Example usage for org.bouncycastle.cert.jcajce JcaX509CertificateConverter JcaX509CertificateConverter

Introduction

In this page you can find the example usage for org.bouncycastle.cert.jcajce JcaX509CertificateConverter JcaX509CertificateConverter.

Prototype

public JcaX509CertificateConverter() 

Source Link

Document

Base constructor, configure with the default provider.

Usage

From source file:com.gitblit.utils.X509Utils.java

License:Apache License

/**
 * Creates a new certificate authority PKCS#12 store.  This function will
 * destroy any existing CA store.// w  w  w  .j  ava  2s  . c  o m
 *
 * @param metadata
 * @param storeFile
 * @param keystorePassword
 * @param x509log
 * @return
 */
public static X509Certificate newCertificateAuthority(X509Metadata metadata, File storeFile, X509Log x509log) {
    try {
        KeyPair caPair = newKeyPair();

        ContentSigner caSigner = new JcaContentSignerBuilder(SIGNING_ALGORITHM).setProvider(BC)
                .build(caPair.getPrivate());

        // clone metadata
        X509Metadata caMetadata = metadata.clone(CA_CN, metadata.password);
        X500Name issuerDN = buildDistinguishedName(caMetadata);

        // Generate self-signed certificate
        X509v3CertificateBuilder caBuilder = new JcaX509v3CertificateBuilder(issuerDN,
                BigInteger.valueOf(System.currentTimeMillis()), caMetadata.notBefore, caMetadata.notAfter,
                issuerDN, caPair.getPublic());

        JcaX509ExtensionUtils extUtils = new JcaX509ExtensionUtils();
        caBuilder.addExtension(X509Extension.subjectKeyIdentifier, false,
                extUtils.createSubjectKeyIdentifier(caPair.getPublic()));
        caBuilder.addExtension(X509Extension.authorityKeyIdentifier, false,
                extUtils.createAuthorityKeyIdentifier(caPair.getPublic()));
        caBuilder.addExtension(X509Extension.basicConstraints, false, new BasicConstraints(true));
        caBuilder.addExtension(X509Extension.keyUsage, true,
                new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyCertSign | KeyUsage.cRLSign));

        JcaX509CertificateConverter converter = new JcaX509CertificateConverter().setProvider(BC);
        X509Certificate cert = converter.getCertificate(caBuilder.build(caSigner));

        // confirm the validity of the CA certificate
        cert.checkValidity(new Date());
        cert.verify(cert.getPublicKey());

        // Delete existing keystore
        if (storeFile.exists()) {
            storeFile.delete();
        }

        // Save private key and certificate to new keystore
        KeyStore store = openKeyStore(storeFile, caMetadata.password);
        store.setKeyEntry(CA_ALIAS, caPair.getPrivate(), caMetadata.password.toCharArray(),
                new Certificate[] { cert });
        saveKeyStore(storeFile, store, caMetadata.password);

        x509log.log(MessageFormat.format("New CA certificate {0,number,0} [{1}]", cert.getSerialNumber(),
                cert.getIssuerDN().getName()));

        // update serial number in metadata object
        caMetadata.serialNumber = cert.getSerialNumber().toString();

        return cert;
    } catch (Throwable t) {
        throw new RuntimeException("Failed to generate Gitblit CA certificate!", t);
    }
}

---

From source file:com.gitblit.utils.X509Utils.java

License:Apache License

/**
 * Creates a new client certificate PKCS#12 and PEM store.  Any existing
 * stores are destroyed.//from  w  ww  .j  a  va2s .c  o m
 *
 * @param clientMetadata a container for dynamic parameters needed for generation
 * @param caKeystoreFile
 * @param caKeystorePassword
 * @param targetFolder
 * @return
 */
public static X509Certificate newClientCertificate(X509Metadata clientMetadata, PrivateKey caPrivateKey,
        X509Certificate caCert, File targetFolder) {
    try {
        KeyPair pair = newKeyPair();

        X500Name userDN = buildDistinguishedName(clientMetadata);
        X500Name issuerDN = new X500Name(PrincipalUtil.getIssuerX509Principal(caCert).getName());

