Examples with DistributionPointName com.github.zhenwei.core.asn1.x509.DistributionPointName used on opensource projects

Example 41 with DistributionPointName

use of com.github.zhenwei.core.asn1.x509.DistributionPointName in project LinLong-Java by zhenwei1108.

the class RevocationUtilities method getAdditionalStoresFromCRLDistributionPoint.

static List<PKIXCRLStore> getAdditionalStoresFromCRLDistributionPoint(CRLDistPoint crldp, Map<GeneralName, PKIXCRLStore> namedCRLStoreMap) throws AnnotatedException {
    if (crldp == null) {
        return Collections.emptyList();
    }
    DistributionPoint[] dps;
    try {
        dps = crldp.getDistributionPoints();
    } catch (Exception e) {
        throw new AnnotatedException("Distribution points could not be read.", e);
    }
    List<PKIXCRLStore> stores = new ArrayList<PKIXCRLStore>();
    for (int i = 0; i < dps.length; i++) {
        DistributionPointName dpn = dps[i].getDistributionPoint();
        // look for URIs in fullName
        if (dpn != null && dpn.getType() == DistributionPointName.FULL_NAME) {
            GeneralName[] genNames = GeneralNames.getInstance(dpn.getName()).getNames();
            for (int j = 0; j < genNames.length; j++) {
                PKIXCRLStore store = namedCRLStoreMap.get(genNames[j]);
                if (store != null) {
                    stores.add(store);
                }
            }
        }
    }
    return stores;
}

Example 42 with DistributionPointName

use of com.github.zhenwei.core.asn1.x509.DistributionPointName in project LinLong-Java by zhenwei1108.

the class X509RevocationChecker method checkCRLs.

