Examples with CrlControl org.xipki.ca.server.mgmt.api.x509.CrlControl used on opensource projects

Example 1 with CrlControl

use of org.xipki.ca.server.mgmt.api.x509.CrlControl in project xipki by xipki.

the class CaManagerQueryExecutor method changeCrlSigner.

// method changeResponder
X509CrlSignerEntryWrapper changeCrlSigner(String name, String signerType, String signerConf, String base64Cert, String crlControl, CaManagerImpl caManager, SecurityFactory securityFactory) throws CaMgmtException {
    ParamUtil.requireNonBlank("name", name);
    ParamUtil.requireNonNull("caManager", caManager);
    StringBuilder sqlBuilder = new StringBuilder();
    sqlBuilder.append("UPDATE CRLSIGNER SET ");
    AtomicInteger index = new AtomicInteger(1);
    Integer idxSignerType = addToSqlIfNotNull(sqlBuilder, index, signerType, "SIGNER_TYPE");
    Integer idxSignerCert = addToSqlIfNotNull(sqlBuilder, index, base64Cert, "SIGNER_CERT");
    Integer idxCrlControl = addToSqlIfNotNull(sqlBuilder, index, crlControl, "CRL_CONTROL");
    Integer idxSignerConf = addToSqlIfNotNull(sqlBuilder, index, signerConf, "SIGNER_CONF");
    sqlBuilder.deleteCharAt(sqlBuilder.length() - 1);
    sqlBuilder.append(" WHERE NAME=?");
    if (index.get() == 1) {
        throw new IllegalArgumentException("nothing to change");
    }
    X509CrlSignerEntry dbEntry = createCrlSigner(name);
    String tmpSignerType = (signerType == null) ? dbEntry.getType() : signerType;
    String tmpCrlControl = crlControl;
    String tmpSignerConf;
    String tmpBase64Cert;
    if ("CA".equalsIgnoreCase(tmpSignerType)) {
        tmpSignerConf = null;
        tmpBase64Cert = null;
    } else {
        if (signerConf == null) {
            tmpSignerConf = dbEntry.getConf();
        } else {
            tmpSignerConf = CaManagerImpl.canonicalizeSignerConf(tmpSignerType, signerConf, null, securityFactory);
        }
        if (base64Cert == null) {
            tmpBase64Cert = dbEntry.getBase64Cert();
        } else {
            tmpBase64Cert = base64Cert;
        }
    }
    if (tmpCrlControl == null) {
        tmpCrlControl = dbEntry.crlControl();
    } else {
        // validate crlControl
        try {
            new CrlControl(tmpCrlControl);
        } catch (InvalidConfException ex) {
            throw new CaMgmtException(concat("invalid CRL control '", tmpCrlControl, "'"));
        }
    }
    try {
        dbEntry = new X509CrlSignerEntry(name, tmpSignerType, tmpSignerConf, tmpBase64Cert, tmpCrlControl);
    } catch (InvalidConfException ex) {
        throw new CaMgmtException(ex);
    }
    X509CrlSignerEntryWrapper crlSigner = caManager.createX509CrlSigner(dbEntry);
    final String sql = sqlBuilder.toString();
    PreparedStatement ps = null;
    try {
        StringBuilder sb = new StringBuilder();
        ps = prepareStatement(sql);
        if (idxSignerType != null) {
            sb.append("signerType: '").append(tmpSignerType).append("'; ");
            ps.setString(idxSignerType, tmpSignerType);
        }
        if (idxSignerConf != null) {
            String txt = getRealString(tmpSignerConf);
            sb.append("signerConf: '").append(SignerConf.toString(txt, false, true)).append("'; ");
            ps.setString(idxSignerConf, txt);
        }
        if (idxSignerCert != null) {
            String txt = getRealString(tmpBase64Cert);
            String subject = null;
            if (txt != null) {
                try {
                    subject = canonicalizName(X509Util.parseBase64EncodedCert(txt).getSubjectX500Principal());
                } catch (CertificateException ex) {
                    subject = "ERROR";
                }
            }
            sb.append("signerCert: '").append(subject).append("'; ");
            ps.setString(idxSignerCert, txt);
        }
        if (idxCrlControl != null) {
            sb.append("crlControl: '").append(tmpCrlControl).append("'; ");
            ps.setString(idxCrlControl, tmpCrlControl);
        }
        ps.setString(index.get(), name);
        if (ps.executeUpdate() == 0) {
            throw new CaMgmtException("could not change CRL signer " + name);
        }
        if (sb.length() > 0) {
            sb.deleteCharAt(sb.length() - 1).deleteCharAt(sb.length() - 1);
        }
        LOG.info("changed CRL signer '{}': {}", name, sb);
        return crlSigner;
    } catch (SQLException ex) {
        throw new CaMgmtException(datasource, sql, ex);
    } finally {
        datasource.releaseResources(ps, null);
    }
}

Example 2 with CrlControl

use of org.xipki.ca.server.mgmt.api.x509.CrlControl in project xipki by xipki.

the class X509CrlSignerEntryWrapper method setDbEntry.

public void setDbEntry(X509CrlSignerEntry dbEntry) throws InvalidConfException {
    this.dbEntry = dbEntry;
    this.crlControl = new CrlControl(dbEntry.crlControl());
}

Example 3 with CrlControl

use of org.xipki.ca.server.mgmt.api.x509.CrlControl in project xipki by xipki.

the class CrlSignerAddCmd method execute0.

