Example usage for org.bouncycastle.asn1.pkcs PKCSObjectIdentifiers pkcs_9_at_extensionRequest

List of usage examples for org.bouncycastle.asn1.pkcs PKCSObjectIdentifiers pkcs_9_at_extensionRequest

  1. HOME
  2. Java
  3. org.bouncycastle
  4. org.bouncycastle.asn1.pkcs.*
  5. PKCSObjectIdentifiers
  6. pkcs_9_at_extensionRequest

Introduction

In this page you can find the example usage for org.bouncycastle.asn1.pkcs PKCSObjectIdentifiers pkcs_9_at_extensionRequest.

Prototype

ASN1ObjectIdentifier pkcs_9_at_extensionRequest

To view the source code for org.bouncycastle.asn1.pkcs PKCSObjectIdentifiers pkcs_9_at_extensionRequest.

Click Source Link

Document

PKCS#9: 1.2.840.113549.1.9.14

Usage

From source file:org.apache.nifi.toolkit.tls.util.TlsHelperTest.java

License:Apache License

private List<String> extractSanFromCsr(JcaPKCS10CertificationRequest csr) {
    List<String> sans = new ArrayList<>();
    Attribute[] certAttributes = csr.getAttributes();
    for (Attribute attribute : certAttributes) {
        if (attribute.getAttrType().equals(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest)) {
            Extensions extensions = Extensions.getInstance(attribute.getAttrValues().getObjectAt(0));
            GeneralNames gns = GeneralNames.fromExtensions(extensions, Extension.subjectAlternativeName);
            GeneralName[] names = gns.getNames();
            for (GeneralName name : names) {
                logger.info("Type: " + name.getTagNo() + " | Name: " + name.getName());
                String title = "";
                if (name.getTagNo() == GeneralName.dNSName) {
                    title = "DNS";
                } else if (name.getTagNo() == GeneralName.iPAddress) {
                    title = "IP Address";
                    // name.toASN1Primitive();
                } else if (name.getTagNo() == GeneralName.otherName) {
                    title = "Other Name";
                }//from  w w  w . j av  a  2 s  . c  om
                sans.add(title + ": " + name.getName());
            }
        }
    }

    return sans;
}

From source file:org.cesecore.certificates.ca.X509CATest.java

License:Open Source License

@SuppressWarnings("unchecked")
private void doTestX509CABasicOperations(String algName) throws Exception {
    final CryptoToken cryptoToken = getNewCryptoToken();
    final X509CA x509ca = createTestCA(cryptoToken, CADN);
    Certificate cacert = x509ca.getCACertificate();

    // Start by creating a PKCS7
    byte[] p7 = x509ca.createPKCS7(cryptoToken, cacert, true);
    assertNotNull(p7);/* w  ww . j  av  a 2 s.  c  o  m*/
    CMSSignedData s = new CMSSignedData(p7);
    Store certstore = s.getCertificates();
    Collection<X509CertificateHolder> certs = certstore.getMatches(null);
    assertEquals(2, certs.size());
    p7 = x509ca.createPKCS7(cryptoToken, cacert, false);
    assertNotNull(p7);
    s = new CMSSignedData(p7);
    certstore = s.getCertificates();
    certs = certstore.getMatches(null);
    assertEquals(1, certs.size());

    // Create a certificate request (will be pkcs10)
    byte[] req = x509ca.createRequest(cryptoToken, null, algName, cacert,
            CATokenConstants.CAKEYPURPOSE_CERTSIGN);
    PKCS10CertificationRequest p10 = new PKCS10CertificationRequest(req);
    assertNotNull(p10);
    String dn = p10.getSubject().toString();
    assertEquals(CADN, dn);

