Examples with CertificateAndKey com.fathomdb.crypto.CertificateAndKey used on opensource projects

Example 1 with CertificateAndKey

use of com.fathomdb.crypto.CertificateAndKey in project platformlayer by platformlayer.

the class OpsSystem method getServerTrustKeys.

public List<String> getServerTrustKeys() throws OpsException {
    if (trustKeys == null) {
        CertificateAndKey certificateAndKey = encryptionStore.getCertificateAndKey("https");
        List<String> trustKeys = Lists.newArrayList();
        for (X509Certificate certificate : certificateAndKey.getCertificateChain()) {
            PublicKey publicKey = certificate.getPublicKey();
            trustKeys.add(OpenSshUtils.getSignatureString(publicKey));
        }
        this.trustKeys = Optional.of(trustKeys);
    }
    return trustKeys.orNull();
}

Example 2 with CertificateAndKey

use of com.fathomdb.crypto.CertificateAndKey in project platformlayer by platformlayer.

the class DirectoryEncryptionStore method getCertificateAndKey.

@Override
public CertificateAndKey getCertificateAndKey(String alias) {
    CertificateAndKey certificateAndKey;
    Preconditions.checkNotNull(alias);
    // Path to file
    File certPath = new File(base, alias + ".crt");
    List<X509Certificate> certificate;
    try {
        certificate = CertificateUtils.fromPem(certPath);
    } catch (IOException e) {
        throw new IllegalArgumentException("Error reading certificate: " + certPath, e);
    }
    File keyPath = new File(base, alias + ".key");
    PrivateKey privateKey;
    try {
        privateKey = PrivateKeys.fromPem(keyPath);
    } catch (IOException e) {
        throw new IllegalArgumentException("Error reading private key: " + keyPath, e);
    }
    certificateAndKey = new SimpleCertificateAndKey(certificate, privateKey);
    return certificateAndKey;
}

Example 3 with CertificateAndKey

use of com.fathomdb.crypto.CertificateAndKey in project platformlayer by platformlayer.

the class PlatformLayerAuthAdminClient method build.

public static AuthenticationTokenValidator build(HttpStrategy httpStrategy, Configuration configuration, EncryptionStore encryptionStore) throws OpsException {
    String keystoneServiceUrl = configuration.lookup("auth.system.url", "https://127.0.0.1:" + WellKnownPorts.PORT_PLATFORMLAYER_AUTH_ADMIN + "/");
    String cert = configuration.get("auth.system.tls.clientcert");
    CertificateAndKey certificateAndKey = encryptionStore.getCertificateAndKey(cert);
    HostnameVerifier hostnameVerifier = null;
    KeyManager keyManager = new SimpleClientCertificateKeyManager(certificateAndKey);
    TrustManager trustManager = null;
    String trustKeys = configuration.lookup("auth.system.ssl.keys", null);
    if (trustKeys != null) {
        trustManager = new PublicKeyTrustManager(Splitter.on(',').trimResults().split(trustKeys));
        hostnameVerifier = new AcceptAllHostnameVerifier();
    }
    if (log.isDebugEnabled() && certificateAndKey != null) {
        X509Certificate[] chain = certificateAndKey.getCertificateChain();
        log.debug("Using client cert for PL auth: " + Joiner.on(",").join(chain));
    }
    SslConfiguration sslConfiguration = new SslConfiguration(keyManager, trustManager, hostnameVerifier);
    RestfulClient restfulClient = new JreRestfulClient(httpStrategy, keystoneServiceUrl, sslConfiguration);
    AuthenticationTokenValidator tokenValidator = new PlatformLayerAuthAdminClient(restfulClient);
    tokenValidator = new CachingAuthenticationTokenValidator(tokenValidator);
    return tokenValidator;
}

Example 4 with CertificateAndKey

use of com.fathomdb.crypto.CertificateAndKey in project platformlayer by platformlayer.

the class PkiServiceImpl method signCsr.

