Example usage for org.bouncycastle.cert.jcajce JcaX509CertificateConverter JcaX509CertificateConverter

Introduction

In this page you can find the example usage for org.bouncycastle.cert.jcajce JcaX509CertificateConverter JcaX509CertificateConverter.

Prototype

public JcaX509CertificateConverter() 

Source Link

Document

Base constructor, configure with the default provider.

Usage

From source file:net.sf.sahi.ssl.SSLHelper.java

License:Apache License

private X509Certificate createX509Certificate(X509v3CertificateBuilder certificateBuilder,
        PrivateKey privateRootKey) throws OperatorCreationException, CertificateException {
    ContentSigner signer = new JcaContentSignerBuilder("SHA256WithRSAEncryption")
            .setProvider(bouncyCastleProvider).build(privateRootKey);
    return new JcaX509CertificateConverter().setProvider(bouncyCastleProvider)
            .getCertificate(certificateBuilder.build(signer));
}

---

From source file:net.solarnetwork.node.setup.test.PKITestUtils.java

License:Open Source License

public static X509Certificate generateNewCACert(PublicKey publicKey, String subject, X509Certificate issuer,
        PrivateKey issuerKey, String caDN) throws Exception {
    final X500Name issuerDn = (issuer == null ? new X500Name(subject) : JcaX500NameUtil.getSubject(issuer));
    final X500Name subjectDn = new X500Name(subject);
    final BigInteger serial = getNextSerialNumber();
    final Date notBefore = new Date();
    final Date notAfter = new Date(System.currentTimeMillis() + 1000L * 60L * 60L);
    JcaX509v3CertificateBuilder builder = new JcaX509v3CertificateBuilder(issuerDn, serial, notBefore, notAfter,
            subjectDn, publicKey);// w ww. j  ava  2s . c  om

    // add "CA" extension
    BasicConstraints basicConstraints;
    if (issuer == null) {
        basicConstraints = new BasicConstraints(true);
    } else {
        int issuerPathLength = issuer.getBasicConstraints();
        basicConstraints = new BasicConstraints(issuerPathLength - 1);
    }
    builder.addExtension(X509Extension.basicConstraints, true, basicConstraints);

    // add subjectKeyIdentifier
    JcaX509ExtensionUtils utils = new JcaX509ExtensionUtils();
    SubjectKeyIdentifier ski = utils.createSubjectKeyIdentifier(publicKey);
    builder.addExtension(X509Extension.subjectKeyIdentifier, false, ski);

    // add authorityKeyIdentifier
    GeneralNames issuerName = new GeneralNames(new GeneralName(GeneralName.directoryName, caDN));
    AuthorityKeyIdentifier aki = utils.createAuthorityKeyIdentifier(publicKey);
    aki = new AuthorityKeyIdentifier(aki.getKeyIdentifier(), issuerName, serial);
    builder.addExtension(X509Extension.authorityKeyIdentifier, false, aki);

    // add keyUsage
    X509KeyUsage keyUsage = new X509KeyUsage(X509KeyUsage.cRLSign | X509KeyUsage.digitalSignature
            | X509KeyUsage.keyCertSign | X509KeyUsage.nonRepudiation);
    builder.addExtension(X509Extension.keyUsage, true, keyUsage);

    JcaContentSignerBuilder signerBuilder = new JcaContentSignerBuilder("SHA256WithRSA");
    ContentSigner signer = signerBuilder.build(issuerKey);

    X509CertificateHolder holder = builder.build(signer);
    JcaX509CertificateConverter converter = new JcaX509CertificateConverter();
    return converter.getCertificate(holder);
}

---

From source file:net.solarnetwork.node.setup.test.PKITestUtils.java

License:Open Source License

public static X509Certificate sign(PKCS10CertificationRequest csr, X509Certificate issuer,
        PrivateKey issuerPrivateKey)
        throws InvalidKeyException, NoSuchAlgorithmException, NoSuchProviderException, SignatureException,
        IOException, OperatorCreationException, CertificateException, java.security.cert.CertificateException {

    final BigInteger serial = getNextSerialNumber();
    final Date notBefore = new Date();
    final Date notAfter = new Date(System.currentTimeMillis() + 24L * 60L * 60L * 1000L);

