Examples with JcePEMDecryptorProviderBuilder org.bouncycastle.openssl.jcajce.JcePEMDecryptorProviderBuilder used on opensource projects

Example 1 with JcePEMDecryptorProviderBuilder

use of org.bouncycastle.openssl.jcajce.JcePEMDecryptorProviderBuilder in project runwar by cfmlprojects.

the class SSLUtil method loadPemPrivateKey.

private static PrivateKey loadPemPrivateKey(final File file, final char[] passphrase) throws Exception {
    Security.addProvider(new BouncyCastleProvider());
    final PEMParser pemParser = new PEMParser(new BufferedReader(new FileReader(file)));
    final PEMDecryptorProvider build = new JcePEMDecryptorProviderBuilder().build(passphrase);
    final JcaPEMKeyConverter jcaPEMKeyConverter = new JcaPEMKeyConverter();
    PrivateKey privateKey;
    try {
        final Object object = pemParser.readObject();
        if (object instanceof PEMEncryptedKeyPair) {
            privateKey = jcaPEMKeyConverter.getKeyPair(((PEMEncryptedKeyPair) object).decryptKeyPair(build)).getPrivate();
        } else {
            PrivateKeyInfo privateKeyInfo;
            if (object instanceof PEMKeyPair) {
                privateKeyInfo = ((PEMKeyPair) object).getPrivateKeyInfo();
            } else {
                privateKeyInfo = (PrivateKeyInfo) object;
            }
            if (privateKeyInfo != null) {
                privateKey = new JcaPEMKeyConverter().getPrivateKey(privateKeyInfo);
            } else {
                final KeyStore keyStore = KeyStore.getInstance("PKCS12", "BC");
                final FileInputStream fileInputStream = new FileInputStream(file);
                keyStore.load(fileInputStream, passphrase);
                fileInputStream.close();
                final Enumeration<String> aliases = keyStore.aliases();
                String alias = "";
                while (aliases.hasMoreElements()) {
                    alias = aliases.nextElement();
                }
                privateKey = (PrivateKey) keyStore.getKey(alias, passphrase);
            }
        }
    } finally {
        pemParser.close();
    }
    pemParser.close();
    return privateKey;
}

Example 2 with JcePEMDecryptorProviderBuilder

use of org.bouncycastle.openssl.jcajce.JcePEMDecryptorProviderBuilder in project neo4j by neo4j.

the class PkiUtils method loadPrivateKey.

public static PrivateKey loadPrivateKey(Path privateKeyFile, String passPhrase) throws IOException {
    if (passPhrase == null) {
        passPhrase = "";
    }
    try (PEMParser r = new PEMParser(Files.newBufferedReader(privateKeyFile))) {
        Object pemObject = r.readObject();
        final JcaPEMKeyConverter converter = new JcaPEMKeyConverter().setProvider(PROVIDER);
        if (// -----BEGIN RSA/DSA/EC PRIVATE KEY----- Proc-Type: 4,ENCRYPTED
        pemObject instanceof PEMEncryptedKeyPair) {
            final PEMEncryptedKeyPair ckp = (PEMEncryptedKeyPair) pemObject;
            final PEMDecryptorProvider decProv = new JcePEMDecryptorProviderBuilder().build(passPhrase.toCharArray());
            return converter.getKeyPair(ckp.decryptKeyPair(decProv)).getPrivate();
        } else if (// -----BEGIN ENCRYPTED PRIVATE KEY-----
        pemObject instanceof PKCS8EncryptedPrivateKeyInfo) {
            try {
                final PKCS8EncryptedPrivateKeyInfo encryptedInfo = (PKCS8EncryptedPrivateKeyInfo) pemObject;
                final InputDecryptorProvider provider = new JceOpenSSLPKCS8DecryptorProviderBuilder().build(passPhrase.toCharArray());
                final PrivateKeyInfo privateKeyInfo = encryptedInfo.decryptPrivateKeyInfo(provider);
                return converter.getPrivateKey(privateKeyInfo);
            } catch (PKCSException | OperatorCreationException e) {
                throw new IOException("Unable to decrypt private key.", e);
            }
        } else if (// -----BEGIN PRIVATE KEY-----
        pemObject instanceof PrivateKeyInfo) {
            return converter.getPrivateKey((PrivateKeyInfo) pemObject);
        } else if (// -----BEGIN RSA/DSA/EC PRIVATE KEY-----
        pemObject instanceof PEMKeyPair) {
            return converter.getKeyPair((PEMKeyPair) pemObject).getPrivate();
        } else {
            throw new IOException("Unrecognized private key format.");
        }
    }
}

