030 HTTPS listener.
Closed forwarding representation selected explicitly by server configuration.
Build-time generator for complete JSON and TypeScript catalog projections.
Production HTTP-01 validator using policy-checked, IP-pinned port-80 sockets.
HTTP implementation of
CtLogClient using java.net.http.HttpClient.Production DNS-01 validator using one explicit absolute-name JNDI DNS resolver.
Controls server-keygen eligibility for an EST endpoint.
Production mutual-TLS authenticator using immutable cryptographic certificate
commitments rather than mutable subject or SAN strings.
Transport-neutral signed-OCSP requester authentication and scoped query
authorization.
Safe successful authentication result.
Exact bounded cryptographic fields retained from one canonical request.
Safe authentication or authorization rejection.
Dependency corruption or recovery-required authorization authority.
Durable exact responder-binding authority over the server control store.
Closed nonce behavior.
One cryptographic requester-certificate mapping.
Cryptographic requester-to-principal mapping type.
Closed administrator input without server-authoritative timestamps, state, or record commitments.
Closed signed-request authentication policy.
Closed local requester-certificate revocation behavior.
Finite immutable requester trust, mapping, signature and chain policy.
One exact active request-signature binding reference.
Strict versioned responder binding.
Exact signing authority.
Durable activation state.
One explicit repository-backed trust selector.
Repository-backed requester trust selector.
Immutable, validated authority for static operation projections.
One fully validated operation projection.
Request-affecting field refinements and optional display hints.
Presentation joined to a canonical operation.
Request-envelope and field semantics.
Immutable model for machine-readable operation parameter schemas.
Specification for one operation argument field.
Wire types matching the codec's strict intake methods.
Specification for one operation: identity, required permission, and fields.
Complete registry of machine-readable operation parameter schemas derived from the codec.
Immutable parameter definition before permissions are joined from security metadata.
Immutable security descriptors keyed by existing typed-operation identities.
Approval treatment for one operation.
Immutable operation security descriptor.
Future transport eligibility without defining a transport protocol.
Internally fixed execution family; callers cannot select it.
Closed permission vocabulary and immutable scoped grant model.
Stable permission actions; semantic separation is part of the public contract.
Closed non-programmable grant conditions.
Safe finite context used only by closed conditions.
Explicitly separated disclosure and audit data views.
Grant effect.
Immutable persisted permission grant.
Relationship between the requesting principal and the target object.
Transport-neutral target reference.
Security resource types, distinct from PKI authority ownership.
Canonical resource scope supplied independently of object contents.
External PKCS#12 trust-store provider for forwarded administrative clients.
Production JSSE provider using externally protected PKCS#12 identity and trust
stores.
Lifecycle owner for one bounded administrative mutual-TLS HTTPS server.
Closed process lifecycle.
Narrow lifecycle facade hiding the JDK HTTPS listener and bounded execution runtime.
Bounded read-only mutual-TLS authentication input, independent of operation
arguments.
Safe closed mutual-TLS authentication result.
Successfully resolved persisted principal identity.
Safe non-disclosing rejection codes.
Authentication rejection containing only a stable safe code.
Internal transport-neutral server authentication composition boundary.
Explicit provider for the external administrative-client trust policy used
after a trusted proxy forwards a certificate chain.
Explicit provider for the external administrative-client trust policy used
after a trusted proxy forwards a certificate chain.
Strict immutable configuration for one administrative HTTPS server instance.
Separately bounded ACME listener and protocol-security configuration.
Closed ACME listener transport topologies.
Bounded audit-projection policy, independently applied to revocation and each evidence family.
Strict mode-separated administrative client-certificate authentication.
One exact client-certificate mapping.
Configuration for the optional CMP RFC 4210/9480 HTTPS listener.
Separately bounded EST protocol listener configuration.
Bounded worker, queue, admission, deadline and shutdown policy.
HTTPS listener configuration.
Separately bounded public repository listener configuration.
Process-local capability references.
Configuration for the optional SCEP RFC 8894 HTTPS listener.
Bounds for one signing-reconciliation pass executed by
SigningReconciliationWorker.Strict current-version server configuration decoder with closed field sets.
Production command-line entry point for the administrative HTTPS server.
Explicit server-local boundary for lifecycle-confined JSSE key and trust
material.
Explicit server-local boundary for lifecycle-confined JSSE key and trust
material.
Builds a CT pre-certificate from a
TBSCertificate by adding the CT poison
extension and signing it with the CA's key, ready for submission to CT logs.Transport-neutral, read-only disclosed repository gateway.
Safe request identity, without certificate or bearer-token logging fields.
Safe public authority metadata.
Cache policy classes with distinct privacy semantics.
Exact explicit chain path represented as ordered immutable certificate links.
Lifecycle-owned binary response descriptor.
Lifecycle owner for the isolated, optionally enabled public repository listener.
Canonical identity of one PKI realm.
Durable non-authoritative repository alias administration.
Immutable finite alias metadata; no content bytes or filesystem paths.
Durable alias state; removal never deletes its immutable target.
Closed stable repository alias types.
Strict opaque request-correlation identity policy.
Strict deterministic loader for versioned built-in role templates.
Persistable scoped role assignment; the template itself grants nothing.
Immutable role template that has no authority until scoped assignment.
