Example usage for org.bouncycastle.cert.jcajce JcaX509CertificateConverter JcaX509CertificateConverter

Introduction

In this page you can find the example usage for org.bouncycastle.cert.jcajce JcaX509CertificateConverter JcaX509CertificateConverter.

Prototype

public JcaX509CertificateConverter() 

Source Link

Document

Base constructor, configure with the default provider.

Usage

From source file:com.liferay.sync.engine.lan.util.LanPEMParserUtil.java

License:Open Source License

public static X509Certificate parseX509Certificate(String certificate) throws Exception {

    StringBuilder sb = new StringBuilder();

    sb.append("-----BEGIN CERTIFICATE-----\n");
    sb.append(certificate);//from   w w w .j a v  a 2s  .c o  m

    if (!certificate.endsWith("\n")) {
        sb.append("\n");
    }

    sb.append("-----END CERTIFICATE-----");

    PEMParser pemParser = new PEMParser(new StringReader(sb.toString()));

    JcaX509CertificateConverter jcaX509CertificateConverter = new JcaX509CertificateConverter();

    return jcaX509CertificateConverter.getCertificate((X509CertificateHolder) pemParser.readObject());
}

---

From source file:com.liferay.sync.util.SyncUtil.java

License:Open Source License

public static void enableLanSync(long companyId) throws Exception {
    String lanServerUuid = PrefsPropsUtil.getString(companyId, SyncConstants.SYNC_LAN_SERVER_UUID);

    if (Validator.isNotNull(lanServerUuid)) {
        return;// ww w  .  j  ava2  s  . co m
    }

    lanServerUuid = PortalUUIDUtil.generate();

    X500Name x500Name = new X500Name("CN=" + lanServerUuid);

    KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");

    keyPairGenerator.initialize(1024);

    KeyPair keyPair = keyPairGenerator.generateKeyPair();

    X509v3CertificateBuilder x509v3CertificateBuilder = new JcaX509v3CertificateBuilder(x500Name,
            new BigInteger(64, new SecureRandom()), new Date(System.currentTimeMillis() - Time.YEAR),
            new Date(System.currentTimeMillis() + Time.YEAR * 1000), x500Name, keyPair.getPublic());

    PrivateKey privateKey = keyPair.getPrivate();

    JcaContentSignerBuilder jcaContentSignerBuilder = new JcaContentSignerBuilder("SHA256WithRSAEncryption");

    JcaX509CertificateConverter jcaX509CertificateConverter = new JcaX509CertificateConverter();

    jcaX509CertificateConverter.setProvider(_provider);

    X509Certificate x509Certificate = jcaX509CertificateConverter
            .getCertificate(x509v3CertificateBuilder.build(jcaContentSignerBuilder.build(privateKey)));

    x509Certificate.verify(keyPair.getPublic());

    PortletPreferences portletPreferences = PrefsPropsUtil.getPreferences(companyId);

    portletPreferences.setValue(SyncConstants.SYNC_LAN_CERTIFICATE,
            Base64.encode(x509Certificate.getEncoded()));
    portletPreferences.setValue(SyncConstants.SYNC_LAN_KEY, Base64.encode(privateKey.getEncoded()));
    portletPreferences.setValue(SyncConstants.SYNC_LAN_SERVER_UUID, lanServerUuid);

    portletPreferences.store();
}

---

From source file:com.linkedin.kafka.clients.utils.tests.TestSslUtils.java

/**
 * Create a self-signed X.509 Certificate.
 * From http://bfo.com/blog/2011/03/08/odds_and_ends_creating_a_new_x_509_certificate.html.
 *
 * @param dn        the X.509 Distinguished Name, eg "CN=Test, L=London, C=GB"
 * @param pair      the KeyPair//  w  w w .j  av  a2s . com
 * @param days      how many days from now the Certificate is valid for
 * @param algorithm the signing algorithm, eg "SHA1withRSA"
 * @return the self-signed certificate
 * @throws CertificateException thrown if a security error or an IO error occurred.
 */
public static X509Certificate generateCertificate(String dn, KeyPair pair, int days, String algorithm)
        throws CertificateException {

