Example usage for org.bouncycastle.asn1.x509 Extension extendedKeyUsage

List of usage examples for org.bouncycastle.asn1.x509 Extension extendedKeyUsage

Introduction

In this page you can find the example usage for org.bouncycastle.asn1.x509 Extension extendedKeyUsage.

Prototype

ASN1ObjectIdentifier extendedKeyUsage

To view the source code for org.bouncycastle.asn1.x509 Extension extendedKeyUsage.

Click Source Link

Document

Extended Key Usage

Usage

From source file:net.sf.portecle.crypto.X509Ext.java

License:Open Source License

/**
 * Get extension value as a string./*from w  w w . j  av  a2 s.  com*/
 * 
 * @return Extension value as a string
 * @throws IOException If an I/O problem occurs
 * @throws ParseException If a date formatting problem occurs
 */
public String getStringValue() throws IOException, ParseException {
    // Get octet string from extension
    byte[] bOctets = ((ASN1OctetString) ASN1Primitive.fromByteArray(m_bValue)).getOctets();

    // Octet string processed differently depending on extension type
    if (m_Oid.equals(X509ObjectIdentifiers.commonName)) {
        return getCommonNameStringValue(bOctets);
    } else if (m_Oid.equals(Extension.subjectKeyIdentifier)) {
        return getSubjectKeyIdentifierStringValue(bOctets);
    } else if (m_Oid.equals(Extension.keyUsage)) {
        return getKeyUsageStringValue(bOctets);
    } else if (m_Oid.equals(Extension.privateKeyUsagePeriod)) {
        return getPrivateKeyUsagePeriod(bOctets);
    } else if (m_Oid.equals(Extension.issuerAlternativeName)
            || m_Oid.equals(Extension.subjectAlternativeName)) {
        return getAlternativeName(bOctets);
    } else if (m_Oid.equals(Extension.basicConstraints)) {
        return getBasicConstraintsStringValue(bOctets);
    } else if (m_Oid.equals(Extension.cRLNumber)) {
        return getCrlNumberStringValue(bOctets);
    } else if (m_Oid.equals(Extension.reasonCode)) {
        return getReasonCodeStringValue(bOctets);
    } else if (m_Oid.equals(Extension.instructionCode)) {
        return getHoldInstructionCodeStringValue(bOctets);
    } else if (m_Oid.equals(Extension.invalidityDate)) {
        return getInvalidityDateStringValue(bOctets);
    } else if (m_Oid.equals(Extension.deltaCRLIndicator)) {
        return getDeltaCrlIndicatorStringValue(bOctets);
    } else if (m_Oid.equals(Extension.certificateIssuer)) {
        return getCertificateIssuerStringValue(bOctets);
    } else if (m_Oid.equals(Extension.policyMappings)) {
        return getPolicyMappingsStringValue(bOctets);
    } else if (m_Oid.equals(Extension.authorityKeyIdentifier)) {
        return getAuthorityKeyIdentifierStringValue(bOctets);
    } else if (m_Oid.equals(Extension.policyConstraints)) {
        return getPolicyConstraintsStringValue(bOctets);
    } else if (m_Oid.equals(Extension.extendedKeyUsage)) {
        return getExtendedKeyUsageStringValue(bOctets);
    } else if (m_Oid.equals(Extension.inhibitAnyPolicy)) {
        return getInhibitAnyPolicyStringValue(bOctets);
    } else if (m_Oid.equals(MiscObjectIdentifiers.entrustVersionExtension)) {
        return getEntrustVersionExtensionStringValue(bOctets);
    } else if (m_Oid.equals(PKCSObjectIdentifiers.pkcs_9_at_smimeCapabilities)) {
        return getSmimeCapabilitiesStringValue(bOctets);
    } else if (m_Oid.equals(MicrosoftObjectIdentifiers.microsoftCaVersion)) {
        return getMicrosoftCAVersionStringValue(bOctets);
    } else if (m_Oid.equals(MicrosoftObjectIdentifiers.microsoftPrevCaCertHash)) {
        return getMicrosoftPreviousCACertificateHashStringValue(bOctets);
    } else if (m_Oid.equals(MicrosoftObjectIdentifiers.microsoftCertTemplateV2)) {
        return getMicrosoftCertificateTemplateV2StringValue(bOctets);
    } else if (m_Oid.equals(MicrosoftObjectIdentifiers.microsoftAppPolicies)) {
        return getUnknownOidStringValue(bOctets); // TODO
    }
    // TODO: https://github.com/bcgit/bc-java/pull/92
    else if (m_Oid.toString().equals("1.3.6.1.4.1.311.21.4")) {
        return getMicrosoftCrlNextPublish(bOctets);
    } else if (m_Oid.equals(Extension.authorityInfoAccess) || m_Oid.equals(Extension.subjectInfoAccess)) {
        return getInformationAccessStringValue(bOctets);
    } else if (m_Oid.equals(Extension.logoType)) {
        return getLogotypeStringValue(bOctets);
    } else if (m_Oid.equals(MiscObjectIdentifiers.novellSecurityAttribs)) {
        return getNovellSecurityAttributesStringValue(bOctets);
    } else if (m_Oid.equals(MiscObjectIdentifiers.netscapeCertType)) {
        return getNetscapeCertificateTypeStringValue(bOctets);
    } else if (m_Oid.equals(MiscObjectIdentifiers.netscapeSSLServerName)
            || m_Oid.equals(MiscObjectIdentifiers.netscapeCertComment)
            || m_Oid.equals(MiscObjectIdentifiers.verisignDnbDunsNumber)
            || m_Oid.equals(MicrosoftObjectIdentifiers.microsoftCertTemplateV1)) {
        return getASN1ObjectString(bOctets);
    } else if (m_Oid.equals(MiscObjectIdentifiers.netscapeCApolicyURL)) {
        return getNetscapeExtensionURLValue(bOctets, LinkClass.BROWSER);
    } else if (m_Oid.equals(MiscObjectIdentifiers.netscapeBaseURL)
            || m_Oid.equals(MiscObjectIdentifiers.netscapeRenewalURL)
            || m_Oid.equals(MiscObjectIdentifiers.netscapeRevocationURL)
            || m_Oid.equals(MiscObjectIdentifiers.netscapeCARevocationURL)) {
        return getNetscapeExtensionURLValue(bOctets, LinkClass.CRL);
    } else if (m_Oid.equals(Extension.cRLDistributionPoints)) {
        return getCrlDistributionPointsStringValue(bOctets);
    } else if (m_Oid.equals(Extension.certificatePolicies)) {
        return getCertificatePoliciesStringValue(bOctets);
    }