Immutable binding that maps a SCEP URL label to a CA authority, an issuance profile,
and a hashed challenge password.
Signals a SCEP protocol-level error that maps to an HTTP error response.
SCEP enrollment adapter with provisioned authority-scoped RA custody and durable
enrollment continuation.
Public RA advertisement with explicit media type.
Lifecycle owner for the optional SCEP RFC 8894 HTTPS listener.
Verifies Signed Certificate Timestamps collected from CT logs before they may be
embedded in a final certificate.
Transport-independent authenticated-identity target used by authorization.
Closed principal types.
Closed transport-neutral server-control administration operation hierarchy.
Server-resolved exact profile precondition bound into approval canonicalization.
Activation of one already-created approved emergency grant.
Activates a suspended enrollment profile.
Requests an action on an owned opaque archive or restore workflow.
Closed workflow actions and their stable operation identities.
Approval cancellation.
Lists safe configured metadata and one page of known key references.
Independently approved emergency grant creation.
Direct grant creation.
Scoped assignment creation.
Durably deactivates one ACME account without deleting history.
Approval or rejection decision.
Independently approves or rejects the exact record reviewed by an administrator.
De-registers a CMP endpoint by label.
De-registers an EST endpoint by label.
De-registers a SCEP endpoint by label.
Explicit post-issuance enrollment into confirmation and disclosure.
Side-effect-free authorization simulation.
Executes a restore from a backup artifact.
Exports a backup of PKI state, excluding private keys.
Creates a file-backed export for a subsequent authorized download.
Inspects one protocol-scoped ACME account.
Inspects one exact ACME directory revision.
Approval lookup.
Existing safe auditor projection over one server-control object.
Break-glass lookup.
Inspects one registered CMP endpoint.
Disclosure metadata lookup.
Inspects one enrollment profile.
Inspects a durable protocol request using its authoritative persisted scope.
Inspects one registered EST endpoint.
Direct grant lookup.
Inspects one exact OCSP responder binding.
Principal lookup.
Exact repository alias inspection.
Scoped assignment lookup.
Immutable role-template lookup.
Inspects one registered SCEP endpoint.
One-time unlisted retrieval capability issuance.
Lists a bounded account page without contact PII.
Lists a bounded page of ACME directory revisions.
Bounded approval page.
Bounded break-glass page.
Lists non-bearer capabilities for one authoritative disclosure object.
Lists registered CMP endpoints.
Lists enrollment profiles.
Lists retained enrollment requests within the authorized scope.
Lists registered EST endpoints.
Bounded direct-grant page.
Lists a bounded OCSP responder page.
Bounded principal page.
Bounded repository alias page.
Bounded assignment page.
Immutable role-template list.
Lists registered SCEP endpoints.
Registers one immutable inactive ACME directory revision.
Registers a CMP RFC 4210/9480 endpoint.
Registers a new enrollment profile.
Registers an EST RFC 7030 endpoint.
Registers one exact inactive OCSP responder binding.
Principal registration.
Registers a SCEP RFC 8894 endpoint.
Durable repository alias removal without target mutation.
Exact future-operation approval request.
Reserves bounded storage for a streaming archive upload.
Break-glass revocation.
Capability revocation by non-bearer record identity.
Durable direct-grant revocation.
Durable assignment revocation.
Bounded audit-log search over the packaged admin API; preserves tamper-evidence (read-only).
Activates or deactivates one exact ACME directory revision.
Disclosure-only state transition.
Activates or deactivates one exact responder.
Principal enablement transition.
Exact CRL or chain alias publication with expected-current protection.
Suspends an active enrollment profile.
Updates an existing enrollment profile (replaces all mutable fields).
Verifies the audit-log hash chain, optionally against a trusted head anchor.
Verifies structural integrity and completeness of a backup artifact.
Sole closed dispatcher for transport-neutral server-control operations.
Closed server-control result with explicit one-time-sensitive handling.
Response handling classification.
Single-consumption capability delivery result, never a PKI operation value.
Ordinary safe replayable operation result.
Dedicated durable authority for finite server security and disclosure control
metadata.
Finite page returned without materializing the complete namespace.
Thread-confined, closeable iterator over one immutable protocol snapshot.
One compare-and-set mutation participating in an atomic protocol-state change.
Strict opaque protocol payload framed by the server-control authority.
Durable realm-control identity and commitments.
In-process transport-neutral security gateway for existing typed PKI
operations.
Closed gateway outcome preserving typed backend results.
High-risk operation requires a separately created durable approval.
Successfully admitted server-control result.
Safe denial without protected-object existence information.
Successfully admitted operation and exact backend outcome.
Complete transport-neutral request admission input.
Executes one already-authorized signing operation through semantic admission.
Immutable transport-neutral configuration for one server realm.
Lifecycle owner for one server realm, one long-lived PKI session, and one
dedicated durable server-control authority.
Closed lifecycle states.
Centralized owner of all bounded server-created threads, queues and permits.
Operation executed on this runtime's bounded worker lane.
Stateless thread-safe provider for the standard ZeroEcho signature
key-possession proof suite.
JFR event emitted for every signing operation submitted to the gateway.
Strict bounded UTF-8 JSON framing shared by server configuration and HTTP.