    // Make a request with some pkcs11 attributes as well
    Collection<ASN1Encodable> attributes = new ArrayList<ASN1Encodable>();
    // Add a subject alternative name
    ASN1EncodableVector altnameattr = new ASN1EncodableVector();
    altnameattr.add(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest);
    GeneralNames san = CertTools.getGeneralNamesFromAltName("dNSName=foobar.bar.com");
    ExtensionsGenerator extgen = new ExtensionsGenerator();
    extgen.addExtension(Extension.subjectAlternativeName, false, san);
    Extensions exts = extgen.generate();
    altnameattr.add(new DERSet(exts));
    // Add a challenge password as well
    ASN1EncodableVector pwdattr = new ASN1EncodableVector();
    pwdattr.add(PKCSObjectIdentifiers.pkcs_9_at_challengePassword);
    ASN1EncodableVector pwdvalues = new ASN1EncodableVector();
    pwdvalues.add(new DERUTF8String("foobar123"));
    pwdattr.add(new DERSet(pwdvalues));
    attributes.add(new DERSequence(altnameattr));
    attributes.add(new DERSequence(pwdattr));
    // create the p10
    req = x509ca.createRequest(cryptoToken, attributes, algName, cacert,
            CATokenConstants.CAKEYPURPOSE_CERTSIGN);
    p10 = new PKCS10CertificationRequest(req);
    assertNotNull(p10);
    dn = p10.getSubject().toString();
    assertEquals(CADN, dn);
    Attribute[] attrs = p10.getAttributes();
    assertEquals(2, attrs.length);
    PKCS10RequestMessage p10msg = new PKCS10RequestMessage(new JcaPKCS10CertificationRequest(p10));
    assertEquals("foobar123", p10msg.getPassword());
    assertEquals("dNSName=foobar.bar.com", p10msg.getRequestAltNames());

    try {
        x509ca.createAuthCertSignRequest(cryptoToken, p10.getEncoded());
    } catch (UnsupportedOperationException e) {
        // Expected for a X509 CA
    }

    // Generate a client certificate and check that it was generated correctly
    EndEntityInformation user = new EndEntityInformation("username", "CN=User", 666, "rfc822Name=user@user.com",
            "user@user.com", new EndEntityType(EndEntityTypes.ENDUSER), 0, 0, EndEntityConstants.TOKEN_USERGEN,
            0, null);
    KeyPair keypair = genTestKeyPair(algName);
    CertificateProfile cp = new CertificateProfile(CertificateProfileConstants.CERTPROFILE_FIXED_ENDUSER);
    cp.addCertificatePolicy(new CertificatePolicy("1.1.1.2", null, null));
    cp.setUseCertificatePolicies(true);
    Certificate usercert = x509ca.generateCertificate(cryptoToken, user, keypair.getPublic(), 0, null, 10L, cp,
            "00000");
    assertNotNull(usercert);
    assertEquals("CN=User", CertTools.getSubjectDN(usercert));
    assertEquals(CADN, CertTools.getIssuerDN(usercert));
    assertEquals(getTestKeyPairAlgName(algName).toUpperCase(),
            AlgorithmTools.getCertSignatureAlgorithmNameAsString(usercert).toUpperCase());
    assertEquals(new String(CertTools.getSubjectKeyId(cacert)),
            new String(CertTools.getAuthorityKeyId(usercert)));
    assertEquals("user@user.com", CertTools.getEMailAddress(usercert));
    assertEquals("rfc822name=user@user.com", CertTools.getSubjectAlternativeName(usercert));
    assertNull(CertTools.getUPNAltName(usercert));
    assertFalse(CertTools.isSelfSigned(usercert));
    usercert.verify(cryptoToken
            .getPublicKey(x509ca.getCAToken().getAliasFromPurpose(CATokenConstants.CAKEYPURPOSE_CERTSIGN)));
    usercert.verify(x509ca.getCACertificate().getPublicKey());
    assertTrue(CertTools.isCA(x509ca.getCACertificate()));
    assertFalse(CertTools.isCA(usercert));
    assertEquals("1.1.1.2", CertTools.getCertificatePolicyId(usercert, 0));
    X509Certificate cert = (X509Certificate) usercert;
    boolean[] ku = cert.getKeyUsage();
    assertTrue(ku[0]);
    assertTrue(ku[1]);
    assertTrue(ku[2]);
    assertFalse(ku[3]);
    assertFalse(ku[4]);
    assertFalse(ku[5]);
    assertFalse(ku[6]);
    assertFalse(ku[7]);
    int bcku = CertTools.sunKeyUsageToBC(ku);
    assertEquals(X509KeyUsage.digitalSignature | X509KeyUsage.nonRepudiation | X509KeyUsage.keyEncipherment,
            bcku);

