Example usage for org.bouncycastle.cert.jcajce JcaX509CertificateConverter getCertificate

Introduction

In this page you can find the example usage for org.bouncycastle.cert.jcajce JcaX509CertificateConverter getCertificate.

Prototype

public X509Certificate getCertificate(X509CertificateHolder certHolder) throws CertificateException 

Source Link

Document

Use the configured converter to produce a X509Certificate object from a X509CertificateHolder object.

Usage

From source file:org.hyperledger.fabric.sdk.security.certgen.TLSCertificateBuilder.java

License:Open Source License

private X509Certificate createSelfSignedCertificate(CertType certType, KeyPair keyPair, String san)
        throws Exception {
    X509v3CertificateBuilder certBuilder = createCertBuilder(keyPair);

    // Basic constraints
    BasicConstraints constraints = new BasicConstraints(false);
    certBuilder.addExtension(Extension.basicConstraints, true, constraints.getEncoded());
    // Key usage//from  ww  w.j av a 2 s .  c om
    KeyUsage usage = new KeyUsage(KeyUsage.keyEncipherment | KeyUsage.digitalSignature);
    certBuilder.addExtension(Extension.keyUsage, false, usage.getEncoded());
    // Extended key usage
    certBuilder.addExtension(Extension.extendedKeyUsage, false, certType.keyUsage().getEncoded());

    if (san != null) {
        addSAN(certBuilder, san);
    }

    ContentSigner signer = new JcaContentSignerBuilder(signatureAlgorithm).build(keyPair.getPrivate());
    X509CertificateHolder holder = certBuilder.build(signer);

    JcaX509CertificateConverter converter = new JcaX509CertificateConverter();
    converter.setProvider(new BouncyCastleProvider());
    return converter.getCertificate(holder);
}

---

From source file:org.metaeffekt.dcc.commons.pki.KeyUtils.java

License:Apache License

public static Certificate loadCertificate(String file) throws IOException, CertificateException {
    PEMParser parser = new PEMParser(new FileReader(file));
    try {/*from   ww w. j a  v  a2 s .  c o m*/
        X509CertificateHolder holder = (X509CertificateHolder) parser.readObject();
        JcaX509CertificateConverter converter = new JcaX509CertificateConverter();
        return converter.getCertificate(holder);
    } finally {
        IOUtils.closeQuietly(parser);
    }
}

---

From source file:org.openremote.security.provider.BouncyCastleKeySigner.java

License:Open Source License

/**
 * Sign a public key with a given (BouncyCastle) signer and create the corresponding
 * X.509 certificate./*from   www .  j  a  va 2 s. co  m*/
 *
 * @param builder
 *          BouncyCastle X.509 version 3 certificate builder instance
 *
 * @param signer
 *          BouncyCastle content signer configured with a signature hash algorithm and
 *          a private key for signing
 *
 * @return
 *          a X.509 certificate
 *
 * @throws  SigningException
 *            if signing the public key fails
 */
private X509Certificate signPublicKey(X509v3CertificateBuilder builder, ContentSigner signer)
        throws SigningException {
    // Construct the certificate structure and sign with the given BC content signer...

    X509CertificateHolder certHolder = builder.build(signer);

    // Convert the BC X.509 certificate holder structure into Java Crypto Architecture
    // javax.security.cert.X509Certificate instance...

    JcaX509CertificateConverter certConverter = new JcaX509CertificateConverter();
    certConverter.setProvider(SecurityProvider.BC.getProviderInstance());

    try {
        return certConverter.getCertificate(certHolder);
    }

    catch (CertificateEncodingException exception) {
        // should only happen if the code for certificate creation is using illegal values...

        throw new SigningException("Implementation Error -- Cannot create certificate : {0}", exception,
                exception.getMessage());
    }

    catch (CertificateException exception) {
        // If certificate conversion from BouncyCastle X.509 to JCA X.509 certificate fails...

        throw new SigningException("Certification conversion error : {0}", exception, exception.getMessage());
    }
}

---

From source file:org.renci.ahab.ndllib.transport.OrcaSMXMLRPCProxy.java

private KeyStore loadX509Data(FileInputStream certIS, FileInputStream keyIS, String keyAlias,
        String keyPassword) throws Exception {

    if (Security.getProvider("BC") == null) {
        Security.addProvider(new BouncyCastleProvider());
    }/*from  w ww.j ava2s  .co m*/

