Examples with Certificate com.beanit.asn1bean.compiler.pkix1explicit88.Certificate used on opensource projects

Example 36 with Certificate

use of com.beanit.asn1bean.compiler.pkix1explicit88.Certificate in project jasn1 by openmuc.

the class AuthenticateResponseOk method decode.

public int decode(InputStream is, boolean withTag) throws IOException {
    int tlByteCount = 0;
    int vByteCount = 0;
    BerTag berTag = new BerTag();
    if (withTag) {
        tlByteCount += tag.decodeAndCheck(is);
    }
    BerLength length = new BerLength();
    tlByteCount += length.decode(is);
    int lengthVal = length.val;
    vByteCount += berTag.decode(is);
    if (berTag.equals(EuiccSigned1.tag)) {
        euiccSigned1 = new EuiccSigned1();
        vByteCount += euiccSigned1.decode(is, false);
        vByteCount += berTag.decode(is);
    } else {
        throw new IOException("Tag does not match mandatory sequence component.");
    }
    if (berTag.equals(BerTag.APPLICATION_CLASS, BerTag.PRIMITIVE, 55)) {
        euiccSignature1 = new BerOctetString();
        vByteCount += euiccSignature1.decode(is, false);
        vByteCount += berTag.decode(is);
    } else {
        throw new IOException("Tag does not match mandatory sequence component.");
    }
    if (berTag.equals(Certificate.tag)) {
        euiccCertificate = new Certificate();
        vByteCount += euiccCertificate.decode(is, false);
        vByteCount += berTag.decode(is);
    } else {
        throw new IOException("Tag does not match mandatory sequence component.");
    }
    if (berTag.equals(Certificate.tag)) {
        eumCertificate = new Certificate();
        vByteCount += eumCertificate.decode(is, false);
        if (lengthVal >= 0 && vByteCount == lengthVal) {
            return tlByteCount + vByteCount;
        }
        vByteCount += berTag.decode(is);
    } else {
        throw new IOException("Tag does not match mandatory sequence component.");
    }
    if (lengthVal < 0) {
        while (!berTag.equals(0, 0, 0)) {
            vByteCount += DecodeUtil.decodeUnknownComponent(is);
            vByteCount += berTag.decode(is);
        }
        vByteCount += BerLength.readEocByte(is);
        return tlByteCount + vByteCount;
    } else {
        while (vByteCount < lengthVal) {
            vByteCount += DecodeUtil.decodeUnknownComponent(is);
            if (vByteCount == lengthVal) {
                return tlByteCount + vByteCount;
            }
            vByteCount += berTag.decode(is);
        }
    }
    throw new IOException("Unexpected end of sequence, length tag: " + lengthVal + ", bytes decoded: " + vByteCount);
}

Example 37 with Certificate

use of com.beanit.asn1bean.compiler.pkix1explicit88.Certificate in project ddf by codice.

the class OcspChecker method getStatusFromOcspResponse.

/**
 * Gets the {@link CertificateStatus} from the given {@param ocspResponse}.
 *
 * @param ocspResponse - the {@link OCSPResp} to get the {@link CertificateStatus} from.
 * @return the {@link CertificateStatus} from the given {@param ocspResponse}. Returns an {@link
 *     UnknownStatus} if the status could not be found.
 */
private CertificateStatus getStatusFromOcspResponse(OCSPResp ocspResponse, X509Certificate certificate) {
    try {
        BasicOCSPResp basicResponse = (BasicOCSPResp) ocspResponse.getResponseObject();
        if (basicResponse == null) {
            return new UnknownStatus();
        }
        SingleResp[] singleResps = basicResponse.getResponses();
        if (singleResps == null) {
            return new UnknownStatus();
        }
        SingleResp response = Arrays.stream(singleResps).filter(singleResp -> singleResp.getCertID() != null).filter(singleResp -> singleResp.getCertID().getSerialNumber().equals(certificate.getSerialNumber())).findFirst().orElse(null);
        if (response == null) {
            LOGGER.debug("Certificate status from OCSP response is unknown.");
            return new UnknownStatus();
        }
        if (response.getCertStatus() == null) {
            LOGGER.debug("Certificate status from OCSP response is good.");
            return CertificateStatus.GOOD;
        }
        return response.getCertStatus();
    } catch (OCSPException e) {
        return new UnknownStatus();
    }
}

Example 38 with Certificate

use of com.beanit.asn1bean.compiler.pkix1explicit88.Certificate in project ddf by codice.

the class OcspChecker method passesOcspCheck.

/**
 * Checks whether the given {@param certs} are revoked or not against the configured OCSP server
 * urls + the optionally given OCSP server url in the given {@param certs}.
 *
 * @param certs - an array of certificates to verify.
 * @return true if the certificates are good or if they could not be properly checked against the
 *     OCSP server. Returns false if any of them are revoked.
 */
@Override
public boolean passesOcspCheck(X509Certificate[] certs) {
    if (!ocspEnabled) {
        LOGGER.debug("OCSP check is not enabled. Skipping.");
        return true;
    }
    LOGGER.debug("OCSP check for {} certificate(s)", certs == null ? "0" : certs.length);
    for (X509Certificate cert : certs) {
        try {
            Certificate certificate = convertToBouncyCastleCert(cert);
            OCSPReq ocspRequest = generateOcspRequest(certificate);
            Map<URI, CertificateStatus> ocspStatuses = sendOcspRequests(cert, ocspRequest);
            URI revokedStatusUrl = getFirstRevokedStatusUrl(ocspStatuses);
            if (revokedStatusUrl != null) {
                securityLogger.audit("Certificate {} has been revoked by the OCSP server at URL {}.", cert, revokedStatusUrl);
                LOGGER.warn("Certificate {} has been revoked by the OCSP server at URL {}.", cert, revokedStatusUrl);
                return false;
            }
            LOGGER.debug("No certificates revoked by the OCSP server");
        } catch (OcspCheckerException e) {
            postErrorEvent(e.getMessage());
        }
    }
    // An alert will be posted to the admin console.
    return true;
}