    // TODO:
    // - CERTIFICATE_POLICIES_OLD_OID
    // - AUTHORITY_KEY_IDENTIFIER_OLD_OID
    // - BASIC_CONSTRAINTS_OLD_0_OID

    // Don't know how to process the extension
    // and clear text
    else {
        return getUnknownOidStringValue(bOctets);
    }
}

From source file:net.wstech2.me.httpsclient.CertificateValidatorUtils.java

License:Apache License

private static Boolean isHostAunthenticationCertificate(Certificate cert) throws IOException {

    Extension extKeyUsageExtension = cert.getTBSCertificate().getExtensions()
            .getExtension(Extension.extendedKeyUsage);
    if (extKeyUsageExtension == null) {
        return Boolean.FALSE;
    }/*from w  ww.j  a  va 2 s. c om*/
    ASN1OctetString oct = extKeyUsageExtension.getExtnValue();
    ASN1InputStream extIn = new ASN1InputStream(new ByteArrayInputStream(oct.getOctets()));
    ExtendedKeyUsage extKeyUsages = ExtendedKeyUsage.getInstance(extIn.readObject());
    extIn.close();
    KeyPurposeId[] keyPurposeIds = extKeyUsages.getUsages();
    for (int i = 0; i < keyPurposeIds.length; i++) {
        if (keyPurposeIds[i].equals(KeyPurposeId.id_kp_serverAuth)) {
            return Boolean.TRUE;
        }
    }
    return Boolean.FALSE;
}

