Examples with X509ResourceCertificate net.ripe.rpki.commons.crypto.x509cert.X509ResourceCertificate used on opensource projects

Example 6 with X509ResourceCertificate

use of net.ripe.rpki.commons.crypto.x509cert.X509ResourceCertificate in project rpki-validator-3 by RIPE-NCC.

the class TrustAnchorValidationService method validate.

@Transactional(Transactional.TxType.REQUIRED)
public void validate(long trustAnchorId) {
    TrustAnchor trustAnchor = trustAnchorRepository.get(trustAnchorId);
    log.debug("trust anchor {} located at {} with subject public key info {}", trustAnchor.getName(), trustAnchor.getLocations(), trustAnchor.getSubjectPublicKeyInfo());
    TrustAnchorValidationRun validationRun = new TrustAnchorValidationRun(trustAnchor);
    validationRunRepository.add(validationRun);
    try {
        boolean updated = false;
        URI trustAnchorCertificateURI = URI.create(validationRun.getTrustAnchorCertificateURI()).normalize();
        ValidationResult validationResult = ValidationResult.withLocation(trustAnchorCertificateURI);
        File targetFile = fetchTrustAnchorCertificate(trustAnchorCertificateURI, validationResult);
        if (!validationResult.hasFailureForCurrentLocation()) {
            long trustAnchorCertificateSize = targetFile.length();
            if (trustAnchorCertificateSize < RpkiObject.MIN_SIZE) {
                validationResult.error(ErrorCodes.REPOSITORY_OBJECT_MINIMUM_SIZE, trustAnchorCertificateURI.toASCIIString(), String.valueOf(trustAnchorCertificateSize), String.valueOf(RpkiObject.MIN_SIZE));
            } else if (trustAnchorCertificateSize > RpkiObject.MAX_SIZE) {
                validationResult.error(ErrorCodes.REPOSITORY_OBJECT_MAXIMUM_SIZE, trustAnchorCertificateURI.toASCIIString(), String.valueOf(trustAnchorCertificateSize), String.valueOf(RpkiObject.MAX_SIZE));
            } else {
                X509ResourceCertificate certificate = parseCertificate(trustAnchor, targetFile, validationResult);
                if (!validationResult.hasFailureForCurrentLocation()) {
                    // validity time?
                    int comparedSerial = trustAnchor.getCertificate() == null ? 1 : trustAnchor.getCertificate().getSerialNumber().compareTo(certificate.getSerialNumber());
                    validationResult.warnIfTrue(comparedSerial < 0, "repository.object.is.older.than.previous.object", trustAnchorCertificateURI.toASCIIString());
                    if (comparedSerial > 0) {
                        trustAnchor.setCertificate(certificate);
                        updated = true;
                    }
                }
            }
        }
        validationRun.completeWith(validationResult);
        if (updated) {
            validationRunRepository.runCertificateTreeValidation(trustAnchor);
        }
    } catch (CommandExecutionException | IOException e) {
        log.error("validation run for trust anchor {} failed", trustAnchor, e);
        validationRun.addCheck(new ValidationCheck(validationRun, validationRun.getTrustAnchorCertificateURI(), ValidationCheck.Status.ERROR, ErrorCodes.UNHANDLED_EXCEPTION, e.toString()));
        validationRun.setFailed();
    }
}

Example 7 with X509ResourceCertificate

use of net.ripe.rpki.commons.crypto.x509cert.X509ResourceCertificate in project rpki-validator-3 by RIPE-NCC.

the class TrustAnchorValidationServiceTest method test_success.

@Test
public void test_success() {
    TrustAnchor ta = createRipeNccTrustAnchor();
    trustAnchors.add(ta);
    ta.setLocations(Arrays.asList("src/test/resources/ripe-ncc-ta.cer"));
    subject.validate(ta.getId());
    ta.setLocations(Arrays.asList(DUMMY_RSYNC_URI));
    X509ResourceCertificate certificate = ta.getCertificate();
    assertThat(certificate).isNotNull();
    Optional<TrustAnchorValidationRun> validationRun = validationRuns.findLatestCompletedForTrustAnchor(ta);
    assertThat(validationRun).isPresent();
    assertThat(validationRun.get().getStatus()).isEqualTo(ValidationRun.Status.SUCCEEDED);
    assertThat(validationRun.get().getValidationChecks()).isEmpty();
}

Example 8 with X509ResourceCertificate

use of net.ripe.rpki.commons.crypto.x509cert.X509ResourceCertificate in project rpki-validator-3 by RIPE-NCC.

the class TrustAnchorsFactory method createTrustAnchor.

public TrustAnchor createTrustAnchor(Consumer<CertificateAuthority.CertificateAuthorityBuilder> configure, ValidityPeriod mftValidityPeriod) {
    KeyPair rootKeyPair = KEY_PAIR_FACTORY.generate();
    CertificateAuthority.CertificateAuthorityBuilder builder = CertificateAuthority.builder().dn("CN=test-trust-anchor").keyPair(rootKeyPair).certificateLocation("rsync://rpki.test/test-trust-anchor.cer").resources(IpResourceSet.parse("0.0.0.0/0")).notifyURI(TA_RRDP_NOTIFY_URI).manifestURI(TA_MANIFEST_URI).repositoryURI(TA_CA_REPOSITORY_URI).crlDistributionPoint(TA_CRL_URI);
    configure.accept(builder);
    CertificateAuthority root = builder.build();
    X509ResourceCertificate certificate = createCertificateAuthority(root, root, mftValidityPeriod);
    TrustAnchor ta = new TrustAnchor();
    ta.setName(root.dn);
    ta.getLocations().add(root.certificateLocation);
    ta.setCertificate(certificate);
    ta.setSubjectPublicKeyInfo(X509CertificateUtil.getEncodedSubjectPublicKeyInfo(certificate.getCertificate()));
    return ta;
}