Class CtIssuanceInterceptor

java.lang.Object

zeroecho.pki.server.ct.CtIssuanceInterceptor

public final class CtIssuanceInterceptor
extends Object

Certificate Transparency pipeline stage that runs between request approval and final certificate signing (Mode B — external CT log submission).

For each issuance, beforeSigning(byte[], List, ContentSigner) performs the full RFC 9162 pre-issuance CT sequence:

1. Build a CT pre-certificate by adding the CT poison extension and signing it with the CA's key (PreCertificateBuilder).
2. Submit the pre-certificate in parallel to all configured CT logs and collect SCTs within the configured timeout (CtLogSubmitter).
3. Verify each collected SCT's timestamp freshness and cryptographic signature against the corresponding log's public key (SctVerifier).
4. Embed the verified SCTs into the original TBSCertificate as the SCT list extension (OID 1.3.6.1.4.1.11129.2.4.2) using Pkix.embedScts(byte[], List).
5. Return the modified TBSCertificate DER for final signing.

If fewer than minScts SCTs survive verification the method throws CtSubmissionException and the issuance is aborted. No serial number is consumed and no credential is committed to the store.

This interceptor is a no-op when instantiated with an empty log list (useful for authorities that do not require CT). Use the factory method disabled() to obtain a disabled instance.

Thread safety

This class is immutable and thread-safe after construction.

Since:

1.0

Constructor Summary

Constructors

Constructor	Description
CtIssuanceInterceptor(List<CtLogClient> logs, Map<String, PublicKey> logPublicKeys, int minScts, Duration submissionTimeout)	Creates a CT issuance interceptor.

Method Summary

Modifier and Type	Method	Description
byte[]	beforeSigning(byte[] tbsCertificateDer, List<byte[]> issuerChainDer, ContentSigner signer)	Executes the CT pre-issuance pipeline and returns the modified TBSCertificate DER with SCTs embedded.
static CtIssuanceInterceptor	disabled()	Returns a disabled interceptor that passes tbsCertificateDer through unchanged.
boolean	isEnabled()	Returns true if this interceptor has at least one CT log configured.
int	minScts()	Returns the minimum number of valid SCTs required for issuance.
Duration	submissionTimeout()	Returns the maximum time allowed for parallel log submission.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

CtIssuanceInterceptor

public CtIssuanceInterceptor(List<CtLogClient> logs,
 Map<String, PublicKey> logPublicKeys,
 int minScts,
 Duration submissionTimeout)

Creates a CT issuance interceptor.

Parameters:

logs - CT log clients to submit pre-certificates to; must not be null; may be empty (disables CT for this authority)

logPublicKeys - map from hex log ID to the log's EC or RSA public key; must not be null

minScts - minimum number of valid SCTs required for issuance (typically ≥ 2)

submissionTimeout - maximum total time allowed for parallel log submission; must not be null and must be positive

Throws:

NullPointerException - if any argument is null

IllegalArgumentException - if minScts is negative or submissionTimeout is not positive

Since:

1.0

Method Details

disabled

public static CtIssuanceInterceptor disabled()

Returns a disabled interceptor that passes tbsCertificateDer through unchanged.

This sentinel avoids null checks at call sites for authorities without CT configured.

Returns:

disabled interceptor instance

Since:

1.0

isEnabled

public boolean isEnabled()

Returns true if this interceptor has at least one CT log configured.

Returns:

true if CT log submission will be performed

Since:

1.0

beforeSigning

public byte[] beforeSigning(byte[] tbsCertificateDer,
 List<byte[]> issuerChainDer,
 ContentSigner signer)
                     throws CtSubmissionException

Executes the CT pre-issuance pipeline and returns the modified TBSCertificate DER with SCTs embedded.

If this interceptor was constructed with an empty log list (see disabled()), the input tbsCertificateDer is returned unchanged.

Parameters:

tbsCertificateDer - DER-encoded TBSCertificate for the certificate being issued; must not be null

issuerChainDer - DER-encoded issuer chain, issuer certificate first; must not be null

signer - content signer for the issuing CA key, used to sign the pre-certificate; must not be null

Returns:

DER-encoded TBSCertificate with the SCT list extension embedded

Throws:

CtSubmissionException - if fewer than minScts SCTs survive verification

IllegalArgumentException - if pre-certificate construction or SCT embedding fails

NullPointerException - if any argument is null

Since:

1.0

minScts

public int minScts()

Returns the minimum number of valid SCTs required for issuance.

Returns:

minimum SCT count

Since:

1.0

submissionTimeout

public Duration submissionTimeout()

Returns the maximum time allowed for parallel log submission.

Returns:

submission timeout

Since:

1.0