    // Create a CRL
    Collection<RevokedCertInfo> revcerts = new ArrayList<RevokedCertInfo>();
    X509CRLHolder crl = x509ca.generateCRL(cryptoToken, revcerts, 1);
    assertNotNull(crl);
    X509CRL xcrl = CertTools.getCRLfromByteArray(crl.getEncoded());
    assertEquals(CADN, CertTools.getIssuerDN(xcrl));
    Set<?> set = xcrl.getRevokedCertificates();
    assertNull(set);
    BigInteger num = CrlExtensions.getCrlNumber(xcrl);
    assertEquals(1, num.intValue());
    BigInteger deltanum = CrlExtensions.getDeltaCRLIndicator(xcrl);
    assertEquals(-1, deltanum.intValue());
    // Revoke some cert
    Date revDate = new Date();
    revcerts.add(new RevokedCertInfo(CertTools.getFingerprintAsString(usercert).getBytes(),
            CertTools.getSerialNumber(usercert).toByteArray(), revDate.getTime(),
            RevokedCertInfo.REVOCATION_REASON_CERTIFICATEHOLD, CertTools.getNotAfter(usercert).getTime()));
    crl = x509ca.generateCRL(cryptoToken, revcerts, 2);
    assertNotNull(crl);
    xcrl = CertTools.getCRLfromByteArray(crl.getEncoded());
    set = xcrl.getRevokedCertificates();
    assertEquals(1, set.size());
    num = CrlExtensions.getCrlNumber(xcrl);
    assertEquals(2, num.intValue());
    X509CRLEntry entry = (X509CRLEntry) set.iterator().next();
    assertEquals(CertTools.getSerialNumber(usercert).toString(), entry.getSerialNumber().toString());
    assertEquals(revDate.toString(), entry.getRevocationDate().toString());
    // Getting the revocation reason is a pita...
    byte[] extval = entry.getExtensionValue(Extension.reasonCode.getId());
    ASN1InputStream aIn = new ASN1InputStream(new ByteArrayInputStream(extval));
    ASN1OctetString octs = (ASN1OctetString) aIn.readObject();
    aIn = new ASN1InputStream(new ByteArrayInputStream(octs.getOctets()));
    ASN1Primitive obj = aIn.readObject();
    CRLReason reason = CRLReason.getInstance((ASN1Enumerated) obj);
    assertEquals("CRLReason: certificateHold", reason.toString());
    //DEROctetString ostr = (DEROctetString)obj;

