Examples with X509CertImpl org.mozilla.jss.netscape.security.x509.X509CertImpl used on opensource projects

Example 71 with X509CertImpl

use of org.mozilla.jss.netscape.security.x509.X509CertImpl in project Bytecoder by mirkosertic.

the class SimpleValidator method getNetscapeCertTypeBit.

/**
 * Get the value of the specified bit in the Netscape certificate type
 * extension. If the extension is not present at all, we return true.
 */
static boolean getNetscapeCertTypeBit(X509Certificate cert, String type) {
    try {
        NetscapeCertTypeExtension ext;
        if (cert instanceof X509CertImpl) {
            X509CertImpl certImpl = (X509CertImpl) cert;
            ObjectIdentifier oid = OBJID_NETSCAPE_CERT_TYPE;
            ext = (NetscapeCertTypeExtension) certImpl.getExtension(oid);
            if (ext == null) {
                return true;
            }
        } else {
            byte[] extVal = cert.getExtensionValue(OID_NETSCAPE_CERT_TYPE);
            if (extVal == null) {
                return true;
            }
            DerInputStream in = new DerInputStream(extVal);
            byte[] encoded = in.getOctetString();
            encoded = new DerValue(encoded).getUnalignedBitString().toByteArray();
            ext = new NetscapeCertTypeExtension(encoded);
        }
        Boolean val = ext.get(type);
        return val.booleanValue();
    } catch (IOException e) {
        return false;
    }
}

Example 72 with X509CertImpl

use of org.mozilla.jss.netscape.security.x509.X509CertImpl in project Bytecoder by mirkosertic.

the class OCSP method check.

public static RevocationStatus check(X509Certificate cert, URI responderURI, TrustAnchor anchor, X509Certificate issuerCert, X509Certificate responderCert, Date date, List<Extension> extensions, String variant) throws IOException, CertPathValidatorException {
    CertId certId;
    try {
        X509CertImpl certImpl = X509CertImpl.toImpl(cert);
        certId = new CertId(issuerCert, certImpl.getSerialNumberObject());
    } catch (CertificateException | IOException e) {
        throw new CertPathValidatorException("Exception while encoding OCSPRequest", e);
    }
    OCSPResponse ocspResponse = check(Collections.singletonList(certId), responderURI, new OCSPResponse.IssuerInfo(anchor, issuerCert), responderCert, date, extensions, variant);
    return (RevocationStatus) ocspResponse.getSingleResponse(certId);
}

Example 73 with X509CertImpl

use of org.mozilla.jss.netscape.security.x509.X509CertImpl in project Bytecoder by mirkosertic.

the class X509Factory method parseX509orPKCS7Cert.

/*
     * Parses the data in the given input stream as a sequence of DER
     * encoded X.509 certificates (in binary or base 64 encoded format) OR
     * as a single PKCS#7 encoded blob (in binary or base64 encoded format).
     */
private Collection<? extends java.security.cert.Certificate> parseX509orPKCS7Cert(InputStream is) throws CertificateException, IOException {
    int peekByte;
    byte[] data;
    PushbackInputStream pbis = new PushbackInputStream(is);
    Collection<X509CertImpl> coll = new ArrayList<>();
    // Test the InputStream for end-of-stream.  If the stream's
    // initial state is already at end-of-stream then return
    // an empty collection.  Otherwise, push the byte back into the
    // stream and let readOneBlock look for the first certificate.
    peekByte = pbis.read();
    if (peekByte == -1) {
        return new ArrayList<>(0);
    } else {
        pbis.unread(peekByte);
        data = readOneBlock(pbis);
    }
    // data has been found.
    if (data == null) {
        throw new CertificateException("No certificate data found");
    }
    try {
        PKCS7 pkcs7 = new PKCS7(data);
        X509Certificate[] certs = pkcs7.getCertificates();
        // certs are optional in PKCS #7
        if (certs != null) {
            return Arrays.asList(certs);
        } else {
            // no certificates provided
            return new ArrayList<>(0);
        }
    } catch (ParsingException e) {
        while (data != null) {
            coll.add(new X509CertImpl(data));
            data = readOneBlock(pbis);
        }
    }
    return coll;
}

Example 74 with X509CertImpl

use of org.mozilla.jss.netscape.security.x509.X509CertImpl in project Bytecoder by mirkosertic.

the class X509Factory method engineGenerateCertificate.

/**
 * Generates an X.509 certificate object and initializes it with
 * the data read from the input stream <code>is</code>.
 *
 * @param is an input stream with the certificate data.
 *
 * @return an X.509 certificate object initialized with the data
 * from the input stream.
 *
 * @exception CertificateException on parsing errors.
 */
@Override
public Certificate engineGenerateCertificate(InputStream is) throws CertificateException {
    if (is == null) {
        // clear the caches (for debugging)
        certCache.clear();
        X509CertificatePair.clearCache();
        throw new CertificateException("Missing input stream");
    }
    try {
        byte[] encoding = readOneBlock(is);
        if (encoding != null) {
            X509CertImpl cert = getFromCache(certCache, encoding);
            if (cert != null) {
                return cert;
            }
            cert = new X509CertImpl(encoding);
            addToCache(certCache, cert.getEncodedInternal(), cert);
            return cert;
        } else {
            throw new IOException("Empty input");
        }
    } catch (IOException ioe) {
        throw new CertificateException("Could not parse certificate: " + ioe.toString(), ioe);
    }
}

Example 75 with X509CertImpl

use of org.mozilla.jss.netscape.security.x509.X509CertImpl in project Bytecoder by mirkosertic.

the class AlgorithmChecker method check.

