Index: java/net/deterlab/abac/X509Credential.java
===================================================================
--- java/net/deterlab/abac/X509Credential.java	(revision 7b33c9b584e09381bd205bd0aee336833e7c4c81)
+++ java/net/deterlab/abac/X509Credential.java	(revision 44896b58622fc4afa61c046f2ff5da0de5722006)
@@ -75,17 +75,11 @@
      * this throws.
      * @param ids a Collection of Identities to use in validating the cert
-     * @throws CertificateException if the certificate is badly formatted
-     * @throws InvalidKeyException if none of the Identities can validate the
-     *				    certificate
-     * @throws NoSuchAlgorithmException if the credential uses an unknown
-     *				    signature algorithm
-     * @throws NoSuchProviderException if the provider of the signature
-     *				    algorithm is unavailable
-     * @throws SignatureException if the signature check fails
+     * @throws CertInvalidException if the stream is unparsable
+     * @throws MissingIssuerException if none of the Identities can validate the
+     *				    certificate
+     * @throws BadSignatureException if the signature check fails
      */
     protected void init(Collection<Identity> ids) 
-	    throws CertificateException, InvalidKeyException, 
-		NoSuchAlgorithmException, NoSuchProviderException,
-		SignatureException {
+	    throws ABACException {
 	for (Identity i: ids) {
 	    try {
@@ -94,12 +88,12 @@
 		break;
 	    }
-	    catch (InvalidKeyException e) { }
-	}
-	if (id == null) throw new InvalidKeyException("Unknown identity");
+	    catch (GeneralSecurityException e) { }
+	}
+	if (id == null) throw new MissingIssuerException("Unknown identity");
 
         load_roles();
 
 	if (!id.getKeyID().equals(m_head.principal()))
-	    throw new InvalidKeyException("Unknown identity");
+	    throw new MissingIssuerException("Unknown identity");
     }
 
@@ -111,20 +105,18 @@
      * @param stream the InputStream to read the certificate from.
      * @param ids a Collection of Identities to use in validating the cert
-     * @throws CertificateException if the certificate is badly formatted
-     * @throws InvalidKeyException if none of the Identities can validate the
-     *				    certificate
-     * @throws NoSuchAlgorithmException if the credential uses an unknown
-     *				    signature algorithm
-     * @throws NoSuchProviderException if the provider of the signature
-     *				    algorithm is unavailable
-     * @throws SignatureException if the signature check fails
-     * @throws IOException if the certificate is unparsable.
+     * @throws CertInvalidException if the stream is unparsable
+     * @throws MissingIssuerException if none of the Identities can validate the
+     *				    certificate
+     * @throws BadSignatureException if the signature check fails
      */
     protected void init(InputStream stream, Collection<Identity> ids) 
-	    throws CertificateException, InvalidKeyException, 
-		NoSuchAlgorithmException, NoSuchProviderException,
-		SignatureException, IOException {
-	read_certificate(stream);
-	if (ac == null) throw new IOException("Unknown Format");
+	    throws ABACException {
+	try {
+	    read_certificate(stream);
+	}
+	catch (IOException e) {
+	    throw new CertInvalidException(e.getMessage(), e);
+	}
+	if (ac == null) throw new CertInvalidException("Unknown Format");
 	init(ids);
     }
@@ -138,17 +130,18 @@
      * @param filename a String containing the filename to read
      * @param ids a Collection of Identities to use in validating the cert
-     * @throws StreamParsingException if the stream is unparsable
-     * @throws CertificateException if the certificate is badly formatted
-     * @throws InvalidKeyException if none of the Identities can validate the
-     *				    certificate
-     * @throws NoSuchAlgorithmException if the credential uses an unknown
-     *				    signature algorithm
-     * @throws NoSuchProviderException if the provider of the signature
-     *				    algorithm is unavailable
-     * @throws SignatureException if the signature check fails
-     * @throws IOException if the certificate is unparsable.
+     * @throws CertInvalidException if the stream is unparsable
+     * @throws MissingIssuerException if none of the Identities can validate the
+     *				    certificate
+     * @throws BadSignatureException if the signature check fails
      */
     public X509Credential(String filename, Collection<Identity> ids) 
-	throws Exception { init(new FileInputStream(filename), ids); }
+	throws ABACException { 
+	try {
+	    init(new FileInputStream(filename), ids); 
+	}
+	catch (FileNotFoundException e) {
+	    throw new CertInvalidException("Bad filename", e);
+	}
+    }
 
