Example usage for org.bouncycastle.asn1.x500 X500Name X500Name

Introduction

In this page you can find the example usage for org.bouncycastle.asn1.x500 X500Name X500Name.

Prototype

public X500Name(String dirName) 

Source Link

Usage

From source file:com.linkedin.kafka.clients.utils.tests.TestSslUtils.java

/**
 * Create a self-signed X.509 Certificate.
 * From http://bfo.com/blog/2011/03/08/odds_and_ends_creating_a_new_x_509_certificate.html.
 *
 * @param dn        the X.509 Distinguished Name, eg "CN=Test, L=London, C=GB"
 * @param pair      the KeyPair/*from w w w. j  ava 2s  .c  o  m*/
 * @param days      how many days from now the Certificate is valid for
 * @param algorithm the signing algorithm, eg "SHA1withRSA"
 * @return the self-signed certificate
 * @throws CertificateException thrown if a security error or an IO error occurred.
 */
public static X509Certificate generateCertificate(String dn, KeyPair pair, int days, String algorithm)
        throws CertificateException {

    try {
        Security.addProvider(new BouncyCastleProvider());
        AlgorithmIdentifier sigAlgId = new DefaultSignatureAlgorithmIdentifierFinder().find(algorithm);
        AlgorithmIdentifier digAlgId = new DefaultDigestAlgorithmIdentifierFinder().find(sigAlgId);
        AsymmetricKeyParameter privateKeyAsymKeyParam = PrivateKeyFactory
                .createKey(pair.getPrivate().getEncoded());
        SubjectPublicKeyInfo subPubKeyInfo = SubjectPublicKeyInfo.getInstance(pair.getPublic().getEncoded());
        ContentSigner sigGen = new BcRSAContentSignerBuilder(sigAlgId, digAlgId).build(privateKeyAsymKeyParam);
        X500Name name = new X500Name(dn);
        Date from = new Date();
        Date to = new Date(from.getTime() + days * 86400000L);
        BigInteger sn = new BigInteger(64, new SecureRandom());

        X509v1CertificateBuilder v1CertGen = new X509v1CertificateBuilder(name, sn, from, to, name,
                subPubKeyInfo);
        X509CertificateHolder certificateHolder = v1CertGen.build(sigGen);
        return new JcaX509CertificateConverter().setProvider("BC").getCertificate(certificateHolder);
    } catch (CertificateException ce) {
        throw ce;
    } catch (Exception e) {
        throw new CertificateException(e);
    }
}

---

From source file:com.mirth.connect.server.controllers.DefaultConfigurationController.java

License:Open Source License

/**
 * Checks for an existing certificate to use for secure communication between the server and
 * client. If no certficate exists, this will generate a new one.
 * /*  w ww  . j a  v a 2  s .  c o  m*/
 */
private void generateDefaultCertificate(Provider provider, KeyStore keyStore, char[] keyPassword)
        throws Exception {
    final String certificateAlias = "mirthconnect";

    if (!keyStore.containsAlias(certificateAlias)) {
        // Common CA and SSL cert attributes
        Date startDate = new Date(); // time from which certificate is valid
        Date expiryDate = DateUtils.addYears(startDate, 50); // time after which certificate is not valid
        KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA", provider);
        keyPairGenerator.initialize(2048);

        KeyPair caKeyPair = keyPairGenerator.generateKeyPair();
        logger.debug("generated new key pair for CA cert using provider: " + provider.getName());

        // Generate CA cert
        X500Name caSubjectName = new X500Name("CN=Mirth Connect Certificate Authority");
        SubjectPublicKeyInfo caSubjectKey = new SubjectPublicKeyInfo(
                ASN1Sequence.getInstance(caKeyPair.getPublic().getEncoded()));
        X509v3CertificateBuilder certBuilder = new X509v3CertificateBuilder(caSubjectName, BigInteger.ONE,
                startDate, expiryDate, caSubjectName, caSubjectKey);
        certBuilder.addExtension(org.bouncycastle.asn1.x509.Extension.basicConstraints, true,
                new BasicConstraints(0));
        ContentSigner sigGen = new JcaContentSignerBuilder("SHA256withRSA").setProvider(provider)
                .build(caKeyPair.getPrivate());
        Certificate caCert = new JcaX509CertificateConverter().setProvider(provider)
                .getCertificate(certBuilder.build(sigGen));

