Example usage for org.bouncycastle.asn1 ASN1InputStream readObject

List of usage examples for org.bouncycastle.asn1 ASN1InputStream readObject

  1. HOME
  2. Java
  3. org.bouncycastle
  4. org.bouncycastle.asn1.*
  5. ASN1InputStream
  6. readObject

Introduction

In this page you can find the example usage for org.bouncycastle.asn1 ASN1InputStream readObject.

Prototype

public ASN1Primitive readObject() throws IOException

Source Link

Usage

From source file:org.ejbca.core.protocol.ocsp.OCSPUnidClient.java

License:Open Source License

private OCSPUnidResponse sendOCSPRequest(byte[] ocspPackage, X509Certificate knownTrustAnchor, boolean useGet)
        throws IOException, OCSPException, OperatorCreationException, CertificateException,
        UnrecoverableKeyException, KeyManagementException, NoSuchAlgorithmException, KeyStoreException {
    final HttpURLConnection con;
    if (useGet) {
        String b64 = new String(Base64.encode(ocspPackage, false));
        URL url = new URL(httpReqPath + '/' + b64);
        con = (HttpURLConnection) url.openConnection();
    } else {/*from w w  w. j  av a 2  s. c o  m*/
        // POST the OCSP request
        URL url = new URL(httpReqPath);
        con = (HttpURLConnection) getUrlConnection(url);
        // we are going to do a POST
        con.setDoOutput(true);
        con.setRequestMethod("POST");
        // POST it
        con.setRequestProperty("Content-Type", "application/ocsp-request");
        OutputStream os = null;
        try {
            os = con.getOutputStream();
            os.write(ocspPackage);
        } finally {
            if (os != null) {
                os.close();
            }
        }
    }
    final OCSPUnidResponse ret = new OCSPUnidResponse();
    ret.setHttpReturnCode(con.getResponseCode());
    if (ret.getHttpReturnCode() != 200) {
        if (ret.getHttpReturnCode() == 401) {
            ret.setErrorCode(OCSPUnidResponse.ERROR_UNAUTHORIZED);
        } else {
            ret.setErrorCode(OCSPUnidResponse.ERROR_UNKNOWN);
        }
        return ret;
    }
    final OCSPResp response;
    {
        final InputStream in = con.getInputStream();
        if (in != null) {
            try {
                response = new OCSPResp(IOUtils.toByteArray(in));
            } finally {
                in.close();
            }
        } else {
            response = null;
        }
    }
    if (response == null) {
        ret.setErrorCode(OCSPUnidResponse.ERROR_NO_RESPONSE);
        return ret;
    }
    ret.setResp(response);
    final BasicOCSPResp brep = (BasicOCSPResp) response.getResponseObject();
    if (brep == null) {
        ret.setErrorCode(OCSPUnidResponse.ERROR_NO_RESPONSE);
        return ret;
    }
    // Compare nonces to see if the server sent the same nonce as we sent
    final byte[] noncerep = brep.getExtension(OCSPObjectIdentifiers.id_pkix_ocsp_nonce).getExtnValue()
            .getEncoded();
    if (noncerep != null) {
        ASN1InputStream ain = new ASN1InputStream(noncerep);
        ASN1OctetString oct = ASN1OctetString.getInstance(ain.readObject());
        ain.close();
        boolean eq = ArrayUtils.isEquals(this.nonce, oct.getOctets());
        if (!eq) {
            ret.setErrorCode(OCSPUnidResponse.ERROR_INVALID_NONCE);
            return ret;
        }
    }

    final RespID id = brep.getResponderId();
    final DERTaggedObject to = (DERTaggedObject) id.toASN1Object().toASN1Primitive();
    final RespID respId;
    final X509CertificateHolder[] chain = brep.getCerts();
    JcaX509CertificateConverter converter = new JcaX509CertificateConverter();
    X509Certificate signerCertificate = converter.getCertificate(chain[0]);
    final PublicKey signerPub = signerCertificate.getPublicKey();
    if (to.getTagNo() == 1) {
        // This is Name
        respId = new JcaRespID(signerCertificate.getSubjectX500Principal());
    } else {
        // This is KeyHash
        respId = new JcaRespID(signerPub, SHA1DigestCalculator.buildSha1Instance());
    }
    if (!id.equals(respId)) {
        // Response responderId does not match signer certificate responderId!
        ret.setErrorCode(OCSPUnidResponse.ERROR_INVALID_SIGNERID);
    }
    if (!brep.isSignatureValid(new JcaContentVerifierProviderBuilder().build(signerPub))) {
        ret.setErrorCode(OCSPUnidResponse.ERROR_INVALID_SIGNATURE);
        return ret;
    }

    /* 
     * Okay, at this point we have three different variables and six different possible valid use cases. These
     * variables are:
     *          1. If the OCSP reply is from a CA (integrated) or an OCSP responder (standalone) 
     *          2. If it was from a CA, then if that CA is self signed or a subCA
     *          3. If the server (in the integrated case) or keybinding (standalone case) was set to include the certificate chain
     */

