Examples with X509CRL java.security.cert.X509CRL used on opensource projects

Example 11 with X509CRL

use of java.security.cert.X509CRL in project robovm by robovm.

the class X509CRLTest method getSigAlgParams.

private void getSigAlgParams(CertificateFactory f) throws Exception {
    X509CRL crl1 = getCRL(f, CRL_RSA);
    final byte[] sigAlgParams = crl1.getSigAlgParams();
    if (StandardNames.IS_RI) {
        assertNull(f.getProvider().getName(), sigAlgParams);
    } else {
        assertNotNull(f.getProvider().getName(), sigAlgParams);
        /* ASN.1 NULL */
        final byte[] expected = new byte[] { 0x05, 0x00 };
        assertEquals(f.getProvider().getName(), Arrays.toString(expected), Arrays.toString(sigAlgParams));
    }
    {
        X509CRL crlSigOpt = getCRL(f, CRL_RSA_DSA_SIGOPT);
        /* SEQUENCE, INTEGER 1 */
        final byte[] expected = new byte[] { /* SEQUENCE, constructed, len=5 */
        (byte) 0x30, (byte) 0x05, /* Type=2, constructed, context-specific, len=3 */
        (byte) 0xA2, (byte) 0x03, /* INTEGER, len=1, value=1 */
        (byte) 0x02, (byte) 0x01, (byte) 0x01 };
        final byte[] params = crlSigOpt.getSigAlgParams();
        assertNotNull(f.getProvider().getName(), params);
        assertEquals(Arrays.toString(expected), Arrays.toString(params));
    }
}

Example 12 with X509CRL

use of java.security.cert.X509CRL in project robovm by robovm.

the class X509CRLTest method test_equals.

private void test_equals(CertificateFactory f) throws Exception {
    X509CRL crl1 = getCRL(f, CRL_RSA);
    X509CRL crl2 = getCRL(f, CRL_RSA);
    X509Certificate rsaCert = getCertificate(f, CERT_RSA);
    X509CRL crlRsaDsa = getCRL(f, CRL_RSA_DSA);
    assertEquals(crl1, crl2);
    assertFalse(crl1.equals(crlRsaDsa));
    X509CRLEntry entry1 = crl1.getRevokedCertificate(rsaCert);
    assertNotNull(entry1);
    X509CRLEntry entry2 = crl2.getRevokedCertificate(rsaCert);
    assertNotNull(entry2);
    assertEquals(entry1, entry2);
}

Example 13 with X509CRL

use of java.security.cert.X509CRL in project cas by apereo.

the class AbstractCRLRevocationChecker method check.

@Override
public void check(final X509Certificate cert) throws GeneralSecurityException {
    if (cert == null) {
        throw new IllegalArgumentException("Certificate cannot be null.");
    }
    LOGGER.debug("Evaluating certificate revocation status for [{}]", CertUtils.toString(cert));
    final Collection<X509CRL> crls = getCRLs(cert);
    if (crls == null || crls.isEmpty()) {
        LOGGER.warn("CRL data is not available for [{}]", CertUtils.toString(cert));
        this.unavailableCRLPolicy.apply(null);
        return;
    }
    final List<X509CRL> expiredCrls = new ArrayList<>();
    final List<X509CRLEntry> revokedCrls;
    crls.stream().filter(CertUtils::isExpired).forEach(crl -> {
        LOGGER.warn("CRL data expired on [{}]", crl.getNextUpdate());
        expiredCrls.add(crl);
    });
    if (crls.size() == expiredCrls.size()) {
        LOGGER.warn("All CRLs retrieved have expired. Applying CRL expiration policy...");
        for (final X509CRL crl : expiredCrls) {
            this.expiredCRLPolicy.apply(crl);
        }
    } else {
        crls.removeAll(expiredCrls);
        LOGGER.debug("Valid CRLs [{}] found that are not expired yet", crls);
        revokedCrls = crls.stream().map(crl -> crl.getRevokedCertificate(cert)).filter(Objects::nonNull).collect(Collectors.toList());
        if (revokedCrls.size() == crls.size()) {
            final X509CRLEntry entry = revokedCrls.get(0);
            LOGGER.warn("All CRL entries have been revoked. Rejecting the first entry [{}]", entry);
            throw new RevokedCertificateException(entry);
        }
    }
}

