Example usage for org.bouncycastle.asn1 DERSequence DERSequence

List of usage examples for org.bouncycastle.asn1 DERSequence DERSequence

  1. HOME
  2. Java
  3. org.bouncycastle
  4. org.bouncycastle.asn1.*
  5. DERSequence
  6. DERSequence

Introduction

In this page you can find the example usage for org.bouncycastle.asn1 DERSequence DERSequence.

Prototype

public DERSequence(ASN1Encodable[] elements)

Source Link

Document

Create a sequence containing an array of objects.

Usage

From source file:org.cesecore.certificates.ca.X509CA.java

License:Open Source License

/**
 * Generate a list of Distribution points.
 * //from w  ww  . jav a 2  s  . c o m
 * @param distPoints
 *            distribution points as String in semi column (';') separated format.
 * @return list of distribution points.
 */
private List<DistributionPoint> generateDistributionPoints(String distPoints) {
    if (distPoints == null) {
        distPoints = "";
    }
    // Multiple CDPs are separated with the ';' sign
    Iterator<String> it = StringTools.splitURIs(distPoints).iterator();
    ArrayList<DistributionPoint> result = new ArrayList<DistributionPoint>();
    while (it.hasNext()) {
        String uri = (String) it.next();
        GeneralName gn = new GeneralName(GeneralName.uniformResourceIdentifier, new DERIA5String(uri));
        if (log.isDebugEnabled()) {
            log.debug("Added CRL distpoint: " + uri);
        }
        ASN1EncodableVector vec = new ASN1EncodableVector();
        vec.add(gn);
        GeneralNames gns = GeneralNames.getInstance(new DERSequence(vec));
        DistributionPointName dpn = new DistributionPointName(0, gns);
        result.add(new DistributionPoint(dpn, null, null));
    }
    return result;
}

From source file:org.cesecore.certificates.ca.X509CATest.java

License:Open Source License

@SuppressWarnings("unchecked")
private void doTestX509CABasicOperations(String algName) throws Exception {
    final CryptoToken cryptoToken = getNewCryptoToken();
    final X509CA x509ca = createTestCA(cryptoToken, CADN);
    Certificate cacert = x509ca.getCACertificate();

    // Start by creating a PKCS7
    byte[] p7 = x509ca.createPKCS7(cryptoToken, cacert, true);
    assertNotNull(p7);//from  ww  w .  java2s  .c  om
    CMSSignedData s = new CMSSignedData(p7);
    Store certstore = s.getCertificates();
    Collection<X509CertificateHolder> certs = certstore.getMatches(null);
    assertEquals(2, certs.size());
    p7 = x509ca.createPKCS7(cryptoToken, cacert, false);
    assertNotNull(p7);
    s = new CMSSignedData(p7);
    certstore = s.getCertificates();
    certs = certstore.getMatches(null);
    assertEquals(1, certs.size());

    // Create a certificate request (will be pkcs10)
    byte[] req = x509ca.createRequest(cryptoToken, null, algName, cacert,
            CATokenConstants.CAKEYPURPOSE_CERTSIGN);
    PKCS10CertificationRequest p10 = new PKCS10CertificationRequest(req);
    assertNotNull(p10);
    String dn = p10.getSubject().toString();
    assertEquals(CADN, dn);

    // Make a request with some pkcs11 attributes as well
    Collection<ASN1Encodable> attributes = new ArrayList<ASN1Encodable>();
    // Add a subject alternative name
    ASN1EncodableVector altnameattr = new ASN1EncodableVector();
    altnameattr.add(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest);
    GeneralNames san = CertTools.getGeneralNamesFromAltName("dNSName=foobar.bar.com");
    ExtensionsGenerator extgen = new ExtensionsGenerator();
    extgen.addExtension(Extension.subjectAlternativeName, false, san);
    Extensions exts = extgen.generate();
    altnameattr.add(new DERSet(exts));
    // Add a challenge password as well
    ASN1EncodableVector pwdattr = new ASN1EncodableVector();
    pwdattr.add(PKCSObjectIdentifiers.pkcs_9_at_challengePassword);
    ASN1EncodableVector pwdvalues = new ASN1EncodableVector();
    pwdvalues.add(new DERUTF8String("foobar123"));
    pwdattr.add(new DERSet(pwdvalues));
    attributes.add(new DERSequence(altnameattr));
    attributes.add(new DERSequence(pwdattr));
    // create the p10
    req = x509ca.createRequest(cryptoToken, attributes, algName, cacert,
            CATokenConstants.CAKEYPURPOSE_CERTSIGN);
    p10 = new PKCS10CertificationRequest(req);
    assertNotNull(p10);
    dn = p10.getSubject().toString();
    assertEquals(CADN, dn);
    Attribute[] attrs = p10.getAttributes();
    assertEquals(2, attrs.length);
    PKCS10RequestMessage p10msg = new PKCS10RequestMessage(new JcaPKCS10CertificationRequest(p10));
    assertEquals("foobar123", p10msg.getPassword());
    assertEquals("dNSName=foobar.bar.com", p10msg.getRequestAltNames());

