Example usage for org.bouncycastle.asn1 ASN1EncodableVector ASN1EncodableVector

List of usage examples for org.bouncycastle.asn1 ASN1EncodableVector ASN1EncodableVector

  1. HOME
  2. Java
  3. org.bouncycastle
  4. org.bouncycastle.asn1.*
  5. ASN1EncodableVector
  6. ASN1EncodableVector

Introduction

In this page you can find the example usage for org.bouncycastle.asn1 ASN1EncodableVector ASN1EncodableVector.

Prototype

public ASN1EncodableVector()

Source Link

Usage

From source file:org.candlepin.resource.test.cert.test.CertTest.java

License:Open Source License

@Test
public void testCertExample() throws Exception {

    Security.addProvider(new BouncyCastleProvider());

    ////from   w w w .  j  a va2  s. c o m
    // set up the keys
    //
    KeyFactory fact = KeyFactory.getInstance("RSA", "BC");
    PrivateKey caPrivKey = fact.generatePrivate(caPrivKeySpec);
    PublicKey caPubKey = fact.generatePublic(caPubKeySpec);
    //PrivateKey privKey =
    fact.generatePrivate(privKeySpec);
    PublicKey pubKey = fact.generatePublic(pubKeySpec);

    //
    // note in this case we are using the CA certificate for both the client
    // cetificate
    // and the attribute certificate. This is to make the vcode simpler to
    // read, in practice
    // the CA for the attribute certificate should be different to that of
    // the client certificate
    //
    X509Certificate caCert = AttrCertExample.createAcIssuerCert(caPubKey, caPrivKey);
    X509Certificate clientCert = AttrCertExample.createClientCert(pubKey, caPrivKey, caPubKey);
    // Instantiate a new AC generator
    X509V2AttributeCertificateGenerator acGen = new X509V2AttributeCertificateGenerator();

    acGen.reset();

    //
    // Holder: here we use the IssuerSerial form
    //
    acGen.setHolder(new AttributeCertificateHolder(clientCert));

    // set the Issuer
    acGen.setIssuer(new AttributeCertificateIssuer(caCert.getSubjectX500Principal()));

    //
    // serial number (as it's an example we don't have to keep track of the
    // serials anyway
    //
    acGen.setSerialNumber(BigInteger.ONE);

    // not Before
    acGen.setNotBefore(new Date(System.currentTimeMillis() - 50000));

    // not After
    acGen.setNotAfter(new Date(System.currentTimeMillis() + 50000));

    // signature Algorithmus
    acGen.setSignatureAlgorithm("SHA1WithRSAEncryption");

    // the actual attributes
    GeneralName roleName = new GeneralName(GeneralName.rfc822Name, "DAU123456789");
    ASN1EncodableVector roleSyntax = new ASN1EncodableVector();
    roleSyntax.add(roleName);

    // roleSyntax OID: 2.5.24.72
    X509Attribute attributes = new X509Attribute("2.5.24.72", new DERSequence(roleSyntax));

    acGen.addAttribute(attributes);

    // finally create the AC
    X509V2AttributeCertificate att = (X509V2AttributeCertificate) acGen.generate(caPrivKey, "BC");

    //String encoded = new String(att.getEncoded());
    //System.out.println("CERT CERT: " + encoded);
    //KeyStore store = KeyStore.getInstance("PKCS12");
    //String pass = "redhat";

    /*FileOutputStream fout = new FileOutputStream("/tmp/foo.file");
    store.load(null, null);
    store.store(fout, pass.toCharArray());
    X509CertificateObject ccert = new
    X509CertificateObject(new X509CertificateStructure(new DERSequence(att)));*/
    //
    // starting here, we parse the newly generated AC
    //

    // Holder

    AttributeCertificateHolder h = att.getHolder();
    if (h.match(clientCert)) {
        if (h.getEntityNames() != null) {
            //                System.out.println(h.getEntityNames().length +
            //                    " entity names found");
        }
        if (h.getIssuer() != null) {
            //                System.out.println(h.getIssuer().length +
            //                    " issuer names found, serial number " +
            //                    h.getSerialNumber());
        }
        //            System.out.println("Matches original client x509 cert");
    }

    // Issuer

    AttributeCertificateIssuer issuer = att.getIssuer();
    if (issuer.match(caCert)) {
        if (issuer.getPrincipals() != null) {
            //                System.out.println(issuer.getPrincipals().length +
            //                    " entity names found");
        }
        //            System.out.println("Matches original ca x509 cert");
    }

    // Dates
    //        System.out.println("valid not before: " + att.getNotBefore());
    //        System.out.println("valid not before: " + att.getNotAfter());

    // check the dates, an exception is thrown in checkValidity()...

    try {
        att.checkValidity();
        att.checkValidity(new Date());
    } catch (Exception e) {
        System.out.println(e);
    }

    // verify

    try {
        att.verify(caPubKey, "BC");
    } catch (Exception e) {
        System.out.println(e);
    }

