Interface CredentialIssuerBackend

public interface CredentialIssuerBackend
SPI contract for framework-specific credential issuance backends.

Implementations of this interface are responsible for constructing the framework-specific credential content required by a concrete credential format, such as X.509 certificates or equivalent encoded artifacts in another framework. This includes assembling the to-be-signed structure, applying framework-specific extensions or metadata, and returning the resulting encoded credential object model expected by the PKI runtime.

This contract deliberately does not require implementations to own or expose private key material directly. Actual signing is expected to be delegated through runtime wiring, such as a signing service, crypto provider, HSM, or other key-management boundary selected by the enclosing PKI deployment.

Architectural role

  • PKI runtime wiring injects the concrete backend into authoritative core services without publishing it through CredentialFramework.
  • PKI core services prepare opaque proof-gated issuance authorities and call this backend to obtain framework-specific credentials.
  • The backend is a privileged post-gate component whose method signatures cannot accept raw issuance commands.
  • This backend performs format-specific credential assembly, not CA policy orchestration, lifecycle control, or long-term persistence.

Implementation expectations

  • Implementations should validate that the supplied authority contains the framework-specific material required for issuance.
  • Implementations should fail explicitly when mandatory issuer material, subject material, or framework-specific overrides are missing or invalid.
  • Implementations may assume that higher layers have already selected the correct framework and issuer context, but they must still protect themselves against structurally inconsistent commands.

Security considerations

  • Implementations must never expose private key material through returned values, thrown exceptions, or logs.
  • Returned credentials should contain only the public credential artifacts appropriate for the target framework.
  • Inputs such as issuer wiring attributes, CSR payloads, and subject public key encodings may be operationally sensitive and must not be logged unsafely.

Thread-safety

Thread-safety is implementation-specific. Implementations intended for shared runtime use should document their concurrency guarantees explicitly.

  • Method Details

    • issueEndEntity

      CredentialBundle issueEndEntity(ValidatedLeafRequest request, DurableContentReference issuerCertificate, KeyRef issuerKeyRef, BigInteger serial)
      Issues an end-entity credential.

      This operation produces a credential for a non-CA subject, typically from a cryptographically verified and profile-authorized request carried by the opaque ValidatedLeafRequest. The returned CredentialBundle may contain the issued leaf credential together with any additional runtime bundle material defined by the concrete framework, such as chain elements or accompanying metadata.

      The parameter type has no public constructor or factory. Only the core issuance gate can create it after mandatory proof-of-possession verification.

      No generic requester attributes or raw CSR extension bytes cross this boundary. Issuer material and the positive serial are supplied independently by the trusted core issuance service.

      Parameters:
      request - gate-produced validated request; must not be null
      issuerCertificate - trusted encoded issuer certificate
      issuerKeyRef - trusted issuer signing-key reference
      serial - trusted positive issuer-controlled serial
      Returns:
      issued credential bundle, never null
      Throws:
      IllegalArgumentException - if command is null or structurally invalid for the concrete framework implementation
      RuntimeException - if credential assembly, delegated signing, or other framework-specific issuance processing fails

    • issueEndEntity

      default CredentialBundle issueEndEntity(ValidatedLeafRequest request, DurableContentReference issuerCertificate, KeyRef issuerKeyRef, BigInteger serial, CancellationSignal cancellation)
      Issues a leaf while carrying originating cancellation to signing.
      Parameters:
      request - gate-produced validated request
      issuerCertificate - trusted encoded issuer certificate
      issuerKeyRef - trusted issuer signing-key reference
      serial - positive issuer-controlled serial
      cancellation - originating cooperative cancellation signal
      Returns:
      issued credential bundle

    • issueIntermediateCertificate

      Credential issueIntermediateCertificate(ValidatedCaRequest request, DurableContentReference issuerCertificate, KeyRef issuerKeyRef)
      Issues a CA credential for an existing CA subject entity.

      This operation is intended for issuance scenarios in which the CA subject already exists in the PKI domain model and requires a new CA credential, such as intermediate CA issuance, CA rollover support, or cross-signing. The exact certificate profile and extension semantics remain framework- specific.

      The supplied ValidatedCaRequest can be constructed only after the core CA proof and active-profile gates have bound the exact public key, subject, profile version, policy, validity, and serial.

      Parameters:
      request - gate-produced validated CA request; must not be null
      issuerCertificate - trusted encoded issuer certificate
      issuerKeyRef - trusted issuer signing-key reference
      Returns:
      issued CA credential, never null
      Throws:
      IllegalArgumentException - if command is null or structurally invalid for the concrete framework implementation
      RuntimeException - if credential assembly, delegated signing, or other framework-specific issuance processing fails

    • issueIntermediateCertificate

      default Credential issueIntermediateCertificate(ValidatedCaRequest request, DurableContentReference issuerCertificate, KeyRef issuerKeyRef, CancellationSignal cancellation)
      Issues an intermediate while carrying originating cancellation to signing.
      Parameters:
      request - gate-produced validated CA request
      issuerCertificate - trusted encoded issuer certificate
      issuerKeyRef - trusted issuer signing-key reference
      cancellation - originating cooperative cancellation signal
      Returns:
      issued CA credential