    // Create a delta CRL
    revcerts = new ArrayList<RevokedCertInfo>();
    crl = x509ca.generateDeltaCRL(cryptoToken, revcerts, 3, 2);
    assertNotNull(crl);
    xcrl = CertTools.getCRLfromByteArray(crl.getEncoded());
    assertEquals(CADN, CertTools.getIssuerDN(xcrl));
    set = xcrl.getRevokedCertificates();
    assertNull(set);
    num = CrlExtensions.getCrlNumber(xcrl);
    assertEquals(3, num.intValue());
    deltanum = CrlExtensions.getDeltaCRLIndicator(xcrl);
    assertEquals(2, deltanum.intValue());
    revcerts.add(new RevokedCertInfo(CertTools.getFingerprintAsString(usercert).getBytes(),
            CertTools.getSerialNumber(usercert).toByteArray(), revDate.getTime(),
            RevokedCertInfo.REVOCATION_REASON_CERTIFICATEHOLD, CertTools.getNotAfter(usercert).getTime()));
    crl = x509ca.generateDeltaCRL(cryptoToken, revcerts, 4, 3);
    assertNotNull(crl);
    xcrl = CertTools.getCRLfromByteArray(crl.getEncoded());
    deltanum = CrlExtensions.getDeltaCRLIndicator(xcrl);
    assertEquals(3, deltanum.intValue());
    set = xcrl.getRevokedCertificates();
    assertEquals(1, set.size());
    entry = (X509CRLEntry) set.iterator().next();
    assertEquals(CertTools.getSerialNumber(usercert).toString(), entry.getSerialNumber().toString());
    assertEquals(revDate.toString(), entry.getRevocationDate().toString());
    // Getting the revocation reason is a pita...
    extval = entry.getExtensionValue(Extension.reasonCode.getId());
    aIn = new ASN1InputStream(new ByteArrayInputStream(extval));
    octs = (ASN1OctetString) aIn.readObject();
    aIn = new ASN1InputStream(new ByteArrayInputStream(octs.getOctets()));
    obj = aIn.readObject();
    reason = CRLReason.getInstance((ASN1Enumerated) obj);
    assertEquals("CRLReason: certificateHold", reason.toString());
}

From source file:org.cesecore.certificates.certificate.request.PKCS10RequestMessage.java

License:Open Source License

@Override
public String getPassword() {
    if (password != null) {
        return password;
    }//from  w w w . j av  a  2s.  com
    try {
        if (pkcs10 == null) {
            init();
        }
    } catch (NullPointerException e) {
        log.error("PKCS10 not initated! " + e.getMessage());
        return null;
    }

    String ret = null;
    Attribute[] attributes = pkcs10.getAttributes(PKCSObjectIdentifiers.pkcs_9_at_challengePassword);
    ASN1Encodable obj = null;
    if (attributes.length == 0) {
        // See if we have it embedded in an extension request instead
        attributes = pkcs10.getAttributes(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest);
        if (attributes.length == 0) {
            return null;
        }
        if (log.isDebugEnabled()) {
            log.debug("got extension request");
        }
        ASN1Set values = attributes[0].getAttrValues();
        if (values.size() == 0) {
            return null;
        }
        Extensions exts = Extensions.getInstance(values.getObjectAt(0));
        Extension ext = exts.getExtension(PKCSObjectIdentifiers.pkcs_9_at_challengePassword);
        if (ext == null) {
            if (log.isDebugEnabled()) {
                log.debug("no challenge password extension");
            }
            return null;
        }
        obj = ext.getExtnValue();
    } else {
        // If it is a challengePassword directly, it's just to grab the value
        ASN1Set values = attributes[0].getAttrValues();
        obj = values.getObjectAt(0);
    }

    if (obj != null) {
        ASN1String str = null;

        try {
            str = DERPrintableString.getInstance((obj));
        } catch (IllegalArgumentException ie) {
            // This was not printable string, should be utf8string then according to pkcs#9 v2.0
            str = DERUTF8String.getInstance((obj));
        }

        if (str != null) {
            ret = str.getString();
        }
    }

    return ret;
}

From source file:org.cesecore.certificates.certificate.request.PKCS10RequestMessage.java

License:Open Source License

@Override
public Extensions getRequestExtensions() {
    try {/*from  w w  w  . ja v  a 2 s . c o m*/
        if (pkcs10 == null) {
            init();
        }
    } catch (NullPointerException e) {
        log.error("PKCS10 not inited! " + e.getMessage());
        return null;
    }
    Extensions ret = null;

    // Get attributes
    // The X509 extension is in a a pkcs_9_at_extensionRequest

    // See if we have it embedded in an extension request instead
    Attribute[] attr = pkcs10.getAttributes(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest);
    if (attr.length != 0) {
        if (log.isDebugEnabled()) {
            log.debug("got request extension");
        }
        ASN1Set values = attr[0].getAttrValues();
        if (values.size() > 0) {
            try {
                ret = Extensions.getInstance(values.getObjectAt(0));
            } catch (IllegalArgumentException e) {
                if (log.isDebugEnabled()) {
                    log.debug(
                            "pkcs_9_extensionRequest does not contain Extensions that it should, ignoring invalid encoded extension request.");
                }
            }
        }
    }

    return ret;
}

From source file:org.cesecore.certificates.certificate.request.RequestMessageTest.java

