Examples with X509CRLHolder org.bouncycastle.cert.X509CRLHolder used on opensource projects

Example 6 with X509CRLHolder

use of org.bouncycastle.cert.X509CRLHolder in project candlepin by candlepin.

the class X509CRLStreamWriterTest method testUpgradesSignature.

@Test
public void testUpgradesSignature() throws Exception {
    X509v2CRLBuilder crlBuilder = createCRLBuilder();
    String signingAlg = "SHA1WithRSA";
    ContentSigner sha1Signer = new JcaContentSignerBuilder(signingAlg).setProvider(BC_PROVIDER).build(keyPair.getPrivate());
    X509CRLHolder holder = crlBuilder.build(sha1Signer);
    File crlToChange = writeCRL(holder);
    X509CRLStreamWriter stream = new X509CRLStreamWriter(crlToChange, (RSAPrivateKey) keyPair.getPrivate(), (RSAPublicKey) keyPair.getPublic());
    stream.setSigningAlgorithm("SHA256WithRSA");
    stream.add(new BigInteger("9000"), new Date(), 0);
    stream.preScan(crlToChange).lock();
    OutputStream o = new BufferedOutputStream(new FileOutputStream(outfile));
    stream.write(o);
    o.close();
    X509CRL changedCrl = readCRL();
    Set<BigInteger> discoveredSerials = new HashSet<>();
    for (X509CRLEntry entry : changedCrl.getRevokedCertificates()) {
        discoveredSerials.add(entry.getSerialNumber());
    }
    Set<BigInteger> expected = new HashSet<>();
    expected.add(new BigInteger("100"));
    expected.add(new BigInteger("9000"));
    assertEquals(expected, discoveredSerials);
}

Example 7 with X509CRLHolder

use of org.bouncycastle.cert.X509CRLHolder in project candlepin by candlepin.

the class X509CRLEntryStreamTest method testIterateOverEmptyCrl.

@Test
public void testIterateOverEmptyCrl() throws Exception {
    X509v2CRLBuilder crlBuilder = new X509v2CRLBuilder(issuer, new Date());
    AuthorityKeyIdentifier identifier = new JcaX509ExtensionUtils().createAuthorityKeyIdentifier(keyPair.getPublic());
    crlBuilder.addExtension(Extension.authorityKeyIdentifier, false, identifier);
    crlBuilder.addExtension(Extension.cRLNumber, false, new CRLNumber(new BigInteger("127")));
    X509CRLHolder holder = crlBuilder.build(signer);
    File noUpdateTimeCrl = new File(folder.getRoot(), "test.crl");
    FileUtils.writeByteArrayToFile(noUpdateTimeCrl, holder.getEncoded());
    X509CRLEntryStream stream = new X509CRLEntryStream(noUpdateTimeCrl);
    try {
        Set<BigInteger> streamedSerials = new HashSet<>();
        while (stream.hasNext()) {
            streamedSerials.add(getSerial(stream.next()));
        }
        assertEquals(0, streamedSerials.size());
    } finally {
        stream.close();
    }
}

Example 8 with X509CRLHolder

use of org.bouncycastle.cert.X509CRLHolder in project candlepin by candlepin.

the class X509CRLEntryStreamTest method testIterateOverEmptyCrlWithNoExtensions.

@Test
public void testIterateOverEmptyCrlWithNoExtensions() throws Exception {
    X509v2CRLBuilder crlBuilder = new X509v2CRLBuilder(issuer, new Date());
    X509CRLHolder holder = crlBuilder.build(signer);
    File noUpdateTimeCrl = new File(folder.getRoot(), "test.crl");
    FileUtils.writeByteArrayToFile(noUpdateTimeCrl, holder.getEncoded());
    X509CRLEntryStream stream = new X509CRLEntryStream(noUpdateTimeCrl);
    thrown.expect(IllegalStateException.class);
    thrown.expectMessage(matchesPattern("v1.*"));
    try {
        while (stream.hasNext()) {
            stream.next();
        }
    } finally {
        stream.close();
    }
}

Example 9 with X509CRLHolder

use of org.bouncycastle.cert.X509CRLHolder in project fabric-sdk-java by hyperledger.

the class HFCAClientIT method parseCRL.

TBSCertList.CRLEntry[] parseCRL(String crl) throws Exception {
    Base64.Decoder b64dec = Base64.getDecoder();
    final byte[] decode = b64dec.decode(crl.getBytes(UTF_8));
    PEMParser pem = new PEMParser(new StringReader(new String(decode)));
    X509CRLHolder holder = (X509CRLHolder) pem.readObject();
    return holder.toASN1Structure().getRevokedCertificates();
}

Example 10 with X509CRLHolder

use of org.bouncycastle.cert.X509CRLHolder in project jruby-openssl by jruby.

the class SecurityHelper method verify.

static boolean verify(final X509CRL crl, final PublicKey publicKey, final boolean silent) throws NoSuchAlgorithmException, CRLException, InvalidKeyException, SignatureException {
    if (crl instanceof X509CRLObject) {
        final CertificateList crlList = (CertificateList) getCertificateList(crl);
        final AlgorithmIdentifier tbsSignatureId = crlList.getTBSCertList().getSignature();
        if (!crlList.getSignatureAlgorithm().equals(tbsSignatureId)) {
            if (silent)
                return false;
            throw new CRLException("Signature algorithm on CertificateList does not match TBSCertList.");
        }
        final Signature signature = getSignature(crl.getSigAlgName(), securityProvider);
        signature.initVerify(publicKey);
        signature.update(crl.getTBSCertList());
        if (!signature.verify(crl.getSignature())) {
            if (silent)
                return false;
            throw new SignatureException("CRL does not verify with supplied public key.");
        }
        return true;
    } else {
        try {
            final DigestAlgorithmIdentifierFinder digestAlgFinder = new DefaultDigestAlgorithmIdentifierFinder();
            final ContentVerifierProvider verifierProvider;
            if ("DSA".equalsIgnoreCase(publicKey.getAlgorithm())) {
                BigInteger y = ((DSAPublicKey) publicKey).getY();
                DSAParams params = ((DSAPublicKey) publicKey).getParams();
                DSAParameters parameters = new DSAParameters(params.getP(), params.getQ(), params.getG());
                AsymmetricKeyParameter dsaKey = new DSAPublicKeyParameters(y, parameters);
                verifierProvider = new BcDSAContentVerifierProviderBuilder(digestAlgFinder).build(dsaKey);
            } else {
                BigInteger mod = ((RSAPublicKey) publicKey).getModulus();
                BigInteger exp = ((RSAPublicKey) publicKey).getPublicExponent();
                AsymmetricKeyParameter rsaKey = new RSAKeyParameters(false, mod, exp);
                verifierProvider = new BcRSAContentVerifierProviderBuilder(digestAlgFinder).build(rsaKey);
            }
            return new X509CRLHolder(crl.getEncoded()).isSignatureValid(verifierProvider);
        } catch (OperatorException e) {
            throw new SignatureException(e);
        } catch (CertException e) {
            throw new SignatureException(e);
        }// can happen if the input is DER but does not match expected strucure
         catch (ClassCastException e) {
            throw new SignatureException(e);
        } catch (IOException e) {
            throw new SignatureException(e);
        }
    }
}