Examples with CollectionCertStoreParameters java.security.cert.CollectionCertStoreParameters used on opensource projects

Example 61 with CollectionCertStoreParameters

use of java.security.cert.CollectionCertStoreParameters in project qpid-broker-j by apache.

the class AbstractTrustStore method getParameters.

private CertPathParameters getParameters(KeyStore trustStore) {
    try {
        final PKIXBuilderParameters parameters = new PKIXBuilderParameters(trustStore, new X509CertSelector());
        parameters.setRevocationEnabled(_certificateRevocationCheckEnabled);
        if (_certificateRevocationCheckEnabled) {
            if (_certificateRevocationListUrl != null) {
                parameters.addCertStore(CertStore.getInstance("Collection", new CollectionCertStoreParameters(getCRLs())));
            }
            final PKIXRevocationChecker revocationChecker = (PKIXRevocationChecker) CertPathBuilder.getInstance(TrustManagerFactory.getDefaultAlgorithm()).getRevocationChecker();
            final Set<PKIXRevocationChecker.Option> options = new HashSet<>();
            if (_certificateRevocationCheckOfOnlyEndEntityCertificates) {
                options.add(PKIXRevocationChecker.Option.ONLY_END_ENTITY);
            }
            if (_certificateRevocationCheckWithPreferringCertificateRevocationList) {
                options.add(PKIXRevocationChecker.Option.PREFER_CRLS);
            }
            if (_certificateRevocationCheckWithNoFallback) {
                options.add(PKIXRevocationChecker.Option.NO_FALLBACK);
            }
            if (_certificateRevocationCheckWithIgnoringSoftFailures) {
                options.add(PKIXRevocationChecker.Option.SOFT_FAIL);
            }
            revocationChecker.setOptions(options);
            parameters.addCertPathChecker(revocationChecker);
        }
        return parameters;
    } catch (NoSuchAlgorithmException | KeyStoreException | InvalidAlgorithmParameterException e) {
        throw new IllegalConfigurationException("Cannot create trust manager factory parameters for truststore '" + getName() + "' :" + e, e);
    }
}

Example 62 with CollectionCertStoreParameters

use of java.security.cert.CollectionCertStoreParameters in project qpid-broker-j by apache.

the class TrustAnchorValidatingTrustManager method getPkixCertPathBuilderResult.

private PKIXCertPathBuilderResult getPkixCertPathBuilderResult(final X509Certificate[] x509Certificates, final Set<TrustAnchor> trustAnchors, final Set<Certificate> otherCerts) throws GeneralSecurityException {
    Set<Certificate> storeCerts = new HashSet<>();
    storeCerts.addAll(otherCerts);
    Iterator<X509Certificate> iterator = Arrays.asList(x509Certificates).iterator();
    if (!iterator.hasNext()) {
        throw new IllegalArgumentException("Peer certificate not found");
    }
    final X509Certificate peerCertificate = iterator.next();
    while (iterator.hasNext()) {
        X509Certificate intermediate = iterator.next();
        storeCerts.add(intermediate);
    }
    X509CertSelector selector = new X509CertSelector();
    selector.setCertificate(peerCertificate);
    // IBM JDK seems to require that the peer's certficate exists in the Collection too
    storeCerts.add(peerCertificate);
    PKIXBuilderParameters pkixParams = new PKIXBuilderParameters(trustAnchors, selector);
    pkixParams.setRevocationEnabled(false);
    CertStore intermediateCertStore = CertStore.getInstance("Collection", new CollectionCertStoreParameters(storeCerts));
    pkixParams.addCertStore(intermediateCertStore);
    CertPathBuilder builder = CertPathBuilder.getInstance("PKIX");
    return (PKIXCertPathBuilderResult) builder.build(pkixParams);
}

Example 63 with CollectionCertStoreParameters

use of java.security.cert.CollectionCertStoreParameters in project mule by mulesoft.

the class CrlFile method configFor.