        // Generate SSL cert
        KeyPair sslKeyPair = keyPairGenerator.generateKeyPair();
        logger.debug("generated new key pair for SSL cert using provider: " + provider.getName());

        X500Name sslSubjectName = new X500Name("CN=mirth-connect");
        SubjectPublicKeyInfo sslSubjectKey = new SubjectPublicKeyInfo(
                ASN1Sequence.getInstance(sslKeyPair.getPublic().getEncoded()));
        X509v3CertificateBuilder sslCertBuilder = new X509v3CertificateBuilder(caSubjectName,
                new BigInteger(50, new SecureRandom()), startDate, expiryDate, sslSubjectName, sslSubjectKey);
        sslCertBuilder.addExtension(org.bouncycastle.asn1.x509.Extension.authorityKeyIdentifier, false,
                new AuthorityKeyIdentifier(caCert.getEncoded()));
        sslCertBuilder.addExtension(org.bouncycastle.asn1.x509.Extension.subjectKeyIdentifier, false,
                new SubjectKeyIdentifier(sslKeyPair.getPublic().getEncoded()));

        sigGen = new JcaContentSignerBuilder("SHA256withRSA").setProvider(provider)
                .build(caKeyPair.getPrivate());
        Certificate sslCert = new JcaX509CertificateConverter().setProvider(provider)
                .getCertificate(sslCertBuilder.build(sigGen));

        logger.debug("generated new certificate with serial number: "
                + ((X509Certificate) sslCert).getSerialNumber());

        // add the generated SSL cert to the keystore using the key password
        keyStore.setKeyEntry(certificateAlias, sslKeyPair.getPrivate(), keyPassword,
                new Certificate[] { sslCert });
    } else {
        logger.debug("found certificate in keystore");
    }
}

---

From source file:com.msopentech.thali.utilities.universal.ThaliCryptoUtilities.java

License:Open Source License

/**
 * Creates a PKCS12 keystore and puts into it the submitted public/private key pair under the submitted
 * Key Alias using the submitted passphrase to 'secure' the file.
 *
 * Right now we only generate large RSA keys because I'm paranoid that the curves used in
 * Elliptic Curve crypto may have been designed by folks for whom security was not the paramount
 * concern. Once this issue is put to rest I would expect to switch to Elliptic Curve because
 * it is considered (with appropriate curves) to be more secure and is certainly faster.
 * @param keyPair/*from  ww w.j a  va2  s . c o m*/
 * @param keyAlias
 * @param passphrase
 * @return
 */
public static KeyStore CreatePKCS12KeyStoreWithPublicPrivateKeyPair(KeyPair keyPair, String keyAlias,
        char[] passphrase) {
    try {
        byte[] publicKeyAsByteArray = keyPair.getPublic().getEncoded();

        // Generate a cert for the public key
        Date startDate = new Date(System.currentTimeMillis() - 24 * 60 * 60 * 1000);
        Date endDate = new Date(
                System.currentTimeMillis() + (ExpirationPeriodForCertsInDays * 24L * 60L * 60L * 1000L));

        // Thali security is based on keys NOT on cert values. That is we are not trying to bind a name (like a DNS
        // address) to a key. The key IS the identity. But the X509 standard requires names so we stick something
        // in.
        X500Name x500Name = new X500Name(X500Name);

        SubjectPublicKeyInfo subjectPublicKeyInfo = new SubjectPublicKeyInfo(
                ASN1Sequence.getInstance(publicKeyAsByteArray));

