Index: java/net/deterlab/abac/Identity.java
===================================================================
--- java/net/deterlab/abac/Identity.java	(revision 718a51f1accf1b7cf2131697b66718140a0bb4d7)
+++ java/net/deterlab/abac/Identity.java	(revision 8fdbdacc23b713ff1de30d6dde656130096a769b)
@@ -45,37 +45,35 @@
      * the certificate, and call init(cert) on it.
      * @param r a Reader containing the certificate
-     * @throws CertificateException if the certificate is badly formatted
-     * @throws InvalidKeyException if none of the Identities can validate the
-     *				    certificate
-     * @throws NoSuchAlgorithmException if the credential uses an unknown
-     *				    signature algorithm
-     * @throws NoSuchProviderException if the provider of the signature
-     *				    algorithm is unavailable
-     * @throws SignatureException if the signature check fails
-     * @throws IOException if the certificate is unparsable.
-     */
-    protected void init(Reader r) throws 
-	    CertificateException, NoSuchAlgorithmException,InvalidKeyException,
-	    NoSuchProviderException, SignatureException, IOException {
+     * @throws CertInvalidException if the stream is unparsable
+     * @throws MissingIssuerException if none of the Identities can validate the
+     *				    certificate
+     * @throws BadSignatureException if the signature check fails
+     * @throws ABACException if an uncategorized error occurs
+     */
+    protected void init(Reader r) throws ABACException {
 	PEMReader pr = new PEMReader(r);
 	Object c = null;
 
-	while ( ( c= pr.readObject()) != null ){
-
-	    if (c instanceof X509Certificate) {
-		if ( cn == null ) 
-		    init((X509Certificate)c);
-		else
-		    throw new CertificateException("Two certs in one file");
+	try {
+	    while ( ( c= pr.readObject()) != null ){
+
+		if (c instanceof X509Certificate) {
+		    if ( cn == null ) 
+			init((X509Certificate)c);
+		    else
+			throw new CertInvalidException("Two certs in one");
+		}
+		else if (c instanceof KeyPair) setKeyPair((KeyPair)c);
+		else 
+		    throw new CertInvalidException(
+			    "Not an identity certificate");
 	    }
-	    else if (c instanceof KeyPair) setKeyPair((KeyPair)c);
-	    else 
-		throw new CertificateException(
-			"Not an identity certificate");
+	}
+	catch (IOException e) {
+	    throw new CertInvalidException(e.getMessage(), e);
 	}
 	// If there's nothing for the PEM reader to parse, the cert is invalid.
 	if (cn == null) 
-	    throw new CertificateException(
-		    "Not an identity certificate");
+	    throw new CertInvalidException("Not an identity certificate");
     }
 
@@ -86,25 +84,30 @@
      * data.  Looks more complex than it is.
      * @param c an X509Certificate to init from
-     * @throws CertificateException if the certificate is badly formatted
-     * @throws InvalidKeyException if none of the Identities can validate the
-     *				    certificate
-     * @throws NoSuchAlgorithmException if the credential uses an unknown
-     *				    signature algorithm
-     * @throws NoSuchProviderException if the provider of the signature
-     *				    algorithm is unavailable
-     * @throws SignatureException if the signature check fails
-     * @throws IOException if the certificate is unparsable.
-     */
-    protected void init(X509Certificate c) throws
-	CertificateException, NoSuchAlgorithmException,InvalidKeyException,
-	NoSuchProviderException, SignatureException, IOException {
-	    cert = (X509Certificate) c;
+     * @throws CertInvalidException if the stream is unparsable
+     * @throws MissingIssuerException if none of the Identities can validate the
+     *				    certificate
+     * @throws BadSignatureException if the signature check fails
+     * @throws ABACException if an uncategorized error occurs
+     */
+    protected void init(X509Certificate c) throws ABACException {
+	cert = (X509Certificate) c;
+	try {
 	    cert.verify(cert.getPublicKey());
-	    // Cert is valid, fill in the CN and keyid
-	    keyid = Context.extractKeyID(cert.getPublicKey());
-	    cn = cert.getSubjectDN().getName();
-	    expiration = cert.getNotAfter();
-	    /// XXX: better parse
-	    if (cn.startsWith("CN=")) cn = cn.substring(3);
+	}
+	catch (SignatureException e) {
+	    throw new BadSignatureException(e.getMessage(), e);
+	}
+	catch (CertificateException e) {
+	    throw new CertInvalidException(e.getMessage(), e);
+	}
+	catch (GeneralSecurityException e) {
+	    throw new ABACException(e.getMessage(), e);
+	}
+	// Cert is valid, fill in the CN and keyid
+	keyid = Context.extractKeyID(cert.getPublicKey());
+	cn = cert.getSubjectDN().getName();
+	expiration = cert.getNotAfter();
+	/// XXX: better parse
+	if (cn.startsWith("CN=")) cn = cn.substring(3);
     }
 