        // create a new certificate signed by the Gitblit CA certificate
        X509v3CertificateBuilder certBuilder = new JcaX509v3CertificateBuilder(issuerDN,
                BigInteger.valueOf(System.currentTimeMillis()), clientMetadata.notBefore,
                clientMetadata.notAfter, userDN, pair.getPublic());

        JcaX509ExtensionUtils extUtils = new JcaX509ExtensionUtils();
        certBuilder.addExtension(X509Extension.subjectKeyIdentifier, false,
                extUtils.createSubjectKeyIdentifier(pair.getPublic()));
        certBuilder.addExtension(X509Extension.basicConstraints, false, new BasicConstraints(false));
        certBuilder.addExtension(X509Extension.authorityKeyIdentifier, false,
                extUtils.createAuthorityKeyIdentifier(caCert.getPublicKey()));
        certBuilder.addExtension(X509Extension.keyUsage, true,
                new KeyUsage(KeyUsage.keyEncipherment | KeyUsage.digitalSignature));
        if (!StringUtils.isEmpty(clientMetadata.emailAddress)) {
            GeneralNames subjectAltName = new GeneralNames(
                    new GeneralName(GeneralName.rfc822Name, clientMetadata.emailAddress));
            certBuilder.addExtension(X509Extension.subjectAlternativeName, false, subjectAltName);
        }

        ContentSigner signer = new JcaContentSignerBuilder(SIGNING_ALGORITHM).setProvider(BC)
                .build(caPrivateKey);

        X509Certificate userCert = new JcaX509CertificateConverter().setProvider(BC)
                .getCertificate(certBuilder.build(signer));
        PKCS12BagAttributeCarrier bagAttr = (PKCS12BagAttributeCarrier) pair.getPrivate();
        bagAttr.setBagAttribute(PKCSObjectIdentifiers.pkcs_9_at_localKeyId,
                extUtils.createSubjectKeyIdentifier(pair.getPublic()));

        // confirm the validity of the user certificate
        userCert.checkValidity();
        userCert.verify(caCert.getPublicKey());
        userCert.getIssuerDN().equals(caCert.getSubjectDN());

        // verify user certificate chain
        verifyChain(userCert, caCert);

        targetFolder.mkdirs();

        // save certificate, stamped with unique name
        String date = new SimpleDateFormat("yyyyMMdd").format(new Date());
        String id = date;
        File certFile = new File(targetFolder, id + ".cer");
        int count = 0;
        while (certFile.exists()) {
            id = date + "_" + Character.toString((char) (0x61 + count));
            certFile = new File(targetFolder, id + ".cer");
            count++;
        }

        // save user private key, user certificate and CA certificate to a PKCS#12 store
        File p12File = new File(targetFolder, clientMetadata.commonName + ".p12");
        if (p12File.exists()) {
            p12File.delete();
        }
        KeyStore userStore = openKeyStore(p12File, clientMetadata.password);
        userStore.setKeyEntry(
                MessageFormat.format("Gitblit ({0}) {1} {2}", clientMetadata.serverHostname,
                        clientMetadata.userDisplayname, id),
                pair.getPrivate(), null, new Certificate[] { userCert });
        userStore.setCertificateEntry(
                MessageFormat.format("Gitblit ({0}) Certificate Authority", clientMetadata.serverHostname),
                caCert);
        saveKeyStore(p12File, userStore, clientMetadata.password);

        // save user private key, user certificate, and CA certificate to a PEM store
        File pemFile = new File(targetFolder, clientMetadata.commonName + ".pem");
        if (pemFile.exists()) {
            pemFile.delete();
        }
        JcePEMEncryptorBuilder builder = new JcePEMEncryptorBuilder("DES-EDE3-CBC");
        builder.setSecureRandom(new SecureRandom());
        PEMEncryptor pemEncryptor = builder.build(clientMetadata.password.toCharArray());
        JcaPEMWriter pemWriter = new JcaPEMWriter(new FileWriter(pemFile));
        pemWriter.writeObject(pair.getPrivate(), pemEncryptor);
        pemWriter.writeObject(userCert);
        pemWriter.writeObject(caCert);
        pemWriter.flush();
        pemWriter.close();

