Example usage for org.bouncycastle.asn1.x509 Extension extendedKeyUsage

Introduction

In this page you can find the example usage for org.bouncycastle.asn1.x509 Extension extendedKeyUsage.

Prototype

ASN1ObjectIdentifier extendedKeyUsage

To view the source code for org.bouncycastle.asn1.x509 Extension extendedKeyUsage.

Click Source Link

Document

Extended Key Usage

Usage

From source file:org.openfact.common.util.CertificateUtils.java

License:Apache License

/**
 * Generates version 3 {@link X509Certificate}.
 *
 * @param keyPair the key pair//from   w w  w .  ja v a2 s .com
 * @param caPrivateKey the CA private key
 * @param caCert the CA certificate
 * @param subject the subject name
 *
 * @return the x509 certificate
 *
 * @throws Exception the exception
 */
public static X509Certificate generateV3Certificate(KeyPair keyPair, PrivateKey caPrivateKey,
        X509Certificate caCert, String subject) throws Exception {

    try {
        X500Name subjectDN = new X500Name("CN=" + subject);

        // Serial Number
        SecureRandom random = SecureRandom.getInstance("SHA1PRNG");
        BigInteger serialNumber = BigInteger.valueOf(Math.abs(random.nextInt()));

        // Validity
        Date notBefore = new Date(System.currentTimeMillis());
        Date notAfter = new Date(System.currentTimeMillis() + (((1000L * 60 * 60 * 24 * 30)) * 12) * 3);

        // SubjectPublicKeyInfo
        SubjectPublicKeyInfo subjPubKeyInfo = new SubjectPublicKeyInfo(
                ASN1Sequence.getInstance(keyPair.getPublic().getEncoded()));

        X509v3CertificateBuilder certGen = new X509v3CertificateBuilder(
                new X500Name(caCert.getSubjectDN().getName()), serialNumber, notBefore, notAfter, subjectDN,
                subjPubKeyInfo);

        DigestCalculator digCalc = new BcDigestCalculatorProvider()
                .get(new AlgorithmIdentifier(OIWObjectIdentifiers.idSHA1));
        X509ExtensionUtils x509ExtensionUtils = new X509ExtensionUtils(digCalc);

        // Subject Key Identifier
        certGen.addExtension(Extension.subjectKeyIdentifier, false,
                x509ExtensionUtils.createSubjectKeyIdentifier(subjPubKeyInfo));

        // Authority Key Identifier
        certGen.addExtension(Extension.authorityKeyIdentifier, false,
                x509ExtensionUtils.createAuthorityKeyIdentifier(subjPubKeyInfo));

        // Key Usage
        certGen.addExtension(Extension.keyUsage, false,
                new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyCertSign | KeyUsage.cRLSign));

        // Extended Key Usage
        KeyPurposeId[] EKU = new KeyPurposeId[2];
        EKU[0] = KeyPurposeId.id_kp_emailProtection;
        EKU[1] = KeyPurposeId.id_kp_serverAuth;

        certGen.addExtension(Extension.extendedKeyUsage, false, new ExtendedKeyUsage(EKU));

        // Basic Constraints
        certGen.addExtension(Extension.basicConstraints, true, new BasicConstraints(0));

        // Content Signer
        ContentSigner sigGen = new JcaContentSignerBuilder("SHA1WithRSAEncryption").setProvider("BC")
                .build(caPrivateKey);

        // Certificate
        return new JcaX509CertificateConverter().setProvider("BC").getCertificate(certGen.build(sigGen));
    } catch (Exception e) {
        throw new RuntimeException("Error creating X509v3Certificate.", e);
    }
}

---

From source file:org.picketlink.pki.internal.util.X509Util.java

License:Open Source License

/**
 * Generate version 3 {@link java.security.cert.X509Certificate}.
 *
 * @param rootCertificate the root certificate
 * @param issuerKeyPair the issuer key pair
 * @param subjectDN the subject dn/*from  w  w  w . ja  v  a  2s  .  c o m*/
 * @param subjectKeyPair the subject key pair
 * @param certificateConfig the certificate config
 *
 * @return the x509 certificate
 */
public static X509Certificate generateV3Certificate(X509Certificate rootCertificate, KeyPair issuerKeyPair,
        X500Name subjectDN, KeyPair subjectKeyPair, CertificateAuthorityConfig certificateConfig) {
    try {
        // Serial Number
        SecureRandom random = SecureRandom.getInstance("SHA1PRNG");
        BigInteger serialNumber = BigInteger.valueOf(Math.abs(random.nextInt()));