    try {
        x509ca.createAuthCertSignRequest(cryptoToken, p10.getEncoded());
    } catch (UnsupportedOperationException e) {
        // Expected for a X509 CA
    }

    // Generate a client certificate and check that it was generated correctly
    EndEntityInformation user = new EndEntityInformation("username", "CN=User", 666, "rfc822Name=user@user.com",
            "user@user.com", new EndEntityType(EndEntityTypes.ENDUSER), 0, 0, EndEntityConstants.TOKEN_USERGEN,
            0, null);
    KeyPair keypair = genTestKeyPair(algName);
    CertificateProfile cp = new CertificateProfile(CertificateProfileConstants.CERTPROFILE_FIXED_ENDUSER);
    cp.addCertificatePolicy(new CertificatePolicy("1.1.1.2", null, null));
    cp.setUseCertificatePolicies(true);
    Certificate usercert = x509ca.generateCertificate(cryptoToken, user, keypair.getPublic(), 0, null, 10L, cp,
            "00000");
    assertNotNull(usercert);
    assertEquals("CN=User", CertTools.getSubjectDN(usercert));
    assertEquals(CADN, CertTools.getIssuerDN(usercert));
    assertEquals(getTestKeyPairAlgName(algName).toUpperCase(),
            AlgorithmTools.getCertSignatureAlgorithmNameAsString(usercert).toUpperCase());
    assertEquals(new String(CertTools.getSubjectKeyId(cacert)),
            new String(CertTools.getAuthorityKeyId(usercert)));
    assertEquals("user@user.com", CertTools.getEMailAddress(usercert));
    assertEquals("rfc822name=user@user.com", CertTools.getSubjectAlternativeName(usercert));
    assertNull(CertTools.getUPNAltName(usercert));
    assertFalse(CertTools.isSelfSigned(usercert));
    usercert.verify(cryptoToken
            .getPublicKey(x509ca.getCAToken().getAliasFromPurpose(CATokenConstants.CAKEYPURPOSE_CERTSIGN)));
    usercert.verify(x509ca.getCACertificate().getPublicKey());
    assertTrue(CertTools.isCA(x509ca.getCACertificate()));
    assertFalse(CertTools.isCA(usercert));
    assertEquals("1.1.1.2", CertTools.getCertificatePolicyId(usercert, 0));
    X509Certificate cert = (X509Certificate) usercert;
    boolean[] ku = cert.getKeyUsage();
    assertTrue(ku[0]);
    assertTrue(ku[1]);
    assertTrue(ku[2]);
    assertFalse(ku[3]);
    assertFalse(ku[4]);
    assertFalse(ku[5]);
    assertFalse(ku[6]);
    assertFalse(ku[7]);
    int bcku = CertTools.sunKeyUsageToBC(ku);
    assertEquals(X509KeyUsage.digitalSignature | X509KeyUsage.nonRepudiation | X509KeyUsage.keyEncipherment,
            bcku);

