Examples with CertificateReader org.cloudfoundry.credhub.utils.CertificateReader used on opensource projects

Example 1 with CertificateReader

use of org.cloudfoundry.credhub.utils.CertificateReader in project credhub by cloudfoundry.

the class CertificateGenerator method generateCredential.

@Override
public CertificateCredentialValue generateCredential(final GenerationParameters p) {
    final CertificateGenerationParameters params = (CertificateGenerationParameters) p;
    final KeyPair keyPair;
    final String privatePem;
    try {
        keyPair = keyGenerator.generateKeyPair(params.getKeyLength());
        privatePem = CertificateFormatter.pemOf(keyPair.getPrivate());
    } catch (final Exception e) {
        throw new RuntimeException(e);
    }
    if (params.isSelfSigned()) {
        try {
            final String cert = CertificateFormatter.pemOf(signedCertificateGenerator.getSelfSigned(keyPair, params));
            return new CertificateCredentialValue(cert, cert, privatePem, null, params.isCa(), params.isSelfSigned(), true, false);
        } catch (final Exception e) {
            throw new RuntimeException(e);
        }
    } else {
        final String caName = params.getCaName();
        final CertificateCredentialValue latestNonTransitionalCaVersion = certificateAuthorityService.findActiveVersion(caName);
        if (latestNonTransitionalCaVersion.getPrivateKey() == null) {
            throw new ParameterizedValidationException(ErrorMessages.CA_MISSING_PRIVATE_KEY);
        }
        final CertificateCredentialValue transitionalCaVersion = certificateAuthorityService.findTransitionalVersion(caName);
        String signingCaCertificate;
        String signingCaPrivateKey;
        String trustedCaCertificate = null;
        if (shouldUseTransitionalParentToSign(params.getAllowTransitionalParentToSign(), latestNonTransitionalCaVersion, transitionalCaVersion)) {
            signingCaCertificate = transitionalCaVersion.getCertificate();
            signingCaPrivateKey = transitionalCaVersion.getPrivateKey();
            trustedCaCertificate = latestNonTransitionalCaVersion.getCertificate();
        } else {
            signingCaCertificate = latestNonTransitionalCaVersion.getCertificate();
            signingCaPrivateKey = latestNonTransitionalCaVersion.getPrivateKey();
            if (transitionalCaVersion != null) {
                trustedCaCertificate = transitionalCaVersion.getCertificate();
            }
        }
        try {
            final CertificateReader certificateReader = new CertificateReader(signingCaCertificate);
            final X509Certificate cert = signedCertificateGenerator.getSignedByIssuer(keyPair, params, certificateReader.getCertificate(), PrivateKeyReader.getPrivateKey(signingCaPrivateKey));
            return new CertificateCredentialValue(signingCaCertificate, CertificateFormatter.pemOf(cert), privatePem, caName, trustedCaCertificate, params.isCa(), params.isSelfSigned(), true, false);
        } catch (final Exception e) {
            throw new RuntimeException(e);
        }
    }
}

Example 2 with CertificateReader

use of org.cloudfoundry.credhub.utils.CertificateReader in project credhub by cloudfoundry.

the class SignedCertificateGeneratorTest method getSignedByIssuer_withNonGeneratedSubjectKeyIdentifier_setsAuthorityKeyIdentifier.