    /*
    AccessController.doPrivileged(new PrivilegedAction<Void>() {
            public Void run() {
                    if (Security.getProvider("BC") == null) {
                            Security.addProvider(new BouncyCastleProvider());
                    }
                    System.out.println("Currently loaded security providers:");
                    for (Provider p: Security.getProviders()) {
                            System.out.println("Provider " + p + " - " +  p.getName());
                    }
                    System.out.println("End of security provider list.");
                    return null;
            }
    });
    */

    JcaPEMKeyConverter keyConverter = new JcaPEMKeyConverter().setProvider("BC");
    JcaX509CertificateConverter certConverter = new JcaX509CertificateConverter().setProvider("BC");

    Object object;

    PEMParser pemParser = new PEMParser(new BufferedReader(new InputStreamReader(keyIS, "UTF-8")));

    PrivateKey privKey = null;

    while ((object = pemParser.readObject()) != null) {
        if (object instanceof PKCS8EncryptedPrivateKeyInfo) {
            InputDecryptorProvider decProv = new JceOpenSSLPKCS8DecryptorProviderBuilder()
                    .build(keyPassword.toCharArray());
            privKey = keyConverter
                    .getPrivateKey(((PKCS8EncryptedPrivateKeyInfo) object).decryptPrivateKeyInfo(decProv));
            break;
        } else if (object instanceof PEMEncryptedKeyPair) {
            PEMDecryptorProvider decProv = new JcePEMDecryptorProviderBuilder()
                    .build(keyPassword.toCharArray());
            privKey = keyConverter.getPrivateKey(
                    (((PEMEncryptedKeyPair) object).decryptKeyPair(decProv)).getPrivateKeyInfo());
            break;
        } else if (object instanceof PEMKeyPair) {
            privKey = keyConverter.getPrivateKey(((PEMKeyPair) object).getPrivateKeyInfo());
            break;
        }
    }

    if (privKey == null)
        throw new Exception("Private key file did not contain a private key.");

    pemParser = new PEMParser(new BufferedReader(new InputStreamReader(certIS, "UTF-8")));

    ArrayList<Certificate> certs = new ArrayList<Certificate>();

    while ((object = pemParser.readObject()) != null) {
        if (object instanceof X509CertificateHolder) {
            certs.add(certConverter.getCertificate((X509CertificateHolder) object));
        }
    }

    if (certs.isEmpty())
        throw new Exception("Certificate file contained no certificates.");

    KeyStore ks = KeyStore.getInstance("jks");
    ks.load(null);
    ks.setKeyEntry(keyAlias, privKey, keyPassword.toCharArray(), certs.toArray(new Certificate[certs.size()]));

    return ks;
}

---

From source file:org.robotbrains.examples.mqtt.subscriber.SslCertificateSubscriberMqttExample.java

License:Apache License

/**
 * Create an SSL socket factory./*w  w w .j  a v  a  2s .c om*/
 * 
 * @param credentials
 *          the security credentials
 * 
 * @return the socket factory.
 * 
 * @throws Exception
 *           something bad happened
 */
public static SSLSocketFactory configureSSLSocketFactory(Properties credentials) throws Exception {
    Security.addProvider(new BouncyCastleProvider());

    JcaX509CertificateConverter certificateConverter = new JcaX509CertificateConverter().setProvider("BC");

    String caCrtFile = credentials.getProperty("mqtt.ca.crt");
    // load CA certificate
    PEMParser reader = new PEMParser(
            new InputStreamReader(new ByteArrayInputStream(Files.readAllBytes(Paths.get(caCrtFile)))));
    X509Certificate caCert = certificateConverter.getCertificate((X509CertificateHolder) reader.readObject());
    reader.close();

    // load client certificate
    String crtFile = credentials.getProperty("mqtt.client.crt");
    reader = new PEMParser(
            new InputStreamReader(new ByteArrayInputStream(Files.readAllBytes(Paths.get(crtFile)))));
    X509Certificate cert = certificateConverter.getCertificate((X509CertificateHolder) reader.readObject());
    reader.close();

    // load client private key
    JcaPEMKeyConverter keyConverter = new JcaPEMKeyConverter().setProvider("BC");
    String keyFile = credentials.getProperty("mqtt.client.key");
    reader = new PEMParser(
            new InputStreamReader(new ByteArrayInputStream(Files.readAllBytes(Paths.get(keyFile)))));
    KeyPair key = keyConverter.getKeyPair((PEMKeyPair) reader.readObject());
    reader.close();

