Example usage for org.bouncycastle.asn1.x509 DistributionPointName DistributionPointName

List of usage examples for org.bouncycastle.asn1.x509 DistributionPointName DistributionPointName

  1. HOME
  2. Java
  3. org.bouncycastle
  4. org.bouncycastle.asn1.x509.*
  5. DistributionPointName
  6. DistributionPointName

Introduction

In this page you can find the example usage for org.bouncycastle.asn1.x509 DistributionPointName DistributionPointName.

Prototype

public DistributionPointName(int type, ASN1Encodable name)

Source Link

Usage

From source file:be.fedict.trust.test.PKITestUtils.java

License:Open Source License

public static DistributionPoint getDistributionPoint(String uri) {
    GeneralName gn = new GeneralName(GeneralName.uniformResourceIdentifier, new DERIA5String(uri));
    GeneralNames gns = new GeneralNames(gn);
    DistributionPointName dpn = new DistributionPointName(0, gns);
    return new DistributionPoint(dpn, null, null);
}

From source file:eu.emi.security.authn.x509.helpers.pkipath.bc.RFC3280CertPathUtilitiesHelper.java

License:Open Source License

/**
 * Checks a certificate if it is revoked.
 * /*from  ww w.  j  av  a2  s  .  c  om*/
 * @param paramsPKIX PKIX parameters.
 * @param cert Certificate to check if it is revoked.
 * @param validDate The date when the certificate revocation status
 *                should be checked.
 * @param sign The issuer certificate of the certificate
 *                <code>cert</code>.
 * @param workingPublicKey The public key of the issuer certificate
 *                <code>sign</code>.
 * @param certPathCerts The certificates of the certification path.
 * @throws AnnotatedException if the certificate is revoked or the
 *                 status cannot be checked or some error occurs.
 */
protected static void checkCRLs2(ExtPKIXParameters paramsPKIX, X509Certificate cert, Date validDate,
        X509Certificate sign, PublicKey workingPublicKey, List<?> certPathCerts)
        throws SimpleValidationErrorException {
    SimpleValidationErrorException lastException = null;
    CRLDistPoint crldp = null;
    try {
        crldp = CRLDistPoint.getInstance(CertPathValidatorUtilities.getExtensionValue(cert,
                RFC3280CertPathUtilities.CRL_DISTRIBUTION_POINTS));
    } catch (Exception e) {
        throw new SimpleValidationErrorException(ValidationErrorCode.crlDistPtExtError, e);
    }
    try {
        CertPathValidatorUtilities.addAdditionalStoresFromCRLDistributionPoint(crldp, paramsPKIX);
    } catch (AnnotatedException e) {
        throw new SimpleValidationErrorException(ValidationErrorCode.crlDistPtExtError, e);
    }
    CertStatus certStatus = new CertStatus();
    ReasonsMask reasonsMask = new ReasonsMask();

    boolean validCrlFound = false;
    // for each distribution point
    if (crldp != null) {
        DistributionPoint dps[] = null;
        try {
            dps = crldp.getDistributionPoints();
        } catch (Exception e) {
            throw new SimpleValidationErrorException(ValidationErrorCode.crlDistPtExtError, e);
        }
        if (dps != null) {
            for (int i = 0; i < dps.length && certStatus.getCertStatus() == CertStatus.UNREVOKED
                    && !reasonsMask.isAllReasons(); i++) {
                ExtendedPKIXParameters paramsPKIXClone = (ExtendedPKIXParameters) paramsPKIX.clone();
                try {
                    checkCRL(dps[i], paramsPKIXClone, cert, validDate, sign, workingPublicKey, certStatus,
                            reasonsMask, certPathCerts);
                    validCrlFound = true;
                } catch (SimpleValidationErrorException e) {
                    lastException = e;
                }
            }
        }
    }

