Class PreCertificateBuilder

java.lang.Object

zeroecho.pki.server.ct.PreCertificateBuilder

public final class PreCertificateBuilder
extends Object

Builds a CT pre-certificate from a TBSCertificate by adding the CT poison extension and signing it with the CA's key, ready for submission to CT logs.

This class delegates entirely to Pkix.buildPreCertificate(byte[], List, ContentSigner); it exists as a named collaborator so the issuance pipeline can treat pre-certificate construction as an injected strategy rather than a direct static call.

Thread safety

This class is stateless and thread-safe.

Since:

1.0

Method Summary

Modifier and Type	Method	Description
static PreCertificateResult	build(byte[] tbsCertificateDer, List<byte[]> issuerChainDer, ContentSigner signer)	Builds a CT pre-certificate from a TBSCertificate using the CA's content signer.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

build

public static PreCertificateResult build(byte[] tbsCertificateDer,
 List<byte[]> issuerChainDer,
 ContentSigner signer)

Builds a CT pre-certificate from a TBSCertificate using the CA's content signer.

The returned PreCertificateResult contains the DER-encoded pre-certificate (with the CT poison extension added and signed with the CA key) and the issuer chain. The pre-certificate is ready for submission to one or more CT logs via CtLogSubmitter.submitAll(byte[], List, List, Instant).

Parameters:

tbsCertificateDer - DER-encoded TBSCertificate; must not be null

issuerChainDer - DER-encoded issuer certificate chain, issuer first; must not be null

signer - content signer configured for the issuing CA key; must not be null

Returns:

pre-certificate DER and its chain

Throws:

IllegalArgumentException - if pre-certificate construction or signing fails

NullPointerException - if any argument is null

Since:

1.0