/**
 * Checks a certificate if it is revoked.
 *
 * @param pkixParams       PKIX parameters.
 * @param cert             Certificate to check if it is revoked.
 * @param validDate        The date when the certificate revocation status should be checked.
 * @param sign             The issuer certificate of the certificate <code>cert</code>.
 * @param workingPublicKey The public key of the issuer certificate <code>sign</code>.
 * @param certPathCerts    The certificates of the certification path.
 * @throws AnnotatedException if the certificate is revoked or the status cannot be checked or
 *                            some error occurs.
 */
protected void checkCRLs(PKIXExtendedParameters pkixParams, Date currentDate, Date validityDate, X509Certificate cert, X509Certificate sign, PublicKey workingPublicKey, List certPathCerts, JcaJceHelper helper) throws AnnotatedException, CertPathValidatorException {
    CRLDistPoint crldp;
    try {
        crldp = CRLDistPoint.getInstance(RevocationUtilities.getExtensionValue(cert, Extension.cRLDistributionPoints));
    } catch (Exception e) {
        throw new AnnotatedException("cannot read CRL distribution point extension", e);
    }
    CertStatus certStatus = new CertStatus();
    ReasonsMask reasonsMask = new ReasonsMask();
    AnnotatedException lastException = null;
    boolean validCrlFound = false;
    // for each distribution point
    if (crldp != null) {
        DistributionPoint[] dps;
        try {
            dps = crldp.getDistributionPoints();
        } catch (Exception e) {
            throw new AnnotatedException("cannot read distribution points", e);
        }
        if (dps != null) {
            PKIXExtendedParameters.Builder pkixBuilder = new PKIXExtendedParameters.Builder(pkixParams);
            try {
                List extras = getAdditionalStoresFromCRLDistributionPoint(crldp, pkixParams.getNamedCRLStoreMap());
                for (Iterator it = extras.iterator(); it.hasNext(); ) {
                    pkixBuilder.addCRLStore((PKIXCRLStore) it.next());
                }
            } catch (AnnotatedException e) {
                throw new AnnotatedException("no additional CRL locations could be decoded from CRL distribution point extension", e);
            }
            PKIXExtendedParameters pkixParamsFinal = pkixBuilder.build();
            Date validityDateFinal = RevocationUtilities.getValidityDate(pkixParamsFinal, currentDate);
            for (int i = 0; i < dps.length && certStatus.getCertStatus() == CertStatus.UNREVOKED && !reasonsMask.isAllReasons(); i++) {
                try {
                    RFC3280CertPathUtilities.checkCRL(dps[i], pkixParamsFinal, currentDate, validityDateFinal, cert, sign, workingPublicKey, certStatus, reasonsMask, certPathCerts, helper);
                    validCrlFound = true;
                } catch (AnnotatedException e) {
                    lastException = e;
                }
            }
        }
    }
    if (certStatus.getCertStatus() == CertStatus.UNREVOKED && !reasonsMask.isAllReasons()) {
        try {
            /*
         * assume a DP with both the reasons and the cRLIssuer fields
         * omitted and a distribution point name of the certificate
         * issuer.
         */
            X500Principal issuer = cert.getIssuerX500Principal();
            DistributionPoint dp = new DistributionPoint(new DistributionPointName(0, new GeneralNames(new GeneralName(GeneralName.directoryName, X500Name.getInstance(issuer.getEncoded())))), null, null);
            PKIXExtendedParameters pkixParamsClone = (PKIXExtendedParameters) pkixParams.clone();
            RFC3280CertPathUtilities.checkCRL(dp, pkixParamsClone, currentDate, validityDate, cert, sign, workingPublicKey, certStatus, reasonsMask, certPathCerts, helper);
            validCrlFound = true;
        } catch (AnnotatedException e) {
            lastException = e;
        }
    }
    if (!validCrlFound) {
        if (lastException instanceof AnnotatedException) {
            throw new CRLNotFoundException("no valid CRL found", lastException);
        }
        throw new CRLNotFoundException("no valid CRL found");
    }
    if (certStatus.getCertStatus() != CertStatus.UNREVOKED) {
        SimpleDateFormat df = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss Z");
        df.setTimeZone(TimeZone.getTimeZone("UTC"));
        String message = "certificate [issuer=\"" + cert.getIssuerX500Principal() + "\",serialNumber=" + cert.getSerialNumber() + ",subject=\"" + cert.getSubjectX500Principal() + "\"] revoked after " + df.format(certStatus.getRevocationDate());
        message += ", reason: " + crlReasons[certStatus.getCertStatus()];
        throw new AnnotatedException(message);
    }
    if (!reasonsMask.isAllReasons() && certStatus.getCertStatus() == CertStatus.UNREVOKED) {
        certStatus.setCertStatus(CertStatus.UNDETERMINED);
    }
    if (certStatus.getCertStatus() == CertStatus.UNDETERMINED) {
        throw new AnnotatedException("certificate status could not be determined");
    }
}

Example 43 with DistributionPointName

use of com.github.zhenwei.core.asn1.x509.DistributionPointName in project LinLong-Java by zhenwei1108.

the class RFC3280CertPathUtilities method checkCRLs.