        // Validity
        Date notBefore = new Date(System.currentTimeMillis());
        Date notAfter = new Date(System.currentTimeMillis() + (((1000L * 60 * 60 * 24 * 30)) * 12) * 3);

        // SubjectPublicKeyInfo
        SubjectPublicKeyInfo subjPubKeyInfo = new SubjectPublicKeyInfo(
                ASN1Sequence.getInstance(subjectKeyPair.getPublic().getEncoded()));

        X509v3CertificateBuilder certGen = new X509v3CertificateBuilder(
                new X500Name(rootCertificate.getSubjectDN().getName()), serialNumber, notBefore, notAfter,
                subjectDN, subjPubKeyInfo);

        DigestCalculator digCalc = new BcDigestCalculatorProvider()
                .get(new AlgorithmIdentifier(OIWObjectIdentifiers.idSHA1));
        X509ExtensionUtils x509ExtensionUtils = new X509ExtensionUtils(digCalc);

        // Subject Key Identifier
        certGen.addExtension(Extension.subjectKeyIdentifier, false,
                x509ExtensionUtils.createSubjectKeyIdentifier(subjPubKeyInfo));

        // Authority Key Identifier
        certGen.addExtension(Extension.authorityKeyIdentifier, false,
                x509ExtensionUtils.createAuthorityKeyIdentifier(subjPubKeyInfo));

        // Key Usage
        certGen.addExtension(Extension.keyUsage, false,
                new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyCertSign | KeyUsage.cRLSign));

        // Extended Key Usage
        KeyPurposeId[] EKU = new KeyPurposeId[2];
        EKU[0] = KeyPurposeId.id_kp_emailProtection;
        EKU[1] = KeyPurposeId.id_kp_serverAuth;

        certGen.addExtension(Extension.extendedKeyUsage, false, new ExtendedKeyUsage(EKU));

        // Basic Constraints
        certGen.addExtension(Extension.basicConstraints, true, new BasicConstraints(0));

        // Certificate Policies
        /* PolicyInformation[] certPolicies = new PolicyInformation[2];
        certPolicies[0] = new PolicyInformation(new ASN1ObjectIdentifier("2.16.840.1.101.2.1.11.5"));
        certPolicies[1] = new PolicyInformation(new ASN1ObjectIdentifier("2.16.840.1.101.2.1.11.18"));
                
        certGen.addExtension(Extension.certificatePolicies, false, new CertificatePolicies(certPolicies));
                
        // Authority Information Access
        AccessDescription caIssuers = new AccessDescription(AccessDescription.id_ad_caIssuers, new GeneralName(
            GeneralName.uniformResourceIdentifier, new DERIA5String("http://www.somewebsite.com/ca.cer")));
        AccessDescription ocsp = new AccessDescription(AccessDescription.id_ad_ocsp, new GeneralName(
            GeneralName.uniformResourceIdentifier, new DERIA5String("http://ocsp.somewebsite.com")));
                
        ASN1EncodableVector aia_ASN = new ASN1EncodableVector();
        aia_ASN.add(caIssuers);
        aia_ASN.add(ocsp);
                
        certGen.addExtension(Extension.authorityInfoAccess, false, new DERSequence(aia_ASN));
                
        // CRL Distribution Points
        DistributionPointName distPointOne = new DistributionPointName(new GeneralNames(new GeneralName(
            GeneralName.uniformResourceIdentifier, "http://crl.somewebsite.com/master.crl")));
        DistributionPointName distPointTwo = new DistributionPointName(
            new GeneralNames(
                    new GeneralName(GeneralName.uniformResourceIdentifier,
                            "ldap://crl.somewebsite.com/cn%3dSecureCA%2cou%3dPKI%2co%3dCyberdyne%2cc%3dUS?certificaterevocationlist;binary")));
                