Example 14 with X509CRL

use of java.security.cert.X509CRL in project gitblit by gitblit.

the class GitblitTrustManager method read.

protected synchronized void read() {
    if (lastModified.get() == caRevocationList.lastModified()) {
        return;
    }
    logger.info("Reloading CRL from " + caRevocationList.getAbsolutePath());
    InputStream inStream = null;
    try {
        inStream = new FileInputStream(caRevocationList);
        CertificateFactory cf = CertificateFactory.getInstance("X.509");
        X509CRL list = (X509CRL) cf.generateCRL(inStream);
        crl = list;
        lastModified.set(caRevocationList.lastModified());
    } catch (Exception e) {
    } finally {
        if (inStream != null) {
            try {
                inStream.close();
            } catch (Exception e) {
            }
        }
    }
}

Example 15 with X509CRL

use of java.security.cert.X509CRL in project j2objc by google.

the class PKCS7 method encodeSignedData.

/**
     * Encodes the signed data to a DerOutputStream.
     *
     * @param out the DerOutputStream to write the encoded data to.
     * @exception IOException on encoding errors.
     */
public void encodeSignedData(DerOutputStream out) throws IOException {
    DerOutputStream signedData = new DerOutputStream();
    // version
    signedData.putInteger(version);
    // digestAlgorithmIds
    signedData.putOrderedSetOf(DerValue.tag_Set, digestAlgorithmIds);
    // contentInfo
    contentInfo.encode(signedData);
    // certificates (optional)
    if (certificates != null && certificates.length != 0) {
        // cast to X509CertImpl[] since X509CertImpl implements DerEncoder
        X509CertImpl[] implCerts = new X509CertImpl[certificates.length];
        for (int i = 0; i < certificates.length; i++) {
            if (certificates[i] instanceof X509CertImpl)
                implCerts[i] = (X509CertImpl) certificates[i];
            else {
                try {
                    byte[] encoded = certificates[i].getEncoded();
                    implCerts[i] = new X509CertImpl(encoded);
                } catch (CertificateException ce) {
                    IOException ie = new IOException(ce.getMessage());
                    ie.initCause(ce);
                    throw ie;
                }
            }
        }
        // Add the certificate set (tagged with [0] IMPLICIT)
        // to the signed data
        signedData.putOrderedSetOf((byte) 0xA0, implCerts);
    }
    // CRLs (optional)
    if (crls != null && crls.length != 0) {
        // cast to X509CRLImpl[] since X509CRLImpl implements DerEncoder
        Set<X509CRLImpl> implCRLs = new HashSet<X509CRLImpl>(crls.length);
        for (X509CRL crl : crls) {
            if (crl instanceof X509CRLImpl)
                implCRLs.add((X509CRLImpl) crl);
            else {
                try {
                    byte[] encoded = crl.getEncoded();
                    implCRLs.add(new X509CRLImpl(encoded));
                } catch (CRLException ce) {
                    IOException ie = new IOException(ce.getMessage());
                    ie.initCause(ce);
                    throw ie;
                }
            }
        }
        // Add the CRL set (tagged with [1] IMPLICIT)
        // to the signed data
        signedData.putOrderedSetOf((byte) 0xA1, implCRLs.toArray(new X509CRLImpl[implCRLs.size()]));
    }
    // signerInfos
    signedData.putOrderedSetOf(DerValue.tag_Set, signerInfos);
    // making it a signed data block
    DerValue signedDataSeq = new DerValue(DerValue.tag_Sequence, signedData.toByteArray());
    // making it a content info sequence
    ContentInfo block = new ContentInfo(ContentInfo.SIGNED_DATA_OID, signedDataSeq);
    // writing out the contentInfo sequence
    block.encode(out);
}