Example usage for org.bouncycastle.asn1 DERSequence DERSequence

Introduction

In this page you can find the example usage for org.bouncycastle.asn1 DERSequence DERSequence.

Prototype

public DERSequence(ASN1Encodable[] elements) 

Source Link

Document

Create a sequence containing an array of objects.

Usage

From source file:org.cesecore.certificates.certificate.certextensions.standard.FreshestCrl.java

License:Open Source License

@Override
public ASN1Encodable getValue(final EndEntityInformation subject, final CA ca,
        final CertificateProfile certProfile, final PublicKey userPublicKey, final PublicKey caPublicKey,
        CertificateValidity val) throws CertificateExtensionException {
    String freshestcrldistpoint = certProfile.getFreshestCRLURI();
    final X509CA x509ca = (X509CA) ca;
    if (certProfile.getUseCADefinedFreshestCRL()) {
        freshestcrldistpoint = x509ca.getCADefinedFreshestCRL();
    }/*from  ww  w .j a va2s  . co  m*/
    // Multiple FCDPs are separated with the ';' sign
    CRLDistPoint ret = null;
    if (freshestcrldistpoint != null) {
        final StringTokenizer tokenizer = new StringTokenizer(freshestcrldistpoint, ";", false);
        final ArrayList<DistributionPoint> distpoints = new ArrayList<DistributionPoint>();
        while (tokenizer.hasMoreTokens()) {
            final String uri = tokenizer.nextToken();
            final GeneralName gn = new GeneralName(GeneralName.uniformResourceIdentifier,
                    new DERIA5String(uri));
            if (log.isDebugEnabled()) {
                log.debug("Added freshest CRL distpoint: " + uri);
            }
            final ASN1EncodableVector vec = new ASN1EncodableVector();
            vec.add(gn);
            final GeneralNames gns = GeneralNames.getInstance(new DERSequence(vec));
            final DistributionPointName dpn = new DistributionPointName(0, gns);
            distpoints.add(new DistributionPoint(dpn, null, null));
        }
        if (!distpoints.isEmpty()) {
            ret = new CRLDistPoint(
                    (DistributionPoint[]) distpoints.toArray(new DistributionPoint[distpoints.size()]));
        }
    }
    if (ret == null) {
        log.error("UseFreshestCRL is true, but no URI string defined!");
    }
    return ret;
}

---

From source file:org.cesecore.certificates.certificate.certextensions.standard.PrivateKeyUsagePeriod.java

License:Open Source License

private static DERSequence privateKeyUsagePeriod(final Date notBefore, final Date notAfter)
        throws CertificateExtensionException {
    // Create the extension.
    // PrivateKeyUsagePeriod ::= SEQUENCE {
    // notBefore [0] GeneralizedTime OPTIONAL,
    // notAfter [1] GeneralizedTime OPTIONAL }
    final ASN1EncodableVector v = new ASN1EncodableVector();
    if (notBefore != null) {
        v.add(new DERTaggedObject(false, 0, new DERGeneralizedTime(notBefore)));
    }// w  ww.  j ava2  s  .co m
    if (notAfter != null) {
        v.add(new DERTaggedObject(false, 1, new DERGeneralizedTime(notAfter)));
    }
    if (v.size() == 0) {
        throw new CertificateExtensionException("At least one of notBefore and notAfter must be specified!");
    }
    return new DERSequence(v);
}

---

From source file:org.cesecore.certificates.certificate.certextensions.standard.QcStatement.java

