CRMF: add the RFC 4211 pkiPublicationInfo and oldCertID controls, a getControlValue() that reads the raw value of any control present, and JCA conveniences for the protocolEncrKey and oldCertID controls.

Author: dghgit

docs/releasenotes.md

@@ -37,6 +37,7 @@ Date: 2026, TBD
 ### 2.1.3 Additional Features and Functionality
 
 - The CRMF certificate request message controls now include the RFC 4211 sec. 6.6 protocolEncrKey control, which names the key a CA is to encrypt its response with: org.bouncycastle.cert.crmf.ProtocolEncrKeyControl carries the SubjectPublicKeyInfo the control is defined to take, and CertificateRequestMessage.getControl() recognises id-regCtrl-protocolEncrKey alongside the regToken, authenticator and pkiArchiveOptions controls it already returned (github PR #2443).
+- The CRMF certificate request message controls now cover all six RFC 4211 sec. 6 registration controls: org.bouncycastle.cert.crmf.PKIPublicationInfoControl (sec. 6.3), which says whether and where the CA should publish the certificate it issues, and OldCertIDControl (sec. 6.5), which names the certificate a request is asking to have replaced, join the regToken, authenticator, pkiArchiveOptions and protocolEncrKey controls, and CertificateRequestMessage.getControl() recognises both. CertificateRequestMessage.getControlValue() returns the raw value of any control present, including one the library has no Control implementation for - getControl() answers those with the same null it uses for a control that is absent - and org.bouncycastle.cert.crmf.jcajce.JcaProtocolEncrKeyControl and JcaOldCertIDControl build the two key- and certificate-bearing controls from a java.security.PublicKey and from the X509Certificate being replaced.
 
 - The OpenPGP smart card API (bcpgsc) can now create signatures on a card as well as decrypt with one. The raw sign and decrypt operations moved onto OpenPGPSmartCard, so a backend can be emulated in software and the simulator exercises the same paths a card does; AbstractOpenPGPDocumentSignatureGenerator detects an external key and routes it to the card, with the content signer supplied through a pluggable PGPContentSignerBuilderProviderFactory; the YubiKey-specific decryptor factories are replaced by generic smart-card ones, ExternalOpenPGPKeyUtils converts an OpenPGPKey or OpenPGPCertificate into an external key, and the YubiKit dependency moves to 3.2.0. YubiKit remains compileOnly, so bcpgsc still ships with no third-party dependencies (github PR #2430).
 

pkix/src/main/java/org/bouncycastle/cert/crmf/CertificateRequestMessage.java

@@ -2,17 +2,20 @@
 
 import java.io.IOException;
 
+import org.bouncycastle.asn1.ASN1Encodable;
 import org.bouncycastle.asn1.ASN1Integer;
 import org.bouncycastle.asn1.ASN1Object;
 import org.bouncycastle.asn1.ASN1ObjectIdentifier;
 import org.bouncycastle.asn1.ASN1Primitive;
 import org.bouncycastle.asn1.ASN1UTF8String;
 import org.bouncycastle.asn1.crmf.AttributeTypeAndValue;
 import org.bouncycastle.asn1.crmf.CRMFObjectIdentifiers;
+import org.bouncycastle.asn1.crmf.CertId;
 import org.bouncycastle.asn1.crmf.CertReqMsg;
 import org.bouncycastle.asn1.crmf.CertTemplate;
 import org.bouncycastle.asn1.crmf.Controls;
 import org.bouncycastle.asn1.crmf.PKIArchiveOptions;
+import org.bouncycastle.asn1.crmf.PKIPublicationInfo;
 import org.bouncycastle.asn1.crmf.PKMACValue;
 import org.bouncycastle.asn1.crmf.POPOSigningKey;
 import org.bouncycastle.asn1.crmf.ProofOfPossession;
@@ -151,11 +154,35 @@ public Control getControl(ASN1ObjectIdentifier type)
             {
                 return new ProtocolEncrKeyControl(SubjectPublicKeyInfo.getInstance(found.getValue()));
             }
+            if (found.getType().equals(CRMFObjectIdentifiers.id_regCtrl_pkiPublicationInfo))
+            {
+                return new PKIPublicationInfoControl(PKIPublicationInfo.getInstance(found.getValue()));
+            }
+            if (found.getType().equals(CRMFObjectIdentifiers.id_regCtrl_oldCertID))
+            {
+                return new OldCertIDControl(CertId.getInstance(found.getValue()));
+            }
         }
 
