Field Detail

• logger

  public static org.slf4j.Logger logger

• ALL_CERTS

  public static final int ALL_CERTS

  See Also:

  Constant Field Values

• ALL_VALID_CERTS

  public static final int ALL_VALID_CERTS

  See Also:

  Constant Field Values

• ALL_UNREVOKED_CERTS

  public static final int ALL_UNREVOKED_CERTS

  See Also:

  Constant Field Values

• PROP_INCREMENT

  public static final java.lang.String PROP_INCREMENT

  See Also:

  Constant Field Values

• PROP_CERT_BASE_DN

  public static final java.lang.String PROP_CERT_BASE_DN

  See Also:

  Constant Field Values

• PROP_TRANS_MAXRECORDS

  public static final java.lang.String PROP_TRANS_MAXRECORDS

  See Also:

  Constant Field Values

• PROP_TRANS_PAGESIZE

  public static final java.lang.String PROP_TRANS_PAGESIZE

  See Also:

  Constant Field Values

• CERT_X509ATTRIBUTE

  public final java.lang.String CERT_X509ATTRIBUTE

  See Also:

  Constant Field Values

• certStatusUpdateTask

  public com.netscape.cmscore.dbs.CertStatusUpdateTask certStatusUpdateTask

• retrieveModificationsTask

  public com.netscape.cmscore.dbs.RetrieveModificationsTask retrieveModificationsTask

• serialNumberUpdateTask

  public com.netscape.cmscore.dbs.SerialNumberUpdateTask serialNumberUpdateTask

Constructor Detail

• CertificateRepository

  public CertificateRepository​(DBSubsystem dbSubsystem,
                               java.lang.String certRepoBaseDN,
                               int increment,
                               java.lang.String baseDN)
                        throws EDBException

  Constructs a certificate repository.

  Throws:

  EDBException

Method Detail

• createCertRecord

  public ICertRecord createCertRecord​(java.math.BigInteger id,
                                      java.security.cert.Certificate cert,
                                      MetaInfo meta)

  Creates certificate record.

  Parameters:

  id - serial number

  cert - certificate

  meta - meta information

  Returns:

  certificate record

• getEnableRandomSerialNumbers

  public boolean getEnableRandomSerialNumbers()

  Retrieves serial number management mode.

  Returns:

  serial number management mode, "true" indicates random serial number management, "false" indicates sequential serial number management.

• setEnableRandomSerialNumbers

  public void setEnableRandomSerialNumbers​(boolean random,
                                           boolean updateMode,
                                           boolean forceModeChange)

  Sets serial number management mode for certificates..

  Parameters:

  random - "true" sets random serial number management, "false" sequential

  updateMode - "true" updates "description" attribute in certificate repository

  forceModeChange - "true" forces certificate repository mode change

• getNextSerialNumber

  public java.math.BigInteger getNextSerialNumber()
                                           throws EBaseException

  Retrieves the next certificate serial number, and also increases the serial number by one.

  Specified by:

  getNextSerialNumber in interface IRepository

  Overrides:

  getNextSerialNumber in class Repository

  Returns:

  serial number

  Throws:

  EBaseException - failed to retrieve next serial number

• updateCounter

  public void updateCounter()

• getLastSerialNumberInRange

  public java.math.BigInteger getLastSerialNumberInRange​(java.math.BigInteger serial_low_bound,
                                                         java.math.BigInteger serial_upper_bound)
                                                  throws EBaseException

  Specified by:

  getLastSerialNumberInRange in class Repository

  Throws:

  EBaseException

• removeCertRecords

  public void removeCertRecords​(java.math.BigInteger beginS,
                                java.math.BigInteger endS)
                         throws EBaseException

  Removes certificate records with this repository.