@@ -113,19 +116,19 @@
      * @param cn a String containing the menomnic name
      * @param validity a long containing the validity period (in seconds)
-     * @throws IOException reading or writing problems
-     * @throws CertificateEncodingException Problem creating certificate
-     * @throws InvalidKeyException if none of the Identities can sign the
-     *				    certificate
-     * @throws NoSuchAlgorithmException if the credential uses an unknown
-     *				    signature algorithm
-     * @throws NoSuchProviderException if the provider of the signature
-     *				    algorithm is unavailable
-     * @throws SignatureException if the signature creation fails
-     */
-    public Identity(String cn, long validity) throws
-	    CertificateException, NoSuchAlgorithmException,InvalidKeyException,
-	    NoSuchProviderException, SignatureException, IOException {
+     * @throws CertInvalidException if the stream is unparsable
+     * @throws MissingIssuerException if none of the Identities can validate the
+     *				    certificate
+     * @throws BadSignatureException if the signature check fails
+     * @throws ABACException if an uncategorized error occurs
+     */
+    public Identity(String cn, long validity) throws ABACException {
 	X509V1CertificateGenerator gen = new X509V1CertificateGenerator();
-	kp = KeyPairGenerator.getInstance("RSA").genKeyPair();
+	try {
+	    kp = KeyPairGenerator.getInstance("RSA").genKeyPair();
+	}
+	catch (NoSuchAlgorithmException e) {
+	    throw new ABACException(e.getMessage(), e);
+	}
+	X509Certificate a = null;
 
 	gen.setIssuerDN(new X500Principal("CN=" + cn));
@@ -137,25 +140,27 @@
 	gen.setPublicKey(kp.getPublic());
 	gen.setSignatureAlgorithm("SHA256WithRSAEncryption");
-	X509Certificate a = (X509Certificate) gen.generate(kp.getPrivate(), "BC");
+	try {
+	    a = (X509Certificate) gen.generate(kp.getPrivate(), "BC");
+	}
+	catch (CertificateEncodingException e) {
+	    throw new CertInvalidException(e.getMessage(), e);
+	}
+	catch (GeneralSecurityException e) {
+	    throw new ABACException(e.getMessage(), e);
+	}
+
 	init(a);
     }
-
 
     /**
      * Construct from a string, used as a CN.  Keys are generated.
      * @param cn a String containing the menomnic name
-     * @throws IOException reading or writing problems
-     * @throws CertificateEncodingException Problem creating certificate
-     * @throws InvalidKeyException if none of the Identities can sign the
-     *				    certificate
-     * @throws NoSuchAlgorithmException if the credential uses an unknown
-     *				    signature algorithm
-     * @throws NoSuchProviderException if the provider of the signature
-     *				    algorithm is unavailable
-     * @throws SignatureException if the signature creation fails
-     */
-    public Identity(String cn) throws
-	    CertificateException, NoSuchAlgorithmException,InvalidKeyException,
-	    NoSuchProviderException, SignatureException, IOException {
+     * @throws CertInvalidException if the stream is unparsable
+     * @throws MissingIssuerException if none of the Identities can validate the
+     *				    certificate
+     * @throws BadSignatureException if the signature check fails
+     * @throws ABACException if an uncategorized error occurs
+     */
+    public Identity(String cn) throws ABACException { 
 	this(cn, defaultValidity);
     }
@@ -164,82 +169,57 @@
      * Construct from a file containing a self-signed PEM certificate.
      * @param file the File to read
-     * @throws CertificateException if the certificate is badly formatted
-     * @throws InvalidKeyException if none of the Identities can validate the
-     *				    certificate
-     * @throws NoSuchAlgorithmException if the credential uses an unknown
-     *				    signature algorithm
-     * @throws NoSuchProviderException if the provider of the signature
-     *				    algorithm is unavailable
-     * @throws SignatureException if the signature check fails
-     * @throws IOException if the certificate is unparsable.
-     */
-    public Identity(File file) throws 
-	CertificateException, NoSuchAlgorithmException,InvalidKeyException,
-	NoSuchProviderException, SignatureException, FileNotFoundException,
-	IOException { 
-	    kp = null;
-	    init(new FileReader(file));
-	}
+     * @throws CertInvalidException if the stream is unparsable
+     * @throws MissingIssuerException if none of the Identities can validate the
+     *				    certificate
+     * @throws BadSignatureException if the signature check fails
+     * @throws ABACException if an uncategorized error occurs
+     * @throws FileNotFoundException if the file is invalid
+     */
+    public Identity(File file) throws ABACException, FileNotFoundException { 
+	kp = null;
+	init(new FileReader(file));
+    }
 
