Example usage for org.bouncycastle.asn1.x500 X500Name getInstance

List of usage examples for org.bouncycastle.asn1.x500 X500Name getInstance

  1. HOME
  2. Java
  3. org.bouncycastle
  4. org.bouncycastle.asn1.x500.*
  5. X500Name
  6. getInstance

Introduction

In this page you can find the example usage for org.bouncycastle.asn1.x500 X500Name getInstance.

Prototype

public static X500Name getInstance(Object obj)

Source Link

Usage

From source file:org.xipki.ca.common.cmp.CmpUtil.java

License:Open Source License

public static PKIMessage addProtection(final PKIMessage pkiMessage, final ConcurrentContentSigner signer,
        GeneralName signerName, final boolean addSignerCert) throws CMPException, NoIdleSignerException {
    if (signerName == null) {
        X500Name x500Name = X500Name
                .getInstance(signer.getCertificate().getSubjectX500Principal().getEncoded());
        signerName = new GeneralName(x500Name);
    }// w  w  w. j  av  a2 s .c o  m
    PKIHeader header = pkiMessage.getHeader();
    ProtectedPKIMessageBuilder builder = new ProtectedPKIMessageBuilder(signerName, header.getRecipient());
    PKIFreeText freeText = header.getFreeText();
    if (freeText != null) {
        builder.setFreeText(freeText);
    }

    InfoTypeAndValue[] generalInfo = header.getGeneralInfo();
    if (generalInfo != null) {
        for (InfoTypeAndValue gi : generalInfo) {
            builder.addGeneralInfo(gi);
        }
    }

    ASN1OctetString octet = header.getRecipKID();
    if (octet != null) {
        builder.setRecipKID(octet.getOctets());
    }

    octet = header.getRecipNonce();
    if (octet != null) {
        builder.setRecipNonce(octet.getOctets());
    }

    octet = header.getSenderKID();
    if (octet != null) {
        builder.setSenderKID(octet.getOctets());
    }

    octet = header.getSenderNonce();
    if (octet != null) {
        builder.setSenderNonce(octet.getOctets());
    }

    octet = header.getTransactionID();
    if (octet != null) {
        builder.setTransactionID(octet.getOctets());
    }

    if (header.getMessageTime() != null) {
        builder.setMessageTime(new Date());
    }
    builder.setBody(pkiMessage.getBody());

    if (addSignerCert) {
        X509CertificateHolder signerCert = signer.getCertificateAsBCObject();
        builder.addCMPCertificate(signerCert);
    }

    ContentSigner realSigner = signer.borrowContentSigner();
    try {
        ProtectedPKIMessage signedMessage = builder.build(realSigner);
        return signedMessage.toASN1Structure();
    } finally {
        signer.returnContentSigner(realSigner);
    }
}

From source file:org.xipki.ca.qa.shell.NegRevokeCertCommand.java

License:Open Source License

@Override
protected Object _doExecute() throws Exception {
    if (certFile == null && (issuerCertFile == null || getSerialNumber() == null)) {
        throw new IllegalCmdParamException("either cert or (cacert, serial) must be specified");
    }//w w  w. j  a  v  a 2 s  .c  o  m

    CRLReason crlReason = CRLReason.getInstance(reason);
    if (crlReason == null) {
        throw new IllegalCmdParamException("invalid reason " + reason);
    }

    if (CRLReason.PERMITTED_CLIENT_CRLREASONS.contains(crlReason) == false) {
        throw new IllegalCmdParamException("reason " + reason + " is not permitted");
    }

    Date invalidityDate = null;
    if (isNotBlank(invalidityDateS)) {
        invalidityDate = DateUtil.parseUTCTimeyyyyMMddhhmmss(invalidityDateS);
    }

    X509Certificate caCert = null;
    if (issuerCertFile != null) {
        caCert = X509Util.parseCert(issuerCertFile);
    }

