Class HttpCtLogClient

java.lang.Object

zeroecho.pki.server.ct.HttpCtLogClient

All Implemented Interfaces:

AutoCloseable, CtLogClient

public final class HttpCtLogClient
extends Object
implements CtLogClient

HTTP implementation of CtLogClient using java.net.http.HttpClient.

Submits pre-certificates to the CT log endpoint {baseUrl}ct/v1/add-pre-chain per RFC 6962 §4.1. On HTTP 5xx responses, retries up to 3 times with exponential backoff starting at 1000L ms.

Security note

SCT signature verification against the log's public key is not performed in this implementation. Parsing an SCT response does not establish its cryptographic authenticity. Operators must configure trusted CT logs and treat independent SCT signature verification as a separate requirement.

Since:

1.0

Constructor Summary

Constructors

Constructor	Description
HttpCtLogClient(CtLogDescriptor descriptor, HttpClient httpClient)	Creates a client for the given CT log using the supplied HTTP client.

Method Summary

Modifier and Type	Method	Description
void	close()	Releases resources held by this client (e.g., the underlying HTTP connection pool).
static HttpCtLogClient	create(CtLogDescriptor descriptor)	Creates a client for the given CT log using a virtual-thread-based HTTP client.
String	logId()	Returns the stable CT log identifier (64-character hex SHA-256 of the log's public key).
SignedCertificateTimestamp	submit(byte[] preCert, List<byte[]> chain, Instant deadline)	Submits a pre-certificate and its issuer chain to the CT log and blocks until an SCT is received or the deadline elapses.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

HttpCtLogClient

public HttpCtLogClient(CtLogDescriptor descriptor,
 HttpClient httpClient)

Creates a client for the given CT log using the supplied HTTP client. Closing this wrapper closes the supplied HTTP client. An executor supplied to that HTTP client remains the caller's responsibility; this wrapper only shuts down executors created by its own factory.

Parameters:

descriptor - describes the CT log endpoint; must not be null

httpClient - caller-supplied HTTP client; must not be null

Method Details

create

public static HttpCtLogClient create(CtLogDescriptor descriptor)

Creates a client for the given CT log using a virtual-thread-based HTTP client.

Parameters:

descriptor - describes the CT log endpoint; must not be null

Returns:

ready-to-use client

logId

public String logId()

Description copied from interface: CtLogClient

Returns the stable CT log identifier (64-character hex SHA-256 of the log's public key).

Specified by:

logId in interface CtLogClient

Returns:

hex log ID

submit

public SignedCertificateTimestamp submit(byte[] preCert,
 List<byte[]> chain,
 Instant deadline)
                                  throws CtSubmissionException

Description copied from interface: CtLogClient

Submits a pre-certificate and its issuer chain to the CT log and blocks until an SCT is received or the deadline elapses.

Specified by:

submit in interface CtLogClient

Parameters:

preCert - DER-encoded pre-certificate; must not be null

chain - DER-encoded issuer chain, issuer certificate first; must not be null

deadline - latest time by which the submission must complete; must not be null

Returns:

the SCT received from the log

Throws:

CtSubmissionException - if the submission fails, times out, or the response is invalid

close

public void close()

Description copied from interface: CtLogClient

Releases resources held by this client (e.g., the underlying HTTP connection pool).

After close(), calls to CtLogClient.submit(byte[], List, Instant) throw IllegalStateException. Closing an already-closed client is a no-op.

Specified by:

close in interface AutoCloseable

Specified by:

close in interface CtLogClient