    try {
        Security.addProvider(new BouncyCastleProvider());
        AlgorithmIdentifier sigAlgId = new DefaultSignatureAlgorithmIdentifierFinder().find(algorithm);
        AlgorithmIdentifier digAlgId = new DefaultDigestAlgorithmIdentifierFinder().find(sigAlgId);
        AsymmetricKeyParameter privateKeyAsymKeyParam = PrivateKeyFactory
                .createKey(pair.getPrivate().getEncoded());
        SubjectPublicKeyInfo subPubKeyInfo = SubjectPublicKeyInfo.getInstance(pair.getPublic().getEncoded());
        ContentSigner sigGen = new BcRSAContentSignerBuilder(sigAlgId, digAlgId).build(privateKeyAsymKeyParam);
        X500Name name = new X500Name(dn);
        Date from = new Date();
        Date to = new Date(from.getTime() + days * 86400000L);
        BigInteger sn = new BigInteger(64, new SecureRandom());

        X509v1CertificateBuilder v1CertGen = new X509v1CertificateBuilder(name, sn, from, to, name,
                subPubKeyInfo);
        X509CertificateHolder certificateHolder = v1CertGen.build(sigGen);
        return new JcaX509CertificateConverter().setProvider("BC").getCertificate(certificateHolder);
    } catch (CertificateException ce) {
        throw ce;
    } catch (Exception e) {
        throw new CertificateException(e);
    }
}

---

From source file:com.linkedin.mitm.services.AbstractX509CertificateService.java

License:Open Source License

protected X509Certificate createCertificate(PrivateKey privateKey,
        X509v3CertificateBuilder x509v3CertificateBuilder)
        throws OperatorCreationException, CertificateException {
    ContentSigner contentSigner = new JcaContentSignerBuilder(SIGNATURE_ALGORITHM)
            .setProvider(BouncyCastleProvider.PROVIDER_NAME).build(privateKey);
    X509Certificate x509Certificate = new JcaX509CertificateConverter()
            .setProvider(BouncyCastleProvider.PROVIDER_NAME)
            .getCertificate(x509v3CertificateBuilder.build(contentSigner));
    return x509Certificate;
}

---

From source file:com.miguelpazo.signature.test.SignDataTest.java

public void verifyData(String envelopedData) throws Exception {
    CMSSignedData cms = new CMSSignedData(Base64.decode(envelopedData.getBytes()));
    Store store = cms.getCertificates();

    SignerInformationStore signers = cms.getSignerInfos();
    Collection c = signers.getSigners();
    Iterator it = c.iterator();//from w  ww . j  a  v  a2 s .c o m

    //        Object content = cms.getSignedContent().getContent();
    //        byte[] b = (byte[]) content;
    //        byte[] dataSigned = Base64.encode(cms.getSignedContent());
    System.out.println(cms.getSignedContent());

    while (it.hasNext()) {
        SignerInformation signer = (SignerInformation) it.next();
        Collection certCollection = store.getMatches(signer.getSID());
        Iterator certIt = certCollection.iterator();

        X509CertificateHolder certHolder = (X509CertificateHolder) certIt.next();
        X509Certificate certFromSignedData = new JcaX509CertificateConverter().setProvider("BC")
                .getCertificate(certHolder);

        System.out.println("data => " + certFromSignedData.getSubjectDN().toString());

        //            byte[] data = Base64.encode(signer.getContentDigest());
        //            System.out.println(new String(data));
        //            if (signer.verify(new JcaSimpleSignerInfoVerifierBuilder().setProvider("BC").build(certFromSignedData))) {
        //                System.out.println("Signature verified");
        //            } else {
        //                System.out.println("Signature verification failed");
        //            }
    }
}

