Examples with X500Name org.mozilla.jss.netscape.security.x509.X500Name used on opensource projects

Example 86 with X500Name

use of org.mozilla.jss.netscape.security.x509.X500Name in project snikket-android by snikket-im.

the class XmppDomainVerifier method getCommonNames.

private static List<String> getCommonNames(X509Certificate certificate) {
    List<String> domains = new ArrayList<>();
    try {
        X500Name x500name = new JcaX509CertificateHolder(certificate).getSubject();
        RDN[] rdns = x500name.getRDNs(BCStyle.CN);
        for (int i = 0; i < rdns.length; ++i) {
            domains.add(IETFUtils.valueToString(x500name.getRDNs(BCStyle.CN)[i].getFirst().getValue()));
        }
        return domains;
    } catch (CertificateEncodingException e) {
        return domains;
    }
}

Example 87 with X500Name

use of org.mozilla.jss.netscape.security.x509.X500Name in project credhub by cloudfoundry.

the class CertificateGeneratorTest method whenCAExists_andItIsAIntermediateCA_aValidChildCertificateIsGenerated.

@Test
public void whenCAExists_andItIsAIntermediateCA_aValidChildCertificateIsGenerated() throws Exception {
    final KeyPair childCertificateKeyPair = setupKeyPair();
    final X500Name intermediateCaDn = new X500Name("O=foo,ST=bar,C=intermediate");
    final KeyPair intermediateCaKeyPair = fakeKeyPairGenerator.generate();
    final X509CertificateHolder intermediateCaCertificateHolder = makeCert(intermediateCaKeyPair, rootCaKeyPair.getPrivate(), rootCaDn, intermediateCaDn, true);
    final X509Certificate intermediateX509Certificate = new JcaX509CertificateConverter().setProvider(BouncyCastleFipsProvider.PROVIDER_NAME).getCertificate(intermediateCaCertificateHolder);
    final CertificateCredentialValue intermediateCa = new CertificateCredentialValue(null, CertificateFormatter.pemOf(intermediateX509Certificate), CertificateFormatter.pemOf(intermediateCaKeyPair.getPrivate()), null, true, false, false, false);
    when(certificateAuthorityService.findActiveVersion("/my-ca-name")).thenReturn(intermediateCa);
    when(keyGenerator.generateKeyPair(anyInt())).thenReturn(childCertificateKeyPair);
    final X509CertificateHolder childCertificateHolder = generateChildCertificateSignedByCa(childCertificateKeyPair, intermediateCaKeyPair.getPrivate(), intermediateCaDn);
    childX509Certificate = new JcaX509CertificateConverter().setProvider(BouncyCastleFipsProvider.PROVIDER_NAME).getCertificate(childCertificateHolder);
    when(signedCertificateGenerator.getSignedByIssuer(childCertificateKeyPair, inputParameters, intermediateX509Certificate, intermediateCaKeyPair.getPrivate())).thenReturn(childX509Certificate);
    final CertificateCredentialValue certificateSignedByIntermediate = subject.generateCredential(inputParameters);
    assertThat(certificateSignedByIntermediate.getCa(), equalTo(intermediateCa.getCertificate()));
    assertThat(certificateSignedByIntermediate.getPrivateKey(), equalTo(CertificateFormatter.pemOf(childCertificateKeyPair.getPrivate())));
    assertThat(certificateSignedByIntermediate.getCertificate(), equalTo(CertificateFormatter.pemOf(childX509Certificate)));
    verify(keyGenerator, times(1)).generateKeyPair(2048);
}

Example 88 with X500Name

use of org.mozilla.jss.netscape.security.x509.X500Name in project mockserver by mock-server.

the class BCKeyAndCertificateFactory method createCASignedCert.

