Examples with GeneralNames de.carne.certmgr.certs.x509.GeneralNames used on opensource projects

Example 96 with GeneralNames

use of de.carne.certmgr.certs.x509.GeneralNames in project keystore-explorer by kaikramer.

the class DIssuerAlternativeName method okPressed.

private void okPressed() {
    GeneralNames issuerAlternativeName = jgnAlternativeName.getGeneralNames();
    if (issuerAlternativeName.getNames().length == 0) {
        JOptionPane.showMessageDialog(this, res.getString("DIssuerAlternativeName.ValueReq.message"), getTitle(), JOptionPane.WARNING_MESSAGE);
        return;
    }
    try {
        value = issuerAlternativeName.getEncoded(ASN1Encoding.DER);
    } catch (IOException ex) {
        DError dError = new DError(this, ex);
        dError.setLocationRelativeTo(this);
        dError.setVisible(true);
        return;
    }
    closeDialog();
}

Example 97 with GeneralNames

use of de.carne.certmgr.certs.x509.GeneralNames in project dcos-commons by mesosphere.

the class CertificateNamesGeneratorTest method testDiscoveryNameAddedAsSan.

@Test
public void testDiscoveryNameAddedAsSan() {
    Mockito.when(mockTaskSpec.getDiscovery()).thenReturn(Optional.of(mockDiscoverySpec));
    Mockito.when(mockDiscoverySpec.getPrefix()).thenReturn(Optional.of("custom-name"));
    CertificateNamesGenerator certificateNamesGenerator = new CertificateNamesGenerator(TestConstants.SERVICE_NAME, mockTaskSpec, mockPodInstance, mockSchedulerConfig);
    GeneralNames sans = certificateNamesGenerator.getSANs();
    Assert.assertEquals(1, sans.getNames().length);
    List<String> names = Arrays.stream(sans.getNames()).map(name -> name.getName().toString()).collect(Collectors.toList());
    Assert.assertEquals(1, names.size());
    Assert.assertTrue(names.contains(String.format("custom-name-0.%s.%s", TestConstants.SERVICE_NAME, Constants.DNS_TLD)));
    // echo -n "custom-name-0.service-name.autoip.dcos.thisdcos.directory" | sha1sum
    Assert.assertEquals("6ce3490a694a0917beec2bd5f7ac978be7a59ef0", certificateNamesGenerator.getSANsHash());
}

Example 98 with GeneralNames

use of de.carne.certmgr.certs.x509.GeneralNames in project dcos-commons by mesosphere.

the class CertificateNamesGeneratorTest method testVipsAddedAsSans.

@Test
public void testVipsAddedAsSans() {
    Mockito.when(mockResourceSet.getResources()).thenReturn(Collections.singletonList(mockVIPSpec));
    Mockito.when(mockVIPSpec.getVipName()).thenReturn("test-vip");
    Mockito.when(mockVIPSpec.getPort()).thenReturn(8000L);
    CertificateNamesGenerator certificateNamesGenerator = new CertificateNamesGenerator(TestConstants.SERVICE_NAME, mockTaskSpec, mockPodInstance, mockSchedulerConfig);
    GeneralNames sans = certificateNamesGenerator.getSANs();
    Assert.assertEquals(2, sans.getNames().length);
    List<String> names = Arrays.stream(sans.getNames()).map(name -> name.getName().toString()).collect(Collectors.toList());
    Assert.assertEquals(2, names.size());
    Assert.assertTrue(names.contains(taskDnsName(TestConstants.TASK_NAME, TestConstants.SERVICE_NAME)));
    Assert.assertTrue(names.contains(taskVipName("test-vip", TestConstants.SERVICE_NAME)));
    // echo -n "some-pod-test-task-name.service-name.autoip.dcos.thisdcos.directory;test-vip.service-name.l4lb.thisdcos.directory" | sha1sum
    Assert.assertEquals("99f8ec48101c439ce41eb62662056dc0ff5d227a", certificateNamesGenerator.getSANsHash());
}

Example 99 with GeneralNames

use of de.carne.certmgr.certs.x509.GeneralNames in project open-ecard by ecsec.

the class HostnameVerifier method validInt.

private void validInt(Certificate cert, String hostOrIp) throws CertificateVerificationException {
    boolean success = false;
    boolean isIPAddr = IPAddress.isValid(hostOrIp);
    // check hostname against Subject CN
    if (!isIPAddr) {
        RDN[] cn = cert.getSubject().getRDNs(BCStrictStyle.CN);
        if (cn.length != 0) {
            // CN is always a string type
            String hostNameReference = cn[0].getFirst().getValue().toString();
            success = checkWildcardName(hostOrIp, hostNameReference);
        } else {
            LOG.debug("No CN entry in certificate's Subject.");
        }
    } else {
        LOG.debug("Given name is an IP Address. Validation relies solely on the SubjectAlternativeName.");
    }
    // stop execution when we found a valid name
    if (success) {
        return;
    }
    // evaluate subject alternative name
    Extensions ext = cert.getTBSCertificate().getExtensions();
    Extension subjAltExt = ext.getExtension(Extension.subjectAlternativeName);
    if (subjAltExt != null) {
        // extract SubjAltName from Extensions
        GeneralNames gns = GeneralNames.fromExtensions(ext, Extension.subjectAlternativeName);
        GeneralName[] names = gns.getNames();
        for (GeneralName name : names) {
            ASN1Encodable reference = name.getName();
            switch(name.getTagNo()) {
                case GeneralName.dNSName:
                    if (!isIPAddr) {
                        success = checkWildcardName(hostOrIp, reference.toString());
                    }
                    break;
                case GeneralName.iPAddress:
                    if (isIPAddr) {
                        // TODO: validate IP Addresses
                        LOG.warn("IP Address verification not supported.");
                    }
                    break;
                default:
                    LOG.debug("Unsupported GeneralName ({}) tag in SubjectAlternativeName.", name.getTagNo());
            }
            // stop execution when we found a valid name
            if (success) {
                return;
            }
        }
    }
    // evaluate result
    if (!success) {
        String errorMsg = "Hostname in certificate differs from actually requested host.";
        throw new CertificateVerificationException(errorMsg);
    }
}

Example 100 with GeneralNames

use of de.carne.certmgr.certs.x509.GeneralNames in project jruby-openssl by jruby.

the class X509ExtensionFactory method parseAuthorityKeyIdentifier.

private ASN1Sequence parseAuthorityKeyIdentifier(final ThreadContext context, final String valuex) {
    final ASN1EncodableVector vec = new ASN1EncodableVector();
    for (String value : valuex.split(",")) {
        // e.g. "keyid:always,issuer:always"
        if (value.startsWith("keyid:")) {
            // keyid:always
            ASN1Encodable publicKeyIdentifier = new DEROctetString(publicKeyIdentifier(context));
            vec.add(new DERTaggedObject(false, 0, publicKeyIdentifier));
        } else if (value.startsWith("issuer:")) {
            // issuer:always
            GeneralName issuerName = new GeneralName(authorityCertIssuer(context));
            vec.add(new DERTaggedObject(false, 1, new GeneralNames(issuerName)));
            BigInteger issuerSerial = getIssuerSerialNumber(context);
            if (issuerSerial != null) {
                vec.add(new DERTaggedObject(false, 2, new ASN1Integer(issuerSerial)));
            }
        }
    }
    return new DERSequence(vec);
}