    // CA certificate is used to authenticate server
    KeyStore caKs = KeyStore.getInstance(KeyStore.getDefaultType());
    caKs.load(null, null);
    caKs.setCertificateEntry("ca-certificate", caCert);
    TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
    tmf.init(caKs);

    // client key and certificates are sent to server so it can authenticate
    // us
    KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
    ks.load(null, null);
    ks.setCertificateEntry("certificate", cert);

    // This assumes that the client key is not password protected. We need a
    // password, but it could be anything.
    char[] password = "password".toCharArray();
    ks.setKeyEntry("private-key", key.getPrivate(), password, new java.security.cert.Certificate[] { cert });
    KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
    kmf.init(ks, password);

    // finally, create SSL socket factory
    SSLContext context = SSLContext.getInstance("TLS");
    context.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);

    return context.getSocketFactory();
}

---

From source file:org.signserver.module.xades.signer.XAdESSignerUnitTest.java

License:Open Source License

private static MockedCryptoToken generateTokenWithIntermediateCert() throws Exception {
    final JcaX509CertificateConverter conv = new JcaX509CertificateConverter();
    final KeyPair rootcaKeyPair = CryptoUtils.generateRSA(1024);
    final X509CertificateHolder rootcaCert = new CertBuilder().setSelfSignKeyPair(rootcaKeyPair)
            .setSubject("CN=Root, O=XAdES Test, C=SE")
            .addExtension(new CertExt(Extension.keyUsage, false,
                    new X509KeyUsage(X509KeyUsage.keyCertSign | X509KeyUsage.cRLSign)))
            .addExtension(new CertExt(Extension.basicConstraints, false, new BasicConstraints(true))).build();
    final KeyPair subcaKeyPair = CryptoUtils.generateRSA(1024);
    final X509CertificateHolder subcaCert = new CertBuilder().setIssuerPrivateKey(rootcaKeyPair.getPrivate())
            .setIssuer(rootcaCert.getSubject()).setSubjectPublicKey(subcaKeyPair.getPublic())
            .setSubject("CN=Sub, O=XAdES Test, C=SE")
            .addExtension(new CertExt(Extension.keyUsage, false,
                    new X509KeyUsage(X509KeyUsage.keyCertSign | X509KeyUsage.cRLSign)))
            .addExtension(new CertExt(Extension.basicConstraints, false, new BasicConstraints(true))).build();

    final KeyPair signerKeyPair = CryptoUtils.generateRSA(1024);
    final X509CertificateHolder signerCert = new CertBuilder().setIssuerPrivateKey(subcaKeyPair.getPrivate())
            .setIssuer(subcaCert.getSubject()).setSubjectPublicKey(signerKeyPair.getPublic())
            .setSubject("CN=Signer 1, O=XAdES Test, C=SE")
            .addExtension(new CertExt(Extension.basicConstraints, false, new BasicConstraints(false))).build();

    final List<Certificate> chain = Arrays.<Certificate>asList(conv.getCertificate(signerCert),
            conv.getCertificate(subcaCert), conv.getCertificate(rootcaCert));

    return new MockedCryptoToken(signerKeyPair.getPrivate(), signerKeyPair.getPublic(),
            conv.getCertificate(signerCert), chain, "BC");
}

---

From source file:org.signserver.module.xades.validator.XAdESValidator2UnitTest.java

License:Open Source License

/**
 * Setting up key-pairs, mocked crypto tokens, certificates and CRLs used
 * by the tests./*w  w  w .j  a v a  2 s  . c o m*/
 */
@BeforeClass
public static void setUpClass() throws Exception {
    Security.addProvider(new BouncyCastleProvider());
    JcaX509CertificateConverter conv = new JcaX509CertificateConverter();