        // save certificate after successfully creating the key stores
        saveCertificate(userCert, certFile);

        // update serial number in metadata object
        clientMetadata.serialNumber = userCert.getSerialNumber().toString();

        return userCert;
    } catch (Throwable t) {
        throw new RuntimeException("Failed to generate client certificate!", t);
    }
}

---

From source file:com.github.ambry.commons.TestSSLUtils.java

License:Open Source License

/**
 * Create a self-signed X.509 Certificate.
 * From http://bfo.com/blog/2011/03/08/odds_and_ends_creating_a_new_x_509_certificate.html.
 *
 * @param dn the X.509 Distinguished Name, eg "CN(commonName)=Test, O(organizationName)=Org"
 * @param pair the KeyPair/*from   www . j a va2s.  c  om*/
 * @param days how many days from now the Certificate is valid for
 * @param algorithm the signing algorithm, eg "SHA1withRSA"
 * @return the self-signed certificate
 * @throws java.security.cert.CertificateException thrown if a security error or an IO error ocurred.
 */
public static X509Certificate generateCertificate(String dn, KeyPair pair, int days, String algorithm)
        throws CertificateException {
    try {
        Security.addProvider(new BouncyCastleProvider());
        AlgorithmIdentifier sigAlgId = new DefaultSignatureAlgorithmIdentifierFinder().find(algorithm);
        AlgorithmIdentifier digAlgId = new DefaultDigestAlgorithmIdentifierFinder().find(sigAlgId);
        AsymmetricKeyParameter privateKeyAsymKeyParam = PrivateKeyFactory
                .createKey(pair.getPrivate().getEncoded());
        SubjectPublicKeyInfo subPubKeyInfo = SubjectPublicKeyInfo.getInstance(pair.getPublic().getEncoded());
        ContentSigner sigGen = new BcRSAContentSignerBuilder(sigAlgId, digAlgId).build(privateKeyAsymKeyParam);
        X500Name name = new X500Name(dn);
        Date from = new Date();
        Date to = new Date(from.getTime() + days * 86400000L);
        BigInteger sn = new BigInteger(64, new SecureRandom());

        X509v1CertificateBuilder v1CertGen = new X509v1CertificateBuilder(name, sn, from, to, name,
                subPubKeyInfo);
        X509CertificateHolder certificateHolder = v1CertGen.build(sigGen);
        return new JcaX509CertificateConverter().setProvider("BC").getCertificate(certificateHolder);
    } catch (CertificateException ce) {
        throw ce;
    } catch (Exception e) {
        throw new CertificateException(e);
    }
}

---

From source file:com.github.jjYBdx4IL.utils.net.PEMParserTest.java

License:Apache License

/**
 * Test of stripComments method, of class PEMParser.
 * /*from  w  w w  .  j a v a2  s.  com*/
 * @throws java.lang.Exception on error
 */
@Test
public void testStripCommentsServerCert() throws Exception {
    try (PEMParser pemReader = new PEMParser(
            new InputStreamReader(PEMParserTest.class.getResourceAsStream("ibm.com.cert.pem")))) {
        X509CertificateHolder certHolder = (X509CertificateHolder) pemReader.readObject();

        X509Certificate cert = new JcaX509CertificateConverter().setProvider("BC").getCertificate(certHolder);

        try {
            cert.checkValidity(new SimpleDateFormat(DATE_FORMAT).parse("2014-02-17"));
            fail();
        } catch (ParseException | CertificateExpiredException | CertificateNotYetValidException ex) {
        }

        cert.checkValidity(new SimpleDateFormat(DATE_FORMAT).parse("2017-07-19"));

        try {
            cert.checkValidity(new SimpleDateFormat(DATE_FORMAT).parse("2016-02-17"));
            fail();
        } catch (ParseException | CertificateExpiredException | CertificateNotYetValidException ex) {
        }

        assertEquals("Fri Jan 26 23:59:59 UTC 2018", cert.getNotAfter().toString());