@Override
protected Object execute0() throws Exception {
    String base64Cert = null;
    if (!"CA".equalsIgnoreCase(signerType)) {
        if (signerCertFile != null) {
            byte[] encodedCert = IoUtil.read(signerCertFile);
            base64Cert = IoUtil.base64Encode(encodedCert, false);
            X509Util.parseCert(encodedCert);
        }
        if (signerConf != null) {
            if ("PKCS12".equalsIgnoreCase(signerType) || "JKS".equalsIgnoreCase(signerType)) {
                signerConf = ShellUtil.canonicalizeSignerConf(signerType, signerConf, passwordResolver, securityFactory);
            }
        }
    }
    X509CrlSignerEntry entry = new X509CrlSignerEntry(name, signerType, signerConf, base64Cert, crlControl);
    String msg = "CRL signer " + name;
    try {
        caManager.addCrlSigner(entry);
        println("added " + msg);
        return null;
    } catch (CaMgmtException ex) {
        throw new CmdFailure("could not add " + msg + ", error: " + ex.getMessage(), ex);
    }
}

Example 4 with CrlControl

use of org.xipki.ca.server.mgmt.api.x509.CrlControl in project xipki by xipki.

the class CrlSignerCheckCmd method execute0.

@Override
protected Object execute0() throws Exception {
    X509ChangeCrlSignerEntry ey = getCrlSignerChangeEntry();
    String name = ey.getName();
    println("checking CRL signer " + name);
    X509CrlSignerEntry cs = caManager.getCrlSigner(name);
    if (cs == null) {
        throw new CmdFailure("CRL signer named '" + name + "' is not configured");
    }
    if (ey.getSignerType() != null) {
        MgmtQaShellUtil.assertEquals("signer type", ey.getSignerType(), cs.getType());
    }
    if (ey.getSignerConf() != null) {
        MgmtQaShellUtil.assertEquals("signer conf", ey.getSignerConf(), cs.getConf());
    }
    if (ey.getCrlControl() != null) {
        CrlControl ex = new CrlControl(ey.getCrlControl());
        CrlControl is = new CrlControl(cs.crlControl());
        if (!ex.equals(is)) {
            throw new CmdFailure("CRL control: is '" + is.getConf() + "', but expected '" + ex.getConf() + "'");
        }
    }
    if (ey.getBase64Cert() != null) {
        MgmtQaShellUtil.assertEquals("certificate", ey.getBase64Cert(), cs.getBase64Cert());
    }
    println(" checked CRL signer " + name);
    return null;
}

Example 5 with CrlControl

use of org.xipki.ca.server.mgmt.api.x509.CrlControl in project xipki by xipki.

the class CaManagerQueryExecutor method addCrlSigner.

// method addRequestorToCa
void addCrlSigner(X509CrlSignerEntry dbEntry) throws CaMgmtException {
    ParamUtil.requireNonNull("dbEntry", dbEntry);
    String crlControl = dbEntry.crlControl();
    // validate crlControl
    if (crlControl != null) {
        try {
            new CrlControl(crlControl);
        } catch (InvalidConfException ex) {
            throw new CaMgmtException(concat("invalid CRL control '", crlControl, "'"));
        }
    }
    String name = dbEntry.getName();
    String sql = "INSERT INTO CRLSIGNER (NAME,SIGNER_TYPE,SIGNER_CERT,CRL_CONTROL,SIGNER_CONF)" + " VALUES (?,?,?,?,?)";
    PreparedStatement ps = null;
    try {
        ps = prepareStatement(sql);
        int idx = 1;
        ps.setString(idx++, name);
        ps.setString(idx++, dbEntry.getType());
        ps.setString(idx++, (dbEntry.getCert() == null) ? null : Base64.encodeToString(dbEntry.getCert().getEncoded()));
        ps.setString(idx++, crlControl);
        ps.setString(idx++, dbEntry.getConf());
        if (ps.executeUpdate() == 0) {
            throw new CaMgmtException("could not add CRL signer " + name);
        }
        LOG.info("added CRL signer '{}': {}", name, dbEntry.toString(false, true));
    } catch (SQLException ex) {
        throw new CaMgmtException(datasource, sql, ex);
    } catch (CertificateEncodingException ex) {
        throw new CaMgmtException(ex);
    } finally {
        datasource.releaseResources(ps, null);
    }
}