From source file:org.apache.nifi.registry.security.util.CertificateUtils.java

License:Apache License

/**
 * Generates a self-signed {@link X509Certificate} suitable for use as a Certificate Authority.
 *
 * @param keyPair                 the {@link KeyPair} to generate the {@link X509Certificate} for
 * @param dn                      the distinguished name to user for the {@link X509Certificate}
 * @param signingAlgorithm        the signing algorithm to use for the {@link X509Certificate}
 * @param certificateDurationDays the duration in days for which the {@link X509Certificate} should be valid
 * @return a self-signed {@link X509Certificate} suitable for use as a Certificate Authority
 * @throws CertificateException      if there is an generating the new certificate
 *//*from ww w  .  jav a 2s .  c  o  m*/
public static X509Certificate generateSelfSignedX509Certificate(KeyPair keyPair, String dn,
        String signingAlgorithm, int certificateDurationDays) throws CertificateException {
    try {
        ContentSigner sigGen = new JcaContentSignerBuilder(signingAlgorithm)
                .setProvider(BouncyCastleProvider.PROVIDER_NAME).build(keyPair.getPrivate());
        SubjectPublicKeyInfo subPubKeyInfo = SubjectPublicKeyInfo.getInstance(keyPair.getPublic().getEncoded());
        Date startDate = new Date();
        Date endDate = new Date(startDate.getTime() + TimeUnit.DAYS.toMillis(certificateDurationDays));

        X509v3CertificateBuilder certBuilder = new X509v3CertificateBuilder(reverseX500Name(new X500Name(dn)),
                getUniqueSerialNumber(), startDate, endDate, reverseX500Name(new X500Name(dn)), subPubKeyInfo);

        // Set certificate extensions
        // (1) digitalSignature extension
        certBuilder.addExtension(Extension.keyUsage, true,
                new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyEncipherment | KeyUsage.dataEncipherment
                        | KeyUsage.keyAgreement | KeyUsage.nonRepudiation | KeyUsage.cRLSign
                        | KeyUsage.keyCertSign));

        certBuilder.addExtension(Extension.basicConstraints, false, new BasicConstraints(true));

        certBuilder.addExtension(Extension.subjectKeyIdentifier, false,
                new JcaX509ExtensionUtils().createSubjectKeyIdentifier(keyPair.getPublic()));

        certBuilder.addExtension(Extension.authorityKeyIdentifier, false,
                new JcaX509ExtensionUtils().createAuthorityKeyIdentifier(keyPair.getPublic()));

        // (2) extendedKeyUsage extension
        certBuilder.addExtension(Extension.extendedKeyUsage, false, new ExtendedKeyUsage(
                new KeyPurposeId[] { KeyPurposeId.id_kp_clientAuth, KeyPurposeId.id_kp_serverAuth }));

        // Sign the certificate
        X509CertificateHolder certificateHolder = certBuilder.build(sigGen);
        return new JcaX509CertificateConverter().setProvider(BouncyCastleProvider.PROVIDER_NAME)
                .getCertificate(certificateHolder);
    } catch (CertIOException | NoSuchAlgorithmException | OperatorCreationException e) {
        throw new CertificateException(e);
    }
}