    // Attribute
    X509Attribute[] attribs = att.getAttributes();
    //        System.out.println("cert has " + attribs.length + " attributes:");
    for (int i = 0; i < attribs.length; i++) {
        X509Attribute a = attribs[i];
        //            System.out.println("OID: " + a.getOID());

        // currently we only check for the presence of a 'RoleSyntax'
        // attribute

        if (a.getOID().equals("2.5.24.72")) {
            //                System.out.println("rolesyntax read from cert!");
        }
    }
}

From source file:org.candlepin.util.X509CRLStreamWriter.java

License:Open Source License

/**
 * Create an entry to be added to the CRL.
 *
 * @param serial/*from   www .  j a  v  a2s  . c o m*/
 * @param date
 * @param reason
 */
@SuppressWarnings({ "unchecked", "rawtypes" })
public void add(BigInteger serial, Date date, int reason) {
    if (locked) {
        throw new IllegalStateException("Cannot add to a locked stream.");
    }

    ASN1EncodableVector v = new ASN1EncodableVector();

    v.add(new DERInteger(serial));
    v.add(new Time(date));

    CRLReason crlReason = new CRLReason(reason);
    Vector extOids = new Vector();
    Vector extValues = new Vector();
    extOids.addElement(X509Extension.reasonCode);
    extValues.addElement(new X509Extension(false, new DEROctetString(crlReason.getDEREncoded())));
    v.add(new X509Extensions(extOids, extValues));

    newEntries.add(new DERSequence(v));
}

From source file:org.candlepin.util.X509CRLStreamWriter.java

License:Open Source License

/**
 * This method updates the crlNumber and authorityKeyIdentifier extensions.  Any
 * other extensions are copied over unchanged.
 * @param extensions//w  ww. ja v  a2  s  .  c om
 * @return
 * @throws IOException
 */
@SuppressWarnings("rawtypes")
protected byte[] updateExtensions(byte[] obj) throws IOException {
    DERTaggedObject taggedExts = (DERTaggedObject) DERTaggedObject.fromByteArray(obj);
    DERSequence seq = (DERSequence) taggedExts.getObject();
    ASN1EncodableVector modifiedExts = new ASN1EncodableVector();

    // Now we need to read the extensions and find the CRL number and increment it,
    // and determine if its length changed.
    Enumeration objs = seq.getObjects();
    while (objs.hasMoreElements()) {
        DERSequence ext = (DERSequence) objs.nextElement();
        DERObjectIdentifier oid = (DERObjectIdentifier) ext.getObjectAt(0);
        if (X509Extension.cRLNumber.equals(oid)) {
            DEROctetString s = (DEROctetString) ext.getObjectAt(1);
            DERInteger i = (DERInteger) DERTaggedObject.fromByteArray(s.getOctets());
            DERInteger newCrlNumber = new DERInteger(i.getValue().add(BigInteger.ONE));

            X509Extension newNumberExt = new X509Extension(false,
                    new DEROctetString(newCrlNumber.getDEREncoded()));

            ASN1EncodableVector crlNumber = new ASN1EncodableVector();
            crlNumber.add(X509Extension.cRLNumber);
            crlNumber.add(newNumberExt.getValue());
            modifiedExts.add(new DERSequence(crlNumber));
        } else if (X509Extension.authorityKeyIdentifier.equals(oid)) {
            X509Extension newAuthorityKeyExt = new X509Extension(false,
                    new DEROctetString(akiStructure.getDEREncoded()));

            ASN1EncodableVector aki = new ASN1EncodableVector();
            aki.add(X509Extension.authorityKeyIdentifier);
            aki.add(newAuthorityKeyExt.getValue());
            modifiedExts.add(new DERSequence(aki));
        } else {
            modifiedExts.add(ext);
        }
    }

    DERSequence seqOut = new DERSequence(modifiedExts);
    DERTaggedObject out = new DERTaggedObject(true, 0, seqOut);
    return out.getDEREncoded();
}

From source file:org.ccnx.ccn.impl.security.crypto.util.AuthorityKeyIdentifier.java

License:Open Source License

/**
* <pre>/*ww  w  . jav a  2 s  .co  m*/
*   AuthorityKeyIdentifier ::= SEQUENCE {
*      keyIdentifier             [0] IMPLICIT KeyIdentifier           OPTIONAL,
*      authorityCertIssuer       [1] IMPLICIT GeneralNames            OPTIONAL,
*      authorityCertSerialNumber [2] IMPLICIT CertificateSerialNumber OPTIONAL  }
*
*   KeyIdentifier ::= OCTET STRING
* </pre>
*/
public DERObject getDERObject() {

