Examples with GeneralNames com.github.zhenwei.core.asn1.x509.GeneralNames used on opensource projects

Example 91 with GeneralNames

use of com.github.zhenwei.core.asn1.x509.GeneralNames in project LinLong-Java by zhenwei1108.

the class X509CRLHolder method init.

private void init(CertificateList x509CRL) {
    this.x509CRL = x509CRL;
    this.extensions = x509CRL.getTBSCertList().getExtensions();
    this.isIndirect = isIndirectCRL(extensions);
    this.issuerName = new GeneralNames(new GeneralName(x509CRL.getIssuer()));
}

Example 92 with GeneralNames

use of com.github.zhenwei.core.asn1.x509.GeneralNames in project LinLong-Java by zhenwei1108.

the class AttributeCertificateIssuer method getNames.

public X500Name[] getNames() {
    GeneralNames name;
    if (form instanceof V2Form) {
        name = ((V2Form) form).getIssuerName();
    } else {
        name = (GeneralNames) form;
    }
    GeneralName[] names = name.getNames();
    List l = new ArrayList(names.length);
    for (int i = 0; i != names.length; i++) {
        if (names[i].getTagNo() == GeneralName.directoryName) {
            l.add(X500Name.getInstance(names[i].getName()));
        }
    }
    return (X500Name[]) l.toArray(new X500Name[l.size()]);
}

Example 93 with GeneralNames

use of com.github.zhenwei.core.asn1.x509.GeneralNames in project LinLong-Java by zhenwei1108.

the class ESSCertIDv2 method toASN1Primitive.

/**
 * <pre>
 * ESSCertIDv2 ::=  SEQUENCE {
 *     hashAlgorithm     AlgorithmIdentifier
 *              DEFAULT {algorithm id-sha256},
 *     certHash          Hash,
 *     issuerSerial      IssuerSerial OPTIONAL
 * }
 *
 * Hash ::= OCTET STRING
 *
 * IssuerSerial ::= SEQUENCE {
 *     issuer         GeneralNames,
 *     serialNumber   CertificateSerialNumber
 * }
 * </pre>
 */
public ASN1Primitive toASN1Primitive() {
    ASN1EncodableVector v = new ASN1EncodableVector(3);
    if (!hashAlgorithm.equals(DEFAULT_ALG_ID)) {
        v.add(hashAlgorithm);
    }
    v.add(new DEROctetString(certHash).toASN1Primitive());
    if (issuerSerial != null) {
        v.add(issuerSerial);
    }
    return new DERSequence(v);
}

Example 94 with GeneralNames

use of com.github.zhenwei.core.asn1.x509.GeneralNames in project LinLong-Java by zhenwei1108.

the class RFC3280CertPathUtilities method processCertBC.

protected static void processCertBC(CertPath certPath, int index, PKIXNameConstraintValidator nameConstraintValidator, boolean isForCRLCheck) throws CertPathValidatorException {
    List certs = certPath.getCertificates();
    X509Certificate cert = (X509Certificate) certs.get(index);
    int n = certs.size();
    // i as defined in the algorithm description
    int i = n - index;
    // checking.
    if (!(CertPathValidatorUtilities.isSelfIssued(cert) && ((i < n) || isForCRLCheck))) {
        X500Name principal = PrincipalUtils.getSubjectPrincipal(cert);
        ASN1Sequence dns;
        try {
            dns = ASN1Sequence.getInstance(principal);
        } catch (Exception e) {
            throw new CertPathValidatorException("Exception extracting subject name when checking subtrees.", e, certPath, index);
        }
        try {
            nameConstraintValidator.checkPermittedDN(dns);
            nameConstraintValidator.checkExcludedDN(dns);
        } catch (PKIXNameConstraintValidatorException e) {
            throw new CertPathValidatorException("Subtree check for certificate subject failed.", e, certPath, index);
        }
        GeneralNames altName = null;
        try {
            altName = GeneralNames.getInstance(CertPathValidatorUtilities.getExtensionValue(cert, RFC3280CertPathUtilities.SUBJECT_ALTERNATIVE_NAME));
        } catch (Exception e) {
            throw new CertPathValidatorException("Subject alternative name extension could not be decoded.", e, certPath, index);
        }
        RDN[] emails = X500Name.getInstance(dns).getRDNs(BCStyle.EmailAddress);
        for (int eI = 0; eI != emails.length; eI++) {
            // TODO: this should take into account multi-valued RDNs
            String email = ((ASN1String) emails[eI].getFirst().getValue()).getString();
            GeneralName emailAsGeneralName = new GeneralName(GeneralName.rfc822Name, email);
            try {
                nameConstraintValidator.checkPermitted(emailAsGeneralName);
                nameConstraintValidator.checkExcluded(emailAsGeneralName);
            } catch (PKIXNameConstraintValidatorException ex) {
                throw new CertPathValidatorException("Subtree check for certificate subject alternative email failed.", ex, certPath, index);
            }
        }
        if (altName != null) {
            GeneralName[] genNames = null;
            try {
                genNames = altName.getNames();
            } catch (Exception e) {
                throw new CertPathValidatorException("Subject alternative name contents could not be decoded.", e, certPath, index);
            }
            for (int j = 0; j < genNames.length; j++) {
                try {
                    nameConstraintValidator.checkPermitted(genNames[j]);
                    nameConstraintValidator.checkExcluded(genNames[j]);
                } catch (PKIXNameConstraintValidatorException e) {
                    throw new CertPathValidatorException("Subtree check for certificate subject alternative name failed.", e, certPath, index);
                }
            }
        }
    }
}

Example 95 with GeneralNames

use of com.github.zhenwei.core.asn1.x509.GeneralNames in project LinLong-Java by zhenwei1108.

the class RFC3281CertPathUtilities method checkCRLs.