/**
 * Create a server certificate for the given domain and subject alternative names, signed by the given Certificate Authority.
 */
private X509Certificate createCASignedCert(PublicKey publicKey, X509Certificate certificateAuthorityCert, PrivateKey certificateAuthorityPrivateKey, PublicKey certificateAuthorityPublicKey, String domain, Set<String> subjectAlternativeNameDomains, Set<String> subjectAlternativeNameIps) throws Exception {
    // signers name
    X500Name issuer = new X509CertificateHolder(certificateAuthorityCert.getEncoded()).getSubject();
    // subjects name - the same as we are self signed.
    X500Name subject = new X500Name("CN=" + domain + ", O=MockServer, L=London, ST=England, C=UK");
    // serial
    BigInteger serial = BigInteger.valueOf(new Random().nextInt(Integer.MAX_VALUE));
    // create the certificate - version 3
    X509v3CertificateBuilder builder = new JcaX509v3CertificateBuilder(issuer, serial, NOT_BEFORE, NOT_AFTER, subject, publicKey);
    builder.addExtension(Extension.subjectKeyIdentifier, false, createSubjectKeyIdentifier(publicKey));
    builder.addExtension(Extension.basicConstraints, false, new BasicConstraints(false));
    // subject alternative name
    List<ASN1Encodable> subjectAlternativeNames = new ArrayList<>();
    if (subjectAlternativeNameDomains != null) {
        subjectAlternativeNames.add(new GeneralName(GeneralName.dNSName, domain));
        for (String subjectAlternativeNameDomain : subjectAlternativeNameDomains) {
            subjectAlternativeNames.add(new GeneralName(GeneralName.dNSName, subjectAlternativeNameDomain));
        }
    }
    if (subjectAlternativeNameIps != null) {
        for (String subjectAlternativeNameIp : subjectAlternativeNameIps) {
            if (IPAddress.isValidIPv6WithNetmask(subjectAlternativeNameIp) || IPAddress.isValidIPv6(subjectAlternativeNameIp) || IPAddress.isValidIPv4WithNetmask(subjectAlternativeNameIp) || IPAddress.isValidIPv4(subjectAlternativeNameIp)) {
                subjectAlternativeNames.add(new GeneralName(GeneralName.iPAddress, subjectAlternativeNameIp));
            }
        }
    }
    if (subjectAlternativeNames.size() > 0) {
        DERSequence subjectAlternativeNamesExtension = new DERSequence(subjectAlternativeNames.toArray(new ASN1Encodable[0]));
        builder.addExtension(Extension.subjectAlternativeName, false, subjectAlternativeNamesExtension);
    }
    X509Certificate signedX509Certificate = signCertificate(builder, certificateAuthorityPrivateKey);
    // validate
    signedX509Certificate.checkValidity(new Date());
    signedX509Certificate.verify(certificateAuthorityPublicKey);
    return signedX509Certificate;
}

Example 89 with X500Name

use of org.mozilla.jss.netscape.security.x509.X500Name in project mockserver by mock-server.

the class BCKeyAndCertificateFactory method createCACert.

private X509Certificate createCACert(PublicKey publicKey, PrivateKey privateKey) throws Exception {
    // signers name
    X500Name issuerName = new X500Name("CN=www.mockserver.com, O=MockServer, L=London, ST=England, C=UK");
    // serial
    BigInteger serial = BigInteger.valueOf(new Random().nextInt(Integer.MAX_VALUE));
    // create the certificate - version 3 (with subjects name same as issues as self signed)
    X509v3CertificateBuilder builder = new JcaX509v3CertificateBuilder(issuerName, serial, NOT_BEFORE, NOT_AFTER, issuerName, publicKey);
    builder.addExtension(Extension.subjectKeyIdentifier, false, createSubjectKeyIdentifier(publicKey));
    builder.addExtension(Extension.basicConstraints, true, new BasicConstraints(true));
    KeyUsage usage = new KeyUsage(KeyUsage.keyCertSign | KeyUsage.digitalSignature | KeyUsage.keyEncipherment | KeyUsage.dataEncipherment | KeyUsage.cRLSign);
    builder.addExtension(Extension.keyUsage, false, usage);
    ASN1EncodableVector purposes = new ASN1EncodableVector();
    purposes.add(KeyPurposeId.id_kp_serverAuth);
    purposes.add(KeyPurposeId.id_kp_clientAuth);
    purposes.add(KeyPurposeId.anyExtendedKeyUsage);
    builder.addExtension(Extension.extendedKeyUsage, false, new DERSequence(purposes));
    X509Certificate cert = signCertificate(builder, privateKey);
    cert.checkValidity(new Date());
    cert.verify(publicKey);
    return cert;
}

Example 90 with X500Name

use of org.mozilla.jss.netscape.security.x509.X500Name in project mockserver by mock-server.

the class X509Generator method generateLeafX509AndPrivateKey.

public X509AndPrivateKey generateLeafX509AndPrivateKey(final CertificateSigningRequest csr, String issuerDistinguishingName, final String caPrivateKey, final X509Certificate caCertificate) throws IOException, NoSuchAlgorithmException, CertificateException, InvalidKeyException, NoSuchProviderException, SignatureException, InvalidKeySpecException {
    final PrivateKey privateKey = KeyFactory.getInstance(csr.getKeyPairAlgorithm()).generatePrivate(keySpecFromPEM(caPrivateKey));
    final KeyPair keyPair = generateKeyPair(csr.getKeyPairAlgorithm(), csr.getKeyPairSize());
    final X500Name subject = new X500Name(buildDistinguishedName(csr.getCommonName()));
    final X500Name issuer = new X500Name(issuerDistinguishingName);
    X509CertInfo x509CertInfo = buildX509CertInfo(subject, issuer, keyPair.getPublic(), csr);
    updateWithCertificateExtensions(x509CertInfo, keyPair.getPublic(), caCertificate.getPublicKey(), csr.getSubjectAlternativeNames());
    X509AndPrivateKey x509AndPrivateKey = signX509KeyPair(privateKey, keyPair, x509CertInfo, csr.getSigningAlgorithm());
    // validate
    X509Certificate signedX509Certificate = x509FromPEM(x509AndPrivateKey.getCert());
    signedX509Certificate.checkValidity(new Date());
    signedX509Certificate.verify(caCertificate.getPublicKey());
    return x509AndPrivateKey;
}