@Test
public void getSignedByIssuer_withNonGeneratedSubjectKeyIdentifier_setsAuthorityKeyIdentifier() throws Exception {
    final X509Certificate caCertificate = new CertificateReader(TEST_CA_WITH_DIFFERENT_SKID).getCertificate();
    PrivateKey caPrivateKey = PrivateKeyReader.getPrivateKey(TEST_KEY_WITH_DIFFERENT_SKID);
    final X509Certificate generatedCert = subject.getSignedByIssuer(generatedCertificateKeyPair, certificateGenerationParameters, caCertificate, caPrivateKey);
    final byte[] authorityKeyIdDer = generatedCert.getExtensionValue(Extension.authorityKeyIdentifier.getId());
    final AuthorityKeyIdentifier authorityKeyIdentifier = AuthorityKeyIdentifier.getInstance(parseExtensionValue(authorityKeyIdDer));
    final byte[] subjectKeyIdDer = caCertificate.getExtensionValue(Extension.subjectKeyIdentifier.getId());
    SubjectKeyIdentifier subjectKeyIdentifier = SubjectKeyIdentifier.getInstance(parseExtensionValue(subjectKeyIdDer));
    assertThat(authorityKeyIdentifier.getKeyIdentifier(), equalTo(subjectKeyIdentifier.getKeyIdentifier()));
}

Example 3 with CertificateReader

use of org.cloudfoundry.credhub.utils.CertificateReader in project credhub by cloudfoundry.

the class DefaultCertificateAuthorityServiceTest method findTransitionalVersion_givenExistingTransitionalCa_returnsTheTransitionalCa.

@Test
public void findTransitionalVersion_givenExistingTransitionalCa_returnsTheTransitionalCa() {
    final CertificateReader certificateReader = mock(CertificateReader.class);
    when(transitionalCertificateCredential.getParsedCertificate()).thenReturn(certificateReader);
    when(certificateReader.isCa()).thenReturn(true);
    when(certificateVersionDataService.findBothActiveCertAndTransitionalCert(CREDENTIAL_NAME)).thenReturn(Arrays.asList(certificateCredential, transitionalCertificateCredential));
    when(transitionalCertificateCredential.getCertificate()).thenReturn(SELF_SIGNED_CA_CERT);
    assertThat(certificateAuthorityService.findTransitionalVersion(CREDENTIAL_NAME).getCertificate(), equalTo(transitionalCertificateCredential.getCertificate()));
}

Example 4 with CertificateReader

use of org.cloudfoundry.credhub.utils.CertificateReader in project credhub by cloudfoundry.

the class DefaultCertificateAuthorityServiceTest method findActiveVersion_givenExistingCa_returnsTheCa.

@Test
public void findActiveVersion_givenExistingCa_returnsTheCa() {
    final CertificateReader certificateReader = mock(CertificateReader.class);
    when(certificateVersionDataService.findActive(CREDENTIAL_NAME)).thenReturn(certificateCredential);
    when(certificateCredential.getPrivateKey()).thenReturn("my-key");
    when(certificateCredential.getParsedCertificate()).thenReturn(certificateReader);
    when(certificateReader.isCa()).thenReturn(true);
    when(certificateCredential.isCertificateAuthority()).thenReturn(true);
    when(certificateCredential.isSelfSigned()).thenReturn(true);
    when(certificateCredential.getCertificate()).thenReturn(SELF_SIGNED_CA_CERT);
    when(certificateCredential.getGenerated()).thenReturn(false);
    when(certificateCredential.isVersionTransitional()).thenReturn(false);
    assertThat(certificateAuthorityService.findActiveVersion(CREDENTIAL_NAME), samePropertyValuesAs(certificate));
}

Example 5 with CertificateReader

use of org.cloudfoundry.credhub.utils.CertificateReader in project credhub by cloudfoundry.

the class CAValidator method isValid.

@Override
public boolean isValid(final Object value, final ConstraintValidatorContext context) {
    for (final String fieldName : fields) {
        try {
            final Field field = value.getClass().getDeclaredField(fieldName);
            field.setAccessible(true);
            if (StringUtils.isEmpty((String) field.get(value))) {
                return true;
            }
            final String certificate = (String) field.get(value);
            final CertificateReader reader = new CertificateReader(certificate);
            return reader.isCa();
        } catch (final MalformedCertificateException e) {
            return false;
        } catch (final NoSuchFieldException | IllegalAccessException e) {
            throw new RuntimeException(e);
        }
    }
    return true;
}