Example usage for org.bouncycastle.asn1.x509 CRLReason privilegeWithdrawn

List of usage examples for org.bouncycastle.asn1.x509 CRLReason privilegeWithdrawn

  1. HOME
  2. Java
  3. org.bouncycastle
  4. org.bouncycastle.asn1.x509.*
  5. CRLReason
  6. privilegeWithdrawn

Introduction

In this page you can find the example usage for org.bouncycastle.asn1.x509 CRLReason privilegeWithdrawn.

Prototype

int privilegeWithdrawn

To view the source code for org.bouncycastle.asn1.x509 CRLReason privilegeWithdrawn.

Click Source Link

Usage

From source file:be.fedict.trust.test.PKITestUtils.java

License:Open Source License

public static X509CRL generateCrl(PrivateKey issuerPrivateKey, X509Certificate issuerCertificate,
        DateTime thisUpdate, DateTime nextUpdate, List<String> deltaCrlUris, boolean deltaCrl,
        List<RevokedCertificate> revokedCertificates, String signatureAlgorithm,
        long numberOfRevokedCertificates)
        throws InvalidKeyException, CRLException, IllegalStateException, NoSuchAlgorithmException,
        SignatureException, CertificateException, IOException, OperatorCreationException {

    X500Name issuerName = new X500Name(issuerCertificate.getSubjectX500Principal().toString());
    X509v2CRLBuilder x509v2crlBuilder = new X509v2CRLBuilder(issuerName, thisUpdate.toDate());
    x509v2crlBuilder.setNextUpdate(nextUpdate.toDate());

    for (RevokedCertificate revokedCertificate : revokedCertificates) {
        x509v2crlBuilder.addCRLEntry(revokedCertificate.serialNumber,
                revokedCertificate.revocationDate.toDate(), CRLReason.privilegeWithdrawn);
    }/*from  w  w  w. j  a  v a2s  . c  o m*/
    if (-1 != numberOfRevokedCertificates) {
        SecureRandom secureRandom = new SecureRandom();
        while (numberOfRevokedCertificates-- > 0) {
            BigInteger serialNumber = new BigInteger(128, secureRandom);
            Date revocationDate = new Date();
            x509v2crlBuilder.addCRLEntry(serialNumber, revocationDate, CRLReason.privilegeWithdrawn);
        }
    }

    JcaX509ExtensionUtils extensionUtils = new JcaX509ExtensionUtils();
    x509v2crlBuilder.addExtension(Extension.authorityKeyIdentifier, false,
            extensionUtils.createAuthorityKeyIdentifier(issuerCertificate));
    x509v2crlBuilder.addExtension(Extension.cRLNumber, false, new CRLNumber(BigInteger.ONE));

    if (null != deltaCrlUris && !deltaCrlUris.isEmpty()) {
        DistributionPoint[] deltaCrlDps = new DistributionPoint[deltaCrlUris.size()];
        for (int i = 0; i < deltaCrlUris.size(); i++) {
            deltaCrlDps[i] = getDistributionPoint(deltaCrlUris.get(i));
        }
        CRLDistPoint crlDistPoint = new CRLDistPoint((DistributionPoint[]) deltaCrlDps);
        x509v2crlBuilder.addExtension(Extension.freshestCRL, false, crlDistPoint);
    }

    if (deltaCrl) {
        x509v2crlBuilder.addExtension(Extension.deltaCRLIndicator, true, new CRLNumber(BigInteger.ONE));
    }

    AlgorithmIdentifier sigAlgId = new DefaultSignatureAlgorithmIdentifierFinder().find(signatureAlgorithm);
    AlgorithmIdentifier digAlgId = new DefaultDigestAlgorithmIdentifierFinder().find(sigAlgId);
    AsymmetricKeyParameter asymmetricKeyParameter = PrivateKeyFactory.createKey(issuerPrivateKey.getEncoded());

    ContentSigner contentSigner = new BcRSAContentSignerBuilder(sigAlgId, digAlgId)
            .build(asymmetricKeyParameter);

    X509CRLHolder x509crlHolder = x509v2crlBuilder.build(contentSigner);
    byte[] crlValue = x509crlHolder.getEncoded();
    CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509");
    X509CRL crl = (X509CRL) certificateFactory.generateCRL(new ByteArrayInputStream(crlValue));
    return crl;
}