    // Create a CRL
    Collection<RevokedCertInfo> revcerts = new ArrayList<RevokedCertInfo>();
    X509CRLHolder crl = x509ca.generateCRL(cryptoToken, revcerts, 1);
    assertNotNull(crl);
    X509CRL xcrl = CertTools.getCRLfromByteArray(crl.getEncoded());
    assertEquals(CADN, CertTools.getIssuerDN(xcrl));
    Set<?> set = xcrl.getRevokedCertificates();
    assertNull(set);
    BigInteger num = CrlExtensions.getCrlNumber(xcrl);
    assertEquals(1, num.intValue());
    BigInteger deltanum = CrlExtensions.getDeltaCRLIndicator(xcrl);
    assertEquals(-1, deltanum.intValue());
    // Revoke some cert
    Date revDate = new Date();
    revcerts.add(new RevokedCertInfo(CertTools.getFingerprintAsString(usercert).getBytes(),
            CertTools.getSerialNumber(usercert).toByteArray(), revDate.getTime(),
            RevokedCertInfo.REVOCATION_REASON_CERTIFICATEHOLD, CertTools.getNotAfter(usercert).getTime()));
    crl = x509ca.generateCRL(cryptoToken, revcerts, 2);
    assertNotNull(crl);
    xcrl = CertTools.getCRLfromByteArray(crl.getEncoded());
    set = xcrl.getRevokedCertificates();
    assertEquals(1, set.size());
    num = CrlExtensions.getCrlNumber(xcrl);
    assertEquals(2, num.intValue());
    X509CRLEntry entry = (X509CRLEntry) set.iterator().next();
    assertEquals(CertTools.getSerialNumber(usercert).toString(), entry.getSerialNumber().toString());
    assertEquals(revDate.toString(), entry.getRevocationDate().toString());
    // Getting the revocation reason is a pita...
    byte[] extval = entry.getExtensionValue(Extension.reasonCode.getId());
    ASN1InputStream aIn = new ASN1InputStream(new ByteArrayInputStream(extval));
    ASN1OctetString octs = (ASN1OctetString) aIn.readObject();
    aIn = new ASN1InputStream(new ByteArrayInputStream(octs.getOctets()));
    ASN1Primitive obj = aIn.readObject();
    CRLReason reason = CRLReason.getInstance((ASN1Enumerated) obj);
    assertEquals("CRLReason: certificateHold", reason.toString());
    //DEROctetString ostr = (DEROctetString)obj;

    // Create a delta CRL
    revcerts = new ArrayList<RevokedCertInfo>();
    crl = x509ca.generateDeltaCRL(cryptoToken, revcerts, 3, 2);
    assertNotNull(crl);
    xcrl = CertTools.getCRLfromByteArray(crl.getEncoded());
    assertEquals(CADN, CertTools.getIssuerDN(xcrl));
    set = xcrl.getRevokedCertificates();
    assertNull(set);
    num = CrlExtensions.getCrlNumber(xcrl);
    assertEquals(3, num.intValue());
    deltanum = CrlExtensions.getDeltaCRLIndicator(xcrl);
    assertEquals(2, deltanum.intValue());
    revcerts.add(new RevokedCertInfo(CertTools.getFingerprintAsString(usercert).getBytes(),
            CertTools.getSerialNumber(usercert).toByteArray(), revDate.getTime(),
            RevokedCertInfo.REVOCATION_REASON_CERTIFICATEHOLD, CertTools.getNotAfter(usercert).getTime()));
    crl = x509ca.generateDeltaCRL(cryptoToken, revcerts, 4, 3);
    assertNotNull(crl);
    xcrl = CertTools.getCRLfromByteArray(crl.getEncoded());
    deltanum = CrlExtensions.getDeltaCRLIndicator(xcrl);
    assertEquals(3, deltanum.intValue());
    set = xcrl.getRevokedCertificates();
    assertEquals(1, set.size());
    entry = (X509CRLEntry) set.iterator().next();
    assertEquals(CertTools.getSerialNumber(usercert).toString(), entry.getSerialNumber().toString());
    assertEquals(revDate.toString(), entry.getRevocationDate().toString());
    // Getting the revocation reason is a pita...
    extval = entry.getExtensionValue(Extension.reasonCode.getId());
    aIn = new ASN1InputStream(new ByteArrayInputStream(extval));
    octs = (ASN1OctetString) aIn.readObject();
    aIn = new ASN1InputStream(new ByteArrayInputStream(octs.getOctets()));
    obj = aIn.readObject();
    reason = CRLReason.getInstance((ASN1Enumerated) obj);
    assertEquals("CRLReason: certificateHold", reason.toString());
}

From source file:org.cesecore.certificates.certificate.certextensions.BasicCertificateExtension.java

