Example usage for org.bouncycastle.cert.jcajce JcaX509CertificateConverter JcaX509CertificateConverter

Introduction

In this page you can find the example usage for org.bouncycastle.cert.jcajce JcaX509CertificateConverter JcaX509CertificateConverter.

Prototype

public JcaX509CertificateConverter() 

Source Link

Document

Base constructor, configure with the default provider.

Usage

From source file:esteidhacker.FakeEstEIDCA.java

License:Open Source License

private X509Certificate makeEsteidCert(KeyPair esteid, KeyPair root)
        throws InvalidKeyException, IllegalStateException, NoSuchProviderException, SignatureException,
        IOException, NoSuchAlgorithmException, ParseException, OperatorCreationException, CertificateException {

    // Load current root certificate
    X509CertificateHolder real = getRealCert("/resources/sk-esteid.pem");

    JcaX509v3CertificateBuilder builder = new JcaX509v3CertificateBuilder(real.getIssuer(),
            real.getSerialNumber(), real.getNotBefore(), real.getNotAfter(), real.getSubject(),
            esteid.getPublic());/*from  w  ww  .  j av a2s.  c  o  m*/

    // Basic constraints
    @SuppressWarnings("unchecked")
    List<ASN1ObjectIdentifier> list = real.getExtensionOIDs();

    // Copy all extensions
    for (ASN1ObjectIdentifier extoid : list) {
        Extension ext = real.getExtension(extoid);
        builder.copyAndAddExtension(ext.getExtnId(), ext.isCritical(), real);
    }

    // Generate cert
    ContentSigner sigGen = new JcaContentSignerBuilder("SHA1withRSA")
            .setProvider(BouncyCastleProvider.PROVIDER_NAME).build(root.getPrivate());

    X509CertificateHolder cert = builder.build(sigGen);
    return new JcaX509CertificateConverter().setProvider(BouncyCastleProvider.PROVIDER_NAME)
            .getCertificate(cert);

}

---

From source file:esteidhacker.FakeEstEIDCA.java

License:Open Source License

public X509Certificate cloneUserCertificate(RSAPublicKey pubkey, X509Certificate cert)
        throws OperatorCreationException, CertificateException, IOException {
    X509CertificateHolder holder = new X509CertificateHolder(cert.getEncoded());
    // Clone everything
    JcaX509v3CertificateBuilder builder = new JcaX509v3CertificateBuilder(holder.getIssuer(),
            cert.getSerialNumber(), cert.getNotBefore(), cert.getNotAfter(), holder.getSubject(), pubkey);
    @SuppressWarnings("unchecked")
    List<ASN1ObjectIdentifier> list = holder.getExtensionOIDs();

    // Copy all extensions
    for (ASN1ObjectIdentifier extoid : list) {
        Extension ext = holder.getExtension(extoid);
        builder.copyAndAddExtension(ext.getExtnId(), ext.isCritical(), holder);
    }/*w w w.  j  av  a 2  s  .co  m*/
    // Generate cert
    ContentSigner sigGen = new JcaContentSignerBuilder("SHA1withRSA")
            .setProvider(BouncyCastleProvider.PROVIDER_NAME).build(esteidKey);

    X509CertificateHolder newcert = builder.build(sigGen);
    return new JcaX509CertificateConverter().setProvider(BouncyCastleProvider.PROVIDER_NAME)
            .getCertificate(newcert);

}

---

From source file:esteidhacker.FakeEstEIDCA.java

License:Open Source License

public X509Certificate generateUserCertificate(RSAPublicKey pubkey, boolean signature, String firstname,
        String lastname, String idcode, String email)
        throws InvalidKeyException, ParseException, IOException, IllegalStateException, NoSuchProviderException,
        NoSuchAlgorithmException, SignatureException, CertificateException, OperatorCreationException {
    Date startDate = new SimpleDateFormat("yyyy-MM-dd", Locale.ENGLISH).parse("2015-01-01");
    Date endDate = new SimpleDateFormat("yyyy-MM-dd", Locale.ENGLISH).parse("2015-12-31");