Example 3 with JcePEMDecryptorProviderBuilder

use of org.bouncycastle.openssl.jcajce.JcePEMDecryptorProviderBuilder in project gocd by gocd.

the class GoAgentServerClientBuilder method getPrivateKey.

private PrivateKey getPrivateKey() throws IOException {
    PrivateKey privateKey;
    try (PEMParser reader = new PEMParser(new FileReader(this.sslPrivateKey, StandardCharsets.UTF_8))) {
        Object pemObject = reader.readObject();
        JcaPEMKeyConverter converter = new JcaPEMKeyConverter().setProvider(new BouncyCastleProvider());
        if (pemObject instanceof PEMEncryptedKeyPair) {
            PEMDecryptorProvider decProv = new JcePEMDecryptorProviderBuilder().build(passphrase());
            KeyPair keyPair = converter.getKeyPair(((PEMEncryptedKeyPair) pemObject).decryptKeyPair(decProv));
            privateKey = keyPair.getPrivate();
        } else if (pemObject instanceof PEMKeyPair) {
            KeyPair keyPair = converter.getKeyPair((PEMKeyPair) pemObject);
            privateKey = keyPair.getPrivate();
        } else if (pemObject instanceof PrivateKeyInfo) {
            PrivateKeyInfo privateKeyInfo = (PrivateKeyInfo) pemObject;
            privateKey = converter.getPrivateKey(privateKeyInfo);
        } else {
            throw new RuntimeException("Unable to parse key of type " + pemObject.getClass());
        }
        return privateKey;
    }
}

Example 4 with JcePEMDecryptorProviderBuilder

use of org.bouncycastle.openssl.jcajce.JcePEMDecryptorProviderBuilder in project ddf by codice.

the class KeystoreEditor method addToStore.