    CertIdOrError certIdOrError;
    if (certFile != null) {
        X509Certificate cert = X509Util.parseCert(certFile);
        if (caCert != null) {
            String errorMsg = checkCertificate(cert, caCert);
            if (errorMsg != null) {
                throw new CmdFailure(errorMsg);
            }
        }
        RequestResponseDebug debug = getRequestResponseDebug();
        try {
            certIdOrError = caClient.revokeCert(cert, crlReason.getCode(), invalidityDate, debug);
        } finally {
            saveRequestResponse(debug);
        }

    } else {
        X500Name issuer = X500Name.getInstance(caCert.getSubjectX500Principal().getEncoded());
        RequestResponseDebug debug = getRequestResponseDebug();
        try {
            certIdOrError = caClient.revokeCert(issuer, getSerialNumber(), crlReason.getCode(), invalidityDate,
                    debug);
        } finally {
            saveRequestResponse(debug);
        }
    }

    if (certIdOrError.getError() == null) {
        throw new CmdFailure("revocation sucessful but expected failure");
    }
    return null;
}

From source file:org.xipki.ca.qa.shell.NegUnrevokeCertCommand.java

License:Open Source License

@Override
protected Object _doExecute() throws Exception {
    if (certFile == null && (issuerCertFile == null || getSerialNumber() == null)) {
        throw new IllegalCmdParamException("either cert or (cacert, serial) must be specified");
    }/*from  w w  w.j  a  va 2  s . c  o m*/

    X509Certificate caCert = null;
    if (issuerCertFile != null) {
        caCert = X509Util.parseCert(issuerCertFile);
    }

    CertIdOrError certIdOrError;
    if (certFile != null) {
        X509Certificate cert = X509Util.parseCert(certFile);
        if (caCert != null) {
            String errorMsg = checkCertificate(cert, caCert);
            if (errorMsg != null) {
                throw new CmdFailure(errorMsg);
            }
        }
        RequestResponseDebug debug = getRequestResponseDebug();
        try {
            certIdOrError = caClient.unrevokeCert(cert, debug);
        } finally {
            saveRequestResponse(debug);
        }
    } else {
        X500Name issuer = X500Name.getInstance(caCert.getSubjectX500Principal().getEncoded());
        RequestResponseDebug debug = getRequestResponseDebug();
        try {
            certIdOrError = caClient.unrevokeCert(issuer, getSerialNumber(), debug);
        } finally {
            saveRequestResponse(debug);
        }
    }

    if (certIdOrError.getError() == null) {
        throw new CmdFailure("releasing revocation successful but expected failure");
    }
    return null;
}

From source file:org.xipki.ca.server.impl.CmpResponderEntryWrapper.java

License:Open Source License

public void setDbEntry(final CmpResponderEntry dbEntry) {
    this.dbEntry = dbEntry;
    signer = null;/*www. j  a va2s. c  o m*/
    if (dbEntry.getCertificate() != null) {
        subjectAsX500Name = X500Name
                .getInstance(dbEntry.getCertificate().getSubjectX500Principal().getEncoded());
        subjectAsGeneralName = new GeneralName(subjectAsX500Name);
    }
}

From source file:org.xipki.ca.server.impl.CmpResponderEntryWrapper.java

License:Open Source License

public void initSigner(final SecurityFactory securityFactory) throws SignerException {
    if (signer != null) {
        return;// w ww  . ja va  2 s.  c  o m
    }

    if (dbEntry == null) {
        throw new SignerException("dbEntry is null");
    }

    X509Certificate responderCert = dbEntry.getCertificate();
    dbEntry.setConfFaulty(true);
    signer = securityFactory.createSigner(dbEntry.getType(), dbEntry.getConf(), responderCert);
    dbEntry.setConfFaulty(false);
    if (dbEntry.getBase64Cert() == null) {
        dbEntry.setCertificate(signer.getCertificate());
        subjectAsX500Name = X500Name.getInstance(signer.getCertificateAsBCObject().getSubject());
        subjectAsGeneralName = new GeneralName(subjectAsX500Name);
    }
}

From source file:org.xipki.ca.server.impl.IdentifiedX509Certprofile.java

License:Open Source License

public ExtensionValues getExtensions(final X500Name requestedSubject, final Extensions requestExtensions,
        final SubjectPublicKeyInfo publicKeyInfo, final PublicCAInfo publicCaInfo,
        final X509Certificate crlSignerCert) throws CertprofileException, BadCertTemplateException {
    ExtensionValues values = new ExtensionValues();