        // Note that by not specify .setProvider("BC") we are using the default provider, this is because bouncy castle as
        // previously mentioned is installed on Android but is a challenge for the applet so I'll just use the default for now.
        ContentSigner contentSigner = new JcaContentSignerBuilder(SignerAlgorithm).build(keyPair.getPrivate());

        X509v1CertificateBuilder x509v1CertificateBuilder = new X509v1CertificateBuilder(x500Name,
                BigInteger.ONE, startDate, endDate, x500Name, subjectPublicKeyInfo);
        X509CertificateHolder x509CertificateHolder = x509v1CertificateBuilder.build(contentSigner);
        JcaX509CertificateConverter jcaX509CertificateConverter = new JcaX509CertificateConverter();
        X509Certificate x509Certificate = jcaX509CertificateConverter.getCertificate(x509CertificateHolder);

        // Store the private key and the cert in the keystore
        KeyStore.PrivateKeyEntry privateKeyEntry = new KeyStore.PrivateKeyEntry(keyPair.getPrivate(),
                new Certificate[] { x509Certificate });

        KeyStore keyStore = KeyStore.getInstance(PrivateKeyHolderFormat);
        // Keystore has to be initialized before being used
        keyStore.load(null, null);

        keyStore.setEntry(keyAlias, privateKeyEntry, new KeyStore.PasswordProtection(passphrase));

        return keyStore;
    } catch (Exception e) {
        throw new RuntimeException(e.getMessage(), e);
    }
}

---

From source file:com.nkapps.billing.services.AuthServiceImpl.java

public Subject extractSubject(CertificateInfoLocal certificateInfo) {
    String tin, name, organization, address, email, role;
    Short ns10Code, ns11Code, kind;

    HashMap<String, String> subjectInfos = new HashMap<>();
    X500Name x500 = new X500Name(certificateInfo.getSubjectName());

    for (RDN rdn : x500.getRDNs()) {
        AttributeTypeAndValue tv = rdn.getFirst();
        String v = tv.getValue().toString().trim().replaceAll("\\s+", " ");
        if (!v.trim().isEmpty())
            subjectInfos.put(BCStyle.INSTANCE.oidToDisplayName(tv.getType()), v);
    }/*from  ww w. ja va2s  . c  o  m*/
    role = certificateInfo.getRoleName();

    Subject subject = new Subject();
    // set subject datas
    subject.setRole(role);

    return subject;
}

---

From source file:com.otterca.common.crypto.X509CertificateBuilderImpl.java

License:Apache License

/**
 * Set Name Constraints (RFC3280 4.2.1.11)
 *//*from www.j  a  v a  2  s  .  c o m*/
protected void setNameConstraints() {
    // FIXME: add constraints inherited from parent?
    if (!permittedNames.isEmpty() || !excludedNames.isEmpty()) {

        // convert permitted names.
        Vector<org.bouncycastle.asn1.x509.GeneralSubtree> permitted = new Vector<org.bouncycastle.asn1.x509.GeneralSubtree>();
        for (int i = 0; i < permittedNames.size(); i++) {
            GeneralSubtree g = permittedNames.get(i);
            GeneralName name = new GeneralName(new X500Name(g.getName().getName()));
            permitted.add(new org.bouncycastle.asn1.x509.GeneralSubtree(name, g.getMin(), g.getMax()));
        }

        // convert excluded names.
        Vector<org.bouncycastle.asn1.x509.GeneralSubtree> excluded = new Vector<org.bouncycastle.asn1.x509.GeneralSubtree>();
        for (int i = 0; i < excludedNames.size(); i++) {
            GeneralSubtree g = excludedNames.get(i);
            GeneralName name = new GeneralName(new X500Name(g.getName().getName()));
            excluded.add(new org.bouncycastle.asn1.x509.GeneralSubtree(name, g.getMin(), g.getMax()));
        }
        generator.addExtension(X509Extensions.NameConstraints, false, new NameConstraints(permitted, excluded));
    }
}