  Parameters:

  beginS - BigInteger with radix 16

  endS - BigInteger with radix 16

  Throws:

  EBaseException

• setConsistencyCheck

  public void setConsistencyCheck​(boolean ConsistencyCheck)

• setSkipIfInConsistent

  public void setSkipIfInConsistent​(boolean SkipIfInconsistent)

• setTransitMaxRecords

  public void setTransitMaxRecords​(int max)

• setTransitRecordPageSize

  public void setTransitRecordPageSize​(int size)

• addCRLIssuingPoint

  public void addCRLIssuingPoint​(java.lang.String id,
                                 ICRLIssuingPoint crlIssuingPoint)

  register CRL Issuing Point

• setCertStatusUpdateInterval

  public void setCertStatusUpdateInterval​(IRepository requestRepository,
                                          int interval,
                                          boolean listenToCloneModifications)

  Sets certificate status update internal. interval value: (in seconds) 0 - disable >0 - enable

  Parameters:

  requestRepo - request repository

  interval - update interval

  listenToCloneModifications - enable listening to clone modifications

• setSerialNumberUpdateInterval

  public void setSerialNumberUpdateInterval​(IRepository requestRepository,
                                            int interval)

  interval value: (in seconds) 0 - disable >0 - enable

• updateCertStatus

  public void updateCertStatus()
                        throws EBaseException

  Updates certificate status now. This is a blocking method.

  Throws:

  EBaseException - failed to update

• getDN

  public java.lang.String getDN()

  Retrieves DN of this repository.

• setRequestDN

  public void setRequestDN​(java.lang.String requestDN)

• getRequestDN

  public java.lang.String getRequestDN()

• getDBSubsystem

  public DBSubsystem getDBSubsystem()

  Retrieves backend database handle.

• addCertificateRecord

  public void addCertificateRecord​(ICertRecord record)
                            throws EBaseException

  Adds a certificate record to the repository. Each certificate record contains four parts: certificate, meta-attributes, issue information and revocation information.

  Parameters:

  cert - X.509 certificate

  Throws:

  EBaseException - failed to add new certificate to the repository

• addRevokedCertRecord

  public void addRevokedCertRecord​(CertRecord record)
                            throws EBaseException

  Used by the Clone Master (CLA) to add a revoked certificate record to the repository.

  Parameters:

  record - a CertRecord

  Throws:

  EBaseException - failed to add new certificate to the repository

• transitValidCertificates

  public void transitValidCertificates()
                                throws EBaseException

  This transits a certificate status from VALID to EXPIRED if a certificate becomes expired.

  Throws:

  EBaseException

• transitRevokedExpiredCertificates

  public void transitRevokedExpiredCertificates()
                                         throws EBaseException

  This transits a certificate status from REVOKED to REVOKED_EXPIRED if an revoked certificate becomes expired.

  Throws:

  EBaseException

• transitInvalidCertificates

  public void transitInvalidCertificates()
                                  throws EBaseException

  This transits a certificate status from INVALID to VALID if a certificate becomes valid.

  Throws:

  EBaseException

• getX509Certificate

  public org.mozilla.jss.netscape.security.x509.X509CertImpl getX509Certificate​(java.math.BigInteger serialNo)
                                                                         throws EBaseException

  Reads the certificate identified by the given serial no.

  Parameters:

  serialNo - serial number of certificate

  Returns:

  certificate

  Throws:

  EBaseException - failed to retrieve certificate

• deleteCertificateRecord

  public void deleteCertificateRecord​(java.math.BigInteger serialNo)
                               throws EBaseException

  Deletes certificate from this repository.

  Parameters:

  serialNo - serial number of certificate

  Throws:

  EBaseException - failed to delete

• readCertificateRecord

  public ICertRecord readCertificateRecord​(java.math.BigInteger serialNo)
                                    throws EBaseException

  Reads certificate from repository.

  Parameters:

  serialNo - serial number of certificate

  Returns:

  certificate record

  Throws:

  EBaseException - failed to retrieve certificate

• checkCertificateRecord

  public boolean checkCertificateRecord​(java.math.BigInteger serialNo)
                                 throws EBaseException

  Throws:

  EBaseException

• modifyCertificateRecord

  public void modifyCertificateRecord​(java.math.BigInteger serialNo,
                                      ModificationSet mods)
                               throws EBaseException

  Modifies certificate record.

  Parameters:

  serialNo - serial number of record

  mods - modifications

  Throws:

  EBaseException - failed to modify

• containsCertificate

  public boolean containsCertificate​(java.math.BigInteger serialNo)
                              throws EBaseException

  Checks if the certificate exists in this repository.