From source file:org.apache.nifi.registry.security.util.CertificateUtils.java

License:Apache License

/**
 * Generates an issued {@link X509Certificate} from the given issuer certificate and {@link KeyPair}
 *
 * @param dn the distinguished name to use
 * @param publicKey the public key to issue the certificate to
 * @param extensions extensions extracted from the CSR
 * @param issuer the issuer's certificate
 * @param issuerKeyPair the issuer's keypair
 * @param signingAlgorithm the signing algorithm to use
 * @param days the number of days it should be valid for
 * @return an issued {@link X509Certificate} from the given issuer certificate and {@link KeyPair}
 * @throws CertificateException if there is an error issuing the certificate
 *///ww  w .  j  av a2s  .  c o  m
public static X509Certificate generateIssuedCertificate(String dn, PublicKey publicKey, Extensions extensions,
        X509Certificate issuer, KeyPair issuerKeyPair, String signingAlgorithm, int days)
        throws CertificateException {
    try {
        ContentSigner sigGen = new JcaContentSignerBuilder(signingAlgorithm)
                .setProvider(BouncyCastleProvider.PROVIDER_NAME).build(issuerKeyPair.getPrivate());
        SubjectPublicKeyInfo subPubKeyInfo = SubjectPublicKeyInfo.getInstance(publicKey.getEncoded());
        Date startDate = new Date();
        Date endDate = new Date(startDate.getTime() + TimeUnit.DAYS.toMillis(days));

        X509v3CertificateBuilder certBuilder = new X509v3CertificateBuilder(
                reverseX500Name(new X500Name(issuer.getSubjectX500Principal().getName())),
                getUniqueSerialNumber(), startDate, endDate, reverseX500Name(new X500Name(dn)), subPubKeyInfo);

        certBuilder.addExtension(Extension.subjectKeyIdentifier, false,
                new JcaX509ExtensionUtils().createSubjectKeyIdentifier(publicKey));

        certBuilder.addExtension(Extension.authorityKeyIdentifier, false,
                new JcaX509ExtensionUtils().createAuthorityKeyIdentifier(issuerKeyPair.getPublic()));
        // Set certificate extensions
        // (1) digitalSignature extension
        certBuilder.addExtension(Extension.keyUsage, true,
                new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyEncipherment | KeyUsage.dataEncipherment
                        | KeyUsage.keyAgreement | KeyUsage.nonRepudiation));

        certBuilder.addExtension(Extension.basicConstraints, false, new BasicConstraints(false));

        // (2) extendedKeyUsage extension
        certBuilder.addExtension(Extension.extendedKeyUsage, false, new ExtendedKeyUsage(
                new KeyPurposeId[] { KeyPurposeId.id_kp_clientAuth, KeyPurposeId.id_kp_serverAuth }));

        // (3) subjectAlternativeName
        if (extensions != null && extensions.getExtension(Extension.subjectAlternativeName) != null) {
            certBuilder.addExtension(Extension.subjectAlternativeName, false,
                    extensions.getExtensionParsedValue(Extension.subjectAlternativeName));
        }

        X509CertificateHolder certificateHolder = certBuilder.build(sigGen);
        return new JcaX509CertificateConverter().setProvider(BouncyCastleProvider.PROVIDER_NAME)
                .getCertificate(certificateHolder);
    } catch (CertIOException | NoSuchAlgorithmException | OperatorCreationException e) {
        throw new CertificateException(e);
    }
}