         return null;
     }
 
+    /**
+     * Return the raw value of the control of passed in type, if present. Unlike
+     * {@link #getControl(ASN1ObjectIdentifier)} this makes no attempt to interpret the value, so a
+     * control this class has no {@link Control} implementation for can still be read, and a null
+     * return means the control is absent rather than unrecognised.
+     *
+     * @param type the type OID of the control to look for.
+     * @return the value of the control of the passed in type, null if the control is not present.
+     */
+    public ASN1Encodable getControlValue(ASN1ObjectIdentifier type)
+    {
+        AttributeTypeAndValue found = findControl(type);
+
+        return found != null ? found.getValue() : null;
+    }
+
     private AttributeTypeAndValue findControl(ASN1ObjectIdentifier type)
     {
         if (controls == null)

pkix/src/main/java/org/bouncycastle/cert/crmf/OldCertIDControl.java

@@ -0,0 +1,74 @@
+package org.bouncycastle.cert.crmf;
+
+import java.math.BigInteger;
+
+import org.bouncycastle.asn1.ASN1Encodable;
+import org.bouncycastle.asn1.ASN1ObjectIdentifier;
+import org.bouncycastle.asn1.crmf.CRMFObjectIdentifiers;
+import org.bouncycastle.asn1.crmf.CertId;
+import org.bouncycastle.asn1.x500.X500Name;
+import org.bouncycastle.asn1.x509.GeneralName;
+
+/**
+ * Carrier for an old certificate ID control, naming the certificate a request is asking to have
+ * replaced - RFC 4211 sec. 6.5.
+ */
+public class OldCertIDControl
+    implements Control
+{
+    private static final ASN1ObjectIdentifier type = CRMFObjectIdentifiers.id_regCtrl_oldCertID;
+
+    private final CertId certId;
+
+    /**
+     * Basic constructor - build from the ID of the certificate to be replaced.
+     *
+     * @param certId the issuer and serial number of the certificate to be replaced.
+     */
+    public OldCertIDControl(CertId certId)
+    {
+        this.certId = certId;
+    }
+
+    /**
+     * Basic constructor - build from the issuer and serial number of the certificate to be
+     * replaced.
+     *
+     * @param issuer the issuer of the certificate to be replaced.
+     * @param serialNumber the serial number of the certificate to be replaced.
+     */
+    public OldCertIDControl(X500Name issuer, BigInteger serialNumber)
+    {
+        this(new CertId(new GeneralName(issuer), serialNumber));
+    }
+
+    /**
+     * Return the type of this control.
+     *
+     * @return CRMFObjectIdentifiers.id_regCtrl_oldCertID
+     */
+    public ASN1ObjectIdentifier getType()
+    {
+        return type;
+    }
+
+    /**
+     * Return the certificate ID associated with this control.
+     *
+     * @return a CertId structure.
+     */
+    public ASN1Encodable getValue()
+    {
+        return certId;
+    }
+
+    /**
+     * Return the certificate ID associated with this control.
+     *
+     * @return a CertId structure.
+     */
+    public CertId getCertId()
+    {
+        return certId;
+    }
+}

