Interpreting SubjectAlternativeNames

Question

Hi,
I have the following code and i am trying to obtain the name field stored in the Subject Alternative Name with oid "1.3.6.1.4.1.5734.1.1" in a X509Certificate object.
// <X509Certificate object> obtained from a CMS message created with the BouncyCastle API.
java.security.cert.X509Certificate cert =<X509Certificate object>
Collection altNames = cert.getSubjectAlternativeNames();
for (Iterator ani = altNames.iterator(); ani.hasNext();)
logger.info(ani.next().toString());
This is the output: (only one element of directoryName type)
[4, 1.3.6.1.4.1.5734.1.1=#13087573756172696f31,1.3.6.1.4.1.5734.1.2=#13086170653175737531,1.3.6.1.4.1.5734.1.3=#13086170653275737561,1.3.6.1.4.1.5734.1.4=#1309303030303030303161]
I am not able to obtain a GeneralName or X509Name object that let me read this content. Does anybody know how to interpret this collection getting each oid value separately?.
Thanks all.

Answer 1

BouncyCastle appears not to implement the getSubjectAlternativeNames function, so it is implemented by the Sun package (the function is not abstract, as mentioned in the Javadoc below).
So the directoryname is returned as a RFC2253 string, but in a way that is difficult to use. For instance, the value you need is printed in hexadecimal, instead of translated into a String (I don't know why, because the value is a PrintableString, not an OCTET STRING.)
1.3.6.1.4.1.5734.1.1=#13 08 75 73 75 61 72 69 6f 31
Ordinary directoryNames are printed correctly, but not yours. It is a pity.
Could you try to use the ASN.1 functions from BouncyCastle directly, instead of struggling with the default implementation of Sun? It is a process that requires a lot of work (read the RFC of X.509 and understand some ASN.1 for understanding how to extract the correct values from the directoryName part of the Subject Alternative Names returned by getExtension, for instance), but you will not find undesired surprises.
By the way, your ASN.1 value was printed by DUMPASN1 as "usuario1". I always guess that the words in Spanish are completely different of Portuguese, but in this case the word for "user" in Portuguese is "usu&aacute;rio" that is not so different of "usuario".
C>hd test.bin
0000 13 08 75 73 75 61 72 69 6F 31 ..usuario1
C>dumpasn1 -a test.bin
0 13 8: PrintableString 'usuario1'
The Javadoc.
public Collection<List<?>> getSubjectAlternativeNames()
throws CertificateParsingExceptionGets an immutable collection of subject alternative names from the SubjectAltName extension, (OID = 2.5.29.17).
The ASN.1 definition of the SubjectAltName extension is:
SubjectAltName ::= GeneralNames
GeneralNames :: = SEQUENCE SIZE (1..MAX) OF GeneralName
GeneralName ::= CHOICE {
otherName [0] OtherName,
rfc822Name [1] IA5String,
dNSName [2] IA5String,
x400Address [3] ORAddress,
directoryName [4] Name,
ediPartyName [5] EDIPartyName,
uniformResourceIdentifier [6] IA5String,
iPAddress [7] OCTET STRING,
registeredID [8] OBJECT IDENTIFIER}
If this certificate does not contain a SubjectAltName extension, null is returned. Otherwise, a Collection is returned with an entry representing each GeneralName included in the extension. Each entry is a List whose first entry is an Integer (the name type, 0-8) and whose second entry is a String or a byte array (the name, in string or ASN.1 DER encoded form, respectively).
RFC 822, DNS, and URI names are returned as Strings, using the well-established string formats for those types (subject to the restrictions included in RFC 2459). IPv4 address names are returned using dotted quad notation. IPv6 address names are returned in the form "a1:a2:...:a8", where a1-a8 are hexadecimal values representing the eight 16-bit pieces of the address. OID names are returned as Strings represented as a series of nonnegative integers separated by periods. And directory names (distinguished names) are returned in RFC 2253 string format. No standard string format is defined for otherNames, X.400 names, EDI party names, or any other type of names. They are returned as byte arrays containing the ASN.1 DER encoded form of the name.
Note that the Collection returned may contain more than one name of the same type. Also, note that the returned Collection is immutable and any entries containing byte arrays are cloned to protect against subsequent modifications.
This method was added to version 1.4 of the Java 2 Platform Standard Edition. In order to maintain backwards compatibility with existing service providers, this method is not abstract and it provides a default implementation. Subclasses should override this method with a correct implementation.
Returns:
an immutable Collection of subject alternative names (or null)
Throws:
CertificateParsingException - if the extension cannot be decoded
Since:
1.4