From source file:org.apache.zookeeper.common.X509TestHelpers.java

License:Apache License

/**
 * Using the private key of the given CA key pair and the Subject of the given CA cert as the Issuer, issues a
 * new cert with the given subject and public key. The returned certificate, combined with the private key half
 * of the <code>certPublicKey</code>, should be used as the key store.
 * @param caCert the certificate of the CA that's doing the signing.
 * @param caKeyPair the key pair of the CA. The private key will be used to sign. The public key must match the
 *                  public key in the <code>caCert</code>.
 * @param certSubject the subject field of the new cert being issued.
 * @param certPublicKey the public key of the new cert being issued.
 * @param expirationMillis the expiration of the cert being issued, in milliseconds from now.
 * @return a new certificate signed by the CA's private key.
 * @throws IOException//w ww.  ja va 2s .c  o m
 * @throws OperatorCreationException
 * @throws GeneralSecurityException
 */
public static X509Certificate newCert(X509Certificate caCert, KeyPair caKeyPair, X500Name certSubject,
        PublicKey certPublicKey, long expirationMillis)
        throws IOException, OperatorCreationException, GeneralSecurityException {
    if (!caKeyPair.getPublic().equals(caCert.getPublicKey())) {
        throw new IllegalArgumentException("CA private key does not match the public key in the CA cert");
    }
    Date now = new Date();
    X509v3CertificateBuilder builder = initCertBuilder(new X500Name(caCert.getIssuerDN().getName()), now,
            new Date(now.getTime() + expirationMillis), certSubject, certPublicKey);
    builder.addExtension(Extension.basicConstraints, true, new BasicConstraints(false)); // not a CA
    builder.addExtension(Extension.keyUsage, true,
            new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyEncipherment));
    builder.addExtension(Extension.extendedKeyUsage, true, new ExtendedKeyUsage(
            new KeyPurposeId[] { KeyPurposeId.id_kp_serverAuth, KeyPurposeId.id_kp_clientAuth }));

    builder.addExtension(Extension.subjectAlternativeName, false, getLocalhostSubjectAltNames());
    return buildAndSignCertificate(caKeyPair.getPrivate(), builder);
}

From source file:org.cesecore.certificates.certificate.certextensions.standard.ExtendedKeyUsage.java

License:Open Source License

@Override
public void init(final CertificateProfile certProf) {
    super.setOID(Extension.extendedKeyUsage.getId());
    // Extended Key Usage may be either critical or non-critical
    super.setCriticalFlag(certProf.getExtendedKeyUsageCritical());
}

From source file:org.cesecore.certificates.certificateprofile.CertificateProfileTest.java

License:Open Source License

@Test
public void test06CertificateExtensions() throws Exception {
    CertificateProfile profile = new CertificateProfile(CertificateProfileConstants.CERTPROFILE_NO_PROFILE);

    // Check standard values for the certificate profile
    List<String> l = profile.getUsedStandardCertificateExtensions();
    assertEquals(6, l.size());/*w ww. ja va  2 s  .  c o m*/
    assertTrue(l.contains(Extension.keyUsage.getId()));
    assertTrue(l.contains(Extension.basicConstraints.getId()));
    assertTrue(l.contains(Extension.subjectKeyIdentifier.getId()));
    assertTrue(l.contains(Extension.authorityKeyIdentifier.getId()));
    assertTrue(l.contains(Extension.subjectAlternativeName.getId()));
    assertTrue(l.contains(Extension.issuerAlternativeName.getId()));

    CertificateProfile eprofile = new CertificateProfile(CertificateProfileConstants.CERTPROFILE_FIXED_ENDUSER);

    // Check standard values for the certificate profile
    l = eprofile.getUsedStandardCertificateExtensions();
    assertEquals(7, l.size());
    assertTrue(l.contains(Extension.keyUsage.getId()));
    assertTrue(l.contains(Extension.basicConstraints.getId()));
    assertTrue(l.contains(Extension.subjectKeyIdentifier.getId()));
    assertTrue(l.contains(Extension.authorityKeyIdentifier.getId()));
    assertTrue(l.contains(Extension.subjectAlternativeName.getId()));
    assertTrue(l.contains(Extension.issuerAlternativeName.getId()));
    assertTrue(l.contains(Extension.extendedKeyUsage.getId()));