License:Open Source License

@Override
public ASN1Encodable getValue(final EndEntityInformation subject, final CA ca,
        final CertificateProfile certProfile, final PublicKey userPublicKey, final PublicKey caPublicKey,
        CertificateValidity val) throws CertificateExtensionException {
    DERSequence ret = null;/*w ww.  ja v  a  2 s .  c om*/
    final String names = certProfile.getQCStatementRAName();
    final GeneralNames san = CertTools.getGeneralNamesFromAltName(names);
    SemanticsInformation si = null;
    if (san != null) {
        if (StringUtils.isNotEmpty(certProfile.getQCSemanticsId())) {
            si = new SemanticsInformation(new ASN1ObjectIdentifier(certProfile.getQCSemanticsId()),
                    san.getNames());
        } else {
            si = new SemanticsInformation(san.getNames());
        }
    } else if (StringUtils.isNotEmpty(certProfile.getQCSemanticsId())) {
        si = new SemanticsInformation(new ASN1ObjectIdentifier(certProfile.getQCSemanticsId()));
    }
    final ArrayList<QCStatement> qcs = new ArrayList<QCStatement>();
    QCStatement qc = null;
    // First the standard rfc3739 QCStatement with an optional SematicsInformation
    // We never add RFC3739QCObjectIdentifiers.id_qcs_pkixQCSyntax_v1. This is so old so we think it has never been used in the wild basically.
    // That means no need to have code we have to maintain for that.
    if (certProfile.getUsePkixQCSyntaxV2()) {
        ASN1ObjectIdentifier pkixQcSyntax = RFC3739QCObjectIdentifiers.id_qcs_pkixQCSyntax_v2;
        if ((si != null)) {
            qc = new QCStatement(pkixQcSyntax, si);
            qcs.add(qc);
        } else {
            qc = new QCStatement(pkixQcSyntax);
            qcs.add(qc);
        }
    }
    // ETSI Statement that the certificate is a Qualified Certificate
    if (certProfile.getUseQCEtsiQCCompliance()) {
        qc = new QCStatement(ETSIQCObjectIdentifiers.id_etsi_qcs_QcCompliance);
        qcs.add(qc);
    }
    // ETSI Statement regarding limit on the value of transactions
    // Both value and currency must be available for this extension
    if (certProfile.getUseQCEtsiValueLimit() && (certProfile.getQCEtsiValueLimit() >= 0)
            && (certProfile.getQCEtsiValueLimitCurrency() != null)) {
        final int limit = certProfile.getQCEtsiValueLimit();
        // The exponent should be default 0
        final int exponent = certProfile.getQCEtsiValueLimitExp();
        final MonetaryValue value = new MonetaryValue(
                new Iso4217CurrencyCode(certProfile.getQCEtsiValueLimitCurrency()), limit, exponent);
        qc = new QCStatement(ETSIQCObjectIdentifiers.id_etsi_qcs_LimiteValue, value);
        qcs.add(qc);
    }

    if (certProfile.getUseQCEtsiRetentionPeriod()) {
        final ASN1Integer years = new ASN1Integer(((Integer) certProfile.getQCEtsiRetentionPeriod()));
        qc = new QCStatement(ETSIQCObjectIdentifiers.id_etsi_qcs_RetentionPeriod, years);
        qcs.add(qc);
    }

    // ETSI Statement claiming that the private key resides in a Signature Creation Device
    if (certProfile.getUseQCEtsiSignatureDevice()) {
        qc = new QCStatement(ETSIQCObjectIdentifiers.id_etsi_qcs_QcSSCD);
        qcs.add(qc);
    }
    // Custom UTF8String QC-statement:
    // qcStatement-YourCustom QC-STATEMENT ::= { SYNTAX YourCustomUTF8String
    //   IDENTIFIED BY youroid }
    //   -- This statement gives you the possibility to define your own QC-statement
    //   -- using an OID and a simple UTF8String, with describing text. A sample text could for example be:
    //   -- This certificate, according to Act. No. xxxx Electronic Signature Law is a qualified electronic certificate
    //
    // YourCustomUTF8String ::= UTF8String
    if (certProfile.getUseQCCustomString() && !StringUtils.isEmpty(certProfile.getQCCustomStringOid())
            && !StringUtils.isEmpty(certProfile.getQCCustomStringText())) {
        final DERUTF8String str = new DERUTF8String(certProfile.getQCCustomStringText());
        final ASN1ObjectIdentifier oid = new ASN1ObjectIdentifier(certProfile.getQCCustomStringOid());
        qc = new QCStatement(oid, str);
        qcs.add(qc);
    }
    if (!qcs.isEmpty()) {
        final ASN1EncodableVector vec = new ASN1EncodableVector();
        final Iterator<QCStatement> iter = qcs.iterator();
        while (iter.hasNext()) {
            final QCStatement q = (QCStatement) iter.next();
            vec.add(q);
        }
        ret = new DERSequence(vec);
    }
    if (ret == null) {
        log.error(
                "Qualified certificate statements extension has been enabled, but no statements were included!");
        throw new CertificateExtensionException(
                "If qualified certificate statements extension has been enabled, at least one statement must be included!");
    }
    return ret;
}

---

From source file:org.cesecore.certificates.certificate.certextensions.standard.SubjectDirectoryAttributes.java