/**
 * Checks a certificate if it is revoked.
 *
 * @param paramsPKIX       PKIX parameters.
 * @param currentDate      The date at which this check is being run.
 * @param validityDate     The date when the certificate revocation status should be checked.
 * @param cert             Certificate to check if it is revoked.
 * @param sign             The issuer certificate of the certificate <code>cert</code>.
 * @param workingPublicKey The public key of the issuer certificate <code>sign</code>.
 * @param certPathCerts    The certificates of the certification path.
 * @throws AnnotatedException if the certificate is revoked or the status cannot be checked or
 *                            some error occurs.
 */
protected static void checkCRLs(PKIXCertRevocationCheckerParameters params, PKIXExtendedParameters paramsPKIX, Date currentDate, Date validityDate, X509Certificate cert, X509Certificate sign, PublicKey workingPublicKey, List certPathCerts, JcaJceHelper helper) throws AnnotatedException, RecoverableCertPathValidatorException {
    AnnotatedException lastException = null;
    CRLDistPoint crldp = null;
    try {
        crldp = CRLDistPoint.getInstance(CertPathValidatorUtilities.getExtensionValue(cert, RFC3280CertPathUtilities.CRL_DISTRIBUTION_POINTS));
    } catch (Exception e) {
        throw new AnnotatedException("CRL distribution point extension could not be read.", e);
    }
    PKIXExtendedParameters.Builder paramsBldr = new PKIXExtendedParameters.Builder(paramsPKIX);
    try {
        List extras = CertPathValidatorUtilities.getAdditionalStoresFromCRLDistributionPoint(crldp, paramsPKIX.getNamedCRLStoreMap(), validityDate, helper);
        for (Iterator it = extras.iterator(); it.hasNext(); ) {
            paramsBldr.addCRLStore((PKIXCRLStore) it.next());
        }
    } catch (AnnotatedException e) {
        throw new AnnotatedException("No additional CRL locations could be decoded from CRL distribution point extension.", e);
    }
    CertStatus certStatus = new CertStatus();
    ReasonsMask reasonsMask = new ReasonsMask();
    PKIXExtendedParameters finalParams = paramsBldr.build();
    boolean validCrlFound = false;
    // for each distribution point
    if (crldp != null) {
        DistributionPoint[] dps = null;
        try {
            dps = crldp.getDistributionPoints();
        } catch (Exception e) {
            throw new AnnotatedException("Distribution points could not be read.", e);
        }
        if (dps != null) {
            for (int i = 0; i < dps.length && certStatus.getCertStatus() == CertStatus.UNREVOKED && !reasonsMask.isAllReasons(); i++) {
                try {
                    checkCRL(params, dps[i], finalParams, currentDate, validityDate, cert, sign, workingPublicKey, certStatus, reasonsMask, certPathCerts, helper);
                    validCrlFound = true;
                } catch (AnnotatedException e) {
                    lastException = e;
                }
            }
        }
    }
    if (certStatus.getCertStatus() == CertStatus.UNREVOKED && !reasonsMask.isAllReasons()) {
        try {
            /*
         * assume a DP with both the reasons and the cRLIssuer fields
         * omitted and a distribution point name of the certificate
         * issuer.
         */
            X500Name issuer;
            try {
                issuer = PrincipalUtils.getIssuerPrincipal(cert);
            } catch (RuntimeException e) {
                throw new AnnotatedException("Issuer from certificate for CRL could not be reencoded.", e);
            }
            DistributionPoint dp = new DistributionPoint(new DistributionPointName(0, new GeneralNames(new GeneralName(GeneralName.directoryName, issuer))), null, null);
            PKIXExtendedParameters paramsPKIXClone = (PKIXExtendedParameters) paramsPKIX.clone();
            checkCRL(params, dp, paramsPKIXClone, currentDate, validityDate, cert, sign, workingPublicKey, certStatus, reasonsMask, certPathCerts, helper);
            validCrlFound = true;
        } catch (AnnotatedException e) {
            lastException = e;
        }
    }
    if (!validCrlFound) {
        if (lastException instanceof AnnotatedException) {
            throw lastException;
        }
        throw new AnnotatedException("No valid CRL found.", lastException);
    }
    if (certStatus.getCertStatus() != CertStatus.UNREVOKED) {
        SimpleDateFormat df = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss Z");
        df.setTimeZone(TimeZone.getTimeZone("UTC"));
        String message = "Certificate revocation after " + df.format(certStatus.getRevocationDate());
        message += ", reason: " + crlReasons[certStatus.getCertStatus()];
        throw new AnnotatedException(message);
    }
    if (!reasonsMask.isAllReasons() && certStatus.getCertStatus() == CertStatus.UNREVOKED) {
        certStatus.setCertStatus(CertStatus.UNDETERMINED);
    }
    if (certStatus.getCertStatus() == CertStatus.UNDETERMINED) {
        throw new AnnotatedException("Certificate status could not be determined.");
    }
}