    Map<ASN1ObjectIdentifier, ExtensionControl> controls = new HashMap<>(certprofile.getExtensionControls());

    Set<ASN1ObjectIdentifier> neededExtensionTypes = new HashSet<>();
    Set<ASN1ObjectIdentifier> wantedExtensionTypes = new HashSet<>();
    if (requestExtensions != null) {
        Extension reqExtension = requestExtensions
                .getExtension(ObjectIdentifiers.id_xipki_ext_cmpRequestExtensions);
        if (reqExtension != null) {
            ExtensionExistence ee = ExtensionExistence.getInstance(reqExtension.getParsedValue());
            neededExtensionTypes.addAll(ee.getNeedExtensions());
            wantedExtensionTypes.addAll(ee.getWantExtensions());
        }//from www  .j av  a 2s.c om

        for (ASN1ObjectIdentifier oid : neededExtensionTypes) {
            if (wantedExtensionTypes.contains(oid)) {
                wantedExtensionTypes.remove(oid);
            }

            if (controls.containsKey(oid) == false) {
                throw new BadCertTemplateException("could not add needed extension " + oid.getId());
            }
        }
    }

    // SubjectKeyIdentifier
    ASN1ObjectIdentifier extType = Extension.subjectKeyIdentifier;
    ExtensionControl extControl = controls.remove(extType);
    if (extControl != null && addMe(extType, extControl, neededExtensionTypes, wantedExtensionTypes)) {
        MessageDigest sha1;
        try {
            sha1 = MessageDigest.getInstance("SHA-1");
        } catch (NoSuchAlgorithmException e) {
            throw new CertprofileException(e.getMessage(), e);
        }
        byte[] skiValue = sha1.digest(publicKeyInfo.getPublicKeyData().getBytes());

        SubjectKeyIdentifier value = new SubjectKeyIdentifier(skiValue);
        addExtension(values, extType, value, extControl, neededExtensionTypes, wantedExtensionTypes);
    }

    // Authority key identifier
    extType = Extension.authorityKeyIdentifier;
    extControl = controls.remove(extType);
    if (extControl != null && addMe(extType, extControl, neededExtensionTypes, wantedExtensionTypes)) {
        byte[] ikiValue = publicCaInfo.getSubjectKeyIdentifer();
        AuthorityKeyIdentifier value = null;
        if (ikiValue != null) {
            if (certprofile.includeIssuerAndSerialInAKI()) {
                GeneralNames x509CaSubject = new GeneralNames(new GeneralName(publicCaInfo.getX500Subject()));
                value = new AuthorityKeyIdentifier(ikiValue, x509CaSubject, publicCaInfo.getSerialNumber());
            } else {
                value = new AuthorityKeyIdentifier(ikiValue);
            }
        }

        addExtension(values, extType, value, extControl, neededExtensionTypes, wantedExtensionTypes);
    }

    // IssuerAltName
    extType = Extension.issuerAlternativeName;
    extControl = controls.remove(extType);
    if (extControl != null && addMe(extType, extControl, neededExtensionTypes, wantedExtensionTypes)) {
        GeneralNames value = publicCaInfo.getSubjectAltName();
        addExtension(values, extType, value, extControl, neededExtensionTypes, wantedExtensionTypes);
    }

    // AuthorityInfoAccess
    extType = Extension.authorityInfoAccess;
    extControl = controls.remove(extType);
    if (extControl != null && addMe(extType, extControl, neededExtensionTypes, wantedExtensionTypes)) {
        AuthorityInfoAccessControl aiaControl = certprofile.getAIAControl();

        List<String> caIssuers = null;
        if (aiaControl == null || aiaControl.includesCaIssuers()) {
            caIssuers = publicCaInfo.getCaCertUris();
        }