    ASN1EncodableVector seq = new ASN1EncodableVector();

    if (null != this._keyIdentifier)
        seq.add(new DERTaggedObject(false, tag_KeyIdentifier, _keyIdentifier));

    if (null != this._issuerName)
        seq.add(new DERTaggedObject(false, tag_IssuerName, _issuerName));

    if (null != this._issuerSerial)
        seq.add(new DERTaggedObject(false, tag_issuerSerialNumber, _issuerSerial));

    return new DERSequence(seq);
}

From source file:org.cesecore.certificates.ca.X509CA.java

License:Open Source License

/**
 * @see CA#createRequest(Collection, String, Certificate, int)
 *//*  w ww .  j a  va  2  s .c o m*/
@Override
public byte[] createRequest(CryptoToken cryptoToken, Collection<ASN1Encodable> attributes, String signAlg,
        Certificate cacert, int signatureKeyPurpose) throws CryptoTokenOfflineException {
    log.trace(
            ">createRequest: " + signAlg + ", " + CertTools.getSubjectDN(cacert) + ", " + signatureKeyPurpose);
    ASN1Set attrset = new DERSet();
    if (attributes != null) {
        log.debug("Adding attributes in the request");
        Iterator<ASN1Encodable> iter = attributes.iterator();
        ASN1EncodableVector vec = new ASN1EncodableVector();
        while (iter.hasNext()) {
            ASN1Encodable o = (ASN1Encodable) iter.next();
            vec.add(o);
        }
        attrset = new DERSet(vec);
    }
    final X500NameStyle nameStyle;
    if (getUsePrintableStringSubjectDN()) {
        nameStyle = PrintableStringNameStyle.INSTANCE;
    } else {
        nameStyle = CeSecoreNameStyle.INSTANCE;
    }
    X500Name x509dn = CertTools.stringToBcX500Name(getSubjectDN(), nameStyle, getUseLdapDNOrder());
    PKCS10CertificationRequest req;
    try {
        final CAToken catoken = getCAToken();
        final String alias = catoken.getAliasFromPurpose(signatureKeyPurpose);
        final KeyPair keyPair = new KeyPair(cryptoToken.getPublicKey(alias), cryptoToken.getPrivateKey(alias));
        req = CertTools.genPKCS10CertificationRequest(signAlg, x509dn, keyPair.getPublic(), attrset,
                keyPair.getPrivate(), cryptoToken.getSignProviderName());
        log.trace("<createRequest");
        return req.getEncoded();
    } catch (CryptoTokenOfflineException e) { // NOPMD, since we catch wide below
        throw e;
    } catch (Exception e) {
        throw new RuntimeException(e);
    }
}

From source file:org.cesecore.certificates.ca.X509CA.java

License:Open Source License

/**
 * Constructs the SubjectAlternativeName extension that will end up on the generated certificate.
 * //from  w ww. j a v a 2  s.com
 * If the DNS values in the subjectAlternativeName extension contain parentheses to specify labels that should be redacted, the parentheses are removed and another extension 
 * containing the number of redacted labels is added.
 * 
 * @param subAltNameExt
 * @param publishToCT
 * @return An extension generator containing the SubjectAlternativeName extension and an extension holding the number of redacted labels if the certificate is to be published 
 * to a CTLog
 * @throws IOException
 */
private ExtensionsGenerator getSubjectAltNameExtensionForCert(Extension subAltNameExt, boolean publishToCT)
        throws IOException {
    String subAltName = CertTools.getAltNameStringFromExtension(subAltNameExt);
    List<String> dnsValues = CertTools.getPartsFromDN(subAltName, CertTools.DNS);
    int[] nrOfRecactedLables = new int[dnsValues.size()];
    boolean sanEdited = false;
    int i = 0;
    for (String dns : dnsValues) {
        if (StringUtils.contains(dns, "(") && StringUtils.contains(dns, ")")) { // if it contains parts that should be redacted
            // Remove the parentheses from the SubjectAltName that will end up on the certificate
            String certBuilderDNSValue = StringUtils.remove(dns, '(');
            certBuilderDNSValue = StringUtils.remove(certBuilderDNSValue, ')');
            subAltName = StringUtils.replace(subAltName, dns, certBuilderDNSValue);
            sanEdited = true;
            if (publishToCT) {
                String redactedLable = StringUtils.substring(dns, StringUtils.indexOf(dns, "("),
                        StringUtils.lastIndexOf(dns, ")") + 1); // tex. (top.secret).domain.se => redactedLable = (top.secret) aka. including the parentheses 
                nrOfRecactedLables[i] = StringUtils.countMatches(redactedLable, ".") + 1;
            }
        }
        i++;
    }
    ExtensionsGenerator gen = new ExtensionsGenerator();
    gen.addExtension(Extension.subjectAlternativeName, subAltNameExt.isCritical(),
            CertTools.getGeneralNamesFromAltName(subAltName));
    // If there actually are redacted parts, add the extension containing the number of redacted lables to the certificate 
    if (publishToCT && sanEdited) {
        ASN1EncodableVector v = new ASN1EncodableVector();
        for (int val : nrOfRecactedLables) {
            v.add(new ASN1Integer(val));
        }
        ASN1Encodable seq = new DERSequence(v);
        gen.addExtension(new ASN1ObjectIdentifier("1.3.6.1.4.1.11129.2.4.6"), false, seq);
    }

