Hey there ,
This week I finally extracted extensions form certificates. X509Certificate class doesn’t contain methods that would just say what extensions are included in certificate. Instead there are two methods getCriticalExtensionOIDs() and getNonCriticalExtensionOIDs() where OID stands for Object Identifier. Such OID number may look like this: “2.5.29.31”, as I worked a bit around this I might remember by heart that it stands for “CRL Distiribution Points” but normal people will doesn’t know that. To make it human readable I mapped around 100 OID’s descriptions in language files. The whole problem is that there is much more OIDs for certificates and I cannot map all of them especially as some are just in use by certain companies. I had to make field in GUI for listing extensions/OIDs that are unknown. I also created new class OIDTranslator as additional level of abstraction to translate OID values. That wasn’t necessary but in the future there can be added some additional methods as getOIDBrothers/Children/Father() which might be helpful.
Having prepared translation for OIDs I could start working on getting extensions and theirs values. Thanks to Bouncy Castle library for most of the extensions I could use similar pice of code:
ASN1Primitive primitive = JcaX509ExtensionUtils.parseExtensionValue(cert.getExtensionValue(oid));
CRLDistPoint point = CRLDistPoint.getInstance(primitive);
Unfortunately this way wasn’t working in all cases but if it worked, then depending on extension, I could use it’s methods to get values from it’s different fields or sometimes just use toString() method. At this point structure of extension varied a lot. Sometimes it could be arrays of bytes, then before saving it into displayable String I changed their format into easier readable Hex digits. Some values could be null what I also had to handle. Basically every certificate extension required me some research about it’s structure and some of them I still had to left unsupported as I was unable to read them well.
One thing that I still want to do now is option for deleting certificates from Truststore and then I will move to creating lists of exceptions/valid_but_distrusted_certificates/etc… For now the idea is to create separate Keystore for each such list to store it properly.
See you next week ,
Paweł