    // Root CA, sub CA
    rootcaCRLFile = File.createTempFile("xadestest-", "-rootca.crl");
    LOG.debug("rootcaCRLFile: " + rootcaCRLFile);
    subca1CRLFile = File.createTempFile("xadestest-", "-subca.crl");
    LOG.debug("subcaCRLFile: " + subca1CRLFile);
    rootcaKeyPair = CryptoUtils.generateRSA(1024);
    anotherKeyPair = CryptoUtils.generateRSA(1024);
    rootcaCert = new CertBuilder().setSelfSignKeyPair(rootcaKeyPair).setSubject("CN=Root, O=XAdES Test, C=SE")
            .addExtension(new CertExt(Extension.keyUsage, false,
                    new X509KeyUsage(
                            X509KeyUsage.keyCertSign | X509KeyUsage.cRLSign | X509KeyUsage.digitalSignature)))
            .addExtension(new CertExt(Extension.basicConstraints, false, new BasicConstraints(true))).build();
    final KeyPair subca1KeyPair = CryptoUtils.generateRSA(1024);
    subca1Cert = new CertBuilder().setIssuerPrivateKey(rootcaKeyPair.getPrivate())
            .setIssuer(rootcaCert.getSubject()).setSubjectPublicKey(subca1KeyPair.getPublic())
            .addCDPURI(rootcaCRLFile.toURI().toURL().toExternalForm())
            .setSubject("CN=Sub 1, O=XAdES Test, C=SE")
            .addExtension(new CertExt(Extension.keyUsage, false,
                    new X509KeyUsage(X509KeyUsage.keyCertSign | X509KeyUsage.cRLSign)))
            .addExtension(new CertExt(Extension.basicConstraints, false, new BasicConstraints(true))).build();
    subca2KeyPair = CryptoUtils.generateRSA(1024);
    subca2Cert = new CertBuilder().setIssuerPrivateKey(rootcaKeyPair.getPrivate())
            .setIssuer(rootcaCert.getSubject()).setSubjectPublicKey(subca2KeyPair.getPublic())
            .setSubject("CN=Sub 2, O=XAdES Test, C=SE")
            .addExtension(new CertExt(Extension.keyUsage, false,
                    new X509KeyUsage(
                            X509KeyUsage.keyCertSign | X509KeyUsage.cRLSign | X509KeyUsage.digitalSignature)))
            .addExtension(new CertExt(Extension.basicConstraints, false, new BasicConstraints(true)))
            .addExtension(new CertExt(Extension.authorityInfoAccess, false,
                    new AuthorityInformationAccess(AccessDescription.id_ad_ocsp,
                            new GeneralName(GeneralName.uniformResourceIdentifier, "http://ocsp.example.com"))))
            .build();

    // Signer 1 is issued directly by the root CA
    final KeyPair signer1KeyPair = CryptoUtils.generateRSA(1024);
    final X509CertificateHolder signer1Cert = new CertBuilder().setIssuerPrivateKey(rootcaKeyPair.getPrivate())
            .setIssuer(rootcaCert.getSubject()).setSubjectPublicKey(signer1KeyPair.getPublic())
            .setSubject("CN=Signer 1, O=XAdES Test, C=SE")
            .addCDPURI(rootcaCRLFile.toURI().toURL().toExternalForm())
            .addExtension(new CertExt(Extension.basicConstraints, false, new BasicConstraints(false))).build();
    final List<Certificate> chain1 = Arrays.<Certificate>asList(conv.getCertificate(signer1Cert),
            conv.getCertificate(rootcaCert));
    token1 = new MockedCryptoToken(signer1KeyPair.getPrivate(), signer1KeyPair.getPublic(),
            conv.getCertificate(signer1Cert), chain1, "BC");
    LOG.debug("Chain 1: \n" + new String(CertTools.getPEMFromCerts(chain1), "ASCII") + "\n");

    // Sign a document by signer 1
    XAdESSigner instance = new MockedXAdESSigner(token1);
    WorkerConfig config = new WorkerConfig();
    instance.init(4712, config, null, null);
    RequestContext requestContext = new RequestContext();
    requestContext.put(RequestContext.TRANSACTION_ID, "0000-201-1");
    GenericSignRequest request = new GenericSignRequest(201, "<test201/>".getBytes("UTF-8"));
    GenericSignResponse response = (GenericSignResponse) instance.processData(request, requestContext);
    byte[] data = response.getProcessedData();
    signedXml1 = new String(data);
    LOG.debug("Signed document by signer 1:\n\n" + signedXml1 + "\n");

