Class KeyCertificate

java.lang.Object
com.iizix.license.v2.KeyCertificate
public final class KeyCertificate extends Object
A signing-key certificate (LICENSE-V2-DESIGN.md section 2.4, ruling LV-3): the IIZI-KEYCERT/1 envelope a pinned root signs over a payload of v, kid (the certified key's ID), key (its Ed25519 public half), notBefore and notAfter (epoch milliseconds UTC, inclusive). The envelope's own kid line names the ROOT that signed it; the payload's kid names the key being certified. A licence document carries the certificate of the key that signed it in its cert line, and its kid line must equal this certificate's getKeyID().

Constructed only by LicenseVerifier.verifyCertificate(byte[]), so an instance is a certificate that verified under a pinned root. Its validity at a later instant is isValidAt(Instant).

Author:
Christopher Mindus

  • Field Details

    • VERSION

      public static final int VERSION
      The format version: 1.
      See Also:

    • KEY

      public static final String KEY
      The payload key "key": the certified key, base64url of its 32 bytes.
      See Also:

    • KID

      public static final String KID
      The payload key "kid": the certified key's ID.
      See Also:

    • NOT_AFTER

      public static final String NOT_AFTER
      The payload key "notAfter": the last instant the certificate is valid, epoch milliseconds.
      See Also:

    • NOT_BEFORE

      public static final String NOT_BEFORE
      The payload key "notBefore": the first instant the certificate is valid, epoch milliseconds.
      See Also:

    • V

      public static final String V
      The payload key "v": the format version, VERSION.
      See Also:

    • KEYS

      public static final Set<String> KEYS
      The payload keys, all required.

    • KEY_ID_PATTERN

      public static final Pattern KEY_ID_PATTERN
      A key ID: [A-Za-z0-9][A-Za-z0-9._-]{0,63}, e.g. mls-2026-1.

  • Method Details

    • isKeyID

      public static boolean isKeyID(String text)
      Tells whether a text is a key ID of the form KEY_ID_PATTERN.
      Parameters:
      text - The text, may be null.
      Returns:
      true for a key ID.

    • getBytes

      public byte[] getBytes()
      Gets the certificate bytes, the IIZI-KEYCERT/1 envelope.
      Returns:
      A copy of the bytes.

    • getRootKeyID

      public String getRootKeyID()
      Gets the key ID of the root that signed the certificate.
      Returns:
      The root's key ID, the envelope's kid.

    • getKeyID

      public String getKeyID()
      Gets the certified key's ID.
      Returns:
      The key ID, the payload's kid.

    • getKey

      public PublicKey getKey()
      Gets the certified key.
      Returns:
      The Ed25519 public key.

    • getKeyBytes

      public byte[] getKeyBytes()
      Gets the certified key's 32 bytes.
      Returns:
      A copy of the bytes.

    • getKeyText

      public String getKeyText()
      Gets the certified key as text.
      Returns:
      The key, base64url.

    • getNotBefore

      public Instant getNotBefore()
      Gets the first instant the certificate is valid.
      Returns:
      The instant.

    • getNotAfter

      public Instant getNotAfter()
      Gets the last instant the certificate is valid.
      Returns:
      The instant.

    • isValidAt

      public boolean isValidAt(Instant now)
      Tells whether an instant is inside the validity, both ends inclusive.
      Parameters:
      now - The instant.
      Returns:
      true when notBefore <= now <= notAfter.

    • toString

      public String toString()
      The key IDs and the validity, never the bytes.
      Overrides:
      toString in class Object