Class ClientCertificate

java.lang.Object

com.codename1.backend.ClientCertificate

public final class ClientCertificate
extends Object

A TLS client credential for mutual TLS: a certificate chain and its private key, presented to a server that asks for one. Given to a WebClient through WebClient.setClientCertificate(ClientCertificate).

Two encodings, the two a credential is actually delivered in:

• PEM -- [#pem(byte[], byte[], String)]: the certificate (leaf first, then any intermediates) and the private key, as the text files a CA or a secrets manager hands out. The key may be in a file of its own or in the same one as the certificate.
• PKCS#12 -- [#pkcs12(byte[], String)]: the single .p12/.pfx archive holding both, protected by a password.

The bytes are copied in, never written to disk and never logged: toString names the encoding and nothing else, so a credential that reaches a log line by accident carries nothing secret with it.

What each runtime accepts. The packaged binary hands both encodings to libcurl and OpenSSL, which take every PEM key format OpenSSL reads -- PKCS#8, encrypted PKCS#8 with a passphrase, traditional RSA and EC keys. The local Java SE runtime reads PKCS#12, and PEM keys in unencrypted PKCS#8 (BEGIN PRIVATE KEY) or traditional RSA (BEGIN RSA PRIVATE KEY) form; any other PEM key fails there with an IOException that names the conversion, openssl pkcs8 -topk8 -nocrypt. Prefer PKCS#12 when one credential has to work identically on both.

Method Summary

Modifier and Type	Method	Description
static ClientCertificate	pem(byte[] certificateChain, byte[] privateKey, String passphrase)	A PEM certificate chain and private key.
static ClientCertificate	pkcs12(byte[] archive, String password)	A PKCS#12 archive holding the certificate chain and its private key.
String	toString()	The encoding only; the credential itself never reaches a string.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Method Details

pem

public static ClientCertificate pem(byte[] certificateChain,
 byte[] privateKey,
 String passphrase)

A PEM certificate chain and private key.

Parameters

• certificateChain: the PEM certificate, leaf first, then any intermediates

• privateKey: the PEM private key, or null when it is in certificateChain

• passphrase: the key's passphrase, or null for an unencrypted key

pkcs12

public static ClientCertificate pkcs12(byte[] archive,
 String password)

A PKCS#12 archive holding the certificate chain and its private key.

Parameters

• archive: the .p12/.pfx bytes

• password: the archive's password, or null for none

toString

public String toString()

The encoding only; the credential itself never reaches a string.

Overrides:

toString in class Object