License:Open Source License

private PKCS10CertificationRequest createP10(final String subjectDN)
        throws IOException, OperatorCreationException {
    // Create a P10 with extensions, in this case altNames with a DNS name
    ASN1EncodableVector altnameattr = new ASN1EncodableVector();
    altnameattr.add(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest);
    // AltNames//from   ww w  .  j  a v a  2s. c om
    // String[] namearray = altnames.split(",");
    GeneralNames san = CertTools.getGeneralNamesFromAltName("dNSName=foo1.bar.com");
    ExtensionsGenerator extgen = new ExtensionsGenerator();
    extgen.addExtension(Extension.subjectAlternativeName, false, san);
    Extensions exts = extgen.generate();
    altnameattr.add(new DERSet(exts));

    // Add a challenge password as well
    ASN1EncodableVector pwdattr = new ASN1EncodableVector();
    pwdattr.add(PKCSObjectIdentifiers.pkcs_9_at_challengePassword);
    ASN1EncodableVector pwdvalues = new ASN1EncodableVector();
    pwdvalues.add(new DERUTF8String("foo123"));
    pwdattr.add(new DERSet(pwdvalues));

    // Complete the Attribute section of the request, the set (Attributes)
    // contains one sequence (Attribute)
    ASN1EncodableVector v = new ASN1EncodableVector();
    v.add(new DERSequence(altnameattr));
    v.add(new DERSequence(pwdattr));
    DERSet attributes = new DERSet(v);

    // Create the PKCS10
    X500Name dn = new X500Name(subjectDN);
    PKCS10CertificationRequest basicpkcs10 = CertTools.genPKCS10CertificationRequest("SHA1WithRSA", dn,
            keyPair.getPublic(), attributes, keyPair.getPrivate(), null);
    return basicpkcs10;
}

From source file:org.cesecore.util.CertToolsTest.java

License:Open Source License

@Test
public void test19getAltNameStringFromExtension() throws Exception {
    {/*w w  w. j  av  a2 s . c  o m*/
        PKCS10CertificationRequest p10 = new JcaPKCS10CertificationRequest(p10ReqWithAltNames);
        Attribute attribute = p10.getAttributes(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest)[0];
        // The set of attributes contains a sequence of with type oid
        // PKCSObjectIdentifiers.pkcs_9_at_extensionRequest
        boolean found = false;
        DERSet s = (DERSet) attribute.getAttrValues();
        Extensions exts = Extensions.getInstance(s.getObjectAt(0));
        Extension ext = exts.getExtension(Extension.subjectAlternativeName);
        if (ext != null) {
            found = true;
            String altNames = CertTools.getAltNameStringFromExtension(ext);
            assertEquals("dNSName=ort3-kru.net.polisen.se, iPAddress=10.252.255.237", altNames);

        }
        assertTrue(found);
    }
    {
        PKCS10CertificationRequest p10 = new JcaPKCS10CertificationRequest(p10ReqWithAltNames2);
        // The set of attributes contains a sequence of with type oid
        // PKCSObjectIdentifiers.pkcs_9_at_extensionRequest
        Attribute attribute = p10.getAttributes(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest)[0];
        boolean found = false;
        DERSet s = (DERSet) attribute.getAttrValues();
        Extensions exts = Extensions.getInstance(s.getObjectAt(0));
        Extension ext = exts.getExtension(Extension.subjectAlternativeName);
        if (ext != null) {
            found = true;
            String altNames = CertTools.getAltNameStringFromExtension(ext);
            assertEquals("dNSName=foo.bar.com, iPAddress=10.0.0.1", altNames);
        }
        assertTrue(found);
    }