    return gen;
}

From source file:org.cesecore.certificates.ca.X509CA.java

License:Open Source License

/**
 * Generate a CRL or a deltaCRL//w ww  .  j  a  va 2s. c  om
 * 
 * @param certs
 *            list of revoked certificates
 * @param crlnumber
 *            CRLNumber for this CRL
 * @param isDeltaCRL
 *            true if we should generate a DeltaCRL
 * @param basecrlnumber
 *            caseCRLNumber for a delta CRL, use 0 for full CRLs
 * @param certProfile
 *            certificate profile for CRL Distribution point in the CRL, or null
 * @return CRL
 * @throws CryptoTokenOfflineException
 * @throws IllegalCryptoTokenException
 * @throws IOException
 * @throws SignatureException
 * @throws NoSuchProviderException
 * @throws InvalidKeyException
 * @throws CRLException
 * @throws NoSuchAlgorithmException
 */
private X509CRLHolder generateCRL(CryptoToken cryptoToken, Collection<RevokedCertInfo> certs, long crlPeriod,
        int crlnumber, boolean isDeltaCRL, int basecrlnumber)
        throws CryptoTokenOfflineException, IllegalCryptoTokenException, IOException, SignatureException,
        NoSuchProviderException, InvalidKeyException, CRLException, NoSuchAlgorithmException {
    final String sigAlg = getCAInfo().getCAToken().getSignatureAlgorithm();

    if (log.isDebugEnabled()) {
        log.debug("generateCRL(" + certs.size() + ", " + crlPeriod + ", " + crlnumber + ", " + isDeltaCRL + ", "
                + basecrlnumber);
    }

    // Make DNs
    final X509Certificate cacert = (X509Certificate) getCACertificate();
    final X500Name issuer;
    if (cacert == null) {
        // This is an initial root CA, since no CA-certificate exists
        // (I don't think we can ever get here!!!)
        final X500NameStyle nameStyle;
        if (getUsePrintableStringSubjectDN()) {
            nameStyle = PrintableStringNameStyle.INSTANCE;
        } else {
            nameStyle = CeSecoreNameStyle.INSTANCE;
        }
        issuer = CertTools.stringToBcX500Name(getSubjectDN(), nameStyle, getUseLdapDNOrder());
    } else {
        issuer = X500Name.getInstance(cacert.getSubjectX500Principal().getEncoded());
    }
    final Date thisUpdate = new Date();
    final Date nextUpdate = new Date();
    nextUpdate.setTime(nextUpdate.getTime() + crlPeriod);
    final X509v2CRLBuilder crlgen = new X509v2CRLBuilder(issuer, thisUpdate);
    crlgen.setNextUpdate(nextUpdate);
    if (certs != null) {
        if (log.isDebugEnabled()) {
            log.debug("Adding " + certs.size() + " revoked certificates to CRL. Free memory="
                    + Runtime.getRuntime().freeMemory());
        }
        final Iterator<RevokedCertInfo> it = certs.iterator();
        while (it.hasNext()) {
            final RevokedCertInfo certinfo = (RevokedCertInfo) it.next();
            crlgen.addCRLEntry(certinfo.getUserCertificate(), certinfo.getRevocationDate(),
                    certinfo.getReason());
        }
        if (log.isDebugEnabled()) {
            log.debug("Finished adding " + certs.size() + " revoked certificates to CRL. Free memory="
                    + Runtime.getRuntime().freeMemory());
        }
    }

    // Authority key identifier
    if (getUseAuthorityKeyIdentifier() == true) {
        byte[] caSkid = (cacert != null ? CertTools.getSubjectKeyId(cacert) : null);
        if (caSkid != null) {
            // Use subject key id from CA certificate
            AuthorityKeyIdentifier aki = new AuthorityKeyIdentifier(caSkid);
            crlgen.addExtension(Extension.authorityKeyIdentifier, getAuthorityKeyIdentifierCritical(), aki);
        } else {
            // Generate from SHA1 of public key
            ASN1InputStream asn1InputStream = new ASN1InputStream(new ByteArrayInputStream(cryptoToken
                    .getPublicKey(getCAToken().getAliasFromPurpose(CATokenConstants.CAKEYPURPOSE_CRLSIGN))
                    .getEncoded()));
            try {
                SubjectPublicKeyInfo apki = new SubjectPublicKeyInfo(
                        (ASN1Sequence) asn1InputStream.readObject());
                AuthorityKeyIdentifier aki = new AuthorityKeyIdentifier(apki);
                crlgen.addExtension(Extension.authorityKeyIdentifier, getAuthorityKeyIdentifierCritical(), aki);
            } finally {
                asn1InputStream.close();
            }
        }
    }