@Override
public ManagerFactoryParameters configFor(KeyStore trustStore, Set<TrustAnchor> defaultTrustAnchors) {
    checkArgument(path != null, "tls:crl-file requires the 'path' attribute");
    checkArgument(trustStore != null, "tls:crl-file requires a trust store");
    try {
        Set<TrustAnchor> trustAnchors = getTrustAnchorsFromKeyStore(trustStore);
        PKIXBuilderParameters pbParams = new PKIXBuilderParameters(trustAnchors, new X509CertSelector());
        // Make sure revocation checking is enabled (com.sun.net.ssl.checkRevocation)
        pbParams.setRevocationEnabled(true);
        Collection<? extends CRL> crls = loadCRL(path);
        if (crls != null && !crls.isEmpty()) {
            pbParams.addCertStore(CertStore.getInstance("Collection", new CollectionCertStoreParameters(crls)));
        }
        return new CertPathTrustManagerParameters(pbParams);
    } catch (IOException | GeneralSecurityException e) {
        throw new RuntimeException(e);
    }
}

Example 64 with CollectionCertStoreParameters

use of java.security.cert.CollectionCertStoreParameters in project Openfire by igniterealtime.

the class KeystoreTestUtils method testChain.

/**
 * This method will validate a chain of certificates. It is provided as an alternative to the certificate chain
 * validation mechanisms that are under test. This method is intended to be used as a comparative benchmark against
 * other validation methods.
 *
 * The first certificate in the chain is expected to be the end-entity certificate.
 *
 * The last certificate in the chain is expected to be the root CA certificate.
 *
 * @param chain A certificate chain (cannot be null or empty).
 * @return CertPathBuilderResult result of validation.
 * @throws Exception When the chain is not valid.
 */
public CertPathBuilderResult testChain(X509Certificate[] chain) throws Exception {
    // Create the selector that specifies the starting certificate
    X509CertSelector selector = new X509CertSelector();
    selector.setCertificate(chain[0]);
    // Create the trust anchors (set of root CA certificates)
    Set<TrustAnchor> trustAnchors = new HashSet<TrustAnchor>();
    trustAnchors.add(new TrustAnchor(chain[chain.length - 1], null));
    // Configure the PKIX certificate builder algorithm parameters
    PKIXBuilderParameters pkixParams = new PKIXBuilderParameters(trustAnchors, selector);
    // Disable CRL checks (this is done manually as additional step)
    pkixParams.setRevocationEnabled(false);
    // Specify a list of intermediate certificates
    Set<java.security.cert.Certificate> intermediateCerts = new HashSet<>();
    for (int i = 1; i < chain.length - 1; i++) {
        intermediateCerts.add(chain[i]);
    }
    CertStore intermediateCertStore = CertStore.getInstance("Collection", new CollectionCertStoreParameters(intermediateCerts));
    pkixParams.addCertStore(intermediateCertStore);
    // Build and verify the certification chain
    CertPathBuilder builder = CertPathBuilder.getInstance("PKIX");
    PKIXCertPathBuilderResult result = (PKIXCertPathBuilderResult) builder.build(pkixParams);
    return result;
}

Example 65 with CollectionCertStoreParameters

use of java.security.cert.CollectionCertStoreParameters in project neo4j by neo4j.

the class SslPolicyLoader method createTrustManagerFactory.

private static TrustManagerFactory createTrustManagerFactory(boolean trustAll, Collection<X509CRL> crls, KeyStore trustStore) throws Exception {
    if (trustAll) {
        return InsecureTrustManagerFactory.INSTANCE;
    }
    TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
    if (!crls.isEmpty()) {
        PKIXBuilderParameters pkixParamsBuilder = new PKIXBuilderParameters(trustStore, new X509CertSelector());
        pkixParamsBuilder.setRevocationEnabled(true);
        pkixParamsBuilder.addCertStore(CertStore.getInstance("Collection", new CollectionCertStoreParameters(crls)));
        trustManagerFactory.init(new CertPathTrustManagerParameters(pkixParamsBuilder));
    } else {
        trustManagerFactory.init(trustStore);
    }
    return trustManagerFactory;
}