    //If we have a chain, verify it
    if (chain.length > 1) {
        // end at one shortof chain.length, because the root certificate is (usually) not included in the OCSP response
        // TODO: improve this when we can pass in the root cert from parameter to properly validate the whole chain
        for (int i = 0; i + 1 < chain.length; i++) {
            final X509Certificate cert1 = converter.getCertificate(chain[i]);
            final X509Certificate cert2 = converter.getCertificate(chain[Math.min(i + 1, chain.length - 1)]);
            try {
                cert1.verify(cert2.getPublicKey());
            } catch (GeneralSecurityException e) {
                m_log.info("Verifying problem with", e);
                m_log.info("Certificate to be verified: " + cert1);
                m_log.info("Verifying certificate: " + cert2);
                ret.setErrorCode(OCSPUnidResponse.ERROR_INVALID_SIGNERCERT);
                return ret;
            }
        }
    }

    if (CertTools.isCA(signerCertificate)) {
        //Verify that the signer certificate was the same as the trust anchor
        if (!signerCertificate.getSerialNumber().equals(knownTrustAnchor.getSerialNumber())) {
            m_log.info("Signing certificate for integrated OCSP was not the provided trust anchor.");
            ret.setErrorCode(OCSPUnidResponse.ERROR_INVALID_SIGNERCERT);
            return ret;
        }
    } else if (CertTools.isOCSPCert(signerCertificate)) {
        //If an OCSP certificate was used to sign
        try {
            signerCertificate.verify(knownTrustAnchor.getPublicKey());
        } catch (GeneralSecurityException e) {
            m_log.info("Signing certificate was not signed by known trust anchor.");
            ret.setErrorCode(OCSPUnidResponse.ERROR_INVALID_SIGNERCERT);
            return ret;
        }
    } else {
        m_log.info("Signing certificate was not an OCSP certificate.");
        ret.setErrorCode(OCSPUnidResponse.ERROR_INVALID_SIGNERCERT);
        return ret;
    }

    String fnr = getFnr(brep);
    if (fnr != null) {
        ret.setFnr(fnr);
    }
    return ret;
}

From source file:org.ejbca.core.protocol.ocsp.OCSPUnidClient.java

License:Open Source License

private String getFnr(BasicOCSPResp brep) throws IOException {
    Extension fnrrep = brep.getExtension(FnrFromUnidExtension.FnrFromUnidOid);
    if (fnrrep == null) {
        return null;
    }/*from   w w  w  .  j  a  v a2 s .c  o  m*/
    ASN1InputStream aIn = new ASN1InputStream(new ByteArrayInputStream(fnrrep.getExtnValue().getEncoded()));
    ASN1OctetString octs = (ASN1OctetString) aIn.readObject();
    aIn = new ASN1InputStream(new ByteArrayInputStream(octs.getOctets()));
    FnrFromUnidExtension fnrobj = FnrFromUnidExtension.getInstance(aIn.readObject());
    return fnrobj.getFnr();
}

From source file:org.ejbca.core.protocol.ocsp.ProtocolLookupServerHttpTest.java

License:Open Source License

private String getFnr(BasicOCSPResp brep) throws IOException {
    byte[] fnrrep = brep.getExtension(FnrFromUnidExtension.FnrFromUnidOid).getExtnValue().getEncoded();
    if (fnrrep == null) {
        return null;
    }/*from   w  w w. j  a v a  2 s  .c o  m*/
    assertNotNull(fnrrep);
    ASN1InputStream aIn = new ASN1InputStream(new ByteArrayInputStream(fnrrep));
    ASN1OctetString octs = (ASN1OctetString) aIn.readObject();
    aIn = new ASN1InputStream(new ByteArrayInputStream(octs.getOctets()));
    FnrFromUnidExtension fnrobj = FnrFromUnidExtension.getInstance(aIn.readObject());
    return fnrobj.getFnr();
}

From source file:org.ejbca.core.protocol.ocsp.ProtocolOcspHttpPerfTest.java

License:Open Source License

private SingleResp sendOCSPPost(byte[] ocspPackage, String nonce) throws IOException, OCSPException,
        NoSuchProviderException, OperatorCreationException, CertificateException {
    // POST the OCSP request
    URL url = new URL(httpReqPath + '/' + resourceOcsp);
    HttpURLConnection con = (HttpURLConnection) url.openConnection();
    // we are going to do a POST
    con.setDoOutput(true);// w ww .  jav  a  2s  .  c  om
    con.setRequestMethod("POST");