    X500Name issuerName = JcaX500NameUtil.getSubject(issuer);
    X509v3CertificateBuilder myCertificateGenerator = new X509v3CertificateBuilder(issuerName, serial,
            notBefore, notAfter, csr.getSubject(), csr.getSubjectPublicKeyInfo());

    JcaContentSignerBuilder signerBuilder = new JcaContentSignerBuilder("SHA256WithRSA");
    ContentSigner signer = signerBuilder.build(issuerPrivateKey);
    X509CertificateHolder holder = myCertificateGenerator.build(signer);

    JcaX509CertificateConverter converter = new JcaX509CertificateConverter();
    return converter.getCertificate(holder);
}

---

From source file:net.solarnetwork.pki.bc.BCCertificateService.java

License:Open Source License

@Override
public X509Certificate generateCertificate(String dn, PublicKey publicKey, PrivateKey privateKey) {
    X500Principal issuer = new X500Principal(dn);
    Date now = new Date();
    Date expire = new Date(now.getTime() + (1000L * 60L * 60L * 24L * certificateExpireDays));
    JcaX509v3CertificateBuilder builder = new JcaX509v3CertificateBuilder(issuer,
            new BigInteger(String.valueOf(counter.incrementAndGet())), now, expire, issuer, publicKey);
    JcaContentSignerBuilder signerBuilder = new JcaContentSignerBuilder(signatureAlgorithm);
    ContentSigner signer;/*from w  w w.  ja v  a  2  s .  c o m*/
    try {
        signer = signerBuilder.build(privateKey);
    } catch (OperatorCreationException e) {
        throw new CertificateException("Error signing certificate", e);
    }
    X509CertificateHolder holder = builder.build(signer);
    JcaX509CertificateConverter converter = new JcaX509CertificateConverter();
    try {
        return converter.getCertificate(holder);
    } catch (java.security.cert.CertificateException e) {
        throw new CertificateException("Error creating certificate", e);
    }
}

---

From source file:net.solarnetwork.pki.bc.BCCertificateService.java

License:Open Source License

@Override
public X509Certificate generateCertificationAuthorityCertificate(String dn, PublicKey publicKey,
        PrivateKey privateKey) {// ww  w  .j  a  va 2  s  .c o  m
    X500Principal issuer = new X500Principal(dn);
    Date now = new Date();
    Date expire = new Date(now.getTime() + (1000L * 60L * 60L * 24L * authorityExpireDays));
    JcaX509v3CertificateBuilder builder = new JcaX509v3CertificateBuilder(issuer, new BigInteger("0"), now,
            expire, issuer, publicKey);
    JcaContentSignerBuilder signerBuilder = new JcaContentSignerBuilder(signatureAlgorithm);
    DefaultDigestAlgorithmIdentifierFinder digestAlgFinder = new DefaultDigestAlgorithmIdentifierFinder();
    ContentSigner signer;
    try {
        DigestCalculatorProvider digestCalcProvider = new JcaDigestCalculatorProviderBuilder()
                .setProvider(new BouncyCastleProvider()).build();
        JcaX509ExtensionUtils extUtils = new JcaX509ExtensionUtils(
                digestCalcProvider.get(digestAlgFinder.find("SHA-256")));
        builder.addExtension(X509Extension.basicConstraints, true, new BasicConstraints(true));
        builder.addExtension(X509Extension.subjectKeyIdentifier, false,
                extUtils.createSubjectKeyIdentifier(publicKey));
        builder.addExtension(X509Extension.keyUsage, true, new KeyUsage(
                KeyUsage.digitalSignature | KeyUsage.nonRepudiation | KeyUsage.keyCertSign | KeyUsage.cRLSign));
        builder.addExtension(X509Extension.authorityKeyIdentifier, false,
                extUtils.createAuthorityKeyIdentifier(publicKey));

        signer = signerBuilder.build(privateKey);
    } catch (OperatorCreationException e) {
        log.error("Error generating CA certificate [{}]", dn, e);
        throw new CertificateException("Error signing CA certificate", e);
    } catch (CertIOException e) {
        log.error("Error generating CA certificate [{}]", dn, e);
        throw new CertificateException("Error signing CA certificate", e);
    }
    X509CertificateHolder holder = builder.build(signer);
    JcaX509CertificateConverter converter = new JcaX509CertificateConverter();
    try {
        return converter.getCertificate(holder);
    } catch (java.security.cert.CertificateException e) {
        throw new CertificateException("Error creating certificate", e);
    }
}