---

From source file:com.spotify.helios.client.tls.X509CertificateFactory.java

License:Apache License

private CertificateAndPrivateKey generate(final AgentProxy agentProxy, final Identity identity,
        final String username) {

    final UUID uuid = new UUID();
    final Calendar calendar = Calendar.getInstance();
    final X500Name issuerDN = new X500Name("C=US,O=Spotify,CN=helios-client");
    final X500Name subjectDN = new X500NameBuilder().addRDN(BCStyle.UID, username).build();

    calendar.add(Calendar.MILLISECOND, -validBeforeMilliseconds);
    final Date notBefore = calendar.getTime();

    calendar.add(Calendar.MILLISECOND, validBeforeMilliseconds + validAfterMilliseconds);
    final Date notAfter = calendar.getTime();

    // Reuse the UUID time as a SN
    final BigInteger serialNumber = BigInteger.valueOf(uuid.getTime()).abs();

    try {/*from  w w  w  . j  a v  a  2s  .  co m*/
        final KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA", "BC");
        keyPairGenerator.initialize(KEY_SIZE, new SecureRandom());

        final KeyPair keyPair = keyPairGenerator.generateKeyPair();
        final SubjectPublicKeyInfo subjectPublicKeyInfo = SubjectPublicKeyInfo
                .getInstance(ASN1Sequence.getInstance(keyPair.getPublic().getEncoded()));

        final X509v3CertificateBuilder builder = new X509v3CertificateBuilder(issuerDN, serialNumber, notBefore,
                notAfter, subjectDN, subjectPublicKeyInfo);

        final DigestCalculator digestCalculator = new BcDigestCalculatorProvider()
                .get(new AlgorithmIdentifier(OIWObjectIdentifiers.idSHA1));
        final X509ExtensionUtils utils = new X509ExtensionUtils(digestCalculator);

        final SubjectKeyIdentifier keyId = utils.createSubjectKeyIdentifier(subjectPublicKeyInfo);
        final String keyIdHex = KEY_ID_ENCODING.encode(keyId.getKeyIdentifier());
        log.info("generating an X509 certificate for {} with key ID={} and identity={}", username, keyIdHex,
                identity.getComment());

        builder.addExtension(Extension.subjectKeyIdentifier, false, keyId);
        builder.addExtension(Extension.authorityKeyIdentifier, false,
                utils.createAuthorityKeyIdentifier(subjectPublicKeyInfo));
        builder.addExtension(Extension.keyUsage, false,
                new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyCertSign));
        builder.addExtension(Extension.basicConstraints, true, new BasicConstraints(false));

        final X509CertificateHolder holder = builder.build(new SshAgentContentSigner(agentProxy, identity));

        final X509Certificate certificate = CERTIFICATE_CONVERTER.getCertificate(holder);
        log.debug("generated certificate:\n{}", asPEMString(certificate));

        return new CertificateAndPrivateKey(certificate, keyPair.getPrivate());
    } catch (Exception e) {
        throw Throwables.propagate(e);
    }
}

---

From source file:com.spotify.sshagenttls.X509CertKeyCreator.java

License:Apache License

@Override
public CertKey createCertKey(final String username, final X500Principal x500Principal) {
    final Calendar calendar = Calendar.getInstance();
    final BigInteger serialNumber = BigInteger.valueOf(calendar.getTimeInMillis()).abs();
    final X500Name issuerDn = new X500Name(x500Principal.getName(X500Principal.RFC1779));
    final X500Name subjectDn = new X500NameBuilder().addRDN(BCStyle.UID, username).build();

    calendar.add(Calendar.MILLISECOND, -validBeforeMillis);
    final Date notBefore = calendar.getTime();

    calendar.add(Calendar.MILLISECOND, validBeforeMillis + validAfterMillis);
    final Date notAfter = calendar.getTime();

    try {/*www .  jav  a 2s. co m*/
        final KeyPair keyPair = generateRandomKeyPair();
        final SubjectPublicKeyInfo subjectPublicKeyInfo = SubjectPublicKeyInfo
                .getInstance(ASN1Sequence.getInstance(keyPair.getPublic().getEncoded()));