     /**
@@ -160,20 +153,17 @@
      * @param file the File to read
      * @param ids a Collection of Identities to use in validating the cert
-     * @throws StreamParsingException if the stream is unparsable
-     * @throws CertificateException if the certificate is badly formatted
-     * @throws InvalidKeyException if none of the Identities can validate the
-     *				    certificate
-     * @throws NoSuchAlgorithmException if the credential uses an unknown
-     *				    signature algorithm
-     * @throws NoSuchProviderException if the provider of the signature
-     *				    algorithm is unavailable
-     * @throws SignatureException if the signature check fails
-     * @throws IOException if the certificate is unparsable.
+     * @throws CertInvalidException if the stream is unparsable
+     * @throws MissingIssuerException if none of the Identities can validate the
+     *				    certificate
+     * @throws BadSignatureException if the signature check fails
      */
     public X509Credential(File file, Collection<Identity> ids) 
-	    throws CertificateException, InvalidKeyException, 
-		NoSuchAlgorithmException, NoSuchProviderException,
-		SignatureException, StreamParsingException, IOException {
-	init(new FileInputStream(file), ids);
+	    throws ABACException {
+	try {
+	    init(new FileInputStream(file), ids);
+	}
+	catch (FileNotFoundException e) {
+	    throw new CertInvalidException("Bad filename", e);
+	}
     }
 
@@ -185,21 +175,11 @@
      * @param s the InputStream to read
      * @param ids a Collection of Identities to use in validating the cert
-     * @throws StreamParsingException if the stream is unparsable
-     * @throws CertificateException if the certificate is badly formatted
-     * @throws InvalidKeyException if none of the Identities can validate the
-     *				    certificate
-     * @throws NoSuchAlgorithmException if the credential uses an unknown
-     *				    signature algorithm
-     * @throws NoSuchProviderException if the provider of the signature
-     *				    algorithm is unavailable
-     * @throws SignatureException if the signature check fails
-     * @throws IOException if the certificate is unparsable.
+     * @throws CertInvalidException if the stream is unparsable
+     * @throws MissingIssuerException if none of the Identities can validate the
+     *				    certificate
+     * @throws BadSignatureException if the signature check fails
      */
     public X509Credential(InputStream s, Collection<Identity> ids) 
-	    throws CertificateException, InvalidKeyException, 
-		NoSuchAlgorithmException, NoSuchProviderException,
-		SignatureException, StreamParsingException, IOException {
-	init(s, ids);
-    }
+	    throws ABACException { init(s, ids); }
 
     /**
@@ -211,18 +191,12 @@
      * @param c the X509V2AttributeCertificate to create from
      * @param ids a Collection of Identities to use in validating the cert
-     * @throws CertificateException if the certificate is badly formatted
-     * @throws InvalidKeyException if none of the Identities can validate the
-     *				    certificate
-     * @throws NoSuchAlgorithmException if the credential uses an unknown
-     *				    signature algorithm
-     * @throws NoSuchProviderException if the provider of the signature
-     *				    algorithm is unavailable
-     * @throws SignatureException if the signature check fails
-     * @throws IOException if the certificate is unparsable.
-     */
-    public X509Credential(X509V2AttributeCertificate c, Collection<Identity> ids) 
-	    throws CertificateException, InvalidKeyException, 
-		NoSuchAlgorithmException, NoSuchProviderException,
-		SignatureException, IOException {
+     * @throws CertInvalidException if the stream is unparsable
+     * @throws MissingIssuerException if none of the Identities can validate the
+     *				    certificate
+     * @throws BadSignatureException if the signature check fails
+     */
+    public X509Credential(X509V2AttributeCertificate c, 
+	    Collection<Identity> ids) 
+	    throws ABACException {
 	ac = c;
 	init(ids);
@@ -235,18 +209,10 @@
      * of the exceptions this throws.
      * @param i the Identity that will issue the certificate
-     * @throws IOException reading or writing problems
-     * @throws CertificateEncodingException Problem creating certificate
-     * @throws InvalidKeyException if none of the Identities can sign the
-     *				    certificate
-     * @throws NoSuchAlgorithmException if the credential uses an unknown
-     *				    signature algorithm
-     * @throws NoSuchProviderException if the provider of the signature
-     *				    algorithm is unavailable
-     * @throws SignatureException if the signature creation fails
+     * @throws ABACException if xml creation fails
+     * @throws MissingIssuerException if the issuer is bad
+     * @throws BadSignatureException if the signature creation fails
      */
     public void make_cert(Identity i) 
-	    throws IOException, CertificateEncodingException,
-	       NoSuchProviderException, NoSuchAlgorithmException,
-	       SignatureException, InvalidKeyException {
+	    throws ABACException {
 	PrivateKey key = i.getKeyPair().getPrivate();
 	SubjectPublicKeyInfo pki = Context.extractSubjectPublicKeyInfo(
@@ -255,31 +221,36 @@
 	    new X509V2AttributeCertificateGenerator();
 