    profile = new CertificateProfile(CertificateProfileConstants.CERTPROFILE_NO_PROFILE);
    profile.setUseAuthorityInformationAccess(true);
    profile.setUseCertificatePolicies(true);
    profile.setUseCRLDistributionPoint(true);
    profile.setUseFreshestCRL(true);
    profile.setUseMicrosoftTemplate(true);
    profile.setUseOcspNoCheck(true);
    profile.setUseQCStatement(true);
    profile.setUseExtendedKeyUsage(true);
    profile.setUseSubjectDirAttributes(true);
    l = profile.getUsedStandardCertificateExtensions();
    assertEquals(15, l.size());
    assertTrue(l.contains(Extension.keyUsage.getId()));
    assertTrue(l.contains(Extension.basicConstraints.getId()));
    assertTrue(l.contains(Extension.subjectKeyIdentifier.getId()));
    assertTrue(l.contains(Extension.authorityKeyIdentifier.getId()));
    assertTrue(l.contains(Extension.subjectAlternativeName.getId()));
    assertTrue(l.contains(Extension.issuerAlternativeName.getId()));
    assertTrue(l.contains(Extension.extendedKeyUsage.getId()));
    assertTrue(l.contains(Extension.authorityInfoAccess.getId()));
    assertTrue(l.contains(Extension.certificatePolicies.getId()));
    assertTrue(l.contains(Extension.cRLDistributionPoints.getId()));
    assertTrue(l.contains(Extension.freshestCRL.getId()));
    assertTrue(l.contains(OCSPObjectIdentifiers.id_pkix_ocsp_nocheck.getId()));
    assertTrue(l.contains(Extension.qCStatements.getId()));
    assertTrue(l.contains(Extension.subjectDirectoryAttributes.getId()));
    assertTrue(l.contains(CertTools.OID_MSTEMPLATE));
}

From source file:org.cesecore.keybind.impl.OcspKeyBindingTest.java

License:Open Source License

/** @return An extended key usage extension with id_kp_OCSPSigning set. */
private static Extension getExtendedKeyUsageExtension() throws IOException {
    final ASN1Encodable usage = KeyPurposeId.getInstance(KeyPurposeId.id_kp_OCSPSigning);
    final ASN1Sequence seq = ASN1Sequence.getInstance(new DERSequence(usage));
    return new Extension(Extension.extendedKeyUsage, true, seq.getEncoded());
}

From source file:org.cesecore.util.provider.EkuPKIXCertPathChecker.java

License:Open Source License

@Override
public void check(final Certificate cert, final Collection<String> unresolvedCritExts)
        throws CertPathValidatorException {
    if (!CertTools.isCA(cert) && cert instanceof X509Certificate) {
        final X509Certificate x509Certificate = (X509Certificate) cert;
        try {//from  w w  w  . ja  v a  2  s  .com
            List<String> ekus = x509Certificate.getExtendedKeyUsage();
            if (ekus == null) {
                ekus = EMPTY;
            }
            if (ekus.containsAll(requiredKeyPurposeOids)) {
                // All the required EKUs are present, so mark the EKU extension as processed
                unresolvedCritExts.remove(Extension.extendedKeyUsage.getId());
            } else {
                final List<String> ekusMissing = new ArrayList<String>(requiredKeyPurposeOids);
                ekusMissing.removeAll(ekus);
                if (log.isDebugEnabled()) {
                    log.debug("EKUs in certificate: " + Arrays.toString(ekus.toArray()) + " EKUs required: "
                            + Arrays.toString(requiredKeyPurposeOids.toArray()));
                }
                log.info("Validation of certificate with subject " + CertTools.getSubjectDN(cert)
                        + " failed critical EKU validation. The missing EKUs were: "
                        + Arrays.toString(ekusMissing.toArray()));
                return;
            }
        } catch (CertificateParsingException e) {
            throw new CertPathValidatorException(e);
        }
    }
}

From source file:org.cesecore.util.provider.EkuPKIXCertPathChecker.java

License:Open Source License

@Override
public Set<String> getSupportedExtensions() {
    return Collections.singleton(Extension.extendedKeyUsage.getId());
}