License:Open Source License

/**
 * Returns the defined property 'value' in the encoding specified in 'encoding'.
 * /*from w  w w.  j  av  a 2s .c o  m*/
 * This certificate extension implementations overrides this method as it 
 * want to be able to return a byte[] with the extension value. Otherwise 
 * the implementation could have been put in the getValue method as the 
 * super class CertificateExtension has a default implementation for 
 * getValueEncoded which calls getValue.
 * 
 * @param userData
 *            Used to lookup extension data
 * @param ca
 *            not used
 * @param certProfile
 *            not used
 * @see org.cesecore.certificates.certificate.certextensions.CertificateExtension#getValue(EndEntityInformation, CA, CertificateProfile, PublicKey,
 *      PublicKey, CertificateValidity)
 */
@Override
public byte[] getValueEncoded(EndEntityInformation userData, CA ca, CertificateProfile certProfile,
        PublicKey userPublicKey, PublicKey caPublicKey, CertificateValidity val)
        throws CertificateExtensionException {
    final byte[] result;
    String encoding = StringUtils.trim(getProperties().getProperty(PROPERTY_ENCODING));
    String[] values = getValues(userData);
    if (log.isDebugEnabled()) {
        log.debug("Got extension values: " + Arrays.toString(values));
    }

    if (values == null || values.length == 0) {
        throw new CertificateExtensionException(
                intres.getLocalizedMessage("certext.basic.incorrectvalue", Integer.valueOf(getId()), getOID()));
    }

    if (encoding.equalsIgnoreCase(ENCODING_RAW)) {
        if (values.length > 1) {
            // nvalues can not be used together with encoding=RAW
            throw new CertificateExtensionException(
                    intres.getLocalizedMessage("certext.certextmissconfigured", Integer.valueOf(getId())));
        } else {
            result = parseRaw(values[0]);
        }
    } else {
        try {
            if (values.length > 1) {
                ASN1EncodableVector ev = new ASN1EncodableVector();
                for (String value : values) {
                    ASN1Encodable derval = parseValue(encoding, value);
                    ev.add(derval);
                }
                result = new DERSequence(ev).getEncoded();
            } else {
                result = parseValue(encoding, values[0]).toASN1Primitive().getEncoded();
            }
        } catch (IOException ioe) {
            throw new CertificateExtensionException(ioe.getMessage(), ioe);
        }
    }
    return result;
}

From source file:org.cesecore.certificates.certificate.certextensions.BasicCertificateExtension.java

License:Open Source License

/**
 * Tries to read the hex-string as an DERObject. If it contains more than one ASN1Encodable object, return a DERSequence of the objects.
 *//*w  w  w .  ja  va  2  s .  c o m*/
private ASN1Encodable parseHexEncodedDERObject(String value) throws CertificateExtensionException {
    ASN1Encodable retval = null;
    if (value.matches("^\\p{XDigit}*")) {
        byte[] bytes = Hex.decode(value);
        try {
            ASN1InputStream ais = new ASN1InputStream(bytes);
            ASN1Encodable firstObject = ais.readObject();
            if (ais.available() > 0) {
                ASN1EncodableVector ev = new ASN1EncodableVector();
                ev.add(firstObject);
                while (ais.available() > 0) {
                    ev.add(ais.readObject());
                }
                retval = new DERSequence(ev);
            } else {
                retval = firstObject;
            }
            ais.close();
        } catch (Exception e) {
            throw new CertificateExtensionException(intres.getLocalizedMessage("certext.basic.illegalvalue",
                    value, Integer.valueOf(getId()), getOID()));
        }
    } else {
        throw new CertificateExtensionException(intres.getLocalizedMessage("certext.basic.illegalvalue", value,
                Integer.valueOf(getId()), getOID()));
    }
    return retval;
}

From source file:org.cesecore.certificates.certificate.certextensions.standard.AuthorityInformationAccess.java

License:Open Source License

@Override
public ASN1Encodable getValue(final EndEntityInformation subject, final CA ca,
        final CertificateProfile certProfile, final PublicKey userPublicKey, final PublicKey caPublicKey,
        CertificateValidity val) throws CertificateExtensionException {
    final ASN1EncodableVector accessList = new ASN1EncodableVector();
    GeneralName accessLocation;/*from   w ww  . j  a va  2  s  .  c  o  m*/
    String url;

    // caIssuers
    final List<String> caIssuers = certProfile.getCaIssuers();
    if (caIssuers != null) {
        for (final Iterator<String> it = caIssuers.iterator(); it.hasNext();) {
            url = it.next();
            if (StringUtils.isNotEmpty(url)) {
                accessLocation = new GeneralName(GeneralName.uniformResourceIdentifier, new DERIA5String(url));
                accessList.add(new AccessDescription(AccessDescription.id_ad_caIssuers, accessLocation));
            }
        }
    }

