com.ibm.security.certclient.util
Class PkSsCertFactory
- java.lang.Object
com.ibm.security.certclient.util.PkSsCertFactory
All implemented interfaces:
com.ibm.security.certclient.base.PkAttrKind, com.ibm.security.certclient.base.PkCertConstants, com.ibm.security.certclient.base.PkConstants, com.ibm.security.certclient.base.PkHttpConstants, com.ibm.security.certclient.base.PkPollConstants, com.ibm.security.certclient.base.PkRevoConstants
- public final class PkSsCertFactory
- extends Object
- implements com.ibm.security.certclient.base.PkConstants
Field Summary
Fields inherited from interface com.ibm.security.certclient.base.PkConstants |
---|
BIG_ONE, BIG_TWO, DEFAULT_KEY_SIZE, DEFAULT_LIFETIME, DEFAULT_PROVIDER, DEFAULT_RNG, DSA_KEY_TYPE, EC_KEY_TYPE, MD2_WITH_RSA, MD5_WITH_RSA, PKI_DB_CONN, PKI_DB_CONNS, PKI_ISSUER_DN, PKI_ISSUER_HOST, PKI_ISSUER_PORT, PKI_OPER, PKI_ROOT, RSA_KEY_TYPE, SHA1_WITH_DSA, SHA1_WITH_ECDSA, SHA1_WITH_RSA, SHA2_WITH_ECDSA, SHA3_WITH_ECDSA, SHA3_WITH_RSA, SHA5_WITH_ECDSA, SHA5_WITH_RSA |
Fields inherited from interface com.ibm.security.certclient.base.PkAttrKind |
---|
ATTR_APPLIED, ATTR_APPROVED, ATTR_NAMES |
Fields inherited from interface com.ibm.security.certclient.base.PkCertConstants |
---|
CERT_ALGORITHM_ID, CERT_ALGORITHM_NAME, CERT_ALTERNATIVE_NAME, CERT_AUTH_KEY_IDENTIFIER, CERT_BASIC_CONSTRAINTS, CERT_CA_PUBS, CERT_CA_VENDOR, CERT_CMP_VERSION, CERT_CRL_DISTRIBUTION_POINTS, CERT_EXT, CERT_EXT_KEY_USAGE, CERT_HIERARCHICAL, CERT_INIT_PWD, CERT_ISSUER, CERT_ISSUER_ID, CERT_KEY, CERT_KEY_IDENTIFIER, CERT_KEY_TYPE, CERT_KEY_USAGE, CERT_MESSAGE_PROTECTED, CERT_MESSAGE_PROTECTION_ALGORITHM_ID, CERT_MESSAGE_PROTECTION_ALGORITHM_NAME, CERT_MESSAGE_PROTECTION_KEY, CERT_MESSAGE_PROTECTION_PWD, CERT_NAME_CONSTRAINTS, CERT_NETSCAPE_CERT_TYPE, CERT_NOT_AFTER, CERT_NOT_BEFORE, CERT_OPER, CERT_OUTFILENAME, CERT_POLICY_CONSTRAINTS, CERT_POLICY_MAPPINGS, CERT_PRIVATE_KEY, CERT_PRIVATE_KEY_EE, CERT_PRIVATE_KEY_USAGE, CERT_PROVIDER, CERT_PUBLISH_IMMEDIATELY, CERT_RECIPIENT_DN, CERT_REP_HDR, CERT_REQ_ID, CERT_REVO_PUBLIC_KEY, CERT_REVOCATION_PASSPHRASE, CERT_ROOT, CERT_SENDER_KID, CERT_SERIAL_NUMBER, CERT_SUBJECT, CERT_SUBJECT_ALTERNATIVE_NAME, CERT_SUBJECT_ID, CERT_TIME_TO_CHECK_BACK, CERT_VENDOR_TPKI_RA_ENROLL, CERT_VERSION, CERT_VERSION_1, CERT_VERSION_2, CERT_VERSION_3, CERT_X509, KEY_STORE_CERT_ALIAS, KEY_STORE_ENTRY_PWD, KEY_STORE_INIT_CERT_ALIAS, KEY_STORE_INIT_ENTRY_PWD, MAKE_CONF_REQUEST_MESSAGE, MAX_SUBJECT_NAME_LENGTH_TO_STORE_IN_TABLES, sccsid |
Fields inherited from interface com.ibm.security.certclient.base.PkRevoConstants |
---|
REVO_BAD_SINCE_DATE, REVO_CRL_EXT, REVO_OPER, REVO_PUBLISH_IMMEDIATELY, REVO_REASON, REVO_ROOT |
Fields inherited from interface com.ibm.security.certclient.base.PkHttpConstants |
---|
HTTP_BASE_NAME, HTTP_FILE_NAME, HTTP_METHOD, HTTP_ROOT, HTTP_VERSION |
Fields inherited from interface com.ibm.security.certclient.base.PkPollConstants |
---|
POLL_REFERENCE, POLL_ROOT, POLL_TIME_TO_CHECK_BACK |
Method Summary
Modifier and Type | Method and Description |
---|---|
|
newSsCert(int keySize,String subjectDN,int numValidDays,boolean useRSA,boolean useShortSubjectKId,List<String> subjectAltNames,List<String> kUsage,List<String> extKUsage,String provider)
Deprecated.