Example 39 with Certificate

use of com.beanit.asn1bean.compiler.pkix1explicit88.Certificate in project jruby-openssl by jruby.

the class OCSPRequest method verify.

@JRubyMethod(name = "verify", rest = true)
public IRubyObject verify(ThreadContext context, IRubyObject[] args) {
    Ruby runtime = context.runtime;
    int flags = 0;
    boolean ret = false;
    if (Arity.checkArgumentCount(runtime, args, 2, 3) == 3) {
        flags = RubyFixnum.fix2int((RubyFixnum) args[2]);
    }
    IRubyObject certificates = args[0];
    IRubyObject store = args[1];
    OCSPReq bcOCSPReq = getBCOCSPReq();
    if (bcOCSPReq == null) {
        throw newOCSPError(runtime, new NullPointerException("Missing BC asn1bcReq. Missing certIDs or signature?"));
    }
    if (!bcOCSPReq.isSigned()) {
        return RubyBoolean.newBoolean(runtime, ret);
    }
    GeneralName genName = bcOCSPReq.getRequestorName();
    if (genName.getTagNo() != 4) {
        return RubyBoolean.newBoolean(runtime, ret);
    }
    X500Name genX500Name = X500Name.getInstance(genName.getName());
    X509StoreContext storeContext;
    try {
        java.security.cert.Certificate signer = findCertByName(genX500Name, certificates, flags);
        if (signer == null)
            return RubyBoolean.newBoolean(runtime, ret);
        if ((flags & RubyFixnum.fix2int(_OCSP(runtime).getConstant(OCSP_NOINTERN))) > 0 && ((flags & RubyFixnum.fix2int(_OCSP(runtime).getConstant(OCSP_TRUSTOTHER))) > 0))
            flags |= RubyFixnum.fix2int(_OCSP(runtime).getConstant(OCSP_NOVERIFY));
        if ((flags & RubyFixnum.fix2int(_OCSP(runtime).getConstant(OCSP_NOSIGS))) == 0) {
            PublicKey signerPubKey = signer.getPublicKey();
            ContentVerifierProvider cvp = newJcaContentVerifierProviderBuilder().build(signerPubKey);
            ret = bcOCSPReq.isSignatureValid(cvp);
            if (!ret) {
                return RubyBoolean.newBoolean(runtime, ret);
            }
        }
        if ((flags & RubyFixnum.fix2int(_OCSP(runtime).getConstant(OCSP_NOVERIFY))) == 0) {
            if ((flags & RubyFixnum.fix2int(_OCSP(runtime).getConstant(OCSP_NOCHAIN))) > 0) {
                storeContext = X509StoreContext.newStoreContext(context, (X509Store) store, X509Cert.wrap(runtime, signer), context.nil);
            } else {
                RubyArray certs = RubyArray.newEmptyArray(runtime);
                ASN1Sequence bcCerts = asn1bcReq.getOptionalSignature().getCerts();
                if (bcCerts != null) {
                    Iterator<ASN1Encodable> it = bcCerts.iterator();
                    while (it.hasNext()) {
                        Certificate cert = Certificate.getInstance(it.next());
                        certs.add(X509Cert.wrap(runtime, new X509AuxCertificate(cert)));
                    }
                }
                storeContext = X509StoreContext.newStoreContext(context, (X509Store) store, X509Cert.wrap(runtime, signer), certs);
            }
            storeContext.set_purpose(context, _X509(runtime).getConstant("PURPOSE_OCSP_HELPER"));
            storeContext.set_trust(context, _X509(runtime).getConstant("TRUST_OCSP_REQUEST"));
            ret = storeContext.verify(context).isTrue();
            if (!ret)
                return RubyBoolean.newBoolean(runtime, false);
        }
    } catch (Exception e) {
        debugStackTrace(e);
        throw newOCSPError(runtime, e);
    }
    return RubyBoolean.newBoolean(getRuntime(), ret);
}

Example 40 with Certificate

use of com.beanit.asn1bean.compiler.pkix1explicit88.Certificate in project open-ecard by ecsec.

the class ExpirationVerifier method isValid.

@Override
public void isValid(TlsServerCertificate chain, String hostOrIP) throws CertificateVerificationException {
    try {
        Date now = new Date();
        for (TlsCertificate next : chain.getCertificate().getCertificateList()) {
            Certificate c = Certificate.getInstance(next.getEncoded());
            Date expDate = c.getEndDate().getDate();
            if (now.after(expDate)) {
                String msg = String.format("The certificate '%s' expired at %s.", c.getSubject(), expDate);
                throw new CertificateVerificationException(msg);
            }
        }
    } catch (IOException ex) {
        throw new CertificateVerificationException("Invalid certificate received from server.", ex);
    }
}