    /*
     * If the revocation status has not been determined, repeat the
     * process above with any available CRLs not specified in a
     * distribution point but issued by the certificate issuer.
     */

    if (certStatus.getCertStatus() == CertStatus.UNREVOKED && !reasonsMask.isAllReasons()) {
        try {
            /*
             * assume a DP with both the reasons and the
             * cRLIssuer fields omitted and a distribution
             * point name of the certificate issuer.
             */
            ASN1Primitive issuer = null;
            try {
                issuer = new ASN1InputStream(
                        CertPathValidatorUtilities.getEncodedIssuerPrincipal(cert).getEncoded()).readObject();
            } catch (Exception e) {
                throw new SimpleValidationErrorException(ValidationErrorCode.crlIssuerException, e);
            }
            DistributionPoint dp = new DistributionPoint(new DistributionPointName(0,
                    new GeneralNames(new GeneralName(GeneralName.directoryName, issuer))), null, null);
            ExtendedPKIXParameters paramsPKIXClone = (ExtendedPKIXParameters) paramsPKIX.clone();
            checkCRL(dp, paramsPKIXClone, cert, validDate, sign, workingPublicKey, certStatus, reasonsMask,
                    certPathCerts);
            validCrlFound = true;
        } catch (SimpleValidationErrorException e) {
            lastException = e;
        }
    }

    if (!validCrlFound)
        throw lastException;
    if (certStatus.getCertStatus() != CertStatus.UNREVOKED) {
        throw new SimpleValidationErrorException(ValidationErrorCode.certRevoked,
                new TrustedInput(certStatus.getRevocationDate()), crlReasons[certStatus.getCertStatus()]);
    }
    if (!reasonsMask.isAllReasons() && certStatus.getCertStatus() == CertStatus.UNREVOKED) {
        certStatus.setCertStatus(CertStatus.UNDETERMINED);
    }
    if (certStatus.getCertStatus() == CertStatus.UNDETERMINED) {
        throw new SimpleValidationErrorException(ValidationErrorCode.noValidCrlFound);
    }
}

From source file:mitm.common.security.crl.CRLDistributionPointsBuilder.java

License:Open Source License

public CRLDistPoint buildCRLDistPoint() {
    if (uris.size() == 0) {
        return null;
    }//from w w  w.j  a v a 2 s.c  om

    CRLDistPoint crlDistPoint;

    ASN1EncodableVector names = new ASN1EncodableVector();

    for (String uri : uris) {
        GeneralName gn = new GeneralName(GeneralName.uniformResourceIdentifier, new DERIA5String(uri));

        names.add(gn);
    }

    GeneralNames gns = GeneralNames.getInstance(new DERSequence(names));

    DistributionPointName dpn = new DistributionPointName(DistributionPointName.FULL_NAME, gns);
    DistributionPoint distp = new DistributionPoint(dpn, null, null);

    crlDistPoint = CRLDistPoint.getInstance(new DERSequence(distp));

    return crlDistPoint;
}

From source file:org.apache.poi.poifs.crypt.PkiTestUtils.java

License:Apache License

static X509Certificate generateCertificate(PublicKey subjectPublicKey, String subjectDn, Date notBefore,
        Date notAfter, X509Certificate issuerCertificate, PrivateKey issuerPrivateKey, boolean caFlag,
        int pathLength, String crlUri, String ocspUri, KeyUsage keyUsage)
        throws IOException, OperatorCreationException, CertificateException {
    String signatureAlgorithm = "SHA1withRSA";
    X500Name issuerName;//from  w  w  w.  ja  va 2 s.c  om
    if (issuerCertificate != null) {
        issuerName = new X509CertificateHolder(issuerCertificate.getEncoded()).getIssuer();
    } else {
        issuerName = new X500Name(subjectDn);
    }

    RSAPublicKey rsaPubKey = (RSAPublicKey) subjectPublicKey;
    RSAKeyParameters rsaSpec = new RSAKeyParameters(false, rsaPubKey.getModulus(),
            rsaPubKey.getPublicExponent());

    SubjectPublicKeyInfo subjectPublicKeyInfo = SubjectPublicKeyInfoFactory.createSubjectPublicKeyInfo(rsaSpec);

    DigestCalculator digestCalc = new JcaDigestCalculatorProviderBuilder().setProvider("BC").build()
            .get(CertificateID.HASH_SHA1);

    X509v3CertificateBuilder certificateGenerator = new X509v3CertificateBuilder(issuerName,
            new BigInteger(128, new SecureRandom()), notBefore, notAfter, new X500Name(subjectDn),
            subjectPublicKeyInfo);

