Class AcmeJwsVerifier

java.lang.Object

zeroecho.pki.server.acme.AcmeJwsVerifier

public final class AcmeJwsVerifier
extends Object

Strict narrow ACME flattened-JWS verifier supporting only ES256.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final record	AcmeJwsVerifier.AccountKey	Resolved durable account public key with exact revision commitment.
static interface	AcmeJwsVerifier.AccountKeyResolver	Account lookup used only after strict KID framing.
static final class	AcmeJwsVerifier.AcmeProblem	Safe finite protocol failure, never carrying provider or parser details.
static enum	AcmeJwsVerifier.KeyMode	Required protected-header account-key mode.
static final record	AcmeJwsVerifier.Verified	Verified JWS data safe to pass to one closed endpoint decoder.

Constructor Summary

Constructors

Constructor	Description
AcmeJwsVerifier()	Creates a stateless strict ACME JWS verifier.

Method Summary

Modifier and Type	Method	Description
String	kidRoutingHint(byte[] document, int maximumDocumentBytes, URI expectedUrl)	Extracts a strictly framed KID only as a routing hint before full JWS verification.
AcmeJwsVerifier.Verified	verify(byte[] document, int maximumDocumentBytes, URI expectedUrl, String nonceScope, AcmeJwsVerifier.KeyMode keyMode, AcmeNonceService nonces, AcmeJwsVerifier.AccountKeyResolver accounts)	Verifies one complete flattened JWS against the exact configured external URL.
AcmeJwsVerifier.Verified	verifyKeyChange(byte[] document, int maximumDocumentBytes, URI expectedUrl, String expectedAccountKid, String oldKeyThumbprint)	Verifies the RFC key-change inner JWS signed by the replacement key.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

AcmeJwsVerifier

public AcmeJwsVerifier()

Creates a stateless strict ACME JWS verifier.

Method Details

kidRoutingHint

public String kidRoutingHint(byte[] document,
 int maximumDocumentBytes,
 URI expectedUrl)

Extracts a strictly framed KID only as a routing hint before full JWS verification. The returned value grants no authority and must be resolved and authenticated by verify(byte[], int, URI, String, KeyMode, AcmeNonceService, AccountKeyResolver).

Parameters:

document - flattened JWS document

maximumDocumentBytes - positive encoded-document bound in bytes

expectedUrl - exact externally visible endpoint URL

Returns:

untrusted KID routing hint

verify

public AcmeJwsVerifier.Verified verify(byte[] document,
 int maximumDocumentBytes,
 URI expectedUrl,
 String nonceScope,
 AcmeJwsVerifier.KeyMode keyMode,
 AcmeNonceService nonces,
 AcmeJwsVerifier.AccountKeyResolver accounts)

Verifies one complete flattened JWS against the exact configured external URL. The admitted replay nonce is consumed before signature verification.

Parameters:

document - flattened JWS document

maximumDocumentBytes - positive encoded-document bound in bytes

expectedUrl - exact externally visible endpoint URL

nonceScope - canonical directory nonce scope

keyMode - required protected-header key mode

nonces - one-use replay-nonce service

accounts - exact account-key resolver

Returns:

verified payload and signing authority

verifyKeyChange

public AcmeJwsVerifier.Verified verifyKeyChange(byte[] document,
 int maximumDocumentBytes,
 URI expectedUrl,
 String expectedAccountKid,
 String oldKeyThumbprint)

Verifies the RFC key-change inner JWS signed by the replacement key.

Parameters:

document - flattened inner JWS document

maximumDocumentBytes - positive encoded-document bound in bytes

expectedUrl - exact externally visible key-change URL

expectedAccountKid - exact existing-account KID

oldKeyThumbprint - authenticated old account-key thumbprint

Returns:

verified payload and replacement-key authority