Example usage for org.bouncycastle.asn1.x509 CRLReason toString

List of usage examples for org.bouncycastle.asn1.x509 CRLReason toString

  1. HOME
  2. Java
  3. org.bouncycastle
  4. org.bouncycastle.asn1.x509.*
  5. CRLReason
  6. toString

Introduction

In this page you can find the example usage for org.bouncycastle.asn1.x509 CRLReason toString.

Prototype

public String toString()

Source Link

Usage

From source file:eu.europa.ec.markt.dss.DSSRevocationUtils.java

License:Open Source License

/**
 * This method returns the reason of the revocation of the certificate extracted from the given CRL.
 *
 * @param crlEntry An object for a revoked certificate in a CRL (Certificate Revocation List).
 * @return/* w w  w  .  j a  va2s .co m*/
 * @throws DSSException
 */
public static String getRevocationReason(final X509CRLEntry crlEntry) throws DSSException {

    final String reasonId = Extension.reasonCode.getId();
    final byte[] extensionBytes = crlEntry.getExtensionValue(reasonId);
    ASN1InputStream asn1InputStream = null;
    try {

        asn1InputStream = new ASN1InputStream(extensionBytes);
        final ASN1Enumerated asn1Enumerated = ASN1Enumerated.getInstance(asn1InputStream.readObject());
        final CRLReason reason = CRLReason.getInstance(asn1Enumerated);
        return reason.toString();
    } catch (IllegalArgumentException e) {
        // In the test case XAdESTest003 testTRevoked() there is an error in the revocation reason.
        //LOG.warn("Error when revocation reason decoding from CRL: " + e.toString());
        final CRLReason reason = CRLReason.lookup(7); // 7 -> unknown
        return reason.toString(); // unknown
    } catch (IOException e) {
        throw new DSSException(e);
    } finally {

        DSSUtils.closeQuietly(asn1InputStream);
    }
}

From source file:eu.europa.ec.markt.dss.validation102853.CRLCertificateVerifier.java

License:Open Source License

@Override
public RevocationToken check(final CertificateToken toCheckToken) {

    String crlUri = null;//w w  w .j  a  va  2s .co m
    try {

        if (crlSource == null) {

            toCheckToken.extraInfo().infoCRLSourceIsNull();
            return null;
        }
        final X509Certificate toCheckCert = toCheckToken.getCertificate();
        final X509Certificate issuerCert = toCheckToken.getIssuerToken().getCertificate();
        final X509CRL x509crl = crlSource.findCrl(toCheckCert, issuerCert);
        if (crlSource instanceof OnlineCRLSource) {

            crlUri = ((OnlineCRLSource) crlSource).getCrlUri(toCheckCert);
        }
        if (x509crl == null) {

            if (LOG.isLoggable(Level.INFO)) {
                LOG.info("No CRL found for " + toCheckToken.getDSSIdAsString());
            }
            if (crlSource instanceof OnlineCRLSource) {

                toCheckToken.extraInfo().infoNoCRLInfoFound(crlUri);
            }
            return null;
        }
        final CRLToken crlToken = new CRLToken(x509crl);
        if (crlSource instanceof OnlineCRLSource) {

            crlToken.setSourceURI(crlUri);
        }
        if (!isCRLTokenValid(crlToken, toCheckToken.getIssuerToken())) {

            LOG.warning("The CRL is not valid !");
            toCheckToken.extraInfo().infoCRLIsNotValid();
            return null;
        }
        final X509CRLEntry crlEntry = x509crl.getRevokedCertificate(toCheckCert.getSerialNumber());
        if (null == crlEntry) {

            if (LOG.isLoggable(Level.FINE)) {
                LOG.fine("CRL OK for: " + toCheckToken.getDSSIdAsString());
            }
            /*
             * If there is no entry in the CRL, the certificate is more likely to be valid
             */
            crlToken.setStatus(true);
        } else {

            if (LOG.isLoggable(Level.FINE)) {
                LOG.fine("CRL reports certificate: " + toCheckToken.getDSSIdAsString() + " as revoked since "
                        + crlEntry.getRevocationDate());
            }
            crlToken.setStatus(false);
            crlToken.setRevocationDate(crlEntry.getRevocationDate());
            final byte[] extensionBytes = crlEntry.getExtensionValue(X509Extension.reasonCode.getId());
            ASN1InputStream dIn = null;
            try {