        assertEquals("C=US,O=GeoTrust Inc.,CN=GeoTrust SSL CA - G3", cert.getIssuerDN().getName());

        assertEquals("C=US,ST=New York,L=Armonk,O=IBM,CN=www.ibm.com", cert.getSubjectDN().getName());

        assertEquals("www.ibm.com", SSLUtils.getSubjectPart(cert, PrincipalParts.CN.toString()));
        assertEquals("GeoTrust SSL CA - G3", SSLUtils.getIssuerPart(cert, PrincipalParts.CN.toString()));
    }
}

---

From source file:com.github.jjYBdx4IL.utils.net.PEMParserTest.java

License:Apache License

@Test
public void testStripCommentsCACert() throws Exception {
    try (PEMParser pemReader = new PEMParser(
            new InputStreamReader(PEMParserTest.class.getResourceAsStream("ca.cert.pem")))) {
        X509CertificateHolder certHolder = (X509CertificateHolder) pemReader.readObject();

        X509Certificate cert = new JcaX509CertificateConverter().setProvider("BC").getCertificate(certHolder);

        try {//w w w. ja  v  a  2  s  .  c  o  m
            cert.checkValidity(new SimpleDateFormat(DATE_FORMAT).parse("2030-06-17"));
            fail();
        } catch (ParseException | CertificateExpiredException | CertificateNotYetValidException ex) {
        }

        cert.checkValidity(new SimpleDateFormat(DATE_FORMAT).parse("2017-07-19"));

        try {
            cert.checkValidity(new SimpleDateFormat(DATE_FORMAT).parse("2011-02-17"));
            fail();
        } catch (ParseException | CertificateExpiredException | CertificateNotYetValidException ex) {
        }

        assertEquals("Fri May 20 21:36:50 UTC 2022", cert.getNotAfter().toString());

        assertEquals("C=US,O=GeoTrust Inc.,CN=GeoTrust Global CA", cert.getIssuerDN().getName());

        assertEquals("C=US,O=GeoTrust Inc.,CN=GeoTrust SSL CA - G3", cert.getSubjectDN().getName());

        assertEquals("GeoTrust SSL CA - G3", SSLUtils.getSubjectPart(cert, PrincipalParts.CN.toString()));
        assertEquals("GeoTrust Global CA", SSLUtils.getIssuerPart(cert, PrincipalParts.CN.toString()));
    }
}

---

From source file:com.github.spyhunter99.simplejks.CertGenBouncy.java

public static java.security.cert.Certificate selfSign(KeyPair keyPair, String subjectDN)
        throws OperatorCreationException, CertificateException, IOException {
    Provider bcProvider = new BouncyCastleProvider();
    Security.addProvider(bcProvider);

    long now = System.currentTimeMillis();
    Date startDate = new Date(now);

    X500Name dnName = new X500Name(subjectDN);
    BigInteger certSerialNumber = new BigInteger(Long.toString(now)); // <-- Using the current timestamp as the certificate serial number

    Calendar calendar = Calendar.getInstance();
    calendar.setTime(startDate);/* w  w  w . j ava 2  s.  c  om*/
    calendar.add(Calendar.YEAR, 30); // <-- 1 Yr validity

    Date endDate = calendar.getTime();

    String signatureAlgorithm = "SHA256WithRSA"; // <-- Use appropriate signature algorithm based on your keyPair algorithm.

    ContentSigner contentSigner = new JcaContentSignerBuilder(signatureAlgorithm).build(keyPair.getPrivate());

    JcaX509v3CertificateBuilder certBuilder = new JcaX509v3CertificateBuilder(dnName, certSerialNumber,
            startDate, endDate, dnName, keyPair.getPublic());

    // Extensions --------------------------
    // Basic Constraints
    BasicConstraints basicConstraints = new BasicConstraints(true); // <-- true for CA, false for EndEntity

    certBuilder.addExtension(new ASN1ObjectIdentifier("2.5.29.19"), true, basicConstraints); // Basic Constraints is usually marked as critical.