        final X509v3CertificateBuilder builder = new X509v3CertificateBuilder(issuerDn, serialNumber, notBefore,
                notAfter, subjectDn, subjectPublicKeyInfo);

        final DigestCalculator digestCalculator = new BcDigestCalculatorProvider()
                .get(new AlgorithmIdentifier(OIWObjectIdentifiers.idSHA1));
        final X509ExtensionUtils utils = new X509ExtensionUtils(digestCalculator);

        final SubjectKeyIdentifier keyId = utils.createSubjectKeyIdentifier(subjectPublicKeyInfo);
        final String keyIdHex = KEY_ID_ENCODING.encode(keyId.getKeyIdentifier());
        LOG.info("generating an X.509 certificate for {} with key ID={}", username, keyIdHex);

        builder.addExtension(Extension.subjectKeyIdentifier, false, keyId);
        builder.addExtension(Extension.authorityKeyIdentifier, false,
                utils.createAuthorityKeyIdentifier(subjectPublicKeyInfo));
        builder.addExtension(Extension.keyUsage, false,
                new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyCertSign));
        builder.addExtension(Extension.basicConstraints, true, new BasicConstraints(false));

        final X509CertificateHolder holder = builder.build(contentSigner);

        final X509Certificate cert = CERT_CONVERTER.getCertificate(holder);
        LOG.debug("generated certificate:\n{}", Utils.asPemString(cert));

        return CertKey.create(cert, keyPair.getPrivate());
    } catch (Exception e) {
        throw new RuntimeException(e);
    }
}

---

From source file:com.spotify.sshtlsclient.X509CertificateFactory.java

License:Apache License

static Certificate get(final SshAgentContentSigner signer, final Identity identity, final String username) {
    final UUID uuid = new UUID();
    final Calendar calendar = Calendar.getInstance();
    final X500Name issuerDN = new X500Name("C=US,O=Spotify,CN=helios-client");
    final X500Name subjectDN = new X500NameBuilder().addRDN(BCStyle.UID, username).build();
    final SubjectPublicKeyInfo subjectPublicKeyInfo = SubjectPublicKeyInfo
            .getInstance(ASN1Sequence.getInstance(identity.getPublicKey().getEncoded()));

    calendar.add(Calendar.HOUR, -HOURS_BEFORE);
    final Date notBefore = calendar.getTime();

    calendar.add(Calendar.HOUR, HOURS_BEFORE + HOURS_AFTER);
    final Date notAfter = calendar.getTime();

    // Reuse the UUID time as a SN
    final BigInteger serialNumber = BigInteger.valueOf(uuid.getTime()).abs();

    final X509v3CertificateBuilder builder = new X509v3CertificateBuilder(issuerDN, serialNumber, notBefore,
            notAfter, subjectDN, subjectPublicKeyInfo);

    try {/*  www  .ja v a 2s.co m*/
        final DigestCalculator digestCalculator = new BcDigestCalculatorProvider()
                .get(new AlgorithmIdentifier(OIWObjectIdentifiers.idSHA1));
        final X509ExtensionUtils utils = new X509ExtensionUtils(digestCalculator);

        builder.addExtension(Extension.subjectKeyIdentifier, false,
                utils.createSubjectKeyIdentifier(subjectPublicKeyInfo));
        builder.addExtension(Extension.authorityKeyIdentifier, false,
                utils.createAuthorityKeyIdentifier(subjectPublicKeyInfo));
        builder.addExtension(Extension.keyUsage, false,
                new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyCertSign));
        builder.addExtension(Extension.basicConstraints, true, new BasicConstraints(false));

        final X509CertificateHolder holder = builder.build(signer);

        return new Certificate(new org.bouncycastle.asn1.x509.Certificate[] { holder.toASN1Structure(), });
    } catch (Exception e) {
        throw Throwables.propagate(e);
    }
}