|
|
newSsCert(int keySize,String subjectDN,int numValidDays,boolean useRSA,boolean useShortSubjectKId,List<String> subjectAltNames,List<String> kUsage,List<String> extKUsage,String provider,KeyPair keyPair)
Deprecated.
|
|
newSsCert(int keySize,String subjectDN,int numValidDays,boolean useRSA,boolean useShortSubjectKId,String provider)
Deprecated.
|
|
newSsCert(int keySize,String subjectDN,int numValidDays,boolean useRSA,boolean useShortSubjectKId,String provider,KeyPair keyPair)
Deprecated.
|
|
newSsCert(int keySize,String subjectDN,int numValidDays,Date notBefore,boolean useRSA,boolean useShortSubjectKId,List<String> subjectAltNames,List<String> kUsage,List<String> extKUsage,String provider)
Deprecated.
|
|
newSsCert(int keySize,String subjectDN,int numValidDays,Date notBefore,boolean useRSA,boolean useShortSubjectKId,List<String> subjectAltNames,List<String> kUsage,List<String> extKUsage,String provider,KeyPair keyPair)
Deprecated.
|
|
newSsCert(int keySize,String subjectDN,int numValidDays,Date notBefore,boolean useRSA,boolean useShortSubjectKId,List<String> subjectAltNames,List<String> kUsage,List<String> extKUsage,String provider,KeyPair keyPair,boolean CA)
Deprecated.
|
|
newSsCert(int keySize,String subjectDN,int numValidDays,Date notBefore,boolean useRSA,boolean useShortSubjectKId,String provider)
Deprecated.
|
|
newSsCert(int keySize,String subjectDN,int numValidDays,Date notBefore,boolean useRSA,boolean useShortSubjectKId,String provider,KeyPair keyPair)
Deprecated.
|
|
newSsCert(int keySize,String keyType,String signatureAlgorithm,String subjectDN,int numValidDays,Date notBefore,boolean useShortSubjectKId,List<String> subjectAltNames,List<String> kUsage,List<String> extKUsage,String provider,KeyPair keyPair,boolean CA)
Create a self-signed certificate with supplied extensions
|
|
newSsCert(String subjectDN)
Deprecated.
|
|
newSsCert(String subjectDN,Date notBefore)
Deprecated.
|
Methods inherited from class java.lang.Object |
---|
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
Method Detail
newSsCert
- @Deprecated
- public static PkSsCertificate newSsCert( String subjectDN)
- throws com.ibm.security.certclient.base.PkRejectionException
Deprecated.
Most simple way to generate a self-signed certificate. Uses all default
values:
- version = 3
- keysize = 1024
- validity period = 365 days from current date
- signatureAlgorithm = SHA1withRSA
- subjectKeyId version = long
- provider = IBMJCE
Parameters:
subjectDN
- Distinguished name which will be both subject and issuer for
this certificate Returns:
a PkSsCertificate type object that implements a self-signed
certificate with the provided attributes
Throws:
com.ibm.security.certclient.base.PkRejectionException
newSsCert
- @Deprecated
- public static PkSsCertificate newSsCert( String subjectDN,
- Date notBefore)
- throws com.ibm.security.certclient.base.PkRejectionException
Deprecated.