@Override
public List<X509Certificate> signCsr(ProjectEntity project, String csr) throws OpsException {
    CertificateAndKey projectPki;
    try {
        projectPki = repository.getProjectPki(project);
    } catch (RepositoryException e) {
        throw new OpsException("Error getting project PKI info", e);
    }
    SimpleCertificateAuthority ca = new SimpleCertificateAuthority();
    ca.caCertificate = projectPki.getCertificateChain();
    ca.caPrivateKey = projectPki.getPrivateKey();
    X509Certificate certificate = ca.signCsr(csr);
    List<X509Certificate> chain = Lists.newArrayList();
    chain.add(certificate);
    for (X509Certificate cert : projectPki.getCertificateChain()) {
        chain.add(cert);
    }
    return chain;
}

Example 5 with CertificateAndKey

use of com.fathomdb.crypto.CertificateAndKey in project platformlayer by platformlayer.

the class StandaloneXaasWebserver method start.

public boolean start() throws Exception {
    LogbackHook.attachToRootLogger();
    this.server = new Server();
    {
        SslContextFactory sslContextFactory = new SslContextFactory(SslContextFactory.DEFAULT_KEYSTORE_PATH);
        {
            CertificateAndKey certificateAndKey = encryptionStore.getCertificateAndKey("https");
            String secret = KeyStoreUtils.DEFAULT_KEYSTORE_SECRET;
            KeyStore keystore = KeyStoreUtils.createEmpty(secret);
            String alias = "https";
            KeyStoreUtils.put(keystore, alias, certificateAndKey, secret);
            sslContextFactory.setKeyStore(keystore);
            sslContextFactory.setKeyStorePassword(secret);
            sslContextFactory.setCertAlias(alias);
        }
        // TODO: Preconfigure a better SSLContext??
        SSLContext sslContext = SSLContext.getDefault();
        sslContextFactory.setIncludeCipherSuites(SslPolicy.DEFAULT.getEngineConfig(sslContext).getEnabledCipherSuites());
        sslContextFactory.setIncludeProtocols(SslPolicy.DEFAULT.getEngineConfig(sslContext).getEnabledProtocols());
        SslSelectChannelConnector connector = new SslSelectChannelConnector(sslContextFactory);
        connector.setPort(PORT);
        String host = configuration.lookup("http.host", null);
        if (host != null) {
            connector.setHost(host);
        }
        server.setConnectors(new Connector[] { connector });
    }
    ContextHandlerCollection contexts = new ContextHandlerCollection();
    {
        ServletContextHandler context = new ServletContextHandler(contexts, "/api");
        // context.setContextPath("/");
        context.addEventListener(guiceServletConfig);
        // Must add DefaultServlet for embedded Jetty
        // Failing to do this will cause 404 errors.
        context.addServlet(DefaultServlet.class, "/");
        FilterHolder filterHolder = new FilterHolder(GuiceFilter.class);
        context.addFilter(filterHolder, "*", EnumSet.of(DispatcherType.REQUEST));
        context.setClassLoader(Thread.currentThread().getContextClassLoader());
    }
    for (Entry<String, File> entry : wars.entrySet()) {
        String contextPath = entry.getKey();
        File war = entry.getValue();
        WebAppContext context = new WebAppContext();
        context.setWar(war.getAbsolutePath());
        context.setContextPath(contextPath);
        context.setInitParameter("org.eclipse.jetty.servlet.Default.dirAllowed", "false");
        context.addFilter(GwtCacheHeaderFilter.class, "/*", EnumSet.of(DispatcherType.REQUEST));
        contexts.addHandler(context);
    }
    server.setHandler(contexts);
    server.addLifeCycleListener(new CloseOnFailLifecycleListener());
    server.start();
    if (!server.isStarted()) {
        return false;
    }
    if (configuration.lookup("jobrunner.enabled", true)) {
        scheduler.start();
        jobPoller.start();
    }
    return true;
}