public abstract class X509CRL extends CRL implements X509Extension
Abstract class for an X.509 Certificate Revocation List (CRL). A CRL is a time-stamped list identifying revoked certificates. It is signed by a Certificate Authority (CA) and made freely available in a public repository.
Each revoked certificate is identified in a CRL by its certificate serial number. When a certificate-using system uses a certificate (e.g., for verifying a remote user's digital signature), that system not only checks the certificate signature and validity but also acquires a suitably- recent CRL and checks that the certificate serial number is not on that CRL. The meaning of "suitably-recent" may vary with local policy, but it usually means the most recently-issued CRL. A CA issues a new CRL on a regular periodic basis (e.g., hourly, daily, or weekly). Entries are added to CRLs as revocations occur, and an entry may be removed when the certificate expiration date is reached.
The X.509 v2 CRL format is described below in ASN.1:
 CertificateList  ::=  SEQUENCE  {
     tbsCertList          TBSCertList,
     signatureAlgorithm   AlgorithmIdentifier,
     signature            BIT STRING  }
 
 More information can be found in RFC 3280: Internet X.509 Public Key Infrastructure Certificate and CRL Profile.
 The ASN.1 definition of tbsCertList is:
 
 TBSCertList  ::=  SEQUENCE  {
     version                 Version OPTIONAL,
                             -- if present, must be v2
     signature               AlgorithmIdentifier,
     issuer                  Name,
     thisUpdate              ChoiceOfTime,
     nextUpdate              ChoiceOfTime OPTIONAL,
     revokedCertificates     SEQUENCE OF SEQUENCE  {
         userCertificate         CertificateSerialNumber,
         revocationDate          ChoiceOfTime,
         crlEntryExtensions      Extensions OPTIONAL
                                 -- if present, must be v2
         }  OPTIONAL,
     crlExtensions           [0]  EXPLICIT Extensions OPTIONAL
                                  -- if present, must be v2
     }
 
 CRLs are instantiated using a certificate factory. The following is an example of how to instantiate an X.509 CRL:
 try (InputStream inStream = new FileInputStream("fileName-of-crl")) {
     CertificateFactory cf = CertificateFactory.getInstance("X.509");
     X509CRL crl = (X509CRL)cf.generateCRL(inStream);
 }
 CRL, 
CertificateFactory, 
X509Extension| Modifier | Constructor and Description | 
|---|---|
| protected  | X509CRL()Constructor for X.509 CRLs. | 
| Modifier and Type | Method and Description | 
|---|---|
| boolean | equals(Object other)Compares this CRL for equality with the given
 object. | 
| abstract byte[] | getEncoded()Returns the ASN.1 DER-encoded form of this CRL. | 
| abstract Principal | getIssuerDN()Denigrated, replaced by getIssuerX500Principal(). | 
| X500Principal | getIssuerX500Principal()Returns the issuer (issuer distinguished name) value from the
 CRL as an  X500Principal. | 
| abstract Date | getNextUpdate()Gets the  nextUpdatedate from the CRL. | 
| abstract X509CRLEntry | getRevokedCertificate(BigInteger serialNumber)Gets the CRL entry, if any, with the given certificate serialNumber. | 
| X509CRLEntry | getRevokedCertificate(X509Certificate certificate)Get the CRL entry, if any, for the given certificate. | 
| abstract Set<? extends X509CRLEntry> | getRevokedCertificates()Gets all the entries from this CRL. | 
| abstract String | getSigAlgName()Gets the signature algorithm name for the CRL
 signature algorithm. | 
| abstract String | getSigAlgOID()Gets the signature algorithm OID string from the CRL. | 
| abstract byte[] | getSigAlgParams()Gets the DER-encoded signature algorithm parameters from this
 CRL's signature algorithm. | 
| abstract byte[] | getSignature()Gets the  signaturevalue (the raw signature bits) from
 the CRL. | 
| abstract byte[] | getTBSCertList()Gets the DER-encoded CRL information, the
  tbsCertListfrom this CRL. | 
| abstract Date | getThisUpdate()Gets the  thisUpdatedate from the CRL. | 
| abstract int | getVersion()Gets the  version(version number) value from the CRL. | 
| int | hashCode()Returns a hashcode value for this CRL from its
 encoded form. | 
| abstract void | verify(PublicKey key)Verifies that this CRL was signed using the
 private key that corresponds to the given public key. | 
| void | verify(PublicKey key,
      Provider sigProvider)Verifies that this CRL was signed using the
 private key that corresponds to the given public key. | 
| abstract void | verify(PublicKey key,
      String sigProvider)Verifies that this CRL was signed using the
 private key that corresponds to the given public key. | 
clone, finalize, getClass, notify, notifyAll, wait, wait, waitgetCriticalExtensionOIDs, getExtensionValue, getNonCriticalExtensionOIDs, hasUnsupportedCriticalExtensionpublic boolean equals(Object other)
other object is an
 instanceof X509CRL, then
 its encoded form is retrieved and compared with the
 encoded form of this CRL.equals in class Objectother - the object to test for equality with this CRL.Object.hashCode(), 
HashMappublic int hashCode()
hashCode in class ObjectObject.equals(java.lang.Object), 
System.identityHashCode(java.lang.Object)public abstract byte[] getEncoded()
                           throws CRLException
CRLException - if an encoding error occurs.public abstract void verify(PublicKey key) throws CRLException, NoSuchAlgorithmException, InvalidKeyException, NoSuchProviderException, SignatureException
key - the PublicKey used to carry out the verification.NoSuchAlgorithmException - on unsupported signature
 algorithms.InvalidKeyException - on incorrect key.NoSuchProviderException - if there's no default provider.SignatureException - on signature errors.CRLException - on encoding errors.public abstract void verify(PublicKey key, String sigProvider) throws CRLException, NoSuchAlgorithmException, InvalidKeyException, NoSuchProviderException, SignatureException
key - the PublicKey used to carry out the verification.sigProvider - the name of the signature provider.NoSuchAlgorithmException - on unsupported signature
 algorithms.InvalidKeyException - on incorrect key.NoSuchProviderException - on incorrect provider.SignatureException - on signature errors.CRLException - on encoding errors.public void verify(PublicKey key, Provider sigProvider) throws CRLException, NoSuchAlgorithmException, InvalidKeyException, SignatureException
abstract
 and it provides a default implementation.key - the PublicKey used to carry out the verification.sigProvider - the signature provider.NoSuchAlgorithmException - on unsupported signature
 algorithms.InvalidKeyException - on incorrect key.SignatureException - on signature errors.CRLException - on encoding errors.public abstract int getVersion()
version (version number) value from the CRL.
 The ASN.1 definition for this is:
 