Most simple way to generate a self-signed certificate. Uses all default
values:
- version = 3
- keysize = 1024
- validity period = 365 days from current date
- signatureAlgorithm = SHA1withRSA
- subjectKeyId version = long
- provider = IBMJCE
Parameters:
subjectDN
- Distinguished name which will be both subject and issuer for
this certificate notBefore
- Date that this certificate valitity begins. Must be no greater
than 3 days prior to the issuing UTC time. If null,
current Date will be used. Returns:
a PkSsCertificate type object that implements a self-signed
certificate with the provided attributes
Throws:
com.ibm.security.certclient.base.PkRejectionException
newSsCert
- @Deprecated
- public static PkSsCertificate newSsCert( int keySize,
- String subjectDN,
- int numValidDays,
- boolean useRSA,
- boolean useShortSubjectKId,
- String provider)
- throws com.ibm.security.certclient.base.PkRejectionException
Deprecated.
Create a self-signed certificate without any supplied extensions
Parameters:
keySize
- size of key. subjectDN
- Distinguished name which will be both subject and issuer for
this certificate numValidDays
- period of certificate validity. Will be measured from current
date. useRSA
- if true use RSA key with SHA1withRSA signature algorithm else
DSA with SHA1withDSA algorithm useShortSubjectKId
- if true use short form of Subject Key Id else use long form provider
- name of crypto provider Returns:
a PkSsCertificate type object that implements a self-signed
certificate with the provided attributes
Throws:
com.ibm.security.certclient.base.PkRejectionException
newSsCert
- @Deprecated
- public static PkSsCertificate newSsCert( int keySize,
- String subjectDN,
- int numValidDays,
- Date notBefore,
- boolean useRSA,
- boolean useShortSubjectKId,
- String provider)
- throws com.ibm.security.certclient.base.PkRejectionException
Deprecated.
Create a self-signed certificate without any supplied extensions
Parameters:
keySize
- size of key. subjectDN
- Distinguished name which will be both subject and issuer for
this certificate numValidDays
- period of certificate validity. Will be measured from notBefore
date. notBefore
- Date that this certificate valitity begins. Must be no greater
than 3 days prior to the issuing UTC time. If null,
current Date will be used. useRSA
- if true use RSA key with SHA1withRSA signature algorithm else
DSA with SHA1withDSA algorithm useShortSubjectKId
- if true use short form of Subject Key Id else use long form provider
- name of crypto provider Returns:
a PkSsCertificate type object that implements a self-signed
certificate with the provided attributes
Throws:
com.ibm.security.certclient.base.PkRejectionException
newSsCert
- @Deprecated
- public static PkSsCertificate newSsCert( int keySize,
- String subjectDN,
- int numValidDays,
- boolean useRSA,
- boolean useShortSubjectKId,
- String provider,
- KeyPair keyPair)
- throws com.ibm.security.certclient.base.PkRejectionException
Deprecated.
Create a self-signed certificate without any supplied extensions
Parameters:
keySize
- size of key. Not used if keyPair is provided. subjectDN
- Distinguished name which will be both subject and issuer for
this certificate numValidDays
- period of certificaate validity. Will be measured from current
date. useRSA
- if true use RSA key with SHA1withRSA signature algorithm else
DSA with SHA1withDSA algorithm
Not used if keyPair is provided. useShortSubjectKId
- if true use short form of Subject Key Id else use long form provider
- name of crypto provider keyPair
- keypair to use for private/public key Returns:
a PkSsCertificate type object that implements a self-signed
certificate with the provided attributes
Throws:
com.ibm.security.certclient.base.PkRejectionException
newSsCert
- @Deprecated
- public static PkSsCertificate newSsCert( int keySize,
- String subjectDN,
- int numValidDays,
- Date notBefore,
- boolean useRSA,
- boolean useShortSubjectKId,
- String provider,
- KeyPair keyPair)
- throws com.ibm.security.certclient.base.PkRejectionException
Deprecated.