     /**
      * Construct from a reader containing a self-signed PEM certificate.
      * @param r the Reader containing the certificate
-     * @throws CertificateException if the certificate is badly formatted
-     * @throws InvalidKeyException if none of the Identities can validate the
-     *				    certificate
-     * @throws NoSuchAlgorithmException if the credential uses an unknown
-     *				    signature algorithm
-     * @throws NoSuchProviderException if the provider of the signature
-     *				    algorithm is unavailable
-     * @throws SignatureException if the signature check fails
-     * @throws IOException if the certificate is unparsable.
-     */
-    public Identity(Reader r) throws 
-	CertificateException, NoSuchAlgorithmException,InvalidKeyException,
-	NoSuchProviderException, SignatureException, IOException {
-	    kp = null;
-	    init(r);
-	}
+     * @throws CertInvalidException if the stream is unparsable
+     * @throws MissingIssuerException if none of the Identities can validate the
+     *				    certificate
+     * @throws BadSignatureException if the signature check fails
+     * @throws ABACException if an uncategorized error occurs
+     */
+    public Identity(Reader r) throws ABACException {
+	kp = null;
+	init(r);
+    }
 
     /**
      * Construct from an InputStream containing a self-signed PEM certificate.
      * @param s the InputStream containing the certificate
-     * @throws CertificateException if the certificate is badly formatted
-     * @throws InvalidKeyException if none of the Identities can validate the
-     *				    certificate
-     * @throws NoSuchAlgorithmException if the credential uses an unknown
-     *				    signature algorithm
-     * @throws NoSuchProviderException if the provider of the signature
-     *				    algorithm is unavailable
-     * @throws SignatureException if the signature check fails
-     * @throws IOException if the certificate is unparsable.
-     */
-    public Identity(InputStream s) throws 
-	CertificateException, NoSuchAlgorithmException,InvalidKeyException,
-	NoSuchProviderException, SignatureException, IOException { 
-	    kp = null;
-	    init(new InputStreamReader(s));
-	}
+     * @throws CertInvalidException if the stream is unparsable
+     * @throws MissingIssuerException if none of the Identities can validate the
+     *				    certificate
+     * @throws BadSignatureException if the signature check fails
+     * @throws ABACException if an uncategorized error occurs
+     */
+    public Identity(InputStream s) throws ABACException {
+	kp = null;
+	init(new InputStreamReader(s));
+    }
 
     /**
      * Construct from an X509Certificate
      * @param cert an X509Certificate to init from
-     * @throws CertificateException if the certificate is badly formatted
-     * @throws InvalidKeyException if none of the Identities can validate the
-     *				    certificate
-     * @throws NoSuchAlgorithmException if the credential uses an unknown
-     *				    signature algorithm
-     * @throws NoSuchProviderException if the provider of the signature
-     *				    algorithm is unavailable
-     * @throws SignatureException if the signature check fails
-     * @throws IOException if the certificate is unparsable.
-     */
-    Identity(X509Certificate cert) throws 
-	CertificateException, NoSuchAlgorithmException,InvalidKeyException,
-	NoSuchProviderException, SignatureException, FileNotFoundException,
-	IOException { 
-	    kp = null;
-	    init(cert);
-	}
+     * @throws CertInvalidException if the stream is unparsable
+     * @throws MissingIssuerException if none of the Identities can validate the
+     *				    certificate
+     * @throws BadSignatureException if the signature check fails
+     * @throws ABACException if an uncategorized error occurs
+     */
+    Identity(X509Certificate cert) throws ABACException {
+	kp = null;
+	init(cert);
+    }
 
     /**