---

From source file:com.mirth.connect.server.controllers.DefaultConfigurationController.java

License:Open Source License

/**
 * Checks for an existing certificate to use for secure communication between the server and
 * client. If no certficate exists, this will generate a new one.
 * //from  w w w . j  av a  2s.co m
 */
private void generateDefaultCertificate(Provider provider, KeyStore keyStore, char[] keyPassword)
        throws Exception {
    final String certificateAlias = "mirthconnect";

    if (!keyStore.containsAlias(certificateAlias)) {
        // Common CA and SSL cert attributes
        Date startDate = new Date(); // time from which certificate is valid
        Date expiryDate = DateUtils.addYears(startDate, 50); // time after which certificate is not valid
        KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA", provider);
        keyPairGenerator.initialize(2048);

        KeyPair caKeyPair = keyPairGenerator.generateKeyPair();
        logger.debug("generated new key pair for CA cert using provider: " + provider.getName());

        // Generate CA cert
        X500Name caSubjectName = new X500Name("CN=Mirth Connect Certificate Authority");
        SubjectPublicKeyInfo caSubjectKey = new SubjectPublicKeyInfo(
                ASN1Sequence.getInstance(caKeyPair.getPublic().getEncoded()));
        X509v3CertificateBuilder certBuilder = new X509v3CertificateBuilder(caSubjectName, BigInteger.ONE,
                startDate, expiryDate, caSubjectName, caSubjectKey);
        certBuilder.addExtension(org.bouncycastle.asn1.x509.Extension.basicConstraints, true,
                new BasicConstraints(0));
        ContentSigner sigGen = new JcaContentSignerBuilder("SHA256withRSA").setProvider(provider)
                .build(caKeyPair.getPrivate());
        Certificate caCert = new JcaX509CertificateConverter().setProvider(provider)
                .getCertificate(certBuilder.build(sigGen));

        // Generate SSL cert
        KeyPair sslKeyPair = keyPairGenerator.generateKeyPair();
        logger.debug("generated new key pair for SSL cert using provider: " + provider.getName());

        X500Name sslSubjectName = new X500Name("CN=mirth-connect");
        SubjectPublicKeyInfo sslSubjectKey = new SubjectPublicKeyInfo(
                ASN1Sequence.getInstance(sslKeyPair.getPublic().getEncoded()));
        X509v3CertificateBuilder sslCertBuilder = new X509v3CertificateBuilder(caSubjectName,
                new BigInteger(50, new SecureRandom()), startDate, expiryDate, sslSubjectName, sslSubjectKey);
        sslCertBuilder.addExtension(org.bouncycastle.asn1.x509.Extension.authorityKeyIdentifier, false,
                new AuthorityKeyIdentifier(caCert.getEncoded()));
        sslCertBuilder.addExtension(org.bouncycastle.asn1.x509.Extension.subjectKeyIdentifier, false,
                new SubjectKeyIdentifier(sslKeyPair.getPublic().getEncoded()));

        sigGen = new JcaContentSignerBuilder("SHA256withRSA").setProvider(provider)
                .build(caKeyPair.getPrivate());
        Certificate sslCert = new JcaX509CertificateConverter().setProvider(provider)
                .getCertificate(sslCertBuilder.build(sigGen));

        logger.debug("generated new certificate with serial number: "
                + ((X509Certificate) sslCert).getSerialNumber());

        // add the generated SSL cert to the keystore using the key password
        keyStore.setKeyEntry(certificateAlias, sslKeyPair.getPrivate(), keyPassword,
                new Certificate[] { sslCert });
    } else {
        logger.debug("found certificate in keystore");
    }
}

---

From source file:com.motorolamobility.studio.android.certmanager.core.KeyStoreUtils.java