    ASN1Encodable[] subjectAlternativeNames = new ASN1Encodable[] {
            new GeneralName(GeneralName.dNSName, "server"),
            new GeneralName(GeneralName.dNSName, "server.mydomain.com") };
    DERSequence subjectAlternativeNamesExtension = new DERSequence(subjectAlternativeNames);
    certBuilder.addExtension(X509Extension.subjectAlternativeName, false, subjectAlternativeNamesExtension);

    // -------------------------------------
    return new JcaX509CertificateConverter().setProvider(bcProvider)
            .getCertificate(certBuilder.build(contentSigner));
}

---

From source file:com.google.api.auth.TestUtils.java

License:Open Source License

/**
 * Generate a PEM-encoded X509 using the given {@link RsaJsonWebKey}.
 */// www .  j a va  2 s.co  m
public static String generateX509Cert(RsaJsonWebKey rsaJsonWebKey) {
    try {
        Provider provider = new BouncyCastleProvider();
        String providerName = provider.getName();
        Security.addProvider(provider);

        long currentTimeMillis = System.currentTimeMillis();
        Date start = new Date(currentTimeMillis - TimeUnit.DAYS.toMillis(1));
        Date end = new Date(currentTimeMillis + TimeUnit.DAYS.toMillis(1));
        X509v3CertificateBuilder x509v3CertificateBuilder = new X509v3CertificateBuilder(
                new X500Name("cn=example"), BigInteger.valueOf(currentTimeMillis), start, end,
                new X500Name("cn=example"),
                SubjectPublicKeyInfo.getInstance(rsaJsonWebKey.getPublicKey().getEncoded()));
        ContentSigner contentSigner = new JcaContentSignerBuilder("SHA1WithRSAEncryption")
                .setProvider(providerName).build(rsaJsonWebKey.getPrivateKey());
        X509CertificateHolder x509CertHolder = x509v3CertificateBuilder.build(contentSigner);
        X509Certificate certificate = new JcaX509CertificateConverter().getCertificate(x509CertHolder);
        Security.removeProvider(providerName);

        return String.format("%s%n%s%n%s", DefaultJwksSupplier.X509_CERT_PREFIX,
                new X509Util().toPem(certificate), DefaultJwksSupplier.X509_CERT_SUFFIX);
    } catch (Exception exception) {
        throw new RuntimeException(exception);
    }
}

---

From source file:com.google.bitcoin.core.MakeCertificate.java

License:Apache License

public static void generateSelfSignedCertificate(String hostname, File keystore, String keystorePassword) {
    try {//ww  w.  j  a  v a 2  s . c o  m
        Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());

        KeyPairGenerator kpGen = KeyPairGenerator.getInstance("RSA", "BC");
        kpGen.initialize(1024, new SecureRandom());
        KeyPair pair = kpGen.generateKeyPair();

        // Generate self-signed certificate
        X500NameBuilder builder = new X500NameBuilder(BCStyle.INSTANCE);
        builder.addRDN(BCStyle.CN, hostname);

        Date notBefore = new Date(System.currentTimeMillis() - 24 * 60 * 60 * 1000);
        Date notAfter = new Date(System.currentTimeMillis() + 10 * 365 * 24 * 60 * 60 * 1000);
        BigInteger serial = BigInteger.valueOf(System.currentTimeMillis());

        X509v3CertificateBuilder certGen = new JcaX509v3CertificateBuilder(builder.build(), serial, notBefore,
                notAfter, builder.build(), pair.getPublic());
        ContentSigner sigGen = new JcaContentSignerBuilder("SHA256WithRSAEncryption").setProvider(BC)
                .build(pair.getPrivate());
        X509Certificate cert = new JcaX509CertificateConverter().setProvider(BC)
                .getCertificate(certGen.build(sigGen));
        cert.checkValidity(new Date());
        cert.verify(cert.getPublicKey());

