javax.security.auth.x500

---

1. Verifying a Certificate Chain

import javax.security.auth.x500.X500Principal;
import javax.security.auth.x500.X509Certificate;

public class VerifyCertificateChain {

    public static void main(String[] args) {
        // Create a certificate chain
        X509Certificate[] chain = new X509Certificate[3];
        ...

        // Get the root certificate from the chain
        X500Principal rootCertSubject = chain[0].getSubjectX500Principal();

        // Create a trust store containing the root certificate
        KeyStore ks = KeyStore.getInstance("JKS");
        ks.load(null, null);
        ks.setCertificateEntry("rootCert", chain[0]);

        // Create a trust manager factory
        TrustManagerFactory tmf = TrustManagerFactory.getInstance("PKIX");
        tmf.init(ks);

        // Create a trust manager
        TrustManager[] trustManagers = tmf.getTrustManagers();

        // Create an SSL context using the trust manager
        SSLContext sslContext = SSLContext.getInstance("SSL");
        sslContext.init(null, trustManagers, null);

        // Create an SSL socket factory using the SSL context
        SSLSocketFactory sslSocketFactory = sslContext.getSocketFactory();

        // Connect to a server and verify the certificate chain
        SSLSocket socket = (SSLSocket) sslSocketFactory.createSocket();
        socket.connect(new InetSocketAddress("example.com", 443));
        X509Certificate[] serverCertificates = socket.getSession().getPeerCertificates();

        // Verify the certificate chain using the root certificate
        X509Chain chainVerifier = X509Chain.getInstance("X.509");
        chainVerifier.init(true, rootCertSubject, trustManagers);
        chainVerifier.verify(serverCertificates);
    }
}

2. Generating a Self-Signed Certificate

import javax.security.auth.x500.X500Principal;
import javax.security.auth.x500.X509Certificate;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.cert.X509Certificate;

public class GenerateSelfSignedCertificate {

    public static void main(String[] args) {
        // Generate a key pair
        KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
        keyPairGenerator.initialize(2048);
        KeyPair keyPair = keyPairGenerator.generateKeyPair();

        // Create a certificate subject
        X500Principal subject = new X500Principal("CN=example.com");

        // Create a self-signed certificate
        X509Certificate certificate = CertificateFactory.getInstance("X.509").generateCertificate(
                new X509CertificateBuilder(subject, keyPair.getPublic()).
                        setIssuer(subject).
                        setNotAfter(new Date(new Date().getTime() + 3600 * 24 * 365))
        );

        // Sign the certificate with the private key
        certificate.sign(keyPair.getPrivate(), "SHA256withRSA");
    }
}

3. Extracting Certificate Information

import javax.security.auth.x500.X509Certificate;

public class ExtractCertificateInfo {

    public static void main(String[] args) {
        // Load a certificate from a file
        X509Certificate certificate = CertificateFactory.getInstance("X.509").generateCertificate(new FileInputStream("certificate.pem"));

        // Get the subject of the certificate
        X500Principal subject = certificate.getSubjectX500Principal();

        // Get the issuer of the certificate
        X500Principal issuer = certificate.getIssuerX500Principal();

        // Get the not before date of the certificate
        Date notBefore = certificate.getNotBefore();

        // Get the not after date of the certificate
        Date notAfter = certificate.getNotAfter();

        // Get the public key of the certificate
        PublicKey publicKey = certificate.getPublicKey();

        // Get the signature algorithm of the certificate
        String signatureAlgorithm = certificate.getSigAlgName();
    }
}

4. Using a KeyStore to Manage Certificates

import javax.security.auth.x500.X509Certificate;
import java.security.KeyStore;
import java.security.cert.Certificate;

public class ManageCertificatesWithKeyStore {

    public static void main(String[] args) {
        // Create a key store
        KeyStore ks = KeyStore.getInstance("JKS");
        ks.load(null, null);

        // Add a certificate to the key store
        ks.setCertificateEntry("myCert", certificate);

        // Get a certificate from the key store
        Certificate cert = ks.getCertificate("myCert");

        // Delete a certificate from the key store
        ks.deleteEntry("myCert");
    }
}