pkix/src/main/java/org/bouncycastle/cert/crmf/PKIPublicationInfoControl.java

@@ -0,0 +1,81 @@
+package org.bouncycastle.cert.crmf;
+
+import org.bouncycastle.asn1.ASN1Encodable;
+import org.bouncycastle.asn1.ASN1ObjectIdentifier;
+import org.bouncycastle.asn1.crmf.CRMFObjectIdentifiers;
+import org.bouncycastle.asn1.crmf.PKIPublicationInfo;
+import org.bouncycastle.asn1.crmf.SinglePubInfo;
+
+/**
+ * Carrier for a publication information control, saying whether and where the CA should publish
+ * the certificate it issues - RFC 4211 sec. 6.3.
+ */
+public class PKIPublicationInfoControl
+    implements Control
+{
+    private static final ASN1ObjectIdentifier type = CRMFObjectIdentifiers.id_regCtrl_pkiPublicationInfo;
+
+    private final PKIPublicationInfo publicationInfo;
+
+    /**
+     * Basic constructor - build from the publication information to use.
+     *
+     * @param publicationInfo the publication information for the certificate.
+     */
+    public PKIPublicationInfoControl(PKIPublicationInfo publicationInfo)
+    {
+        this.publicationInfo = publicationInfo;
+    }
+
+    /**
+     * Basic constructor - build from the locations the certificate is to be published at,
+     * which asks for publication (pleasePublish). A null or empty array asks for publication
+     * without saying where ("dontCare"); use {@link #dontPublish()} to ask for none.
+     *
+     * @param pubInfos the locations to publish the certificate at.
+     */
+    public PKIPublicationInfoControl(SinglePubInfo[] pubInfos)
+    {
+        this(new PKIPublicationInfo(pubInfos == null || pubInfos.length == 0 ? null : pubInfos));
+    }
+
+    /**
+     * Return a control asking the CA not to publish the certificate.
+     *
+     * @return a control carrying the dontPublish action.
+     */
+    public static PKIPublicationInfoControl dontPublish()
+    {
+        return new PKIPublicationInfoControl(new PKIPublicationInfo(PKIPublicationInfo.dontPublish));
+    }
+
+    /**
+     * Return the type of this control.
+     *
+     * @return CRMFObjectIdentifiers.id_regCtrl_pkiPublicationInfo
+     */
+    public ASN1ObjectIdentifier getType()
+    {
+        return type;
+    }
+
+    /**
+     * Return the publication information associated with this control.
+     *
+     * @return a PKIPublicationInfo structure.
+     */
+    public ASN1Encodable getValue()
+    {
+        return publicationInfo;
+    }
+
+    /**
+     * Return the publication information associated with this control.
+     *
+     * @return a PKIPublicationInfo structure.
+     */
+    public PKIPublicationInfo getPublicationInfo()
+    {
+        return publicationInfo;
+    }
+}

pkix/src/main/java/org/bouncycastle/cert/crmf/jcajce/JcaOldCertIDControl.java

@@ -0,0 +1,27 @@
+package org.bouncycastle.cert.crmf.jcajce;
+
+import java.math.BigInteger;
+import java.security.cert.X509Certificate;
+
+import javax.security.auth.x500.X500Principal;
+
+import org.bouncycastle.asn1.x500.X500Name;
+import org.bouncycastle.cert.crmf.OldCertIDControl;
+
+/**
+ * JCA convenience for the old certificate ID control - builds the control from the certificate
+ * being replaced, or from its issuer and serial number, rather than from a CertId.
+ */
+public class JcaOldCertIDControl
+    extends OldCertIDControl
+{
+    public JcaOldCertIDControl(X509Certificate certificate)
+    {
+        this(certificate.getIssuerX500Principal(), certificate.getSerialNumber());
+    }
+
+    public JcaOldCertIDControl(X500Principal issuer, BigInteger serialNumber)
+    {
+        super(X500Name.getInstance(issuer.getEncoded()), serialNumber);
+    }
+}

pkix/src/main/java/org/bouncycastle/cert/crmf/jcajce/JcaProtocolEncrKeyControl.java

@@ -0,0 +1,19 @@
+package org.bouncycastle.cert.crmf.jcajce;
+
+import java.security.PublicKey;
+
+import org.bouncycastle.asn1.x509.SubjectPublicKeyInfo;
+import org.bouncycastle.cert.crmf.ProtocolEncrKeyControl;
+
+/**
+ * JCA convenience for the protocol encryption key control - builds the control from a
+ * {@link PublicKey} rather than from its SubjectPublicKeyInfo encoding.
+ */
+public class JcaProtocolEncrKeyControl
+    extends ProtocolEncrKeyControl
+{
+    public JcaProtocolEncrKeyControl(PublicKey publicKey)
+    {
+        super(SubjectPublicKeyInfo.getInstance(publicKey.getEncoded()));
+    }
+}