}

From source file:org.deviceconnect.android.ssl.EndPointKeyStoreManager.java

License:MIT License

/**
 * ??????./*from   w w w .ja va  2  s  .c  o  m*/
 *
 * @param keyPair 
 * @param commonName ?
 * @param generalNames SANs
 * @return ????
 * @throws GeneralSecurityException ?????
 */
private static PKCS10CertificationRequest createCSR(final KeyPair keyPair, final String commonName,
        final GeneralNames generalNames) throws GeneralSecurityException {
    final String signatureAlgorithm = "SHA256WithRSAEncryption";
    final X500Principal principal = new X500Principal(
            "CN=" + commonName + ", O=Device Connect Project, L=N/A, ST=N/A, C=JP");
    DERSequence sanExtension = new DERSequence(
            new ASN1Encodable[] { X509Extensions.SubjectAlternativeName, new DEROctetString(generalNames) });
    DERSet extensions = new DERSet(new DERSequence(sanExtension));
    DERSequence extensionRequest = new DERSequence(
            new ASN1Encodable[] { PKCSObjectIdentifiers.pkcs_9_at_extensionRequest, extensions });
    DERSet attributes = new DERSet(extensionRequest);
    return new PKCS10CertificationRequest(signatureAlgorithm, principal, keyPair.getPublic(), attributes,
            keyPair.getPrivate());
}

From source file:org.eclipse.milo.opcua.stack.core.util.CertificateUtil.java

License:Open Source License

/**
 * Generate a {@link PKCS10CertificationRequest} for the provided {@code certificate} and {@code keyPair}.
 *
 * @param keyPair     the {@link KeyPair} for {@code certificate}.
 * @param certificate the {@link X509Certificate} to request signing for.
 * @return a {@link PKCS10CertificationRequest}.
 * @throws Exception if creating the signing request fails for any reason.
 *///w w w.j  av  a  2  s .  c om
public static PKCS10CertificationRequest generateCsr(KeyPair keyPair, X509Certificate certificate)
        throws Exception {

    PKCS10CertificationRequestBuilder builder = new JcaPKCS10CertificationRequestBuilder(
            certificate.getSubjectX500Principal(), certificate.getPublicKey());

    GeneralNames subjectAltNames = new GeneralNames(
            getSubjectAltNames(certificate).toArray(new GeneralName[0]));

    ExtensionsGenerator extGen = new ExtensionsGenerator();
    extGen.addExtension(Extension.subjectAlternativeName, false, subjectAltNames);
    builder.addAttribute(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest, extGen.generate());

    JcaContentSignerBuilder signerBuilder = new JcaContentSignerBuilder(certificate.getSigAlgName());

    ContentSigner signer = signerBuilder.build(keyPair.getPrivate());

    return builder.build(signer);
}

From source file:org.eclipse.milo.opcua.stack.core.util.CertificateUtil.java

License:Open Source License

/**
 * Generate a {@link PKCS10CertificationRequest}.
 *
 * @param keyPair            the {@link KeyPair} containing Public and Private keys.
 * @param subject            the subject name {@link X500Name}.
 * @param sanUri             the URI to request in the SAN.
 * @param sanDnsNames        the DNS names to request in the SAN.
 * @param sanIpAddresses     the IP addresses to request in the SAN.
 * @param signatureAlgorithm the signature algorithm to use when generating the signature to validate the
 *                           certificate.
 * @return a {@link PKCS10CertificationRequest}.
 * @throws Exception if creating the signing request fails for any reason.
 *//*from  w  w  w . ja va  2 s  .c  o  m*/
public static PKCS10CertificationRequest generateCsr(KeyPair keyPair, X500Name subject, String sanUri,
        List<String> sanDnsNames, List<String> sanIpAddresses, String signatureAlgorithm) throws Exception {

    PKCS10CertificationRequestBuilder builder = new PKCS10CertificationRequestBuilder(subject,
            SubjectPublicKeyInfo.getInstance(keyPair.getPublic().getEncoded()));