    String template = "C=EE,O=ESTEID,OU=%s,CN=%s\\,%s\\,%s,SURNAME=%s,GIVENNAME=%s,SERIALNUMBER=%s";
    // Normalize.
    lastname = lastname.toUpperCase();//from  ww w  .ja  v  a  2  s .c o m
    firstname = firstname.toUpperCase();
    idcode = idcode.toUpperCase();
    email = email.toLowerCase();
    String subject = String.format(template, (signature ? "digital signature" : "authentication"), lastname,
            firstname, idcode, lastname, firstname, idcode);

    byte[] serialBytes = new byte[16];
    SecureRandom rnd = SecureRandom.getInstance("SHA1PRNG");
    rnd.nextBytes(serialBytes);
    serialBytes[0] &= 0x7F; // Can't be negative
    BigInteger serial = new BigInteger(serialBytes);

    X509CertificateHolder real;
    if (signature) {
        real = getRealCert("/resources/sk-sign.pem");
    } else {
        real = getRealCert("/resources/sk-auth.pem");
    }
    serial = real.getSerialNumber();
    System.out.println("Generating from subject: " + real.getSubject());
    System.out.println("Generating subject: " + new X500Name(subject).toString());

    JcaX509v3CertificateBuilder builder = new JcaX509v3CertificateBuilder(real.getIssuer(), serial, startDate,
            endDate, new X500Name(subject), pubkey);

    @SuppressWarnings("unchecked")
    List<ASN1ObjectIdentifier> list = real.getExtensionOIDs();

    // Copy all extensions, except altName
    for (ASN1ObjectIdentifier extoid : list) {
        Extension ext = real.getExtension(extoid);
        if (ext.getExtnId().equals(Extension.subjectAlternativeName)) {
            // altName must be changed
            builder.addExtension(ext.getExtnId(), ext.isCritical(),
                    new GeneralNames(new GeneralName(GeneralName.rfc822Name, email)));
        } else {
            builder.copyAndAddExtension(ext.getExtnId(), ext.isCritical(), real);
        }
    }

    // Generate cert
    ContentSigner sigGen = new JcaContentSignerBuilder("SHA1withRSA")
            .setProvider(BouncyCastleProvider.PROVIDER_NAME).build(esteidKey);

    X509CertificateHolder cert = builder.build(sigGen);
    return new JcaX509CertificateConverter().setProvider(BouncyCastleProvider.PROVIDER_NAME)
            .getCertificate(cert);
}

---

From source file:eu.europa.esig.dss.cades.signature.CAdESLevelBTest.java

License:Open Source License

@Override
protected void onDocumentSigned(byte[] byteArray) {
    try {/*from   w  w w  .  j  a  va 2s  .c o m*/

        CAdESSignature signature = new CAdESSignature(byteArray);
        assertNotNull(signature.getCmsSignedData());

        ASN1InputStream asn1sInput = new ASN1InputStream(byteArray);
        ASN1Sequence asn1Seq = (ASN1Sequence) asn1sInput.readObject();

        logger.info("SEQ : " + asn1Seq.toString());

        assertEquals(2, asn1Seq.size());

        ASN1ObjectIdentifier oid = ASN1ObjectIdentifier.getInstance(asn1Seq.getObjectAt(0));
        assertEquals(PKCSObjectIdentifiers.signedData, oid);
        logger.info("OID : " + oid.toString());

        ASN1TaggedObject taggedObj = DERTaggedObject.getInstance(asn1Seq.getObjectAt(1));

        logger.info("TAGGED OBJ : " + taggedObj.toString());

        ASN1Primitive object = taggedObj.getObject();
        logger.info("OBJ : " + object.toString());

        SignedData signedData = SignedData.getInstance(object);
        logger.info("SIGNED DATA : " + signedData.toString());

        ASN1Set digestAlgorithms = signedData.getDigestAlgorithms();
        logger.info("DIGEST ALGOS : " + digestAlgorithms.toString());

        ContentInfo encapContentInfo = signedData.getEncapContentInfo();
        logger.info("ENCAPSULATED CONTENT INFO : " + encapContentInfo.getContentType() + " "
                + encapContentInfo.getContent());

        ASN1Set certificates = signedData.getCertificates();
        logger.info("CERTIFICATES (" + certificates.size() + ") : " + certificates);

        List<X509Certificate> foundCertificates = new ArrayList<X509Certificate>();
        for (int i = 0; i < certificates.size(); i++) {
            ASN1Sequence seqCertif = ASN1Sequence.getInstance(certificates.getObjectAt(i));
            logger.info("SEQ cert " + i + " : " + seqCertif);

