Class OcspResponderService

java.lang.Object
zeroecho.pki.server.OcspResponderService
public final class OcspResponderService extends Object
Durable exact responder-binding authority over the server control store.

  • Constructor Details

    • OcspResponderService

      public OcspResponderService(RealmId realmId, ServerControlStore control, PkiRepository repository, X509AlgorithmBindingRegistry bindings, Optional<OcspResponseService> signing, Clock clock)
      Binds responder control to one realm and one authoritative PKI repository.
      Parameters:
      realmId - owning security realm
      control - durable server-control store
      repository - authoritative PKI repository
      bindings - active X.509 algorithm-binding registry
      signing - optional status-object signing service
      clock - authoritative server clock

  • Method Details

    • register

      public OcspResponderService.Responder register(OcspResponderService.Registration supplied)
      Creates authoritative metadata and durably registers one inactive responder.
      Parameters:
      supplied - validated administrator input
      Returns:
      durably sealed inactive responder

    • require

      public OcspResponderService.Responder require(String responderId)
      Returns one exact responder.
      Parameters:
      responderId - stable responder identifier
      Returns:
      durable responder configuration

    • requireActiveAlias

      public OcspResponderService.Responder requireActiveAlias(String alias)
      Resolves one unique active public alias.
      Parameters:
      alias - public responder alias
      Returns:
      active responder configuration

    • requireAlias

      public OcspResponderService.Responder requireAlias(String alias)
      Resolves one unique durable alias regardless of activation state.
      Parameters:
      alias - public responder alias
      Returns:
      durable responder configuration

    • list

      public ServerControlStore.Page<OcspResponderService.Responder> list(int offset, int limit)
      Lists one bounded deterministic responder page.
      Parameters:
      offset - zero-based record offset
      limit - positive maximum page size
      Returns:
      deterministic bounded responder page

    • setActive

      public OcspResponderService.Responder setActive(String responderId, boolean active)
      Atomically changes only responder activation after dependency revalidation.
      Parameters:
      responderId - stable responder identifier
      active - desired activation state
      Returns:
      durably updated responder

    • validateAll

      public void validateAll()
      Revalidates every durable binding during realm recovery.

    • create

      public OcspResponderService.Responder create(String responderId, String alias, PkiId authorityId, PkiId issuerId, OcspResponderService.SigningMode signingMode, PkiId responderCredentialId, KeyRef signingKeyRef, PkiId chainPathId, String signatureAlgorithm, Optional<String> signatureBindingId, String bindingCommitment, OcspResponseService.ResponderId responderIdForm, Duration validity, OcspResponderService.NoncePolicy noncePolicy, int maximumNonceBytes, Set<OcspResponseService.CertIdHash> hashes, int maximumRequestBytes, int maximumEntries, Duration cacheLifetime)
      Creates a canonical unsigned-only unsealed record before registration.
      Parameters:
      responderId - stable responder identifier
      alias - unique public responder alias
      authorityId - logical authority identifier
      issuerId - exact issuer generation identifier
      signingMode - issuer or delegated signing mode
      responderCredentialId - exact responder certificate identifier
      signingKeyRef - exact signing-key reference
      chainPathId - responder certificate-chain path identifier
      signatureAlgorithm - signature algorithm identifier
      signatureBindingId - optional explicit signature binding
      bindingCommitment - expected binding or registry commitment
      responderIdForm - OCSP responder-identifier representation
      validity - positive response validity
      noncePolicy - request nonce policy
      maximumNonceBytes - maximum accepted nonce size in bytes
      hashes - accepted certificate-identifier hash algorithms
      maximumRequestBytes - maximum encoded request size in bytes
      maximumEntries - maximum certificate identifiers per request
      cacheLifetime - positive response-cache lifetime
      Returns:
      canonical unsealed inactive responder draft

    • create

      public OcspResponderService.Responder create(String responderId, String alias, PkiId authorityId, PkiId issuerId, OcspResponderService.SigningMode signingMode, PkiId responderCredentialId, KeyRef signingKeyRef, PkiId chainPathId, String signatureAlgorithm, Optional<String> signatureBindingId, String bindingCommitment, OcspResponseService.ResponderId responderIdForm, Duration validity, OcspResponderService.NoncePolicy noncePolicy, int maximumNonceBytes, Set<OcspResponseService.CertIdHash> hashes, int maximumRequestBytes, int maximumEntries, Duration cacheLifetime, OcspResponderService.RequestAuthenticationMode requestAuthenticationMode, Optional<OcspResponderService.RequesterTrustPolicy> requesterTrustPolicy)
      Creates a canonical unsealed record with explicit signed-request policy.
      Parameters:
      responderId - stable responder identifier
      alias - unique public responder alias
      authorityId - logical authority identifier
      issuerId - exact issuer generation identifier
      signingMode - issuer or delegated signing mode
      responderCredentialId - exact responder certificate identifier
      signingKeyRef - exact signing-key reference
      chainPathId - responder certificate-chain path identifier
      signatureAlgorithm - signature algorithm identifier
      signatureBindingId - optional explicit signature binding
      bindingCommitment - expected binding or registry commitment
      responderIdForm - OCSP responder-identifier representation
      validity - positive response validity
      noncePolicy - request nonce policy
      maximumNonceBytes - maximum accepted nonce size in bytes
      hashes - accepted certificate-identifier hash algorithms
      maximumRequestBytes - maximum encoded request size in bytes
      maximumEntries - maximum certificate identifiers per request
      cacheLifetime - positive response-cache lifetime
      requestAuthenticationMode - signed-request authentication policy
      requesterTrustPolicy - requester trust policy required by signed modes
      Returns:
      canonical unsealed inactive responder draft

    • requestPolicyCommitment

      public static String requestPolicyCommitment(OcspResponderService.Registration value)
      Returns a safe deterministic commitment to one request-authentication policy.
      Parameters:
      value - responder registration containing the policy
      Returns:
      lowercase SHA-256 policy commitment