        List<String> ocspUris = null;
        if (aiaControl == null || aiaControl.includesOcsp()) {
            ocspUris = publicCaInfo.getOcspUris();
        }
        AuthorityInformationAccess value = X509CertUtil.createAuthorityInformationAccess(caIssuers, ocspUris);
        addExtension(values, extType, value, extControl, neededExtensionTypes, wantedExtensionTypes);
    }

    if (controls.containsKey(Extension.cRLDistributionPoints) || controls.containsKey(Extension.freshestCRL)) {
        X500Name crlSignerSubject = null;
        if (crlSignerCert != null) {
            crlSignerSubject = X500Name.getInstance(crlSignerCert.getSubjectX500Principal().getEncoded());
        }

        X500Name x500CaPrincipal = publicCaInfo.getX500Subject();

        // CRLDistributionPoints
        extType = Extension.cRLDistributionPoints;
        extControl = controls.remove(extType);
        if (extControl != null && addMe(extType, extControl, neededExtensionTypes, wantedExtensionTypes)) {
            CRLDistPoint value;
            try {
                value = X509CertUtil.createCRLDistributionPoints(publicCaInfo.getCrlUris(), x500CaPrincipal,
                        crlSignerSubject);
            } catch (IOException e) {
                throw new CertprofileException(e.getMessage(), e);
            }
            addExtension(values, extType, value, extControl, neededExtensionTypes, wantedExtensionTypes);
        }

        // FreshestCRL
        extType = Extension.freshestCRL;
        extControl = controls.remove(extType);
        if (extControl != null && addMe(extType, extControl, neededExtensionTypes, wantedExtensionTypes)) {
            CRLDistPoint value;
            try {
                value = X509CertUtil.createCRLDistributionPoints(publicCaInfo.getDeltaCrlUris(),
                        x500CaPrincipal, crlSignerSubject);
            } catch (IOException e) {
                throw new CertprofileException(e.getMessage(), e);
            }
            addExtension(values, extType, value, extControl, neededExtensionTypes, wantedExtensionTypes);
        }
    }

    // BasicConstraints
    extType = Extension.basicConstraints;
    extControl = controls.remove(extType);
    if (extControl != null && addMe(extType, extControl, neededExtensionTypes, wantedExtensionTypes)) {
        BasicConstraints value = X509CertUtil.createBasicConstraints(certprofile.isCA(),
                certprofile.getPathLenBasicConstraint());
        addExtension(values, extType, value, extControl, neededExtensionTypes, wantedExtensionTypes);
    }

    // KeyUsage
    extType = Extension.keyUsage;
    extControl = controls.remove(extType);
    if (extControl != null && addMe(extType, extControl, neededExtensionTypes, wantedExtensionTypes)) {
        Set<KeyUsage> usages = new HashSet<>();
        Set<KeyUsageControl> usageOccs = certprofile.getKeyUsage();
        for (KeyUsageControl k : usageOccs) {
            if (k.isRequired()) {
                usages.add(k.getKeyUsage());
            }
        }

        // the optional KeyUsage will only be set if requested explicitly
        if (requestExtensions != null && extControl.isRequest()) {
            addRequestedKeyusage(usages, requestExtensions, usageOccs);
        }

        org.bouncycastle.asn1.x509.KeyUsage value = X509Util.createKeyUsage(usages);
        addExtension(values, extType, value, extControl, neededExtensionTypes, wantedExtensionTypes);
    }

    // ExtendedKeyUsage
    extType = Extension.extendedKeyUsage;
    extControl = controls.remove(extType);
    if (extControl != null && addMe(extType, extControl, neededExtensionTypes, wantedExtensionTypes)) {
        Set<ASN1ObjectIdentifier> usages = new HashSet<>();
        Set<ExtKeyUsageControl> usageOccs = certprofile.getExtendedKeyUsages();
        for (ExtKeyUsageControl k : usageOccs) {
            if (k.isRequired()) {
                usages.add(k.getExtKeyUsage());
            }
        }

        // the optional ExtKeyUsage will only be set if requested explicitly
        if (requestExtensions != null && extControl.isRequest()) {
            addRequestedExtKeyusage(usages, requestExtensions, usageOccs);
        }

        if (extControl.isCritical() && usages.contains(ObjectIdentifiers.anyExtendedKeyUsage)) {
            extControl = new ExtensionControl(false, extControl.isRequired(), extControl.isRequest());
        }