License:Apache License

/**
 * Create a new X509 certificate for a given KeyPair
 * @param keyPair the {@link KeyPair} used to create the certificate,
 *     RSAPublicKey and RSAPrivateKey are mandatory on keyPair, IllegalArgumentExeption will be thrown otherwise.
 * @param issuerName The issuer name to be used on the certificate
 * @param ownerName  The owner name to be used on the certificate
 * @param expireDate The expire date//from   w ww. java  2  s  .  c  om
 * @return The {@link X509Certificate}
 * @throws IOException
 * @throws OperatorCreationException
 * @throws CertificateException
 */
public static X509Certificate createX509Certificate(KeyPair keyPair, CertificateDetailsInfo certDetails)
        throws IOException, OperatorCreationException, CertificateException {

    PublicKey publicKey = keyPair.getPublic();
    PrivateKey privateKey = keyPair.getPrivate();
    if (!(publicKey instanceof RSAPublicKey) || !(privateKey instanceof RSAPrivateKey)) {
        throw new IllegalArgumentException(CertificateManagerNLS.KeyStoreUtils_RSA_Keys_Expected);
    }

    RSAPublicKey rsaPublicKey = (RSAPublicKey) publicKey;
    RSAPrivateKey rsaPrivateKey = (RSAPrivateKey) privateKey;

    //Transform the PublicKey into the BouncyCastle expected format
    ASN1InputStream asn1InputStream = null;
    X509Certificate x509Certificate = null;

    try {
        asn1InputStream = new ASN1InputStream(new ByteArrayInputStream(rsaPublicKey.getEncoded()));
        SubjectPublicKeyInfo pubKey = new SubjectPublicKeyInfo((ASN1Sequence) asn1InputStream.readObject());

        X500NameBuilder nameBuilder = new X500NameBuilder(new BCStrictStyle());
        addField(BCStyle.C, certDetails.getCountry(), nameBuilder);
        addField(BCStyle.ST, certDetails.getState(), nameBuilder);
        addField(BCStyle.L, certDetails.getLocality(), nameBuilder);
        addField(BCStyle.O, certDetails.getOrganization(), nameBuilder);
        addField(BCStyle.OU, certDetails.getOrganizationUnit(), nameBuilder);
        addField(BCStyle.CN, certDetails.getCommonName(), nameBuilder);

        X500Name subjectName = nameBuilder.build();
        X500Name issuerName = subjectName;
        X509v3CertificateBuilder certBuilder = new X509v3CertificateBuilder(issuerName,
                BigInteger.valueOf(new SecureRandom().nextInt()), GregorianCalendar.getInstance().getTime(),
                certDetails.getExpirationDate(), subjectName, pubKey);

        AlgorithmIdentifier sigAlgId = new DefaultSignatureAlgorithmIdentifierFinder().find("SHA1withRSA"); //$NON-NLS-1$
        AlgorithmIdentifier digAlgId = new DefaultDigestAlgorithmIdentifierFinder().find(sigAlgId);
        BcContentSignerBuilder sigGen = new BcRSAContentSignerBuilder(sigAlgId, digAlgId);

        //Create RSAKeyParameters, the private key format expected by Bouncy Castle
        RSAKeyParameters keyParams = new RSAKeyParameters(true, rsaPrivateKey.getPrivateExponent(),
                rsaPrivateKey.getModulus());

        ContentSigner contentSigner = sigGen.build(keyParams);
        X509CertificateHolder certificateHolder = certBuilder.build(contentSigner);

        //Convert the X509Certificate from BouncyCastle format to the java.security format
        JcaX509CertificateConverter certConverter = new JcaX509CertificateConverter();
        x509Certificate = certConverter.getCertificate(certificateHolder);
    } finally {
        if (asn1InputStream != null) {
            try {
                asn1InputStream.close();
            } catch (IOException e) {
                StudioLogger.error("Could not close stream while creating X509 certificate. " + e.getMessage());
            }
        }
    }

    return x509Certificate;
}

---

From source file:com.msopentech.thali.utilities.universal.ThaliCryptoUtilities.java

