Example usage for org.bouncycastle.asn1 DERSequence DERSequence

List of usage examples for org.bouncycastle.asn1 DERSequence DERSequence

  1. HOME
  2. Java
  3. org.bouncycastle
  4. org.bouncycastle.asn1.*
  5. DERSequence
  6. DERSequence

Introduction

In this page you can find the example usage for org.bouncycastle.asn1 DERSequence DERSequence.

Prototype

public DERSequence(ASN1Encodable[] elements)

Source Link

Document

Create a sequence containing an array of objects.

Usage

From source file:org.cagrid.security.ssl.proxy.trust.ProxyPolicy.java

License:Open Source License

/**
 * Returns the DER-encoded ASN.1 representation of proxy policy.
 * /* w w  w  .j  a v a 2s .  c  om*/
 * @return <code>DERObject</code> the encoded representation of the proxy
 *         policy.
 */
public DERObject getDERObject() {
    ASN1EncodableVector vec = new ASN1EncodableVector();

    vec.add(this.policyLanguage);

    if (this.policy != null) {
        vec.add(this.policy);
    }

    return new DERSequence(vec);
}

From source file:org.candlepin.resource.test.cert.test.CertTest.java

License:Open Source License

@Test
public void testCertExample() throws Exception {

    Security.addProvider(new BouncyCastleProvider());

    ///*from   w w w  . j  a v a 2  s .  c o  m*/
    // set up the keys
    //
    KeyFactory fact = KeyFactory.getInstance("RSA", "BC");
    PrivateKey caPrivKey = fact.generatePrivate(caPrivKeySpec);
    PublicKey caPubKey = fact.generatePublic(caPubKeySpec);
    //PrivateKey privKey =
    fact.generatePrivate(privKeySpec);
    PublicKey pubKey = fact.generatePublic(pubKeySpec);

    //
    // note in this case we are using the CA certificate for both the client
    // cetificate
    // and the attribute certificate. This is to make the vcode simpler to
    // read, in practice
    // the CA for the attribute certificate should be different to that of
    // the client certificate
    //
    X509Certificate caCert = AttrCertExample.createAcIssuerCert(caPubKey, caPrivKey);
    X509Certificate clientCert = AttrCertExample.createClientCert(pubKey, caPrivKey, caPubKey);
    // Instantiate a new AC generator
    X509V2AttributeCertificateGenerator acGen = new X509V2AttributeCertificateGenerator();

    acGen.reset();

    //
    // Holder: here we use the IssuerSerial form
    //
    acGen.setHolder(new AttributeCertificateHolder(clientCert));

    // set the Issuer
    acGen.setIssuer(new AttributeCertificateIssuer(caCert.getSubjectX500Principal()));

    //
    // serial number (as it's an example we don't have to keep track of the
    // serials anyway
    //
    acGen.setSerialNumber(BigInteger.ONE);

    // not Before
    acGen.setNotBefore(new Date(System.currentTimeMillis() - 50000));

    // not After
    acGen.setNotAfter(new Date(System.currentTimeMillis() + 50000));

    // signature Algorithmus
    acGen.setSignatureAlgorithm("SHA1WithRSAEncryption");

    // the actual attributes
    GeneralName roleName = new GeneralName(GeneralName.rfc822Name, "DAU123456789");
    ASN1EncodableVector roleSyntax = new ASN1EncodableVector();
    roleSyntax.add(roleName);

    // roleSyntax OID: 2.5.24.72
    X509Attribute attributes = new X509Attribute("2.5.24.72", new DERSequence(roleSyntax));

    acGen.addAttribute(attributes);

    // finally create the AC
    X509V2AttributeCertificate att = (X509V2AttributeCertificate) acGen.generate(caPrivKey, "BC");

    //String encoded = new String(att.getEncoded());
    //System.out.println("CERT CERT: " + encoded);
    //KeyStore store = KeyStore.getInstance("PKCS12");
    //String pass = "redhat";

    /*FileOutputStream fout = new FileOutputStream("/tmp/foo.file");
    store.load(null, null);
    store.store(fout, pass.toCharArray());
    X509CertificateObject ccert = new
    X509CertificateObject(new X509CertificateStructure(new DERSequence(att)));*/
    //
    // starting here, we parse the newly generated AC
    //