        DistributionPoint[] distPoints = new DistributionPoint[2];
        distPoints[0] = new DistributionPoint(distPointOne, null, null);
        distPoints[1] = new DistributionPoint(distPointTwo, null, null);
                
        certGen.addExtension(Extension.cRLDistributionPoints, false, new CRLDistPoint(distPoints));*/

        // Content Signer
        ContentSigner sigGen = new JcaContentSignerBuilder("SHA1WithRSAEncryption").setProvider("BC")
                .build(issuerKeyPair.getPrivate());

        // Certificate
        return new JcaX509CertificateConverter().setProvider("BC").getCertificate(certGen.build(sigGen));
    } catch (Exception e) {
        throw new RuntimeException("Error creating X509v3Certificate.", e);
    }
}

---

From source file:org.signserver.module.xades.validator.XAdESValidator2UnitTest.java

License:Open Source License

/**
 * Setting up key-pairs, mocked crypto tokens, certificates and CRLs used
 * by the tests./*from  ww  w  .  j av  a2  s  .c  o  m*/
 */
@BeforeClass
public static void setUpClass() throws Exception {
    Security.addProvider(new BouncyCastleProvider());
    JcaX509CertificateConverter conv = new JcaX509CertificateConverter();

    // Root CA, sub CA
    rootcaCRLFile = File.createTempFile("xadestest-", "-rootca.crl");
    LOG.debug("rootcaCRLFile: " + rootcaCRLFile);
    subca1CRLFile = File.createTempFile("xadestest-", "-subca.crl");
    LOG.debug("subcaCRLFile: " + subca1CRLFile);
    rootcaKeyPair = CryptoUtils.generateRSA(1024);
    anotherKeyPair = CryptoUtils.generateRSA(1024);
    rootcaCert = new CertBuilder().setSelfSignKeyPair(rootcaKeyPair).setSubject("CN=Root, O=XAdES Test, C=SE")
            .addExtension(new CertExt(Extension.keyUsage, false,
                    new X509KeyUsage(
                            X509KeyUsage.keyCertSign | X509KeyUsage.cRLSign | X509KeyUsage.digitalSignature)))
            .addExtension(new CertExt(Extension.basicConstraints, false, new BasicConstraints(true))).build();
    final KeyPair subca1KeyPair = CryptoUtils.generateRSA(1024);
    subca1Cert = new CertBuilder().setIssuerPrivateKey(rootcaKeyPair.getPrivate())
            .setIssuer(rootcaCert.getSubject()).setSubjectPublicKey(subca1KeyPair.getPublic())
            .addCDPURI(rootcaCRLFile.toURI().toURL().toExternalForm())
            .setSubject("CN=Sub 1, O=XAdES Test, C=SE")
            .addExtension(new CertExt(Extension.keyUsage, false,
                    new X509KeyUsage(X509KeyUsage.keyCertSign | X509KeyUsage.cRLSign)))
            .addExtension(new CertExt(Extension.basicConstraints, false, new BasicConstraints(true))).build();
    subca2KeyPair = CryptoUtils.generateRSA(1024);
    subca2Cert = new CertBuilder().setIssuerPrivateKey(rootcaKeyPair.getPrivate())
            .setIssuer(rootcaCert.getSubject()).setSubjectPublicKey(subca2KeyPair.getPublic())
            .setSubject("CN=Sub 2, O=XAdES Test, C=SE")
            .addExtension(new CertExt(Extension.keyUsage, false,
                    new X509KeyUsage(
                            X509KeyUsage.keyCertSign | X509KeyUsage.cRLSign | X509KeyUsage.digitalSignature)))
            .addExtension(new CertExt(Extension.basicConstraints, false, new BasicConstraints(true)))
            .addExtension(new CertExt(Extension.authorityInfoAccess, false,
                    new AuthorityInformationAccess(AccessDescription.id_ad_ocsp,
                            new GeneralName(GeneralName.uniformResourceIdentifier, "http://ocsp.example.com"))))
            .build();