  Parameters:

  serialNo - serial number of certificate

  Returns:

  true if it exists

  Throws:

  EBaseException - failed to check

• markAsRevoked

  public void markAsRevoked​(java.math.BigInteger id,
                            IRevocationInfo info)
                     throws EBaseException

  Marks certificate as revoked. isAlreadyRevoked - boolean to indicate that the cert was revoked ( possibly onHold ) When a cert was originally revoked (possibly onHold), some of the ldap attributes already exist, so "MOD_REPLACE" is needed instead of "MOD_ADD"

  Parameters:

  id - serial number

  info - revocation information

  Throws:

  EBaseException - failed to mark

• markAsRevoked

  public void markAsRevoked​(java.math.BigInteger id,
                            IRevocationInfo info,
                            boolean isAlreadyRevoked)
                     throws EBaseException

  Marks certificate as revoked.

  Parameters:

  id - serial number

  info - revocation information

  isAlreadyOnHold - boolean to indicate if the cert was revoked onHold

  Throws:

  EBaseException - failed to mark

• unmarkRevoked

  public void unmarkRevoked​(java.math.BigInteger id,
                            IRevocationInfo info,
                            java.util.Date revokedOn,
                            java.lang.String revokedBy)
                     throws EBaseException

  Unmark a revoked certificates.

  Parameters:

  id - serial number

  info - revocation information

  revokedOn - revocation date

  revokedBy - userid

  Throws:

  EBaseException - failed to unmark

• updateStatus

  public void updateStatus​(java.math.BigInteger id,
                           java.lang.String status)
                    throws EBaseException

  Updates certificate status.

  Parameters:

  id - serial number

  status - certificate status

  Throws:

  EBaseException - failed to update status

• searchCertificates

  public java.util.Enumeration<java.lang.Object> searchCertificates​(java.lang.String filter,
                                                                    int maxSize,
                                                                    java.lang.String sortAttribute)
                                                             throws EBaseException

  Finds a list of certificate records that satisifies the filter.

  Parameters:

  filter - search filter

  maxSize - max size to return

  sortAttribute - Attribute of ICertRecord to sort the results

  Returns:

  a list of certificates

  Throws:

  EBaseException - failed to search

• searchCertificates

  public java.util.Enumeration<java.lang.Object> searchCertificates​(java.lang.String filter,
                                                                    int maxSize)
                                                             throws EBaseException

  Finds a list of certificate records that satisifies the filter. Here is a list of filter attribute can be used:

     certRecordId
     certMetaInfo
     certStatus
     certCreateTime
     certModifyTime
     x509Cert.notBefore
     x509Cert.notAfter
     x509Cert.subject
   

  The filter should follow RFC1558 LDAP filter syntax. For example,

     (&(certRecordId=5)(x509Cert.notBefore=934398398))
   

  Parameters:

  filter - search filter

  maxSize - max size to return

  Returns:

  a list of certificates

  Throws:

  EBaseException - failed to search

• searchCertificates

  public java.util.Enumeration<ICertRecord> searchCertificates​(java.lang.String filter,
                                                               int maxSize,
                                                               int timeLimit)
                                                        throws EBaseException

  Finds a list of certificate records that satisifies the filter.

  Parameters:

  filter - search filter

  maxSize - max size to return

  timeLimit - timeout value

  Returns:

  a list of certificates

  Throws:

  EBaseException - failed to search

• searchCertificates

  public java.util.Enumeration<ICertRecord> searchCertificates​(java.lang.String filter,
                                                               int maxSize,
                                                               int timeLimit,
                                                               java.lang.String sortAttribute)
                                                        throws EBaseException

  Finds a list of certificate records that satisifies the filter.

  Parameters:

  filter - search filter

  maxSize - max size to return

  timeLimit - timeout value

  sortAttribute - Attribute of ICertRecord to sort the results

  Returns:

  a list of certificates

  Throws:

  EBaseException - failed to search

• findCertRecs

  public java.util.Enumeration<java.lang.Object> findCertRecs​(java.lang.String filter)
                                                       throws EBaseException

  Deprecated.

  replaced by findCertificatesInList
  Finds certificate records.

