Package io.netty.pkitesting

Class RevocationServer

java.lang.Object

io.netty.pkitesting.RevocationServer

public final class RevocationServer
extends java.lang.Object

A simple HTTP server that serves Certificate Revocation Lists.

Issuer certificates can be registered with the server, and revocations of their certificates and be published and added to the revocation lists.

The server is only intended for testing usage, and runs entirely in a single thread.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
private static class	RevocationServer.CrlInfo

Field Summary

Fields

Modifier and Type	Field	Description
private java.lang.String	crlBaseAddress
private com.sun.net.httpserver.HttpServer	crlServer
private static RevocationServer	instance
private java.util.concurrent.atomic.AtomicInteger	issuerCounter
private java.util.concurrent.ConcurrentMap<java.security.cert.X509Certificate,RevocationServer.CrlInfo>	issuers
private java.util.concurrent.ConcurrentMap<java.lang.String,RevocationServer.CrlInfo>	paths

Constructor Summary

Constructors

Modifier	Constructor	Description
private	RevocationServer()

Method Summary

Modifier and Type	Method	Description
private static byte[]	generateCrl(RevocationServer.CrlInfo info)
java.net.URI	getCrlUri(X509Bundle issuer)	Get the URI of the Certificate Revocation List for the given issuer.
static RevocationServer	getInstance()	Get the shared revocation server instance.
void	register(X509Bundle issuer)	Register an issuer with the revocation server.
void	register(X509Bundle issuer, java.security.Provider provider)	Register an issuer with the revocation server.
void	revoke(X509Bundle cert, java.time.Instant time)	Revoke the given certificate with the given revocation time.
private void	start()

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

instance

private static volatile RevocationServer instance

crlServer

private final com.sun.net.httpserver.HttpServer crlServer

crlBaseAddress

private final java.lang.String crlBaseAddress

issuerCounter

private final java.util.concurrent.atomic.AtomicInteger issuerCounter

issuers

private final java.util.concurrent.ConcurrentMap<java.security.cert.X509Certificate,RevocationServer.CrlInfo> issuers

paths

private final java.util.concurrent.ConcurrentMap<java.lang.String,RevocationServer.CrlInfo> paths

Constructor Detail

RevocationServer

private RevocationServer()
                  throws java.lang.Exception

Throws:

java.lang.Exception

Method Detail

getInstance

public static RevocationServer getInstance()
                                    throws java.lang.Exception

Get the shared revocation server instance. This will start the server, if it isn't already running, and bind it to a random port on the loopback address.

Returns:

The revocation server instance.

Throws:

java.lang.Exception - If the server failed to start.

start

private void start()

register

public void register(X509Bundle issuer)

Register an issuer with the revocation server. This must be done before CRLs can be served for that issuer, and before any of its certificates can be revoked.

Parameters:

issuer - The issuer to register.

register

public void register(X509Bundle issuer,
                     java.security.Provider provider)

Register an issuer with the revocation server. This must be done before CRLs can be served for that issuer, and before any of its certificates can be revoked.

Parameters:

issuer - The issuer to register.

provider - The Provider to use (or null to fallback to default)

revoke

public void revoke(X509Bundle cert,
                   java.time.Instant time)

Revoke the given certificate with the given revocation time.

The issuer of the given certificate must be registered before its certifiactes can be revoked.

Parameters:

cert - The certificate to revoke.

time - The time of revocation.

getCrlUri

public java.net.URI getCrlUri(X509Bundle issuer)

Get the URI of the Certificate Revocation List for the given issuer.

Parameters:

issuer - The issuer to get the CRL for.

Returns:

The URI to the CRL for the given issuer, or null if the issuer is not registered.

generateCrl

private static byte[] generateCrl(RevocationServer.CrlInfo info)