From source file:chapter7.OCSPResponderExample.java

/**
 *
 * @param request//from w  ww  .  ja  v  a2s.  c om
 * @param responderKey
 * @param pubKey
 * @param revokedID
 * @return
 * @throws NoSuchProviderException
 * @throws OCSPException
 */
public static OCSPResp generateOCSPResponse(final OCSPReq request, final PrivateKey responderKey,
        final PublicKey pubKey, final CertificateID revokedID) throws NoSuchProviderException, OCSPException {
    BasicOCSPRespGenerator basicRespGen = new BasicOCSPRespGenerator(pubKey);
    X509Extensions reqExtensions = request.getRequestExtensions();

    if (reqExtensions != null) {
        X509Extension ext = reqExtensions.getExtension(OCSPObjectIdentifiers.id_pkix_ocsp_nonce);

        if (ext != null) {
            Vector oids = new Vector();
            Vector values = new Vector();

            oids.add(OCSPObjectIdentifiers.id_pkix_ocsp_nonce);
            values.add(ext);

            basicRespGen.setResponseExtensions(new X509Extensions(oids, values));
        }
    }

    Req[] requests = request.getRequestList();

    for (Req x : requests) {
        CertificateID certID = x.getCertID();

        // This would normally be a lot more general!!
        if (certID.equals(revokedID)) {
            basicRespGen.addResponse(certID, new RevokedStatus(new Date(), CRLReason.privilegeWithdrawn));
        } else {
            basicRespGen.addResponse(certID, CertificateStatus.GOOD);
        }
    }

    BasicOCSPResp basicResp = basicRespGen.generate(CryptoDefs.Algorithm.SHA256withRSA.getName(), responderKey,
            null, new Date(), CryptoDefs.Provider.BC.getName());

    OCSPRespGenerator respGen = new OCSPRespGenerator();

    return respGen.generate(OCSPRespGenerator.SUCCESSFUL, basicResp);
}

From source file:eu.europa.esig.dss.cades.extension.AbstractTestCAdESExtension.java

License:Open Source License

@Override
protected DSSDocument getSignedDocument() throws Exception {
    CertificateService certificateService = new CertificateService();

    MockPrivateKeyEntry issuerEntry = certificateService
            .generateSelfSignedCertificate(SignatureAlgorithm.RSA_SHA256, true);
    MockPrivateKeyEntry entryUserA = certificateService.generateCertificateChain(SignatureAlgorithm.RSA_SHA256,
            issuerEntry);/*w  w  w .j a  va2  s .com*/
    MockPrivateKeyEntry entryUserB = certificateService.generateCertificateChain(SignatureAlgorithm.RSA_SHA256,
            issuerEntry);

    CRLGenerator crlGenerator = new CRLGenerator();
    generatedCRL = crlGenerator.generateCRL(entryUserB.getCertificate().getCertificate(), issuerEntry,
            new Date(), CRLReason.privilegeWithdrawn);

    DSSDocument document = new InMemoryDocument("Hello world!".getBytes(), "test.bin");

    // Sign
    CAdESSignatureParameters signatureParameters = new CAdESSignatureParameters();
    signatureParameters.setSigningCertificate(entryUserA.getCertificate());
    signatureParameters.setCertificateChain(entryUserA.getCertificateChain());
    signatureParameters.setSignaturePackaging(SignaturePackaging.ENVELOPING);
    signatureParameters.setSignatureLevel(getOriginalSignatureLevel());

    CertificateVerifier certificateVerifier = new CommonCertificateVerifier();

    CAdESService service = new CAdESService(certificateVerifier);
    service.setTspSource(
            new MockTSPSource(certificateService.generateTspCertificate(SignatureAlgorithm.RSA_SHA256)));

    ToBeSigned dataToSign = service.getDataToSign(document, signatureParameters);

    SignatureValue signatureValue = sign(signatureParameters.getSignatureAlgorithm(), entryUserA, dataToSign);
    final DSSDocument signedDocument = service.signDocument(document, signatureParameters, signatureValue);
    return signedDocument;
}

