Package org.bouncycastle.cert.ct

package org.bouncycastle.cert.ct
Decoders for the embedded Signed Certificate Timestamp extensions defined by RFC 6962 (Certificate Transparency v1) and RFC 9162 (CT v2).

For v1, SignedCertificateTimestampList parses the TLS-encoded list of SignedCertificateTimestamp entries carried inside the 1.3.6.1.4.1.11129.2.4.2 extension. For v2, TransItemList parses the TLS-encoded list of TransItem entries carried inside the 1.3.101.75 extension; SCT-typed items expose their payload via SignedCertificateTimestampDataV2.

This is a decode-only API: verifying an SCT against a log's STH (fetching the inclusion proof and checking the log's public-key signature) is intentionally not provided here.

  • Classes
    Class
    Description
    SctExtension
    One Extension entry inside the sct_extensions list of an RFC 9162 (CT v2) SignedCertificateTimestampDataV2.
    SignedCertificateTimestamp
    A single Signed Certificate Timestamp (SCT) in the RFC 6962 (CT v1) wire format.
    SignedCertificateTimestampDataV2
    The SCT body carried inside an RFC 9162 (CT v2) TransItem whose versioned_type is x509_sct_v2 (0x0102) or precert_sct_v2 (0x0103).
    SignedCertificateTimestampList
    RFC 6962 (CT v1) SignedCertificateTimestampList: the TLS-encoded structure carried inside the embedded-SCT certificate extension and the OCSP SCT-list extension.
    TransItem
    One TLS-encoded item from an RFC 9162 (CT v2) TransItemList.
    TransItemList
    RFC 9162 (CT v2) TransItemList: the TLS-encoded structure carried inside the Transparency Information X.509v3 extension (X509ObjectIdentifiers.id_ce_ct_transparencyInformation).