    // Authority Information Access  
    final ASN1EncodableVector accessList = new ASN1EncodableVector();
    if (getAuthorityInformationAccess() != null) {
        for (String url : getAuthorityInformationAccess()) {
            if (StringUtils.isNotEmpty(url)) {
                GeneralName accessLocation = new GeneralName(GeneralName.uniformResourceIdentifier,
                        new DERIA5String(url));
                accessList.add(new AccessDescription(AccessDescription.id_ad_caIssuers, accessLocation));
            }
        }
    }
    if (accessList.size() > 0) {
        AuthorityInformationAccess authorityInformationAccess = AuthorityInformationAccess
                .getInstance(new DERSequence(accessList));
        // "This CRL extension MUST NOT be marked critical." according to rfc4325
        crlgen.addExtension(Extension.authorityInfoAccess, false, authorityInformationAccess);
    }

    // CRLNumber extension
    if (getUseCRLNumber() == true) {
        CRLNumber crlnum = new CRLNumber(BigInteger.valueOf(crlnumber));
        crlgen.addExtension(Extension.cRLNumber, this.getCRLNumberCritical(), crlnum);
    }

    if (isDeltaCRL) {
        // DeltaCRLIndicator extension
        CRLNumber basecrlnum = new CRLNumber(BigInteger.valueOf(basecrlnumber));
        crlgen.addExtension(Extension.deltaCRLIndicator, true, basecrlnum);
    }
    // CRL Distribution point URI and Freshest CRL DP
    if (getUseCrlDistributionPointOnCrl()) {
        String crldistpoint = getDefaultCRLDistPoint();
        List<DistributionPoint> distpoints = generateDistributionPoints(crldistpoint);

        if (distpoints.size() > 0) {
            IssuingDistributionPoint idp = new IssuingDistributionPoint(
                    distpoints.get(0).getDistributionPoint(), false, false, null, false, false);

            // According to the RFC, IDP must be a critical extension.
            // Nonetheless, at the moment, Mozilla is not able to correctly
            // handle the IDP extension and discards the CRL if it is critical.
            crlgen.addExtension(Extension.issuingDistributionPoint, getCrlDistributionPointOnCrlCritical(),
                    idp);
        }

        if (!isDeltaCRL) {
            String crlFreshestDP = getCADefinedFreshestCRL();
            List<DistributionPoint> freshestDistPoints = generateDistributionPoints(crlFreshestDP);
            if (freshestDistPoints.size() > 0) {
                CRLDistPoint ext = new CRLDistPoint((DistributionPoint[]) freshestDistPoints
                        .toArray(new DistributionPoint[freshestDistPoints.size()]));

                // According to the RFC, the Freshest CRL extension on a
                // CRL must not be marked as critical. Therefore it is
                // hardcoded as not critical and is independent of
                // getCrlDistributionPointOnCrlCritical().
                crlgen.addExtension(Extension.freshestCRL, false, ext);
            }

        }
    }

    final X509CRLHolder crl;
    if (log.isDebugEnabled()) {
        log.debug("Signing CRL. Free memory=" + Runtime.getRuntime().freeMemory());
    }
    final String alias = getCAToken().getAliasFromPurpose(CATokenConstants.CAKEYPURPOSE_CRLSIGN);
    try {
        final ContentSigner signer = new BufferingContentSigner(new JcaContentSignerBuilder(sigAlg)
                .setProvider(cryptoToken.getSignProviderName()).build(cryptoToken.getPrivateKey(alias)), 20480);
        crl = crlgen.build(signer);
    } catch (OperatorCreationException e) {
        // Very fatal error
        throw new RuntimeException("Can not create Jca content signer: ", e);
    }
    if (log.isDebugEnabled()) {
        log.debug("Finished signing CRL. Free memory=" + Runtime.getRuntime().freeMemory());
    }

    // Verify using the CA certificate before returning
    // If we can not verify the issued CRL using the CA certificate we don't want to issue this CRL
    // because something is wrong...
    final PublicKey verifyKey;
    if (cacert != null) {
        verifyKey = cacert.getPublicKey();
        if (log.isTraceEnabled()) {
            log.trace("Got the verify key from the CA certificate.");
        }
    } else {
        verifyKey = cryptoToken.getPublicKey(alias);
        if (log.isTraceEnabled()) {
            log.trace("Got the verify key from the CA token.");
        }
    }
    try {
        final ContentVerifierProvider verifier = new JcaContentVerifierProviderBuilder().build(verifyKey);
        if (!crl.isSignatureValid(verifier)) {
            throw new SignatureException("Error verifying CRL to be returned.");
        }
    } catch (OperatorCreationException e) {
        // Very fatal error
        throw new RuntimeException("Can not create Jca content signer: ", e);
    } catch (CertException e) {
        throw new SignatureException(e.getMessage(), e);
    }
    if (log.isDebugEnabled()) {
        log.debug("Returning CRL. Free memory=" + Runtime.getRuntime().freeMemory());
    }
    return crl;
}