---

From source file:com.streamsets.pipeline.lib.remote.FTPAndSSHDUnitTest.java

License:Apache License

private X509Certificate generateCertificate(KeyPair keyPair) throws Exception {
    Date from = new Date();
    Date to = new GregorianCalendar(2037, Calendar.DECEMBER, 31).getTime();
    X500Name subject = new X500Name("CN=localhost");
    SubjectPublicKeyInfo subPubKeyInfo = SubjectPublicKeyInfo.getInstance(keyPair.getPublic().getEncoded());
    X509v3CertificateBuilder certBuilder = new X509v3CertificateBuilder(subject,
            new BigInteger(64, new SecureRandom()), from, to, subject, subPubKeyInfo);
    AlgorithmIdentifier sigAlgId = new DefaultSignatureAlgorithmIdentifierFinder().find("SHA512WITHRSA");
    AlgorithmIdentifier digAlgId = new DefaultDigestAlgorithmIdentifierFinder().find(sigAlgId);
    ContentSigner contentSigner = new BcRSAContentSignerBuilder(sigAlgId, digAlgId)
            .build(PrivateKeyFactory.createKey(keyPair.getPrivate().getEncoded()));
    X509CertificateHolder certHolder = certBuilder.build(contentSigner);
    return new JcaX509CertificateConverter().setProvider("BC").getCertificate(certHolder);
}

---

From source file:com.trsst.server.Server.java

License:Apache License

/**
 * Generates a new keystore containing a self-signed certificate. Would
 * prefer anon SSL ciphers, but this works albeit with scary warnings.
 * //from  ww  w.j a  v a2 s  .  com
 * @return a keystore to secure SSL connections.
 */
private KeyStore getKeyStore() {
    try {
        KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
        keyPairGenerator.initialize(1024);
        KeyPair kp = keyPairGenerator.generateKeyPair();
        X509v3CertificateBuilder v3CertGen = new X509v3CertificateBuilder(
                new X500Name("CN=0.0.0.0, OU=None, O=None, L=None, C=None"),
                BigInteger.valueOf(new SecureRandom().nextInt()),
                new Date(System.currentTimeMillis() - 1000L * 60 * 60 * 24 * 30),
                new Date(System.currentTimeMillis() + (1000L * 60 * 60 * 24 * 365 * 10)),
                new X500Name("CN=0.0.0.0, OU=None, O=None, L=None, C=None"),
                SubjectPublicKeyInfo.getInstance(kp.getPublic().getEncoded()));
        ContentSigner signer = new JcaContentSignerBuilder("SHA256WithRSAEncryption").build(kp.getPrivate());
        Certificate certificate = new JcaX509CertificateConverter().getCertificate(v3CertGen.build(signer));

        final KeyStore keystore = KeyStore.getInstance(KeyStore.getDefaultType());
        keystore.load(null); // bogus: required to "initialize" keystore
        keystore.setEntry("jetty",
                new KeyStore.PrivateKeyEntry(kp.getPrivate(), new Certificate[] { certificate }),
                new KeyStore.PasswordProtection("ignored".toCharArray()));

        return keystore;
    } catch (NoSuchAlgorithmException e) {
        log.error("Could not generate self-signed certificate: missing provider", e);
    } catch (OperatorCreationException e) {
        log.error("Could not generate self-signed certificate", e);
    } catch (CertificateException e) {
        log.error("Could not convert certificate to JCE", e);
    } catch (KeyStoreException e) {
        log.error("Could not generate keystore", e);
    } catch (IOException e) {
        log.error("Could not initialize keystore", e);
    }
    return null;
}

---

• «
• 1
• 2
• 3
• 4
• 5
• 6
• 7
• 8
• 9
• 10
• 11
• 12
• 13
• 14
• 15
• 16
• 17
• 18
• 19
• 20
• 21
• 22
• 23
• 24
• 25
• 26
• 27
• 28
• 29
• 30
• 31
• 32
• 33
• 34
• 35
• 36
• 37
• 38
• 39
• 40
• 41
• 42
• »