Example 44 with DistributionPointName

use of com.github.zhenwei.core.asn1.x509.DistributionPointName in project LinLong-Java by zhenwei1108.

the class CertPathValidatorUtilities method getAdditionalStoresFromCRLDistributionPoint.

static List<PKIXCRLStore> getAdditionalStoresFromCRLDistributionPoint(CRLDistPoint crldp, Map<GeneralName, PKIXCRLStore> namedCRLStoreMap, Date validDate, JcaJceHelper helper) throws AnnotatedException {
    if (null == crldp) {
        return Collections.EMPTY_LIST;
    }
    DistributionPoint[] dps;
    try {
        dps = crldp.getDistributionPoints();
    } catch (Exception e) {
        throw new AnnotatedException("Distribution points could not be read.", e);
    }
    List<PKIXCRLStore> stores = new ArrayList<PKIXCRLStore>();
    for (int i = 0; i < dps.length; i++) {
        DistributionPointName dpn = dps[i].getDistributionPoint();
        // look for URIs in fullName
        if (dpn != null && dpn.getType() == DistributionPointName.FULL_NAME) {
            GeneralName[] genNames = GeneralNames.getInstance(dpn.getName()).getNames();
            for (int j = 0; j < genNames.length; j++) {
                PKIXCRLStore store = namedCRLStoreMap.get(genNames[j]);
                if (store != null) {
                    stores.add(store);
                }
            }
        }
    }
    // if the named CRL store is empty, and we're told to check with CRLDP
    if (stores.isEmpty() && Properties.isOverrideSet("com.github.zhenwei.provider.x509.enableCRLDP")) {
        CertificateFactory certFact;
        try {
            certFact = helper.createCertificateFactory("X.509");
        } catch (Exception e) {
            throw new AnnotatedException("cannot create certificate factory: " + e.getMessage(), e);
        }
        for (int i = 0; i < dps.length; i++) {
            DistributionPointName dpn = dps[i].getDistributionPoint();
            // look for URIs in fullName
            if (dpn != null && dpn.getType() == DistributionPointName.FULL_NAME) {
                GeneralName[] genNames = GeneralNames.getInstance(dpn.getName()).getNames();
                for (int j = 0; j < genNames.length; j++) {
                    GeneralName name = genNames[i];
                    if (name.getTagNo() == GeneralName.uniformResourceIdentifier) {
                        try {
                            URI distributionPoint = new URI(((ASN1String) name.getName()).getString());
                            PKIXCRLStore store = CrlCache.getCrl(certFact, validDate, distributionPoint);
                            if (store != null) {
                                stores.add(store);
                            }
                            break;
                        } catch (Exception e) {
                        // ignore...  TODO: maybe log
                        }
                    }
                }
            }
        }
    }
    return stores;
}

Example 45 with DistributionPointName

use of com.github.zhenwei.core.asn1.x509.DistributionPointName in project eblocker by eblocker.

the class CrlCacheCertStore method extractCrls.

private List<String> extractCrls(X509Certificate certificate) throws IOException {
    CRLDistPoint crlDistPoint = getCrlExtensions(certificate);
    if (crlDistPoint == null) {
        return Collections.emptyList();
    }
    List<String> urls = new ArrayList<>();
    for (DistributionPoint point : crlDistPoint.getDistributionPoints()) {
        DistributionPointName pointName = point.getDistributionPoint();
        if (pointName.getType() == DistributionPointName.FULL_NAME) {
            GeneralName[] names = ((GeneralNames) pointName.getName()).getNames();
            for (GeneralName name : names) {
                urls.add(DERIA5String.getInstance(name.getName()).getString());
            }
        }
    }
    return urls;
}