From source file:eu.europa.esig.dss.cookbook.sources.AlwaysValidOCSPSource.java

License:Open Source License

@Override
public OCSPToken getOCSPToken(CertificateToken certificateToken, CertificateToken issuerCertificateToken) {

    try {/*from w ww.  j  ava 2 s .  c om*/

        final X509Certificate cert = certificateToken.getCertificate();
        final BigInteger serialNumber = cert.getSerialNumber();
        X509Certificate issuerCert = issuerCertificateToken.getCertificate();
        final OCSPReq ocspReq = generateOCSPRequest(issuerCert, serialNumber);

        final DigestCalculator digestCalculator = DSSRevocationUtils.getSHA1DigestCalculator();
        final BasicOCSPRespBuilder basicOCSPRespBuilder = new JcaBasicOCSPRespBuilder(issuerCert.getPublicKey(),
                digestCalculator);
        final Extension extension = ocspReq.getExtension(OCSPObjectIdentifiers.id_pkix_ocsp_nonce);
        if (extension != null) {

            basicOCSPRespBuilder.setResponseExtensions(new Extensions(new Extension[] { extension }));
        }
        final Req[] requests = ocspReq.getRequestList();
        for (int ii = 0; ii != requests.length; ii++) {

            final Req req = requests[ii];
            final CertificateID certID = req.getCertID();

            boolean isOK = true;

            if (isOK) {

                basicOCSPRespBuilder.addResponse(certID, CertificateStatus.GOOD, ocspDate, null, null);
            } else {

                Date revocationDate = DSSUtils.getDate(ocspDate, -1);
                basicOCSPRespBuilder.addResponse(certID,
                        new RevokedStatus(revocationDate, CRLReason.privilegeWithdrawn));
            }
        }

        final ContentSigner contentSigner = new JcaContentSignerBuilder("SHA1withRSA").setProvider("BC")
                .build(privateKey);
        final X509CertificateHolder x509CertificateHolder = new X509CertificateHolder(issuerCert.getEncoded());
        final X509CertificateHolder[] chain = { x509CertificateHolder };
        BasicOCSPResp basicResp = basicOCSPRespBuilder.build(contentSigner, chain, ocspDate);
        final SingleResp[] responses = basicResp.getResponses();

        final OCSPToken ocspToken = new OCSPToken();
        ocspToken.setBasicOCSPResp(basicResp);
        ocspToken.setBestSingleResp(responses[0]);
        return ocspToken;
    } catch (OCSPException e) {
        throw new DSSException(e);
    } catch (IOException e) {
        throw new DSSException(e);
    } catch (CertificateEncodingException e) {
        throw new DSSException(e);
    } catch (OperatorCreationException e) {
        throw new DSSException(e);
    }
}

From source file:eu.europa.esig.dss.test.gen.CRLGeneratorTest.java

License:Open Source License

@Test
public void test() throws Exception {
    MockPrivateKeyEntry issuerKeyEntry = certificateService
            .generateSelfSignedCertificate(SignatureAlgorithm.RSA_SHA256, true);
    MockPrivateKeyEntry privateKeyEntry = certificateService
            .generateCertificateChain(SignatureAlgorithm.RSA_SHA256, issuerKeyEntry);
    X509CRL generatedCRL = crlGenerator.generateCRL(privateKeyEntry.getCertificate().getCertificate(),
            issuerKeyEntry, new Date(), CRLReason.privilegeWithdrawn);
    assertNotNull(generatedCRL);//w  w  w.  j  a v a  2  s .c  o  m

    assertEquals(issuerKeyEntry.getCertificate().getSubjectX500Principal(),
            generatedCRL.getIssuerX500Principal());

    X509CRLEntry revokedCertificate = generatedCRL
            .getRevokedCertificate(privateKeyEntry.getCertificate().getSerialNumber());
    assertNotNull(revokedCertificate);
}

From source file:eu.europa.esig.dss.xades.signature.XAdESLevelBWithMockCrlTest.java

License:Open Source License

@Before
public void init() throws Exception {
    documentToSign = new FileDocument(new File("src/test/resources/sample.xml"));

    CertificateService certificateService = new CertificateService();
    issuerEntry = certificateService.generateSelfSignedCertificate(SignatureAlgorithm.RSA_SHA256, true);
    signerEntry = certificateService.generateCertificateChain(SignatureAlgorithm.RSA_SHA256, issuerEntry);

    CRLGenerator crlGenerator = new CRLGenerator();
    generatedCRL = crlGenerator.generateCRL(signerEntry.getCertificate().getCertificate(), issuerEntry,
            new Date(), CRLReason.privilegeWithdrawn);

    signatureParameters = new XAdESSignatureParameters();
    signatureParameters.bLevel().setSigningDate(new Date());
    signatureParameters.setSigningCertificate(signerEntry.getCertificate());
    signatureParameters.setCertificateChain(signerEntry.getCertificateChain());
    signatureParameters.setSignaturePackaging(SignaturePackaging.ENVELOPING);
    signatureParameters.setSignatureLevel(SignatureLevel.XAdES_BASELINE_B);

