Examples with X509CaEntry org.xipki.ca.server.mgmt.api.x509.X509CaEntry used on opensource projects

Example 1 with X509CaEntry

use of org.xipki.ca.server.mgmt.api.x509.X509CaEntry in project xipki by xipki.

the class CaManagerImpl method generateRootCa.

// method getIdentifiedPublishersForCa
@Override
public X509Certificate generateRootCa(X509CaEntry caEntry, String profileName, byte[] encodedCsr, BigInteger serialNumber) throws CaMgmtException {
    ParamUtil.requireNonNull("caEntry", caEntry);
    profileName = ParamUtil.requireNonBlank("profileName", profileName).toLowerCase();
    ParamUtil.requireNonNull("encodedCsr", encodedCsr);
    int numCrls = caEntry.getNumCrls();
    List<String> crlUris = caEntry.getCrlUris();
    List<String> deltaCrlUris = caEntry.getDeltaCrlUris();
    List<String> ocspUris = caEntry.getOcspUris();
    List<String> caCertUris = caEntry.getCaCertUris();
    String signerType = caEntry.getSignerType();
    asssertMasterMode();
    if (numCrls < 0) {
        System.err.println("invalid numCrls: " + numCrls);
        return null;
    }
    int expirationPeriod = caEntry.getExpirationPeriod();
    if (expirationPeriod < 0) {
        System.err.println("invalid expirationPeriod: " + expirationPeriod);
        return null;
    }
    CertificationRequest csr;
    try {
        csr = CertificationRequest.getInstance(encodedCsr);
    } catch (Exception ex) {
        System.err.println("invalid encodedCsr");
        return null;
    }
    IdentifiedX509Certprofile certprofile = getIdentifiedCertprofile(profileName);
    if (certprofile == null) {
        throw new CaMgmtException(concat("unknown certprofile ", profileName));
    }
    BigInteger serialOfThisCert = (serialNumber != null) ? serialNumber : RandomSerialNumberGenerator.getInstance().nextSerialNumber(caEntry.getSerialNoBitLen());
    GenerateSelfSignedResult result;
    try {
        result = X509SelfSignedCertBuilder.generateSelfSigned(securityFactory, signerType, caEntry.getSignerConf(), certprofile, csr, serialOfThisCert, caCertUris, ocspUris, crlUris, deltaCrlUris, caEntry.getExtraControl());
    } catch (OperationException | InvalidConfException ex) {
        throw new CaMgmtException(concat(ex.getClass().getName(), ": ", ex.getMessage()), ex);
    }
    String signerConf = result.getSignerConf();
    X509Certificate caCert = result.getCert();
    if ("PKCS12".equalsIgnoreCase(signerType) || "JKS".equalsIgnoreCase(signerType)) {
        try {
            signerConf = canonicalizeSignerConf(signerType, signerConf, new X509Certificate[] { caCert }, securityFactory);
        } catch (Exception ex) {
            throw new CaMgmtException(concat(ex.getClass().getName(), ": ", ex.getMessage()), ex);
        }
    }
    X509CaUris caUris = new X509CaUris(caCertUris, ocspUris, crlUris, deltaCrlUris);
    String name = caEntry.getIdent().getName();
    long nextCrlNumber = caEntry.getNextCrlNumber();
    CaStatus status = caEntry.getStatus();
    X509CaEntry entry = new X509CaEntry(new NameId(null, name), caEntry.getSerialNoBitLen(), nextCrlNumber, signerType, signerConf, caUris, numCrls, expirationPeriod);
    entry.setCert(caCert);
    entry.setCmpControlName(caEntry.getCmpControlName());
    entry.setCrlSignerName(caEntry.getCrlSignerName());
    entry.setDuplicateKeyPermitted(caEntry.isDuplicateKeyPermitted());
    entry.setDuplicateSubjectPermitted(caEntry.isDuplicateSubjectPermitted());
    entry.setExtraControl(caEntry.getExtraControl());
    entry.setKeepExpiredCertInDays(caEntry.getKeepExpiredCertInDays());
    entry.setMaxValidity(caEntry.getMaxValidity());
    entry.setPermission(caEntry.getPermission());
    entry.setResponderName(caEntry.getResponderName());
    entry.setSaveRequest(caEntry.isSaveRequest());
    entry.setStatus(status);
    entry.setValidityMode(caEntry.getValidityMode());
    addCa(entry);
    return caCert;
}

Example 2 with X509CaEntry

use of org.xipki.ca.server.mgmt.api.x509.X509CaEntry in project xipki by xipki.

the class CaAddOrGenAction method getCaEntry.