 version    Version OPTIONAL,
             -- if present, must be v2
 Version  ::=  INTEGER  {  v1(0), v2(1), v3(2)  }
             -- v3 does not apply to CRLs but appears for consistency
             -- with definition of Version for certs
 public abstract Principal getIssuerDN()
issuer
 as an implementation specific Principal object, which should not be
 relied upon by portable code.
 
 Gets the issuer (issuer distinguished name) value from
 the CRL. The issuer name identifies the entity that signed (and
 issued) the CRL.
 
The issuer name field contains an X.500 distinguished name (DN). The ASN.1 definition for this is:
 issuer    Name
 Name ::= CHOICE { RDNSequence }
 RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
 RelativeDistinguishedName ::=
     SET OF AttributeValueAssertion
 AttributeValueAssertion ::= SEQUENCE {
                               AttributeType,
                               AttributeValue }
 AttributeType ::= OBJECT IDENTIFIER
 AttributeValue ::= ANY
 
 The Name describes a hierarchical name composed of
 attributes,
 such as country name, and corresponding values, such as US.
 The type of the AttributeValue component is determined by
 the AttributeType; in general it will be a
 directoryString. A directoryString is usually
 one of PrintableString,
 TeletexString or UniversalString.public X500Principal getIssuerX500Principal()
X500Principal.
 It is recommended that subclasses override this method.
X500Principal representing the issuer
          distinguished namepublic abstract Date getThisUpdate()
thisUpdate date from the CRL.
 The ASN.1 definition for this is:
 
 thisUpdate   ChoiceOfTime
 ChoiceOfTime ::= CHOICE {
     utcTime        UTCTime,
     generalTime    GeneralizedTime }
 thisUpdate date from the CRL.public abstract Date getNextUpdate()
nextUpdate date from the CRL.nextUpdate date from the CRL, or null if
 not present.public abstract X509CRLEntry getRevokedCertificate(BigInteger serialNumber)
serialNumber - the serial number of the certificate for which a CRL entry
 is to be looked upX509CRLEntrypublic X509CRLEntry getRevokedCertificate(X509Certificate certificate)
This method can be used to lookup CRL entries in indirect CRLs, that means CRLs that contain entries from issuers other than the CRL issuer. The default implementation will only return entries for certificates issued by the CRL issuer. Subclasses that wish to support indirect CRLs should override this method.
certificate - the certificate for which a CRL entry is to be looked
   upNullPointerException - if certificate is nullpublic abstract Set<? extends X509CRLEntry> getRevokedCertificates()
X509CRLEntrypublic abstract byte[] getTBSCertList()
                               throws CRLException
tbsCertList from this CRL.
 This can be used to verify the signature independently.CRLException - if an encoding error occurs.public abstract byte[] getSignature()
signature value (the raw signature bits) from
 the CRL.
 The ASN.1 definition for this is:
 signature BIT STRING
public abstract String getSigAlgName()
 signatureAlgorithm   AlgorithmIdentifier
 AlgorithmIdentifier  ::=  SEQUENCE  {
     algorithm               OBJECT IDENTIFIER,
     parameters              ANY DEFINED BY algorithm OPTIONAL  }
                             -- contains a value of the type
                             -- registered for use with the
                             -- algorithm object identifier value
 
 The algorithm name is determined from the algorithm
 OID string.
public abstract String getSigAlgOID()
See getSigAlgName for
 relevant ASN.1 definitions.
public abstract byte[] getSigAlgParams()
AlgorithmParameters
 and instantiate with the name returned by
 getSigAlgName.
 See getSigAlgName for
 relevant ASN.1 definitions.
 Submit a bug or feature 
For further API reference and developer documentation, see Java SE Documentation. That documentation contains more detailed, developer-targeted descriptions, with conceptual overviews, definitions of terms, workarounds, and working code examples.
 Copyright © 1993, 2017, Oracle and/or its affiliates.  All rights reserved. Use is subject to license terms. Also see the documentation redistribution policy.