    // ocsp url
    final X509CA x509ca = (X509CA) ca;
    url = certProfile.getOCSPServiceLocatorURI();
    if (certProfile.getUseDefaultOCSPServiceLocator()) {
        url = x509ca.getDefaultOCSPServiceLocator();
    }
    if (StringUtils.isNotEmpty(url)) {
        accessLocation = new GeneralName(GeneralName.uniformResourceIdentifier, new DERIA5String(url));
        accessList.add(new AccessDescription(AccessDescription.id_ad_ocsp, accessLocation));
    }
    org.bouncycastle.asn1.x509.AuthorityInformationAccess ret = null;
    if (accessList.size() > 0) {
        ret = org.bouncycastle.asn1.x509.AuthorityInformationAccess.getInstance(new DERSequence(accessList));
    }
    if (ret == null) {
        log.error("AuthorityInformationAccess is used, but nor caIssuers not Ocsp url are defined!");
    }
    return ret;
}

From source file:org.cesecore.certificates.certificate.certextensions.standard.AuthorityKeyIdentifier.java

License:Open Source License

@Override
public ASN1Encodable getValue(final EndEntityInformation subject, final CA ca,
        final CertificateProfile certProfile, final PublicKey userPublicKey, final PublicKey caPublicKey,
        CertificateValidity val) throws CertificateExtensionException {
    org.bouncycastle.asn1.x509.AuthorityKeyIdentifier ret = null;
    // Default value is that we calculate it from scratch!
    // (If this is a root CA we must calculate the AuthorityKeyIdentifier from scratch)
    // (If the CA signing this cert does not have a SubjectKeyIdentifier we must calculate the AuthorityKeyIdentifier from scratch)
    final byte[] keybytes = caPublicKey.getEncoded();
    ASN1InputStream inputStream = new ASN1InputStream(new ByteArrayInputStream(keybytes));
    try {/*from   w ww .  j a  v  a2 s .  co  m*/
        try {
            final SubjectPublicKeyInfo apki = new SubjectPublicKeyInfo((ASN1Sequence) inputStream.readObject());
            ret = new org.bouncycastle.asn1.x509.AuthorityKeyIdentifier(apki);

            // If we have a CA-certificate (i.e. this is not a Root CA), we must take the authority key identifier from
            // the CA-certificates SubjectKeyIdentifier if it exists. If we don't do that we will get the wrong identifier if the
            // CA does not follow RFC3280 (guess if MS-CA follows RFC3280?)
            final X509Certificate cacert = (X509Certificate) ca.getCACertificate();
            final boolean isRootCA = (certProfile.getType() == CertificateConstants.CERTTYPE_ROOTCA);
            if ((cacert != null) && (!isRootCA)) {
                byte[] akibytes;
                akibytes = CertTools.getSubjectKeyId(cacert);
                if (akibytes != null) {
                    // TODO: The code below is snipped from AuthorityKeyIdentifier.java in BC 1.36, because there is no method there
                    // to set only a pre-computed key identifier
                    // This should be replaced when such a method is added to BC
                    final ASN1OctetString keyidentifier = new DEROctetString(akibytes);
                    final ASN1EncodableVector v = new ASN1EncodableVector();
                    v.add(new DERTaggedObject(false, 0, keyidentifier));
                    final ASN1Sequence seq = new DERSequence(v);
                    ret = org.bouncycastle.asn1.x509.AuthorityKeyIdentifier.getInstance(seq);
                    if (log.isDebugEnabled()) {
                        log.debug("Using AuthorityKeyIdentifier from CA-certificates SubjectKeyIdentifier.");
                    }
                }
            }
        } finally {
            inputStream.close();
        }
    } catch (IOException e) {
        throw new CertificateExtensionException("IOException parsing CA public key: " + e.getMessage(), e);
    }

    return ret;
}

From source file:org.cesecore.certificates.certificate.certextensions.standard.CertificatePolicies.java

