Class ScepService

java.lang.Object
zeroecho.pki.server.scep.ScepService
public final class ScepService extends Object
SCEP enrollment adapter with provisioned authority-scoped RA custody and durable enrollment continuation. CMS verification precedes credential selection and decryption; the shared coordinator owns approval, signing and recovery. No request, private key or transaction state is retained in this service.

  • Constructor Details

    • ScepService

      public ScepService(ServerRealmContext realm)
      Creates a stateless adapter.
      Parameters:
      realm - lifecycle-owned realm context

  • Method Details

    • register

      public void register(ScepEndpoint endpoint)
      Registers or replaces an endpoint.
      Parameters:
      endpoint - validated configuration

    • deregister

      public Optional<ScepEndpoint> deregister(String label)
      Removes an endpoint.
      Parameters:
      label - endpoint label
      Returns:
      removed endpoint, if present

    • find

      public Optional<ScepEndpoint> find(String label)
      Finds an endpoint.
      Parameters:
      label - endpoint label
      Returns:
      current endpoint, if present

    • list

      public List<ScepEndpoint> list()
      Collects current endpoints.
      Returns:
      immutable endpoints from bounded store pages

    • getCaCert

      public ScepService.CaCertificateResponse getCaCert(ScepEndpoint endpoint) throws ScepProtocolException
      Advertises the actual active RA and its exact issuing CA chain.
      Parameters:
      endpoint - current endpoint
      Returns:
      typed degenerate CMS response
      Throws:
      ScepProtocolException - if configuration or custody is unavailable

    • getCaCertChain

      public byte[] getCaCertChain(ScepEndpoint endpoint) throws ScepProtocolException
      Returns the same provisioned certificate set as GetCACert.
      Parameters:
      endpoint - current endpoint
      Returns:
      certificates-only CMS
      Throws:
      ScepProtocolException - if custody is unavailable

    • getCaCaps

      public byte[] getCaCaps()
      Advertises implemented capabilities.
      Returns:
      ASCII capability list

    • processPkiOperation

      public byte[] processPkiOperation(ScepEndpoint endpoint, byte[] messageData) throws ScepProtocolException
      Processes authenticated PKCSReq or GetCertInitial with durable replay and frozen credential selection. A retry may deliver a retained completed result.
      Parameters:
      endpoint - routed endpoint
      messageData - bounded encoded CMS request
      Returns:
      signed CertRep, pending, failure or encrypted completed certificate
      Throws:
      ScepProtocolException - for unauthenticated input or unavailable custody

    • processPkiOperation

      public byte[] processPkiOperation(ScepEndpoint endpoint, byte[] messageData, CancellationSignal cancellation) throws ScepProtocolException
      Processes a request with cancellation before durable signing admission.
      Parameters:
      endpoint - routed endpoint
      messageData - bounded encoded CMS request
      cancellation - request cancellation signal
      Returns:
      signed CertRep
      Throws:
      ScepProtocolException - for invalid input or unavailable processing