ADD certificate in HTTP Header

Question

I want to add a Certificate in http header. My questions are :

1. Do we have to send it as byte Array? or as a String?
2. If yes , the toString method of java.securit.PublicKey does it build a good string representation?
3. Isn't it too long to be inserted in an http header or not? Thanks

Code :

public byte []   getCertificate() throws IOException, KeyStoreException, CertificateException, NoSuchAlgorithmException {
    if (Configuration.getSignaturekeyStoreLocation()==null || ewalletConfiguration.getSignaturekeyStoreLocation().isEmpty()) {
            throw new IllegalArgumentException("Keystore url must not be null");
        }
        FileInputStream is = new FileInputStream(Configuration.getSignaturekeyStoreLocation());
        char[] keyPassword = ewalletConfiguration.getSignaturekeyStorePassword().toCharArray();
        KeyStore keystore = KeyStore.getInstance("JKS");
        //keyStore Password
        keystore.load(is, keyPassword);
        //
        final Certificate cert = (Certificate) keystore.getCertificate(Configuration.getSignatureCertificateAlias());

        return  cert.getEncoded();
}``

`

Answer 1

There are different purposes why there would be a certificate in the header, so it would be simpler if you'd explain the use case.

Do we have to send it as byte Array? or as a String?

HTTP headers are always a string, I'd assume you will need to use base64 encoding.

If yes , the toString method of java.securit.PublicKey does it build a good string representation?

No, the public key is only a public key, not the whole certificate (a certificate contains the public key). The simplest way to get a (x509) certificate representation is using getEncoded method

Isn't it too long to be inserted in an http header or not? Thanks

It may. Usually http servers are having certain header buffer (eg apache tomat has/had default 8kB buffer, IIS 16kB) so if the returned encoded response would be larger, the server may return an error response. Even I know some clients / browsers are having different limits.

I'd be curious what you want to achieve, maybe there is a more robust way, such as sending necessary certificate in a payload or send the certificate signature only