Example usage for org.bouncycastle.asn1.x509 CRLReason keyCompromise

Introduction

In this page you can find the example usage for org.bouncycastle.asn1.x509 CRLReason keyCompromise.

Prototype

int keyCompromise

To view the source code for org.bouncycastle.asn1.x509 CRLReason keyCompromise.

Click Source Link

Usage

From source file:dk.itst.oiosaml.sp.IntegrationTests.java

License:Mozilla Public License

private File generateCRL(X509Certificate cert) throws CRLException, NoSuchAlgorithmException,
        SignatureException, InvalidKeyException, IOException, OperatorCreationException {
    X500Name issuer = new X500Name("CN=ca");
    Date thisUpdate = new Date();
    X509v2CRLBuilder gen = new X509v2CRLBuilder(issuer, thisUpdate);
    gen.setNextUpdate(new Date(System.currentTimeMillis() + 60000));

    if (cert != null) {
        gen.addCRLEntry(cert.getSerialNumber(), new Date(System.currentTimeMillis() - 1000),
                CRLReason.keyCompromise);
    }/*  w  w  w  .  j ava  2 s . com*/

    ContentSigner sigGen = new JcaContentSignerBuilder("SHA1withRSA").setProvider("BC")
            .build(credential.getPrivateKey());
    X509CRLHolder crl = gen.build(sigGen);

    final File crlFile = File.createTempFile("test", "test");
    crlFile.deleteOnExit();
    FileOutputStream fos = new FileOutputStream(crlFile);
    IOUtils.write(crl.getEncoded(), fos);
    fos.close();
    return crlFile;
}

---

From source file:mitm.common.security.crl.GenerateTestCRLs.java

License:Open Source License

@Test
public void testGenerateCACRLThisUpdateInFarFuture() throws Exception {
    X509CRLBuilder crlGenerator = createX509CRLBuilder();

    Date thisDate = TestUtils.parseDate("30-Nov-2030 11:38:35 GMT");

    Date nextDate = TestUtils.parseDate("30-Nov-2040 11:38:35 GMT");

    crlGenerator.setThisUpdate(thisDate);
    crlGenerator.setNextUpdate(nextDate);
    crlGenerator.setSignatureAlgorithm("SHA256WithRSAEncryption");

    X509Certificate certificate = TestUtils
            .loadCertificate("test/resources/testdata/certificates/" + "valid_certificate_mitm_test_ca.cer");
    assertNotNull(certificate);//from  www .jav a2s  . c om

    Date revocationDate = TestUtils.parseDate("30-Nov-2006 11:38:35 GMT");

    crlGenerator.addCRLEntry(certificate.getSerialNumber(), revocationDate, CRLReason.keyCompromise);

    X509CRL crl = crlGenerator.generateCRL(new KeyAndCertificateImpl(caPrivateKey, caCertificate));

    assertEquals("EMAILADDRESS=ca@example.com, CN=MITM Test CA, L=Amsterdam, ST=NH, C=NL",
            crl.getIssuerX500Principal().toString());
    assertEquals(thisDate, crl.getThisUpdate());
    assertEquals(nextDate, crl.getNextUpdate());
    assertEquals(1, crl.getRevokedCertificates().size());
    assertTrue(crl.isRevoked(certificate));

    File crlFile = new File("test/tmp/testgeneratecacrlthisupdateinfarfuture.crl");

    FileOutputStream fos = new FileOutputStream(crlFile);

    IOUtils.write(crl.getEncoded(), fos);

    fos.close();
}

---

From source file:net.maritimecloud.identityregistry.utils.CertificateUtil.java

License:Apache License

public int getCRLReasonFromString(String certReason) {
    int reason = CRLReason.unspecified;
    if ("unspecified".equals(certReason)) {
        reason = CRLReason.unspecified;
    } else if ("keycompromise".equals(certReason)) {
        reason = CRLReason.keyCompromise;
    } else if ("cacompromise".equals(certReason)) {
        reason = CRLReason.cACompromise;
    } else if ("affiliationchanged".equals(certReason)) {
        reason = CRLReason.affiliationChanged;
    } else if ("superseded".equals(certReason)) {
        reason = CRLReason.superseded;
    } else if ("cessationofoperation".equals(certReason)) {
        reason = CRLReason.cessationOfOperation;
    } else if ("certificateHold".equals(certReason)) {
        reason = CRLReason.certificateHold;
    } else if ("removefromcrl".equals(certReason)) {
        reason = CRLReason.removeFromCRL;
    } else if ("privilegewithdrawn".equals(certReason)) {
        reason = CRLReason.privilegeWithdrawn;
    } else if ("aacompromise".equals(certReason)) {
        reason = CRLReason.aACompromise;
    }/*from ww w .  jav a 2 s  .co m*/
    return reason;
}

