net.jsign.jca

Class HashiCorpVaultSigningService

java.lang.Object

net.jsign.jca.HashiCorpVaultSigningService

All Implemented Interfaces:

SigningService

public class HashiCorpVaultSigningService
extends Object
implements SigningService

Signing service using the HashiCorp Vault API. It supports the Google Cloud KMS and Transit secrets engines.

Since:

5.0

See Also:

HashiCorp Vault API - Google Cloud KMS Secrets Engine, HashiCorp Vault API - Transit Secrets Engine

Constructor Summary

Constructors

Constructor and Description
HashiCorpVaultSigningService(String engineURL, String token, Function<String,Certificate[]> certificateStore) Creates a new HashiCorp Vault signing service.

Method Summary

Modifier and Type	Method and Description
List<String>	aliases() Returns the list of key names available in the secrets engine.
Certificate[]	getCertificateChain(String alias) Returns the certificate chain for the alias specified.
String	getName() Returns the name of the service.
SigningServicePrivateKey	getPrivateKey(String alias, char[] password) Returns the private key for the certificate alias specified.
byte[]	sign(SigningServicePrivateKey privateKey, String algorithm, byte[] data) Sign the data with the private key specified.

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.jsign.jca.SigningService

getPrivateKey

Constructor Detail

HashiCorpVaultSigningService

public HashiCorpVaultSigningService(String engineURL,
                                    String token,
                                    Function<String,Certificate[]> certificateStore)

Creates a new HashiCorp Vault signing service.

Parameters:

engineURL - the URL of the HashiCorp Vault secrets engine

token - the HashiCorp Vault token

certificateStore - provides the certificate chain for the keys

Method Detail

aliases

public List<String> aliases()
                     throws KeyStoreException

Returns the list of key names available in the secrets engine. NOTE: This will return the key name only, not the key name and version. HashiCorp Vault does not provide a function to retrieve the key version. The key version will need to be appended to the key name when using the key.

Specified by:

aliases in interface SigningService

Returns:

list of key names

Throws:

KeyStoreException

getCertificateChain

public Certificate[] getCertificateChain(String alias)
                                  throws KeyStoreException

Description copied from interface: SigningService

Returns the certificate chain for the alias specified.

Specified by:

getCertificateChain in interface SigningService

Parameters:

alias - the name of the certificate

Throws:

KeyStoreException

getName

public String getName()

Description copied from interface: SigningService

Returns the name of the service.

Specified by:

getName in interface SigningService

getPrivateKey

public SigningServicePrivateKey getPrivateKey(String alias,
                                              char[] password)
                                       throws UnrecoverableKeyException

Description copied from interface: SigningService

Returns the private key for the certificate alias specified.

Specified by:

getPrivateKey in interface SigningService

Parameters:

alias - the name of the certificate

password - the secret required to access the key

Throws:

UnrecoverableKeyException

sign

public byte[] sign(SigningServicePrivateKey privateKey,
                   String algorithm,
                   byte[] data)
            throws GeneralSecurityException

Description copied from interface: SigningService

Sign the data with the private key specified.

Specified by:

sign in interface SigningService

Parameters:

privateKey - the private key

algorithm - the signing algorithm (for example SHA256withRSA)

data - the data to be signed

Throws:

GeneralSecurityException