            X509CertificateHolder certificateHolder = new X509CertificateHolder(seqCertif.getEncoded());
            X509Certificate certificate = new JcaX509CertificateConverter()
                    .setProvider(BouncyCastleProvider.PROVIDER_NAME).getCertificate(certificateHolder);

            certificate.checkValidity();

            logger.info("Cert " + i + " : " + certificate);

            foundCertificates.add(certificate);
        }

        ASN1Set crLs = signedData.getCRLs();
        logger.info("CRLs : " + crLs);

        ASN1Set signerInfosAsn1 = signedData.getSignerInfos();
        logger.info("SIGNER INFO ASN1 : " + signerInfosAsn1.toString());
        assertEquals(1, signerInfosAsn1.size());

        ASN1Sequence seqSignedInfo = ASN1Sequence.getInstance(signerInfosAsn1.getObjectAt(0));

        SignerInfo signedInfo = SignerInfo.getInstance(seqSignedInfo);
        logger.info("SIGNER INFO : " + signedInfo.toString());

        SignerIdentifier sid = signedInfo.getSID();
        logger.info("SIGNER IDENTIFIER : " + sid.getId());

        IssuerAndSerialNumber issuerAndSerialNumber = IssuerAndSerialNumber.getInstance(signedInfo.getSID());
        logger.info("ISSUER AND SN : " + issuerAndSerialNumber.toString());

        BigInteger serial = issuerAndSerialNumber.getSerialNumber().getValue();

        X509Certificate signerCertificate = null;
        for (X509Certificate x509Certificate : foundCertificates) {
            // TODO check issuer name
            if (serial.equals(x509Certificate.getSerialNumber())) {
                signerCertificate = x509Certificate;
            }
        }
        assertNotNull(signerCertificate);

        ASN1OctetString encryptedDigest = signedInfo.getEncryptedDigest();
        logger.info("ENCRYPT DIGEST : " + encryptedDigest.toString());

        ASN1Sequence seq = ASN1Sequence.getInstance(object);

        ASN1Integer version = ASN1Integer.getInstance(seq.getObjectAt(0));
        logger.info("VERSION : " + version.toString());

        ASN1Set digestManualSet = ASN1Set.getInstance(seq.getObjectAt(1));
        logger.info("DIGEST SET : " + digestManualSet.toString());
        assertEquals(digestAlgorithms, digestManualSet);

        ASN1Sequence seqDigest = ASN1Sequence.getInstance(digestManualSet.getObjectAt(0));
        // assertEquals(1, seqDigest.size());

        ASN1ObjectIdentifier oidDigestAlgo = ASN1ObjectIdentifier.getInstance(seqDigest.getObjectAt(0));
        assertEquals(new ASN1ObjectIdentifier(DigestAlgorithm.SHA256.getOid()), oidDigestAlgo);

        ASN1Sequence seqEncapsulatedInfo = ASN1Sequence.getInstance(seq.getObjectAt(2));
        logger.info("ENCAPSULATED INFO : " + seqEncapsulatedInfo.toString());

        ASN1ObjectIdentifier oidContentType = ASN1ObjectIdentifier
                .getInstance(seqEncapsulatedInfo.getObjectAt(0));
        logger.info("OID CONTENT TYPE : " + oidContentType.toString());

        ASN1TaggedObject taggedContent = DERTaggedObject.getInstance(seqEncapsulatedInfo.getObjectAt(1));

        ASN1OctetString contentOctetString = ASN1OctetString.getInstance(taggedContent.getObject());
        String content = new String(contentOctetString.getOctets());
        assertEquals(HELLO_WORLD, content);
        logger.info("CONTENT : " + content);

        byte[] digest = DSSUtils.digest(DigestAlgorithm.SHA256, HELLO_WORLD.getBytes());
        String encodeHexDigest = Hex.toHexString(digest);
        logger.info("CONTENT DIGEST COMPUTED : " + encodeHexDigest);

        ASN1Set authenticatedAttributes = signedInfo.getAuthenticatedAttributes();
        logger.info("AUTHENTICATED ATTRIBUTES : " + authenticatedAttributes.toString());

        // ASN1Sequence seqAuthAttrib = ASN1Sequence.getInstance(authenticatedAttributes.getObjectAt(0));

        logger.info("Nb Auth Attributes : " + authenticatedAttributes.size());