License:Open Source License

@Override
public ASN1Encodable getValue(final EndEntityInformation subject, final CA ca,
        final CertificateProfile certProfile, final PublicKey userPublicKey, final PublicKey caPublicKey,
        CertificateValidity val) throws CertificateExtensionException {
    DERSequence ret = null;/*from  ww w  .java  2 s . co m*/
    // The UserNotice policy qualifier can have two different character encodings,
    // the correct one (UTF8) or the wrong one (BMP) used by IE < 7.
    final X509CA x509ca = (X509CA) ca;
    int displayencoding = DisplayText.CONTENT_TYPE_BMPSTRING;
    if (x509ca.getUseUTF8PolicyText()) {
        displayencoding = DisplayText.CONTENT_TYPE_UTF8STRING;
    }
    // Iterate through policies and add oids and policy qualifiers if they exist
    final List<CertificatePolicy> policies = certProfile.getCertificatePolicies();
    final Map<ASN1ObjectIdentifier, ASN1EncodableVector> policiesMap = new HashMap<ASN1ObjectIdentifier, ASN1EncodableVector>();
    // Each Policy OID can be entered several times, with different qualifiers, 
    // because of this we make a map of oid and qualifiers, and we can add a new qualifier
    // in each round of this for loop
    for (final Iterator<CertificatePolicy> it = policies.iterator(); it.hasNext();) {
        final CertificatePolicy policy = it.next();
        final ASN1ObjectIdentifier oid = new ASN1ObjectIdentifier(policy.getPolicyID());
        final ASN1EncodableVector qualifiers;
        if (policiesMap.containsKey(oid)) {
            qualifiers = policiesMap.get(oid);
        } else {
            qualifiers = new ASN1EncodableVector();
        }
        final PolicyQualifierInfo pqi = getPolicyQualifierInformation(policy, displayencoding);
        if (pqi != null) {
            qualifiers.add(pqi);
        }
        policiesMap.put(oid, qualifiers);
    }
    final ASN1EncodableVector seq = new ASN1EncodableVector();
    for (final Iterator<ASN1ObjectIdentifier> it = policiesMap.keySet().iterator(); it.hasNext();) {
        final ASN1ObjectIdentifier oid = it.next();
        final ASN1EncodableVector qualifiers = policiesMap.get(oid);
        if (qualifiers.size() == 0) {
            seq.add(new PolicyInformation(oid, null));
        } else {
            seq.add(new PolicyInformation(oid, new DERSequence(qualifiers)));
        }
    }
    if (seq.size() > 0) {
        ret = new DERSequence(seq);
    }
    if (ret == null) {
        log.error("Certificate policies missconfigured, no policies present!");
    }
    return ret;
}

From source file:org.cesecore.certificates.certificate.certextensions.standard.CrlDistributionPoints.java

License:Open Source License

@Override
public ASN1Encodable getValue(final EndEntityInformation subject, final CA ca,
        final CertificateProfile certProfile, final PublicKey userPublicKey, final PublicKey caPublicKey,
        CertificateValidity val) throws CertificateExtensionException {
    String crldistpoint = certProfile.getCRLDistributionPointURI();
    String crlissuer = certProfile.getCRLIssuer();
    final X509CA x509ca = (X509CA) ca;
    if (certProfile.getUseDefaultCRLDistributionPoint()) {
        crldistpoint = x509ca.getDefaultCRLDistPoint();
        crlissuer = x509ca.getDefaultCRLIssuer();
    }/*from w ww .  j a v  a  2s . c  om*/
    // Multiple CDPs are separated with the ';' sign                        
    final ArrayList<DistributionPointName> dpns = new ArrayList<DistributionPointName>();
    if (StringUtils.isNotEmpty(crldistpoint)) {
        final Iterator<String> it = StringTools.splitURIs(crldistpoint).iterator();
        while (it.hasNext()) {
            // 6 is URI
            final String uri = (String) it.next();
            final GeneralName gn = new GeneralName(GeneralName.uniformResourceIdentifier,
                    new DERIA5String(uri));
            if (log.isDebugEnabled()) {
                log.debug("Added CRL distpoint: " + uri);
            }
            final ASN1EncodableVector vec = new ASN1EncodableVector();
            vec.add(gn);
            final GeneralNames gns = GeneralNames.getInstance(new DERSequence(vec));
            final DistributionPointName dpn = new DistributionPointName(0, gns);
            dpns.add(dpn);
        }
    }
    // CRL issuer works much like Dist point URI. If separated by ; it is put in the same global distPoint as the URI, 
    // if there is more of one of them, the one with more is put in an own global distPoint.
    final ArrayList<GeneralNames> issuers = new ArrayList<GeneralNames>();
    if (StringUtils.isNotEmpty(crlissuer)) {
        final StringTokenizer tokenizer = new StringTokenizer(crlissuer, ";", false);
        while (tokenizer.hasMoreTokens()) {
            final String issuer = tokenizer.nextToken();
            final GeneralName gn = new GeneralName(new X500Name(issuer));
            if (log.isDebugEnabled()) {
                log.debug("Added CRL issuer: " + issuer);
            }
            final ASN1EncodableVector vec = new ASN1EncodableVector();
            vec.add(gn);
            final GeneralNames gns = GeneralNames.getInstance(new DERSequence(vec));
            issuers.add(gns);
        }
    }
    final ArrayList<DistributionPoint> distpoints = new ArrayList<DistributionPoint>();
    if ((!issuers.isEmpty()) || (!dpns.isEmpty())) {
        int i = dpns.size();
        if (issuers.size() > i) {
            i = issuers.size();
        }
        for (int j = 0; j < i; j++) {
            DistributionPointName dpn = null;
            GeneralNames issuer = null;
            if (dpns.size() > j) {
                dpn = (DistributionPointName) dpns.get(j);
            }
            if (issuers.size() > j) {
                issuer = (GeneralNames) issuers.get(j);
            }
            if ((dpn != null) || (issuer != null)) {
                distpoints.add(new DistributionPoint(dpn, null, issuer));
            }
        }
    }
    CRLDistPoint ret = null;
    if (!distpoints.isEmpty()) {
        ret = new CRLDistPoint(
                (DistributionPoint[]) distpoints.toArray(new DistributionPoint[distpoints.size()]));
    }
    if (ret == null) {
        log.error("DrlDistributionPoints missconfigured, no distribution points available.");
    }
    return ret;
}