---

From source file:net.maritimecloud.pki.Revocation.java

License:Apache License

/**
 * Returns the int value associated with a revocation status
 *
 * @param certReason The string representation of the status. Should be lowercase with no spaces or underscore
 * @return The int value associated with the revocation status
 *///from w w  w .j  a v  a  2  s .  co  m
public static int getCRLReasonFromString(String certReason) {
    int reason = CRLReason.unspecified;
    if ("unspecified".equals(certReason)) {
        reason = CRLReason.unspecified;
    } else if ("keycompromise".equals(certReason)) {
        reason = CRLReason.keyCompromise;
    } else if ("cacompromise".equals(certReason)) {
        reason = CRLReason.cACompromise;
    } else if ("affiliationchanged".equals(certReason)) {
        reason = CRLReason.affiliationChanged;
    } else if ("superseded".equals(certReason)) {
        reason = CRLReason.superseded;
    } else if ("cessationofoperation".equals(certReason)) {
        reason = CRLReason.cessationOfOperation;
    } else if ("certificatehold".equals(certReason)) {
        reason = CRLReason.certificateHold;
    } else if ("removefromcrl".equals(certReason)) {
        reason = CRLReason.removeFromCRL;
    } else if ("privilegewithdrawn".equals(certReason)) {
        reason = CRLReason.privilegeWithdrawn;
    } else if ("aacompromise".equals(certReason)) {
        reason = CRLReason.aACompromise;
    }
    return reason;
}

---

From source file:net.sf.keystore_explorer.crypto.x509.X509Ext.java

License:Open Source License

private String getReasonCodeStringValue(byte[] value) throws IOException {
    // @formatter:off

    /*//from ww w .  j a v  a2 s .  c om
     * ReasonCode ::= { CRLReason }
     *
     * CRLReason ::= ASN1Enumerated { unspecified (0), keyCompromise (1),
     * cACompromise (2), affiliationChanged (3), superseded (4),
     * cessationOfOperation (5), certificateHold (6), removeFromCRL (8),
     * privilegeWithdrawn (9), aACompromise (10) }
     */

    // @formatter:on

    StringBuilder sb = new StringBuilder();

    CRLReason crlReason = CRLReason.getInstance(value);

    long crlReasonLong = crlReason.getValue().longValue();

    if (crlReasonLong == CRLReason.unspecified) {
        sb.append(res.getString("UnspecifiedCrlReason"));
    } else if (crlReasonLong == CRLReason.keyCompromise) {
        sb.append(res.getString("KeyCompromiseCrlReason"));
    } else if (crlReasonLong == CRLReason.cACompromise) {
        sb.append(res.getString("CaCompromiseCrlReason"));
    } else if (crlReasonLong == CRLReason.affiliationChanged) {
        sb.append(res.getString("AffiliationChangedCrlReason"));
    } else if (crlReasonLong == CRLReason.superseded) {
        sb.append(res.getString("SupersededCrlReason"));
    } else if (crlReasonLong == CRLReason.cessationOfOperation) {
        sb.append(res.getString("CessationOfOperationCrlReason"));
    } else if (crlReasonLong == CRLReason.certificateHold) {
        sb.append(res.getString("CertificateHoldCrlReason"));
    } else if (crlReasonLong == CRLReason.removeFromCRL) {
        sb.append(res.getString("RemoveFromCrlCrlReason"));
    } else if (crlReasonLong == CRLReason.privilegeWithdrawn) {
        sb.append(res.getString("PrivilegeWithdrawnCrlReason"));
    } else
    // CRLReason.aACompromise
    {
        sb.append(res.getString("AaCompromiseCrlReason"));
    }

    sb.append(NEWLINE);

    return sb.toString();
}

---

From source file:org.conscrypt.java.security.TestKeyStore.java

License:Apache License

public static byte[] getOCSPResponseForRevoked(PrivateKeyEntry server, PrivateKeyEntry issuer)
        throws CertificateException {
    try {// w  w w. j  av a  2 s  . c  o  m
        return generateOCSPResponse(server, issuer, new RevokedStatus(new Date(), CRLReason.keyCompromise))
                .getEncoded();
    } catch (IOException e) {
        throw new CertificateException(e);
    }
}