        ExtendedKeyUsage value = X509Util.createExtendedUsage(usages);
        addExtension(values, extType, value, extControl, neededExtensionTypes, wantedExtensionTypes);
    }

    // ocsp-nocheck
    extType = ObjectIdentifiers.id_extension_pkix_ocsp_nocheck;
    extControl = controls.remove(extType);
    if (extControl != null && addMe(extType, extControl, neededExtensionTypes, wantedExtensionTypes)) {
        // the extension ocsp-nocheck will only be set if requested explicitly
        DERNull value = DERNull.INSTANCE;
        addExtension(values, extType, value, extControl, neededExtensionTypes, wantedExtensionTypes);
    }

    // SubjectAltName
    extType = Extension.subjectAlternativeName;
    extControl = controls.remove(extType);
    if (extControl != null && addMe(extType, extControl, neededExtensionTypes, wantedExtensionTypes)) {
        GeneralNames value = null;
        if (requestExtensions != null && extControl.isRequest()) {
            value = createRequestedSubjectAltNames(requestExtensions, certprofile.getSubjectAltNameModes());
        }
        addExtension(values, extType, value, extControl, neededExtensionTypes, wantedExtensionTypes);
    }

    // SubjectInfoAccess
    extType = Extension.subjectInfoAccess;
    extControl = controls.remove(extType);
    if (extControl != null && addMe(extType, extControl, neededExtensionTypes, wantedExtensionTypes)) {
        ASN1Sequence value = null;
        if (requestExtensions != null && extControl.isRequest()) {
            value = createSubjectInfoAccess(requestExtensions, certprofile.getSubjectInfoAccessModes());
        }
        addExtension(values, extType, value, extControl, neededExtensionTypes, wantedExtensionTypes);
    }

    ExtensionValues subvalues = certprofile.getExtensions(Collections.unmodifiableMap(controls),
            requestedSubject, requestExtensions);

    Set<ASN1ObjectIdentifier> extTypes = new HashSet<>(controls.keySet());
    for (ASN1ObjectIdentifier type : extTypes) {
        extControl = controls.remove(type);
        boolean addMe = addMe(type, extControl, neededExtensionTypes, wantedExtensionTypes);
        if (addMe) {
            ExtensionValue value = null;
            if (extControl.isRequest()) {
                Extension reqExt = requestExtensions.getExtension(type);
                if (reqExt != null) {
                    value = new ExtensionValue(reqExt.isCritical(), reqExt.getParsedValue());
                }
            }

            if (value == null) {
                value = subvalues.getExtensionValue(type);
            }

            addExtension(values, type, value, extControl, neededExtensionTypes, wantedExtensionTypes);
        }
    }

    Set<ASN1ObjectIdentifier> unprocessedExtTypes = new HashSet<>();
    for (ASN1ObjectIdentifier type : controls.keySet()) {
        if (controls.get(type).isRequired()) {
            unprocessedExtTypes.add(type);
        }
    }

    if (CollectionUtil.isNotEmpty(unprocessedExtTypes)) {
        throw new CertprofileException("could not add required extensions " + toString(unprocessedExtTypes));
    }

    if (CollectionUtil.isNotEmpty(neededExtensionTypes)) {
        throw new BadCertTemplateException(
                "could not add requested extensions " + toString(neededExtensionTypes));
    }

    return values;
}

From source file:org.xipki.ca.server.impl.PublicCAInfo.java

License:Open Source License

public PublicCAInfo(final X509Certificate caCertificate, final List<String> caCertUris,
        final List<String> ocspUris, final List<String> crlUris, final List<String> deltaCrlUris)
        throws OperationException {
    ParamChecker.assertNotNull("caCertificate", caCertificate);
    this.caCertificate = new X509CertWithDBCertId(caCertificate);
    this.serialNumber = caCertificate.getSerialNumber();
    this.subject = caCertificate.getSubjectX500Principal();
    this.x500Subject = X500Name.getInstance(subject.getEncoded());
    try {//from   w w  w  . ja v a 2 s  .c o m
        this.subjectKeyIdentifier = X509Util.extractSKI(caCertificate);
    } catch (CertificateEncodingException e) {
        throw new OperationException(ErrorCode.INVALID_EXTENSION, e.getMessage());
    }
    this.caCertUris = CollectionUtil.unmodifiableList(caCertUris, true, true);
    this.ocspUris = CollectionUtil.unmodifiableList(ocspUris, true, true);
    this.crlUris = CollectionUtil.unmodifiableList(crlUris, true, true);
    this.deltaCrlUris = CollectionUtil.unmodifiableList(deltaCrlUris, true, true);

