Examples with KeyUsage com.github.zhenwei.core.asn1.x509.KeyUsage used on opensource projects

Example 91 with KeyUsage

use of com.github.zhenwei.core.asn1.x509.KeyUsage in project nifi-registry by apache.

the class CertificateUtils method generateSelfSignedX509Certificate.

/**
 * Generates a self-signed {@link X509Certificate} suitable for use as a Certificate Authority.
 *
 * @param keyPair                 the {@link KeyPair} to generate the {@link X509Certificate} for
 * @param dn                      the distinguished name to user for the {@link X509Certificate}
 * @param signingAlgorithm        the signing algorithm to use for the {@link X509Certificate}
 * @param certificateDurationDays the duration in days for which the {@link X509Certificate} should be valid
 * @return a self-signed {@link X509Certificate} suitable for use as a Certificate Authority
 * @throws CertificateException      if there is an generating the new certificate
 */
public static X509Certificate generateSelfSignedX509Certificate(KeyPair keyPair, String dn, String signingAlgorithm, int certificateDurationDays) throws CertificateException {
    try {
        ContentSigner sigGen = new JcaContentSignerBuilder(signingAlgorithm).setProvider(BouncyCastleProvider.PROVIDER_NAME).build(keyPair.getPrivate());
        SubjectPublicKeyInfo subPubKeyInfo = SubjectPublicKeyInfo.getInstance(keyPair.getPublic().getEncoded());
        Date startDate = new Date();
        Date endDate = new Date(startDate.getTime() + TimeUnit.DAYS.toMillis(certificateDurationDays));
        X509v3CertificateBuilder certBuilder = new X509v3CertificateBuilder(reverseX500Name(new X500Name(dn)), getUniqueSerialNumber(), startDate, endDate, reverseX500Name(new X500Name(dn)), subPubKeyInfo);
        // Set certificate extensions
        // (1) digitalSignature extension
        certBuilder.addExtension(Extension.keyUsage, true, new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyEncipherment | KeyUsage.dataEncipherment | KeyUsage.keyAgreement | KeyUsage.nonRepudiation | KeyUsage.cRLSign | KeyUsage.keyCertSign));
        certBuilder.addExtension(Extension.basicConstraints, false, new BasicConstraints(true));
        certBuilder.addExtension(Extension.subjectKeyIdentifier, false, new JcaX509ExtensionUtils().createSubjectKeyIdentifier(keyPair.getPublic()));
        certBuilder.addExtension(Extension.authorityKeyIdentifier, false, new JcaX509ExtensionUtils().createAuthorityKeyIdentifier(keyPair.getPublic()));
        // (2) extendedKeyUsage extension
        certBuilder.addExtension(Extension.extendedKeyUsage, false, new ExtendedKeyUsage(new KeyPurposeId[] { KeyPurposeId.id_kp_clientAuth, KeyPurposeId.id_kp_serverAuth }));
        // Sign the certificate
        X509CertificateHolder certificateHolder = certBuilder.build(sigGen);
        return new JcaX509CertificateConverter().setProvider(BouncyCastleProvider.PROVIDER_NAME).getCertificate(certificateHolder);
    } catch (CertIOException | NoSuchAlgorithmException | OperatorCreationException e) {
        throw new CertificateException(e);
    }
}

Example 92 with KeyUsage

use of com.github.zhenwei.core.asn1.x509.KeyUsage in project ozone by apache.

the class SelfSignedCertificate method generateCertificate.

private X509CertificateHolder generateCertificate(boolean isCA) throws OperatorCreationException, IOException {
    // For the Root Certificate we form the name from Subject, SCM ID and
    // Cluster ID.
    String dnName = String.format(getNameFormat(), subject, scmID, clusterID);
    X500Name name = new X500Name(dnName);
    byte[] encoded = key.getPublic().getEncoded();
    SubjectPublicKeyInfo publicKeyInfo = SubjectPublicKeyInfo.getInstance(encoded);
    ContentSigner contentSigner = new JcaContentSignerBuilder(config.getSignatureAlgo()).setProvider(config.getProvider()).build(key.getPrivate());
    // Please note: Since this is a root certificate we use "ONE" as the
    // serial number. Also note that skip enforcing locale or UTC. We are
    // trying to operate at the Days level, hence Time zone is also skipped for
    // now.
    BigInteger serial = BigInteger.ONE;
    if (!isCA) {
        serial = new BigInteger(Long.toString(Time.monotonicNow()));
    }
    ZoneOffset zoneOffset = beginDate.atStartOfDay(ZoneOffset.systemDefault()).getOffset();
    // Valid from the Start of the day when we generate this Certificate.
    Date validFrom = Date.from(beginDate.atTime(LocalTime.MIN).toInstant(zoneOffset));
    // Valid till end day finishes.
    Date validTill = Date.from(endDate.atTime(LocalTime.MAX).toInstant(zoneOffset));
    X509v3CertificateBuilder builder = new X509v3CertificateBuilder(name, serial, validFrom, validTill, name, publicKeyInfo);
    if (isCA) {
        builder.addExtension(Extension.basicConstraints, true, new BasicConstraints(true));
        int keyUsageFlag = KeyUsage.keyCertSign | KeyUsage.cRLSign;
        KeyUsage keyUsage = new KeyUsage(keyUsageFlag);
        builder.addExtension(Extension.keyUsage, true, keyUsage);
        if (altNames != null && altNames.size() >= 1) {
            builder.addExtension(new Extension(Extension.subjectAlternativeName, false, new GeneralNames(altNames.toArray(new GeneralName[altNames.size()])).getEncoded()));
        }
    }
    return builder.build(contentSigner);
}