---

From source file:org.ejbca.core.protocol.cmp.CmpTestCase.java

License:Open Source License

protected static PKIMessage genRevReq(String issuerDN, X500Name userDN, BigInteger serNo, Certificate cacert,
        byte[] nonce, byte[] transid, boolean crlEntryExtension, AlgorithmIdentifier pAlg,
        DEROctetString senderKID) throws IOException {
    CertTemplateBuilder myCertTemplate = new CertTemplateBuilder();
    myCertTemplate.setIssuer(new X500Name(issuerDN));
    myCertTemplate.setSubject(userDN);//  w ww.  j a v  a 2 s .  co m
    myCertTemplate.setSerialNumber(new ASN1Integer(serNo));

    ExtensionsGenerator extgen = new ExtensionsGenerator();
    CRLReason crlReason;
    if (crlEntryExtension) {
        crlReason = CRLReason.lookup(CRLReason.cessationOfOperation);
    } else {
        crlReason = CRLReason.lookup(CRLReason.keyCompromise);
    }
    extgen.addExtension(Extension.reasonCode, false, crlReason);

    Extensions exts = extgen.generate();

    ASN1EncodableVector v = new ASN1EncodableVector();
    v.add(myCertTemplate.build());
    v.add(exts);
    ASN1Sequence seq = new DERSequence(v);

    RevDetails myRevDetails = RevDetails.getInstance(seq); //new RevDetails(myCertTemplate.build(), exts);

    RevReqContent myRevReqContent = new RevReqContent(myRevDetails);

    PKIHeaderBuilder myPKIHeader = new PKIHeaderBuilder(2, new GeneralName(userDN),
            new GeneralName(new X500Name(((X509Certificate) cacert).getSubjectDN().getName())));
    myPKIHeader.setMessageTime(new ASN1GeneralizedTime(new Date()));
    // senderNonce
    myPKIHeader.setSenderNonce(new DEROctetString(nonce));
    // TransactionId
    myPKIHeader.setTransactionID(new DEROctetString(transid));
    myPKIHeader.setProtectionAlg(pAlg);
    myPKIHeader.setSenderKID(senderKID);

    PKIBody myPKIBody = new PKIBody(PKIBody.TYPE_REVOCATION_REQ, myRevReqContent); // revocation request
    PKIMessage myPKIMessage = new PKIMessage(myPKIHeader.build(), myPKIBody);
    return myPKIMessage;
}

---

From source file:org.ejbca.ui.cmpclient.commands.RevocationRequestCommand.java

License:Open Source License

private CRLReason getCRLReason(String revreason) {
    if (revreason == null)
        return CRLReason.lookup(CRLReason.unspecified);
    if (StringUtils.equalsIgnoreCase(revreason, REVOCATION_REASON_UNSPECIFIED))
        return CRLReason.lookup(CRLReason.unspecified);
    if (StringUtils.equalsIgnoreCase(revreason, REVOCATION_REASON_KEYCOMPROMISE))
        return CRLReason.lookup(CRLReason.keyCompromise);
    if (StringUtils.equalsIgnoreCase(revreason, REVOCATION_REASON_CACOMPROMISE))
        return CRLReason.lookup(CRLReason.cACompromise);
    if (StringUtils.equalsIgnoreCase(revreason, REVOCATION_REASON_AFFILIATIONCHANGED))
        return CRLReason.lookup(CRLReason.affiliationChanged);
    if (StringUtils.equalsIgnoreCase(revreason, REVOCATION_REASON_SUPERSEDED))
        return CRLReason.lookup(CRLReason.superseded);
    if (StringUtils.equalsIgnoreCase(revreason, REVOCATION_REASON_CESSATIONOFOPERATION))
        return CRLReason.lookup(CRLReason.cessationOfOperation);
    if (StringUtils.equalsIgnoreCase(revreason, REVOCATION_REASON_CERTIFICATEHOLD))
        return CRLReason.lookup(CRLReason.certificateHold);
    return CRLReason.lookup(CRLReason.unspecified);
}