    // Signer 2 is issued by the sub CA
    final KeyPair signer2KeyPair = CryptoUtils.generateRSA(1024);
    final X509CertificateHolder signer2Cert = new CertBuilder().setIssuerPrivateKey(subca1KeyPair.getPrivate())
            .setIssuer(subca1Cert.getSubject()).setSubjectPublicKey(signer2KeyPair.getPublic())
            .setSubject("CN=Signer 2, O=XAdES Test, C=SE")
            .addCDPURI(subca1CRLFile.toURI().toURL().toExternalForm())
            .addExtension(new CertExt(Extension.basicConstraints, false, new BasicConstraints(false))).build();
    final List<Certificate> chain2 = Arrays.<Certificate>asList(conv.getCertificate(signer2Cert),
            conv.getCertificate(subca1Cert), conv.getCertificate(rootcaCert));
    token2 = new MockedCryptoToken(signer2KeyPair.getPrivate(), signer2KeyPair.getPublic(),
            conv.getCertificate(signer2Cert), chain2, "BC");
    LOG.debug("Chain 2: \n" + new String(CertTools.getPEMFromCerts(chain2)) + "\n");

    // Sign a document by signer 2
    instance = new MockedXAdESSigner(token2);
    config = new WorkerConfig();
    instance.init(4713, config, null, null);
    requestContext = new RequestContext();
    requestContext.put(RequestContext.TRANSACTION_ID, "0000-202-1");
    request = new GenericSignRequest(202, "<test202/>".getBytes("UTF-8"));
    response = (GenericSignResponse) instance.processData(request, requestContext);
    data = response.getProcessedData();
    signedXml2 = new String(data);
    LOG.debug("Signed document by signer 2:\n\n" + signedXml2 + "\n");

    // CRL with all active (empty CRL)
    rootcaCRLEmpty = new CRLBuilder().setIssuerPrivateKey(rootcaKeyPair.getPrivate())
            .setIssuer(rootcaCert.getSubject()).build();
    subca1CRLEmpty = new CRLBuilder().setIssuerPrivateKey(subca1KeyPair.getPrivate())
            .setIssuer(subca1Cert.getSubject()).build();
    rootcaCRLSubCAAndSigner1Revoked = new CRLBuilder().setIssuerPrivateKey(rootcaKeyPair.getPrivate())
            .setIssuer(rootcaCert.getSubject())
            .addCRLEntry(subca1Cert.getSerialNumber(), new Date(), CRLReason.keyCompromise)
            .addCRLEntry(signer1Cert.getSerialNumber(), new Date(), CRLReason.keyCompromise).build();
    subca1CRLSigner2Revoked = new CRLBuilder().setIssuerPrivateKey(subca1KeyPair.getPrivate())
            .setIssuer(subca1Cert.getSubject())
            .addCRLEntry(signer2Cert.getSerialNumber(), new Date(), CRLReason.keyCompromise).build();
    otherCRL = new CRLBuilder().setIssuer(subca1Cert.getSubject()) // Setting Sub CA DN all though an other key will be used
            .build();

    // signer 3, issued by the root CA with an OCSP authority information access in the signer cert
    final KeyPair signer3KeyPair = CryptoUtils.generateRSA(1024);
    signer3Cert = new CertBuilder().setIssuerPrivateKey(rootcaKeyPair.getPrivate())
            .setIssuer(rootcaCert.getSubject()).setSubjectPublicKey(signer3KeyPair.getPublic())
            .setSubject("CN=Signer 3, O=XAdES Test, C=SE")
            .addExtension(new CertExt(Extension.authorityInfoAccess, false,
                    new AuthorityInformationAccess(AccessDescription.id_ad_ocsp,
                            new GeneralName(GeneralName.uniformResourceIdentifier, "http://ocsp.example.com"))))
            .addExtension(new CertExt(Extension.basicConstraints, false, new BasicConstraints(false))).build();
    final List<Certificate> chain3 = Arrays.<Certificate>asList(conv.getCertificate(signer3Cert),
            conv.getCertificate(rootcaCert));
    token3 = new MockedCryptoToken(signer3KeyPair.getPrivate(), signer3KeyPair.getPublic(),
            conv.getCertificate(signer3Cert), chain3, "BC");
    LOG.debug("Chain 3: \n" + new String(CertTools.getPEMFromCerts(chain3)) + "\n");