private synchronized void addToStore(String alias, String keyPassword, String storePassword, String data, String type, String fileName, String path, String storepass, KeyStore store) throws KeystoreEditorException {
    OutputStream fos = null;
    try (InputStream inputStream = new ByteArrayInputStream(Base64.getDecoder().decode(data))) {
        if (StringUtils.isBlank(alias)) {
            throw new IllegalArgumentException(NULL_ALIAS_MSG);
        }
        Path storeFile = Paths.get(path);
        // check the two most common key/cert stores first (pkcs12 and jks)
        if (PKCS12_TYPE.equals(type) || StringUtils.endsWithIgnoreCase(fileName, ".p12")) {
            // priv key + cert chain
            KeyStore pkcs12Store = KeyStore.getInstance("PKCS12");
            pkcs12Store.load(inputStream, storePassword.toCharArray());
            Certificate[] chain = pkcs12Store.getCertificateChain(alias);
            Key key = pkcs12Store.getKey(alias, keyPassword.toCharArray());
            if (key != null) {
                store.setKeyEntry(alias, key, keyPassword.toCharArray(), chain);
                fos = Files.newOutputStream(storeFile);
                store.store(fos, storepass.toCharArray());
            }
        } else if (JKS_TYPE.equals(type) || StringUtils.endsWithIgnoreCase(fileName, ".jks")) {
            // java keystore file
            KeyStore jks = KeyStore.getInstance("jks");
            jks.load(inputStream, storePassword.toCharArray());
            Enumeration<String> aliases = jks.aliases();
            // we are going to store all entries from the jks regardless of the passed in alias
            while (aliases.hasMoreElements()) {
                String jksAlias = aliases.nextElement();
                if (jks.isKeyEntry(jksAlias)) {
                    Key key = jks.getKey(jksAlias, keyPassword.toCharArray());
                    Certificate[] certificateChain = jks.getCertificateChain(jksAlias);
                    store.setKeyEntry(jksAlias, key, keyPassword.toCharArray(), certificateChain);
                } else {
                    Certificate certificate = jks.getCertificate(jksAlias);
                    store.setCertificateEntry(jksAlias, certificate);
                }
            }
            fos = Files.newOutputStream(storeFile);
            store.store(fos, storepass.toCharArray());
        // need to parse der separately from pem, der has the same mime type but is binary hence
        // checking both
        } else if (DER_TYPE.equals(type) && StringUtils.endsWithIgnoreCase(fileName, ".der")) {
            ASN1InputStream asn1InputStream = new ASN1InputStream(inputStream);
            ASN1Primitive asn1Primitive = asn1InputStream.readObject();
            X509CertificateHolder x509CertificateHolder = new X509CertificateHolder(asn1Primitive.getEncoded());
            CertificateFactory certificateFactory = CertificateFactory.getInstance(X509, "BC");
            Certificate certificate = certificateFactory.generateCertificate(new ByteArrayInputStream(x509CertificateHolder.getEncoded()));
            X500Name x500name = new JcaX509CertificateHolder((X509Certificate) certificate).getSubject();
            RDN cn = x500name.getRDNs(BCStyle.CN)[0];
            String cnStr = IETFUtils.valueToString(cn.getFirst().getValue());
            if (!store.isCertificateEntry(cnStr) && !store.isKeyEntry(cnStr)) {
                store.setCertificateEntry(cnStr, certificate);
            }
            store.setCertificateEntry(alias, certificate);
            fos = Files.newOutputStream(storeFile);
            store.store(fos, storepass.toCharArray());
        // if it isn't one of the stores we support, it might be a key or cert by itself
        } else if (isPemParsable(type, fileName)) {
            // This is the catch all case for PEM, P7B, etc. with common file extensions if the mime
            // type isn't read correctly in the browser
            Reader reader = new BufferedReader(new InputStreamReader(inputStream, StandardCharsets.UTF_8));
            PEMParser pemParser = new PEMParser(reader);
            Object object;
            boolean setEntry = false;
            while ((object = pemParser.readObject()) != null) {
                if (object instanceof PEMEncryptedKeyPair || object instanceof PEMKeyPair) {
                    PEMKeyPair pemKeyPair;
                    if (object instanceof PEMEncryptedKeyPair) {
                        PEMEncryptedKeyPair pemEncryptedKeyPairKeyPair = (PEMEncryptedKeyPair) object;
                        JcePEMDecryptorProviderBuilder jcePEMDecryptorProviderBuilder = new JcePEMDecryptorProviderBuilder();
                        pemKeyPair = pemEncryptedKeyPairKeyPair.decryptKeyPair(jcePEMDecryptorProviderBuilder.build(keyPassword.toCharArray()));
                    } else {
                        pemKeyPair = (PEMKeyPair) object;
                    }
                    KeyPair keyPair = new JcaPEMKeyConverter().setProvider("BC").getKeyPair(pemKeyPair);
                    PrivateKey privateKey = keyPair.getPrivate();
                    Certificate[] chain = store.getCertificateChain(alias);
                    if (chain == null) {
                        chain = buildCertChain(alias, store);
                    }
                    store.setKeyEntry(alias, privateKey, keyPassword.toCharArray(), chain);
                    setEntry = true;
                } else if (object instanceof X509CertificateHolder) {
                    X509CertificateHolder x509CertificateHolder = (X509CertificateHolder) object;
                    CertificateFactory certificateFactory = CertificateFactory.getInstance(X509, "BC");
                    Certificate certificate = certificateFactory.generateCertificate(new ByteArrayInputStream(x509CertificateHolder.getEncoded()));
                    X500Name x500name = new JcaX509CertificateHolder((X509Certificate) certificate).getSubject();
                    RDN cn = x500name.getRDNs(BCStyle.CN)[0];
                    String cnStr = IETFUtils.valueToString(cn.getFirst().getValue());
                    if (!store.isCertificateEntry(cnStr) && !store.isKeyEntry(cnStr)) {
                        store.setCertificateEntry(cnStr, certificate);
                    }
                    store.setCertificateEntry(alias, certificate);
                    setEntry = true;
                } else if (object instanceof ContentInfo) {
                    ContentInfo contentInfo = (ContentInfo) object;
                    if (contentInfo.getContentType().equals(CMSObjectIdentifiers.envelopedData)) {
                        CMSEnvelopedData cmsEnvelopedData = new CMSEnvelopedData(contentInfo);
                        OriginatorInfo originatorInfo = cmsEnvelopedData.getOriginatorInfo().toASN1Structure();
                        ASN1Set certificates = originatorInfo.getCertificates();
                        setEntry = importASN1CertificatesToStore(store, setEntry, certificates);
                    } else if (contentInfo.getContentType().equals(CMSObjectIdentifiers.signedData)) {
                        SignedData signedData = SignedData.getInstance(contentInfo.getContent());
                        ASN1Set certificates = signedData.getCertificates();
                        setEntry = importASN1CertificatesToStore(store, setEntry, certificates);
                    }
                } else if (object instanceof PKCS8EncryptedPrivateKeyInfo) {
                    PKCS8EncryptedPrivateKeyInfo pkcs8EncryptedPrivateKeyInfo = (PKCS8EncryptedPrivateKeyInfo) object;
                    Certificate[] chain = store.getCertificateChain(alias);
                    if (chain == null) {
                        chain = buildCertChain(alias, store);
                    }
                    try {
                        store.setKeyEntry(alias, pkcs8EncryptedPrivateKeyInfo.getEncoded(), chain);
                        setEntry = true;
                    } catch (KeyStoreException keyEx) {
                        try {
                            PKCS8Key pkcs8Key = new PKCS8Key(pkcs8EncryptedPrivateKeyInfo.getEncoded(), keyPassword.toCharArray());
                            store.setKeyEntry(alias, pkcs8Key.getPrivateKey(), keyPassword.toCharArray(), chain);
                            setEntry = true;
                        } catch (GeneralSecurityException e) {
                            LOGGER.info("Unable to add PKCS8 key to keystore with secondary method. Throwing original exception.", e);
                            throw keyEx;
                        }
                    }
                }
            }
            if (setEntry) {
                fos = Files.newOutputStream(storeFile);
                store.store(fos, storepass.toCharArray());
            }
        }
    } catch (Exception e) {
        LOGGER.info("Unable to add entry {} to store", alias, e);
        throw new KeystoreEditorException("Unable to add entry " + alias + " to store", e);
    } finally {
        if (fos != null) {
            try {
                fos.close();
            } catch (IOException ignore) {
            }
        }
    }
    init();
}

