Examples with CertProviderException de.carne.certmgr.certs.CertProviderException used on opensource projects

Example 1 with CertProviderException

use of de.carne.certmgr.certs.CertProviderException in project certmgr by hdecarne.

the class DERCertReaderWriter method tryDecodeKey.

@Nullable
private static KeyPair tryDecodeKey(ASN1Primitive asn1Object, String resource, PasswordCallback password) throws IOException {
    PKCS8EncryptedPrivateKeyInfo encryptedPrivateKeyInfo = null;
    try {
        encryptedPrivateKeyInfo = new PKCS8EncryptedPrivateKeyInfo(EncryptedPrivateKeyInfo.getInstance(asn1Object));
    } catch (Exception e) {
        Exceptions.ignore(e);
    }
    PrivateKeyInfo privateKeyInfo = null;
    if (encryptedPrivateKeyInfo != null) {
        Throwable passwordException = null;
        while (privateKeyInfo == null) {
            char[] passwordChars = password.queryPassword(resource);
            if (passwordChars == null) {
                throw new PasswordRequiredException(resource, passwordException);
            }
            InputDecryptorProvider inputDecryptorProvider = INPUT_DECRYPTOR_BUILDER.build(passwordChars);
            try {
                privateKeyInfo = encryptedPrivateKeyInfo.decryptPrivateKeyInfo(inputDecryptorProvider);
            } catch (PKCSException e) {
                passwordException = e;
            }
        }
    }
    try {
        privateKeyInfo = PrivateKeyInfo.getInstance(asn1Object);
    } catch (Exception e) {
        Exceptions.ignore(e);
    }
    KeyPair key = null;
    if (privateKeyInfo != null) {
        PrivateKey privateKey;
        try {
            String algorithmId = privateKeyInfo.getPrivateKeyAlgorithm().getAlgorithm().getId();
            KeyFactory keyFactory = JCA_JCE_HELPER.createKeyFactory(algorithmId);
            PKCS8EncodedKeySpec keySpec = new PKCS8EncodedKeySpec(privateKeyInfo.getEncoded());
            privateKey = keyFactory.generatePrivate(keySpec);
        } catch (GeneralSecurityException e) {
            throw new CertProviderException(e);
        }
        key = KeyHelper.rebuildKeyPair(privateKey);
    }
    return key;
}

Example 2 with CertProviderException

use of de.carne.certmgr.certs.CertProviderException in project certmgr by hdecarne.

the class PKCS12CertReaderWriter method writeEncryptedBinary.

@Override
public void writeEncryptedBinary(IOResource<OutputStream> out, CertObjectStore certObjects, PasswordCallback newPassword) throws IOException {
    char[] passwordChars = newPassword.queryPassword(out.resource());
    if (passwordChars == null) {
        throw new PasswordRequiredException(out.resource());
    }
    try {
        List<PKCS12SafeBagBuilder> safeBagBuilders = new ArrayList<>(certObjects.size());
        for (CertObjectStore.Entry certObject : certObjects) {
            switch(certObject.type()) {
                case CRT:
                    safeBagBuilders.add(createCRTSafeBagBuilder(certObject.alias(), certObject.getCRT(), safeBagBuilders.isEmpty()));
                    break;
                case KEY:
                    safeBagBuilders.add(createKeySafeBagBuilder(certObject.alias(), certObject.getKey(), passwordChars));
                    break;
                case CSR:
                    break;
                case CRL:
                    break;
            }
        }
        PKCS12PfxPduBuilder pkcs12Builder = new PKCS12PfxPduBuilder();
        for (PKCS12SafeBagBuilder safeBagBuilder : safeBagBuilders) {
            pkcs12Builder.addData(safeBagBuilder.build());
        }
        PKCS12PfxPdu pkcs12 = pkcs12Builder.build(new BcPKCS12MacCalculatorBuilder(), passwordChars);
        out.io().write(pkcs12.getEncoded());
    } catch (GeneralSecurityException | PKCSException e) {
        throw new CertProviderException(e);
    }
}

Example 3 with CertProviderException

use of de.carne.certmgr.certs.CertProviderException in project certmgr by hdecarne.

the class PKCS12CertReaderWriter method writeBinary.

@Override
public void writeBinary(IOResource<OutputStream> out, CertObjectStore certObjects) throws IOException, UnsupportedOperationException {
    try {
        List<PKCS12SafeBagBuilder> safeBagBuilders = new ArrayList<>(certObjects.size());
        for (CertObjectStore.Entry certObject : certObjects) {
            switch(certObject.type()) {
                case CRT:
                    safeBagBuilders.add(createCRTSafeBagBuilder(certObject.alias(), certObject.getCRT(), safeBagBuilders.isEmpty()));
                    break;
                case KEY:
                    safeBagBuilders.add(createKeySafeBagBuilder(certObject.alias(), certObject.getKey()));
                    break;
                case CSR:
                    break;
                case CRL:
                    break;
            }
        }
        PKCS12PfxPduBuilder pkcs12Builder = new PKCS12PfxPduBuilder();
        for (PKCS12SafeBagBuilder safeBagBuilder : safeBagBuilders) {
            pkcs12Builder.addData(safeBagBuilder.build());
        }
        PKCS12PfxPdu pkcs12 = pkcs12Builder.build(null, null);
        out.io().write(pkcs12.getEncoded());
    } catch (GeneralSecurityException | PKCSException e) {
        throw new CertProviderException(e);
    }
}

Example 4 with CertProviderException

use of de.carne.certmgr.certs.CertProviderException in project certmgr by hdecarne.

the class X509CertificateHelper method generateCRT.