    // POST it
    con.setRequestProperty("Content-Type", "application/ocsp-request");
    OutputStream os = con.getOutputStream();
    os.write(ocspPackage);
    os.close();
    assertEquals("Response code", 200, con.getResponseCode());
    assertEquals("Content-Type", "application/ocsp-response", con.getContentType());
    ByteArrayOutputStream baos = new ByteArrayOutputStream();
    // This works for small requests, and OCSP requests are small
    InputStream in = con.getInputStream();
    int b = in.read();
    while (b != -1) {
        baos.write(b);
        b = in.read();
    }
    baos.flush();
    in.close();
    byte[] respBytes = baos.toByteArray();
    OCSPResp response = new OCSPResp(respBytes);
    assertEquals("Response status not zero.", response.getStatus(), 0);
    BasicOCSPResp brep = (BasicOCSPResp) response.getResponseObject();
    X509CertificateHolder[] chain = brep.getCerts();
    boolean verify = brep.isSignatureValid(new JcaContentVerifierProviderBuilder().build(chain[0]));
    assertTrue("Response failed to verify.", verify);
    // Check nonce (if we sent one)
    if (nonce != null) {
        byte[] noncerep = brep.getExtension(OCSPObjectIdentifiers.id_pkix_ocsp_nonce).getExtnValue()
                .getEncoded();
        assertNotNull(noncerep);
        ASN1InputStream ain = new ASN1InputStream(noncerep);
        ASN1OctetString oct = ASN1OctetString.getInstance(ain.readObject());
        ain.close();
        assertEquals(nonce, new String(oct.getOctets()));
    }
    SingleResp[] singleResps = brep.getResponses();
    assertEquals("No of SingResps should be 1.", singleResps.length, 1);
    SingleResp singleResp = singleResps[0];
    return singleResp;
}

From source file:org.ejbca.core.protocol.ocsp.ProtocolOcspHttpTest.java

License:Open Source License

/**
 * This test tests that the OCSP response for a status unknown contains the header "cache-control" with the value "no-cache, must-revalidate"
 * //from   w  w w. j a va  2s .  c  om
 * @throws Exception
 */
@Test
public void testUnknownStatusCacheControlHeader() throws Exception {

    // set ocsp configuration
    Map<String, String> map = new HashMap<String, String>();
    map.put(OcspConfiguration.UNTIL_NEXT_UPDATE, "1");
    this.helper.alterConfig(map);

    OCSPReqBuilder gen = new OCSPReqBuilder();
    gen.addRequest(new JcaCertificateID(SHA1DigestCalculator.buildSha1Instance(), cacert, new BigInteger("1")));
    OCSPReq req = gen.build();

    String sBaseURL = httpReqPath + '/' + resourceOcsp;
    String urlEnding = "";
    String b64 = new String(Base64.encode(req.getEncoded(), false));
    //String urls = URLEncoder.encode(b64, "UTF-8");    // JBoss/Tomcat will not accept escaped '/'-characters by default
    URL url = new URL(sBaseURL + '/' + b64 + urlEnding);
    HttpURLConnection con = (HttpURLConnection) url.openConnection();
    if (con.getResponseCode() != 200) {
        log.info("URL when request gave unexpected result: " + url.toString() + " Message was: "
                + con.getResponseMessage());
    }
    assertEquals("Response code did not match. ", 200, con.getResponseCode());
    assertNotNull(con.getContentType());
    assertTrue(con.getContentType().startsWith("application/ocsp-response"));

    assertNotNull("No Cache-Control in reply.", con.getHeaderField("Cache-Control"));
    assertEquals("no-cache, must-revalidate", con.getHeaderField("Cache-Control"));

    // Create a GET request using Nonce extension, in this case we should have no cache-control header
    gen = new OCSPReqBuilder();
    gen.addRequest(new JcaCertificateID(SHA1DigestCalculator.buildSha1Instance(), cacert, new BigInteger("1")));
    Extension[] extensions = new Extension[1];
    extensions[0] = new Extension(OCSPObjectIdentifiers.id_pkix_ocsp_nonce, false,
            new DEROctetString("123456789".getBytes()));
    gen.setRequestExtensions(new Extensions(extensions));
    req = gen.build();
    b64 = new String(Base64.encode(req.getEncoded(), false));
    url = new URL(sBaseURL + '/' + b64 + urlEnding);
    con = (HttpURLConnection) url.openConnection();
    if (con.getResponseCode() != 200) {
        log.info("URL when request gave unexpected result: " + url.toString() + " Message was: "
                + con.getResponseMessage());
    }
    assertEquals("Response code did not match. ", 200, con.getResponseCode());
    assertNotNull(con.getContentType());
    assertTrue(con.getContentType().startsWith("application/ocsp-response"));
    OCSPResp response = new OCSPResp(IOUtils.toByteArray(con.getInputStream()));
    BasicOCSPResp brep = (BasicOCSPResp) response.getResponseObject();
    byte[] noncerep = brep.getExtension(OCSPObjectIdentifiers.id_pkix_ocsp_nonce).getExtnValue().getEncoded();
    // Make sure we have a nonce in the response, we should have since we sent one in the request
    assertNotNull("Response should have nonce since we sent a nonce in the request", noncerep);
    ASN1InputStream ain = new ASN1InputStream(noncerep);
    ASN1OctetString oct = ASN1OctetString.getInstance(ain.readObject());
    ain.close();
    assertEquals("Response Nonce was not the same as the request Nonce, it must be", "123456789",
            new String(oct.getOctets()));
    assertNull(
            "Cache-Control in reply although we used Nonce in the request. Responses with Nonce should not have a Cache-control header.",
            con.getHeaderField("Cache-Control"));
}