Create a self-signed certificate without any supplied extensions
Parameters:
keySize
- size of key. Not used if keyPair is provided. subjectDN
- Distinguished name which will be both subject and issuer for
this certificate numValidDays
- period of certificaate validity. Will be measured from notBefore
date. notBefore
- Date that this certificate valitity begins. Must be no greater
than 3 days prior to the issuing UTC time. If null,
current Date will be used. useRSA
- if true use RSA key with SHA1withRSA signature algorithm else
DSA with SHA1withDSA algorithm
Not used if keyPair is provided. useShortSubjectKId
- if true use short form of Subject Key Id else use long form provider
- name of crypto provider keyPair
- keypair to use for private/public key Returns:
a PkSsCertificate type object that implements a self-signed
certificate with the provided attributes
Throws:
com.ibm.security.certclient.base.PkRejectionException
newSsCert
- @Deprecated
- public static PkSsCertificate newSsCert( int keySize,
- String subjectDN,
- int numValidDays,
- boolean useRSA,
- boolean useShortSubjectKId,
- List<String> subjectAltNames,
- List<String> kUsage,
- List<String> extKUsage,
- String provider)
- throws com.ibm.security.certclient.base.PkRejectionException
Deprecated.
Create a self-signed certificate with supplied extensions
Parameters:
keySize
- size of key. subjectDN
- Distinguished name which will be both subject and issuer for
this certificate numValidDays
- period of certificaate validity. Will be measured from current
date. useRSA
- if true use RSA key with SHA1withRSA signature algorithm else
DSA with SHA1withDSA algorithm useShortSubjectKId
- if true use short form of Subject Key Id else use long form subjectAltNames
- (optional)list of subject alternate names. Specify null to
indicate that no value is being specified.
kUsage
- (optional)list of Key Usage strings. Acceptable values are-
"digital_signature" "non_repudiation" "key_encipherment"
"data_encipherment" "encipher_only" "decipher_only" extKUsage
- (optional)list of Extended Key Usage strings. Acceptable
values are- "ServerAuth_Id" "ClientAuth_Id" "CodeSigning_Id"
"EmailProtection_Id" "IPSecEndSystem_Id" "IPSecTunnel_Id"
"IPSecUser_Id" "TimeStamping_Id" provider
- name of crypto provider Returns:
a PkSsCertificate type object that implements a self-signed
certificate with the provided attributes
Throws:
com.ibm.security.certclient.base.PkRejectionException
newSsCert
- @Deprecated
- public static PkSsCertificate newSsCert( int keySize,
- String subjectDN,
- int numValidDays,
- Date notBefore,
- boolean useRSA,
- boolean useShortSubjectKId,
- List<String> subjectAltNames,
- List<String> kUsage,
- List<String> extKUsage,
- String provider)
- throws com.ibm.security.certclient.base.PkRejectionException
Deprecated.
Create a self-signed certificate with supplied extensions
Parameters:
keySize
- size of key. subjectDN
- Distinguished name which will be both subject and issuer for
this certificate numValidDays
- period of certificate validity. Will be measured from notBefore
date. notBefore
- Date that this certificate validity begins. Must be no greater
than 3 days prior to the issuing UTC time. If null,
current Date will be used. useRSA
- if true use RSA key with SHA1withRSA signature algorithm else
DSA with SHA1withDSA algorithm useShortSubjectKId
- if true use short form of Subject Key Id else use long form subjectAltNames
- (optional)list of subject alternate names. Specify null to
indicate that no value is being specified.
- email email address for the subject , e.g. newUser@us.ibm.com
- dnsName domain name server name. Name is not case sensitive. e.g host.domain
- uri universal resource identifier ,e.g http://www.tivoli.com, ftp://www.ibm.com/
- ipaddress ipaddress for the subject , e.g. 127.0.0.1
kUsage
- (optional)list of Key Usage strings. Acceptable values are-
"digital_signature" "non_repudiation" "key_encipherment"
"data_encipherment" "encipher_only" "decipher_only" extKUsage
- (optional)list of Extended Key Usage strings. Acceptable
values are- "ServerAuth_Id" "ClientAuth_Id" "CodeSigning_Id"
"EmailProtection_Id" "IPSecEndSystem_Id" "IPSecTunnel_Id"
"IPSecUser_Id" "TimeStamping_Id" provider
- name of crypto provider Returns:
a PkSsCertificate type object that implements a self-signed
certificate with the provided attributes
Throws:
com.ibm.security.certclient.base.PkRejectionException
newSsCert
- @Deprecated
- public static PkSsCertificate newSsCert( int keySize,
- String subjectDN,
- int numValidDays,
- boolean useRSA,
- boolean useShortSubjectKId,
- List<String> subjectAltNames,
- List<String> kUsage,
- List<String> extKUsage,
- String provider,
- KeyPair keyPair)
- throws com.ibm.security.certclient.base.PkRejectionException
Deprecated.