    // signer 4, issued by the sub CA2 with an OCSP authority information access in the signer cert
    final KeyPair signer4KeyPair = CryptoUtils.generateRSA(1024);
    signer4Cert = new CertBuilder().setIssuerPrivateKey(subca2KeyPair.getPrivate())
            .setIssuer(subca2Cert.getSubject()).setSubjectPublicKey(signer4KeyPair.getPublic())
            .setSubject("CN=Signer 4, O=XAdES Test, C=SE")
            .addExtension(new CertExt(Extension.authorityInfoAccess, false,
                    new AuthorityInformationAccess(AccessDescription.id_ad_ocsp,
                            new GeneralName(GeneralName.uniformResourceIdentifier, "http://ocsp.example.com"))))
            .addExtension(new CertExt(Extension.basicConstraints, false, new BasicConstraints(false))).build();
    final List<Certificate> chain4 = Arrays.<Certificate>asList(conv.getCertificate(signer4Cert),
            conv.getCertificate(subca2Cert), conv.getCertificate(rootcaCert));
    token4 = new MockedCryptoToken(signer4KeyPair.getPrivate(), signer4KeyPair.getPublic(),
            conv.getCertificate(signer4Cert), chain4, "BC");
    LOG.debug("Chain 4: \n" + new String(CertTools.getPEMFromCerts(chain4)) + "\n");

    // ocspSigner 1, OCSP responder issued by the root CA with an ocsp-nocheck in the signer cert
    ocspSigner1KeyPair = CryptoUtils.generateRSA(1024);
    ocspSigner1Cert = new CertBuilder().setIssuerPrivateKey(rootcaKeyPair.getPrivate())
            .setIssuer(rootcaCert.getSubject()).setSubjectPublicKey(ocspSigner1KeyPair.getPublic())
            .setSubject("CN=OCSP Responder 1, O=XAdES Test, C=SE")
            .addExtension(new CertExt(Extension.basicConstraints, false, new BasicConstraints(false)))
            .addExtension(new CertExt(Extension.extendedKeyUsage, false,
                    new ExtendedKeyUsage(KeyPurposeId.id_kp_OCSPSigning)))
            .addExtension(new CertExt(OCSPObjectIdentifiers.id_pkix_ocsp_nocheck, false, new DERNull()))
            .build();

    // ocspSigner 2, OCSP responder issued by the sub CA2 with an ocsp-nocheck in the signer cert
    ocspSigner2KeyPair = CryptoUtils.generateRSA(1024);
    ocspSigner2Cert = new CertBuilder().setIssuerPrivateKey(subca2KeyPair.getPrivate())
            .setIssuer(subca2Cert.getSubject()).setSubjectPublicKey(ocspSigner2KeyPair.getPublic())
            .setSubject("CN=OCSP Responder 2, O=XAdES Test, C=SE")
            .addExtension(new CertExt(Extension.basicConstraints, false, new BasicConstraints(false)))
            .addExtension(new CertExt(Extension.extendedKeyUsage, false,
                    new ExtendedKeyUsage(KeyPurposeId.id_kp_OCSPSigning)))
            .addExtension(new CertExt(OCSPObjectIdentifiers.id_pkix_ocsp_nocheck, false, new DERNull()))
            .build();

    // Sign a document by signer 3
    instance = new MockedXAdESSigner(token3);
    config = new WorkerConfig();
    instance.init(4714, config, null, null);
    requestContext = new RequestContext();
    requestContext.put(RequestContext.TRANSACTION_ID, "0000-203-1");
    request = new GenericSignRequest(202, "<test203/>".getBytes("UTF-8"));
    response = (GenericSignResponse) instance.processData(request, requestContext);
    data = response.getProcessedData();
    signedXml3 = new String(data);
    LOG.debug("Signed document by signer 3:\n\n" + signedXml3 + "\n");

    // Sign a document by signer 4
    instance = new MockedXAdESSigner(token4);
    config = new WorkerConfig();
    instance.init(4715, config, null, null);
    requestContext = new RequestContext();
    requestContext.put(RequestContext.TRANSACTION_ID, "0000-204-1");
    request = new GenericSignRequest(203, "<test204/>".getBytes("UTF-8"));
    response = (GenericSignResponse) instance.processData(request, requestContext);
    data = response.getProcessedData();
    signedXml4 = new String(data);
    LOG.debug("Signed document by signer 4:\n\n" + signedXml4 + "\n");

