Examples with X509CertImpl org.mozilla.jss.netscape.security.x509.X509CertImpl used on opensource projects

Example 36 with X509CertImpl

use of org.mozilla.jss.netscape.security.x509.X509CertImpl in project coprhd-controller by CoprHD.

the class KeyCertificatePairGenerator method generateCertificate.

/**
 * Create a self-signed X.509 Certificate
 *
 * @param pair the KeyPair
 */
private X509Certificate generateCertificate(KeyPair pair) throws GeneralSecurityException, IOException {
    PublicKey pubKey = loadPublicKeyFromBytes(pair.getPublic().getEncoded());
    PrivateKey privkey = pair.getPrivate();
    X509CertInfo info = new X509CertInfo();
    Date from = getNotBefore();
    Date to = new Date(from.getTime() + valuesHolder.getCertificateValidityInDays() * 86400000L);
    CertificateValidity interval = new CertificateValidity(from, to);
    BigInteger sn = new BigInteger(64, new SecureRandom());
    X500Name owner = new X500Name(String.format(CERTIFICATE_COMMON_NAME_FORMAT, valuesHolder.getCertificateCommonName()));
    info.set(X509CertInfo.VALIDITY, interval);
    info.set(X509CertInfo.SERIAL_NUMBER, new CertificateSerialNumber(sn));
    info.set(X509CertInfo.SUBJECT, owner);
    info.set(X509CertInfo.ISSUER, owner);
    info.set(X509CertInfo.KEY, new CertificateX509Key(pubKey));
    info.set(X509CertInfo.VERSION, new CertificateVersion(CertificateVersion.V3));
    AlgorithmId keyAlgo = AlgorithmId.get(KeyCertificateAlgorithmValuesHolder.DEFAULT_KEY_ALGORITHM);
    info.set(X509CertInfo.ALGORITHM_ID, new CertificateAlgorithmId(keyAlgo));
    AlgorithmId signingAlgo = AlgorithmId.get(valuesHolder.getSigningAlgorithm());
    info.set(CertificateAlgorithmId.NAME + "." + CertificateAlgorithmId.ALGORITHM, signingAlgo);
    // add extensions
    CertificateExtensions ext = new CertificateExtensions();
    ext.set(SubjectKeyIdentifierExtension.NAME, new SubjectKeyIdentifierExtension(new KeyIdentifier(pubKey).getIdentifier()));
    // CA public key is the same as our public key (self signed)
    ext.set(AuthorityKeyIdentifierExtension.NAME, new AuthorityKeyIdentifierExtension(new KeyIdentifier(pubKey), null, null));
    ext.set(SubjectAlternativeNameExtension.NAME, new SubjectAlternativeNameExtension(subjectAltNames()));
    info.set(X509CertInfo.EXTENSIONS, ext);
    X509CertImpl cert = new X509CertImpl(info);
    cert.sign(privkey, valuesHolder.getSigningAlgorithm());
    return cert;
}

Example 37 with X509CertImpl

use of org.mozilla.jss.netscape.security.x509.X509CertImpl in project Bytecoder by mirkosertic.

the class PolicyChecker method checkPolicy.

/**
 * Internal method to run through all the checks.
 *
 * @param currCert the certificate to be processed
 * @exception CertPathValidatorException Exception thrown if
 * the certificate does not verify
 */
private void checkPolicy(X509Certificate currCert) throws CertPathValidatorException {
    String msg = "certificate policies";
    if (debug != null) {
        debug.println("PolicyChecker.checkPolicy() ---checking " + msg + "...");
        debug.println("PolicyChecker.checkPolicy() certIndex = " + certIndex);
        debug.println("PolicyChecker.checkPolicy() BEFORE PROCESSING: " + "explicitPolicy = " + explicitPolicy);
        debug.println("PolicyChecker.checkPolicy() BEFORE PROCESSING: " + "policyMapping = " + policyMapping);
        debug.println("PolicyChecker.checkPolicy() BEFORE PROCESSING: " + "inhibitAnyPolicy = " + inhibitAnyPolicy);
        debug.println("PolicyChecker.checkPolicy() BEFORE PROCESSING: " + "policyTree = " + rootNode);
    }
    X509CertImpl currCertImpl = null;
    try {
        currCertImpl = X509CertImpl.toImpl(currCert);
    } catch (CertificateException ce) {
        throw new CertPathValidatorException(ce);
    }
    boolean finalCert = (certIndex == certPathLen);
    rootNode = processPolicies(certIndex, initPolicies, explicitPolicy, policyMapping, inhibitAnyPolicy, rejectPolicyQualifiers, rootNode, currCertImpl, finalCert);
    if (!finalCert) {
        explicitPolicy = mergeExplicitPolicy(explicitPolicy, currCertImpl, finalCert);
        policyMapping = mergePolicyMapping(policyMapping, currCertImpl);
        inhibitAnyPolicy = mergeInhibitAnyPolicy(inhibitAnyPolicy, currCertImpl);
    }
    certIndex++;
    if (debug != null) {
        debug.println("PolicyChecker.checkPolicy() AFTER PROCESSING: " + "explicitPolicy = " + explicitPolicy);
        debug.println("PolicyChecker.checkPolicy() AFTER PROCESSING: " + "policyMapping = " + policyMapping);
        debug.println("PolicyChecker.checkPolicy() AFTER PROCESSING: " + "inhibitAnyPolicy = " + inhibitAnyPolicy);
        debug.println("PolicyChecker.checkPolicy() AFTER PROCESSING: " + "policyTree = " + rootNode);
        debug.println("PolicyChecker.checkPolicy() " + msg + " verified");
    }
}

Example 38 with X509CertImpl

use of org.mozilla.jss.netscape.security.x509.X509CertImpl in project Bytecoder by mirkosertic.

the class ForwardState method updateState.