License:Open Source License

@Override
public ASN1Encodable getValue(final EndEntityInformation subject, final CA ca,
        final CertificateProfile certProfile, final PublicKey userPublicKey, final PublicKey caPublicKey,
        CertificateValidity val) {
    ASN1Encodable ret = null;/*from  w  ww  . j  a  v a2s .co m*/
    final String dirAttrString = subject.getExtendedinformation() != null
            ? subject.getExtendedinformation().getSubjectDirectoryAttributes()
            : null;
    if (StringUtils.isNotEmpty(dirAttrString)) {
        // Subject Directory Attributes is a sequence of Attribute
        final Collection<Attribute> attr = SubjectDirAttrExtension.getSubjectDirectoryAttributes(dirAttrString);
        final ASN1EncodableVector vec = new ASN1EncodableVector();
        final Iterator<Attribute> iter = attr.iterator();
        while (iter.hasNext()) {
            vec.add(iter.next());
        }
        if (vec.size() > 0) {
            ret = new DERSequence(vec);
        }
    }
    if (ret == null) {
        if (log.isDebugEnabled()) {
            log.debug("No directory attributes trying to create SubjectDirectoryAttributes extension: "
                    + dirAttrString);
        }
    }
    return ret;
}

---

From source file:org.cesecore.certificates.certificate.request.RequestMessageTest.java

License:Open Source License

private PKCS10CertificationRequest createP10(final String subjectDN)
        throws IOException, OperatorCreationException {
    // Create a P10 with extensions, in this case altNames with a DNS name
    ASN1EncodableVector altnameattr = new ASN1EncodableVector();
    altnameattr.add(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest);
    // AltNames//from  w  ww . ja v  a 2s  .co  m
    // String[] namearray = altnames.split(",");
    GeneralNames san = CertTools.getGeneralNamesFromAltName("dNSName=foo1.bar.com");
    ExtensionsGenerator extgen = new ExtensionsGenerator();
    extgen.addExtension(Extension.subjectAlternativeName, false, san);
    Extensions exts = extgen.generate();
    altnameattr.add(new DERSet(exts));

    // Add a challenge password as well
    ASN1EncodableVector pwdattr = new ASN1EncodableVector();
    pwdattr.add(PKCSObjectIdentifiers.pkcs_9_at_challengePassword);
    ASN1EncodableVector pwdvalues = new ASN1EncodableVector();
    pwdvalues.add(new DERUTF8String("foo123"));
    pwdattr.add(new DERSet(pwdvalues));

    // Complete the Attribute section of the request, the set (Attributes)
    // contains one sequence (Attribute)
    ASN1EncodableVector v = new ASN1EncodableVector();
    v.add(new DERSequence(altnameattr));
    v.add(new DERSequence(pwdattr));
    DERSet attributes = new DERSet(v);

    // Create the PKCS10
    X500Name dn = new X500Name(subjectDN);
    PKCS10CertificationRequest basicpkcs10 = CertTools.genPKCS10CertificationRequest("SHA1WithRSA", dn,
            keyPair.getPublic(), attributes, keyPair.getPrivate(), null);
    return basicpkcs10;
}

---

From source file:org.cesecore.keybind.impl.OcspKeyBindingTest.java

License:Open Source License

/** @return An extended key usage extension with id_kp_OCSPSigning set. */
private static Extension getExtendedKeyUsageExtension() throws IOException {
    final ASN1Encodable usage = KeyPurposeId.getInstance(KeyPurposeId.id_kp_OCSPSigning);
    final ASN1Sequence seq = ASN1Sequence.getInstance(new DERSequence(usage));
    return new Extension(Extension.extendedKeyUsage, true, seq.getEncoded());
}

---

From source file:org.cesecore.util.CertTools.java

License:Open Source License

public static X509Certificate genSelfCertForPurpose(String dn, long validity, String policyId,
        PrivateKey privKey, PublicKey pubKey, String sigAlg, boolean isCA, int keyusage,
        Date privateKeyNotBefore, Date privateKeyNotAfter, String provider, boolean ldapOrder,
        List<Extension> additionalExtensions)
        throws CertificateParsingException, IOException, OperatorCreationException {
    // Create self signed certificate
    Date firstDate = new Date();

    // Set back startdate ten minutes to avoid some problems with wrongly set clocks.
    firstDate.setTime(firstDate.getTime() - (10 * 60 * 1000));

    Date lastDate = new Date();