                dIn = new ASN1InputStream(extensionBytes);
                CRLReason reason = new CRLReason(DEREnumerated.getInstance(dIn.readObject()));
                crlToken.setReason(reason.toString());
            } catch (IllegalArgumentException e) {
                // In the test case XAdESTest003 testTRevoked() there is an error in the revocation reason.
                LOG.warning("Error when revocation reason decoding from CRL: " + e.toString());
                crlToken.setReason(new CRLReason(7).toString()); // unknown
            } finally {

                DSSUtils.closeQuietly(dIn);
            }
        }
        toCheckToken.setRevocationToken(crlToken);
        return crlToken;
    } catch (final Exception e) {

        LOG.log(Level.SEVERE, "Exception when accessing CRL for " + toCheckToken.getDSSIdAsString(), e);
        toCheckToken.extraInfo().infoCRLException(crlUri, e);
        return null;
    }
}

From source file:eu.europa.ec.markt.dss.validation102853.OCSPCertificateVerifier.java

License:Open Source License

@Override
public RevocationToken check(final CertificateToken toCheckToken) {

    if (ocspSource == null) {

        LOG.warn("OCSPSource null");
        toCheckToken.extraInfo().infoOCSPSourceIsNull();
        return null;
    }//  w w  w. j  av a 2 s  .co  m
    try {

        final X509Certificate issuerCert = toCheckToken.getIssuerToken().getCertificate();
        final X509Certificate toCheckCert = toCheckToken.getCertificate();
        final BasicOCSPResp basicOCSPResp = ocspSource.getOCSPResponse(toCheckCert, issuerCert);
        if (basicOCSPResp == null) {

            String uri = "";
            if (ocspSource instanceof OnlineOCSPSource) {

                uri = ((OnlineOCSPSource) ocspSource).getAccessLocation(toCheckCert);
                toCheckToken.extraInfo().infoNoOCSPResponse(uri);
            }

            if (LOG.isInfoEnabled()) {
                LOG.info("OCSP response not found for " + toCheckToken.getDSSIdAsString() + " [" + uri + "]");
            }
            return null;
        }
        final BigInteger serialNumber = toCheckCert.getSerialNumber();
        final X509CertificateHolder x509CertificateHolder = new X509CertificateHolder(
                DSSUtils.getEncoded(issuerCert));
        final DigestCalculator digestCalculator = DSSUtils.getSHA1DigestCalculator();
        final CertificateID certificateId = new CertificateID(digestCalculator, x509CertificateHolder,
                serialNumber);
        final SingleResp[] singleResps = basicOCSPResp.getResponses();
        for (final SingleResp singleResp : singleResps) {
            if (!DSSRevocationUtils.matches(certificateId, singleResp)) {

                continue;
            }
            if (LOG.isDebugEnabled()) {

                LOG.debug("OCSP thisUpdate: " + singleResp.getThisUpdate());
                LOG.debug("OCSP nextUpdate: " + singleResp.getNextUpdate());
            }
            final OCSPToken ocspToken = new OCSPToken(basicOCSPResp, validationCertPool);
            if (ocspSource instanceof OnlineOCSPSource) {

                ocspToken.setSourceURI(((OnlineOCSPSource) ocspSource).getAccessLocation(toCheckCert));
            }

            ocspToken.setIssuingTime(basicOCSPResp.getProducedAt());
            toCheckToken.setRevocationToken(ocspToken);
            final Object certStatus = singleResp.getCertStatus();
            if (certStatus == null) {

                if (LOG.isInfoEnabled()) {
                    LOG.info("OCSP OK for: " + toCheckToken.getDSSIdAsString());
                    if (LOG.isTraceEnabled()) {
                        LOG.trace("CertificateToken:\n{}", toCheckToken.toString());
                    }
                }
                ocspToken.setStatus(true);
            } else {

                if (LOG.isInfoEnabled()) {
                    LOG.info("OCSP certificate status: " + certStatus.getClass().getName());
                }
                if (certStatus instanceof RevokedStatus) {