/**
 * Generate a CRT object.
 *
 * @param dn The CRT's Distinguished Name (DN).
 * @param key The CRT's key pair
 * @param serial The CRT's serial.
 * @param notBefore The CRT's validity start.
 * @param notAfter The CRT's validity end.
 * @param extensions The CRT's extension objects.
 * @param issuerDN The issuer's Distinguished Name (DN).
 * @param issuerKey The issuer's key pair.
 * @param signatureAlgorithm The signature algorithm to use.
 * @return The generated CRT object.
 * @throws IOException if an error occurs during generation.
 */
public static X509Certificate generateCRT(X500Principal dn, KeyPair key, BigInteger serial, Date notBefore, Date notAfter, List<X509ExtensionData> extensions, X500Principal issuerDN, KeyPair issuerKey, SignatureAlgorithm signatureAlgorithm) throws IOException {
    LOG.info("CRT generation ''{0}'' started...", dn);
    // Initialize CRT builder
    X509v3CertificateBuilder crtBuilder = new JcaX509v3CertificateBuilder(issuerDN, serial, notBefore, notAfter, dn, key.getPublic());
    // Add custom extension objects
    for (X509ExtensionData extensionData : extensions) {
        String oid = extensionData.oid();
        if (!oid.equals(Extension.subjectKeyIdentifier) && !oid.equals(Extension.authorityKeyIdentifier)) {
            boolean critical = extensionData.getCritical();
            crtBuilder.addExtension(new ASN1ObjectIdentifier(oid), critical, extensionData.encode());
        } else {
            LOG.warning("Ignoring key identifier extension");
        }
    }
    X509Certificate crt;
    try {
        // Add standard extensions based upon the CRT's purpose
        JcaX509ExtensionUtils extensionUtils = new JcaX509ExtensionUtils();
        for (X509ExtensionData extensionData : extensions) {
            if (extensionData instanceof BasicConstraintsExtensionData) {
                BasicConstraintsExtensionData basicConstraintsExtension = (BasicConstraintsExtensionData) extensionData;
                if (basicConstraintsExtension.getCA()) {
                    // CRT is CA --> record it's key's identifier
                    crtBuilder.addExtension(Extension.subjectKeyIdentifier, false, extensionUtils.createSubjectKeyIdentifier(key.getPublic()));
                }
            }
        }
        if (!key.equals(issuerKey)) {
            // CRT is not self-signed --> record issuer key's identifier
            crtBuilder.addExtension(Extension.authorityKeyIdentifier, false, extensionUtils.createAuthorityKeyIdentifier(issuerKey.getPublic()));
        }
        // Sign CRT
        ContentSigner crtSigner = new JcaContentSignerBuilder(signatureAlgorithm.algorithm()).build(issuerKey.getPrivate());
        crt = new JcaX509CertificateConverter().getCertificate(crtBuilder.build(crtSigner));
    } catch (OperatorCreationException | GeneralSecurityException e) {
        throw new CertProviderException(e);
    }
    LOG.info("CRT generation ''{0}'' done", dn);
    return crt;
}

Example 5 with CertProviderException

use of de.carne.certmgr.certs.CertProviderException in project certmgr by hdecarne.

the class PKCS10CertificateRequest method fromPKCS10.

/**
 * Construct {@code PKCS10CertificateRequest} from a PKCS#10 object.
 *
 * @param pkcs10 The PCKS#10 object.
 * @return The constructed {@code PKCS10CertificateRequest}.
 * @throws IOException if an I/O error occurs while accessing the PKCS#10 object.
 */
public static PKCS10CertificateRequest fromPKCS10(PKCS10CertificationRequest pkcs10) throws IOException {
    JcaPKCS10CertificationRequest csr;
    X500Principal subject;
    PublicKey publicKey;
    Map<String, byte[]> criticalExtensions = new HashMap<>();
    Map<String, byte[]> nonCriticalExtensions = new HashMap<>();
    try {
        if (pkcs10 instanceof JcaPKCS10CertificationRequest) {
            csr = (JcaPKCS10CertificationRequest) pkcs10;
        } else {
            csr = new JcaPKCS10CertificationRequest(pkcs10);
        }
        subject = new X500Principal(csr.getSubject().getEncoded());
        publicKey = csr.getPublicKey();
        Attribute[] extensionAttributes = csr.getAttributes(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest);
        if (extensionAttributes != null) {
            for (Attribute extensionAttribute : extensionAttributes) {
                ASN1Encodable[] values = extensionAttribute.getAttributeValues();
                if (values != null) {
                    for (ASN1Encodable value : values) {
                        ASN1Primitive[] extensionPrimitives = decodeSequence(value.toASN1Primitive(), 0, Integer.MAX_VALUE);
                        for (ASN1Primitive extensionPrimitive : extensionPrimitives) {
                            ASN1Primitive[] sequence = decodeSequence(extensionPrimitive, 2, 3);
                            String extensionOID = decodePrimitive(sequence[0], ASN1ObjectIdentifier.class).getId();
                            boolean criticalFlag = true;
                            byte[] extensionData;
                            if (sequence.length == 3) {
                                criticalFlag = decodePrimitive(sequence[1], ASN1Boolean.class).isTrue();
                                extensionData = sequence[2].getEncoded();
                            } else {
                                extensionData = sequence[1].getEncoded();
                            }
                            if (criticalFlag) {
                                criticalExtensions.put(extensionOID, extensionData);
                            } else {
                                nonCriticalExtensions.put(extensionOID, extensionData);
                            }
                        }
                    }
                }
            }
        }
    } catch (GeneralSecurityException e) {
        throw new CertProviderException(e);
    }
    return new PKCS10CertificateRequest(csr, subject, publicKey, criticalExtensions, nonCriticalExtensions);
}