    // validity in days = validity*24*60*60*1000 milliseconds
    lastDate.setTime(lastDate.getTime() + (validity * (24 * 60 * 60 * 1000)));

    // Transform the PublicKey to be sure we have it in a format that the X509 certificate generator handles, it might be
    // a CVC public key that is passed as parameter
    PublicKey publicKey = null;//from   w  ww  .j a v a  2  s.c  o  m
    if (pubKey instanceof RSAPublicKey) {
        RSAPublicKey rsapk = (RSAPublicKey) pubKey;
        RSAPublicKeySpec rSAPublicKeySpec = new RSAPublicKeySpec(rsapk.getModulus(), rsapk.getPublicExponent());
        try {
            publicKey = KeyFactory.getInstance("RSA").generatePublic(rSAPublicKeySpec);
        } catch (InvalidKeySpecException e) {
            log.error("Error creating RSAPublicKey from spec: ", e);
            publicKey = pubKey;
        } catch (NoSuchAlgorithmException e) {
            throw new IllegalStateException("RSA was not a known algorithm", e);
        }
    } else if (pubKey instanceof ECPublicKey) {
        ECPublicKey ecpk = (ECPublicKey) pubKey;
        try {
            ECPublicKeySpec ecspec = new ECPublicKeySpec(ecpk.getW(), ecpk.getParams()); // will throw NPE if key is "implicitlyCA"
            final String algo = ecpk.getAlgorithm();
            if (algo.equals(AlgorithmConstants.KEYALGORITHM_ECGOST3410)) {
                try {
                    publicKey = KeyFactory.getInstance("ECGOST3410").generatePublic(ecspec);
                } catch (NoSuchAlgorithmException e) {
                    throw new IllegalStateException("ECGOST3410 was not a known algorithm", e);
                }
            } else if (algo.equals(AlgorithmConstants.KEYALGORITHM_DSTU4145)) {
                try {
                    publicKey = KeyFactory.getInstance("DSTU4145").generatePublic(ecspec);
                } catch (NoSuchAlgorithmException e) {
                    throw new IllegalStateException("DSTU4145 was not a known algorithm", e);
                }
            } else {
                try {
                    publicKey = KeyFactory.getInstance("EC").generatePublic(ecspec);
                } catch (NoSuchAlgorithmException e) {
                    throw new IllegalStateException("EC was not a known algorithm", e);
                }
            }
        } catch (InvalidKeySpecException e) {
            log.error("Error creating ECPublicKey from spec: ", e);
            publicKey = pubKey;
        } catch (NullPointerException e) {
            log.debug("NullPointerException, probably it is implicitlyCA generated keys: " + e.getMessage());
            publicKey = pubKey;
        }
    } else {
        log.debug("Not converting key of class. " + pubKey.getClass().getName());
        publicKey = pubKey;
    }

    // Serialnumber is random bits, where random generator is initialized with Date.getTime() when this
    // bean is created.
    byte[] serno = new byte[8];
    SecureRandom random;
    try {
        random = SecureRandom.getInstance("SHA1PRNG");
    } catch (NoSuchAlgorithmException e) {
        throw new IllegalStateException("SHA1PRNG was not a known algorithm", e);
    }
    random.setSeed(new Date().getTime());
    random.nextBytes(serno);

    SubjectPublicKeyInfo pkinfo;
    try {
        pkinfo = new SubjectPublicKeyInfo((ASN1Sequence) ASN1Primitive.fromByteArray(publicKey.getEncoded()));
    } catch (IOException e) {
        throw new IllegalArgumentException("Provided public key could not be read to ASN1Primitive", e);
    }
    X509v3CertificateBuilder certbuilder = new X509v3CertificateBuilder(
            CertTools.stringToBcX500Name(dn, ldapOrder), new BigInteger(serno).abs(), firstDate, lastDate,
            CertTools.stringToBcX500Name(dn, ldapOrder), pkinfo);

    // Basic constranits is always critical and MUST be present at-least in CA-certificates.
    BasicConstraints bc = new BasicConstraints(isCA);
    certbuilder.addExtension(Extension.basicConstraints, true, bc);