From source file:org.ejbca.core.protocol.scep.ScepRequestMessage.java

License:Open Source License

private void init() throws IOException {
    if (log.isTraceEnabled()) {
        log.trace(">init");
    }//from ww w  . j  av a 2 s.  com
    try {
        CMSSignedData csd = new CMSSignedData(scepmsg);
        SignerInformationStore infoStore = csd.getSignerInfos();
        @SuppressWarnings("unchecked")
        Collection<SignerInformation> signers = infoStore.getSigners();
        Iterator<SignerInformation> iter = signers.iterator();
        if (iter.hasNext()) {
            SignerInformation si = (SignerInformation) iter.next();
            preferredDigestAlg = si.getDigestAlgOID();
            log.debug("Set " + preferredDigestAlg + " as preferred digest algorithm for SCEP");
        }
    } catch (CMSException e) {
        // ignore, use default digest algo
        log.error("CMSException trying to get preferred digest algorithm: ", e);
    }
    // Parse and verify the integrity of the PKIOperation message PKCS#7
    /* If this would have been done using the newer CMS it would have made me so much happier... */
    ASN1InputStream seqAsn1InputStream = new ASN1InputStream(new ByteArrayInputStream(scepmsg));
    ASN1Sequence seq = null;
    try {
        seq = (ASN1Sequence) seqAsn1InputStream.readObject();
    } finally {
        seqAsn1InputStream.close();
    }
    ContentInfo ci = ContentInfo.getInstance(seq);
    String ctoid = ci.getContentType().getId();

    if (ctoid.equals(CMSObjectIdentifiers.signedData.getId())) {
        // This is SignedData so it is a pkcsCertReqSigned, pkcsGetCertInitialSigned, pkcsGetCertSigned, pkcsGetCRLSigned
        // (could also be pkcsRepSigned or certOnly, but we don't receive them on the server side
        // Try to find out what kind of message this is
        sd = SignedData.getInstance((ASN1Sequence) ci.getContent());
        // Get self signed cert to identify the senders public key
        ASN1Set certs = sd.getCertificates();
        if (certs.size() > 0) {
            // There should be only one...
            ASN1Encodable dercert = certs.getObjectAt(0);
            if (dercert != null) {
                // Requester's self-signed certificate is requestKeyInfo
                ByteArrayOutputStream bOut = new ByteArrayOutputStream();
                DEROutputStream dOut = new DEROutputStream(bOut);
                dOut.writeObject(dercert);
                if (bOut.size() > 0) {
                    requestKeyInfo = bOut.toByteArray();
                    //Create Certificate used for debugging
                    try {
                        signercert = CertTools.getCertfromByteArray(requestKeyInfo);
                        if (log.isDebugEnabled()) {
                            log.debug("requestKeyInfo is SubjectDN: " + CertTools.getSubjectDN(signercert)
                                    + ", Serial=" + CertTools.getSerialNumberAsString(signercert)
                                    + "; IssuerDN: " + CertTools.getIssuerDN(signercert).toString());
                        }
                    } catch (CertificateException e) {
                        log.error("Error parsing requestKeyInfo : ", e);
                    }

                }
            }
        }

        Enumeration<?> sis = sd.getSignerInfos().getObjects();

        if (sis.hasMoreElements()) {
            SignerInfo si = SignerInfo.getInstance((ASN1Sequence) sis.nextElement());
            Enumeration<?> attr = si.getAuthenticatedAttributes().getObjects();

            while (attr.hasMoreElements()) {
                Attribute a = Attribute.getInstance((ASN1Sequence) attr.nextElement());
                if (log.isDebugEnabled()) {
                    log.debug("Found attribute: " + a.getAttrType().getId());
                }
                if (a.getAttrType().getId().equals(id_senderNonce)) {
                    Enumeration<?> values = a.getAttrValues().getObjects();
                    ASN1OctetString str = ASN1OctetString.getInstance(values.nextElement());
                    senderNonce = new String(Base64.encode(str.getOctets(), false));
                    if (log.isDebugEnabled()) {
                        log.debug("senderNonce = " + senderNonce);
                    }
                }
                if (a.getAttrType().getId().equals(id_transId)) {
                    Enumeration<?> values = a.getAttrValues().getObjects();
                    DERPrintableString str = DERPrintableString.getInstance(values.nextElement());
                    transactionId = str.getString();
                    if (log.isDebugEnabled()) {
                        log.debug("transactionId = " + transactionId);
                    }
                }
                if (a.getAttrType().getId().equals(id_messageType)) {
                    Enumeration<?> values = a.getAttrValues().getObjects();
                    DERPrintableString str = DERPrintableString.getInstance(values.nextElement());
                    messageType = Integer.parseInt(str.getString());
                    if (log.isDebugEnabled()) {
                        log.debug("messagetype = " + messageType);
                    }
                }
            }
        }