    // Signer 1 is issued directly by the root CA
    final KeyPair signer1KeyPair = CryptoUtils.generateRSA(1024);
    final X509CertificateHolder signer1Cert = new CertBuilder().setIssuerPrivateKey(rootcaKeyPair.getPrivate())
            .setIssuer(rootcaCert.getSubject()).setSubjectPublicKey(signer1KeyPair.getPublic())
            .setSubject("CN=Signer 1, O=XAdES Test, C=SE")
            .addCDPURI(rootcaCRLFile.toURI().toURL().toExternalForm())
            .addExtension(new CertExt(Extension.basicConstraints, false, new BasicConstraints(false))).build();
    final List<Certificate> chain1 = Arrays.<Certificate>asList(conv.getCertificate(signer1Cert),
            conv.getCertificate(rootcaCert));
    token1 = new MockedCryptoToken(signer1KeyPair.getPrivate(), signer1KeyPair.getPublic(),
            conv.getCertificate(signer1Cert), chain1, "BC");
    LOG.debug("Chain 1: \n" + new String(CertTools.getPEMFromCerts(chain1), "ASCII") + "\n");

    // Sign a document by signer 1
    XAdESSigner instance = new MockedXAdESSigner(token1);
    WorkerConfig config = new WorkerConfig();
    instance.init(4712, config, null, null);
    RequestContext requestContext = new RequestContext();
    requestContext.put(RequestContext.TRANSACTION_ID, "0000-201-1");
    GenericSignRequest request = new GenericSignRequest(201, "<test201/>".getBytes("UTF-8"));
    GenericSignResponse response = (GenericSignResponse) instance.processData(request, requestContext);
    byte[] data = response.getProcessedData();
    signedXml1 = new String(data);
    LOG.debug("Signed document by signer 1:\n\n" + signedXml1 + "\n");

    // Signer 2 is issued by the sub CA
    final KeyPair signer2KeyPair = CryptoUtils.generateRSA(1024);
    final X509CertificateHolder signer2Cert = new CertBuilder().setIssuerPrivateKey(subca1KeyPair.getPrivate())
            .setIssuer(subca1Cert.getSubject()).setSubjectPublicKey(signer2KeyPair.getPublic())
            .setSubject("CN=Signer 2, O=XAdES Test, C=SE")
            .addCDPURI(subca1CRLFile.toURI().toURL().toExternalForm())
            .addExtension(new CertExt(Extension.basicConstraints, false, new BasicConstraints(false))).build();
    final List<Certificate> chain2 = Arrays.<Certificate>asList(conv.getCertificate(signer2Cert),
            conv.getCertificate(subca1Cert), conv.getCertificate(rootcaCert));
    token2 = new MockedCryptoToken(signer2KeyPair.getPrivate(), signer2KeyPair.getPublic(),
            conv.getCertificate(signer2Cert), chain2, "BC");
    LOG.debug("Chain 2: \n" + new String(CertTools.getPEMFromCerts(chain2)) + "\n");

    // Sign a document by signer 2
    instance = new MockedXAdESSigner(token2);
    config = new WorkerConfig();
    instance.init(4713, config, null, null);
    requestContext = new RequestContext();
    requestContext.put(RequestContext.TRANSACTION_ID, "0000-202-1");
    request = new GenericSignRequest(202, "<test202/>".getBytes("UTF-8"));
    response = (GenericSignResponse) instance.processData(request, requestContext);
    data = response.getProcessedData();
    signedXml2 = new String(data);
    LOG.debug("Signed document by signer 2:\n\n" + signedXml2 + "\n");

    // CRL with all active (empty CRL)
    rootcaCRLEmpty = new CRLBuilder().setIssuerPrivateKey(rootcaKeyPair.getPrivate())
            .setIssuer(rootcaCert.getSubject()).build();
    subca1CRLEmpty = new CRLBuilder().setIssuerPrivateKey(subca1KeyPair.getPrivate())
            .setIssuer(subca1Cert.getSubject()).build();
    rootcaCRLSubCAAndSigner1Revoked = new CRLBuilder().setIssuerPrivateKey(rootcaKeyPair.getPrivate())
            .setIssuer(rootcaCert.getSubject())
            .addCRLEntry(subca1Cert.getSerialNumber(), new Date(), CRLReason.keyCompromise)
            .addCRLEntry(signer1Cert.getSerialNumber(), new Date(), CRLReason.keyCompromise).build();
    subca1CRLSigner2Revoked = new CRLBuilder().setIssuerPrivateKey(subca1KeyPair.getPrivate())
            .setIssuer(subca1Cert.getSubject())
            .addCRLEntry(signer2Cert.getSerialNumber(), new Date(), CRLReason.keyCompromise).build();
    otherCRL = new CRLBuilder().setIssuer(subca1Cert.getSubject()) // Setting Sub CA DN all though an other key will be used
            .build();