    X509ExtensionUtils exUtils = new X509ExtensionUtils(digestCalc);
    SubjectKeyIdentifier subKeyId = exUtils.createSubjectKeyIdentifier(subjectPublicKeyInfo);
    AuthorityKeyIdentifier autKeyId = (issuerCertificate != null)
            ? exUtils.createAuthorityKeyIdentifier(new X509CertificateHolder(issuerCertificate.getEncoded()))
            : exUtils.createAuthorityKeyIdentifier(subjectPublicKeyInfo);

    certificateGenerator.addExtension(Extension.subjectKeyIdentifier, false, subKeyId);
    certificateGenerator.addExtension(Extension.authorityKeyIdentifier, false, autKeyId);

    if (caFlag) {
        BasicConstraints bc;

        if (-1 == pathLength) {
            bc = new BasicConstraints(true);
        } else {
            bc = new BasicConstraints(pathLength);
        }
        certificateGenerator.addExtension(Extension.basicConstraints, false, bc);
    }

    if (null != crlUri) {
        int uri = GeneralName.uniformResourceIdentifier;
        DERIA5String crlUriDer = new DERIA5String(crlUri);
        GeneralName gn = new GeneralName(uri, crlUriDer);

        DERSequence gnDer = new DERSequence(gn);
        GeneralNames gns = GeneralNames.getInstance(gnDer);

        DistributionPointName dpn = new DistributionPointName(0, gns);
        DistributionPoint distp = new DistributionPoint(dpn, null, null);
        DERSequence distpDer = new DERSequence(distp);
        certificateGenerator.addExtension(Extension.cRLDistributionPoints, false, distpDer);
    }

    if (null != ocspUri) {
        int uri = GeneralName.uniformResourceIdentifier;
        GeneralName ocspName = new GeneralName(uri, ocspUri);

        AuthorityInformationAccess authorityInformationAccess = new AuthorityInformationAccess(
                X509ObjectIdentifiers.ocspAccessMethod, ocspName);

        certificateGenerator.addExtension(Extension.authorityInfoAccess, false, authorityInformationAccess);
    }

    if (null != keyUsage) {
        certificateGenerator.addExtension(Extension.keyUsage, true, keyUsage);
    }

    JcaContentSignerBuilder signerBuilder = new JcaContentSignerBuilder(signatureAlgorithm);
    signerBuilder.setProvider("BC");

    X509CertificateHolder certHolder = certificateGenerator.build(signerBuilder.build(issuerPrivateKey));

    /*
     * Next certificate factory trick is needed to make sure that the
     * certificate delivered to the caller is provided by the default
     * security provider instead of BouncyCastle. If we don't do this trick
     * we might run into trouble when trying to use the CertPath validator.
     */
    //        CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509");
    //        certificate = (X509Certificate) certificateFactory
    //                .generateCertificate(new ByteArrayInputStream(certificate
    //                        .getEncoded()));
    return new JcaX509CertificateConverter().getCertificate(certHolder);
}

From source file:org.cesecore.certificates.ca.X509CA.java

License:Open Source License

/**
 * Generate a list of Distribution points.
 * /*  w ww  . ja  v  a2 s .  co m*/
 * @param distPoints
 *            distribution points as String in semi column (';') separated format.
 * @return list of distribution points.
 */
private List<DistributionPoint> generateDistributionPoints(String distPoints) {
    if (distPoints == null) {
        distPoints = "";
    }
    // Multiple CDPs are separated with the ';' sign
    Iterator<String> it = StringTools.splitURIs(distPoints).iterator();
    ArrayList<DistributionPoint> result = new ArrayList<DistributionPoint>();
    while (it.hasNext()) {
        String uri = (String) it.next();
        GeneralName gn = new GeneralName(GeneralName.uniformResourceIdentifier, new DERIA5String(uri));
        if (log.isDebugEnabled()) {
            log.debug("Added CRL distpoint: " + uri);
        }
        ASN1EncodableVector vec = new ASN1EncodableVector();
        vec.add(gn);
        GeneralNames gns = GeneralNames.getInstance(new DERSequence(vec));
        DistributionPointName dpn = new DistributionPointName(0, gns);
        result.add(new DistributionPoint(dpn, null, null));
    }
    return result;
}

From source file:org.cesecore.certificates.certificate.certextensions.standard.CrlDistributionPoints.java