    // Put critical KeyUsage in CA-certificates
    if (isCA || keyusage != 0) {
        X509KeyUsage ku = new X509KeyUsage(keyusage);
        certbuilder.addExtension(Extension.keyUsage, true, ku);
    }

    if ((privateKeyNotBefore != null) || (privateKeyNotAfter != null)) {
        final ASN1EncodableVector v = new ASN1EncodableVector();
        if (privateKeyNotBefore != null) {
            v.add(new DERTaggedObject(false, 0, new DERGeneralizedTime(privateKeyNotBefore)));
        }
        if (privateKeyNotAfter != null) {
            v.add(new DERTaggedObject(false, 1, new DERGeneralizedTime(privateKeyNotAfter)));
        }
        certbuilder.addExtension(Extension.privateKeyUsagePeriod, false, new DERSequence(v));
    }

    // Subject and Authority key identifier is always non-critical and MUST be present for certificates to verify in Firefox.
    try {
        if (isCA) {

            ASN1InputStream sAsn1InputStream = new ASN1InputStream(
                    new ByteArrayInputStream(publicKey.getEncoded()));
            ASN1InputStream aAsn1InputStream = new ASN1InputStream(
                    new ByteArrayInputStream(publicKey.getEncoded()));
            try {
                SubjectPublicKeyInfo spki = new SubjectPublicKeyInfo(
                        (ASN1Sequence) sAsn1InputStream.readObject());
                X509ExtensionUtils x509ExtensionUtils = new BcX509ExtensionUtils();
                SubjectKeyIdentifier ski = x509ExtensionUtils.createSubjectKeyIdentifier(spki);
                SubjectPublicKeyInfo apki = new SubjectPublicKeyInfo(
                        (ASN1Sequence) aAsn1InputStream.readObject());
                AuthorityKeyIdentifier aki = new AuthorityKeyIdentifier(apki);

                certbuilder.addExtension(Extension.subjectKeyIdentifier, false, ski);
                certbuilder.addExtension(Extension.authorityKeyIdentifier, false, aki);
            } finally {
                sAsn1InputStream.close();
                aAsn1InputStream.close();
            }
        }
    } catch (IOException e) { // do nothing
    }

    // CertificatePolicies extension if supplied policy ID, always non-critical
    if (policyId != null) {
        PolicyInformation pi = new PolicyInformation(new ASN1ObjectIdentifier(policyId));
        DERSequence seq = new DERSequence(pi);
        certbuilder.addExtension(Extension.certificatePolicies, false, seq);
    }
    // Add any additional
    if (additionalExtensions != null) {
        for (final Extension extension : additionalExtensions) {
            certbuilder.addExtension(extension.getExtnId(), extension.isCritical(), extension.getParsedValue());
        }
    }
    final ContentSigner signer = new BufferingContentSigner(
            new JcaContentSignerBuilder(sigAlg).setProvider(provider).build(privKey), 20480);
    final X509CertificateHolder certHolder = certbuilder.build(signer);
    final X509Certificate selfcert = (X509Certificate) CertTools.getCertfromByteArray(certHolder.getEncoded());

    return selfcert;
}

---

From source file:org.cesecore.util.CertTools.java

License:Open Source License

/**
 * From an altName string as defined in getSubjectAlternativeName
 * //from www  . ja v  a  2  s.com
 * @param altName
 * @return ASN.1 GeneralNames
 * @see #getSubjectAlternativeName
 */
public static GeneralNames getGeneralNamesFromAltName(final String altName) {
    if (log.isTraceEnabled()) {
        log.trace(">getGeneralNamesFromAltName: " + altName);
    }
    final ASN1EncodableVector vec = new ASN1EncodableVector();

    for (final String email : CertTools.getEmailFromDN(altName)) {
        vec.add(new GeneralName(1, /*new DERIA5String(iter.next())*/email));
    }

    for (final String dns : CertTools.getPartsFromDN(altName, CertTools.DNS)) {
        vec.add(new GeneralName(2, new DERIA5String(dns)));
    }

    final String directoryName = getDirectoryStringFromAltName(altName);
    if (directoryName != null) {
        //final X500Name x500DirectoryName = new X500Name(directoryName);
        final X500Name x500DirectoryName = new X500Name(LDAPDN.unescapeRDN(directoryName));
        final GeneralName gn = new GeneralName(4, x500DirectoryName);
        vec.add(gn);
    }

    for (final String uri : CertTools.getPartsFromDN(altName, CertTools.URI)) {
        vec.add(new GeneralName(6, new DERIA5String(uri)));
    }
    for (final String uri : CertTools.getPartsFromDN(altName, CertTools.URI1)) {
        vec.add(new GeneralName(6, new DERIA5String(uri)));
    }
    for (final String uri : CertTools.getPartsFromDN(altName, CertTools.URI2)) {
        vec.add(new GeneralName(6, new DERIA5String(uri)));
    }

    for (final String addr : CertTools.getPartsFromDN(altName, CertTools.IPADDR)) {
        final byte[] ipoctets = StringTools.ipStringToOctets(addr);
        if (ipoctets.length > 0) {
            final GeneralName gn = new GeneralName(7, new DEROctetString(ipoctets));
            vec.add(gn);
        } else {
            log.error("Cannot parse/encode ip address, ignoring: " + addr);
        }
    }

