Package com.pd4ml.pdf.sign

Class CertificateUtils

java.lang.Object

com.pd4ml.pdf.sign.CertificateUtils

public final class CertificateUtils
extends java.lang.Object

Loads the signing identity (private key + certificate chain) used by PdfSigner.sign(java.io.File, java.io.File, com.pd4ml.pdf.sign.CertificateUtils.SigningIdentity, com.pd4ml.pdf.sign.SigningOptions), from any of three sources: a PKCS#12 (.p12/.pfx) keystore file (the private key lives in this process, in the clear, for the duration of the JVM), a PKCS#11 token/HSM (the private key never leaves the token -- every RSA/EC operation is delegated to it via the JDK's SunPKCS11 security provider), or a remote key held by a cloud KMS (AWS KMS, Azure Key Vault, GCP Cloud KMS, ...) reached through a user-supplied RemoteSigner -- see forRemoteKey(java.security.cert.Certificate[], com.pd4ml.pdf.sign.RemoteSigner).

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static class	CertificateUtils.SigningIdentity	Holds the certificate chain to sign with, plus however this identity's private key operations actually get performed: an in-process PrivateKey (PKCS#12; CertificateUtils.SigningIdentity.getProvider() is null, any JCA provider -- normally BouncyCastle -- may perform the RSA/EC operation), an opaque PrivateKey handle tied to one specific Provider (PKCS#11; that exact provider instance must perform the operation, since the key material never leaves the token), or no local key at all, only a RemoteSigner (cloud KMS).

Method Summary

Modifier and Type	Method	Description
static CertificateUtils.SigningIdentity	forRemoteKey(java.security.cert.Certificate[] certificateChain, RemoteSigner remoteSigner)	Builds a signing identity for a key that lives entirely in a remote KMS (AWS KMS, Azure Key Vault, GCP Cloud KMS, or any signing service reachable over the network) -- there is no local PrivateKey; every signature is produced by calling remoteSigner.
static CertificateUtils.SigningIdentity	loadFromPkcs11(java.io.File pkcs11ConfigFile, char[] pin)	Loads the first available private-key alias from a PKCS#11 token, configured by a standard SunPKCS11 config file (the same name=... / library=... / slot=... format documented for -Djava.security.pkcs11.SunPKCS11.provider).
static CertificateUtils.SigningIdentity	loadFromPkcs11(java.io.File pkcs11ConfigFile, char[] pin, java.lang.String alias)	Like loadFromPkcs11(File, char[]), for a token holding more than one key.
static CertificateUtils.SigningIdentity	loadFromPkcs11(java.security.Provider pkcs11Provider, char[] pin, java.lang.String alias)	Like loadFromPkcs11(File, char[], String), for a caller that already has a configured SunPKCS11 Provider instance (e.g.
static CertificateUtils.SigningIdentity	loadFromPkcs12(java.io.File keystoreFile, char[] password)	Loads the first alias found in a PKCS#12 keystore (the common case for a keystore that holds exactly one signing identity).
static CertificateUtils.SigningIdentity	loadFromPkcs12(java.io.InputStream keystoreStream, char[] password, java.lang.String alias)	Loads a specific alias from a PKCS#12 keystore.

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Detail

loadFromPkcs12

public static CertificateUtils.SigningIdentity loadFromPkcs12(java.io.File keystoreFile,
                                                              char[] password)
                                                       throws PdfSigningException

Loads the first alias found in a PKCS#12 keystore (the common case for a keystore that holds exactly one signing identity).

Parameters:

keystoreFile - PKCS#12 file (.p12 / .pfx)

password - keystore AND key password (PKCS#12 normally uses the same password for both)

Throws:

PdfSigningException

loadFromPkcs12

public static CertificateUtils.SigningIdentity loadFromPkcs12(java.io.InputStream keystoreStream,
                                                              char[] password,
                                                              java.lang.String alias)
                                                       throws PdfSigningException

Loads a specific alias from a PKCS#12 keystore.

Parameters:

keystoreStream - PKCS#12 keystore contents; not closed by this method

password - keystore AND key password

alias - alias to load, or null to use the first alias holding a private key

Throws:

PdfSigningException

loadFromPkcs11

public static CertificateUtils.SigningIdentity loadFromPkcs11(java.io.File pkcs11ConfigFile,
                                                              char[] pin)
                                                       throws PdfSigningException

Loads the first available private-key alias from a PKCS#11 token, configured by a standard SunPKCS11 config file (the same name=... / library=... / slot=... format documented for -Djava.security.pkcs11.SunPKCS11.provider). The private key is never copied into this process: every signature operation is performed on the token itself.

Parameters:

pkcs11ConfigFile - SunPKCS11 provider config file describing the token/HSM and its PKCS#11 library

pin - the token's PIN (used as the KeyStore password)

Throws:

PdfSigningException

loadFromPkcs11

public static CertificateUtils.SigningIdentity loadFromPkcs11(java.io.File pkcs11ConfigFile,
                                                              char[] pin,
                                                              java.lang.String alias)
                                                       throws PdfSigningException

Like loadFromPkcs11(File, char[]), for a token holding more than one key.

Throws:

PdfSigningException

loadFromPkcs11

public static CertificateUtils.SigningIdentity loadFromPkcs11(java.security.Provider pkcs11Provider,
                                                              char[] pin,
                                                              java.lang.String alias)
                                                       throws PdfSigningException

Like loadFromPkcs11(File, char[], String), for a caller that already has a configured SunPKCS11 Provider instance (e.g. built with Java 9+'s Provider.configure(String), or shared across several loadFromPkcs11 calls against the same token so the token is only opened once).

Throws:

PdfSigningException

forRemoteKey

public static CertificateUtils.SigningIdentity forRemoteKey(java.security.cert.Certificate[] certificateChain,
                                                            RemoteSigner remoteSigner)
                                                     throws PdfSigningException

Builds a signing identity for a key that lives entirely in a remote KMS (AWS KMS, Azure Key Vault, GCP Cloud KMS, or any signing service reachable over the network) -- there is no local PrivateKey; every signature is produced by calling remoteSigner. Bring your own vendor SDK/HTTP client inside remoteSigner; this library has no vendor dependency of its own.

Parameters:

certificateChain - the signer's certificate (and any intermediates), matching the KMS key

remoteSigner - performs the actual sign operation against the KMS

Throws:

PdfSigningException