License:Open Source License

@Override
public ASN1Encodable getValue(final EndEntityInformation subject, final CA ca,
        final CertificateProfile certProfile, final PublicKey userPublicKey, final PublicKey caPublicKey,
        CertificateValidity val) throws CertificateExtensionException {
    String crldistpoint = certProfile.getCRLDistributionPointURI();
    String crlissuer = certProfile.getCRLIssuer();
    final X509CA x509ca = (X509CA) ca;
    if (certProfile.getUseDefaultCRLDistributionPoint()) {
        crldistpoint = x509ca.getDefaultCRLDistPoint();
        crlissuer = x509ca.getDefaultCRLIssuer();
    }/*from w w w  .  jav a 2s .  c o  m*/
    // Multiple CDPs are separated with the ';' sign                        
    final ArrayList<DistributionPointName> dpns = new ArrayList<DistributionPointName>();
    if (StringUtils.isNotEmpty(crldistpoint)) {
        final Iterator<String> it = StringTools.splitURIs(crldistpoint).iterator();
        while (it.hasNext()) {
            // 6 is URI
            final String uri = (String) it.next();
            final GeneralName gn = new GeneralName(GeneralName.uniformResourceIdentifier,
                    new DERIA5String(uri));
            if (log.isDebugEnabled()) {
                log.debug("Added CRL distpoint: " + uri);
            }
            final ASN1EncodableVector vec = new ASN1EncodableVector();
            vec.add(gn);
            final GeneralNames gns = GeneralNames.getInstance(new DERSequence(vec));
            final DistributionPointName dpn = new DistributionPointName(0, gns);
            dpns.add(dpn);
        }
    }
    // CRL issuer works much like Dist point URI. If separated by ; it is put in the same global distPoint as the URI, 
    // if there is more of one of them, the one with more is put in an own global distPoint.
    final ArrayList<GeneralNames> issuers = new ArrayList<GeneralNames>();
    if (StringUtils.isNotEmpty(crlissuer)) {
        final StringTokenizer tokenizer = new StringTokenizer(crlissuer, ";", false);
        while (tokenizer.hasMoreTokens()) {
            final String issuer = tokenizer.nextToken();
            final GeneralName gn = new GeneralName(new X500Name(issuer));
            if (log.isDebugEnabled()) {
                log.debug("Added CRL issuer: " + issuer);
            }
            final ASN1EncodableVector vec = new ASN1EncodableVector();
            vec.add(gn);
            final GeneralNames gns = GeneralNames.getInstance(new DERSequence(vec));
            issuers.add(gns);
        }
    }
    final ArrayList<DistributionPoint> distpoints = new ArrayList<DistributionPoint>();
    if ((!issuers.isEmpty()) || (!dpns.isEmpty())) {
        int i = dpns.size();
        if (issuers.size() > i) {
            i = issuers.size();
        }
        for (int j = 0; j < i; j++) {
            DistributionPointName dpn = null;
            GeneralNames issuer = null;
            if (dpns.size() > j) {
                dpn = (DistributionPointName) dpns.get(j);
            }
            if (issuers.size() > j) {
                issuer = (GeneralNames) issuers.get(j);
            }
            if ((dpn != null) || (issuer != null)) {
                distpoints.add(new DistributionPoint(dpn, null, issuer));
            }
        }
    }
    CRLDistPoint ret = null;
    if (!distpoints.isEmpty()) {
        ret = new CRLDistPoint(
                (DistributionPoint[]) distpoints.toArray(new DistributionPoint[distpoints.size()]));
    }
    if (ret == null) {
        log.error("DrlDistributionPoints missconfigured, no distribution points available.");
    }
    return ret;
}

From source file:org.cesecore.certificates.certificate.certextensions.standard.FreshestCrl.java