protected X509CaEntry getCaEntry() throws Exception {
    ParamUtil.requireRange("sn-bitlen", snBitLen, 63, 159);
    if (nextCrlNumber < 1) {
        throw new IllegalCmdParamException("invalid CRL number: " + nextCrlNumber);
    }
    if (numCrls < 0) {
        throw new IllegalCmdParamException("invalid numCrls: " + numCrls);
    }
    if (expirationPeriod < 0) {
        throw new IllegalCmdParamException("invalid expirationPeriod: " + expirationPeriod);
    }
    if ("PKCS12".equalsIgnoreCase(signerType) || "JKS".equalsIgnoreCase(signerType)) {
        signerConf = ShellUtil.canonicalizeSignerConf(signerType, signerConf, passwordResolver, securityFactory);
    }
    X509CaUris caUris = new X509CaUris(caCertUris, ocspUris, crlUris, deltaCrlUris);
    X509CaEntry entry = new X509CaEntry(new NameId(null, caName), snBitLen, nextCrlNumber, signerType, signerConf, caUris, numCrls.intValue(), expirationPeriod.intValue());
    entry.setKeepExpiredCertInDays(keepExpiredCertInDays.intValue());
    boolean duplicateKeyPermitted = isEnabled(duplicateKeyS, true, "duplicate-key");
    entry.setDuplicateKeyPermitted(duplicateKeyPermitted);
    boolean duplicateSubjectPermitted = isEnabled(duplicateSubjectS, true, "duplicate-subject");
    entry.setDuplicateSubjectPermitted(duplicateSubjectPermitted);
    boolean saveReq = isEnabled(saveReqS, false, "save-req");
    entry.setSaveRequest(saveReq);
    ValidityMode validityMode = ValidityMode.forName(validityModeS);
    entry.setValidityMode(validityMode);
    CaStatus status = CaStatus.forName(caStatus);
    entry.setStatus(status);
    if (crlSignerName != null) {
        entry.setCrlSignerName(crlSignerName);
    }
    if (responderName != null) {
        entry.setResponderName(responderName);
    }
    CertValidity tmpMaxValidity = CertValidity.getInstance(maxValidity);
    entry.setMaxValidity(tmpMaxValidity);
    entry.setKeepExpiredCertInDays(keepExpiredCertInDays);
    if (cmpControlName != null) {
        entry.setCmpControlName(cmpControlName);
    }
    int intPermission = ShellUtil.getPermission(permissions);
    entry.setPermission(intPermission);
    if (extraControl != null) {
        extraControl = extraControl.trim();
    }
    if (StringUtil.isNotBlank(extraControl)) {
        entry.setExtraControl(new ConfPairs(extraControl).unmodifiable());
    }
    return entry;
}

Example 3 with X509CaEntry

use of org.xipki.ca.server.mgmt.api.x509.X509CaEntry in project xipki by xipki.

the class CaGenRcaCmd method execute0.

@Override
protected Object execute0() throws Exception {
    X509CaEntry caEntry = getCaEntry();
    byte[] csr = IoUtil.read(csrFile);
    BigInteger serialNumber = null;
    if (serialS != null) {
        serialNumber = toBigInt(serialS);
    }
    X509Certificate rootcaCert = caManager.generateRootCa(caEntry, rootcaProfile, csr, serialNumber);
    if (rootcaCertOutFile != null) {
        saveVerbose("saved root certificate to file", new File(rootcaCertOutFile), rootcaCert.getEncoded());
    }
    println("generated root CA " + caEntry.getIdent().getName());
    return null;
}

Example 4 with X509CaEntry

use of org.xipki.ca.server.mgmt.api.x509.X509CaEntry in project xipki by xipki.

the class CaAddCmd method execute0.

@Override
protected Object execute0() throws Exception {
    X509CaEntry caEntry = getCaEntry();
    if (certFile != null) {
        X509Certificate caCert = X509Util.parseCert(certFile);
        caEntry.setCert(caCert);
    }
    String msg = "CA " + caEntry.getIdent().getName();
    try {
        caManager.addCa(caEntry);
        println("added " + msg);
        return null;
    } catch (CaMgmtException ex) {
        throw new CmdFailure("could not add " + msg + ", error: " + ex.getMessage(), ex);
    }
}

Example 5 with X509CaEntry

use of org.xipki.ca.server.mgmt.api.x509.X509CaEntry in project xipki by xipki.

the class RcaNameCompleter method getEnums.

@Override
protected Set<String> getEnums() {
    Set<String> ret = new HashSet<>();
    for (String name : caManager.getCaNames()) {
        CaEntry caEntry = caManager.getCa(name);
        if (!(caEntry instanceof X509CaEntry)) {
            continue;
        }
        X509Certificate cert = ((X509CaEntry) caEntry).getCert();
        if (cert.getIssuerX500Principal().equals(cert.getSubjectX500Principal())) {
            ret.add(name);
        }
    }
    return ret;
}