    byte[] encodedSubjectAltName = caCertificate.getExtensionValue(Extension.subjectAlternativeName.getId());
    if (encodedSubjectAltName == null) {
        subjectAltName = null;
    } else {
        try {
            subjectAltName = GeneralNames
                    .getInstance(X509ExtensionUtil.fromExtensionValue(encodedSubjectAltName));
        } catch (IOException e) {
            throw new OperationException(ErrorCode.INVALID_EXTENSION,
                    "invalid SubjectAltName extension in CA certificate");
        }
    }
}

From source file:org.xipki.ca.server.impl.X509CA.java

License:Open Source License

private X509CRL generateCRL(final boolean deltaCRL, final Date thisUpdate, final Date nextUpdate,
        final AuditEvent auditEvent) throws OperationException {
    X509CrlSignerEntryWrapper crlSigner = getCrlSigner();
    if (crlSigner == null) {
        throw new OperationException(ErrorCode.INSUFFICIENT_PERMISSION, "CRL generation is not allowed");
    }/*from   w w  w  .j  a v a  2 s .com*/

    LOG.info("     START generateCRL: ca={}, deltaCRL={}, nextUpdate={}",
            new Object[] { caInfo.getName(), deltaCRL, nextUpdate });

    if (auditEvent != null) {
        auditEvent.addEventData(new AuditEventData("crlType", deltaCRL ? "DELTA_CRL" : "FULL_CRL"));
        if (nextUpdate != null) {
            String value;
            synchronized (dateFormat) {
                value = dateFormat.format(nextUpdate);
            }
            auditEvent.addEventData(new AuditEventData("nextUpdate", value));
        } else {
            auditEvent.addEventData(new AuditEventData("nextUpdate", "NULL"));
        }
    }

    if (nextUpdate != null) {
        if (nextUpdate.getTime() - thisUpdate.getTime() < 10 * 60 * MS_PER_SECOND) {
            // less than 10 minutes
            throw new OperationException(ErrorCode.CRL_FAILURE, "nextUpdate and thisUpdate are too close");
        }
    }

    CRLControl crlControl = crlSigner.getCRLControl();
    boolean successfull = false;

    try {
        ConcurrentContentSigner _crlSigner = crlSigner.getSigner();

        CRLControl control = crlSigner.getCRLControl();

        boolean directCRL = _crlSigner == null;
        X500Name crlIssuer = directCRL ? caInfo.getPublicCAInfo().getX500Subject()
                : X500Name.getInstance(_crlSigner.getCertificate().getSubjectX500Principal().getEncoded());

        X509v2CRLBuilder crlBuilder = new X509v2CRLBuilder(crlIssuer, thisUpdate);
        if (nextUpdate != null) {
            crlBuilder.setNextUpdate(nextUpdate);
        }

        BigInteger startSerial = BigInteger.ONE;
        final int numEntries = 100;

        X509CertWithDBCertId caCert = caInfo.getCertificate();
        List<CertRevInfoWithSerial> revInfos;
        boolean isFirstCRLEntry = true;

        Date notExpireAt;
        if (control.isIncludeExpiredCerts()) {
            notExpireAt = new Date(0);
        } else {
            // 10 minutes buffer
            notExpireAt = new Date(thisUpdate.getTime() - 600L * MS_PER_SECOND);
        }

        do {
            if (deltaCRL) {
                revInfos = certstore.getCertificatesForDeltaCRL(caCert, startSerial, numEntries,
                        control.isOnlyContainsCACerts(), control.isOnlyContainsUserCerts());
            } else {
                revInfos = certstore.getRevokedCertificates(caCert, notExpireAt, startSerial, numEntries,
                        control.isOnlyContainsCACerts(), control.isOnlyContainsUserCerts());
            }