        String embeddedDigest = StringUtils.EMPTY;
        for (int i = 0; i < authenticatedAttributes.size(); i++) {
            ASN1Sequence authAttrSeq = ASN1Sequence.getInstance(authenticatedAttributes.getObjectAt(i));
            logger.info(authAttrSeq.toString());
            ASN1ObjectIdentifier attrOid = ASN1ObjectIdentifier.getInstance(authAttrSeq.getObjectAt(0));
            if (PKCSObjectIdentifiers.pkcs_9_at_messageDigest.equals(attrOid)) {
                ASN1Set setMessageDigest = ASN1Set.getInstance(authAttrSeq.getObjectAt(1));
                ASN1OctetString asn1ObjString = ASN1OctetString.getInstance(setMessageDigest.getObjectAt(0));
                embeddedDigest = Hex.toHexString(asn1ObjString.getOctets());
            }
        }
        assertEquals(encodeHexDigest, embeddedDigest);

        ASN1OctetString encryptedInfoOctedString = signedInfo.getEncryptedDigest();
        String signatureValue = Hex.toHexString(encryptedInfoOctedString.getOctets());

        logger.info("SIGNATURE VALUE : " + signatureValue);

        Cipher cipher = Cipher.getInstance("RSA");
        cipher.init(Cipher.DECRYPT_MODE, signerCertificate);
        byte[] decrypted = cipher.doFinal(encryptedInfoOctedString.getOctets());

        ASN1InputStream inputDecrypted = new ASN1InputStream(decrypted);

        ASN1Sequence seqDecrypt = (ASN1Sequence) inputDecrypted.readObject();
        logger.info("Decrypted : " + seqDecrypt);

        DigestInfo digestInfo = new DigestInfo(seqDecrypt);
        assertEquals(oidDigestAlgo, digestInfo.getAlgorithmId().getAlgorithm());

        String decryptedDigestEncodeBase64 = Base64.encodeBase64String(digestInfo.getDigest());
        logger.info("Decrypted Base64 : " + decryptedDigestEncodeBase64);

        byte[] encoded = signedInfo.getAuthenticatedAttributes().getEncoded();
        MessageDigest messageDigest = MessageDigest.getInstance(DigestAlgorithm.SHA256.getName());
        byte[] digestOfAuthenticatedAttributes = messageDigest.digest(encoded);

        String computedDigestEncodeBase64 = Base64.encodeBase64String(digestOfAuthenticatedAttributes);
        logger.info("Computed Base64 : " + computedDigestEncodeBase64);

        assertEquals(decryptedDigestEncodeBase64, computedDigestEncodeBase64);

        IOUtils.closeQuietly(asn1sInput);
        IOUtils.closeQuietly(inputDecrypted);
    } catch (Exception e) {
        logger.error(e.getMessage(), e);
        fail(e.getMessage());
    }
}

---

From source file:eu.europa.esig.dss.pades.InfiniteLoopDSS621Test.java

License:Open Source License

private List<X509Certificate> extractCertificates(SignedData signedData) throws Exception {
    ASN1Set certificates = signedData.getCertificates();
    logger.info("CERTIFICATES (" + certificates.size() + ") : " + certificates);

    List<X509Certificate> foundCertificates = new ArrayList<X509Certificate>();
    for (int i = 0; i < certificates.size(); i++) {
        ASN1Sequence seqCertif = ASN1Sequence.getInstance(certificates.getObjectAt(i));

        X509CertificateHolder certificateHolder = new X509CertificateHolder(seqCertif.getEncoded());
        X509Certificate certificate = new JcaX509CertificateConverter()
                .setProvider(BouncyCastleProvider.PROVIDER_NAME).getCertificate(certificateHolder);

        foundCertificates.add(certificate);
    }//from   www .j  av a2  s  .co  m
    return foundCertificates;
}

---

From source file:eu.peppol.as2.MimeMessageHelperTest.java

License:EUPL

/**
 * verify the signature (assuming the cert is contained in the message)
 *///from  w  w w.j  a va2s . c o  m
private boolean verify(String resourceName, boolean debug) {

    System.out.println("Verifying resource " + resourceName + " (debug=" + debug + ")");
    String resourcePath = "real-mdn-examples/" + resourceName;

    try {

        // add provider
        Security.addProvider(new BouncyCastleProvider());