    // Holder

    AttributeCertificateHolder h = att.getHolder();
    if (h.match(clientCert)) {
        if (h.getEntityNames() != null) {
            //                System.out.println(h.getEntityNames().length +
            //                    " entity names found");
        }
        if (h.getIssuer() != null) {
            //                System.out.println(h.getIssuer().length +
            //                    " issuer names found, serial number " +
            //                    h.getSerialNumber());
        }
        //            System.out.println("Matches original client x509 cert");
    }

    // Issuer

    AttributeCertificateIssuer issuer = att.getIssuer();
    if (issuer.match(caCert)) {
        if (issuer.getPrincipals() != null) {
            //                System.out.println(issuer.getPrincipals().length +
            //                    " entity names found");
        }
        //            System.out.println("Matches original ca x509 cert");
    }

    // Dates
    //        System.out.println("valid not before: " + att.getNotBefore());
    //        System.out.println("valid not before: " + att.getNotAfter());

    // check the dates, an exception is thrown in checkValidity()...

    try {
        att.checkValidity();
        att.checkValidity(new Date());
    } catch (Exception e) {
        System.out.println(e);
    }

    // verify

    try {
        att.verify(caPubKey, "BC");
    } catch (Exception e) {
        System.out.println(e);
    }

    // Attribute
    X509Attribute[] attribs = att.getAttributes();
    //        System.out.println("cert has " + attribs.length + " attributes:");
    for (int i = 0; i < attribs.length; i++) {
        X509Attribute a = attribs[i];
        //            System.out.println("OID: " + a.getOID());

        // currently we only check for the presence of a 'RoleSyntax'
        // attribute

        if (a.getOID().equals("2.5.24.72")) {
            //                System.out.println("rolesyntax read from cert!");
        }
    }
}

From source file:org.candlepin.util.X509CRLStreamWriter.java

License:Open Source License

/**
 * Create an entry to be added to the CRL.
 *
 * @param serial//www  .j a  va 2s .  co  m
 * @param date
 * @param reason
 */
@SuppressWarnings({ "unchecked", "rawtypes" })
public void add(BigInteger serial, Date date, int reason) {
    if (locked) {
        throw new IllegalStateException("Cannot add to a locked stream.");
    }

    ASN1EncodableVector v = new ASN1EncodableVector();

    v.add(new DERInteger(serial));
    v.add(new Time(date));

    CRLReason crlReason = new CRLReason(reason);
    Vector extOids = new Vector();
    Vector extValues = new Vector();
    extOids.addElement(X509Extension.reasonCode);
    extValues.addElement(new X509Extension(false, new DEROctetString(crlReason.getDEREncoded())));
    v.add(new X509Extensions(extOids, extValues));

    newEntries.add(new DERSequence(v));
}

From source file:org.candlepin.util.X509CRLStreamWriter.java

License:Open Source License

/**
 * This method updates the crlNumber and authorityKeyIdentifier extensions.  Any
 * other extensions are copied over unchanged.
 * @param extensions/*from  w  w w  .ja  v  a 2 s .c  om*/
 * @return
 * @throws IOException
 */
@SuppressWarnings("rawtypes")
protected byte[] updateExtensions(byte[] obj) throws IOException {
    DERTaggedObject taggedExts = (DERTaggedObject) DERTaggedObject.fromByteArray(obj);
    DERSequence seq = (DERSequence) taggedExts.getObject();
    ASN1EncodableVector modifiedExts = new ASN1EncodableVector();

    // Now we need to read the extensions and find the CRL number and increment it,
    // and determine if its length changed.
    Enumeration objs = seq.getObjects();
    while (objs.hasMoreElements()) {
        DERSequence ext = (DERSequence) objs.nextElement();
        DERObjectIdentifier oid = (DERObjectIdentifier) ext.getObjectAt(0);
        if (X509Extension.cRLNumber.equals(oid)) {
            DEROctetString s = (DEROctetString) ext.getObjectAt(1);
            DERInteger i = (DERInteger) DERTaggedObject.fromByteArray(s.getOctets());
            DERInteger newCrlNumber = new DERInteger(i.getValue().add(BigInteger.ONE));

            X509Extension newNumberExt = new X509Extension(false,
                    new DEROctetString(newCrlNumber.getDEREncoded()));

            ASN1EncodableVector crlNumber = new ASN1EncodableVector();
            crlNumber.add(X509Extension.cRLNumber);
            crlNumber.add(newNumberExt.getValue());
            modifiedExts.add(new DERSequence(crlNumber));
        } else if (X509Extension.authorityKeyIdentifier.equals(oid)) {
            X509Extension newAuthorityKeyExt = new X509Extension(false,
                    new DEROctetString(akiStructure.getDEREncoded()));