    CertificateVerifier certificateVerifier = new CommonCertificateVerifier();
    service = new XAdESService(certificateVerifier);

}

From source file:io.aos.crypto.spl07.OCSPResponderExample.java

License:Apache License

public static OCSPResp generateOCSPResponse(OCSPReq request, PrivateKey responderKey, PublicKey pubKey,
        CertificateID revokedID) throws NoSuchProviderException, OCSPException {
    BasicOCSPRespGenerator basicRespGen = new BasicOCSPRespGenerator(pubKey);

    X509Extensions reqExtensions = request.getRequestExtensions();

    if (reqExtensions != null) {
        X509Extension ext = reqExtensions.getExtension(OCSPObjectIdentifiers.id_pkix_ocsp_nonce);

        if (ext != null) {
            Vector oids = new Vector();
            Vector values = new Vector();

            oids.add(OCSPObjectIdentifiers.id_pkix_ocsp_nonce);
            values.add(ext);//from www  .j  a v a  2 s.  co m

            basicRespGen.setResponseExtensions(new X509Extensions(oids, values));
        }
    }

    Req[] requests = request.getRequestList();

    for (int i = 0; i != requests.length; i++) {
        CertificateID certID = requests[i].getCertID();

        // this would normally be a lot more general!
        if (certID.equals(revokedID)) {
            basicRespGen.addResponse(certID, new RevokedStatus(new Date(), CRLReason.privilegeWithdrawn));
        } else {
            basicRespGen.addResponse(certID, CertificateStatus.GOOD);
        }
    }

    BasicOCSPResp basicResp = basicRespGen.generate("SHA256WithRSA", responderKey, null, new Date(), "BC");

    OCSPRespGenerator respGen = new OCSPRespGenerator();

    return respGen.generate(OCSPRespGenerator.SUCCESSFUL, basicResp);
}

From source file:io.aos.crypto.spl07.X509CRLExample.java

License:Apache License

public static X509CRL createCRL(X509Certificate caCert, PrivateKey caKey, BigInteger revokedSerialNumber)
        throws Exception {
    X509V2CRLGenerator crlGen = new X509V2CRLGenerator();
    Date now = new Date();

    crlGen.setIssuerDN(caCert.getSubjectX500Principal());

    crlGen.setThisUpdate(now);//from  w ww . jav  a2  s. c  o m
    crlGen.setNextUpdate(new Date(now.getTime() + 100000));
    crlGen.setSignatureAlgorithm("SHA256WithRSAEncryption");

    crlGen.addCRLEntry(revokedSerialNumber, now, CRLReason.privilegeWithdrawn);

    crlGen.addExtension(X509Extensions.AuthorityKeyIdentifier, false,
            new AuthorityKeyIdentifierStructure(caCert));
    crlGen.addExtension(X509Extensions.CRLNumber, false, new CRLNumber(BigInteger.valueOf(1)));

    return crlGen.generateX509CRL(caKey, "BC");
}

From source file:mitm.common.security.crl.GenerateTestCRLs.java

License:Open Source License

@Test
public void testGenerateCACRL() throws Exception {
    X509CRLBuilder crlGenerator = createX509CRLBuilder();

    Date thisDate = TestUtils.parseDate("30-Nov-2007 11:38:35 GMT");

    Date nextDate = TestUtils.parseDate("30-Nov-2027 11:38:35 GMT");

    crlGenerator.setThisUpdate(thisDate);
    crlGenerator.setNextUpdate(nextDate);
    crlGenerator.setSignatureAlgorithm("SHA256WithRSAEncryption");

    X509Certificate certificate = TestUtils
            .loadCertificate("test/resources/testdata/certificates/" + "valid_certificate_mitm_test_ca.cer");
    assertNotNull(certificate);/*w w  w . ja  v  a 2  s . co  m*/

    crlGenerator.addCRLEntry(certificate.getSerialNumber(), thisDate, CRLReason.privilegeWithdrawn);

    X509CRL crl = crlGenerator.generateCRL(new KeyAndCertificateImpl(caPrivateKey, caCertificate));

    assertEquals("EMAILADDRESS=ca@example.com, CN=MITM Test CA, L=Amsterdam, ST=NH, C=NL",
            crl.getIssuerX500Principal().toString());
    assertEquals(thisDate, crl.getThisUpdate());
    assertEquals(nextDate, crl.getNextUpdate());
    assertEquals(1, crl.getRevokedCertificates().size());
    assertTrue(crl.isRevoked(certificate));

