Question

In Java How do you extract “issued to” or user from a SSL cert within an HttpRequest?

what I’m working with:

 Object certChain = request
    .getAttribute("javax.servlet.request.X509Certificate");
if (certChain != null)
{
  X509Certificate certs[] = (X509Certificate[]) certChain;
  X509Certificate cert = certs[0];
  String user = cert.getSubjectDN().getName();
}

Answer 1

Here’s the code to extract the “Issued To” aka Subject for a cert within an httprequest,

import java.security.cert.X509Certificate;
import javax.naming.InvalidNameException;
import javax.naming.ldap.LdapName;
import javax.naming.ldap.Rdn;

X509Certificate[] certs = (X509Certificate[])request.getAttribute("javax.servlet.request.X509Certificate");
if ((certs == null) || (certs.length == 0)) {
   return null;
}

String name = certs[0].getSubjectX500Principal().getName(); // if you are looking for issuer then use cert[0].getIssuerX500Principal().getName();
LdapName ldapName = null;
try {
   ldapName = new LdapName(name);
} catch (InvalidNameException e) {
   throw new RuntimeException(e);
}

for (Rdn rdn : ldapName.getRdns()) {
   String type = rdn.getType();
   if ("CN".equals(type)) { 
        String issuedTo = (String)rdn.getValue();
   }
}

JDK 6 has the API getSubjectX500Prinicpal() in it’s rt.jar locally, not sure about the previous versions,