    List<GeneralName> generalNames = new ArrayList<>();

    generalNames.add(new GeneralName(SUBJECT_ALT_NAME_URI, sanUri));

    sanDnsNames.stream().map(n -> new GeneralName(SUBJECT_ALT_NAME_DNS_NAME, n)).forEach(generalNames::add);

    sanIpAddresses.stream().map(n -> new GeneralName(SUBJECT_ALT_NAME_IP_ADDRESS, n))
            .forEach(generalNames::add);

    ExtensionsGenerator extGen = new ExtensionsGenerator();

    extGen.addExtension(Extension.subjectAlternativeName, false,
            new GeneralNames(generalNames.toArray(new GeneralName[0])));

    builder.addAttribute(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest, extGen.generate());

    JcaContentSignerBuilder signerBuilder = new JcaContentSignerBuilder(signatureAlgorithm);

    ContentSigner signer = signerBuilder.build(keyPair.getPrivate());

    return builder.build(signer);
}

From source file:org.ejbca.core.ejb.ca.sign.SignSessionTest.java

License:Open Source License

public void test29TestExtensionOverride() throws Exception {
    final String altnames = "dNSName=foo1.bar.com,dNSName=foo2.bar.com,dNSName=foo3.bar.com,dNSName=foo4.bar.com,dNSName=foo5.bar.com,dNSName=foo6.bar.com,dNSName=foo7.bar.com,dNSName=foo8.bar.com,dNSName=foo9.bar.com,dNSName=foo10.bar.com,dNSName=foo11.bar.com,dNSName=foo12.bar.com,dNSName=foo13.bar.com,dNSName=foo14.bar.com,dNSName=foo15.bar.com,dNSName=foo16.bar.com,dNSName=foo17.bar.com,dNSName=foo18.bar.com,dNSName=foo19.bar.com,dNSName=foo20.bar.com,dNSName=foo21.bar.com";
    // Create a good certificate profile (good enough), using QC statement
    certificateProfileSession.removeCertificateProfile(admin, "TESTEXTENSIONOVERRIDE");
    EndUserCertificateProfile certprof = new EndUserCertificateProfile();
    // Default profile does not allow Extension override
    certprof.setValidity(298);/*from ww  w  . ja va2  s.  c o m*/
    certificateProfileSession.addCertificateProfile(admin, "TESTEXTENSIONOVERRIDE", certprof);
    int cprofile = certificateProfileSession.getCertificateProfileId(admin, "TESTEXTENSIONOVERRIDE");

    // Create a good end entity profile (good enough), allowing multiple UPN
    // names
    endEntityProfileSession.removeEndEntityProfile(admin, "TESTEXTENSIONOVERRIDE");
    EndEntityProfile profile = new EndEntityProfile();
    profile.addField(DnComponents.COUNTRY);
    profile.addField(DnComponents.COMMONNAME);
    profile.setValue(EndEntityProfile.AVAILCAS, 0, Integer.toString(SecConst.ALLCAS));
    profile.setValue(EndEntityProfile.AVAILCERTPROFILES, 0, Integer.toString(cprofile));
    endEntityProfileSession.addEndEntityProfile(admin, "TESTEXTENSIONOVERRIDE", profile);
    int eeprofile = endEntityProfileSession.getEndEntityProfileId(admin, "TESTEXTENSIONOVERRIDE");
    UserDataVO user = new UserDataVO("foo", "C=SE,CN=extoverride", rsacaid, null, "foo@anatom.nu",
            SecConst.USER_ENDUSER, eeprofile, cprofile, SecConst.TOKEN_SOFT_PEM, 0, null);
    user.setPassword("foo123");
    user.setStatus(UserDataConstants.STATUS_NEW);
    // Change a user that we know...
    userAdminSession.changeUser(admin, user, false);