---

From source file:org.qipki.crypto.x509.RevocationReason.java

License:Open Source License

public static RevocationReason valueOf(int reason) {
    switch (reason) {
    case CRLReason.unspecified:
        return unspecified;
    case CRLReason.keyCompromise:
        return keyCompromise;
    case CRLReason.cACompromise:
        return cACompromise;
    case CRLReason.affiliationChanged:
        return affiliationChanged;
    case CRLReason.superseded:
        return superseded;
    case CRLReason.cessationOfOperation:
        return cessationOfOperation;
    case CRLReason.certificateHold:
        return certificateHold;
    case CRLReason.removeFromCRL:
        return removeFromCRL;
    case CRLReason.privilegeWithdrawn:
        return privilegeWithdrawn;
    case CRLReason.aACompromise:
        return aACompromise;
    default:/*  w w w  .j a va2 s .  com*/
        throw new IllegalArgumentException("Unknown revocation reason: " + reason);
    }
}

---

From source file:org.signserver.module.xades.validator.XAdESValidator2UnitTest.java

License:Open Source License

/**
 * Setting up key-pairs, mocked crypto tokens, certificates and CRLs used
 * by the tests.//from  w  w  w  . ja va  2 s.  co m
 */
@BeforeClass
public static void setUpClass() throws Exception {
    Security.addProvider(new BouncyCastleProvider());
    JcaX509CertificateConverter conv = new JcaX509CertificateConverter();

    // Root CA, sub CA
    rootcaCRLFile = File.createTempFile("xadestest-", "-rootca.crl");
    LOG.debug("rootcaCRLFile: " + rootcaCRLFile);
    subca1CRLFile = File.createTempFile("xadestest-", "-subca.crl");
    LOG.debug("subcaCRLFile: " + subca1CRLFile);
    rootcaKeyPair = CryptoUtils.generateRSA(1024);
    anotherKeyPair = CryptoUtils.generateRSA(1024);
    rootcaCert = new CertBuilder().setSelfSignKeyPair(rootcaKeyPair).setSubject("CN=Root, O=XAdES Test, C=SE")
            .addExtension(new CertExt(Extension.keyUsage, false,
                    new X509KeyUsage(
                            X509KeyUsage.keyCertSign | X509KeyUsage.cRLSign | X509KeyUsage.digitalSignature)))
            .addExtension(new CertExt(Extension.basicConstraints, false, new BasicConstraints(true))).build();
    final KeyPair subca1KeyPair = CryptoUtils.generateRSA(1024);
    subca1Cert = new CertBuilder().setIssuerPrivateKey(rootcaKeyPair.getPrivate())
            .setIssuer(rootcaCert.getSubject()).setSubjectPublicKey(subca1KeyPair.getPublic())
            .addCDPURI(rootcaCRLFile.toURI().toURL().toExternalForm())
            .setSubject("CN=Sub 1, O=XAdES Test, C=SE")
            .addExtension(new CertExt(Extension.keyUsage, false,
                    new X509KeyUsage(X509KeyUsage.keyCertSign | X509KeyUsage.cRLSign)))
            .addExtension(new CertExt(Extension.basicConstraints, false, new BasicConstraints(true))).build();
    subca2KeyPair = CryptoUtils.generateRSA(1024);
    subca2Cert = new CertBuilder().setIssuerPrivateKey(rootcaKeyPair.getPrivate())
            .setIssuer(rootcaCert.getSubject()).setSubjectPublicKey(subca2KeyPair.getPublic())
            .setSubject("CN=Sub 2, O=XAdES Test, C=SE")
            .addExtension(new CertExt(Extension.keyUsage, false,
                    new X509KeyUsage(
                            X509KeyUsage.keyCertSign | X509KeyUsage.cRLSign | X509KeyUsage.digitalSignature)))
            .addExtension(new CertExt(Extension.basicConstraints, false, new BasicConstraints(true)))
            .addExtension(new CertExt(Extension.authorityInfoAccess, false,
                    new AuthorityInformationAccess(AccessDescription.id_ad_ocsp,
                            new GeneralName(GeneralName.uniformResourceIdentifier, "http://ocsp.example.com"))))
            .build();

