Examples with Certificate java.security.cert.Certificate used on opensource projects

Example 1 with Certificate

use of java.security.cert.Certificate in project buck by facebook.

the class ApkBuilderStep method createKeystoreProperties.

private PrivateKeyAndCertificate createKeystoreProperties() throws IOException, KeyStoreException, NoSuchAlgorithmException, UnrecoverableKeyException {
    KeyStore keystore = KeyStore.getInstance(JARSIGNER_KEY_STORE_TYPE);
    KeystoreProperties keystoreProperties = keystorePropertiesSupplier.get();
    InputStream inputStream = filesystem.getInputStreamForRelativePath(pathToKeystore);
    char[] keystorePassword = keystoreProperties.getStorepass().toCharArray();
    try {
        keystore.load(inputStream, keystorePassword);
    } catch (IOException | NoSuchAlgorithmException | CertificateException e) {
        throw new HumanReadableException(e, "%s is an invalid keystore.", pathToKeystore);
    }
    String alias = keystoreProperties.getAlias();
    char[] keyPassword = keystoreProperties.getKeypass().toCharArray();
    Key key = keystore.getKey(alias, keyPassword);
    // key can be null if alias/password is incorrect.
    if (key == null) {
        throw new HumanReadableException("The keystore [%s] key.alias [%s] does not exist or does not identify a key-related " + "entry", pathToKeystore, alias);
    }
    Certificate certificate = keystore.getCertificate(alias);
    return new PrivateKeyAndCertificate((PrivateKey) key, (X509Certificate) certificate);
}

Example 2 with Certificate

use of java.security.cert.Certificate in project jetty.project by eclipse.

the class SslContextFactory method getCertChain.

public static X509Certificate[] getCertChain(SSLSession sslSession) {
    try {
        Certificate[] javaxCerts = sslSession.getPeerCertificates();
        if (javaxCerts == null || javaxCerts.length == 0)
            return null;
        int length = javaxCerts.length;
        X509Certificate[] javaCerts = new X509Certificate[length];
        java.security.cert.CertificateFactory cf = java.security.cert.CertificateFactory.getInstance("X.509");
        for (int i = 0; i < length; i++) {
            byte[] bytes = javaxCerts[i].getEncoded();
            ByteArrayInputStream stream = new ByteArrayInputStream(bytes);
            javaCerts[i] = (X509Certificate) cf.generateCertificate(stream);
        }
        return javaCerts;
    } catch (SSLPeerUnverifiedException pue) {
        return null;
    } catch (Exception e) {
        LOG.warn(Log.EXCEPTION, e);
        return null;
    }
}

Example 3 with Certificate

use of java.security.cert.Certificate in project jetty.project by eclipse.

the class CertificateValidator method validate.

/**
     * validates a specific certificate inside of the keystore being passed in
     * 
     * @param keyStore the keystore to validate against
     * @param cert the certificate to validate
     * @throws CertificateException if keystore error and unable to validate
     */
public void validate(KeyStore keyStore, Certificate cert) throws CertificateException {
    Certificate[] certChain = null;
    if (cert != null && cert instanceof X509Certificate) {
        ((X509Certificate) cert).checkValidity();
        String certAlias = null;
        try {
            if (keyStore == null) {
                throw new InvalidParameterException("Keystore cannot be null");
            }
            certAlias = keyStore.getCertificateAlias((X509Certificate) cert);
            if (certAlias == null) {
                certAlias = "JETTY" + String.format("%016X", __aliasCount.incrementAndGet());
                keyStore.setCertificateEntry(certAlias, cert);
            }
            certChain = keyStore.getCertificateChain(certAlias);
            if (certChain == null || certChain.length == 0) {
                throw new IllegalStateException("Unable to retrieve certificate chain");
            }
        } catch (KeyStoreException kse) {
            LOG.debug(kse);
            throw new CertificateException("Unable to validate certificate" + (certAlias == null ? "" : " for alias [" + certAlias + "]") + ": " + kse.getMessage(), kse);
        }
        validate(certChain);
    }
}

Example 4 with Certificate

use of java.security.cert.Certificate in project tomcat by apache.

the class JSSESupport method getPeerCertificateChain.

@Override
public java.security.cert.X509Certificate[] getPeerCertificateChain() throws IOException {
    // Look up the current SSLSession
    if (session == null)
        return null;
    Certificate[] certs = null;
    try {
        certs = session.getPeerCertificates();
    } catch (Throwable t) {
        log.debug(sm.getString("jsseSupport.clientCertError"), t);
        return null;
    }
    if (certs == null)
        return null;
    java.security.cert.X509Certificate[] x509Certs = new java.security.cert.X509Certificate[certs.length];
    for (int i = 0; i < certs.length; i++) {
        if (certs[i] instanceof java.security.cert.X509Certificate) {
            // always currently true with the JSSE 1.1.x
            x509Certs[i] = (java.security.cert.X509Certificate) certs[i];
        } else {
            try {
                byte[] buffer = certs[i].getEncoded();
                CertificateFactory cf = CertificateFactory.getInstance("X.509");
                ByteArrayInputStream stream = new ByteArrayInputStream(buffer);
                x509Certs[i] = (java.security.cert.X509Certificate) cf.generateCertificate(stream);
            } catch (Exception ex) {
                log.info(sm.getString("jseeSupport.certTranslationError", certs[i]), ex);
                return null;
            }
        }
        if (log.isTraceEnabled())
            log.trace("Cert #" + i + " = " + x509Certs[i]);
    }
    if (x509Certs.length < 1)
        return null;
    return x509Certs;
}

Example 5 with Certificate

use of java.security.cert.Certificate in project Openfire by igniterealtime.

the class CertificateManager method getEndEntityCertificate.