    // UPN is an OtherName see method getUpn... for asn.1 definition
    for (final String upn : CertTools.getPartsFromDN(altName, CertTools.UPN)) {
        final ASN1EncodableVector v = new ASN1EncodableVector();
        v.add(new ASN1ObjectIdentifier(CertTools.UPN_OBJECTID));
        v.add(new DERTaggedObject(true, 0, new DERUTF8String(upn)));
        vec.add(GeneralName.getInstance(new DERTaggedObject(false, 0, new DERSequence(v))));
    }

    // PermanentIdentifier is an OtherName see method getPermananentIdentifier... for asn.1 definition
    for (final String permanentIdentifier : CertTools.getPartsFromDN(altName, CertTools.PERMANENTIDENTIFIER)) {
        final String[] values = getPermanentIdentifierValues(permanentIdentifier);
        final ASN1EncodableVector v = new ASN1EncodableVector(); // this is the OtherName
        v.add(new ASN1ObjectIdentifier(CertTools.PERMANENTIDENTIFIER_OBJECTID));
        // First the PermanentIdentifier sequence
        final ASN1EncodableVector piSeq = new ASN1EncodableVector();
        if (values[0] != null) {
            piSeq.add(new DERUTF8String(values[0]));
        }
        if (values[1] != null) {
            piSeq.add(new ASN1ObjectIdentifier(values[1]));
        }
        v.add(new DERTaggedObject(true, 0, new DERSequence(piSeq)));
        // GeneralName gn = new GeneralName(new DERSequence(v), 0);
        final ASN1Primitive gn = new DERTaggedObject(false, 0, new DERSequence(v));
        vec.add(gn);
    }

    for (final String guid : CertTools.getPartsFromDN(altName, CertTools.GUID)) {
        final ASN1EncodableVector v = new ASN1EncodableVector();
        byte[] guidbytes = Hex.decode(guid);
        if (guidbytes != null) {
            v.add(new ASN1ObjectIdentifier(CertTools.GUID_OBJECTID));
            v.add(new DERTaggedObject(true, 0, new DEROctetString(guidbytes)));
            final ASN1Primitive gn = new DERTaggedObject(false, 0, new DERSequence(v));
            vec.add(gn);
        } else {
            log.error("Cannot decode hexadecimal guid, ignoring: " + guid);
        }
    }

    // Krb5PrincipalName is an OtherName, see method getKrb5Principal...for ASN.1 definition
    for (final String principalString : CertTools.getPartsFromDN(altName, CertTools.KRB5PRINCIPAL)) {
        // Start by parsing the input string to separate it in different parts
        if (log.isDebugEnabled()) {
            log.debug("principalString: " + principalString);
        }
        // The realm is the last part moving back until an @
        final int index = principalString.lastIndexOf('@');
        String realm = "";
        if (index > 0) {
            realm = principalString.substring(index + 1);
        }
        if (log.isDebugEnabled()) {
            log.debug("realm: " + realm);
        }
        // Now we can have several principals separated by /
        final ArrayList<String> principalarr = new ArrayList<String>();
        int jndex = 0;
        int bindex = 0;
        while (jndex < index) {
            // Loop and add all strings separated by /
            jndex = principalString.indexOf('/', bindex);
            if (jndex == -1) {
                jndex = index;
            }
            String s = principalString.substring(bindex, jndex);
            if (log.isDebugEnabled()) {
                log.debug("adding principal name: " + s);
            }
            principalarr.add(s);
            bindex = jndex + 1;
        }

        // Now we must construct the rather complex asn.1...
        final ASN1EncodableVector v = new ASN1EncodableVector(); // this is the OtherName
        v.add(new ASN1ObjectIdentifier(CertTools.KRB5PRINCIPAL_OBJECTID));