    // Signer 1 is issued directly by the root CA
    final KeyPair signer1KeyPair = CryptoUtils.generateRSA(1024);
    final X509CertificateHolder signer1Cert = new CertBuilder().setIssuerPrivateKey(rootcaKeyPair.getPrivate())
            .setIssuer(rootcaCert.getSubject()).setSubjectPublicKey(signer1KeyPair.getPublic())
            .setSubject("CN=Signer 1, O=XAdES Test, C=SE")
            .addCDPURI(rootcaCRLFile.toURI().toURL().toExternalForm())
            .addExtension(new CertExt(Extension.basicConstraints, false, new BasicConstraints(false))).build();
    final List<Certificate> chain1 = Arrays.<Certificate>asList(conv.getCertificate(signer1Cert),
            conv.getCertificate(rootcaCert));
    token1 = new MockedCryptoToken(signer1KeyPair.getPrivate(), signer1KeyPair.getPublic(),
            conv.getCertificate(signer1Cert), chain1, "BC");
    LOG.debug("Chain 1: \n" + new String(CertTools.getPEMFromCerts(chain1), "ASCII") + "\n");

    // Sign a document by signer 1
    XAdESSigner instance = new MockedXAdESSigner(token1);
    WorkerConfig config = new WorkerConfig();
    instance.init(4712, config, null, null);
    RequestContext requestContext = new RequestContext();
    requestContext.put(RequestContext.TRANSACTION_ID, "0000-201-1");
    GenericSignRequest request = new GenericSignRequest(201, "<test201/>".getBytes("UTF-8"));
    GenericSignResponse response = (GenericSignResponse) instance.processData(request, requestContext);
    byte[] data = response.getProcessedData();
    signedXml1 = new String(data);
    LOG.debug("Signed document by signer 1:\n\n" + signedXml1 + "\n");

    // Signer 2 is issued by the sub CA
    final KeyPair signer2KeyPair = CryptoUtils.generateRSA(1024);
    final X509CertificateHolder signer2Cert = new CertBuilder().setIssuerPrivateKey(subca1KeyPair.getPrivate())
            .setIssuer(subca1Cert.getSubject()).setSubjectPublicKey(signer2KeyPair.getPublic())
            .setSubject("CN=Signer 2, O=XAdES Test, C=SE")
            .addCDPURI(subca1CRLFile.toURI().toURL().toExternalForm())
            .addExtension(new CertExt(Extension.basicConstraints, false, new BasicConstraints(false))).build();
    final List<Certificate> chain2 = Arrays.<Certificate>asList(conv.getCertificate(signer2Cert),
            conv.getCertificate(subca1Cert), conv.getCertificate(rootcaCert));
    token2 = new MockedCryptoToken(signer2KeyPair.getPrivate(), signer2KeyPair.getPublic(),
            conv.getCertificate(signer2Cert), chain2, "BC");
    LOG.debug("Chain 2: \n" + new String(CertTools.getPEMFromCerts(chain2)) + "\n");

    // Sign a document by signer 2
    instance = new MockedXAdESSigner(token2);
    config = new WorkerConfig();
    instance.init(4713, config, null, null);
    requestContext = new RequestContext();
    requestContext.put(RequestContext.TRANSACTION_ID, "0000-202-1");
    request = new GenericSignRequest(202, "<test202/>".getBytes("UTF-8"));
    response = (GenericSignResponse) instance.processData(request, requestContext);
    data = response.getProcessedData();
    signedXml2 = new String(data);
    LOG.debug("Signed document by signer 2:\n\n" + signedXml2 + "\n");

    // CRL with all active (empty CRL)
    rootcaCRLEmpty = new CRLBuilder().setIssuerPrivateKey(rootcaKeyPair.getPrivate())
            .setIssuer(rootcaCert.getSubject()).build();
    subca1CRLEmpty = new CRLBuilder().setIssuerPrivateKey(subca1KeyPair.getPrivate())
            .setIssuer(subca1Cert.getSubject()).build();
    rootcaCRLSubCAAndSigner1Revoked = new CRLBuilder().setIssuerPrivateKey(rootcaKeyPair.getPrivate())
            .setIssuer(rootcaCert.getSubject())
            .addCRLEntry(subca1Cert.getSerialNumber(), new Date(), CRLReason.keyCompromise)
            .addCRLEntry(signer1Cert.getSerialNumber(), new Date(), CRLReason.keyCompromise).build();
    subca1CRLSigner2Revoked = new CRLBuilder().setIssuerPrivateKey(subca1KeyPair.getPrivate())
            .setIssuer(subca1Cert.getSubject())
            .addCRLEntry(signer2Cert.getSerialNumber(), new Date(), CRLReason.keyCompromise).build();
    otherCRL = new CRLBuilder().setIssuer(subca1Cert.getSubject()) // Setting Sub CA DN all though an other key will be used
            .build();