                    if (LOG.isInfoEnabled()) {
                        LOG.info("OCSP status revoked");
                    }
                    final RevokedStatus revokedStatus = (RevokedStatus) certStatus;
                    ocspToken.setStatus(false);
                    ocspToken.setRevocationDate(revokedStatus.getRevocationTime());
                    final int reasonId = revokedStatus.getRevocationReason();
                    final CRLReason crlReason = CRLReason.lookup(reasonId);
                    ocspToken.setReason(crlReason.toString());
                } else if (certStatus instanceof UnknownStatus) {

                    if (LOG.isInfoEnabled()) {
                        LOG.info("OCSP status unknown");
                    }
                    ocspToken.setReason("OCSP status: unknown");
                }
            }
            return ocspToken;
        }
    } catch (DSSException e) {

        LOG.error("OCSP DSS Exception: " + e.getMessage(), e);
        toCheckToken.extraInfo().infoOCSPException(e);
        return null;
    } catch (OCSPException e) {

        LOG.error("OCSP Exception: " + e.getMessage());
        toCheckToken.extraInfo().infoOCSPException(e);
        throw new DSSException(e);
    } catch (IOException e) {
        throw new DSSException(e);
    }
    if (LOG.isInfoEnabled()) {
        LOG.debug("No matching OCSP response entry");
    }
    toCheckToken.extraInfo().infoNoOCSPResponse(null);
    return null;
}

From source file:eu.europa.esig.dss.x509.OCSPToken.java

License:Open Source License

private String getRevocationReason(RevokedStatus revokedStatus) {
    int reasonId = getRevocationReasonId(revokedStatus);
    CRLReason crlReason = CRLReason.lookup(reasonId);
    return crlReason.toString();
}

From source file:org.cesecore.certificates.ca.X509CATest.java

License:Open Source License

@SuppressWarnings("unchecked")
private void doTestX509CABasicOperations(String algName) throws Exception {
    final CryptoToken cryptoToken = getNewCryptoToken();
    final X509CA x509ca = createTestCA(cryptoToken, CADN);
    Certificate cacert = x509ca.getCACertificate();

    // Start by creating a PKCS7
    byte[] p7 = x509ca.createPKCS7(cryptoToken, cacert, true);
    assertNotNull(p7);/*from   ww  w .  j  a va  2s  .  c o m*/
    CMSSignedData s = new CMSSignedData(p7);
    Store certstore = s.getCertificates();
    Collection<X509CertificateHolder> certs = certstore.getMatches(null);
    assertEquals(2, certs.size());
    p7 = x509ca.createPKCS7(cryptoToken, cacert, false);
    assertNotNull(p7);
    s = new CMSSignedData(p7);
    certstore = s.getCertificates();
    certs = certstore.getMatches(null);
    assertEquals(1, certs.size());

    // Create a certificate request (will be pkcs10)
    byte[] req = x509ca.createRequest(cryptoToken, null, algName, cacert,
            CATokenConstants.CAKEYPURPOSE_CERTSIGN);
    PKCS10CertificationRequest p10 = new PKCS10CertificationRequest(req);
    assertNotNull(p10);
    String dn = p10.getSubject().toString();
    assertEquals(CADN, dn);

    // Make a request with some pkcs11 attributes as well
    Collection<ASN1Encodable> attributes = new ArrayList<ASN1Encodable>();
    // Add a subject alternative name
    ASN1EncodableVector altnameattr = new ASN1EncodableVector();
    altnameattr.add(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest);
    GeneralNames san = CertTools.getGeneralNamesFromAltName("dNSName=foobar.bar.com");
    ExtensionsGenerator extgen = new ExtensionsGenerator();
    extgen.addExtension(Extension.subjectAlternativeName, false, san);
    Extensions exts = extgen.generate();
    altnameattr.add(new DERSet(exts));
    // Add a challenge password as well
    ASN1EncodableVector pwdattr = new ASN1EncodableVector();
    pwdattr.add(PKCSObjectIdentifiers.pkcs_9_at_challengePassword);
    ASN1EncodableVector pwdvalues = new ASN1EncodableVector();
    pwdvalues.add(new DERUTF8String("foobar123"));
    pwdattr.add(new DERSet(pwdvalues));
    attributes.add(new DERSequence(altnameattr));
    attributes.add(new DERSequence(pwdattr));
    // create the p10
    req = x509ca.createRequest(cryptoToken, attributes, algName, cacert,
            CATokenConstants.CAKEYPURPOSE_CERTSIGN);
    p10 = new PKCS10CertificationRequest(req);
    assertNotNull(p10);
    dn = p10.getSubject().toString();
    assertEquals(CADN, dn);
    Attribute[] attrs = p10.getAttributes();
    assertEquals(2, attrs.length);
    PKCS10RequestMessage p10msg = new PKCS10RequestMessage(new JcaPKCS10CertificationRequest(p10));
    assertEquals("foobar123", p10msg.getPassword());
    assertEquals("dNSName=foobar.bar.com", p10msg.getRequestAltNames());