  Parameters:

  filter - search filter

  Returns:

  a list of certificate records

  Throws:

  EBaseException - failed to retrieve cert records

• findCertRecs

  public java.util.Enumeration<java.lang.Object> findCertRecs​(java.lang.String filter,
                                                              java.lang.String[] attrs)
                                                       throws EBaseException

  Throws:

  EBaseException

• findCertificates

  public java.util.Enumeration<org.mozilla.jss.netscape.security.x509.X509CertImpl> findCertificates​(java.lang.String filter)
                                                                                              throws EBaseException

  Finds all certificates given a filter.

  Parameters:

  filter - search filter

  Returns:

  a list of certificates

  Throws:

  EBaseException - failed to search

• findCertRecords

  public java.util.Enumeration<ICertRecord> findCertRecords​(java.lang.String filter)
                                                     throws EBaseException

  Finds a list of certificate records that satisifies the filter. If you are going to process everything in the list, use this.

  Parameters:

  filter - search filter

  Returns:

  a list of certificates

  Throws:

  EBaseException - failed to search

• findCertRecordsInList

  public ICertRecordList findCertRecordsInList​(java.lang.String filter,
                                               java.lang.String[] attrs,
                                               int pageSize)
                                        throws EBaseException

  Finds certificate records. Here is a list of filter attribute can be used:

     certRecordId
     certMetaInfo
     certStatus
     certCreateTime
     certModifyTime
     x509Cert.notBefore
     x509Cert.notAfter
     x509Cert.subject
   

  The filter should follow RFC1558 LDAP filter syntax. For example,

     (&(certRecordId=5)(x509Cert.notBefore=934398398))
   

  Parameters:

  filter - search filter

  attrs - selected attribute

  pageSize - page size

  Returns:

  a list of certificates

  Throws:

  EBaseException - failed to search

• findCertRecordsInList

  public ICertRecordList findCertRecordsInList​(java.lang.String filter,
                                               java.lang.String[] attrs,
                                               java.lang.String sortKey,
                                               int pageSize)
                                        throws EBaseException

  Finds a list of certificate records that satisifies the filter.

  Parameters:

  filter - search filter

  attrs - selected attribute

  sortKey - key to use for sorting the returned elements

  pageSize - page size

  Returns:

  a list of certificates

  Throws:

  EBaseException - failed to search

• findCertRecordsInList

  public ICertRecordList findCertRecordsInList​(java.lang.String filter,
                                               java.lang.String[] attrs,
                                               java.lang.String jumpTo,
                                               java.lang.String sortKey,
                                               int pageSize)
                                        throws EBaseException

  Finds a list of certificate records that satisifies the filter.

  Parameters:

  filter - search filter

  attrs - selected attribute

  jumpTo - jump to index

  sortKey - key to use for sorting the returned elements

  pageSize - page size

  Returns:

  a list of certificates

  Throws:

  EBaseException - failed to search

• findCertRecordsInList

  public ICertRecordList findCertRecordsInList​(java.lang.String filter,
                                               java.lang.String[] attrs,
                                               java.lang.String jumpTo,
                                               boolean hardJumpTo,
                                               java.lang.String sortKey,
                                               int pageSize)
                                        throws EBaseException

  Finds a list of certificate records that satisifies the filter.

  Parameters:

  filter - search filter

  attrs - selected attribute

  jumpTo - jump to index

  hardJumpTo -

  sortKey - key to use for sorting the returned elements

  pageSize - page size

  Returns:

  a list of certificates

  Throws:

  EBaseException - failed to search

• findCertRecordsInListRawJumpto

  public ICertRecordList findCertRecordsInListRawJumpto​(java.lang.String filter,
                                                        java.lang.String[] attrs,
                                                        java.lang.String jumpTo,
                                                        java.lang.String sortKey,
                                                        int pageSize)
                                                 throws EBaseException

  Finds a list of certificate records that satisifies the filter.

  Parameters:

  filter - search filter

  attrs - selected attribute

  jumpTo - jump to index

  sortKey - key to use for sorting the returned elements

  pageSize - page size

  Returns:

  a list of certificates

  Throws:

  EBaseException - failed to search

• markCertificateAsRenewable

  public void markCertificateAsRenewable​(ICertRecord record)
                                  throws EBaseException

  Marks certificate as renewable.