        // shortcuts lots of steps in the above test (parseLegalMimeMessageWithHeaders)
        MimeMultipart multipartSigned = (MimeMultipart) MimeMessageHelper
                .createMimeMessage(
                        MimeMessageHelperTest.class.getClassLoader().getResourceAsStream(resourcePath))
                .getContent();
        assertNotNull(multipartSigned);

        // verify signature

        SMIMESigned signedMessage = new SMIMESigned(multipartSigned);
        Store certs = signedMessage.getCertificates();

        SignerInformationStore signers = signedMessage.getSignerInfos();

        for (Object signerInformation : signers.getSigners()) {
            SignerInformation signer = (SignerInformation) signerInformation;
            Collection certCollection = certs.getMatches(signer.getSID());

            Iterator certIterator = certCollection.iterator();

            X509Certificate cert = new JcaX509CertificateConverter().setProvider(new BouncyCastleProvider())
                    .getCertificate((X509CertificateHolder) certIterator.next());

            if (debug)
                System.out.println("Signing certificate : " + cert);

            SignerInformationVerifier signerInformationVerifier = new JcaSimpleSignerInfoVerifierBuilder()
                    .setProvider(new BouncyCastleProvider()).build(cert);
            if (signer.verify(signerInformationVerifier))
                return true;

        }

    } catch (Exception ex) {
        System.out.println("Verification failed with exception " + ex.getMessage());
    }

    return false;

}

---

From source file:eu.peppol.as2.SignedMimeMessage.java

License:EUPL

void parseSignedMessage() {
    SMIMESignedParser smimeSignedParser = null;
    try {//w w  w.  j av a2  s. co  m
        // MimeMessageHelper.dumpMimePartToFile("/tmp/parseSignedMessage.txt", mimeMessage);
        smimeSignedParser = new SMIMESignedParser(new JcaDigestCalculatorProviderBuilder().build(),
                (MimeMultipart) mimeMessage.getContent());
    } catch (MessagingException | CMSException | IOException | OperatorCreationException e) {
        throw new IllegalStateException("Unable to create SMIMESignedParser: " + e.getMessage(), e);
    }

    Store certs = null;
    try {
        certs = smimeSignedParser.getCertificates();
    } catch (CMSException e) {
        throw new IllegalStateException("Unable to retrieve the certificates from signed message.");
    }

    //
    // SignerInfo blocks which contain the signatures
    //
    SignerInformationStore signerInfos = null;
    try {
        signerInfos = smimeSignedParser.getSignerInfos();
    } catch (CMSException e) {
        throw new IllegalStateException("Unable to get the Signer information from message. " + e.getMessage(),
                e);
    }

    Collection signers = signerInfos.getSigners();
    Iterator signersIterator = signers.iterator();

    //
    // Only a single signer, get the first and only certificate
    //
    if (signersIterator.hasNext()) {

        // Retrieves information on first and only signer
        SignerInformation signer = (SignerInformation) signersIterator.next();

        // Retrieves the collection of certificates for first and only signer
        Collection certCollection = certs.getMatches(signer.getSID());

        // Retrieve the first certificate
        Iterator certIt = certCollection.iterator();
        if (certIt.hasNext()) {
            try {
                signersX509Certificate = new JcaX509CertificateConverter()
                        .setProvider(new BouncyCastleProvider())
                        .getCertificate((X509CertificateHolder) certIt.next());
            } catch (CertificateException e) {
                throw new IllegalStateException("Unable to fetch certificate for signer. " + e.getMessage(), e);
            }
        } else {
            throw new IllegalStateException(
                    "Signers certificate was not found, unable to verify the signature");
        }

        // Verify that the signature is correct and that signersIterator was generated when the certificate was current
        try {
            if (!signer.verify(new JcaSimpleSignerInfoVerifierBuilder().setProvider(new BouncyCastleProvider())
                    .build(signersX509Certificate))) {
                throw new IllegalStateException("Verification of signer failed");
            }
        } catch (CMSException e) {
            throw new IllegalStateException("Unable to verify the signer. " + e.getMessage(), e);
        } catch (OperatorCreationException e) {
            throw new IllegalStateException("Unable to verify the signer. " + e.getMessage(), e);
        }

        String issuerDN = signersX509Certificate.getIssuerDN().toString();
        log.debug("Certificate issued by: " + issuerDN);