    // signer 3, issued by the root CA with an OCSP authority information access in the signer cert
    final KeyPair signer3KeyPair = CryptoUtils.generateRSA(1024);
    signer3Cert = new CertBuilder().setIssuerPrivateKey(rootcaKeyPair.getPrivate())
            .setIssuer(rootcaCert.getSubject()).setSubjectPublicKey(signer3KeyPair.getPublic())
            .setSubject("CN=Signer 3, O=XAdES Test, C=SE")
            .addExtension(new CertExt(Extension.authorityInfoAccess, false,
                    new AuthorityInformationAccess(AccessDescription.id_ad_ocsp,
                            new GeneralName(GeneralName.uniformResourceIdentifier, "http://ocsp.example.com"))))
            .addExtension(new CertExt(Extension.basicConstraints, false, new BasicConstraints(false))).build();
    final List<Certificate> chain3 = Arrays.<Certificate>asList(conv.getCertificate(signer3Cert),
            conv.getCertificate(rootcaCert));
    token3 = new MockedCryptoToken(signer3KeyPair.getPrivate(), signer3KeyPair.getPublic(),
            conv.getCertificate(signer3Cert), chain3, "BC");
    LOG.debug("Chain 3: \n" + new String(CertTools.getPEMFromCerts(chain3)) + "\n");

    // signer 4, issued by the sub CA2 with an OCSP authority information access in the signer cert
    final KeyPair signer4KeyPair = CryptoUtils.generateRSA(1024);
    signer4Cert = new CertBuilder().setIssuerPrivateKey(subca2KeyPair.getPrivate())
            .setIssuer(subca2Cert.getSubject()).setSubjectPublicKey(signer4KeyPair.getPublic())
            .setSubject("CN=Signer 4, O=XAdES Test, C=SE")
            .addExtension(new CertExt(Extension.authorityInfoAccess, false,
                    new AuthorityInformationAccess(AccessDescription.id_ad_ocsp,
                            new GeneralName(GeneralName.uniformResourceIdentifier, "http://ocsp.example.com"))))
            .addExtension(new CertExt(Extension.basicConstraints, false, new BasicConstraints(false))).build();
    final List<Certificate> chain4 = Arrays.<Certificate>asList(conv.getCertificate(signer4Cert),
            conv.getCertificate(subca2Cert), conv.getCertificate(rootcaCert));
    token4 = new MockedCryptoToken(signer4KeyPair.getPrivate(), signer4KeyPair.getPublic(),
            conv.getCertificate(signer4Cert), chain4, "BC");
    LOG.debug("Chain 4: \n" + new String(CertTools.getPEMFromCerts(chain4)) + "\n");

    // ocspSigner 1, OCSP responder issued by the root CA with an ocsp-nocheck in the signer cert
    ocspSigner1KeyPair = CryptoUtils.generateRSA(1024);
    ocspSigner1Cert = new CertBuilder().setIssuerPrivateKey(rootcaKeyPair.getPrivate())
            .setIssuer(rootcaCert.getSubject()).setSubjectPublicKey(ocspSigner1KeyPair.getPublic())
            .setSubject("CN=OCSP Responder 1, O=XAdES Test, C=SE")
            .addExtension(new CertExt(Extension.basicConstraints, false, new BasicConstraints(false)))
            .addExtension(new CertExt(Extension.extendedKeyUsage, false,
                    new ExtendedKeyUsage(KeyPurposeId.id_kp_OCSPSigning)))
            .addExtension(new CertExt(OCSPObjectIdentifiers.id_pkix_ocsp_nocheck, false, new DERNull()))
            .build();