        // Save to keystore
        KeyStore store = KeyStore.getInstance("BKS");
        if (keystore.exists()) {
            FileInputStream fis = new FileInputStream(keystore);
            store.load(fis, keystorePassword.toCharArray());
            fis.close();
        } else {
            store.load(null);
        }
        store.setKeyEntry(hostname, pair.getPrivate(), keystorePassword.toCharArray(),
                new java.security.cert.Certificate[] { cert });
        FileOutputStream fos = new FileOutputStream(keystore);
        store.store(fos, keystorePassword.toCharArray());
        fos.close();
    } catch (Throwable t) {
        t.printStackTrace();
        throw new RuntimeException("Failed to generate self-signed certificate!", t);
    }
}

---

From source file:com.google.bitcoin.core.MakeCertificate.java

License:Apache License

public static void generateSelfSignedCertificate(String hostname, File keystore, String keystorePassword,
        String info) {//from   ww w  .  j  av a2  s . c  o m
    try {
        Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());

        KeyPairGenerator kpGen = KeyPairGenerator.getInstance("RSA", "BC");
        kpGen.initialize(1024, new SecureRandom());
        KeyPair pair = kpGen.generateKeyPair();

        // Generate self-signed certificate
        X500Principal principal = new X500Principal(info);

        Date notBefore = new Date(System.currentTimeMillis() - 24 * 60 * 60 * 1000);
        Date notAfter = new Date(System.currentTimeMillis() + 10 * 365 * 24 * 60 * 60 * 1000);
        BigInteger serial = BigInteger.valueOf(System.currentTimeMillis());

        X509v3CertificateBuilder certGen = new JcaX509v3CertificateBuilder(principal, serial, notBefore,
                notAfter, principal, pair.getPublic());
        ContentSigner sigGen = new JcaContentSignerBuilder("SHA256WithRSAEncryption").setProvider(BC)
                .build(pair.getPrivate());
        X509Certificate cert = new JcaX509CertificateConverter().setProvider(BC)
                .getCertificate(certGen.build(sigGen));
        cert.checkValidity(new Date());
        cert.verify(cert.getPublicKey());

        // Save to keystore
        KeyStore store = KeyStore.getInstance("BKS");
        if (keystore.exists()) {
            FileInputStream fis = new FileInputStream(keystore);
            store.load(fis, keystorePassword.toCharArray());
            fis.close();
        } else {
            store.load(null);
        }
        store.setKeyEntry(hostname, pair.getPrivate(), keystorePassword.toCharArray(),
                new java.security.cert.Certificate[] { cert });
        FileOutputStream fos = new FileOutputStream(keystore);
        store.store(fos, keystorePassword.toCharArray());
        fos.close();
    } catch (Throwable t) {
        t.printStackTrace();
        throw new RuntimeException("Failed to generate self-signed certificate!", t);
    }
}

---

From source file:com.google.jenkins.plugins.credentials.oauth.P12ServiceAccountConfigTestUtil.java

License:Open Source License

private static X509Certificate generateCertificate(KeyPair keyPair)
        throws OperatorCreationException, CertificateException {
    Calendar endCalendar = Calendar.getInstance();
    endCalendar.add(Calendar.YEAR, 10);
    X509v3CertificateBuilder x509v3CertificateBuilder = new X509v3CertificateBuilder(
            new X500Name("CN=localhost"), BigInteger.valueOf(1), Calendar.getInstance().getTime(),
            endCalendar.getTime(), new X500Name("CN=localhost"),
            SubjectPublicKeyInfo.getInstance(keyPair.getPublic().getEncoded()));
    ContentSigner contentSigner = new JcaContentSignerBuilder("SHA1withRSA").build(keyPair.getPrivate());
    X509CertificateHolder x509CertificateHolder = x509v3CertificateBuilder.build(contentSigner);
    return new JcaX509CertificateConverter().setProvider("BC").getCertificate(x509CertificateHolder);
}

---

• «
• 1
• 2
• 3
• 4
• 5
• 6
• 7
• 8
• 9
• 10
• 11
• 12
• 13
• 14
• 15
• 16
• 17
• 18
• 19
• 20
• 21
• 22
• 23
• 24
• 25
• 26
• 27
• 28
• 29
• 30
• 31
• 32
• 33
• 34
• 35
• »