    } else {
        throw new IllegalStateException("There is no signer information available");
    }

}

---

From source file:eu.peppol.as2.SignedMimeMessageInspector.java

License:Open Source License

void parseSignedMessage() {
    SMIMESignedParser smimeSignedParser = null;
    try {/*w  ww  .  j ava 2 s.c om*/
        // MimeMessageHelper.dumpMimePartToFile("/tmp/parseSignedMessage.txt", mimeMessage);
        smimeSignedParser = new SMIMESignedParser(new BcDigestCalculatorProvider(),
                (MimeMultipart) mimeMessage.getContent());
    } catch (MessagingException e) {
        throw new IllegalStateException("Unable to get content of message." + e.getMessage(), e);
    } catch (CMSException e) {
        throw new IllegalStateException("Unable to get content of message. " + e.getMessage(), e);
    } catch (IOException e) {
        throw new IllegalStateException("Unable to get content of message. " + e.getMessage(), e);
    }

    Store certs = null;
    try {
        certs = smimeSignedParser.getCertificates();
    } catch (CMSException e) {
        throw new IllegalStateException("Unable to retrieve the certificates from signed message.");
    }

    //
    // SignerInfo blocks which contain the signatures
    //
    SignerInformationStore signerInfos = null;
    try {
        signerInfos = smimeSignedParser.getSignerInfos();
    } catch (CMSException e) {
        throw new IllegalStateException("Unable to get the Signer information from message. " + e.getMessage(),
                e);
    }

    Collection signers = signerInfos.getSigners();
    Iterator signersIterator = signers.iterator();

    //
    // Only a single signer, get the first and only certificate
    //
    if (signersIterator.hasNext()) {

        // Retrieves information on first and only signer
        SignerInformation signer = (SignerInformation) signersIterator.next();

        // Retrieves the collection of certificates for first and only signer
        Collection certCollection = certs.getMatches(signer.getSID());

        // Retrieve the first certificate
        Iterator certIt = certCollection.iterator();
        if (certIt.hasNext()) {
            try {
                signersX509Certificate = new JcaX509CertificateConverter().setProvider(provider)
                        .getCertificate((X509CertificateHolder) certIt.next());
            } catch (CertificateException e) {
                throw new IllegalStateException("Unable to fetch certificate for signer. " + e.getMessage(), e);
            }
        } else {
            throw new IllegalStateException(
                    "Signers certificate was not found, unable to verify the signature");
        }

        // Verify that the signature is correct and that signersIterator was generated when the certificate was current
        try {
            if (!signer.verify(new JcaSimpleSignerInfoVerifierBuilder().setProvider(provider)
                    .build(signersX509Certificate))) {
                throw new IllegalStateException("Verification of signer failed");
            }
        } catch (CMSException e) {
            throw new IllegalStateException("Unable to verify the signer. " + e.getMessage(), e);
        } catch (OperatorCreationException e) {
            throw new IllegalStateException("Unable to verify the signer. " + e.getMessage(), e);
        }

        // Verify that the certificate issuer is trusted
        String issuerDN = signersX509Certificate.getIssuerDN().toString();
        log.debug("Verify the certificate issuer : " + issuerDN);
        //TODO validateCertificate(signersX509Certificate);

    } else {
        throw new IllegalStateException("There is no signer information available");
    }

}

---

From source file:eu.peppol.security.x509.CertificateTest.java

License:EUPL

/**
 * Creates a X509 V3 certificate using Bouncy Castle
 *
 * @throws NoSuchAlgorithmException//  ww  w  .  j  a  v  a 2  s.co  m
 * @throws OperatorCreationException
 * @throws CertificateException
 * @throws NoSuchProviderException
 */
@Test(enabled = false)
public void createSampleCertificate() throws NoSuchAlgorithmException, OperatorCreationException,
        CertificateException, NoSuchProviderException {
    KeyPair keyPair = generateKeyPair();

    ContentSigner sigGen = new JcaContentSignerBuilder("SHA256WithRSAEncryption")
            .setProvider(BouncyCastleProvider.PROVIDER_NAME).build(keyPair.getPrivate());

    Date startDate = new Date(System.currentTimeMillis() - 24 * 60 * 60 * 1000);
    Date endDate = new Date(System.currentTimeMillis() + 365 * 24 * 60 * 60 * 1000);