License:Open Source License

/**
 * Creates a PKCS12 keystore and puts into it the submitted public/private key pair under the submitted
 * Key Alias using the submitted passphrase to 'secure' the file.
 *
 * Right now we only generate large RSA keys because I'm paranoid that the curves used in
 * Elliptic Curve crypto may have been designed by folks for whom security was not the paramount
 * concern. Once this issue is put to rest I would expect to switch to Elliptic Curve because
 * it is considered (with appropriate curves) to be more secure and is certainly faster.
 * @param keyPair//from   www.j a va  2s . c  o m
 * @param keyAlias
 * @param passphrase
 * @return
 */
public static KeyStore CreatePKCS12KeyStoreWithPublicPrivateKeyPair(KeyPair keyPair, String keyAlias,
        char[] passphrase) {
    try {
        byte[] publicKeyAsByteArray = keyPair.getPublic().getEncoded();

        // Generate a cert for the public key
        Date startDate = new Date(System.currentTimeMillis() - 24 * 60 * 60 * 1000);
        Date endDate = new Date(
                System.currentTimeMillis() + (ExpirationPeriodForCertsInDays * 24L * 60L * 60L * 1000L));

        // Thali security is based on keys NOT on cert values. That is we are not trying to bind a name (like a DNS
        // address) to a key. The key IS the identity. But the X509 standard requires names so we stick something
        // in.
        X500Name x500Name = new X500Name(X500Name);

        SubjectPublicKeyInfo subjectPublicKeyInfo = new SubjectPublicKeyInfo(
                ASN1Sequence.getInstance(publicKeyAsByteArray));

        // Note that by not specify .setProvider("BC") we are using the default provider, this is because bouncy castle as
        // previously mentioned is installed on Android but is a challenge for the applet so I'll just use the default for now.
        ContentSigner contentSigner = new JcaContentSignerBuilder(SignerAlgorithm).build(keyPair.getPrivate());

        X509v1CertificateBuilder x509v1CertificateBuilder = new X509v1CertificateBuilder(x500Name,
                BigInteger.ONE, startDate, endDate, x500Name, subjectPublicKeyInfo);
        X509CertificateHolder x509CertificateHolder = x509v1CertificateBuilder.build(contentSigner);
        JcaX509CertificateConverter jcaX509CertificateConverter = new JcaX509CertificateConverter();
        X509Certificate x509Certificate = jcaX509CertificateConverter.getCertificate(x509CertificateHolder);

        // Store the private key and the cert in the keystore
        KeyStore.PrivateKeyEntry privateKeyEntry = new KeyStore.PrivateKeyEntry(keyPair.getPrivate(),
                new Certificate[] { x509Certificate });

        KeyStore keyStore = KeyStore.getInstance(PrivateKeyHolderFormat);
        // Keystore has to be initialized before being used
        keyStore.load(null, null);

        keyStore.setEntry(keyAlias, privateKeyEntry, new KeyStore.PasswordProtection(passphrase));

        return keyStore;
    } catch (Exception e) {
        throw new RuntimeException(e.getMessage(), e);
    }
}

---

From source file:com.rcn.service.CertificateService.java

License:Open Source License

public String generateCert(String certName, String password, int validDays, Optional<String> caPem,
        String caPassword, boolean generateCaCert, Optional<String> pkc10Request) {
    try {//from   ww  w.j a va 2s . c o  m
        Optional<Tuple<KeyPair, X509Certificate>> caTuple = caPem.map(c -> fromPem(c, caPassword));
        Optional<KeyPair> ca = caTuple.map(a -> a.getX());

        Optional<KeyPair> optKeyPair = Optional.ofNullable(pkc10Request.isPresent() ? null : generateKey());

        PublicKey publicKey = pkc10Request.map(this::fromPkcs10).orElseGet(() -> optKeyPair.get().getPublic());