    // ocspSigner 2, OCSP responder issued by the sub CA2 with an ocsp-nocheck in the signer cert
    ocspSigner2KeyPair = CryptoUtils.generateRSA(1024);
    ocspSigner2Cert = new CertBuilder().setIssuerPrivateKey(subca2KeyPair.getPrivate())
            .setIssuer(subca2Cert.getSubject()).setSubjectPublicKey(ocspSigner2KeyPair.getPublic())
            .setSubject("CN=OCSP Responder 2, O=XAdES Test, C=SE")
            .addExtension(new CertExt(Extension.basicConstraints, false, new BasicConstraints(false)))
            .addExtension(new CertExt(Extension.extendedKeyUsage, false,
                    new ExtendedKeyUsage(KeyPurposeId.id_kp_OCSPSigning)))
            .addExtension(new CertExt(OCSPObjectIdentifiers.id_pkix_ocsp_nocheck, false, new DERNull()))
            .build();

    // Sign a document by signer 3
    instance = new MockedXAdESSigner(token3);
    config = new WorkerConfig();
    instance.init(4714, config, null, null);
    requestContext = new RequestContext();
    requestContext.put(RequestContext.TRANSACTION_ID, "0000-203-1");
    request = new GenericSignRequest(202, "<test203/>".getBytes("UTF-8"));
    response = (GenericSignResponse) instance.processData(request, requestContext);
    data = response.getProcessedData();
    signedXml3 = new String(data);
    LOG.debug("Signed document by signer 3:\n\n" + signedXml3 + "\n");

    // Sign a document by signer 4
    instance = new MockedXAdESSigner(token4);
    config = new WorkerConfig();
    instance.init(4715, config, null, null);
    requestContext = new RequestContext();
    requestContext.put(RequestContext.TRANSACTION_ID, "0000-204-1");
    request = new GenericSignRequest(203, "<test204/>".getBytes("UTF-8"));
    response = (GenericSignResponse) instance.processData(request, requestContext);
    data = response.getProcessedData();
    signedXml4 = new String(data);
    LOG.debug("Signed document by signer 4:\n\n" + signedXml4 + "\n");

    // Signer 5 is issued directly by the root CA
    final KeyPair signer5KeyPair = CryptoUtils.generateRSA(1024);
    signer5Cert = new CertBuilder().setIssuerPrivateKey(rootcaKeyPair.getPrivate())
            .setIssuer(rootcaCert.getSubject()).setSubjectPublicKey(signer5KeyPair.getPublic())
            .setSubject("CN=Signer 5, O=XAdES Test, C=SE")
            .addCDPURI(rootcaCRLFile.toURI().toURL().toExternalForm())
            .addExtension(new CertExt(Extension.authorityInfoAccess, false,
                    new AuthorityInformationAccess(AccessDescription.id_ad_ocsp,
                            new GeneralName(GeneralName.uniformResourceIdentifier, "http://ocsp.example.com"))))
            .addExtension(new CertExt(Extension.basicConstraints, false, new BasicConstraints(false))).build();
    final List<Certificate> chain5 = Arrays.<Certificate>asList(conv.getCertificate(signer5Cert),
            conv.getCertificate(rootcaCert));
    token5 = new MockedCryptoToken(signer5KeyPair.getPrivate(), signer5KeyPair.getPublic(),
            conv.getCertificate(signer1Cert), chain5, "BC");
    LOG.debug("Chain 5: \n" + new String(CertTools.getPEMFromCerts(chain5)) + "\n");

    // Sign a document by signer 5
    instance = new MockedXAdESSigner(token5);
    config = new WorkerConfig();
    instance.init(4712, config, null, null);
    requestContext = new RequestContext();
    requestContext.put(RequestContext.TRANSACTION_ID, "0000-205-1");
    request = new GenericSignRequest(205, "<test205/>".getBytes("UTF-8"));
    response = (GenericSignResponse) instance.processData(request, requestContext);
    data = response.getProcessedData();
    signedXml5 = new String(data);
    LOG.debug("Signed document by signer 5:\n\n" + signedXml5 + "\n");

    // CRL with signer 5 revoked
    rootcaCRLSigner5Revoked = new CRLBuilder().setIssuerPrivateKey(rootcaKeyPair.getPrivate())
            .setIssuer(rootcaCert.getSubject())
            .addCRLEntry(signer5Cert.getSerialNumber(), new Date(), CRLReason.keyCompromise).build();
}