---

From source file:net.solarnetwork.pki.bc.BCCertificateService.java

License:Open Source License

@Override
public X509Certificate signCertificate(String csrPEM, X509Certificate caCert, PrivateKey privateKey)
        throws CertificateException {
    if (!csrPEM.matches("(?is)^\\s*-----BEGIN.*")) {
        // let's throw in the guards
        csrPEM = "-----BEGIN CERTIFICATE REQUEST-----\n" + csrPEM + "\n-----END CERTIFICATE REQUEST-----\n";
    }/*from w  w w . j a  v  a  2 s.  c  om*/
    PemReader reader = null;
    try {
        reader = new PemReader(new StringReader(csrPEM));
        PemObject pemObj = reader.readPemObject();
        log.debug("Parsed PEM type {}", pemObj.getType());
        PKCS10CertificationRequest csr = new PKCS10CertificationRequest(pemObj.getContent());

        Date now = new Date();
        Date expire = new Date(now.getTime() + (1000L * 60L * 60L * 24L * certificateExpireDays));
        X509v3CertificateBuilder builder = new X509v3CertificateBuilder(JcaX500NameUtil.getIssuer(caCert),
                new BigInteger(String.valueOf(counter.incrementAndGet())), now, expire, csr.getSubject(),
                csr.getSubjectPublicKeyInfo());

        JcaContentSignerBuilder signerBuilder = new JcaContentSignerBuilder(signatureAlgorithm);
        ContentSigner signer;
        DefaultDigestAlgorithmIdentifierFinder digestAlgFinder = new DefaultDigestAlgorithmIdentifierFinder();
        try {
            DigestCalculatorProvider digestCalcProvider = new JcaDigestCalculatorProviderBuilder()
                    .setProvider(new BouncyCastleProvider()).build();
            JcaX509ExtensionUtils extUtils = new JcaX509ExtensionUtils(
                    digestCalcProvider.get(digestAlgFinder.find("SHA-256")));
            builder.addExtension(X509Extension.basicConstraints, false, new BasicConstraints(false));
            builder.addExtension(X509Extension.subjectKeyIdentifier, false,
                    extUtils.createSubjectKeyIdentifier(csr.getSubjectPublicKeyInfo()));
            builder.addExtension(X509Extension.authorityKeyIdentifier, false,
                    extUtils.createAuthorityKeyIdentifier(caCert));

            signer = signerBuilder.build(privateKey);
        } catch (OperatorException e) {
            log.error("Error signing CSR {}", csr.getSubject(), e);
            throw new CertificateException("Error signing CSR" + csr.getSubject() + ": " + e.getMessage());
        } catch (CertificateEncodingException e) {
            log.error("Error signing CSR {}", csr.getSubject().toString(), e);
            throw new CertificateException("Error signing CSR" + csr.getSubject() + ": " + e.getMessage());
        }

        X509CertificateHolder holder = builder.build(signer);
        JcaX509CertificateConverter converter = new JcaX509CertificateConverter();
        try {
            return converter.getCertificate(holder);
        } catch (java.security.cert.CertificateException e) {
            throw new CertificateException("Error creating certificate", e);
        }
    } catch (IOException e) {
        throw new CertificateException("Error signing CSR", e);
    } finally {
        if (reader != null) {
            try {
                reader.close();
            } catch (IOException e2) {
                log.warn("IOException closing PemReader", e2);
            }
        }
    }
}

---

From source file:net.weta.components.communication.security.JavaKeystoreTest.java

License:EUPL

/**
 * @param keystore/*  ww  w  .  j av a 2s.  c om*/
 * @param alias
 * @throws Exception
 */
public static void generateKeyInKeyStore(File keystore, String alias) throws Exception {
    KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
    char[] password = "password".toCharArray();
    if (keystore.exists()) {
        ks.load(new FileInputStream(keystore), password);
    } else {
        ks.load(null, password);
    }

    KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
    SecureRandom random = SecureRandom.getInstance("SHA1PRNG", "SUN");
    keyGen.initialize(1024, random);
    KeyPair pair = keyGen.generateKeyPair();

    // Generate self-signed certificate
    X500NameBuilder builder = new X500NameBuilder(BCStyle.INSTANCE);
    builder.addRDN(BCStyle.OU, "OU");
    builder.addRDN(BCStyle.O, "O");
    builder.addRDN(BCStyle.CN, "cn");

    Date notBefore = new Date(System.currentTimeMillis() - 360000 * 24);
    Date notAfter = new Date(System.currentTimeMillis() + 10 * 360000 * 365);
    BigInteger serial = BigInteger.valueOf(System.currentTimeMillis());

    X509v3CertificateBuilder certGen = new JcaX509v3CertificateBuilder(builder.build(), serial, notBefore,
            notAfter, builder.build(), pair.getPublic());
    ContentSigner sigGen = new JcaContentSignerBuilder("SHA256WithRSAEncryption").setProvider(BC)
            .build(pair.getPrivate());
    X509Certificate cert = new JcaX509CertificateConverter().setProvider(BC)
            .getCertificate(certGen.build(sigGen));

    PrivateKeyEntry entry = new PrivateKeyEntry(pair.getPrivate(),
            new java.security.cert.Certificate[] { cert });
    ks.setEntry(alias, entry, new KeyStore.PasswordProtection("password".toCharArray()));

    // Store away the keystore.
    FileOutputStream fos = new FileOutputStream(keystore.getAbsolutePath());
    ks.store(fos, password);
    fos.close();
}

---

From source file:no.difi.oxalis.as2.util.MimeMessageHelperTest.java

License:EUPL

/**
 * verify the signature (assuming the cert is contained in the message)
 *//*from ww w  . j  a  v  a  2  s.c  o m*/
private boolean verify(String resourceName, boolean debug) {

    System.out.println("Verifying resource " + resourceName + " (debug=" + debug + ")");
    String resourcePath = "real-mdn-examples/" + resourceName;

    try {
        // shortcuts lots of steps in the above test (parseLegalMimeMessageWithHeaders)
        MimeMultipart multipartSigned = (MimeMultipart) MimeMessageHelper
                .createMimeMessage(
                        MimeMessageHelperTest.class.getClassLoader().getResourceAsStream(resourcePath))
                .getContent();
        assertNotNull(multipartSigned);

        // verify signature

        SMIMESigned signedMessage = new SMIMESigned(multipartSigned);
        Store certs = signedMessage.getCertificates();

        SignerInformationStore signers = signedMessage.getSignerInfos();

        for (Object signerInformation : signers.getSigners()) {
            SignerInformation signer = (SignerInformation) signerInformation;
            Collection certCollection = certs.getMatches(signer.getSID());

            Iterator certIterator = certCollection.iterator();

            X509Certificate cert = new JcaX509CertificateConverter()
                    .setProvider(BouncyCastleProvider.PROVIDER_NAME)
                    .getCertificate((X509CertificateHolder) certIterator.next());

            if (debug)
                System.out.println("Signing certificate : " + cert);

            SignerInformationVerifier signerInformationVerifier = new JcaSimpleSignerInfoVerifierBuilder()
                    .setProvider(BouncyCastleProvider.PROVIDER_NAME).build(cert);
            if (signer.verify(signerInformationVerifier))
                return true;

        }

    } catch (Exception ex) {
        System.out.println("Verification failed with exception " + ex.getMessage());
    }

    return false;

}

---

From source file:no.difi.oxalis.as2.util.SignedMimeMessage.java

License:EUPL

void parseSignedMessage() {
    SMIMESignedParser smimeSignedParser;
    try {/*from w  w  w  .j  a v  a  2s .c om*/
        // MimeMessageHelper.dumpMimePartToFile("/tmp/parseSignedMessage.txt", mimeMessage);
        smimeSignedParser = new SMIMESignedParser(new JcaDigestCalculatorProviderBuilder().build(),
                (MimeMultipart) mimeMessage.getContent());
    } catch (MessagingException | CMSException | IOException | OperatorCreationException e) {
        throw new IllegalStateException("Unable to create SMIMESignedParser: " + e.getMessage(), e);
    }