        // If this is a PKCSReq
        if ((messageType == ScepRequestMessage.SCEP_TYPE_PKCSREQ)
                || (messageType == ScepRequestMessage.SCEP_TYPE_GETCRL)
                || (messageType == ScepRequestMessage.SCEP_TYPE_GETCERTINITIAL)) {
            // Extract the contents, which is an encrypted PKCS10 if messageType == 19
            // , and an encrypted issuer and subject if messageType == 20 (not extracted)
            // and an encrypted IssuerAndSerialNumber if messageType == 22
            ci = sd.getEncapContentInfo();
            ctoid = ci.getContentType().getId();

            if (ctoid.equals(CMSObjectIdentifiers.data.getId())) {
                ASN1OctetString content = (ASN1OctetString) ci.getContent();
                if (log.isDebugEnabled()) {
                    log.debug("envelopedData is " + content.getOctets().length + " bytes.");
                }
                ASN1InputStream seq1Asn1InputStream = new ASN1InputStream(
                        new ByteArrayInputStream(content.getOctets()));
                ASN1Sequence seq1 = null;
                try {
                    seq1 = (ASN1Sequence) seq1Asn1InputStream.readObject();
                } finally {
                    seq1Asn1InputStream.close();
                }
                envEncData = ContentInfo.getInstance(seq1);
                ctoid = envEncData.getContentType().getId();

                if (ctoid.equals(CMSObjectIdentifiers.envelopedData.getId())) {
                    envData = EnvelopedData.getInstance((ASN1Sequence) envEncData.getContent());
                    ASN1Set recipientInfos = envData.getRecipientInfos();
                    Enumeration<?> e = recipientInfos.getObjects();
                    while (e.hasMoreElements()) {
                        RecipientInfo ri = RecipientInfo.getInstance(e.nextElement());
                        KeyTransRecipientInfo recipientInfo = KeyTransRecipientInfo.getInstance(ri.getInfo());
                        RecipientIdentifier rid = recipientInfo.getRecipientIdentifier();
                        IssuerAndSerialNumber iasn = IssuerAndSerialNumber.getInstance(rid.getId());
                        issuerDN = iasn.getName().toString();
                        serialNo = iasn.getSerialNumber().getValue();
                        if (log.isDebugEnabled()) {
                            log.debug("IssuerDN: " + issuerDN);
                            log.debug("SerialNumber: " + iasn.getSerialNumber().getValue().toString(16));
                        }
                    }
                } else {
                    errorText = "EncapsulatedContentInfo does not contain PKCS7 envelopedData: ";
                    log.error(errorText + ctoid);
                    error = 2;
                }
            } else {
                errorText = "EncapsulatedContentInfo is not of type 'data': ";
                log.error(errorText + ctoid);
                error = 3;
            }
        } else {
            errorText = "This is not a certification request!";
            log.error(errorText);
            error = 4;
        }
    } else {
        errorText = "PKCSReq does not contain 'signedData': ";
        log.error(errorText + ctoid);
        error = 1;
    }

    log.trace("<init");
}

From source file:org.ejbca.core.protocol.scep.ScepRequestMessage.java

License:Open Source License

private void decrypt() throws CMSException, NoSuchProviderException, GeneralSecurityException, IOException {
    if (log.isTraceEnabled()) {
        log.trace(">decrypt");
    }//from  www.j a  v  a 2 s. co m
    // Now we are getting somewhere (pheew),
    // Now we just have to get the damn key...to decrypt the PKCS10
    if (privateKey == null) {
        errorText = "Need private key to decrypt!";
        error = 5;
        log.error(errorText);
        return;
    }

    if (envEncData == null) {
        errorText = "No enveloped data to decrypt!";
        error = 6;
        log.error(errorText);
        return;
    }

    CMSEnvelopedData ed = new CMSEnvelopedData(envEncData);
    RecipientInformationStore recipients = ed.getRecipientInfos();
    @SuppressWarnings("unchecked")
    Collection<RecipientInformation> c = recipients.getRecipients();
    Iterator<RecipientInformation> it = c.iterator();
    byte[] decBytes = null;

    while (it.hasNext()) {
        RecipientInformation recipient = (RecipientInformation) it.next();
        if (log.isDebugEnabled()) {
            log.debug("Privatekey : " + privateKey.getAlgorithm());
        }
        JceKeyTransEnvelopedRecipient rec = new JceKeyTransEnvelopedRecipient(privateKey);
        rec.setProvider(jceProvider); // Use the crypto token provides for asymmetric key operations
        rec.setContentProvider(BouncyCastleProvider.PROVIDER_NAME); // Use BC for the symmetric key operations
        decBytes = recipient.getContent(rec);
        break;
    }