License:Open Source License

@Override
public ASN1Encodable getValue(final EndEntityInformation subject, final CA ca,
        final CertificateProfile certProfile, final PublicKey userPublicKey, final PublicKey caPublicKey,
        CertificateValidity val) throws CertificateExtensionException {
    String freshestcrldistpoint = certProfile.getFreshestCRLURI();
    final X509CA x509ca = (X509CA) ca;
    if (certProfile.getUseCADefinedFreshestCRL()) {
        freshestcrldistpoint = x509ca.getCADefinedFreshestCRL();
    }//from   w ww. j  a va2 s. co  m
    // Multiple FCDPs are separated with the ';' sign
    CRLDistPoint ret = null;
    if (freshestcrldistpoint != null) {
        final StringTokenizer tokenizer = new StringTokenizer(freshestcrldistpoint, ";", false);
        final ArrayList<DistributionPoint> distpoints = new ArrayList<DistributionPoint>();
        while (tokenizer.hasMoreTokens()) {
            final String uri = tokenizer.nextToken();
            final GeneralName gn = new GeneralName(GeneralName.uniformResourceIdentifier,
                    new DERIA5String(uri));
            if (log.isDebugEnabled()) {
                log.debug("Added freshest CRL distpoint: " + uri);
            }
            final ASN1EncodableVector vec = new ASN1EncodableVector();
            vec.add(gn);
            final GeneralNames gns = GeneralNames.getInstance(new DERSequence(vec));
            final DistributionPointName dpn = new DistributionPointName(0, gns);
            distpoints.add(new DistributionPoint(dpn, null, null));
        }
        if (!distpoints.isEmpty()) {
            ret = new CRLDistPoint(
                    (DistributionPoint[]) distpoints.toArray(new DistributionPoint[distpoints.size()]));
        }
    }
    if (ret == null) {
        log.error("UseFreshestCRL is true, but no URI string defined!");
    }
    return ret;
}

From source file:org.ejbca.core.model.ca.caadmin.X509CA.java

License:Open Source License

/** Generate a list of Distribution points.
 * @param distPoints distribution points as String in semi column (';') separated format.
 * @return list of distribution points.//from  w  w  w  . j ava2s . c o  m
 */
private List<DistributionPoint> generateDistributionPoints(String distPoints) {
    if (distPoints == null) {
        distPoints = "";
    }
    // Multiple CDPs are separated with the ';' sign
    Iterator<String> it = StringTools.splitURIs(distPoints).iterator();
    ArrayList<DistributionPoint> result = new ArrayList<DistributionPoint>();
    while (it.hasNext()) {
        String uri = (String) it.next();
        GeneralName gn = new GeneralName(GeneralName.uniformResourceIdentifier, new DERIA5String(uri));
        if (log.isDebugEnabled()) {
            log.debug("Added CRL distpoint: " + uri);
        }
        ASN1EncodableVector vec = new ASN1EncodableVector();
        vec.add(gn);
        GeneralNames gns = new GeneralNames(new DERSequence(vec));
        DistributionPointName dpn = new DistributionPointName(0, gns);
        result.add(new DistributionPoint(dpn, null, null));
    }
    return result;
}

From source file:org.ejbca.core.model.ca.certextensions.standard.CrlDistributionPoints.java