    try {
        x509ca.createAuthCertSignRequest(cryptoToken, p10.getEncoded());
    } catch (UnsupportedOperationException e) {
        // Expected for a X509 CA
    }

    // Generate a client certificate and check that it was generated correctly
    EndEntityInformation user = new EndEntityInformation("username", "CN=User", 666, "rfc822Name=user@user.com",
            "user@user.com", new EndEntityType(EndEntityTypes.ENDUSER), 0, 0, EndEntityConstants.TOKEN_USERGEN,
            0, null);
    KeyPair keypair = genTestKeyPair(algName);
    CertificateProfile cp = new CertificateProfile(CertificateProfileConstants.CERTPROFILE_FIXED_ENDUSER);
    cp.addCertificatePolicy(new CertificatePolicy("1.1.1.2", null, null));
    cp.setUseCertificatePolicies(true);
    Certificate usercert = x509ca.generateCertificate(cryptoToken, user, keypair.getPublic(), 0, null, 10L, cp,
            "00000");
    assertNotNull(usercert);
    assertEquals("CN=User", CertTools.getSubjectDN(usercert));
    assertEquals(CADN, CertTools.getIssuerDN(usercert));
    assertEquals(getTestKeyPairAlgName(algName).toUpperCase(),
            AlgorithmTools.getCertSignatureAlgorithmNameAsString(usercert).toUpperCase());
    assertEquals(new String(CertTools.getSubjectKeyId(cacert)),
            new String(CertTools.getAuthorityKeyId(usercert)));
    assertEquals("user@user.com", CertTools.getEMailAddress(usercert));
    assertEquals("rfc822name=user@user.com", CertTools.getSubjectAlternativeName(usercert));
    assertNull(CertTools.getUPNAltName(usercert));
    assertFalse(CertTools.isSelfSigned(usercert));
    usercert.verify(cryptoToken
            .getPublicKey(x509ca.getCAToken().getAliasFromPurpose(CATokenConstants.CAKEYPURPOSE_CERTSIGN)));
    usercert.verify(x509ca.getCACertificate().getPublicKey());
    assertTrue(CertTools.isCA(x509ca.getCACertificate()));
    assertFalse(CertTools.isCA(usercert));
    assertEquals("1.1.1.2", CertTools.getCertificatePolicyId(usercert, 0));
    X509Certificate cert = (X509Certificate) usercert;
    boolean[] ku = cert.getKeyUsage();
    assertTrue(ku[0]);
    assertTrue(ku[1]);
    assertTrue(ku[2]);
    assertFalse(ku[3]);
    assertFalse(ku[4]);
    assertFalse(ku[5]);
    assertFalse(ku[6]);
    assertFalse(ku[7]);
    int bcku = CertTools.sunKeyUsageToBC(ku);
    assertEquals(X509KeyUsage.digitalSignature | X509KeyUsage.nonRepudiation | X509KeyUsage.keyEncipherment,
            bcku);