/**
 * Update the state with the next certificate added to the path.
 *
 * @param cert the certificate which is used to update the state
 */
@Override
public void updateState(X509Certificate cert) throws CertificateException, IOException, CertPathValidatorException {
    if (cert == null)
        return;
    X509CertImpl icert = X509CertImpl.toImpl(cert);
    /* see if certificate key has null parameters */
    if (PKIX.isDSAPublicKeyWithoutParams(icert.getPublicKey())) {
        keyParamsNeededFlag = true;
    }
    /* update certificate */
    this.cert = icert;
    /* update issuer DN */
    issuerDN = cert.getIssuerX500Principal();
    if (!X509CertImpl.isSelfIssued(cert)) {
        /*
             * update traversedCACerts only if this is a non-self-issued
             * intermediate CA cert
             */
        if (!init && cert.getBasicConstraints() != -1) {
            traversedCACerts++;
        }
    }
    /* update subjectNamesTraversed only if this is the EE cert or if
           this cert is not self-issued */
    if (init || !X509CertImpl.isSelfIssued(cert)) {
        X500Principal subjName = cert.getSubjectX500Principal();
        subjectNamesTraversed.add(X500Name.asX500Name(subjName));
        try {
            SubjectAlternativeNameExtension subjAltNameExt = icert.getSubjectAlternativeNameExtension();
            if (subjAltNameExt != null) {
                GeneralNames gNames = subjAltNameExt.get(SubjectAlternativeNameExtension.SUBJECT_NAME);
                for (GeneralName gName : gNames.names()) {
                    subjectNamesTraversed.add(gName.getName());
                }
            }
        } catch (IOException e) {
            if (debug != null) {
                debug.println("ForwardState.updateState() unexpected " + "exception");
                e.printStackTrace();
            }
            throw new CertPathValidatorException(e);
        }
    }
    init = false;
}

Example 39 with X509CertImpl

use of org.mozilla.jss.netscape.security.x509.X509CertImpl in project Bytecoder by mirkosertic.

the class X509CertificatePair method parse.

/* Parse the encoded bytes */
private void parse(DerValue val) throws IOException, CertificateException {
    if (val.tag != DerValue.tag_Sequence) {
        throw new IOException("Sequence tag missing for X509CertificatePair");
    }
    while (val.data != null && val.data.available() != 0) {
        DerValue opt = val.data.getDerValue();
        short tag = (byte) (opt.tag & 0x01f);
        switch(tag) {
            case TAG_FORWARD:
                if (opt.isContextSpecific() && opt.isConstructed()) {
                    if (forward != null) {
                        throw new IOException("Duplicate forward " + "certificate in X509CertificatePair");
                    }
                    opt = opt.data.getDerValue();
                    forward = X509Factory.intern(new X509CertImpl(opt.toByteArray()));
                }
                break;
            case TAG_REVERSE:
                if (opt.isContextSpecific() && opt.isConstructed()) {
                    if (reverse != null) {
                        throw new IOException("Duplicate reverse " + "certificate in X509CertificatePair");
                    }
                    opt = opt.data.getDerValue();
                    reverse = X509Factory.intern(new X509CertImpl(opt.toByteArray()));
                }
                break;
            default:
                throw new IOException("Invalid encoding of " + "X509CertificatePair");
        }
    }
    if (forward == null && reverse == null) {
        throw new CertificateException("at least one of certificate pair " + "must be non-null");
    }
}

Example 40 with X509CertImpl

use of org.mozilla.jss.netscape.security.x509.X509CertImpl in project Bytecoder by mirkosertic.

the class X509Factory method intern.

/**
 * Return an interned X509CertImpl for the given certificate.
 * If the given X509Certificate or X509CertImpl is already present
 * in the cert cache, the cached object is returned. Otherwise,
 * if it is a X509Certificate, it is first converted to a X509CertImpl.
 * Then the X509CertImpl is added to the cache and returned.
 *
 * Note that all certificates created via generateCertificate(InputStream)
 * are already interned and this method does not need to be called.
 * It is useful for certificates that cannot be created via
 * generateCertificate() and for converting other X509Certificate
 * implementations to an X509CertImpl.
 *
 * @param c The source X509Certificate
 * @return An X509CertImpl object that is either a cached certificate or a
 *      newly built X509CertImpl from the provided X509Certificate
 * @throws CertificateException if failures occur while obtaining the DER
 *      encoding for certificate data.
 */
public static synchronized X509CertImpl intern(X509Certificate c) throws CertificateException {
    if (c == null) {
        return null;
    }
    boolean isImpl = c instanceof X509CertImpl;
    byte[] encoding;
    if (isImpl) {
        encoding = ((X509CertImpl) c).getEncodedInternal();
    } else {
        encoding = c.getEncoded();
    }
    X509CertImpl newC = getFromCache(certCache, encoding);
    if (newC != null) {
        return newC;
    }
    if (isImpl) {
        newC = (X509CertImpl) c;
    } else {
        newC = new X509CertImpl(encoding);
        encoding = newC.getEncodedInternal();
    }
    addToCache(certCache, encoding, newC);
    return newC;
}