Download TLS Extensions

TLS Extensions – iSaSiLk
also will hold a private key of the client. However, instead of containing the client certificate chain, it only will refer it by means of URLAndOptionalHash object(s).
For convenience class KeyAndCertURL provides a constructor that can be featured with
certificate and URL values to automatically calculate the required
URLAndOptionalHash objects. However, client certificate urls are intended for use on
constrained clients where the certificates may not be available. Thus you first will have to
create the URLAndOptionalHash object(s) from the URL(s) that refer to the client certificate(s). If you want to include the hash value(s) of the referred individual certificates
or pki path, you already will have calculated it on another, not constrained platform.
When finally creating the KeyAndCertURL object from the URLAndOptionalHash list
also provide the private key of the client and the cert chain type (pki_path or
individual_certs) of the CertificateURL message to be sent. Furthermore you will
have to specify if the client certificate shall be used for RSA signing, DSA signing, or
RSA or DSA based DH key exchange (see Javadoc). This information is later used to
check if the KeyAndCertURL is appropriate for the certificate types the server may sent
within its CertificateRequest message.
// URLAndOptionalHash referring a pki path with the client certs
String pkiPathUrl = ...;
URLAndOptionalHash pkiPathUrlAndHash =
new URLAndOptionalHash(pkiPathUrl);
// optional hash calculated over the DER encoded pki path
byte[] pkiPathHash = ...;
pkiPathUrlAndHash.setHash(pkiPathHash);
// create URLAndOptionalHash list containing one element:
URLAndOptionalHash[] urlAndOptionalHashList = { pkiPathUrlAndHash };
// create client credentials (certificate type is RSA_SIGN)
int certType = SSLContext.CERTTYPE_RSA_SIGN;
// the private key of the client:
PrivateKey privateKey ...;
// cert chain type is pki_path:
int certChainType = KeyAndCertURL.CHT_PKI_PATH;
// create KeyAndCertURL
KeyAndCertURL clientCredentials =
new KeyAndCertURL(certType, privateKey, certChainType,
urlAndOptionalHashList);
// add credentials to your SSLClientContext
SSLClientContext clientContext = new SSLClientContext();
clientContext.addClientCredentials(clientCredentials);
Listing 4-13: Creating Client credentials as KeyAndCertURL of cert chain type pki_path
Stiftung SIC – http://jce.iaik.tugraz.at
21