Class CredentialLineage

java.lang.Object
zeroecho.pki.api.credential.CredentialLineage
public final class CredentialLineage extends Object
Durable, auditable supersession lineage between a superseding credential and the predecessor it replaces.

When a credential is produced by replace or reissue, the newly issued credential carries a forward pointer to the predecessor it supersedes. The pointer lives in credential metadata attributes, not in the signed certificate bytes, so it never changes the content-addressed credential identity or the signing path. Combined with permanent revocation of the predecessor under RevocationReason.SUPERSEDED (or preservation of its existing permanent reason), this records the durable lifecycle relationship. Renewal does not create supersession lineage or revoke its predecessor. The module derives lineage from the validated durable lifecycle command; caller-supplied execution evidence cannot supply it.

  • Field Details

    • SUPERSEDES_CREDENTIAL_ID

      public static final AttributeId SUPERSEDES_CREDENTIAL_ID
      Metadata attribute carrying the predecessor credential identity superseded by this credential.

    • SUPERSESSION_REASON

      public static final AttributeId SUPERSESSION_REASON
      Metadata attribute carrying the trusted REPLACE_END_ENTITY or REISSUE_END_ENTITY discriminator.

  • Method Details

    • supersededCredentialId

      public static Optional<PkiId> supersededCredentialId(AttributeSet attributes)
      Reads the predecessor credential identity a credential supersedes, if any.
      Parameters:
      attributes - credential metadata attributes; must not be null
      Returns:
      predecessor credential id, or empty when the credential supersedes nothing