    // signer 3, issued by the root CA with an OCSP authority information access in the signer cert
    final KeyPair signer3KeyPair = CryptoUtils.generateRSA(1024);
    signer3Cert = new CertBuilder().setIssuerPrivateKey(rootcaKeyPair.getPrivate())
            .setIssuer(rootcaCert.getSubject()).setSubjectPublicKey(signer3KeyPair.getPublic())
            .setSubject("CN=Signer 3, O=XAdES Test, C=SE")
            .addExtension(new CertExt(Extension.authorityInfoAccess, false,
                    new AuthorityInformationAccess(AccessDescription.id_ad_ocsp,
                            new GeneralName(GeneralName.uniformResourceIdentifier, "http://ocsp.example.com"))))
            .addExtension(new CertExt(Extension.basicConstraints, false, new BasicConstraints(false))).build();
    final List<Certificate> chain3 = Arrays.<Certificate>asList(conv.getCertificate(signer3Cert),
            conv.getCertificate(rootcaCert));
    token3 = new MockedCryptoToken(signer3KeyPair.getPrivate(), signer3KeyPair.getPublic(),
            conv.getCertificate(signer3Cert), chain3, "BC");
    LOG.debug("Chain 3: \n" + new String(CertTools.getPEMFromCerts(chain3)) + "\n");

    // signer 4, issued by the sub CA2 with an OCSP authority information access in the signer cert
    final KeyPair signer4KeyPair = CryptoUtils.generateRSA(1024);
    signer4Cert = new CertBuilder().setIssuerPrivateKey(subca2KeyPair.getPrivate())
            .setIssuer(subca2Cert.getSubject()).setSubjectPublicKey(signer4KeyPair.getPublic())
            .setSubject("CN=Signer 4, O=XAdES Test, C=SE")
            .addExtension(new CertExt(Extension.authorityInfoAccess, false,
                    new AuthorityInformationAccess(AccessDescription.id_ad_ocsp,
                            new GeneralName(GeneralName.uniformResourceIdentifier, "http://ocsp.example.com"))))
            .addExtension(new CertExt(Extension.basicConstraints, false, new BasicConstraints(false))).build();
    final List<Certificate> chain4 = Arrays.<Certificate>asList(conv.getCertificate(signer4Cert),
            conv.getCertificate(subca2Cert), conv.getCertificate(rootcaCert));
    token4 = new MockedCryptoToken(signer4KeyPair.getPrivate(), signer4KeyPair.getPublic(),
            conv.getCertificate(signer4Cert), chain4, "BC");
    LOG.debug("Chain 4: \n" + new String(CertTools.getPEMFromCerts(chain4)) + "\n");

    // ocspSigner 1, OCSP responder issued by the root CA with an ocsp-nocheck in the signer cert
    ocspSigner1KeyPair = CryptoUtils.generateRSA(1024);
    ocspSigner1Cert = new CertBuilder().setIssuerPrivateKey(rootcaKeyPair.getPrivate())
            .setIssuer(rootcaCert.getSubject()).setSubjectPublicKey(ocspSigner1KeyPair.getPublic())
            .setSubject("CN=OCSP Responder 1, O=XAdES Test, C=SE")
            .addExtension(new CertExt(Extension.basicConstraints, false, new BasicConstraints(false)))
            .addExtension(new CertExt(Extension.extendedKeyUsage, false,
                    new ExtendedKeyUsage(KeyPurposeId.id_kp_OCSPSigning)))
            .addExtension(new CertExt(OCSPObjectIdentifiers.id_pkix_ocsp_nocheck, false, new DERNull()))
            .build();