            BigInteger maxSerial = BigInteger.ONE;

            for (CertRevInfoWithSerial revInfo : revInfos) {
                BigInteger serial = revInfo.getSerial();
                if (serial.compareTo(maxSerial) > 0) {
                    maxSerial = serial;
                }

                CRLReason reason = revInfo.getReason();
                Date revocationTime = revInfo.getRevocationTime();
                Date invalidityTime = revInfo.getInvalidityTime();
                if (invalidityTime != null && invalidityTime.equals(revocationTime)) {
                    invalidityTime = null;
                }

                if (directCRL || isFirstCRLEntry == false) {
                    if (invalidityTime != null) {
                        crlBuilder.addCRLEntry(revInfo.getSerial(), revocationTime, reason.getCode(),
                                invalidityTime);
                    } else {
                        crlBuilder.addCRLEntry(revInfo.getSerial(), revocationTime, reason.getCode());
                    }
                    continue;
                }

                List<Extension> extensions = new ArrayList<>(3);
                if (reason != CRLReason.UNSPECIFIED) {
                    Extension ext = createReasonExtension(reason.getCode());
                    extensions.add(ext);
                }
                if (invalidityTime != null) {
                    Extension ext = createInvalidityDateExtension(invalidityTime);
                    extensions.add(ext);
                }

                Extension ext = createCertificateIssuerExtension(caInfo.getPublicCAInfo().getX500Subject());
                extensions.add(ext);

                Extensions asn1Extensions = new Extensions(extensions.toArray(new Extension[0]));
                crlBuilder.addCRLEntry(revInfo.getSerial(), revocationTime, asn1Extensions);
                isFirstCRLEntry = false;
            } // end for

            startSerial = maxSerial.add(BigInteger.ONE);

        } while (revInfos.size() >= numEntries);
        // end do

        BigInteger crlNumber = caInfo.nextCRLNumber();
        if (auditEvent != null) {
            auditEvent.addEventData(new AuditEventData("crlNumber", crlNumber.toString()));
        }

        boolean onlyUserCerts = crlControl.isOnlyContainsUserCerts();
        boolean onlyCACerts = crlControl.isOnlyContainsCACerts();
        if (onlyUserCerts && onlyCACerts) {
            throw new RuntimeException("should not reach here, onlyUserCerts and onlyCACerts are both true");
        }

        try {
            // AuthorityKeyIdentifier
            byte[] akiValues = directCRL ? caInfo.getPublicCAInfo().getSubjectKeyIdentifer()
                    : crlSigner.getSubjectKeyIdentifier();
            AuthorityKeyIdentifier aki = new AuthorityKeyIdentifier(akiValues);
            crlBuilder.addExtension(Extension.authorityKeyIdentifier, false, aki);

            // add extension CRL Number
            crlBuilder.addExtension(Extension.cRLNumber, false, new ASN1Integer(crlNumber));

            // IssuingDistributionPoint
            if (onlyUserCerts == true || onlyCACerts == true || directCRL == false) {
                IssuingDistributionPoint idp = new IssuingDistributionPoint((DistributionPointName) null, // distributionPoint,
                        onlyUserCerts, // onlyContainsUserCerts,
                        onlyCACerts, // onlyContainsCACerts,
                        (ReasonFlags) null, // onlySomeReasons,
                        directCRL == false, // indirectCRL,
                        false // onlyContainsAttributeCerts
                );

                crlBuilder.addExtension(Extension.issuingDistributionPoint, true, idp);
            }
        } catch (CertIOException e) {
            final String message = "crlBuilder.addExtension";
            if (LOG.isErrorEnabled()) {
                LOG.error(LogUtil.buildExceptionLogFormat(message), e.getClass().getName(), e.getMessage());
            }
            LOG.debug(message, e);
            throw new OperationException(ErrorCode.INVALID_EXTENSION, e.getMessage());
        }

        startSerial = BigInteger.ONE;
        if (deltaCRL == false && control.isEmbedsCerts()) // XiPKI extension
        {
            ASN1EncodableVector vector = new ASN1EncodableVector();