    // Create a CRL
    Collection<RevokedCertInfo> revcerts = new ArrayList<RevokedCertInfo>();
    X509CRLHolder crl = x509ca.generateCRL(cryptoToken, revcerts, 1);
    assertNotNull(crl);
    X509CRL xcrl = CertTools.getCRLfromByteArray(crl.getEncoded());
    assertEquals(CADN, CertTools.getIssuerDN(xcrl));
    Set<?> set = xcrl.getRevokedCertificates();
    assertNull(set);
    BigInteger num = CrlExtensions.getCrlNumber(xcrl);
    assertEquals(1, num.intValue());
    BigInteger deltanum = CrlExtensions.getDeltaCRLIndicator(xcrl);
    assertEquals(-1, deltanum.intValue());
    // Revoke some cert
    Date revDate = new Date();
    revcerts.add(new RevokedCertInfo(CertTools.getFingerprintAsString(usercert).getBytes(),
            CertTools.getSerialNumber(usercert).toByteArray(), revDate.getTime(),
            RevokedCertInfo.REVOCATION_REASON_CERTIFICATEHOLD, CertTools.getNotAfter(usercert).getTime()));
    crl = x509ca.generateCRL(cryptoToken, revcerts, 2);
    assertNotNull(crl);
    xcrl = CertTools.getCRLfromByteArray(crl.getEncoded());
    set = xcrl.getRevokedCertificates();
    assertEquals(1, set.size());
    num = CrlExtensions.getCrlNumber(xcrl);
    assertEquals(2, num.intValue());
    X509CRLEntry entry = (X509CRLEntry) set.iterator().next();
    assertEquals(CertTools.getSerialNumber(usercert).toString(), entry.getSerialNumber().toString());
    assertEquals(revDate.toString(), entry.getRevocationDate().toString());
    // Getting the revocation reason is a pita...
    byte[] extval = entry.getExtensionValue(Extension.reasonCode.getId());
    ASN1InputStream aIn = new ASN1InputStream(new ByteArrayInputStream(extval));
    ASN1OctetString octs = (ASN1OctetString) aIn.readObject();
    aIn = new ASN1InputStream(new ByteArrayInputStream(octs.getOctets()));
    ASN1Primitive obj = aIn.readObject();
    CRLReason reason = CRLReason.getInstance((ASN1Enumerated) obj);
    assertEquals("CRLReason: certificateHold", reason.toString());
    //DEROctetString ostr = (DEROctetString)obj;

    // Create a delta CRL
    revcerts = new ArrayList<RevokedCertInfo>();
    crl = x509ca.generateDeltaCRL(cryptoToken, revcerts, 3, 2);
    assertNotNull(crl);
    xcrl = CertTools.getCRLfromByteArray(crl.getEncoded());
    assertEquals(CADN, CertTools.getIssuerDN(xcrl));
    set = xcrl.getRevokedCertificates();
    assertNull(set);
    num = CrlExtensions.getCrlNumber(xcrl);
    assertEquals(3, num.intValue());
    deltanum = CrlExtensions.getDeltaCRLIndicator(xcrl);
    assertEquals(2, deltanum.intValue());
    revcerts.add(new RevokedCertInfo(CertTools.getFingerprintAsString(usercert).getBytes(),
            CertTools.getSerialNumber(usercert).toByteArray(), revDate.getTime(),
            RevokedCertInfo.REVOCATION_REASON_CERTIFICATEHOLD, CertTools.getNotAfter(usercert).getTime()));
    crl = x509ca.generateDeltaCRL(cryptoToken, revcerts, 4, 3);
    assertNotNull(crl);
    xcrl = CertTools.getCRLfromByteArray(crl.getEncoded());
    deltanum = CrlExtensions.getDeltaCRLIndicator(xcrl);
    assertEquals(3, deltanum.intValue());
    set = xcrl.getRevokedCertificates();
    assertEquals(1, set.size());
    entry = (X509CRLEntry) set.iterator().next();
    assertEquals(CertTools.getSerialNumber(usercert).toString(), entry.getSerialNumber().toString());
    assertEquals(revDate.toString(), entry.getRevocationDate().toString());
    // Getting the revocation reason is a pita...
    extval = entry.getExtensionValue(Extension.reasonCode.getId());
    aIn = new ASN1InputStream(new ByteArrayInputStream(extval));
    octs = (ASN1OctetString) aIn.readObject();
    aIn = new ASN1InputStream(new ByteArrayInputStream(octs.getOctets()));
    obj = aIn.readObject();
    reason = CRLReason.getInstance((ASN1Enumerated) obj);
    assertEquals("CRLReason: certificateHold", reason.toString());
}