Class CRLGenerator

Object
   |
   +--CRLGenerator

class CRLGenerator

Class implementing a CRL certificate generator
Defined in crlgenerator.js

Field Detail

crypto

Object crypto

aACompromise

<static> Object aACompromise

affiliationChanged

<static> Object affiliationChanged

cACompromise

<static> Object cACompromise

certificateHold

<static> Object certificateHold

cessationOfOperation

<static> Object cessationOfOperation

keyCompromise

<static> Object keyCompromise

privilegeWithdrawn

<static> Object privilegeWithdrawn

removeFromCRL

<static> Object removeFromCRL

superseded

<static> Object superseded

unspecified

<static> Object unspecified

CRLGenerator

CRLGenerator(<Crypto> crypto)

Create a Certificate Revocation List (CRL) generator.

Parameters:
crypto - the crypto provider to use for signing operations

addAuthorityKeyIdentifierExtension

void addAuthorityKeyIdentifierExtension(publicKey)

Adds the authority public key identifier extension based on the issuers key.

The key identifier is calculated as SHA-1 hash over the contents of the issuer public key (Without tag, length and number of unused bits.

addCRLNumberExtension

void addCRLNumberExtension(crlnumber)

Adds the CRL number extension.

addExtension

void addExtension(<String> extnID, <Boolean> critical, extnValue)

Adds an extension to the CRL

The structure is defined as:

    Extension  ::=  SEQUENCE  {
        extnID      OBJECT IDENTIFIER,
        critical    BOOLEAN DEFAULT FALSE,
        extnValue   OCTET STRING
                    -- contains the DER encoding of an ASN.1 value
                    -- corresponding to the extension type identified
                    -- by extnID
        }

Parameters:
extnID - the extensions object identifier
critical - the extension is critical
the - extension value as ByteString

addRevokedCertificate

void addRevokedCertificate(<ASN1> revokedCertificate)

Add a revoked certificate to the list. This adds the complete DER encoded structure.

Parameters:
revokedCertificate - the information related to the revoked certificate

generateCRL

X509 generateCRL(privateKey)

Generates the certificate.

Returns:
the generated certificate

getExtensions

ASN1 getExtensions()

Gets the CRL extension as TLV object

Returns:
the CRL extensions

getIssuer

ASN1 getIssuer()

Gets the issuer name as TLV object

Returns:
the issuer RDNSequence

getNextUpdate

ASN1 getNextUpdate()

Gets the nextUpdate TLV object

Returns:
the nextUpdate UTC encoded time

getRevokedCertificates

ASN1 getRevokedCertificates()

Gets revoked certificates

Returns:
the list of revoked certificates

getSignatureAlgorithm

ASN1 getSignatureAlgorithm()

Gets the signature algorithm TLV object

Returns:
the signature algorithm object

getTbsCertificateList

ASN1 getTbsCertificateList()

Gets the part of the CRL that will be signed

Returns:
the TBSCertificate part

getThisUpdate

ASN1 getThisUpdate()

Gets the thisUpdate TLV object

Returns:
the thisUpdate UTC encoded time

loadCRLEntries

Number loadCRLEntries(<String> filename)

Load list of revoked certificates from an existing CRL

Parameters:
filename - the file name of the DER encoded CRL

Returns:
the value of the CRLNumber extension, 0 if extension not defined or -1 if file could not be loaded

reset

void reset()

Resets all internal state variables.

revokeCertificate

void revokeCertificate(<ByteString> serial, <Date> timestamp, reason, ext)

Add a revoked certificate to the list. This adds the complete DER encoded structure.

Parameters:
serial - the serial number of the certificate to revoke
timestamp - the revocation time, optional, default is now
Number - ) reason the revocation reason
ASN1 - ) ext the crl entry extensions

setIssuer

void setIssuer(<Object> issuer)

Sets the isser name.

The issuer name must be a JavaScript object containing the properties:

• C - the country
• O - the organization
• OU - the organization unit
• CN - the common name

Example:

	var issuer = { C:"UT", O:"ACME Corporation", CN:"Test-CA" };
 

Parameters:
issuer - the issuer name

setNextUpdate

void setNextUpdate(<Date> datetime)

Sets the timestamp for the next update

Parameters:
datetime - the date and time of the next update

setSignatureAlgorithm

void setSignatureAlgorithm(<Number> alg)

Sets the signature algorithm.

Parameters:
alg - the signature algorithm, must be one of Crypto.RSA, Crypto.RSA_SHA256 or Crypto.ECDSA_SHA256

setThisUpdate

void setThisUpdate(<Date> datetime)

Sets the timestamp for this CRL

Parameters:
datetime - the current date and time