Examples with CertificateCodec.getPEMEncodedString org.apache.hadoop.hdds.security.x509.certificate.utils.CertificateCodec.getPEMEncodedString used on opensource projects

Example 1 with CertificateCodec.getPEMEncodedString

use of org.apache.hadoop.hdds.security.x509.certificate.utils.CertificateCodec.getPEMEncodedString in project ozone by apache.

the class HASecurityUtils method getPrimarySCMSelfSignedCert.

/**
 * For primary SCM get sub-ca signed certificate and root CA certificate by
 * root CA certificate server and store it using certificate client.
 */
private static void getPrimarySCMSelfSignedCert(CertificateClient client, OzoneConfiguration config, SCMStorageConfig scmStorageConfig, InetSocketAddress scmAddress) {
    try {
        CertificateServer rootCAServer = initializeRootCertificateServer(config, null, scmStorageConfig, new DefaultCAProfile());
        PKCS10CertificationRequest csr = generateCSR(client, scmStorageConfig, config, scmAddress);
        X509CertificateHolder subSCMCertHolder = rootCAServer.requestCertificate(csr, KERBEROS_TRUSTED, SCM).get();
        X509CertificateHolder rootCACertificateHolder = rootCAServer.getCACertificate();
        String pemEncodedCert = CertificateCodec.getPEMEncodedString(subSCMCertHolder);
        String pemEncodedRootCert = CertificateCodec.getPEMEncodedString(rootCACertificateHolder);
        client.storeCertificate(pemEncodedRootCert, true, true);
        client.storeCertificate(pemEncodedCert, true);
        persistSubCACertificate(config, client, subSCMCertHolder);
        // Persist scm cert serial ID.
        scmStorageConfig.setScmCertSerialId(subSCMCertHolder.getSerialNumber().toString());
    } catch (InterruptedException | ExecutionException | IOException | CertificateException e) {
        LOG.error("Error while fetching/storing SCM signed certificate.", e);
        Thread.currentThread().interrupt();
        throw new RuntimeException(e);
    }
}

Example 2 with CertificateCodec.getPEMEncodedString

use of org.apache.hadoop.hdds.security.x509.certificate.utils.CertificateCodec.getPEMEncodedString in project ozone by apache.

the class TestDefaultCAServer method testIntermediaryCA.

@Test
public void testIntermediaryCA() throws Exception {
    conf.set(HddsConfigKeys.HDDS_X509_MAX_DURATION, "P3650D");
    String clusterId = RandomStringUtils.randomAlphanumeric(4);
    String scmId = RandomStringUtils.randomAlphanumeric(4);
    CertificateServer rootCA = new DefaultCAServer("rootCA", clusterId, scmId, caStore, new DefaultProfile(), Paths.get("scm", "ca").toString());
    rootCA.init(new SecurityConfig(conf), SELF_SIGNED_CA);
    SCMCertificateClient scmCertificateClient = new SCMCertificateClient(new SecurityConfig(conf));
    CertificateClient.InitResponse response = scmCertificateClient.init();
    Assert.assertEquals(CertificateClient.InitResponse.GETCERT, response);
    // Generate cert
    KeyPair keyPair = new HDDSKeyGenerator(conf).generateKey();
    PKCS10CertificationRequest csr = new CertificateSignRequest.Builder().addDnsName("hadoop.apache.org").addIpAddress("8.8.8.8").setCA(false).setSubject("testCA").setConfiguration(conf).setKey(keyPair).build();
    Future<X509CertificateHolder> holder = rootCA.requestCertificate(csr, CertificateApprover.ApprovalType.TESTING_AUTOMATIC, SCM);
    Assert.assertTrue(holder.isDone());
    X509CertificateHolder certificateHolder = holder.get();
    Assert.assertNotNull(certificateHolder);
    LocalDate invalidAfterDate = certificateHolder.getNotAfter().toInstant().atZone(ZoneId.systemDefault()).toLocalDate();
    LocalDate now = LocalDate.now();
    assertEquals(0, invalidAfterDate.compareTo(now.plusDays(3650)));
    X509CertificateHolder rootCertHolder = rootCA.getCACertificate();
    scmCertificateClient.storeCertificate(CertificateCodec.getPEMEncodedString(rootCertHolder), true, true);
    // Write to the location where Default CA Server reads from.
    scmCertificateClient.storeCertificate(CertificateCodec.getPEMEncodedString(certificateHolder), true);
    CertificateCodec certCodec = new CertificateCodec(new SecurityConfig(conf), scmCertificateClient.getComponentName());
    certCodec.writeCertificate(certificateHolder);
    // The certificate generated by above cert client will be used by scmCA.
    // Now scmCA init should be successful.
    CertificateServer scmCA = new DefaultCAServer("scmCA", clusterId, scmId, caStore, new DefaultProfile(), scmCertificateClient.getComponentName());
    try {
        scmCA.init(new SecurityConfig(conf), INTERMEDIARY_CA);
    } catch (Exception e) {
        fail("testIntermediaryCA failed during init");
    }
}