    // ocspSigner 2, OCSP responder issued by the sub CA2 with an ocsp-nocheck in the signer cert
    ocspSigner2KeyPair = CryptoUtils.generateRSA(1024);
    ocspSigner2Cert = new CertBuilder().setIssuerPrivateKey(subca2KeyPair.getPrivate())
            .setIssuer(subca2Cert.getSubject()).setSubjectPublicKey(ocspSigner2KeyPair.getPublic())
            .setSubject("CN=OCSP Responder 2, O=XAdES Test, C=SE")
            .addExtension(new CertExt(Extension.basicConstraints, false, new BasicConstraints(false)))
            .addExtension(new CertExt(Extension.extendedKeyUsage, false,
                    new ExtendedKeyUsage(KeyPurposeId.id_kp_OCSPSigning)))
            .addExtension(new CertExt(OCSPObjectIdentifiers.id_pkix_ocsp_nocheck, false, new DERNull()))
            .build();

    // Sign a document by signer 3
    instance = new MockedXAdESSigner(token3);
    config = new WorkerConfig();
    instance.init(4714, config, null, null);
    requestContext = new RequestContext();
    requestContext.put(RequestContext.TRANSACTION_ID, "0000-203-1");
    request = new GenericSignRequest(202, "<test203/>".getBytes("UTF-8"));
    response = (GenericSignResponse) instance.processData(request, requestContext);
    data = response.getProcessedData();
    signedXml3 = new String(data);
    LOG.debug("Signed document by signer 3:\n\n" + signedXml3 + "\n");

    // Sign a document by signer 4
    instance = new MockedXAdESSigner(token4);
    config = new WorkerConfig();
    instance.init(4715, config, null, null);
    requestContext = new RequestContext();
    requestContext.put(RequestContext.TRANSACTION_ID, "0000-204-1");
    request = new GenericSignRequest(203, "<test204/>".getBytes("UTF-8"));
    response = (GenericSignResponse) instance.processData(request, requestContext);
    data = response.getProcessedData();
    signedXml4 = new String(data);
    LOG.debug("Signed document by signer 4:\n\n" + signedXml4 + "\n");

    // Signer 5 is issued directly by the root CA
    final KeyPair signer5KeyPair = CryptoUtils.generateRSA(1024);
    signer5Cert = new CertBuilder().setIssuerPrivateKey(rootcaKeyPair.getPrivate())
            .setIssuer(rootcaCert.getSubject()).setSubjectPublicKey(signer5KeyPair.getPublic())
            .setSubject("CN=Signer 5, O=XAdES Test, C=SE")
            .addCDPURI(rootcaCRLFile.toURI().toURL().toExternalForm())
            .addExtension(new CertExt(Extension.authorityInfoAccess, false,
                    new AuthorityInformationAccess(AccessDescription.id_ad_ocsp,
                            new GeneralName(GeneralName.uniformResourceIdentifier, "http://ocsp.example.com"))))
            .addExtension(new CertExt(Extension.basicConstraints, false, new BasicConstraints(false))).build();
    final List<Certificate> chain5 = Arrays.<Certificate>asList(conv.getCertificate(signer5Cert),
            conv.getCertificate(rootcaCert));
    token5 = new MockedCryptoToken(signer5KeyPair.getPrivate(), signer5KeyPair.getPublic(),
            conv.getCertificate(signer1Cert), chain5, "BC");
    LOG.debug("Chain 5: \n" + new String(CertTools.getPEMFromCerts(chain5)) + "\n");

    // Sign a document by signer 5
    instance = new MockedXAdESSigner(token5);
    config = new WorkerConfig();
    instance.init(4712, config, null, null);
    requestContext = new RequestContext();
    requestContext.put(RequestContext.TRANSACTION_ID, "0000-205-1");
    request = new GenericSignRequest(205, "<test205/>".getBytes("UTF-8"));
    response = (GenericSignResponse) instance.processData(request, requestContext);
    data = response.getProcessedData();
    signedXml5 = new String(data);
    LOG.debug("Signed document by signer 5:\n\n" + signedXml5 + "\n");

    // CRL with signer 5 revoked
    rootcaCRLSigner5Revoked = new CRLBuilder().setIssuerPrivateKey(rootcaKeyPair.getPrivate())
            .setIssuer(rootcaCert.getSubject())
            .addCRLEntry(signer5Cert.getSerialNumber(), new Date(), CRLReason.keyCompromise).build();
}

---

• «
• 1
• 2
• »