            ASN1EncodableVector aki = new ASN1EncodableVector();
            aki.add(X509Extension.authorityKeyIdentifier);
            aki.add(newAuthorityKeyExt.getValue());
            modifiedExts.add(new DERSequence(aki));
        } else {
            modifiedExts.add(ext);
        }
    }

    DERSequence seqOut = new DERSequence(modifiedExts);
    DERTaggedObject out = new DERTaggedObject(true, 0, seqOut);
    return out.getDEREncoded();
}

From source file:org.ccnx.ccn.impl.security.crypto.MerklePath.java

License:Open Source License

/**
 * DER-encode the path. Embed it in a DigestInfo
 * with the appropriate algorithm identifier.
 * @return the DER-encoded path/*from  w ww. j a  va2  s  .  com*/
 */
public byte[] derEncodedPath() {

    /**
     * Sequence of OCTET STRING
     */
    DERSequence sequenceOf = new DERSequence(_path);
    /**
     * Sequence of INTEGER, SEQUENCE OF OCTET STRING
     */
    DERInteger intVal = new DERInteger(leafNodeIndex());
    ASN1Encodable[] pathStruct = new ASN1Encodable[] { intVal, sequenceOf };
    DERSequence encodablePath = new DERSequence(pathStruct);
    byte[] encodedPath = encodablePath.getDEREncoded();

    // Wrap it up in a DigestInfo
    return CCNDigestHelper.digestEncoder(CCNMerkleTree.DEFAULT_MHT_ALGORITHM, encodedPath);
}

From source file:org.ccnx.ccn.impl.security.crypto.util.AuthorityKeyIdentifier.java

License:Open Source License

/**
* <pre>/*  ww w .  j  av  a 2s. c  o m*/
*   AuthorityKeyIdentifier ::= SEQUENCE {
*      keyIdentifier             [0] IMPLICIT KeyIdentifier           OPTIONAL,
*      authorityCertIssuer       [1] IMPLICIT GeneralNames            OPTIONAL,
*      authorityCertSerialNumber [2] IMPLICIT CertificateSerialNumber OPTIONAL  }
*
*   KeyIdentifier ::= OCTET STRING
* </pre>
*/
public DERObject getDERObject() {

    ASN1EncodableVector seq = new ASN1EncodableVector();

    if (null != this._keyIdentifier)
        seq.add(new DERTaggedObject(false, tag_KeyIdentifier, _keyIdentifier));

    if (null != this._issuerName)
        seq.add(new DERTaggedObject(false, tag_IssuerName, _issuerName));

    if (null != this._issuerSerial)
        seq.add(new DERTaggedObject(false, tag_issuerSerialNumber, _issuerSerial));

    return new DERSequence(seq);
}

From source file:org.ccnx.ccn.impl.security.crypto.util.MinimalCertificateGenerator.java

License:Open Source License

/**
 * Adds an subject alternative name extension to the certificate.
 *///from   w  w w  .  j  a  v a 2 s  .c  o  m
protected void addSubjectAltNamesExtension() {
    if (_subjectAltNames.size() == 0)
        return;
    GeneralNames genNames = new GeneralNames(new DERSequence(_subjectAltNames));
    _generator.addExtension(X509Extensions.SubjectAlternativeName, false, genNames);
}

From source file:org.ccnx.ccn.impl.security.keystore.AESKeyStoreSpi.java

License:Open Source License

/**
 * Store the key from _id into a keystore file
 *///from w  w w .j av a  2s .  c o m
@Override
public void engineStore(OutputStream stream, char[] password)
        throws IOException, NoSuchAlgorithmException, CertificateException {
    if (null == _id)
        throw new IOException("Key not entered yet");
    ASN1OutputStream aos = new ASN1OutputStream(stream);
    Tuple<SecretKeySpec, SecretKeySpec> keys = initializeForAES(password);
    try {
        byte[] iv = new byte[IV_SIZE];
        _random.nextBytes(iv);
        byte[] aesCBC = null;
        Cipher cipher = Cipher.getInstance(AES_CRYPTO_ALGORITHM);
        IvParameterSpec ivspec = new IvParameterSpec(iv);
        cipher.init(Cipher.ENCRYPT_MODE, keys.first(), ivspec);
        aesCBC = cipher.doFinal(_id);
        _macKeyMac.init(keys.second());
        byte[] checkbuf = new byte[iv.length + aesCBC.length];
        System.arraycopy(iv, 0, checkbuf, 0, iv.length);
        System.arraycopy(aesCBC, 0, checkbuf, iv.length, aesCBC.length);
        byte[] part3 = _macKeyMac.doFinal(checkbuf);
        // TODO might be a better way to do this but am not sure how
        // (and its not really that important anyway)
        byte[] asn1buf = new byte[iv.length + aesCBC.length + part3.length];
        System.arraycopy(checkbuf, 0, asn1buf, 0, checkbuf.length);
        System.arraycopy(part3, 0, asn1buf, iv.length + aesCBC.length, part3.length);
        ASN1OctetString os = new DEROctetString(asn1buf);
        ASN1Encodable[] ae = new ASN1Encodable[3];
        ae[0] = _version;
        ae[1] = _oid;
        ae[2] = os;
        DERSequence ds = new DERSequence(ae);
        aos.writeObject(ds);
        aos.flush();
        aos.close();
    } catch (Exception e) {
        throw new IOException(e);
    }
}