        // First the Krb5PrincipalName sequence
        final ASN1EncodableVector krb5p = new ASN1EncodableVector();
        // The realm is the first tagged GeneralString
        krb5p.add(new DERTaggedObject(true, 0, new DERGeneralString(realm)));
        // Second is the sequence of principal names, which is at tagged position 1 in the krb5p
        final ASN1EncodableVector principals = new ASN1EncodableVector();
        // According to rfc4210 the type NT-UNKNOWN is 0, and according to some other rfc this type should be used...
        principals.add(new DERTaggedObject(true, 0, new ASN1Integer(0)));
        // The names themselves are yet another sequence
        final Iterator<String> i = principalarr.iterator();
        final ASN1EncodableVector names = new ASN1EncodableVector();
        while (i.hasNext()) {
            String principalName = (String) i.next();
            names.add(new DERGeneralString(principalName));
        }
        principals.add(new DERTaggedObject(true, 1, new DERSequence(names)));
        krb5p.add(new DERTaggedObject(true, 1, new DERSequence(principals)));

        v.add(new DERTaggedObject(true, 0, new DERSequence(krb5p)));
        final ASN1Primitive gn = new DERTaggedObject(false, 0, new DERSequence(v));
        vec.add(gn);
    }

    // To support custom OIDs in altNames, they must be added as an OtherName of plain type UTF8String
    for (final String oid : CertTools.getCustomOids(altName)) {
        for (final String oidValue : CertTools.getPartsFromDN(altName, oid)) {
            final ASN1EncodableVector v = new ASN1EncodableVector();
            v.add(new ASN1ObjectIdentifier(oid));
            v.add(new DERTaggedObject(true, 0, new DERUTF8String(oidValue)));
            final ASN1Primitive gn = new DERTaggedObject(false, 0, new DERSequence(v));
            vec.add(gn);
        }
    }

    if (vec.size() > 0) {
        return GeneralNames.getInstance(new DERSequence(vec));
    }
    return null;
}

---

From source file:org.cesecore.util.CertToolsTest.java

License:Open Source License

private DERSequence permanentIdentifier(String identifierValue, String assigner) {
    DERSequence result;/*  w ww  . java 2 s . c  om*/
    ASN1EncodableVector v = new ASN1EncodableVector(); // this is the OtherName
    v.add(new ASN1ObjectIdentifier(CertTools.PERMANENTIDENTIFIER_OBJECTID));

    // First the PermanentIdentifier sequence
    ASN1EncodableVector piSeq = new ASN1EncodableVector();
    if (identifierValue != null) {
        piSeq.add(new DERUTF8String(identifierValue));
    }
    if (assigner != null) {
        piSeq.add(new ASN1ObjectIdentifier(assigner));
    }
    v.add(new DERTaggedObject(true, 0, new DERSequence(piSeq)));
    result = new DERSequence(v);

    log.info(ASN1Dump.dumpAsString(result));
    return result;
}

---

From source file:org.cryptacular.x509.ExtensionReaderTest.java

License:Open Source License

@DataProvider(name = "certificate-policies")
public Object[][] getCertificatePolicies() {
    return new Object[][] { new Object[] { CertUtil.readCertificate(CRT_PATH + "serac-dev-test.crt"),
            new PolicyInformation[] {
                    new PolicyInformation(new ASN1ObjectIdentifier("1.3.6.1.4.1.6760.5.2.2.2.1")),
                    new PolicyInformation(new ASN1ObjectIdentifier("1.3.6.1.4.1.6760.5.2.2.1.1")),
                    new PolicyInformation(new ASN1ObjectIdentifier("1.3.6.1.4.1.6760.5.2.2.4.1"),
                            new DERSequence(
                                    new PolicyQualifierInfo("http://www.pki.vt.edu/vtuca/cps/index.html"))),
                    new PolicyInformation(new ASN1ObjectIdentifier("1.3.6.1.4.1.6760.5.2.2.3.1")), }, }, };
}

---

• «
• 1
• 2
• 3
• 4
• 5
• 6
• 7
• 8
• 9
• 10
• 11
• 12
• 13
• 14
• 15
• 16
• 17
• 18
• 19
• 20
• 21
• 22
• 23
• 24
• 25
• 26
• 27
• 28
• 29
• 30
• 31
• 32
• 33
• 34
• 35
• 36
• 37
• 38
• 39
• 40
• 41
• 42
• 43
• 44
• 45
• 46
• 47
• 48
• 49
• »