From source file:org.cesecore.certificates.ca.X509CA.java

License:Open Source License

/**
 * Generate a list of Distribution points.
 * /*  w  w w. j  av  a  2  s.com*/
 * @param distPoints
 *            distribution points as String in semi column (';') separated format.
 * @return list of distribution points.
 */
private List<DistributionPoint> generateDistributionPoints(String distPoints) {
    if (distPoints == null) {
        distPoints = "";
    }
    // Multiple CDPs are separated with the ';' sign
    Iterator<String> it = StringTools.splitURIs(distPoints).iterator();
    ArrayList<DistributionPoint> result = new ArrayList<DistributionPoint>();
    while (it.hasNext()) {
        String uri = (String) it.next();
        GeneralName gn = new GeneralName(GeneralName.uniformResourceIdentifier, new DERIA5String(uri));
        if (log.isDebugEnabled()) {
            log.debug("Added CRL distpoint: " + uri);
        }
        ASN1EncodableVector vec = new ASN1EncodableVector();
        vec.add(gn);
        GeneralNames gns = GeneralNames.getInstance(new DERSequence(vec));
        DistributionPointName dpn = new DistributionPointName(0, gns);
        result.add(new DistributionPoint(dpn, null, null));
    }
    return result;
}

From source file:org.cesecore.certificates.ca.X509CATest.java

License:Open Source License

@SuppressWarnings("unchecked")
private void doTestX509CABasicOperations(String algName) throws Exception {
    final CryptoToken cryptoToken = getNewCryptoToken();
    final X509CA x509ca = createTestCA(cryptoToken, CADN);
    Certificate cacert = x509ca.getCACertificate();

    // Start by creating a PKCS7
    byte[] p7 = x509ca.createPKCS7(cryptoToken, cacert, true);
    assertNotNull(p7);/*from  w  w w.  j a v  a 2s.  c o m*/
    CMSSignedData s = new CMSSignedData(p7);
    Store certstore = s.getCertificates();
    Collection<X509CertificateHolder> certs = certstore.getMatches(null);
    assertEquals(2, certs.size());
    p7 = x509ca.createPKCS7(cryptoToken, cacert, false);
    assertNotNull(p7);
    s = new CMSSignedData(p7);
    certstore = s.getCertificates();
    certs = certstore.getMatches(null);
    assertEquals(1, certs.size());

    // Create a certificate request (will be pkcs10)
    byte[] req = x509ca.createRequest(cryptoToken, null, algName, cacert,
            CATokenConstants.CAKEYPURPOSE_CERTSIGN);
    PKCS10CertificationRequest p10 = new PKCS10CertificationRequest(req);
    assertNotNull(p10);
    String dn = p10.getSubject().toString();
    assertEquals(CADN, dn);

    // Make a request with some pkcs11 attributes as well
    Collection<ASN1Encodable> attributes = new ArrayList<ASN1Encodable>();
    // Add a subject alternative name
    ASN1EncodableVector altnameattr = new ASN1EncodableVector();
    altnameattr.add(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest);
    GeneralNames san = CertTools.getGeneralNamesFromAltName("dNSName=foobar.bar.com");
    ExtensionsGenerator extgen = new ExtensionsGenerator();
    extgen.addExtension(Extension.subjectAlternativeName, false, san);
    Extensions exts = extgen.generate();
    altnameattr.add(new DERSet(exts));
    // Add a challenge password as well
    ASN1EncodableVector pwdattr = new ASN1EncodableVector();
    pwdattr.add(PKCSObjectIdentifiers.pkcs_9_at_challengePassword);
    ASN1EncodableVector pwdvalues = new ASN1EncodableVector();
    pwdvalues.add(new DERUTF8String("foobar123"));
    pwdattr.add(new DERSet(pwdvalues));
    attributes.add(new DERSequence(altnameattr));
    attributes.add(new DERSequence(pwdattr));
    // create the p10
    req = x509ca.createRequest(cryptoToken, attributes, algName, cacert,
            CATokenConstants.CAKEYPURPOSE_CERTSIGN);
    p10 = new PKCS10CertificationRequest(req);
    assertNotNull(p10);
    dn = p10.getSubject().toString();
    assertEquals(CADN, dn);
    Attribute[] attrs = p10.getAttributes();
    assertEquals(2, attrs.length);
    PKCS10RequestMessage p10msg = new PKCS10RequestMessage(new JcaPKCS10CertificationRequest(p10));
    assertEquals("foobar123", p10msg.getPassword());
    assertEquals("dNSName=foobar.bar.com", p10msg.getRequestAltNames());

    try {
        x509ca.createAuthCertSignRequest(cryptoToken, p10.getEncoded());
    } catch (UnsupportedOperationException e) {
        // Expected for a X509 CA
    }