@Override
public void check(Certificate cert, Collection<String> unresolvedCritExts) throws CertPathValidatorException {
    if (!(cert instanceof X509Certificate) || constraints == null) {
        // ignore the check for non-x.509 certificate or null constraints
        return;
    }
    // check the key usage and key size
    boolean[] keyUsage = ((X509Certificate) cert).getKeyUsage();
    if (keyUsage != null && keyUsage.length < 9) {
        throw new CertPathValidatorException("incorrect KeyUsage extension", null, null, -1, PKIXReason.INVALID_KEY_USAGE);
    }
    X509CertImpl x509Cert;
    AlgorithmId algorithmId;
    try {
        x509Cert = X509CertImpl.toImpl((X509Certificate) cert);
        algorithmId = (AlgorithmId) x509Cert.get(X509CertImpl.SIG_ALG);
    } catch (CertificateException ce) {
        throw new CertPathValidatorException(ce);
    }
    AlgorithmParameters currSigAlgParams = algorithmId.getParameters();
    PublicKey currPubKey = cert.getPublicKey();
    String currSigAlg = x509Cert.getSigAlgName();
    // Check the signature algorithm and parameters against constraints.
    if (!constraints.permits(SIGNATURE_PRIMITIVE_SET, currSigAlg, currSigAlgParams)) {
        throw new CertPathValidatorException("Algorithm constraints check failed on signature " + "algorithm: " + currSigAlg, null, null, -1, BasicReason.ALGORITHM_CONSTRAINED);
    }
    // Assume all key usage bits are set if key usage is not present
    Set<CryptoPrimitive> primitives = KU_PRIMITIVE_SET;
    if (keyUsage != null) {
        primitives = EnumSet.noneOf(CryptoPrimitive.class);
        if (keyUsage[0] || keyUsage[1] || keyUsage[5] || keyUsage[6]) {
            // keyUsage[0]: KeyUsage.digitalSignature
            // keyUsage[1]: KeyUsage.nonRepudiation
            // keyUsage[5]: KeyUsage.keyCertSign
            // keyUsage[6]: KeyUsage.cRLSign
            primitives.add(CryptoPrimitive.SIGNATURE);
        }
        if (keyUsage[2]) {
            // KeyUsage.keyEncipherment
            primitives.add(CryptoPrimitive.KEY_ENCAPSULATION);
        }
        if (keyUsage[3]) {
            // KeyUsage.dataEncipherment
            primitives.add(CryptoPrimitive.PUBLIC_KEY_ENCRYPTION);
        }
        if (keyUsage[4]) {
            // KeyUsage.keyAgreement
            primitives.add(CryptoPrimitive.KEY_AGREEMENT);
        }
        if (primitives.isEmpty()) {
            throw new CertPathValidatorException("incorrect KeyUsage extension bits", null, null, -1, PKIXReason.INVALID_KEY_USAGE);
        }
    }
    ConstraintsParameters cp = new ConstraintsParameters((X509Certificate) cert, trustedMatch, pkixdate, jarTimestamp, variant);
    // Check against local constraints if it is DisabledAlgorithmConstraints
    if (constraints instanceof DisabledAlgorithmConstraints) {
        ((DisabledAlgorithmConstraints) constraints).permits(currSigAlg, cp);
    // DisabledAlgorithmsConstraints does not check primitives, so key
    // additional key check.
    } else {
        // Perform the default constraints checking anyway.
        certPathDefaultConstraints.permits(currSigAlg, cp);
        // Call locally set constraints to check key with primitives.
        if (!constraints.permits(primitives, currPubKey)) {
            throw new CertPathValidatorException("Algorithm constraints check failed on key " + currPubKey.getAlgorithm() + " with size of " + sun.security.util.KeyUtil.getKeySize(currPubKey) + "bits", null, null, -1, BasicReason.ALGORITHM_CONSTRAINED);
        }
    }
    // If there is no previous key, set one and exit
    if (prevPubKey == null) {
        prevPubKey = currPubKey;
        return;
    }
    // Check with previous cert for signature algorithm and public key
    if (!constraints.permits(SIGNATURE_PRIMITIVE_SET, currSigAlg, prevPubKey, currSigAlgParams)) {
        throw new CertPathValidatorException("Algorithm constraints check failed on " + "signature algorithm: " + currSigAlg, null, null, -1, BasicReason.ALGORITHM_CONSTRAINED);
    }
    // Inherit key parameters from previous key
    if (PKIX.isDSAPublicKeyWithoutParams(currPubKey)) {
        // Inherit DSA parameters from previous key
        if (!(prevPubKey instanceof DSAPublicKey)) {
            throw new CertPathValidatorException("Input key is not " + "of a appropriate type for inheriting parameters");
        }
        DSAParams params = ((DSAPublicKey) prevPubKey).getParams();
        if (params == null) {
            throw new CertPathValidatorException("Key parameters missing from public key.");
        }
        try {
            BigInteger y = ((DSAPublicKey) currPubKey).getY();
            KeyFactory kf = KeyFactory.getInstance("DSA");
            DSAPublicKeySpec ks = new DSAPublicKeySpec(y, params.getP(), params.getQ(), params.getG());
            currPubKey = kf.generatePublic(ks);
        } catch (GeneralSecurityException e) {
            throw new CertPathValidatorException("Unable to generate " + "key with inherited parameters: " + e.getMessage(), e);
        }
    }
    // reset the previous public key
    prevPubKey = currPubKey;
}