From source file:org.cesecore.certificates.ca.X509CA.java

License:Open Source License

/**
 * Constructs the SubjectAlternativeName extension that will end up on the generated certificate.
 * //  w w  w .ja  v  a2s .  c  o  m
 * If the DNS values in the subjectAlternativeName extension contain parentheses to specify labels that should be redacted, the parentheses are removed and another extension 
 * containing the number of redacted labels is added.
 * 
 * @param subAltNameExt
 * @param publishToCT
 * @return An extension generator containing the SubjectAlternativeName extension and an extension holding the number of redacted labels if the certificate is to be published 
 * to a CTLog
 * @throws IOException
 */
private ExtensionsGenerator getSubjectAltNameExtensionForCert(Extension subAltNameExt, boolean publishToCT)
        throws IOException {
    String subAltName = CertTools.getAltNameStringFromExtension(subAltNameExt);
    List<String> dnsValues = CertTools.getPartsFromDN(subAltName, CertTools.DNS);
    int[] nrOfRecactedLables = new int[dnsValues.size()];
    boolean sanEdited = false;
    int i = 0;
    for (String dns : dnsValues) {
        if (StringUtils.contains(dns, "(") && StringUtils.contains(dns, ")")) { // if it contains parts that should be redacted
            // Remove the parentheses from the SubjectAltName that will end up on the certificate
            String certBuilderDNSValue = StringUtils.remove(dns, '(');
            certBuilderDNSValue = StringUtils.remove(certBuilderDNSValue, ')');
            subAltName = StringUtils.replace(subAltName, dns, certBuilderDNSValue);
            sanEdited = true;
            if (publishToCT) {
                String redactedLable = StringUtils.substring(dns, StringUtils.indexOf(dns, "("),
                        StringUtils.lastIndexOf(dns, ")") + 1); // tex. (top.secret).domain.se => redactedLable = (top.secret) aka. including the parentheses 
                nrOfRecactedLables[i] = StringUtils.countMatches(redactedLable, ".") + 1;
            }
        }
        i++;
    }
    ExtensionsGenerator gen = new ExtensionsGenerator();
    gen.addExtension(Extension.subjectAlternativeName, subAltNameExt.isCritical(),
            CertTools.getGeneralNamesFromAltName(subAltName));
    // If there actually are redacted parts, add the extension containing the number of redacted lables to the certificate 
    if (publishToCT && sanEdited) {
        ASN1EncodableVector v = new ASN1EncodableVector();
        for (int val : nrOfRecactedLables) {
            v.add(new ASN1Integer(val));
        }
        ASN1Encodable seq = new DERSequence(v);
        gen.addExtension(new ASN1ObjectIdentifier("1.3.6.1.4.1.11129.2.4.6"), false, seq);
    }

    return gen;
}

From source file:org.cesecore.certificates.ca.X509CA.java

License:Open Source License

/**
 * Generate a CRL or a deltaCRL/* w  w w . j  av  a  2s.com*/
 * 
 * @param certs
 *            list of revoked certificates
 * @param crlnumber
 *            CRLNumber for this CRL
 * @param isDeltaCRL
 *            true if we should generate a DeltaCRL
 * @param basecrlnumber
 *            caseCRLNumber for a delta CRL, use 0 for full CRLs
 * @param certProfile
 *            certificate profile for CRL Distribution point in the CRL, or null
 * @return CRL
 * @throws CryptoTokenOfflineException
 * @throws IllegalCryptoTokenException
 * @throws IOException
 * @throws SignatureException
 * @throws NoSuchProviderException
 * @throws InvalidKeyException
 * @throws CRLException
 * @throws NoSuchAlgorithmException
 */
private X509CRLHolder generateCRL(CryptoToken cryptoToken, Collection<RevokedCertInfo> certs, long crlPeriod,
        int crlnumber, boolean isDeltaCRL, int basecrlnumber)
        throws CryptoTokenOfflineException, IllegalCryptoTokenException, IOException, SignatureException,
        NoSuchProviderException, InvalidKeyException, CRLException, NoSuchAlgorithmException {
    final String sigAlg = getCAInfo().getCAToken().getSignatureAlgorithm();