-	gen.setIssuer(new AttributeCertificateIssuer(
-		    new X500Principal("CN="+m_head.principal())));
-	gen.setHolder(new AttributeCertificateHolder(
-		    new X500Principal("CN="+m_head.principal())));
-	gen.setNotAfter(new Date(System.currentTimeMillis() 
-		    + (3600L * 1000L * 24L * 365L)));
-	gen.setNotBefore(new Date(System.currentTimeMillis()));
-	gen.setSerialNumber(BigInteger.valueOf(System.currentTimeMillis()));
-	gen.addAttribute(new X509Attribute(attrOID, 
-		    new DERSequence(
+	try {
+	    gen.setIssuer(new AttributeCertificateIssuer(
+			new X500Principal("CN="+m_head.principal())));
+	    gen.setHolder(new AttributeCertificateHolder(
+			new X500Principal("CN="+m_head.principal())));
+	    gen.setNotAfter(new Date(System.currentTimeMillis() 
+			+ (3600L * 1000L * 24L * 365L)));
+	    gen.setNotBefore(new Date(System.currentTimeMillis()));
+	    gen.setSerialNumber(BigInteger.valueOf(System.currentTimeMillis()));
+	    gen.addAttribute(new X509Attribute(attrOID, 
 			new DERSequence(
-			    new DERUTF8String(toString())))));
-	gen.setSignatureAlgorithm("SHA256WithRSAEncryption");
-
-	// Creddy expects an authority key identifier.
-	gen.addExtension(authKeyOID, false, 
-		new AuthorityKeyIdentifier(pki));
+			    new DERSequence(
+				new DERUTF8String(toString())))));
+	    gen.setSignatureAlgorithm("SHA256WithRSAEncryption");
+
+	    // Creddy expects an authority key identifier.
+	    gen.addExtension(authKeyOID, false, 
+		    new AuthorityKeyIdentifier(pki));
+	    ac = (X509V2AttributeCertificate) gen.generate(key, "BC");
+	}
+	catch (Exception e) {
+	    throw new ABACException("Cannot encode cert", e);
+	}
 	// Create the cert.
-	ac = (X509V2AttributeCertificate) gen.generate(key, "BC");
 	id = i;
     }
 
     /**
-     * Load the roles off the attribute cert. Throws a RuntimeException if
-     * there's something wrong with the cert.
-     */
-    private void load_roles() {
+     * Load the roles off the attribute cert. 
+     * @throws CertInvalidException if the certificate is badly formatted
+     */
+    private void load_roles() throws CertInvalidException {
         String roles = null;
         try {
@@ -293,10 +264,10 @@
         }
         catch (Exception e) {
-            throw new RuntimeException("Badly formatted certificate");
+            throw new CertInvalidException("Badly formatted certificate");
         }
 
         String[] parts = roles.split("\\s*<--?\\s*");
         if (parts.length != 2)
-            throw new RuntimeException("Invalid attribute: " + roles);
+            throw new CertInvalidException("Invalid attribute: " + roles);
 
         m_head = new Role(parts[0]);
