Examples with Extensions com.github.zhenwei.core.asn1.x509.Extensions used on opensource projects

Example 96 with Extensions

use of com.github.zhenwei.core.asn1.x509.Extensions in project LinLong-Java by zhenwei1108.

the class CertUtils method doReplaceExtension.

static ExtensionsGenerator doReplaceExtension(ExtensionsGenerator extGenerator, Extension ext) {
    boolean isReplaced = false;
    Extensions exts = extGenerator.generate();
    extGenerator = new ExtensionsGenerator();
    for (Enumeration en = exts.oids(); en.hasMoreElements(); ) {
        ASN1ObjectIdentifier extOid = (ASN1ObjectIdentifier) en.nextElement();
        if (extOid.equals(ext.getExtnId())) {
            isReplaced = true;
            extGenerator.addExtension(ext);
        } else {
            extGenerator.addExtension(exts.getExtension(extOid));
        }
    }
    if (!isReplaced) {
        throw new IllegalArgumentException("replace - original extension (OID = " + ext.getExtnId() + ") not found");
    }
    return extGenerator;
}

Example 97 with Extensions

use of com.github.zhenwei.core.asn1.x509.Extensions in project LinLong-Java by zhenwei1108.

the class X509CRLHolder method init.

private void init(CertificateList x509CRL) {
    this.x509CRL = x509CRL;
    this.extensions = x509CRL.getTBSCertList().getExtensions();
    this.isIndirect = isIndirectCRL(extensions);
    this.issuerName = new GeneralNames(new GeneralName(x509CRL.getIssuer()));
}

Example 98 with Extensions

use of com.github.zhenwei.core.asn1.x509.Extensions in project LinLong-Java by zhenwei1108.

the class RevDetails method toASN1Primitive.

/**
 * <pre>
 * RevDetails ::= SEQUENCE {
 *                  certDetails         CertTemplate,
 *                   -- allows requester to specify as much as they can about
 *                   -- the cert. for which revocation is requested
 *                   -- (e.g., for cases in which serialNumber is not available)
 *                   crlEntryDetails     Extensions       OPTIONAL
 *                   -- requested crlEntryExtensions
 *             }
 * </pre>
 *
 * @return a basic ASN.1 object representation.
 */
public ASN1Primitive toASN1Primitive() {
    ASN1EncodableVector v = new ASN1EncodableVector(2);
    v.add(certDetails);
    if (crlEntryDetails != null) {
        v.add(crlEntryDetails);
    }
    return new DERSequence(v);
}

Example 99 with Extensions

use of com.github.zhenwei.core.asn1.x509.Extensions in project LinLong-Java by zhenwei1108.

the class DVCSRequestInformation method toASN1Primitive.

public ASN1Primitive toASN1Primitive() {
    ASN1EncodableVector v = new ASN1EncodableVector(9);
    if (version != DEFAULT_VERSION) {
        v.add(new ASN1Integer(version));
    }
    v.add(service);
    if (nonce != null) {
        v.add(new ASN1Integer(nonce));
    }
    if (requestTime != null) {
        v.add(requestTime);
    }
    int[] tags = new int[] { TAG_REQUESTER, TAG_REQUEST_POLICY, TAG_DVCS, TAG_DATA_LOCATIONS, TAG_EXTENSIONS };
    ASN1Encodable[] taggedObjects = new ASN1Encodable[] { requester, requestPolicy, dvcs, dataLocations, extensions };
    for (int i = 0; i < tags.length; i++) {
        int tag = tags[i];
        ASN1Encodable taggedObject = taggedObjects[i];
        if (taggedObject != null) {
            v.add(new DERTaggedObject(false, tag, taggedObject));
        }
    }
    return new DERSequence(v);
}

Example 100 with Extensions

use of com.github.zhenwei.core.asn1.x509.Extensions in project LinLong-Java by zhenwei1108.

the class ProvOcspRevocationChecker method validatedOcspResponse.

static boolean validatedOcspResponse(BasicOCSPResponse basicResp, PKIXCertRevocationCheckerParameters parameters, byte[] nonce, X509Certificate responderCert, JcaJceHelper helper) throws CertPathValidatorException {
    try {
        ASN1Sequence certs = basicResp.getCerts();
        Signature sig = helper.createSignature(getSignatureName(basicResp.getSignatureAlgorithm()));
        X509Certificate sigCert = getSignerCert(basicResp, parameters.getSigningCert(), responderCert, helper);
        if (sigCert == null && certs == null) {
            throw new CertPathValidatorException("OCSP responder certificate not found");
        }
        if (sigCert != null) {
            sig.initVerify(sigCert.getPublicKey());
        } else {
            CertificateFactory cf = helper.createCertificateFactory("X.509");
            X509Certificate ocspCert = (X509Certificate) cf.generateCertificate(new ByteArrayInputStream(certs.getObjectAt(0).toASN1Primitive().getEncoded()));
            // check cert signed by CA
            ocspCert.verify(parameters.getSigningCert().getPublicKey());
            // check cert valid
            ocspCert.checkValidity(parameters.getValidDate());
            // check ID
            if (!responderMatches(basicResp.getTbsResponseData().getResponderID(), ocspCert, helper)) {
                throw new CertPathValidatorException("responder certificate does not match responderID", null, parameters.getCertPath(), parameters.getIndex());
            }
            // TODO: RFC 6960 allows for a "no check" extension - where present it means the CA says the cert
            // will remain valid for it's lifetime. If any caching is added here that should be taken into account.
            // check we are valid
            List extendedKeyUsage = ocspCert.getExtendedKeyUsage();
            if (extendedKeyUsage == null || !extendedKeyUsage.contains(KeyPurposeId.id_kp_OCSPSigning.getId())) {
                throw new CertPathValidatorException("responder certificate not valid for signing OCSP responses", null, parameters.getCertPath(), parameters.getIndex());
            }
            sig.initVerify(ocspCert);
        }
        sig.update(basicResp.getTbsResponseData().getEncoded(ASN1Encoding.DER));
        if (sig.verify(basicResp.getSignature().getBytes())) {
            if (nonce != null) {
                Extensions exts = basicResp.getTbsResponseData().getResponseExtensions();
                com.github.zhenwei.core.asn1.x509.Extension ext = exts.getExtension(OCSPObjectIdentifiers.id_pkix_ocsp_nonce);
                if (!Arrays.areEqual(nonce, ext.getExtnValue().getOctets())) {
                    throw new CertPathValidatorException("nonce mismatch in OCSP response", null, parameters.getCertPath(), parameters.getIndex());
                }
            }
            return true;
        }
        return false;
    } catch (CertPathValidatorException e) {
        throw e;
    } catch (GeneralSecurityException e) {
        throw new CertPathValidatorException("OCSP response failure: " + e.getMessage(), e, parameters.getCertPath(), parameters.getIndex());
    } catch (IOException e) {
        throw new CertPathValidatorException("OCSP response failure: " + e.getMessage(), e, parameters.getCertPath(), parameters.getIndex());
    }
}