    Store certs;
    try {
        certs = smimeSignedParser.getCertificates();
    } catch (CMSException e) {
        throw new IllegalStateException("Unable to retrieve the certificates from signed message.");
    }

    //
    // SignerInfo blocks which contain the signatures
    //
    SignerInformationStore signerInfos;
    try {
        signerInfos = smimeSignedParser.getSignerInfos();
    } catch (CMSException e) {
        throw new IllegalStateException("Unable to get the Signer information from message. " + e.getMessage(),
                e);
    }

    Collection signers = signerInfos.getSigners();
    Iterator signersIterator = signers.iterator();

    //
    // Only a single signer, get the first and only certificate
    //
    if (signersIterator.hasNext()) {

        // Retrieves information on first and only signer
        SignerInformation signer = (SignerInformation) signersIterator.next();

        // Retrieves the collection of certificates for first and only signer
        @SuppressWarnings("unchecked")
        Collection certCollection = certs.getMatches(signer.getSID());

        // Retrieve the first certificate
        Iterator certIt = certCollection.iterator();
        if (certIt.hasNext()) {
            try {
                signersX509Certificate = new JcaX509CertificateConverter()
                        .setProvider(BouncyCastleProvider.PROVIDER_NAME)
                        .getCertificate((X509CertificateHolder) certIt.next());
            } catch (CertificateException e) {
                throw new IllegalStateException("Unable to fetch certificate for signer. " + e.getMessage(), e);
            }
        } else {
            throw new IllegalStateException(
                    "Signers certificate was not found, unable to verify the signature");
        }

        // Verify that the signature is correct and that signersIterator was generated when the certificate was current
        /*
        try {
        if (!signer.verify(new JcaSimpleSignerInfoVerifierBuilder().setProvider(BouncyCastleProvider.PROVIDER_NAME).build(signersX509Certificate))) {
            throw new IllegalStateException("Verification of signer failed");
        }
        } catch (CMSException | OperatorCreationException e) {
        throw new IllegalStateException("Unable to verify the signer. " + e.getMessage(), e);
        }
        */

        String issuerDN = signersX509Certificate.getIssuerDN().toString();
        log.debug("Certificate issued by: " + issuerDN);

    } else {
        throw new IllegalStateException("There is no signer information available");
    }

}

---

From source file:org.apache.ace.authentication.processor.clientcert.MemoryKeyStore.java

License:Apache License

/**
 * @throws IllegalStateException/*  w  w  w  . j a  va 2 s.co m*/
 *             if an internal exception occurs.
 * @throws IllegalArgumentException
 *             if the alias already exists.
 */
public X509Certificate createCertificate(X500Principal issuerDN, PrivateKey issuerKey, String name,
        Date notBefore, Date notAfter, PublicKey key) throws IllegalArgumentException {
    try {
        X500Name issuer = new X500Name(issuerDN.getName());
        X500Name commonName = new X500Name(name);
        BigInteger serial = BigInteger.valueOf(++m_serial);

        SubjectPublicKeyInfo pubKeyInfo = convertToSubjectPublicKeyInfo(key);

        X509v3CertificateBuilder builder = new X509v3CertificateBuilder(issuer, serial, notBefore, notAfter,
                commonName, pubKeyInfo);

        X509CertificateHolder certHolder = builder
                .build(new JcaContentSignerBuilder(SIGNATURE_ALGORITHM).build(issuerKey));
        return new JcaX509CertificateConverter().getCertificate(certHolder);
    } catch (IllegalArgumentException e) {
        throw e;
    } catch (Exception e) {
        throw new RuntimeException(e);
    }
}

---

• «
• 1
• 2
• 3
• 4
• 5
• 6
• 7
• 8
• 9
• 10
• 11
• 12
• 13
• 14
• 15
• 16
• 17
• 18
• 19
• 20
• 21
• 22
• 23
• 24
• 25
• 26
• 27
• 28
• 29
• 30
• 31
• 32
• 33
• 34
• 35
• »