    if (messageType == ScepRequestMessage.SCEP_TYPE_PKCSREQ) {
        pkcs10 = new JcaPKCS10CertificationRequest(decBytes);
        if (log.isDebugEnabled()) {
            log.debug("Successfully extracted PKCS10:" + new String(Base64.encode(pkcs10.getEncoded())));
        }
    }
    if (messageType == ScepRequestMessage.SCEP_TYPE_GETCRL) {
        ASN1InputStream derAsn1InputStream = new ASN1InputStream(new ByteArrayInputStream(decBytes));
        ASN1Primitive derobj = null;
        try {
            derobj = derAsn1InputStream.readObject();
        } finally {
            derAsn1InputStream.close();
        }
        issuerAndSerno = IssuerAndSerialNumber.getInstance(derobj);
        log.debug("Successfully extracted IssuerAndSerialNumber.");
    }
    if (log.isTraceEnabled()) {
        log.trace("<decrypt");
    }
}

From source file:org.ejbca.core.protocol.ws.CommonEjbcaWS.java

License:Open Source License

protected void generatePkcs10() throws Exception {

    UserDataVOWS user1 = new UserDataVOWS();
    user1.setUsername(CA1_WSTESTUSER1);/*  w  w  w.j  a  v  a2s  .  c o m*/
    user1.setPassword(PASSWORD);
    user1.setClearPwd(true);
    user1.setSubjectDN(getDN(CA1_WSTESTUSER1));
    user1.setCaName(CA1);
    user1.setStatus(UserDataVOWS.STATUS_NEW);
    user1.setTokenType(UserDataVOWS.TOKEN_TYPE_USERGENERATED);
    user1.setEndEntityProfileName(WS_EEPROF_EI);
    user1.setCertificateProfileName(WS_CERTPROF_EI);
    ejbcaraws.editUser(user1);

    final AuthenticationToken admin = new TestAlwaysAllowLocalAuthenticationToken(
            new UsernamePrincipal("SYSTEMTEST"));

    PKCS10CertificationRequest pkcs10 = getP10Request();
    // Submit the request
    CertificateResponse certenv = ejbcaraws.pkcs10Request(CA1_WSTESTUSER1, PASSWORD,
            new String(Base64.encode(pkcs10.getEncoded())), null, CertificateHelper.RESPONSETYPE_CERTIFICATE);
    assertNotNull(certenv);
    X509Certificate cert = (X509Certificate) CertificateHelper.getCertificate(certenv.getData());
    assertNotNull(cert);
    assertEquals(getDN(CA1_WSTESTUSER1), cert.getSubjectDN().toString());
    byte[] ext = cert.getExtensionValue("1.2.3.4");
    // Certificate profile did not allow extension override
    assertNull("no extension should exist", ext);
    // Allow extension override
    CertificateProfile profile = certificateProfileSession.getCertificateProfile(WS_CERTPROF_EI);
    profile.setAllowExtensionOverride(true);
    certificateProfileSession.changeCertificateProfile(admin, WS_CERTPROF_EI, profile);
    // Now our extension should be possible to get in there
    try {
        ejbcaraws.editUser(user1);
        pkcs10 = getP10Request();
        certenv = ejbcaraws.pkcs10Request(CA1_WSTESTUSER1, PASSWORD,
                new String(Base64.encode(pkcs10.getEncoded())), null,
                CertificateHelper.RESPONSETYPE_CERTIFICATE);
        assertNotNull(certenv);
        cert = (X509Certificate) CertificateHelper.getCertificate(certenv.getData());
        assertNotNull(cert);
        assertEquals(getDN(CA1_WSTESTUSER1), cert.getSubjectDN().toString());
        ext = cert.getExtensionValue("1.2.3.4");
        assertNotNull("there should be an extension", ext);
        ASN1InputStream asn1InputStream = new ASN1InputStream(new ByteArrayInputStream(ext));
        try {
            DEROctetString oct = (DEROctetString) (asn1InputStream.readObject());
            assertEquals("Extension did not have the correct value", "foo123",
                    (new String(oct.getOctets())).trim());
        } finally {
            asn1InputStream.close();
        }
    } finally {
        // restore
        profile.setAllowExtensionOverride(false);
        certificateProfileSession.changeCertificateProfile(admin, WS_CERTPROF_EI, profile);
    }
}