  Parameters:

  record - certificate record to modify

  Throws:

  EBaseException - failed to update

• markCertificateAsNotRenewable

  public void markCertificateAsNotRenewable​(ICertRecord record)
                                     throws EBaseException

  Marks certificate as not renewable.

  Parameters:

  record - certificate record to modify

  Throws:

  EBaseException - failed to update

• markCertificateAsRenewed

  public void markCertificateAsRenewed​(java.lang.String serialNo)
                                throws EBaseException

  Marks certificate as renewed.

  Parameters:

  serialNo - certificate record to modify

  Throws:

  EBaseException - failed to update

• markCertificateAsRenewalNotified

  public void markCertificateAsRenewalNotified​(java.lang.String serialNo)
                                        throws EBaseException

  Marks certificate as renewed and notified.

  Parameters:

  serialNo - certificate record to modify

  Throws:

  EBaseException - failed to update

• getRenewableCertificates

  public java.util.Hashtable<java.lang.String,​RenewableCertificateCollection> getRenewableCertificates​(java.lang.String renewalTime)
                                                                                                      throws EBaseException

  Retrieves renewable certificates.

  Parameters:

  renewalTime - renewal time

  Returns:

  certificates

  Throws:

  EBaseException - failed to retrieve

• getX509Certificates

  public org.mozilla.jss.netscape.security.x509.X509CertImpl[] getX509Certificates​(java.lang.String subjectDN,
                                                                                   int validityType)
                                                                            throws EBaseException

  Gets all valid and unexpired certificates pertaining to a subject DN.

  Parameters:

  subjectDN - The distinguished name of the subject.

  validityType - The type of certificates to get.

  Returns:

  An array of certificates.

  Throws:

  EBaseException - on error.

• getX509Certificates

  public org.mozilla.jss.netscape.security.x509.X509CertImpl[] getX509Certificates​(java.lang.String filter)
                                                                            throws EBaseException

  Throws:

  EBaseException

• getValidCertificates

  public java.util.Enumeration<ICertRecord> getValidCertificates​(java.lang.String from,
                                                                 java.lang.String to)
                                                          throws EBaseException

  Retrieves valid certificates.

  Parameters:

  from - starting serial number

  to - ending serial number

  Returns:

  a list of certificates

  Throws:

  EBaseException - failed to retrieve

• getAllValidCertificates

  public java.util.Enumeration<ICertRecord> getAllValidCertificates()
                                                             throws EBaseException

  Retrives all valid certificates excluding ones already revoked.

  Throws:

  EBaseException

• getValidNotPublishedCertificates

  public java.util.Enumeration<ICertRecord> getValidNotPublishedCertificates​(java.lang.String from,
                                                                             java.lang.String to)
                                                                      throws EBaseException

  Retrieves valid and not published certificates.

  Parameters:

  from - starting serial number

  to - ending serial number

  Returns:

  a list of certificates

  Throws:

  EBaseException - failed to retrieve

• getAllValidNotPublishedCertificates

  public java.util.Enumeration<ICertRecord> getAllValidNotPublishedCertificates()
                                                                         throws EBaseException

  Retrives all valid not published certificates excluding ones already revoked.

  Throws:

  EBaseException

• getExpiredCertificates

  public java.util.Enumeration<ICertRecord> getExpiredCertificates​(java.lang.String from,
                                                                   java.lang.String to)
                                                            throws EBaseException

  Retrieves expired certificates.

  Parameters:

  from - starting serial number

  to - ending serial number

  Returns:

  a list of certificates

  Throws:

  EBaseException - failed to retrieve

• getAllExpiredCertificates

  public java.util.Enumeration<ICertRecord> getAllExpiredCertificates()
                                                               throws EBaseException

  Retrives all expired certificates.

  Throws:

  EBaseException

• getExpiredPublishedCertificates

  public java.util.Enumeration<ICertRecord> getExpiredPublishedCertificates​(java.lang.String from,
                                                                            java.lang.String to)
                                                                     throws EBaseException

  Retrieves expired and published certificates.