    // Signer 5 is issued directly by the root CA
    final KeyPair signer5KeyPair = CryptoUtils.generateRSA(1024);
    signer5Cert = new CertBuilder().setIssuerPrivateKey(rootcaKeyPair.getPrivate())
            .setIssuer(rootcaCert.getSubject()).setSubjectPublicKey(signer5KeyPair.getPublic())
            .setSubject("CN=Signer 5, O=XAdES Test, C=SE")
            .addCDPURI(rootcaCRLFile.toURI().toURL().toExternalForm())
            .addExtension(new CertExt(Extension.authorityInfoAccess, false,
                    new AuthorityInformationAccess(AccessDescription.id_ad_ocsp,
                            new GeneralName(GeneralName.uniformResourceIdentifier, "http://ocsp.example.com"))))
            .addExtension(new CertExt(Extension.basicConstraints, false, new BasicConstraints(false))).build();
    final List<Certificate> chain5 = Arrays.<Certificate>asList(conv.getCertificate(signer5Cert),
            conv.getCertificate(rootcaCert));
    token5 = new MockedCryptoToken(signer5KeyPair.getPrivate(), signer5KeyPair.getPublic(),
            conv.getCertificate(signer1Cert), chain5, "BC");
    LOG.debug("Chain 5: \n" + new String(CertTools.getPEMFromCerts(chain5)) + "\n");

    // Sign a document by signer 5
    instance = new MockedXAdESSigner(token5);
    config = new WorkerConfig();
    instance.init(4712, config, null, null);
    requestContext = new RequestContext();
    requestContext.put(RequestContext.TRANSACTION_ID, "0000-205-1");
    request = new GenericSignRequest(205, "<test205/>".getBytes("UTF-8"));
    response = (GenericSignResponse) instance.processData(request, requestContext);
    data = response.getProcessedData();
    signedXml5 = new String(data);
    LOG.debug("Signed document by signer 5:\n\n" + signedXml5 + "\n");

    // CRL with signer 5 revoked
    rootcaCRLSigner5Revoked = new CRLBuilder().setIssuerPrivateKey(rootcaKeyPair.getPrivate())
            .setIssuer(rootcaCert.getSubject())
            .addCRLEntry(signer5Cert.getSerialNumber(), new Date(), CRLReason.keyCompromise).build();
}

---

From source file:org.signserver.validationservice.server.ValidationUtils.java

License:Open Source License

/**
 * Sends a request to the OCSP responder and returns the results.
 *
 * Note: Based on code from the EJBCA ValidationTool.
 *
 * @param url of the OCSP responder//w w w. j a  va 2  s. co m
 * @param request to send
 * @return An OCSPResponse object filled with information about the response
 * @throws IOException in case of networking related errors
 * @throws OCSPException in case of error parsing the response
 */
public static OCSPResponse queryOCSPResponder(URL url, OCSPReq request) throws IOException, OCSPException {
    final OCSPResponse result = new OCSPResponse();

    final HttpURLConnection con;
    final URLConnection urlCon = url.openConnection();
    if (!(urlCon instanceof HttpURLConnection)) {
        throw new IOException("Unsupported protocol in URL: " + url);
    }
    con = (HttpURLConnection) urlCon;

    // POST the OCSP request
    con.setDoOutput(true);
    con.setRequestMethod("POST");

    // POST it
    con.setRequestProperty("Content-Type", "application/ocsp-request");
    OutputStream os = null;
    try {
        os = con.getOutputStream();
        os.write(request.getEncoded());
    } finally {
        if (os != null) {
            os.close();
        }
    }

    result.setHttpReturnCode(con.getResponseCode());
    if (result.getHttpReturnCode() != 200) {
        if (result.getHttpReturnCode() == 401) {
            result.setError(OCSPResponse.Error.httpUnauthorized);
        } else {
            result.setError(OCSPResponse.Error.unknown);
        }
        return result;
    }