/**
 * Checks if an attribute certificate is revoked.
 *
 * @param attrCert      Attribute certificate to check if it is revoked.
 * @param paramsPKIX    PKIX parameters.
 * @param validityDate  The date when the certificate revocation status should be checked.
 * @param issuerCert    The issuer certificate of the attribute certificate
 *                      <code>attrCert</code>.
 * @param certPathCerts The certificates of the certification path to be checked.
 * @throws CertPathValidatorException if the certificate is revoked or the status cannot be
 *                                    checked or some error occurs.
 */
protected static void checkCRLs(X509AttributeCertificate attrCert, PKIXExtendedParameters paramsPKIX, Date currentDate, Date validityDate, X509Certificate issuerCert, List certPathCerts, JcaJceHelper helper) throws CertPathValidatorException {
    if (paramsPKIX.isRevocationEnabled()) {
        // check if revocation is available
        if (attrCert.getExtensionValue(NO_REV_AVAIL) == null) {
            CRLDistPoint crldp = null;
            try {
                crldp = CRLDistPoint.getInstance(CertPathValidatorUtilities.getExtensionValue(attrCert, CRL_DISTRIBUTION_POINTS));
            } catch (AnnotatedException e) {
                throw new CertPathValidatorException("CRL distribution point extension could not be read.", e);
            }
            List crlStores = new ArrayList();
            try {
                crlStores.addAll(CertPathValidatorUtilities.getAdditionalStoresFromCRLDistributionPoint(crldp, paramsPKIX.getNamedCRLStoreMap(), validityDate, helper));
            } catch (AnnotatedException e) {
                throw new CertPathValidatorException("No additional CRL locations could be decoded from CRL distribution point extension.", e);
            }
            PKIXExtendedParameters.Builder bldr = new PKIXExtendedParameters.Builder(paramsPKIX);
            for (Iterator it = crlStores.iterator(); it.hasNext(); ) {
                bldr.addCRLStore((PKIXCRLStore) crlStores);
            }
            paramsPKIX = bldr.build();
            CertStatus certStatus = new CertStatus();
            ReasonsMask reasonsMask = new ReasonsMask();
            AnnotatedException lastException = null;
            boolean validCrlFound = false;
            // for each distribution point
            if (crldp != null) {
                DistributionPoint[] dps = null;
                try {
                    dps = crldp.getDistributionPoints();
                } catch (Exception e) {
                    throw new ExtCertPathValidatorException("Distribution points could not be read.", e);
                }
                try {
                    for (int i = 0; i < dps.length && certStatus.getCertStatus() == CertStatus.UNREVOKED && !reasonsMask.isAllReasons(); i++) {
                        PKIXExtendedParameters paramsPKIXClone = (PKIXExtendedParameters) paramsPKIX.clone();
                        checkCRL(dps[i], attrCert, paramsPKIXClone, currentDate, validityDate, issuerCert, certStatus, reasonsMask, certPathCerts, helper);
                        validCrlFound = true;
                    }
                } catch (AnnotatedException e) {
                    lastException = new AnnotatedException("No valid CRL for distribution point found.", e);
                }
            }
            if (certStatus.getCertStatus() == CertStatus.UNREVOKED && !reasonsMask.isAllReasons()) {
                try {
                    /*
             * assume a DP with both the reasons and the cRLIssuer
             * fields omitted and a distribution point name of the
             * certificate issuer.
             */
                    X500Name issuer;
                    try {
                        issuer = PrincipalUtils.getEncodedIssuerPrincipal(attrCert);
                    } catch (Exception e) {
                        throw new AnnotatedException("Issuer from certificate for CRL could not be reencoded.", e);
                    }
                    DistributionPoint dp = new DistributionPoint(new DistributionPointName(0, new GeneralNames(new GeneralName(GeneralName.directoryName, issuer))), null, null);
                    PKIXExtendedParameters paramsPKIXClone = (PKIXExtendedParameters) paramsPKIX.clone();
                    checkCRL(dp, attrCert, paramsPKIXClone, currentDate, validityDate, issuerCert, certStatus, reasonsMask, certPathCerts, helper);
                    validCrlFound = true;
                } catch (AnnotatedException e) {
                    lastException = new AnnotatedException("No valid CRL for distribution point found.", e);
                }
            }
            if (!validCrlFound) {
                throw new ExtCertPathValidatorException("No valid CRL found.", lastException);
            }
            if (certStatus.getCertStatus() != CertStatus.UNREVOKED) {
                String message = "Attribute certificate revocation after " + certStatus.getRevocationDate();
                message += ", reason: " + RFC3280CertPathUtilities.crlReasons[certStatus.getCertStatus()];
                throw new CertPathValidatorException(message);
            }
            if (!reasonsMask.isAllReasons() && certStatus.getCertStatus() == CertStatus.UNREVOKED) {
                certStatus.setCertStatus(CertStatus.UNDETERMINED);
            }
            if (certStatus.getCertStatus() == CertStatus.UNDETERMINED) {
                throw new CertPathValidatorException("Attribute certificate status could not be determined.");
            }
        } else {
            if (attrCert.getExtensionValue(CRL_DISTRIBUTION_POINTS) != null || attrCert.getExtensionValue(AUTHORITY_INFO_ACCESS) != null) {
                throw new CertPathValidatorException("No rev avail extension is set, but also an AC revocation pointer.");
            }
        }
    }
}