Create a self-signed certificate with supplied extensions
Parameters:
keySize
- size of key. Not used if keyPair is provided. subjectDN
- Distinguished name which will be both subject and issuer for
this certificate numValidDays
- period of certificate validity. Will be measured from current
date. useRSA
- if true use RSA key with SHA1withRSA signature algorithm else
DSA with SHA1withDSA algorithm
Not used if keyPair is provided. useShortSubjectKId
- if true use short form of Subject Key Id else use long form subjectAltNames
- (optional)list of subject alternate names. Specify null to
indicate that no value is being specified.
- email email address for the subject , e.g. newUser@us.ibm.com
- dnsName domain name server name. Name is not case sensitive. e.g host.domain
- uri universal resource identifier ,e.g http://www.tivoli.com, ftp://www.ibm.com/
- ipaddress ipaddress for the subject , e.g. 127.0.0.1
kUsage
- (optional)list of Key Usage strings. Acceptable values are-
"digital_signature" "non_repudiation" "key_encipherment"
"data_encipherment" "encipher_only" "decipher_only" extKUsage
- (optional)list of Extended Key Usage strings. Acceptable
values are- "ServerAuth_Id" "ClientAuth_Id" "CodeSigning_Id"
"EmailProtection_Id" "IPSecEndSystem_Id" "IPSecTunnel_Id"
"IPSecUser_Id" "TimeStamping_Id" provider
- name of crypto provider keyPair
- keypair to use for private/public keys
if null, keypair will be generated Returns:
a PkSsCertificate type object that implements a self-signed
certificate with the provided attributes
Throws:
com.ibm.security.certclient.base.PkRejectionException
newSsCert
- @Deprecated
- public static PkSsCertificate newSsCert( int keySize,
- String subjectDN,
- int numValidDays,
- Date notBefore,
- boolean useRSA,
- boolean useShortSubjectKId,
- List<String> subjectAltNames,
- List<String> kUsage,
- List<String> extKUsage,
- String provider,
- KeyPair keyPair)
- throws com.ibm.security.certclient.base.PkRejectionException
Deprecated.
Create a self-signed certificate with supplied extensions
Parameters:
keySize
- size of key. Not used if keyPair is provided. subjectDN
- Distinguished name which will be both subject and issuer for
this certificate numValidDays
- period of certificate validity. Will be measured from notBefore
date. notBefore
- Date that this certificate validity begins. Must be no greater
than 3 days prior to the issuing UTC time. If null,
current Date will be used. useRSA
- if true use RSA key with SHA1withRSA signature algorithm else
DSA with SHA1withDSA algorithm
Not used if keyPair is provided. useShortSubjectKId
- if true use short form of Subject Key Id else use long form subjectAltNames
- (optional)list of subject alternate names. Specify null to
indicate that no value is being specified.
- email email address for the subject , e.g. newUser@us.ibm.com
- dnsName domain name server name. Name is not case sensitive. e.g host.domain
- uri universal resource identifier ,e.g http://www.tivoli.com, ftp://www.ibm.com/
- ipaddress ipaddress for the subject , e.g. 127.0.0.1
kUsage
- (optional)list of Key Usage strings. Acceptable values are-
"digital_signature" "non_repudiation" "key_encipherment"
"data_encipherment" "encipher_only" "decipher_only" extKUsage
- (optional)list of Extended Key Usage strings. Acceptable
values are- "ServerAuth_Id" "ClientAuth_Id" "CodeSigning_Id"
"EmailProtection_Id" "IPSecEndSystem_Id" "IPSecTunnel_Id"
"IPSecUser_Id" "TimeStamping_Id" provider
- name of crypto provider keyPair
- keypair to use for private/public keys
if null, keypair will be generated Returns:
a PkSsCertificate type object that implements a self-signed
certificate with the provided attributes
Throws:
com.ibm.security.certclient.base.PkRejectionException
newSsCert
- @Deprecated
- public static PkSsCertificate newSsCert( int keySize,
- String subjectDN,
- int numValidDays,
- Date notBefore,
- boolean useRSA,
- boolean useShortSubjectKId,
- List<String> subjectAltNames,
- List<String> kUsage,
- List<String> extKUsage,
- String provider,
- KeyPair keyPair,
- boolean CA)
- throws com.ibm.security.certclient.base.PkRejectionException
Deprecated.