From source file:org.ejbca.core.protocol.ws.CommonEjbcaWS.java

License:Open Source License

/**
 * Test method for creating/editing a user a requesting a certificate in a single transaction.
 */// w  w w  .j a  va 2  s  .c om
protected void certificateRequest() throws Exception {

    final UserDataVOWS userData1 = getUserData(CA1_WSTESTUSER1);
    ErrorCode errorCode = certreqInternal(userData1, getP10(), CertificateHelper.CERT_REQ_TYPE_PKCS10);
    assertNull("PKCS#10 request resulted in error code: "
            + (errorCode == null ? "" : errorCode.getInternalErrorCode()), errorCode);
    errorCode = certreqInternal(userData1, CRMF, CertificateHelper.CERT_REQ_TYPE_CRMF);
    assertNull("CRMF request resulted in error code: "
            + (errorCode == null ? "" : errorCode.getInternalErrorCode()), errorCode);
    errorCode = certreqInternal(userData1, SPCAK, CertificateHelper.CERT_REQ_TYPE_SPKAC);
    assertNull("SPKAC request resulted in error code: "
            + (errorCode == null ? "" : errorCode.getInternalErrorCode()), errorCode);
    errorCode = certreqInternal(userData1, PUBLICKEY_PEM, CertificateHelper.CERT_REQ_TYPE_PUBLICKEY);
    assertNull("PUBLICKEY request resulted in error code: "
            + (errorCode == null ? "" : errorCode.getInternalErrorCode()), errorCode);
    errorCode = certreqInternal(userData1, PUBLICKEY_BASE64, CertificateHelper.CERT_REQ_TYPE_PUBLICKEY);
    assertNull("PUBLICKEY request resulted in error code: "
            + (errorCode == null ? "" : errorCode.getInternalErrorCode()), errorCode);

    // Test with custom extensions
    final AuthenticationToken admin = new TestAlwaysAllowLocalAuthenticationToken(
            new UsernamePrincipal("SYSTEMTEST"));

    userData1.setStatus(UserDataVOWS.STATUS_NEW);
    userData1.setTokenType(UserDataVOWS.TOKEN_TYPE_USERGENERATED);
    userData1.setEndEntityProfileName(WS_EEPROF_EI);
    userData1.setCertificateProfileName(WS_CERTPROF_EI);
    ejbcaraws.editUser(userData1);
    CertificateResponse certificateResponse = ejbcaraws.certificateRequest(userData1, getP10(),
            CertificateHelper.CERT_REQ_TYPE_PKCS10, null, CertificateHelper.RESPONSETYPE_CERTIFICATE);
    X509Certificate cert = certificateResponse.getCertificate();
    byte[] ext = cert.getExtensionValue("1.2.3.4");
    // Certificate profile did not allow extension override
    assertNull("no extension should exist", ext);
    // Allow extension override
    CertificateProfile profile = certificateProfileSession.getCertificateProfile(WS_CERTPROF_EI);
    profile.setAllowExtensionOverride(true);
    certificateProfileSession.changeCertificateProfile(admin, WS_CERTPROF_EI, profile);
    // Now our extension should be possible to get in there
    try {
        ejbcaraws.editUser(userData1);
        certificateResponse = ejbcaraws.certificateRequest(userData1, getP10(),
                CertificateHelper.CERT_REQ_TYPE_PKCS10, null, CertificateHelper.RESPONSETYPE_CERTIFICATE);
        cert = certificateResponse.getCertificate();
        assertNotNull(cert);
        assertEquals(getDN(CA1_WSTESTUSER1), cert.getSubjectDN().toString());
        ext = cert.getExtensionValue("1.2.3.4");
        assertNotNull("there should be an extension", ext);
        ASN1InputStream asn1InputStream = new ASN1InputStream(new ByteArrayInputStream(ext));
        try {
            DEROctetString oct = (DEROctetString) (asn1InputStream.readObject());
            assertEquals("Extension did not have the correct value", "foo123",
                    (new String(oct.getOctets())).trim());
        } finally {
            asn1InputStream.close();
        }
    } finally {
        // restore
        profile.setAllowExtensionOverride(false);
        certificateProfileSession.changeCertificateProfile(admin, WS_CERTPROF_EI, profile);
    }

    // Make a test with EV TLS DN components
    try {
        final UserDataVOWS userData2 = getUserData(CA1_WSTESTUSER1);
        userData2.setUsername("EVTLSEJBCAWSTEST");
        userData2.setSubjectDN(
                "CN=EVTLSEJBCAWSTEST,JurisdictionCountry=DE,JurisdictionState=Stockholm,JurisdictionLocality=Solna");
        try {
            certificateResponse = ejbcaraws.certificateRequest(userData2, getP10(),
                    CertificateHelper.CERT_REQ_TYPE_PKCS10, null, CertificateHelper.RESPONSETYPE_CERTIFICATE);
        } catch (EjbcaException_Exception e) {
            errorCode = e.getFaultInfo().getErrorCode();
            log.info(errorCode.getInternalErrorCode(), e);
            assertNotNull("error code should not be null", errorCode);
            fail("certificate request with EV TLS DN components failed with error code "
                    + errorCode.getInternalErrorCode());
        }
        // Verify that the response is of the right type
        assertNotNull(certificateResponse);
        assertTrue(certificateResponse.getResponseType().equals(CertificateHelper.RESPONSETYPE_CERTIFICATE));
        // Verify that the certificate in the response has the same Subject DN
        // as in the request.
        cert = certificateResponse.getCertificate();
        assertNotNull(cert);
        assertEquals(
                "JurisdictionCountry=DE,JurisdictionState=Stockholm,JurisdictionLocality=Solna,CN=EVTLSEJBCAWSTEST",
                CertTools.getSubjectDN(cert));
    } finally {
        // Clean up immediately
        endEntityManagementSession.deleteUser(admin, "EVTLSEJBCAWSTEST");
        internalCertStoreSession.removeCertificate(CertTools.getFingerprintAsString(cert));
    }
}