/**
     * Decide whether or not to trust the given supplied certificate chain, returning the
     * End Entity Certificate in this case where it can, and null otherwise.
     * A self-signed certificate will, for example, return null.
     * For certain failures, we SHOULD generate an exception - revocations and the like,
     * but we currently do not.
     *
     * @param chain an array of X509Certificate where the first one is the endEntityCertificate.
     * @param certStore a keystore containing untrusted certificates (including ICAs, etc).
     * @param trustStore a keystore containing Trust Anchors (most-trusted CA certificates).
     * @return trusted end-entity certificate, or null.
     */
public static X509Certificate getEndEntityCertificate(Certificate[] chain, KeyStore certStore, KeyStore trustStore) {
    if (chain.length == 0) {
        return null;
    }
    X509Certificate first = (X509Certificate) chain[0];
    try {
        first.checkValidity();
    } catch (CertificateException e) {
        Log.warn("EE Certificate not valid: " + e.getMessage());
        return null;
    }
    if (chain.length == 1 && first.getSubjectX500Principal().equals(first.getIssuerX500Principal())) {
        // Chain is single cert, and self-signed.
        try {
            if (trustStore.getCertificateAlias(first) != null) {
                // Interesting case: trusted self-signed cert.
                return first;
            }
        } catch (KeyStoreException e) {
            Log.warn("Keystore error while looking for self-signed cert; assuming untrusted.");
        }
        return null;
    }
    final List<Certificate> all_certs = new ArrayList<>();
    try {
        // It's a mystery why these objects are different.
        for (Enumeration<String> aliases = certStore.aliases(); aliases.hasMoreElements(); ) {
            String alias = aliases.nextElement();
            if (certStore.isCertificateEntry(alias)) {
                X509Certificate cert = (X509Certificate) certStore.getCertificate(alias);
                all_certs.add(cert);
            }
        }
        // Now add the trusted certs.
        for (Enumeration<String> aliases = trustStore.aliases(); aliases.hasMoreElements(); ) {
            String alias = aliases.nextElement();
            if (trustStore.isCertificateEntry(alias)) {
                X509Certificate cert = (X509Certificate) trustStore.getCertificate(alias);
                all_certs.add(cert);
            }
        }
        // Finally, add all the certs in the chain:
        for (int i = 0; i < chain.length; ++i) {
            all_certs.add(chain[i]);
        }
        CertStore cs = CertStore.getInstance("Collection", new CollectionCertStoreParameters(all_certs));
        X509CertSelector selector = new X509CertSelector();
        selector.setCertificate(first);
        // / selector.setSubject(first.getSubjectX500Principal());
        PKIXBuilderParameters params = new PKIXBuilderParameters(trustStore, selector);
        params.addCertStore(cs);
        params.setDate(new Date());
        params.setRevocationEnabled(false);
        /* Code here is the right way to do things. */
        CertPathBuilder pathBuilder = CertPathBuilder.getInstance(CertPathBuilder.getDefaultType());
        CertPath cp = pathBuilder.build(params).getCertPath();
        /**
             * This section is an alternative to using CertPathBuilder which is
             * not as complete (or safe), but will emit much better errors. If
             * things break, swap around the code.
             *
             **** COMMENTED OUT. ****
            ArrayList<X509Certificate> ls = new ArrayList<X509Certificate>();
            for (int i = 0; i < chain.length; ++i) {
                ls.add((X509Certificate) chain[i]);
            }
            for (X509Certificate last = ls.get(ls.size() - 1); !last
                    .getIssuerX500Principal().equals(last.getSubjectX500Principal()); last = ls
                    .get(ls.size() - 1)) {
                X509CertSelector sel = new X509CertSelector();
                sel.setSubject(last.getIssuerX500Principal());
                ls.add((X509Certificate) cs.getCertificates(sel).toArray()[0]);
            }
            CertPath cp = CertificateFactory.getInstance("X.509").generateCertPath(ls);
             ****** END ALTERNATIVE. ****
             */
        // Not entirely sure if I need to do this with CertPathBuilder.
        // Can't hurt.
        CertPathValidator pathValidator = CertPathValidator.getInstance("PKIX");
        pathValidator.validate(cp, params);
        return (X509Certificate) cp.getCertificates().get(0);
    } catch (CertPathBuilderException e) {
        Log.warn("Path builder: " + e.getMessage());
    } catch (CertPathValidatorException e) {
        Log.warn("Path validator: " + e.getMessage());
    } catch (Exception e) {
        Log.warn("Unkown exception while validating certificate chain: " + e.getMessage());
    }
    return null;
}