Record Class CertificateIdentityEvidence

java.lang.Object
java.lang.Record
zeroecho.pki.server.CertificateIdentityEvidence
Record Components:
realmId - authentication realm
certificateSha256 - exact certificate DER commitment
canonicalKeySha256 - mathematical key commitment, distinct from mapping hashes
legacySpkiSha256 - finite supported equivalent SPKI commitments plus actual provider encoding
issuerSerialSha256 - existing issuer-DER/positive-serial mapping commitment
public record CertificateIdentityEvidence(RealmId realmId, String certificateSha256, String canonicalKeySha256, Set<String> legacySpkiSha256, String issuerSerialSha256) extends Record
Immutable realm-bound certificate and mathematical key commitments used only for enrollment separation. Construction does not establish certificate trust, authentication or authority. Production callers create this value only after validating the actual direct or forwarded end-client credential.

  • Constructor Details

    • CertificateIdentityEvidence

      public CertificateIdentityEvidence(RealmId realmId, String certificateSha256, String canonicalKeySha256, Set<String> legacySpkiSha256, String issuerSerialSha256)
      Validates fixed-size commitments and snapshots at most three SPKI hashes.

  • Method Details

    • fromCertificate

      public static CertificateIdentityEvidence fromCertificate(RealmId realmId, X509Certificate certificate) throws CertificateEncodingException
      Computes evidence from an already validated end-client certificate. It does not validate trust, time, usage or principal mapping. Unsupported identity encodings are rejected without a fallback to hashing arbitrary SPKI bytes. Existing configured mapping hash semantics remain unchanged.
      Parameters:
      realmId - exact authenticated realm
      certificate - validated end-client leaf, never a proxy transport leaf
      Returns:
      immutable, redacted credential evidence
      Throws:
      CertificateEncodingException - if certificate encoding is unavailable
      IllegalArgumentException - if the key representation or serial is unsupported

    • sameCredential

      public boolean sameCredential(CertificateIdentityEvidence other)
      Compares exact certificates or mathematical keys within the same realm.
      Parameters:
      other - verified credential evidence
      Returns:
      whether both represent one known requester credential relationship

    • toString

      public String toString()
      Returns a string representation of this record class. The representation contains the name of the class, followed by the name and value of each of the record components.
      Specified by:
      toString in class Record
      Returns:
      a string representation of this object

    • hashCode

      public final int hashCode()
      Returns a hash code value for this object. The value is derived from the hash code of each of the record components.
      Specified by:
      hashCode in class Record
      Returns:
      a hash code value for this object

    • equals

      public final boolean equals(Object o)
      Indicates whether some other object is "equal to" this one. The objects are equal if the other object is of the same class and if all the record components are equal. All components in this record class are compared with Objects::equals(Object,Object).
      Specified by:
      equals in class Record
      Parameters:
      o - the object with which to compare
      Returns:
      true if this object is the same as the o argument; false otherwise.

    • realmId

      public RealmId realmId()
      Returns the value of the realmId record component.
      Returns:
      the value of the realmId record component

    • certificateSha256

      public String certificateSha256()
      Returns the value of the certificateSha256 record component.
      Returns:
      the value of the certificateSha256 record component

    • canonicalKeySha256

      public String canonicalKeySha256()
      Returns the value of the canonicalKeySha256 record component.
      Returns:
      the value of the canonicalKeySha256 record component

    • legacySpkiSha256

      public Set<String> legacySpkiSha256()
      Returns the value of the legacySpkiSha256 record component.
      Returns:
      the value of the legacySpkiSha256 record component

    • issuerSerialSha256

      public String issuerSerialSha256()
      Returns the value of the issuerSerialSha256 record component.
      Returns:
      the value of the issuerSerialSha256 record component