Examples with Subject io.strimzi.certs.Subject used on opensource projects

Example 1 with Subject

use of io.strimzi.certs.Subject in project strimzi by strimzi.

the class CertificateRenewalTest method generateCa.

private CertAndKey generateCa(OpenSslCertManager certManager, CertificateAuthority certificateAuthority, String commonName) throws IOException, CertificateException, KeyStoreException, NoSuchAlgorithmException {
    String clusterCaStorePassword = "123456";
    Path clusterCaKeyFile = Files.createTempFile("tls", "cluster-ca-key");
    Path clusterCaCertFile = Files.createTempFile("tls", "cluster-ca-cert");
    Path clusterCaStoreFile = Files.createTempFile("tls", "cluster-ca-store");
    try {
        Subject sbj = new Subject.Builder().withOrganizationName("io.strimzi").withCommonName(commonName).build();
        certManager.generateSelfSignedCert(clusterCaKeyFile.toFile(), clusterCaCertFile.toFile(), sbj, ModelUtils.getCertificateValidity(certificateAuthority));
        certManager.addCertToTrustStore(clusterCaCertFile.toFile(), CA_CRT, clusterCaStoreFile.toFile(), clusterCaStorePassword);
        return new CertAndKey(Files.readAllBytes(clusterCaKeyFile), Files.readAllBytes(clusterCaCertFile), Files.readAllBytes(clusterCaStoreFile), null, clusterCaStorePassword);
    } finally {
        Files.delete(clusterCaKeyFile);
        Files.delete(clusterCaCertFile);
        Files.delete(clusterCaStoreFile);
    }
}

Example 2 with Subject

use of io.strimzi.certs.Subject in project strimzi by strimzi.

the class Ca method generateSignedCert.

/**
 * Generates a certificate signed by this CA
 *
 * @param commonName The CN of the certificate to be generated.
 * @param organization The O of the certificate to be generated. May be null.
 * @return The CertAndKey
 * @throws IOException If the cert could not be generated.
 */
public CertAndKey generateSignedCert(String commonName, String organization) throws IOException {
    File csrFile = File.createTempFile("tls", "csr");
    File keyFile = File.createTempFile("tls", "key");
    File certFile = File.createTempFile("tls", "cert");
    File keyStoreFile = File.createTempFile("tls", "p12");
    Subject.Builder subject = new Subject.Builder();
    if (organization != null) {
        subject.withOrganizationName(organization);
    }
    subject.withCommonName(commonName);
    CertAndKey result = generateSignedCert(subject.build(), csrFile, keyFile, certFile, keyStoreFile);
    delete(reconciliation, csrFile);
    delete(reconciliation, keyFile);
    delete(reconciliation, certFile);
    delete(reconciliation, keyStoreFile);
    return result;
}

Example 3 with Subject

use of io.strimzi.certs.Subject in project strimzi by strimzi.

the class Ca method getSubjectAltNames.

/**
 * Extracts the alternate subject names out of existing certificate
 *
 * @param certificate Existing X509 certificate as a byte array
 * @return
 */
protected List<String> getSubjectAltNames(byte[] certificate) {
    List<String> subjectAltNames = null;
    try {
        X509Certificate cert = x509Certificate(certificate);
        Collection<List<?>> altNames = cert.getSubjectAlternativeNames();
        subjectAltNames = altNames.stream().filter(name -> name.get(1) instanceof String).map(item -> (String) item.get(1)).collect(Collectors.toList());
    } catch (CertificateException | RuntimeException e) {
        // TODO: We should mock the certificates properly so that this doesn't fail in tests (not now => long term :-o)
        LOGGER.debugCr(reconciliation, "Failed to parse existing certificate", e);
    }
    return subjectAltNames;
}

Example 4 with Subject

use of io.strimzi.certs.Subject in project strimzi by strimzi.

the class CaRenewalTest method renewalOfStatefulSetCertificatesDelayedRenewalOutsideWindow.