    if (log.isDebugEnabled()) {
        log.debug("generateCRL(" + certs.size() + ", " + crlPeriod + ", " + crlnumber + ", " + isDeltaCRL + ", "
                + basecrlnumber);
    }

    // Make DNs
    final X509Certificate cacert = (X509Certificate) getCACertificate();
    final X500Name issuer;
    if (cacert == null) {
        // This is an initial root CA, since no CA-certificate exists
        // (I don't think we can ever get here!!!)
        final X500NameStyle nameStyle;
        if (getUsePrintableStringSubjectDN()) {
            nameStyle = PrintableStringNameStyle.INSTANCE;
        } else {
            nameStyle = CeSecoreNameStyle.INSTANCE;
        }
        issuer = CertTools.stringToBcX500Name(getSubjectDN(), nameStyle, getUseLdapDNOrder());
    } else {
        issuer = X500Name.getInstance(cacert.getSubjectX500Principal().getEncoded());
    }
    final Date thisUpdate = new Date();
    final Date nextUpdate = new Date();
    nextUpdate.setTime(nextUpdate.getTime() + crlPeriod);
    final X509v2CRLBuilder crlgen = new X509v2CRLBuilder(issuer, thisUpdate);
    crlgen.setNextUpdate(nextUpdate);
    if (certs != null) {
        if (log.isDebugEnabled()) {
            log.debug("Adding " + certs.size() + " revoked certificates to CRL. Free memory="
                    + Runtime.getRuntime().freeMemory());
        }
        final Iterator<RevokedCertInfo> it = certs.iterator();
        while (it.hasNext()) {
            final RevokedCertInfo certinfo = (RevokedCertInfo) it.next();
            crlgen.addCRLEntry(certinfo.getUserCertificate(), certinfo.getRevocationDate(),
                    certinfo.getReason());
        }
        if (log.isDebugEnabled()) {
            log.debug("Finished adding " + certs.size() + " revoked certificates to CRL. Free memory="
                    + Runtime.getRuntime().freeMemory());
        }
    }

    // Authority key identifier
    if (getUseAuthorityKeyIdentifier() == true) {
        byte[] caSkid = (cacert != null ? CertTools.getSubjectKeyId(cacert) : null);
        if (caSkid != null) {
            // Use subject key id from CA certificate
            AuthorityKeyIdentifier aki = new AuthorityKeyIdentifier(caSkid);
            crlgen.addExtension(Extension.authorityKeyIdentifier, getAuthorityKeyIdentifierCritical(), aki);
        } else {
            // Generate from SHA1 of public key
            ASN1InputStream asn1InputStream = new ASN1InputStream(new ByteArrayInputStream(cryptoToken
                    .getPublicKey(getCAToken().getAliasFromPurpose(CATokenConstants.CAKEYPURPOSE_CRLSIGN))
                    .getEncoded()));
            try {
                SubjectPublicKeyInfo apki = new SubjectPublicKeyInfo(
                        (ASN1Sequence) asn1InputStream.readObject());
                AuthorityKeyIdentifier aki = new AuthorityKeyIdentifier(apki);
                crlgen.addExtension(Extension.authorityKeyIdentifier, getAuthorityKeyIdentifierCritical(), aki);
            } finally {
                asn1InputStream.close();
            }
        }
    }

    // Authority Information Access  
    final ASN1EncodableVector accessList = new ASN1EncodableVector();
    if (getAuthorityInformationAccess() != null) {
        for (String url : getAuthorityInformationAccess()) {
            if (StringUtils.isNotEmpty(url)) {
                GeneralName accessLocation = new GeneralName(GeneralName.uniformResourceIdentifier,
                        new DERIA5String(url));
                accessList.add(new AccessDescription(AccessDescription.id_ad_caIssuers, accessLocation));
            }
        }
    }
    if (accessList.size() > 0) {
        AuthorityInformationAccess authorityInformationAccess = AuthorityInformationAccess
                .getInstance(new DERSequence(accessList));
        // "This CRL extension MUST NOT be marked critical." according to rfc4325
        crlgen.addExtension(Extension.authorityInfoAccess, false, authorityInformationAccess);
    }