    // Generate a client certificate and check that it was generated correctly
    EndEntityInformation user = new EndEntityInformation("username", "CN=User", 666, "rfc822Name=user@user.com",
            "user@user.com", new EndEntityType(EndEntityTypes.ENDUSER), 0, 0, EndEntityConstants.TOKEN_USERGEN,
            0, null);
    KeyPair keypair = genTestKeyPair(algName);
    CertificateProfile cp = new CertificateProfile(CertificateProfileConstants.CERTPROFILE_FIXED_ENDUSER);
    cp.addCertificatePolicy(new CertificatePolicy("1.1.1.2", null, null));
    cp.setUseCertificatePolicies(true);
    Certificate usercert = x509ca.generateCertificate(cryptoToken, user, keypair.getPublic(), 0, null, 10L, cp,
            "00000");
    assertNotNull(usercert);
    assertEquals("CN=User", CertTools.getSubjectDN(usercert));
    assertEquals(CADN, CertTools.getIssuerDN(usercert));
    assertEquals(getTestKeyPairAlgName(algName).toUpperCase(),
            AlgorithmTools.getCertSignatureAlgorithmNameAsString(usercert).toUpperCase());
    assertEquals(new String(CertTools.getSubjectKeyId(cacert)),
            new String(CertTools.getAuthorityKeyId(usercert)));
    assertEquals("user@user.com", CertTools.getEMailAddress(usercert));
    assertEquals("rfc822name=user@user.com", CertTools.getSubjectAlternativeName(usercert));
    assertNull(CertTools.getUPNAltName(usercert));
    assertFalse(CertTools.isSelfSigned(usercert));
    usercert.verify(cryptoToken
            .getPublicKey(x509ca.getCAToken().getAliasFromPurpose(CATokenConstants.CAKEYPURPOSE_CERTSIGN)));
    usercert.verify(x509ca.getCACertificate().getPublicKey());
    assertTrue(CertTools.isCA(x509ca.getCACertificate()));
    assertFalse(CertTools.isCA(usercert));
    assertEquals("1.1.1.2", CertTools.getCertificatePolicyId(usercert, 0));
    X509Certificate cert = (X509Certificate) usercert;
    boolean[] ku = cert.getKeyUsage();
    assertTrue(ku[0]);
    assertTrue(ku[1]);
    assertTrue(ku[2]);
    assertFalse(ku[3]);
    assertFalse(ku[4]);
    assertFalse(ku[5]);
    assertFalse(ku[6]);
    assertFalse(ku[7]);
    int bcku = CertTools.sunKeyUsageToBC(ku);
    assertEquals(X509KeyUsage.digitalSignature | X509KeyUsage.nonRepudiation | X509KeyUsage.keyEncipherment,
            bcku);

    // Create a CRL
    Collection<RevokedCertInfo> revcerts = new ArrayList<RevokedCertInfo>();
    X509CRLHolder crl = x509ca.generateCRL(cryptoToken, revcerts, 1);
    assertNotNull(crl);
    X509CRL xcrl = CertTools.getCRLfromByteArray(crl.getEncoded());
    assertEquals(CADN, CertTools.getIssuerDN(xcrl));
    Set<?> set = xcrl.getRevokedCertificates();
    assertNull(set);
    BigInteger num = CrlExtensions.getCrlNumber(xcrl);
    assertEquals(1, num.intValue());
    BigInteger deltanum = CrlExtensions.getDeltaCRLIndicator(xcrl);
    assertEquals(-1, deltanum.intValue());
    // Revoke some cert
    Date revDate = new Date();
    revcerts.add(new RevokedCertInfo(CertTools.getFingerprintAsString(usercert).getBytes(),
            CertTools.getSerialNumber(usercert).toByteArray(), revDate.getTime(),
            RevokedCertInfo.REVOCATION_REASON_CERTIFICATEHOLD, CertTools.getNotAfter(usercert).getTime()));
    crl = x509ca.generateCRL(cryptoToken, revcerts, 2);
    assertNotNull(crl);
    xcrl = CertTools.getCRLfromByteArray(crl.getEncoded());
    set = xcrl.getRevokedCertificates();
    assertEquals(1, set.size());
    num = CrlExtensions.getCrlNumber(xcrl);
    assertEquals(2, num.intValue());
    X509CRLEntry entry = (X509CRLEntry) set.iterator().next();
    assertEquals(CertTools.getSerialNumber(usercert).toString(), entry.getSerialNumber().toString());
    assertEquals(revDate.toString(), entry.getRevocationDate().toString());
    // Getting the revocation reason is a pita...
    byte[] extval = entry.getExtensionValue(Extension.reasonCode.getId());
    ASN1InputStream aIn = new ASN1InputStream(new ByteArrayInputStream(extval));
    ASN1OctetString octs = (ASN1OctetString) aIn.readObject();
    aIn = new ASN1InputStream(new ByteArrayInputStream(octs.getOctets()));
    ASN1Primitive obj = aIn.readObject();
    CRLReason reason = CRLReason.getInstance((ASN1Enumerated) obj);
    assertEquals("CRLReason: certificateHold", reason.toString());
    //DEROctetString ostr = (DEROctetString)obj;