    SubjectPublicKeyInfo subjectPublicKeyInfo = SubjectPublicKeyInfo
            .getInstance(keyPair.getPublic().getEncoded());

    X509v3CertificateBuilder x509v3CertificateBuilder = new X509v3CertificateBuilder(
            new X500Name("CN=AP_UNIT_TEST"), BigInteger.ONE, startDate, endDate,
            new X500Name("CN=AP_UNIT_TEST"), subjectPublicKeyInfo);
    X509CertificateHolder x509CertificateHolder = x509v3CertificateBuilder.build(sigGen);
    X509Certificate cert = new JcaX509CertificateConverter().setProvider(BouncyCastleProvider.PROVIDER_NAME)
            .getCertificate(x509CertificateHolder);

}

---

From source file:fathom.x509.X509Utils.java

License:Apache License

/**
 * Creates a new SSL certificate signed by the CA private key and stored in
 * keyStore.//from   w w  w  .  j  av  a  2s  .  com
 *
 * @param sslMetadata
 * @param caPrivateKey
 * @param caCert
 * @param targetStoreFile
 * @param x509log
 */
public static X509Certificate newSSLCertificate(X509Metadata sslMetadata, PrivateKey caPrivateKey,
        X509Certificate caCert, File targetStoreFile, X509Log x509log) {
    try {
        KeyPair pair = newKeyPair();

        X500Name webDN = buildDistinguishedName(sslMetadata);
        X500Name issuerDN = new X500Name(PrincipalUtil.getIssuerX509Principal(caCert).getName());

        X509v3CertificateBuilder certBuilder = new JcaX509v3CertificateBuilder(issuerDN,
                BigInteger.valueOf(System.currentTimeMillis()), sslMetadata.notBefore, sslMetadata.notAfter,
                webDN, pair.getPublic());

        JcaX509ExtensionUtils extUtils = new JcaX509ExtensionUtils();
        certBuilder.addExtension(X509Extension.subjectKeyIdentifier, false,
                extUtils.createSubjectKeyIdentifier(pair.getPublic()));
        certBuilder.addExtension(X509Extension.basicConstraints, false, new BasicConstraints(false));
        certBuilder.addExtension(X509Extension.authorityKeyIdentifier, false,
                extUtils.createAuthorityKeyIdentifier(caCert.getPublicKey()));

        // support alternateSubjectNames for SSL certificates
        List<GeneralName> altNames = new ArrayList<GeneralName>();
        if (isIpAddress(sslMetadata.commonName)) {
            altNames.add(new GeneralName(GeneralName.iPAddress, sslMetadata.commonName));
        }
        if (altNames.size() > 0) {
            GeneralNames subjectAltName = new GeneralNames(altNames.toArray(new GeneralName[altNames.size()]));
            certBuilder.addExtension(X509Extension.subjectAlternativeName, false, subjectAltName);
        }

        ContentSigner caSigner = new JcaContentSignerBuilder(SIGNING_ALGORITHM).setProvider(BC)
                .build(caPrivateKey);
        X509Certificate cert = new JcaX509CertificateConverter().setProvider(BC)
                .getCertificate(certBuilder.build(caSigner));

        cert.checkValidity(new Date());
        cert.verify(caCert.getPublicKey());

        // Save to keystore
        KeyStore serverStore = openKeyStore(targetStoreFile, sslMetadata.password);
        serverStore.setKeyEntry(sslMetadata.commonName, pair.getPrivate(), sslMetadata.password.toCharArray(),
                new Certificate[] { cert, caCert });
        saveKeyStore(targetStoreFile, serverStore, sslMetadata.password);

        x509log.log(MessageFormat.format("New SSL certificate {0,number,0} [{1}]", cert.getSerialNumber(),
                cert.getSubjectDN().getName()));

        // update serial number in metadata object
        sslMetadata.serialNumber = cert.getSerialNumber().toString();

        return cert;
    } catch (Throwable t) {
        throw new RuntimeException("Failed to generate SSL certificate!", t);
    }
}

---

• «
• 1
• 2
• 3
• 4
• 5
• 6
• 7
• 8
• 9
• 10
• 11
• 12
• 13
• 14
• 15
• 16
• 17
• 18
• 19
• 20
• 21
• 22
• 23
• 24
• 25
• 26
• 27
• 28
• 29
• 30
• 31
• 32
• 33
• 34
• 35
• »