Create a self-signed certificate with supplied extensions
Parameters:
keySize
- size of key. Not used if keyPair is provided. subjectDN
- Distinguished name which will be both subject and issuer for
this certificate numValidDays
- period of certificate validity. Will be measured from notBefore
date. notBefore
- Date that this certificate validity begins. Must be no greater
than 3 days prior to the issuing UTC time. If null,
current Date will be used. useRSA
- if true use RSA key with SHA1withRSA signature algorithm else
DSA with SHA1withDSA algorithm
Not used if keyPair is provided. useShortSubjectKId
- if true use short form of Subject Key Id else use long form subjectAltNames
- (optional)list of subject alternate names. Specify null to
indicate that no value is being specified.
- email email address for the subject , e.g. newUser@us.ibm.com
- dnsName domain name server name. Name is not case sensitive. e.g host.domain
- uri universal resource identifier ,e.g http://www.tivoli.com, ftp://www.ibm.com/
- ipaddress ipaddress for the subject , e.g. 127.0.0.1
kUsage
- (optional)list of Key Usage strings. Acceptable values are-
"digital_signature" "non_repudiation" "key_encipherment"
"data_encipherment" "encipher_only" "decipher_only" extKUsage
- (optional)list of Extended Key Usage strings. Acceptable
values are- "ServerAuth_Id" "ClientAuth_Id" "CodeSigning_Id"
"EmailProtection_Id" "IPSecEndSystem_Id" "IPSecTunnel_Id"
"IPSecUser_Id" "TimeStamping_Id" provider
- name of crypto provider keyPair
- keypair to use for private/public keys
if null, keypair will be generated CA
- true - create this certificate as a CA with basic constraints
false - create this certificate as an end-user without basic constraints Returns:
a PkSsCertificate type object that implements a self-signed
certificate with the provided attributes
Throws:
com.ibm.security.certclient.base.PkRejectionException
newSsCert
- public static PkSsCertificate newSsCert( int keySize,
- String keyType,
- String signatureAlgorithm,
- String subjectDN,
- int numValidDays,
- Date notBefore,
- boolean useShortSubjectKId,
- List<String> subjectAltNames,
- List<String> kUsage,
- List<String> extKUsage,
- String provider,
- KeyPair keyPair,
- boolean CA)
- throws com.ibm.security.certclient.base.PkRejectionException
Create a self-signed certificate with supplied extensions
Parameters:
keySize
- size of key. Not used if keyPair is provided. keyType
- key type. Valid key types are: RSA,DSA,EC. Not used if keyPair is provided. signatureAlgorithm
- Signature algorithm. subjectDN
- Distinguished name which will be both subject and issuer for
this certificate numValidDays
- period of certificate validity. Will be measured from notBefore
date. notBefore
- Date that this certificate validity begins. Must be no greater
than 3 days prior to the issuing UTC time. If null,
current Date will be used. useShortSubjectKId
- if true use short form of Subject Key Id else use long form subjectAltNames
- (optional)list of subject alternate names. Specify null to
indicate that no value is being specified.
- email email address for the subject , e.g. newUser@us.ibm.com
- dnsName domain name server name. Name is not case sensitive. e.g host.domain
- uri universal resource identifier ,e.g http://www.tivoli.com, ftp://www.ibm.com/
- ipaddress ipaddress for the subject , e.g. 127.0.0.1
kUsage
- (optional)list of Key Usage strings. Acceptable values are-
"digital_signature" "non_repudiation" "key_encipherment"
"data_encipherment" "encipher_only" "decipher_only" extKUsage
- (optional)list of Extended Key Usage strings. Acceptable
values are- "ServerAuth_Id" "ClientAuth_Id" "CodeSigning_Id"
"EmailProtection_Id" "IPSecEndSystem_Id" "IPSecTunnel_Id"
"IPSecUser_Id" "TimeStamping_Id" provider
- name of crypto provider keyPair
- keypair to use for private/public keys
if null, keypair will be generated CA
- true - create this certificate as a CA with basic constraints
false - create this certificate as an end-user without basic constraints Returns:
a PkSsCertificate type object that implements a self-signed
certificate with the provided attributes
Throws:
com.ibm.security.certclient.base.PkRejectionException