        Date now = new Date();
        Calendar tenYears = Calendar.getInstance();
        tenYears.add(Calendar.DATE, validDays);
        X500Principal x500Principal = new X500Principal(certName);
        BigInteger serial = rndBigInt(new BigInteger("8180385048")); //max value for SN
        X500Principal issuer = caTuple.map(a -> a.getY().getSubjectX500Principal())
                .orElseGet(() -> x500Principal);
        JcaX509v3CertificateBuilder v3CertGen = new JcaX509v3CertificateBuilder(issuer, serial, now,
                new Date(tenYears.getTimeInMillis()), x500Principal, publicKey);

        v3CertGen.addExtension(X509Extension.subjectKeyIdentifier, false,
                new SubjectKeyIdentifier(getSubjectPublicKeyInfo(publicKey)));

        ca.ifPresent(caKey -> v3CertGen.addExtension(X509Extension.authorityKeyIdentifier, false,
                new AuthorityKeyIdentifier(getSubjectPublicKeyInfo(caKey.getPublic()))));

        if (generateCaCert) {
            addCaExtension(v3CertGen);
        } else {
            addRegularExtension(Optional.empty(), v3CertGen);
        }

        KeyPair caKey = ca.orElseGet(
                () -> optKeyPair.orElseThrow(() -> new SecurityException("no private key for self-sign cert")));
        X509Certificate certificate = new JcaX509CertificateConverter()
                .setProvider(BouncyCastleProvider.PROVIDER_NAME)
                .getCertificate(v3CertGen.build(new JcaContentSignerBuilder("SHA256WithRSAEncryption")
                        .setProvider(BouncyCastleProvider.PROVIDER_NAME).build(caKey.getPrivate())));
        String certPem = toPem(certificate, Optional.empty());

        String keyPem = optKeyPair
                .map(k -> toPem(k, Optional.ofNullable(password.length() > 0 ? password : null))).orElse("");

        return String.format("%s%s", certPem, keyPem);
    } catch (Exception e) {
        throw new SecurityException(e);
    }
}

---

From source file:com.redhat.akashche.keystoregen.KeystoreGenerator.java

License:Apache License

private Certificate createMasterCert(KeystoreConfig.Entry en, Keys keys) throws Exception {
    String label = en.getLabel() + "_CA";
    X500NameBuilder subject = new X500NameBuilder();
    subject.addRDN(BCStyle.C, en.getX500_C());
    subject.addRDN(BCStyle.O, en.getX500_O());
    subject.addRDN(BCStyle.OU, en.getX500_OU());
    subject.addRDN(BCStyle.CN, label);/* w w w .  j av  a 2 s  .  c o m*/

    ContentSigner signer = new JcaContentSignerBuilder(en.getAlgorithm()).setProvider(BCPROV)
            .build(keys.caPrivate);
    X509CertificateHolder holder = new JcaX509v3CertificateBuilder(subject.build(), BigInteger.valueOf(1),
            en.getValidFrom(), en.getValidTo(), subject.build(), keys.caPublic).build(signer);
    X509Certificate cert = new JcaX509CertificateConverter().setProvider(BCPROV).getCertificate(holder);

    cert.checkValidity(new Date());
    cert.verify(keys.caPublic);

    PKCS12BagAttributeCarrier bagAttr = (PKCS12BagAttributeCarrier) cert;
    bagAttr.setBagAttribute(PKCSObjectIdentifiers.pkcs_9_at_friendlyName, new DERBMPString(label));
    return cert;
}

---

• «
• 1
• 2
• 3
• 4
• 5
• 6
• 7
• 8
• 9
• 10
• 11
• 12
• 13
• 14
• 15
• 16
• 17
• 18
• 19
• 20
• 21
• 22
• 23
• 24
• 25
• 26
• 27
• 28
• 29
• 30
• 31
• 32
• 33
• 34
• 35
• »