    OCSPResp response = null;
    InputStream in = null;
    try {
        in = con.getInputStream();
        if (in != null) {
            ByteArrayOutputStream bout = new ByteArrayOutputStream();
            int b;
            while ((b = in.read()) != -1) {
                bout.write(b);
            }
            response = new OCSPResp(bout.toByteArray());
        }
    } finally {
        if (in != null) {
            try {
                in.close();
            } catch (IOException ignored) {
            } // NOPMD
        }
    }

    if (response == null) {
        result.setError(OCSPResponse.Error.noResponse);
        return result;
    }
    result.setResp(response);

    if (response.getStatus() != OCSPResponseStatus.SUCCESSFUL) {
        result.setError(OCSPResponse.Error.fromBCOCSPResponseStatus(response.getStatus()));
        return result;
    }

    final BasicOCSPResp brep = (BasicOCSPResp) response.getResponseObject();
    result.setResponseObject(brep);
    if (brep == null) {
        result.setError(OCSPResponse.Error.noResponse);
        return result;
    }

    final RespID id = brep.getResponderId();
    final DERTaggedObject to = (DERTaggedObject) id.toASN1Object().toASN1Object();
    final RespID respId;

    final X509CertificateHolder[] chain = brep.getCerts();
    JcaX509CertificateConverter converter = new JcaX509CertificateConverter();
    X509Certificate signerCertificate;
    try {
        signerCertificate = converter.getCertificate(chain[0]);
    } catch (CertificateException ex) {
        throw new IOException("Could not convert certificate: " + ex.getMessage());
    }
    result.setSignerCertificate(signerCertificate);

    if (to.getTagNo() == 1) {
        // This is Name
        respId = new JcaRespID(signerCertificate.getSubjectX500Principal());
    } else {
        // This is KeyHash
        final PublicKey signerPub = signerCertificate.getPublicKey();
        try {
            respId = new JcaRespID(signerPub,
                    new JcaDigestCalculatorProviderBuilder().build().get(RespID.HASH_SHA1));
        } catch (OperatorCreationException ex) {
            throw new IOException("Could not create respId: " + ex.getMessage());
        }
    }
    if (!id.equals(respId)) {
        // Response responderId does not match signer certificate responderId!
        result.setError(OCSPResponse.Error.invalidSignerId);
    }

    result.setIssuerDN(signerCertificate.getIssuerX500Principal());

    if (result.getError() == null) {
        result.setError(OCSPResponse.Error.responseSuccess);
    }

    return result;
}

---

From source file:org.sipfoundry.sipxconfig.cert.CertificateUtils.java

License:Contributor Agreement License

public static X509Certificate generateCert(X509v3CertificateBuilder gen, String algorithm, PrivateKey key)
        throws GeneralSecurityException {
    ContentSigner sigGen;//from  w ww  .  j a v a  2  s. co m
    try {
        sigGen = new JcaContentSignerBuilder(algorithm).setProvider(PROVIDER).build(key);
        JcaX509CertificateConverter converter = new JcaX509CertificateConverter().setProvider(PROVIDER);
        return converter.getCertificate(gen.build(sigGen));
    } catch (OperatorCreationException e) {
        throw new GeneralSecurityException(e);
    } catch (CertificateException e) {
        throw new GeneralSecurityException(e);
    }
}

---

From source file:org.sonatype.nexus.ssl.CertificateUtil.java

License:Open Source License

/**
 * Decodes a PEM formatted certificate.//  w ww  .  j  av  a 2s  .c om
 *
 * @param pemFormattedCertificate text to be decoded as a PEM certificate.
 * @return the Certificate decoded from the input text.
 * @throws CertificateParsingException
 *          thrown if the PEM formatted string cannot be parsed into a Certificate.
 */
public static Certificate decodePEMFormattedCertificate(final String pemFormattedCertificate)
        throws CertificateException {
    log.trace("Parsing PEM formatted certificate string:\n{}", pemFormattedCertificate);

    // make sure we have something to parse
    if (pemFormattedCertificate != null) {
        StringReader stringReader = new StringReader(pemFormattedCertificate);
        PEMParser pemReader = new PEMParser(stringReader);
        try {
            Object object = pemReader.readObject();
            log.trace("Object found while paring PEM formatted string: {}", object);

            if (object instanceof X509CertificateHolder) {
                X509CertificateHolder holder = (X509CertificateHolder) object;
                JcaX509CertificateConverter converter = new JcaX509CertificateConverter();
                return converter.getCertificate(holder);
            }
        } catch (IOException e) {
            throw new CertificateParsingException(
                    "Failed to parse valid certificate from expected PEM formatted certificate:\n"
                            + pemFormattedCertificate,
                    e);
        }
    }

    // cert was not a valid object
    throw new CertificateParsingException(
            "Failed to parse valid certificate from expected PEM formatted certificate:\n"
                    + pemFormattedCertificate);
}

---

• «
• 1
• 2
• 3
• 4
• 5
• 6
• »