5. Using a Certificate Authority (CA)

import javax.security.auth.x500.X500Principal;
import javax.security.auth.x500.X509Certificate;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.cert.X509Certificate;

public class UseCertificateAuthority {

    public static void main(String[] args) {
        // Generate a key pair for the CA
        KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
        keyPairGenerator.initialize(2048);
        KeyPair caKeyPair = keyPairGenerator.generateKeyPair();

        // Create a certificate subject for the CA
        X500Principal caSubject = new X500Principal("CN=My CA");

        // Create a self-signed CA certificate
        X509Certificate caCertificate = CertificateFactory.getInstance("X.509").generateCertificate(
                new X509CertificateBuilder(caSubject, caKeyPair.getPublic()).
                        setIssuer(caSubject).
                        setNotAfter(new Date(new Date().getTime() + 3600 * 24 * 365))
        );

        // Sign the CA certificate with the CA's private key
        caCertificate.sign(caKeyPair.getPrivate(), "SHA256withRSA");

        // Generate a key pair for the server
        KeyPairGenerator serverKeyPairGenerator = KeyPairGenerator.getInstance("RSA");
        serverKeyPairGenerator.initialize(2048);
        KeyPair serverKeyPair = serverKeyPairGenerator.generateKeyPair();

        // Create a certificate subject for the server
        X500Principal serverSubject = new X500Principal("CN=example.com");

        // Create a certificate request for the server
        CertificateSigningRequest serverCsr = CertificateSigningRequestBuilder.getInstance("X.509").
                setSubject(serverSubject).
                setPublicKey(serverKeyPair.getPublic()).
                build();

        // Sign the server certificate request with the CA's private key
        X509Certificate serverCertificate = CertificateFactory.getInstance("X.509").generateCertificate(
                new X509CertificateBuilder(serverSubject, serverKeyPair.getPublic()).
                        setIssuer(caSubject).
                        setNotAfter(new Date(new Date().getTime() + 3600 * 24 * 365))
        );

        // Sign the server certificate with the CA's certificate
        serverCertificate.sign(caKeyPair.getPrivate(), "SHA256withRSA");
    }
}

6. Using a Certificate Transparency Log

import javax.security.auth.x500.X509Certificate;
import java.io.IOException;
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class UseCertificateTransparencyLog {

    public static void main(String[] args) {
        // Get the certificate to check
        X509Certificate certificate = ...

        // Get the ASN.1 DER encoding of the certificate
        byte[] certificateDer = certificate.getEncoded();

        // Create the request body
        String body = "{\"certificate\":\"" + Base64.getEncoder().encodeToString(certificateDer) + "\"}";

        // Send the request to the CT log
        HttpClient client = HttpClient.newHttpClient();
        HttpRequest request = HttpRequest.newBuilder().
                uri(URI.create("https://ct.googleapis.com/v1/certificates"))
                .POST(HttpRequest.BodyPublishers.ofString(body))
                .build();

        HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());

        // Check the response code
        if (response.statusCode() == 200) {
            // The certificate is in the CT log
        } else {
            // The certificate is not in the CT log
        }
    }
}

7. Using a Certificate Revocation List (CRL)

import javax.security.auth.x500.X509CRLEntry;
import javax.security.auth.x500.X509CRL;
import java.io.IOException;
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class UseCertificateRevocationList {

    public static void main(String[] args) {
        // Get the URL of the CRL
        String crlUrl = ...

        // Send the request to the CRL URL
        HttpClient client = HttpClient.newHttpClient();
        HttpRequest request = HttpRequest.newBuilder().
                uri(URI.create(crlUrl))
                .GET()
                .build();

        HttpResponse<byte[]> response = client.send(request, HttpResponse.BodyHandlers.ofByteArray());

        // Check the response code
        if (response.statusCode() == 200) {
            // Parse the CRL
            X509CRL crl = CertificateFactory.getInstance("X.509").generateCRL(new ByteArrayInputStream(response.body()));

            // Iterate over the revoked certificates
            for (X509CRLEntry entry : crl.getRevokedCertificates()) {
                // Check if the certificate is revoked
                if (entry.hasExtensions()) {
                    // Get the certificate