Examples with Certificate org.apache.harmony.security.x509.Certificate used on opensource projects

Example 26 with Certificate

use of org.apache.harmony.security.x509.Certificate in project open-ecard by ecsec.

the class HostnameVerifier method isValid.

@Override
public void isValid(TlsServerCertificate chain, String hostOrIp) throws CertificateVerificationException {
    try {
        TlsCertificate tlsCert = chain.getCertificate().getCertificateAt(0);
        Certificate cert = Certificate.getInstance(tlsCert.getEncoded());
        validInt(cert, hostOrIp);
    } catch (IOException ex) {
        throw new CertificateVerificationException("Invalid certificate received from server.", ex);
    }
}

Example 27 with Certificate

use of org.apache.harmony.security.x509.Certificate in project open-ecard by ecsec.

the class KeyLengthVerifier method isValid.

@Override
public void isValid(TlsServerCertificate chain, String hostname) throws CertificateVerificationException {
    try {
        boolean firstCert = true;
        for (TlsCertificate next : chain.getCertificate().getCertificateList()) {
            Certificate x509 = Certificate.getInstance(next.getEncoded());
            boolean selfSigned = x509.getIssuer().equals(x509.getSubject());
            // skip key comparison step if this is a root certificate, but still check self signed server certs
            boolean isRootCert = selfSigned && !firstCert;
            if (!isRootCert) {
                // get public key and determine minimum size for the actual type
                SubjectPublicKeyInfo pkInfo = x509.getSubjectPublicKeyInfo();
                AsymmetricKeyParameter key = PublicKeyFactory.createKey(pkInfo);
                KeyTools.assertKeyLength(key);
                firstCert = false;
            }
        }
    } catch (IOException ex) {
        String msg = "Failed to extract public key from certificate.";
        throw new CertificateVerificationException(msg, ex);
    } catch (KeyLengthException ex) {
        String msg = "The key in the certificate does not satisfy the length requirements.";
        throw new CertificateVerificationException(msg, ex);
    }
}

Example 28 with Certificate

use of org.apache.harmony.security.x509.Certificate in project open-ecard by ecsec.

the class ExpirationVerifier method isValid.

@Override
public void isValid(TlsServerCertificate chain, String hostOrIP) throws CertificateVerificationException {
    try {
        Date now = new Date();
        for (TlsCertificate next : chain.getCertificate().getCertificateList()) {
            Certificate c = Certificate.getInstance(next.getEncoded());
            Date expDate = c.getEndDate().getDate();
            if (now.after(expDate)) {
                String msg = String.format("The certificate '%s' expired at %s.", c.getSubject(), expDate);
                throw new CertificateVerificationException(msg);
            }
        }
    } catch (IOException ex) {
        throw new CertificateVerificationException("Invalid certificate received from server.", ex);
    }
}

Example 29 with Certificate

use of org.apache.harmony.security.x509.Certificate in project ddf by codice.

the class OcspChecker method passesOcspCheck.

/**
 * Checks whether the given {@param certs} are revoked or not against the configured OCSP server
 * urls + the optionally given OCSP server url in the given {@param certs}.
 *
 * @param certs - an array of certificates to verify.
 * @return true if the certificates are good or if they could not be properly checked against the
 *     OCSP server. Returns false if any of them are revoked.
 */
@Override
public boolean passesOcspCheck(X509Certificate[] certs) {
    if (!ocspEnabled) {
        LOGGER.debug("OCSP check is not enabled. Skipping.");
        return true;
    }
    LOGGER.debug("OCSP check for {} certificate(s)", certs == null ? "0" : certs.length);
    for (X509Certificate cert : certs) {
        try {
            Certificate certificate = convertToBouncyCastleCert(cert);
            OCSPReq ocspRequest = generateOcspRequest(certificate);
            Map<URI, CertificateStatus> ocspStatuses = sendOcspRequests(cert, ocspRequest);
            URI revokedStatusUrl = getFirstRevokedStatusUrl(ocspStatuses);
            if (revokedStatusUrl != null) {
                securityLogger.audit("Certificate {} has been revoked by the OCSP server at URL {}.", cert, revokedStatusUrl);
                LOGGER.warn("Certificate {} has been revoked by the OCSP server at URL {}.", cert, revokedStatusUrl);
                return false;
            }
            LOGGER.debug("No certificates revoked by the OCSP server");
        } catch (OcspCheckerException e) {
            postErrorEvent(e.getMessage());
        }
    }
    // An alert will be posted to the admin console.
    return true;
}

Example 30 with Certificate

use of org.apache.harmony.security.x509.Certificate in project ddf by codice.

the class OcspChecker method getStatusFromOcspResponse.

/**
 * Gets the {@link CertificateStatus} from the given {@param ocspResponse}.
 *
 * @param ocspResponse - the {@link OCSPResp} to get the {@link CertificateStatus} from.
 * @return the {@link CertificateStatus} from the given {@param ocspResponse}. Returns an {@link
 *     UnknownStatus} if the status could not be found.
 */
private CertificateStatus getStatusFromOcspResponse(OCSPResp ocspResponse, X509Certificate certificate) {
    try {
        BasicOCSPResp basicResponse = (BasicOCSPResp) ocspResponse.getResponseObject();
        if (basicResponse == null) {
            return new UnknownStatus();
        }
        SingleResp[] singleResps = basicResponse.getResponses();
        if (singleResps == null) {
            return new UnknownStatus();
        }
        SingleResp response = Arrays.stream(singleResps).filter(singleResp -> singleResp.getCertID() != null).filter(singleResp -> singleResp.getCertID().getSerialNumber().equals(certificate.getSerialNumber())).findFirst().orElse(null);
        if (response == null) {
            LOGGER.debug("Certificate status from OCSP response is unknown.");
            return new UnknownStatus();
        }
        if (response.getCertStatus() == null) {
            LOGGER.debug("Certificate status from OCSP response is good.");
            return CertificateStatus.GOOD;
        }
        return response.getCertStatus();
    } catch (OCSPException e) {
        return new UnknownStatus();
    }
}