            List<BigInteger> serials;

            do {
                serials = certstore.getCertSerials(caCert, notExpireAt, startSerial, numEntries, false,
                        onlyCACerts, onlyUserCerts);

                BigInteger maxSerial = BigInteger.ONE;
                for (BigInteger serial : serials) {
                    if (serial.compareTo(maxSerial) > 0) {
                        maxSerial = serial;
                    }

                    X509CertificateInfo certInfo;
                    try {
                        certInfo = certstore.getCertificateInfoForSerial(caCert, serial);
                    } catch (CertificateException e) {
                        throw new OperationException(ErrorCode.SYSTEM_FAILURE,
                                "CertificateException: " + e.getMessage());
                    }

                    Certificate cert = Certificate.getInstance(certInfo.getCert().getEncodedCert());

                    ASN1EncodableVector v = new ASN1EncodableVector();
                    v.add(cert);
                    String profileName = certInfo.getProfileName();
                    if (StringUtil.isNotBlank(profileName)) {
                        v.add(new DERUTF8String(certInfo.getProfileName()));
                    }
                    ASN1Sequence certWithInfo = new DERSequence(v);

                    vector.add(certWithInfo);
                } // end for

                startSerial = maxSerial.add(BigInteger.ONE);
            } while (serials.size() >= numEntries);
            // end fo

            try {
                crlBuilder.addExtension(ObjectIdentifiers.id_xipki_ext_crlCertset, false, new DERSet(vector));
            } catch (CertIOException e) {
                throw new OperationException(ErrorCode.INVALID_EXTENSION, "CertIOException: " + e.getMessage());
            }
        }

        ConcurrentContentSigner concurrentSigner = (_crlSigner == null) ? caInfo.getSigner(null) : _crlSigner;

        ContentSigner contentSigner;
        try {
            contentSigner = concurrentSigner.borrowContentSigner();
        } catch (NoIdleSignerException e) {
            throw new OperationException(ErrorCode.SYSTEM_FAILURE, "NoIdleSignerException: " + e.getMessage());
        }

        X509CRLHolder crlHolder;
        try {
            crlHolder = crlBuilder.build(contentSigner);
        } finally {
            concurrentSigner.returnContentSigner(contentSigner);
        }

        try {
            X509CRL crl = new X509CRLObject(crlHolder.toASN1Structure());
            publishCRL(crl);

            successfull = true;
            LOG.info("SUCCESSFUL generateCRL: ca={}, crlNumber={}, thisUpdate={}",
                    new Object[] { caInfo.getName(), crlNumber, crl.getThisUpdate() });

            if (deltaCRL) {
                return crl;
            }

            // clean up the CRL
            try {
                cleanupCRLs();
            } catch (Throwable t) {
                LOG.warn("could not cleanup CRLs.{}: {}", t.getClass().getName(), t.getMessage());
            }
            return crl;
        } catch (CRLException e) {
            throw new OperationException(ErrorCode.CRL_FAILURE, "CRLException: " + e.getMessage());
        }
    } finally {
        if (successfull == false) {
            LOG.info("    FAILED generateCRL: ca={}", caInfo.getName());
        }
    }
}

From source file:org.xipki.ca.server.impl.X509CACmpResponder.java

License:Open Source License

@Override
protected boolean intendsMe(final GeneralName requestRecipient) throws ConfigurationException {
    if (requestRecipient == null) {
        return false;
    }/*from w ww. j  av a 2s . com*/

    if (getSender().equals(requestRecipient)) {
        return true;
    }

    if (requestRecipient.getTagNo() == GeneralName.directoryName) {
        X500Name x500Name = X500Name.getInstance(requestRecipient.getName());
        if (x500Name.equals(caManager.getCmpResponderWrapper(getResponderName()).getSubjectAsX500Name())) {
            return true;
        }
    }

    return false;
}

From source file:org.xipki.common.util.X509Util.java

License:Open Source License

public static String getRFC4519Name(final X500Principal name) {
    return getRFC4519Name(X500Name.getInstance(name.getEncoded()));
}