Class CmpService

java.lang.Object

zeroecho.pki.server.cmp.CmpService

public final class CmpService
extends Object

Authenticated CMP enrollment, replacement, revocation and CA discovery. Exact CRMF requests use the shared durable approval/signing coordinator. Responses and nonce progression are persisted before delivery; pre-admission authorization refusals have no durable transaction or domain side effect. Thread-safe; cryptography and domain calls execute outside the control monitor.

Constructor Summary

Constructors

Constructor	Description
CmpService(ServerRealmContext realm)	Creates a protocol adapter with the system clock and secure nonce source.
CmpService(ServerRealmContext realm, Clock clock, SecureRandom random)	Creates an adapter with explicit time and nonce capabilities.

Method Summary

Modifier and Type	Method	Description
Optional<CmpEndpoint>	deregister(String label)	Removes the durable binding.
Optional<CmpEndpoint>	find(String label)	Looks up an endpoint.
List<CmpEndpoint>	list()	Returns immutable endpoints in deterministic registry order.
byte[]	processMessage(CmpEndpoint endpoint, byte[] pkiMessageDer)	Processes one bounded protected request using the owned enrollment runtime.
byte[]	processMessage(CmpEndpoint endpoint, byte[] pkiMessageDer, CancellationSignal cancellation)	Processes a request with cooperative cancellation.
void	register(CmpEndpoint endpoint)	Registers a fully bound endpoint.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

CmpService

public CmpService(ServerRealmContext realm)

Creates a protocol adapter with the system clock and secure nonce source.

Parameters:

realm - lifecycle-owned realm and enrollment runtime

CmpService

public CmpService(ServerRealmContext realm,
 Clock clock,
 SecureRandom random)

Creates an adapter with explicit time and nonce capabilities.

Parameters:

realm - lifecycle-owned realm

clock - authoritative protocol clock

random - thread-safe cryptographic nonce and salt source

Method Details

register

public void register(CmpEndpoint endpoint)

Registers a fully bound endpoint.

Parameters:

endpoint - mandatory policy and authority binding

deregister

public Optional<CmpEndpoint> deregister(String label)

Removes the durable binding.

Parameters:

label - exact endpoint label

Returns:

removed endpoint, if present

find

public Optional<CmpEndpoint> find(String label)

Looks up an endpoint.

Parameters:

label - exact endpoint label

Returns:

current endpoint, if present

list

public List<CmpEndpoint> list()

Returns immutable endpoints in deterministic registry order.

Returns:

immutable endpoints in deterministic registry order

processMessage

public byte[] processMessage(CmpEndpoint endpoint,
 byte[] pkiMessageDer)
                      throws CmpProtocolException

Processes one bounded protected request using the owned enrollment runtime.

Parameters:

endpoint - exact route binding

pkiMessageDer - canonical protected DER message

Returns:

protected response, durably retained after transaction admission

Throws:

CmpProtocolException - for malformed, unauthenticated or unavailable work

processMessage

public byte[] processMessage(CmpEndpoint endpoint,
 byte[] pkiMessageDer,
 CancellationSignal cancellation)
                      throws CmpProtocolException

Processes a request with cooperative cancellation. Claimed signing work is reconciled by its original receipt rather than submitted again after timeout.

Parameters:

endpoint - exact route binding

pkiMessageDer - bounded protected DER request

cancellation - owned HTTP deadline/cancellation signal

Returns:

same-mode protected response

Throws:

CmpProtocolException - for malformed, unauthenticated or unavailable work