  Parameters:

  from - starting serial number

  to - ending serial number

  Returns:

  a list of certificates

  Throws:

  EBaseException - failed to retrieve

• getAllExpiredPublishedCertificates

  public java.util.Enumeration<ICertRecord> getAllExpiredPublishedCertificates()
                                                                        throws EBaseException

  Retrives all expired publishedcertificates.

  Throws:

  EBaseException

• getInvalidCertsByNotBeforeDate

  public ICertRecordList getInvalidCertsByNotBeforeDate​(java.util.Date date,
                                                        int pageSize)
                                                 throws EBaseException

  Gets Invalid certs orderes by noAfter date, jumps to records where notAfter date is greater than current.

  Parameters:

  date - reference date

  pageSize - page size

  Returns:

  a list of certificate records

  Throws:

  EBaseException - failed to retrieve

• getValidCertsByNotAfterDate

  public ICertRecordList getValidCertsByNotAfterDate​(java.util.Date date,
                                                     int pageSize)
                                              throws EBaseException

  Gets valid certs orderes by noAfter date, jumps to records where notAfter date is greater than current.

  Parameters:

  date - reference date

  pageSize - page size

  Returns:

  a list of certificate records

  Throws:

  EBaseException - failed to retrieve

• getRevokedCertsByNotAfterDate

  public ICertRecordList getRevokedCertsByNotAfterDate​(java.util.Date date,
                                                       int pageSize)
                                                throws EBaseException

  Gets Revoked certs orderes by noAfter date, jumps to records where notAfter date is greater than current.

  Parameters:

  date - reference date

  pageSize - page size

  Returns:

  a list of certificate records

  Throws:

  EBaseException - failed to retrieve

• getRevokedCertificates

  public java.util.Enumeration<ICertRecord> getRevokedCertificates​(java.lang.String from,
                                                                   java.lang.String to)
                                                            throws EBaseException

  Retrieves revoked certificates.

  Parameters:

  from - starting serial number

  to - ending serial number

  Returns:

  a list of certificates

  Throws:

  EBaseException - failed to retrieve

• getAllRevokedCertificates

  public java.util.Enumeration<ICertRecord> getAllRevokedCertificates()
                                                               throws EBaseException

  Retrieves all revoked certificates including ones that have expired or that are not yet valid.

  Returns:

  a list of revoked certificates

  Throws:

  EBaseException - failed to search

• getRevokedPublishedCertificates

  public java.util.Enumeration<ICertRecord> getRevokedPublishedCertificates​(java.lang.String from,
                                                                            java.lang.String to)
                                                                     throws EBaseException

  Retrieves revoked and published certificates.

  Parameters:

  from - starting serial number

  to - ending serial number

  Returns:

  a list of certificates

  Throws:

  EBaseException - failed to retrieve

• getAllRevokedPublishedCertificates

  public java.util.Enumeration<ICertRecord> getAllRevokedPublishedCertificates()
                                                                        throws EBaseException

  Retrives all revoked published certificates including ones already expired or not yet valid.

  Throws:

  EBaseException

• getRevokedCertificates

  public java.util.Enumeration<ICertRecord> getRevokedCertificates​(java.util.Date asOfDate)
                                                            throws EBaseException

  Retrieves all revoked certificates that have not expired.

  Parameters:

  asOfDate - as of date

  Returns:

  a list of revoked certificates

  Throws:

  EBaseException - failed to retrieve

• getAllRevokedNonExpiredCertificates

  public java.util.Enumeration<ICertRecord> getAllRevokedNonExpiredCertificates()
                                                                         throws EBaseException

  Retrieves all revoked but not expired certificates.

  Returns:

  a list of revoked certificates

  Throws:

  EBaseException - failed to search

• getModifications

  public void getModifications​(netscape.ldap.LDAPEntry entry)

  Retrieves modified certificate records.

  Parameters:

  entry - LDAPEntry with modified data

• isCertificateRevoked

  public RevocationInfo isCertificateRevoked​(org.mozilla.jss.netscape.security.x509.X509CertImpl cert)
                                      throws EBaseException

  Checks if the presented certificate belongs to the repository and is revoked.

  Parameters:

  cert - certificate to verify.

  Returns:

  RevocationInfo if the presented certificate is revoked otherwise null.

  Throws:

  EBaseException

• shutdown

  public void shutdown()