Example 5 with JcePEMDecryptorProviderBuilder

use of org.bouncycastle.openssl.jcajce.JcePEMDecryptorProviderBuilder in project karaf by apache.

the class KeyPairLoader method getKeyPair.

public static KeyPair getKeyPair(InputStream is, String password) throws GeneralSecurityException, IOException {
    try (PEMParser parser = new PEMParser(new InputStreamReader(is))) {
        Object o = parser.readObject();
        JcaPEMKeyConverter pemConverter = new JcaPEMKeyConverter();
        if (o instanceof PEMEncryptedKeyPair) {
            if (password == null) {
                throw new GeneralSecurityException("A password must be supplied to read an encrypted key pair");
            }
            JcePEMDecryptorProviderBuilder decryptorBuilder = new JcePEMDecryptorProviderBuilder();
            PEMDecryptorProvider pemDecryptor = decryptorBuilder.build(password.toCharArray());
            o = pemConverter.getKeyPair(((PEMEncryptedKeyPair) o).decryptKeyPair(pemDecryptor));
        } else if (o instanceof PKCS8EncryptedPrivateKeyInfo) {
            if (password == null) {
                throw new GeneralSecurityException("A password must be supplied to read an encrypted key pair");
            }
            JceOpenSSLPKCS8DecryptorProviderBuilder jce = new JceOpenSSLPKCS8DecryptorProviderBuilder();
            try {
                InputDecryptorProvider decProv = jce.build(password.toCharArray());
                o = ((PKCS8EncryptedPrivateKeyInfo) o).decryptPrivateKeyInfo(decProv);
            } catch (OperatorCreationException | PKCSException ex) {
                LOGGER.debug("Error decrypting key pair", ex);
                throw new GeneralSecurityException("Error decrypting key pair", ex);
            }
        }
        if (o instanceof PEMKeyPair) {
            return pemConverter.getKeyPair((PEMKeyPair) o);
        } else if (o instanceof KeyPair) {
            return (KeyPair) o;
        } else if (o instanceof PrivateKeyInfo) {
            PrivateKey privateKey = pemConverter.getPrivateKey((PrivateKeyInfo) o);
            PublicKey publicKey = convertPrivateToPublicKey(privateKey);
            if (publicKey != null) {
                return new KeyPair(publicKey, privateKey);
            }
        }
    }
    throw new GeneralSecurityException("Failed to parse input stream");
}