    // Create a P10 with extensions, in this case altNames with a lot of DNS
    // names
    ASN1EncodableVector extensionattr = new ASN1EncodableVector();
    extensionattr.add(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest);
    // AltNames
    // String[] namearray = altnames.split(",");
    GeneralNames san = CertTools.getGeneralNamesFromAltName(altnames);
    ByteArrayOutputStream extOut = new ByteArrayOutputStream();
    DEROutputStream derOut = new DEROutputStream(extOut);
    try {
        derOut.writeObject(san);
    } catch (IOException e) {
        throw new IllegalArgumentException("error encoding value: " + e);
    }
    // Extension request attribute is a set of X509Extensions
    // ASN1EncodableVector x509extensions = new ASN1EncodableVector();
    // An X509Extensions is a sequence of Extension which is a sequence of
    // {oid, X509Extension}
    // ASN1EncodableVector extvalue = new ASN1EncodableVector();
    Vector<DERObjectIdentifier> oidvec = new Vector<DERObjectIdentifier>();
    oidvec.add(X509Extensions.SubjectAlternativeName);
    Vector<X509Extension> valuevec = new Vector<X509Extension>();
    valuevec.add(new X509Extension(false, new DEROctetString(extOut.toByteArray())));
    X509Extensions exts = new X509Extensions(oidvec, valuevec);
    extensionattr.add(new DERSet(exts));
    // Complete the Attribute section of the request, the set (Attributes)
    // contains one sequence (Attribute)
    ASN1EncodableVector v = new ASN1EncodableVector();
    v.add(new DERSequence(extensionattr));
    DERSet attributes = new DERSet(v);
    // Create PKCS#10 certificate request
    PKCS10CertificationRequest req = new PKCS10CertificationRequest("SHA1WithRSA",
            new X509Name("C=SE,CN=extoverride"), rsakeys.getPublic(), attributes, rsakeys.getPrivate());
    ByteArrayOutputStream bOut = new ByteArrayOutputStream();
    DEROutputStream dOut = new DEROutputStream(bOut);
    dOut.writeObject(req);
    dOut.close();
    byte[] p10bytes = bOut.toByteArray();
    // FileOutputStream fos = new FileOutputStream("/tmp/foo.der");
    // fos.write(p10bytes);
    // fos.close();
    PKCS10RequestMessage p10 = new PKCS10RequestMessage(p10bytes);
    p10.setUsername("foo");
    p10.setPassword("foo123");
    // See if the request message works...
    X509Extensions p10exts = p10.getRequestExtensions();
    assertNotNull(p10exts);
    IResponseMessage resp = signSession.createCertificate(admin, p10,
            org.ejbca.core.protocol.X509ResponseMessage.class, null);
    X509Certificate cert = (X509Certificate) CertTools.getCertfromByteArray(resp.getResponseMessage());
    assertNotNull("Failed to create certificate", cert);
    assertEquals("CN=extoverride,C=SE", cert.getSubjectDN().getName());
    // check altNames, should be none
    Collection c = cert.getSubjectAlternativeNames();
    assertNull(c);

    // Change so that we allow override of validity time
    CertificateProfile prof = certificateProfileSession.getCertificateProfile(admin, cprofile);
    prof.setAllowExtensionOverride(true);
    certificateProfileSession.changeCertificateProfile(admin, "TESTEXTENSIONOVERRIDE", prof);

    userAdminSession.changeUser(admin, user, false);
    resp = signSession.createCertificate(admin, p10, org.ejbca.core.protocol.X509ResponseMessage.class, null);
    cert = (X509Certificate) CertTools.getCertfromByteArray(resp.getResponseMessage());
    assertNotNull("Failed to create certificate", cert);
    assertEquals("CN=extoverride,C=SE", cert.getSubjectDN().getName());
    // check altNames, should be one altName
    c = cert.getSubjectAlternativeNames();
    assertNotNull(c);
    assertEquals(21, c.size());
    String retAltNames = CertTools.getSubjectAlternativeName(cert);
    List<String> originalNames = Arrays.asList(altnames.split(","));
    List<String> returnNames = Arrays.asList(retAltNames.split(", "));
    assertTrue(originalNames.containsAll(returnNames));
}