    // Create a delta CRL
    revcerts = new ArrayList<RevokedCertInfo>();
    crl = x509ca.generateDeltaCRL(cryptoToken, revcerts, 3, 2);
    assertNotNull(crl);
    xcrl = CertTools.getCRLfromByteArray(crl.getEncoded());
    assertEquals(CADN, CertTools.getIssuerDN(xcrl));
    set = xcrl.getRevokedCertificates();
    assertNull(set);
    num = CrlExtensions.getCrlNumber(xcrl);
    assertEquals(3, num.intValue());
    deltanum = CrlExtensions.getDeltaCRLIndicator(xcrl);
    assertEquals(2, deltanum.intValue());
    revcerts.add(new RevokedCertInfo(CertTools.getFingerprintAsString(usercert).getBytes(),
            CertTools.getSerialNumber(usercert).toByteArray(), revDate.getTime(),
            RevokedCertInfo.REVOCATION_REASON_CERTIFICATEHOLD, CertTools.getNotAfter(usercert).getTime()));
    crl = x509ca.generateDeltaCRL(cryptoToken, revcerts, 4, 3);
    assertNotNull(crl);
    xcrl = CertTools.getCRLfromByteArray(crl.getEncoded());
    deltanum = CrlExtensions.getDeltaCRLIndicator(xcrl);
    assertEquals(3, deltanum.intValue());
    set = xcrl.getRevokedCertificates();
    assertEquals(1, set.size());
    entry = (X509CRLEntry) set.iterator().next();
    assertEquals(CertTools.getSerialNumber(usercert).toString(), entry.getSerialNumber().toString());
    assertEquals(revDate.toString(), entry.getRevocationDate().toString());
    // Getting the revocation reason is a pita...
    extval = entry.getExtensionValue(Extension.reasonCode.getId());
    aIn = new ASN1InputStream(new ByteArrayInputStream(extval));
    octs = (ASN1OctetString) aIn.readObject();
    aIn = new ASN1InputStream(new ByteArrayInputStream(octs.getOctets()));
    obj = aIn.readObject();
    reason = CRLReason.getInstance((ASN1Enumerated) obj);
    assertEquals("CRLReason: certificateHold", reason.toString());
}

From source file:org.cesecore.certificates.certificate.certextensions.BasicCertificateExtension.java

License:Open Source License

/**
 * Returns the defined property 'value' in the encoding specified in 'encoding'.
 * //from  w  ww . ja  va 2s . c  o m
 * This certificate extension implementations overrides this method as it 
 * want to be able to return a byte[] with the extension value. Otherwise 
 * the implementation could have been put in the getValue method as the 
 * super class CertificateExtension has a default implementation for 
 * getValueEncoded which calls getValue.
 * 
 * @param userData
 *            Used to lookup extension data
 * @param ca
 *            not used
 * @param certProfile
 *            not used
 * @see org.cesecore.certificates.certificate.certextensions.CertificateExtension#getValue(EndEntityInformation, CA, CertificateProfile, PublicKey,
 *      PublicKey, CertificateValidity)
 */
@Override
public byte[] getValueEncoded(EndEntityInformation userData, CA ca, CertificateProfile certProfile,
        PublicKey userPublicKey, PublicKey caPublicKey, CertificateValidity val)
        throws CertificateExtensionException {
    final byte[] result;
    String encoding = StringUtils.trim(getProperties().getProperty(PROPERTY_ENCODING));
    String[] values = getValues(userData);
    if (log.isDebugEnabled()) {
        log.debug("Got extension values: " + Arrays.toString(values));
    }

    if (values == null || values.length == 0) {
        throw new CertificateExtensionException(
                intres.getLocalizedMessage("certext.basic.incorrectvalue", Integer.valueOf(getId()), getOID()));
    }

    if (encoding.equalsIgnoreCase(ENCODING_RAW)) {
        if (values.length > 1) {
            // nvalues can not be used together with encoding=RAW
            throw new CertificateExtensionException(
                    intres.getLocalizedMessage("certext.certextmissconfigured", Integer.valueOf(getId())));
        } else {
            result = parseRaw(values[0]);
        }
    } else {
        try {
            if (values.length > 1) {
                ASN1EncodableVector ev = new ASN1EncodableVector();
                for (String value : values) {
                    ASN1Encodable derval = parseValue(encoding, value);
                    ev.add(derval);
                }
                result = new DERSequence(ev).getEncoded();
            } else {
                result = parseValue(encoding, values[0]).toASN1Primitive().getEncoded();
            }
        } catch (IOException ioe) {
            throw new CertificateExtensionException(ioe.getMessage(), ioe);
        }
    }
    return result;
}