@ParallelTest
public void renewalOfStatefulSetCertificatesDelayedRenewalOutsideWindow() throws IOException {
    MockedCa mockedCa = new MockedCa(Reconciliation.DUMMY_RECONCILIATION, null, null, null, null, null, null, null, 2, 1, true, null);
    mockedCa.setCertExpiring(true);
    Secret initialSecret = new SecretBuilder().withNewMetadata().withName("test-secret").endMetadata().addToData("pod0.crt", Base64.getEncoder().encodeToString("old-cert".getBytes())).addToData("pod0.key", Base64.getEncoder().encodeToString("old-key".getBytes())).addToData("pod0.p12", Base64.getEncoder().encodeToString("old-keystore".getBytes())).addToData("pod0.password", Base64.getEncoder().encodeToString("old-password".getBytes())).addToData("pod1.crt", Base64.getEncoder().encodeToString("old-cert".getBytes())).addToData("pod1.key", Base64.getEncoder().encodeToString("old-key".getBytes())).addToData("pod1.p12", Base64.getEncoder().encodeToString("old-keystore".getBytes())).addToData("pod1.password", Base64.getEncoder().encodeToString("old-password".getBytes())).addToData("pod2.crt", Base64.getEncoder().encodeToString("old-cert".getBytes())).addToData("pod2.key", Base64.getEncoder().encodeToString("old-key".getBytes())).addToData("pod2.p12", Base64.getEncoder().encodeToString("old-keystore".getBytes())).addToData("pod2.password", Base64.getEncoder().encodeToString("old-password".getBytes())).build();
    int replicas = 3;
    Function<Integer, Subject> subjectFn = i -> new Subject.Builder().build();
    Function<Integer, String> podNameFn = i -> "pod" + i;
    boolean isMaintenanceTimeWindowsSatisfied = false;
    Map<String, CertAndKey> newCerts = mockedCa.maybeCopyOrGenerateCerts(Reconciliation.DUMMY_RECONCILIATION, replicas, subjectFn, initialSecret, podNameFn, isMaintenanceTimeWindowsSatisfied);
    assertThat(new String(newCerts.get("pod0").cert()), is("old-cert"));
    assertThat(new String(newCerts.get("pod0").key()), is("old-key"));
    assertThat(new String(newCerts.get("pod0").keyStore()), is("old-keystore"));
    assertThat(newCerts.get("pod0").storePassword(), is("old-password"));
    assertThat(new String(newCerts.get("pod1").cert()), is("old-cert"));
    assertThat(new String(newCerts.get("pod1").key()), is("old-key"));
    assertThat(new String(newCerts.get("pod1").keyStore()), is("old-keystore"));
    assertThat(newCerts.get("pod1").storePassword(), is("old-password"));
    assertThat(new String(newCerts.get("pod2").cert()), is("old-cert"));
    assertThat(new String(newCerts.get("pod2").key()), is("old-key"));
    assertThat(new String(newCerts.get("pod2").keyStore()), is("old-keystore"));
    assertThat(newCerts.get("pod2").storePassword(), is("old-password"));
}

Example 5 with Subject

use of io.strimzi.certs.Subject in project strimzi-kafka-operator by strimzi.

the class CaRenewalTest method renewalOfStatefulSetCertificatesWithCaRenewal.

@ParallelTest
public void renewalOfStatefulSetCertificatesWithCaRenewal() throws IOException {
    MockedCa mockedCa = new MockedCa(Reconciliation.DUMMY_RECONCILIATION, null, null, null, null, null, null, null, 2, 1, true, null);
    mockedCa.setCertRenewed(true);
    Secret initialSecret = new SecretBuilder().withNewMetadata().withName("test-secret").endMetadata().addToData("pod0.crt", Base64.getEncoder().encodeToString("old-cert".getBytes())).addToData("pod0.key", Base64.getEncoder().encodeToString("old-key".getBytes())).addToData("pod0.p12", Base64.getEncoder().encodeToString("old-keystore".getBytes())).addToData("pod0.password", Base64.getEncoder().encodeToString("old-password".getBytes())).addToData("pod1.crt", Base64.getEncoder().encodeToString("old-cert".getBytes())).addToData("pod1.key", Base64.getEncoder().encodeToString("old-key".getBytes())).addToData("pod1.p12", Base64.getEncoder().encodeToString("old-keystore".getBytes())).addToData("pod1.password", Base64.getEncoder().encodeToString("old-password".getBytes())).addToData("pod2.crt", Base64.getEncoder().encodeToString("old-cert".getBytes())).addToData("pod2.key", Base64.getEncoder().encodeToString("old-key".getBytes())).addToData("pod2.p12", Base64.getEncoder().encodeToString("old-keystore".getBytes())).addToData("pod2.password", Base64.getEncoder().encodeToString("old-password".getBytes())).build();
    int replicas = 3;
    Function<Integer, Subject> subjectFn = i -> new Subject.Builder().build();
    Function<Integer, String> podNameFn = i -> "pod" + i;
    boolean isMaintenanceTimeWindowsSatisfied = true;
    Map<String, CertAndKey> newCerts = mockedCa.maybeCopyOrGenerateCerts(Reconciliation.DUMMY_RECONCILIATION, replicas, subjectFn, initialSecret, podNameFn, isMaintenanceTimeWindowsSatisfied);
    assertThat(new String(newCerts.get("pod0").cert()), is("new-cert0"));
    assertThat(new String(newCerts.get("pod0").key()), is("new-key0"));
    assertThat(new String(newCerts.get("pod0").keyStore()), is("new-keystore0"));
    assertThat(newCerts.get("pod0").storePassword(), is("new-password0"));
    assertThat(new String(newCerts.get("pod1").cert()), is("new-cert1"));
    assertThat(new String(newCerts.get("pod1").key()), is("new-key1"));
    assertThat(new String(newCerts.get("pod1").keyStore()), is("new-keystore1"));
    assertThat(newCerts.get("pod1").storePassword(), is("new-password1"));
    assertThat(new String(newCerts.get("pod2").cert()), is("new-cert2"));
    assertThat(new String(newCerts.get("pod2").key()), is("new-key2"));
    assertThat(new String(newCerts.get("pod2").keyStore()), is("new-keystore2"));
    assertThat(newCerts.get("pod2").storePassword(), is("new-password2"));
}