    File crlFile = new File("test/tmp/test-generate-ca.crl");

    FileOutputStream fos = new FileOutputStream(crlFile);

    IOUtils.write(crl.getEncoded(), fos);

    fos.close();
}

From source file:mitm.common.security.crl.GenerateTestCRLs.java

License:Open Source License

@Test
public void testGenerateCACRLSignedByIncorrectKey() throws Exception {
    X509CRLBuilder crlGenerator = createX509CRLBuilder();

    Date thisDate = TestUtils.parseDate("30-Nov-2007 11:38:35 GMT");

    Date nextDate = TestUtils.parseDate("30-Nov-2027 11:38:35 GMT");

    crlGenerator.setThisUpdate(thisDate);
    crlGenerator.setNextUpdate(nextDate);
    crlGenerator.setSignatureAlgorithm("SHA256WithRSAEncryption");

    X509Certificate certificate = TestUtils
            .loadCertificate("test/resources/testdata/certificates/" + "valid_certificate_mitm_test_ca.cer");
    assertNotNull(certificate);/*from  ww w  . j a v a 2 s.  com*/

    crlGenerator.addCRLEntry(certificate.getSerialNumber(), thisDate, CRLReason.privilegeWithdrawn);

    String encodedPrivateKey = "30820276020100300d06092a864886f70d0101010500048202603082025c"
            + "02010002818100a9fee3017954c99b248d1486830c71b2e0ea3f9b7a2763"
            + "1bed8a731f5bd7e1edf856bc3fb7c63dedbeb5bb0de474e7792b3aa7e7b2"
            + "274c03a47c7d89b1935eaef172c6395f2322f1ed9e61ae46d716b4b4394c"
            + "1a802db05a2d7c3d1d41a3e8afc65ff8dada7414744f1ee1540e50ee7fb8"
            + "db437b20c5ee33a82b9d575cfbc951020301000102818004f84ab2b45562"
            + "3f82e60cff91bd3f65b765a1ce6dd7d0f1f413e421ba91a92d47e161478b"
            + "9be41b9b43bce03f199bdad304b7fbf21d6bff7f439477fe150ce38c312f"
            + "c015f3c89291aaa42c4c106f623dfd9f76acad2f1c77b590f038ffbb25f9"
            + "14b6f7ead769808ddd0e2d648442620b50518d9b7fb132b2fa1fa3e9d628"
            + "41024100e69ab3765120d0e0ba5dc21bf384b2f553211b4b1902175454c6"
            + "2f1b0f8ad385d78490539308c9fd5145ae36cc2a6d364fdd97d83d9b6623"
            + "a987db239e716055024100bcb77acf1e9829ab5b2c9a5e73d343db857474"
            + "a529ba52ca256655eb7d760e85d3c68eec9500e3db0494c8f77cb8058593"
            + "6e52a9290149367392d74ecdc3510d024100bd15723b7cb024b56ffabad3"
            + "c26c3774f2b1bdb8690c0ee7060feec6088b737f56450b368be4740332e5"
            + "a8c0a3cdd1f8eba9adfd101ee0b43329036584604075024055465b9a27ea"
            + "fe394e33b375a6c4fa4ec1d943b4364cd9883aaa297d05ee48d5b4426ee6"
            + "fcd5b02091cb619c63a10bedb6170e071e5e5464e4889ffe1e007a290240"
            + "7b60d23994a2ec38db909678446ed56d32455bf684141b9ee0aec68b2025"
            + "1d4d94fd2beebf02074559b811ae1130d2e2aa3bec2e9bccb06969104856" + "00c70759";

    PrivateKey privateKey = decodePrivateKey(encodedPrivateKey);

    // sign not by the caPrivateKey but by some other key
    X509CRL crl = crlGenerator.generateCRL(new KeyAndCertificateImpl(privateKey, caCertificate));

    assertEquals("EMAILADDRESS=ca@example.com, CN=MITM Test CA, L=Amsterdam, ST=NH, C=NL",
            crl.getIssuerX500Principal().toString());
    assertEquals(thisDate, crl.getThisUpdate());
    assertEquals(nextDate, crl.getNextUpdate());
    assertEquals(1, crl.getRevokedCertificates().size());
    assertTrue(crl.isRevoked(certificate));

    File crlFile = new File("test/tmp/test-generate-ca-signed-incorrect-key.crl");

    FileOutputStream fos = new FileOutputStream(crlFile);

    IOUtils.write(crl.getEncoded(), fos);

    fos.close();
}