From source file:org.ejbca.core.protocol.ws.CommonEjbcaWS.java

License:Open Source License

protected void generateCrmf() throws Exception {

    // Edit our favorite test user
    UserDataVOWS user1 = new UserDataVOWS();
    user1.setUsername(CA1_WSTESTUSER1);/*from w w w.j a v a2s .co  m*/
    user1.setPassword(PASSWORD);
    user1.setClearPwd(true);
    user1.setSubjectDN(getDN(CA1_WSTESTUSER1));
    user1.setCaName(CA1);
    user1.setStatus(UserDataVOWS.STATUS_NEW);
    user1.setTokenType(UserDataVOWS.TOKEN_TYPE_USERGENERATED);
    user1.setEndEntityProfileName(WS_EEPROF_EI);
    user1.setCertificateProfileName(WS_CERTPROF_EI);
    ejbcaraws.editUser(user1);

    final AuthenticationToken admin = new TestAlwaysAllowLocalAuthenticationToken(
            new UsernamePrincipal("SYSTEMTEST"));
    KeyPair keys = KeyTools.genKeys("512", "RSA");
    CAInfo info = caSession.getCAInfo(admin, CA1);
    CertReqMsg req = createCrmfRequest(info.getSubjectDN(), getDN(CA1_WSTESTUSER1), keys, "1.2.3.4");
    CertReqMessages msgs = new CertReqMessages(req);
    ByteArrayOutputStream bao = new ByteArrayOutputStream();
    DEROutputStream out = new DEROutputStream(bao);
    out.writeObject(msgs);
    byte[] ba = bao.toByteArray();
    String reqstr = new String(Base64.encode(ba));
    //CertificateResponse certenv = ejbcaraws.crmfRequest(CA1_WSTESTUSER1, PASSWORD, CRMF, null, CertificateHelper.RESPONSETYPE_CERTIFICATE);
    CertificateResponse certenv = ejbcaraws.crmfRequest(CA1_WSTESTUSER1, PASSWORD, reqstr, null,
            CertificateHelper.RESPONSETYPE_CERTIFICATE);
    assertNotNull(certenv);
    X509Certificate cert = (X509Certificate) CertificateHelper.getCertificate(certenv.getData());
    assertNotNull(cert);
    log.info(cert.getSubjectDN().toString());
    assertEquals(getDN(CA1_WSTESTUSER1), cert.getSubjectDN().toString());
    byte[] ext = cert.getExtensionValue("1.2.3.4");
    // Certificate profile did not allow extension override
    assertNull("no extension should exist", ext);
    // Allow extension override
    CertificateProfile profile = certificateProfileSession.getCertificateProfile(WS_CERTPROF_EI);
    profile.setAllowExtensionOverride(true);
    certificateProfileSession.changeCertificateProfile(admin, WS_CERTPROF_EI, profile);
    // Now our extension should be possible to get in there
    try {
        ejbcaraws.editUser(user1);
        keys = KeyTools.genKeys("512", "RSA");
        info = caSession.getCAInfo(admin, CA1);
        req = createCrmfRequest(info.getSubjectDN(), getDN(CA1_WSTESTUSER1), keys, "1.2.3.4");
        msgs = new CertReqMessages(req);
        bao = new ByteArrayOutputStream();
        out = new DEROutputStream(bao);
        out.writeObject(msgs);
        ba = bao.toByteArray();
        reqstr = new String(Base64.encode(ba));
        certenv = ejbcaraws.crmfRequest(CA1_WSTESTUSER1, PASSWORD, reqstr, null,
                CertificateHelper.RESPONSETYPE_CERTIFICATE);
        assertNotNull(certenv);
        cert = (X509Certificate) CertificateHelper.getCertificate(certenv.getData());
        assertNotNull(cert);
        assertEquals(getDN(CA1_WSTESTUSER1), cert.getSubjectDN().toString());
        ext = cert.getExtensionValue("1.2.3.4");
        assertNotNull("there should be an extension", ext);
        ASN1InputStream asn1InputStream = new ASN1InputStream(new ByteArrayInputStream(ext));
        try {
            DEROctetString oct = (DEROctetString) (asn1InputStream.readObject());
            assertEquals("Extension did not have the correct value", "foo123",
                    (new String(oct.getOctets()).trim()));
        } finally {
            asn1InputStream.close();
        }
    } finally {
        // restore
        profile.setAllowExtensionOverride(false);
        certificateProfileSession.changeCertificateProfile(admin, WS_CERTPROF_EI, profile);
    }
}