From source file:org.cesecore.certificates.certificate.certextensions.standard.DocumentTypeList.java

License:Open Source License

@Override
public ASN1Encodable getValue(final EndEntityInformation subject, final CA ca,
        final CertificateProfile certProfile, final PublicKey userPublicKey, final PublicKey caPublicKey,
        CertificateValidity val) {

    ArrayList<String> docTypes = certProfile.getDocumentTypeList();
    if (docTypes.size() == 0) {
        if (log.isDebugEnabled()) {
            log.debug("No DocumentTypeList to make a certificate extension");
        }//from  w  w  w .  ja  va2 s  . c om
        return null;
    }

    ASN1EncodableVector vec = new ASN1EncodableVector();

    // version
    vec.add(new ASN1Integer(0));

    // Add SET OF DocumentType
    Iterator<String> itr = docTypes.iterator();
    while (itr.hasNext()) {
        String type = itr.next();
        vec.add(new DERSet(new ASN1Encodable[] { new DERPrintableString(type) }));
    }

    ASN1Object gn = new DERSequence(vec);
    if (log.isDebugEnabled()) {
        log.debug("Constructed DocumentTypeList:");
        log.debug(ASN1Dump.dumpAsString(gn, true));
    }

    return gn;
}

From source file:org.cesecore.certificates.certificate.certextensions.standard.ExtendedKeyUsage.java

License:Open Source License

@Override
public ASN1Encodable getValue(final EndEntityInformation subject, final CA ca,
        final CertificateProfile certProfile, final PublicKey userPublicKey, final PublicKey caPublicKey,
        CertificateValidity val) throws CertificateExtensionException {
    org.bouncycastle.asn1.x509.ExtendedKeyUsage ret = null;
    // Get extended key usage from certificate profile
    final Collection<String> oids = certProfile.getExtendedKeyUsageOids();

    // Don't add empty key usage extension
    if (oids.size() != 0) {
        final ASN1Encodable[] usage = new ASN1Encodable[oids.size()];
        int i = 0;
        for (String oid : oids) {
            usage[i] = org.bouncycastle.asn1.x509.KeyPurposeId.getInstance(new ASN1ObjectIdentifier(oid));
            i++;//  w  ww.j a v  a2  s .  com
        }

        ASN1Sequence seq = ASN1Sequence.getInstance(new DERSequence(usage));
        ret = org.bouncycastle.asn1.x509.ExtendedKeyUsage.getInstance(seq);
    }
    if (ret == null) {
        log.error("ExtendedKeyUsage missconfigured, no oids defined");
    }
    return ret;
}