License:Open Source License

@Override
public DEREncodable getValue(final UserDataVO subject, final CA ca, final CertificateProfile certProfile,
        final PublicKey userPublicKey, final PublicKey caPublicKey)
        throws CertificateExtentionConfigurationException, CertificateExtensionException {
    String crldistpoint = certProfile.getCRLDistributionPointURI();
    String crlissuer = certProfile.getCRLIssuer();
    final X509CA x509ca = (X509CA) ca;
    if (certProfile.getUseDefaultCRLDistributionPoint()) {
        crldistpoint = x509ca.getDefaultCRLDistPoint();
        crlissuer = x509ca.getDefaultCRLIssuer();
    }//  w  ww.ja  v  a  2s .c om
    // Multiple CDPs are separated with the ';' sign                        
    final ArrayList<DistributionPointName> dpns = new ArrayList<DistributionPointName>();
    if (StringUtils.isNotEmpty(crldistpoint)) {
        final Iterator<String> it = StringTools.splitURIs(crldistpoint).iterator();
        while (it.hasNext()) {
            // 6 is URI
            final String uri = (String) it.next();
            final GeneralName gn = new GeneralName(GeneralName.uniformResourceIdentifier,
                    new DERIA5String(uri));
            if (log.isDebugEnabled()) {
                log.debug("Added CRL distpoint: " + uri);
            }
            final ASN1EncodableVector vec = new ASN1EncodableVector();
            vec.add(gn);
            final GeneralNames gns = new GeneralNames(new DERSequence(vec));
            final DistributionPointName dpn = new DistributionPointName(0, gns);
            dpns.add(dpn);
        }
    }
    // CRL issuer works much like Dist point URI. If separated by ; it is put in the same global distPoint as the URI, 
    // if there is more of one of them, the one with more is put in an own global distPoint.
    final ArrayList<GeneralNames> issuers = new ArrayList<GeneralNames>();
    if (StringUtils.isNotEmpty(crlissuer)) {
        final StringTokenizer tokenizer = new StringTokenizer(crlissuer, ";", false);
        while (tokenizer.hasMoreTokens()) {
            final String issuer = tokenizer.nextToken();
            final GeneralName gn = new GeneralName(new X509Name(issuer));
            if (log.isDebugEnabled()) {
                log.debug("Added CRL issuer: " + issuer);
            }
            final ASN1EncodableVector vec = new ASN1EncodableVector();
            vec.add(gn);
            final GeneralNames gns = new GeneralNames(new DERSequence(vec));
            issuers.add(gns);
        }
    }
    final ArrayList<DistributionPoint> distpoints = new ArrayList<DistributionPoint>();
    if ((!issuers.isEmpty()) || (!dpns.isEmpty())) {
        int i = dpns.size();
        if (issuers.size() > i) {
            i = issuers.size();
        }
        for (int j = 0; j < i; j++) {
            DistributionPointName dpn = null;
            GeneralNames issuer = null;
            if (dpns.size() > j) {
                dpn = (DistributionPointName) dpns.get(j);
            }
            if (issuers.size() > j) {
                issuer = (GeneralNames) issuers.get(j);
            }
            if ((dpn != null) || (issuer != null)) {
                distpoints.add(new DistributionPoint(dpn, null, issuer));
            }
        }
    }
    CRLDistPoint ret = null;
    if (!distpoints.isEmpty()) {
        ret = new CRLDistPoint(
                (DistributionPoint[]) distpoints.toArray(new DistributionPoint[distpoints.size()]));
    }
    if (ret == null) {
        log.error("DrlDistributionPoints missconfigured, no distribution points available.");
    }
    return ret;
}

From source file:org.ejbca.core.model.ca.certextensions.standard.FreshestCrl.java

License:Open Source License

@Override
public DEREncodable getValue(final UserDataVO subject, final CA ca, final CertificateProfile certProfile,
        final PublicKey userPublicKey, final PublicKey caPublicKey)
        throws CertificateExtentionConfigurationException, CertificateExtensionException {
    String freshestcrldistpoint = certProfile.getFreshestCRLURI();
    final X509CA x509ca = (X509CA) ca;
    if (certProfile.getUseCADefinedFreshestCRL()) {
        freshestcrldistpoint = x509ca.getCADefinedFreshestCRL();
    }//from   w  ww  .  j  ava 2  s.  co m
    // Multiple FCDPs are separated with the ';' sign
    CRLDistPoint ret = null;
    if (freshestcrldistpoint != null) {
        final StringTokenizer tokenizer = new StringTokenizer(freshestcrldistpoint, ";", false);
        final ArrayList<DistributionPoint> distpoints = new ArrayList<DistributionPoint>();
        while (tokenizer.hasMoreTokens()) {
            final String uri = tokenizer.nextToken();
            final GeneralName gn = new GeneralName(GeneralName.uniformResourceIdentifier,
                    new DERIA5String(uri));
            if (log.isDebugEnabled()) {
                log.debug("Added freshest CRL distpoint: " + uri);
            }
            final ASN1EncodableVector vec = new ASN1EncodableVector();
            vec.add(gn);
            final GeneralNames gns = new GeneralNames(new DERSequence(vec));
            final DistributionPointName dpn = new DistributionPointName(0, gns);
            distpoints.add(new DistributionPoint(dpn, null, null));
        }
        if (!distpoints.isEmpty()) {
            ret = new CRLDistPoint(
                    (DistributionPoint[]) distpoints.toArray(new DistributionPoint[distpoints.size()]));
        }
    }
    if (ret == null) {
        log.error("UseFreshestCRL is true, but no URI string defined!");
    }
    return ret;
}