    // CRLNumber extension
    if (getUseCRLNumber() == true) {
        CRLNumber crlnum = new CRLNumber(BigInteger.valueOf(crlnumber));
        crlgen.addExtension(Extension.cRLNumber, this.getCRLNumberCritical(), crlnum);
    }

    if (isDeltaCRL) {
        // DeltaCRLIndicator extension
        CRLNumber basecrlnum = new CRLNumber(BigInteger.valueOf(basecrlnumber));
        crlgen.addExtension(Extension.deltaCRLIndicator, true, basecrlnum);
    }
    // CRL Distribution point URI and Freshest CRL DP
    if (getUseCrlDistributionPointOnCrl()) {
        String crldistpoint = getDefaultCRLDistPoint();
        List<DistributionPoint> distpoints = generateDistributionPoints(crldistpoint);

        if (distpoints.size() > 0) {
            IssuingDistributionPoint idp = new IssuingDistributionPoint(
                    distpoints.get(0).getDistributionPoint(), false, false, null, false, false);

            // According to the RFC, IDP must be a critical extension.
            // Nonetheless, at the moment, Mozilla is not able to correctly
            // handle the IDP extension and discards the CRL if it is critical.
            crlgen.addExtension(Extension.issuingDistributionPoint, getCrlDistributionPointOnCrlCritical(),
                    idp);
        }

        if (!isDeltaCRL) {
            String crlFreshestDP = getCADefinedFreshestCRL();
            List<DistributionPoint> freshestDistPoints = generateDistributionPoints(crlFreshestDP);
            if (freshestDistPoints.size() > 0) {
                CRLDistPoint ext = new CRLDistPoint((DistributionPoint[]) freshestDistPoints
                        .toArray(new DistributionPoint[freshestDistPoints.size()]));

                // According to the RFC, the Freshest CRL extension on a
                // CRL must not be marked as critical. Therefore it is
                // hardcoded as not critical and is independent of
                // getCrlDistributionPointOnCrlCritical().
                crlgen.addExtension(Extension.freshestCRL, false, ext);
            }

        }
    }

    final X509CRLHolder crl;
    if (log.isDebugEnabled()) {
        log.debug("Signing CRL. Free memory=" + Runtime.getRuntime().freeMemory());
    }
    final String alias = getCAToken().getAliasFromPurpose(CATokenConstants.CAKEYPURPOSE_CRLSIGN);
    try {
        final ContentSigner signer = new BufferingContentSigner(new JcaContentSignerBuilder(sigAlg)
                .setProvider(cryptoToken.getSignProviderName()).build(cryptoToken.getPrivateKey(alias)), 20480);
        crl = crlgen.build(signer);
    } catch (OperatorCreationException e) {
        // Very fatal error
        throw new RuntimeException("Can not create Jca content signer: ", e);
    }
    if (log.isDebugEnabled()) {
        log.debug("Finished signing CRL. Free memory=" + Runtime.getRuntime().freeMemory());
    }

    // Verify using the CA certificate before returning
    // If we can not verify the issued CRL using the CA certificate we don't want to issue this CRL
    // because something is wrong...
    final PublicKey verifyKey;
    if (cacert != null) {
        verifyKey = cacert.getPublicKey();
        if (log.isTraceEnabled()) {
            log.trace("Got the verify key from the CA certificate.");
        }
    } else {
        verifyKey = cryptoToken.getPublicKey(alias);
        if (log.isTraceEnabled()) {
            log.trace("Got the verify key from the CA token.");
        }
    }
    try {
        final ContentVerifierProvider verifier = new JcaContentVerifierProviderBuilder().build(verifyKey);
        if (!crl.isSignatureValid(verifier)) {
            throw new SignatureException("Error verifying CRL to be returned.");
        }
    } catch (OperatorCreationException e) {
        // Very fatal error
        throw new RuntimeException("Can not create Jca content signer: ", e);
    } catch (CertException e) {
        throw new SignatureException(e.getMessage(), e);
    }
    if (log.isDebugEnabled()) {
        log.debug("Returning CRL. Free memory=" + Runtime.getRuntime().freeMemory());
    }
    return crl;
}