---

From source file:org.usrz.libs.crypto.cert.X509CertificateBuilder.java

License:Apache License

/**
 * Build the final {@link X509Certificate} instance.
 *//*  w ww.java 2  s . c  om*/
public X509Certificate build() {
    if (subject == null)
        throw new IllegalStateException("Subject not specified");
    if (issuer == null)
        throw new IllegalStateException("Issuer not specified");
    if (serial == null)
        throw new IllegalStateException("Serial not specified");
    if (!notAfter.after(notBefore))
        throw new IllegalStateException("Date \"not-after\" before or equal to \"not-before\"");
    if (issuerPrivateKey == null)
        throw new IllegalStateException("Issuer private key not specified");
    if (subjectPublicKey == null)
        throw new IllegalStateException("Sobject public key not specified");

    /* Standard subject public key and X500 names */
    final SubjectPublicKeyInfo subjectPublicKeyInfo = SubjectPublicKeyInfo
            .getInstance(subjectPublicKey.getEncoded());
    final X500Name subjectName = X500Name.getInstance(subject.getEncoded());
    final X500Name issuerName = X500Name.getInstance(issuer.getEncoded());

    /* Derive the issuer public key from the private one if needed/possible */
    if ((issuerPublicKey == null) && (issuerPrivateKey instanceof RSAPrivateCrtKey))
        try {
            final RSAPrivateCrtKey key = (RSAPrivateCrtKey) issuerPrivateKey;
            final RSAPublicKeySpec spec = new RSAPublicKeySpec(key.getModulus(), key.getPublicExponent());
            issuerPublicKey = KeyFactory.getInstance("RSA").generatePublic(spec);
        } catch (InvalidKeySpecException | NoSuchAlgorithmException exception) {
            Logger.getLogger(this.getClass().getName()).log(Level.FINE,
                    "Unable to generate public key from private", exception);
        }

    final X509v3CertificateBuilder certificateBuilder = new X509v3CertificateBuilder(issuerName, serial,
            notBefore, notAfter, subjectName, subjectPublicKeyInfo);

    try {
        final JcaX509ExtensionUtils utils = new JcaX509ExtensionUtils();

        /* Are we a certificate authority? */
        certificateBuilder.addExtension(Extension.basicConstraints, true,
                new BasicConstraints(Mode.AUTHORITY.equals(mode)));

        /* Add our subject key identifier */
        certificateBuilder.addExtension(Extension.subjectKeyIdentifier, false,
                utils.createSubjectKeyIdentifier(subjectPublicKeyInfo));

        /* Do we have Standard key usages? */
        if (!standardKeyUsage.isEmpty())
            certificateBuilder.addExtension(Extension.keyUsage, false,
                    new KeyUsage(StandardKeyUsage.combine(standardKeyUsage)));

        /* Do we have extended key usages? */
        if (!extendedKeyUsage.isEmpty())
            certificateBuilder.addExtension(Extension.extendedKeyUsage, false,
                    ExtendedKeyUsage.combine(extendedKeyUsage));

        /* Add our authority key identifer */
        if (issuerPublicKey != null) {
            final SubjectPublicKeyInfo authorityPublicKeyInfo = SubjectPublicKeyInfo
                    .getInstance(issuerPublicKey.getEncoded());
            certificateBuilder.addExtension(Extension.authorityKeyIdentifier, false,
                    utils.createAuthorityKeyIdentifier(authorityPublicKeyInfo));
        }

        /* Add our alternative names */
        if (!alternativeNames.isEmpty()) {
            final GeneralName[] names = alternativeNames.toArray(new GeneralName[alternativeNames.size()]);
            certificateBuilder.addExtension(Extension.subjectAlternativeName, false, new GeneralNames(names));
        }

        /* Add CRL distribution points */
        if (!crlDistributionPoints.isEmpty()) {
            final DistributionPoint[] distributionPoints = new DistributionPoint[crlDistributionPoints.size()];
            int position = 0;
            for (GeneralName generalName : crlDistributionPoints) {
                final DistributionPointName distributionPointName = new DistributionPointName(
                        new GeneralNames(generalName));
                distributionPoints[position++] = new DistributionPoint(distributionPointName, null, null);
            }
            final CRLDistPoint crlDistributionPoint = new CRLDistPoint(distributionPoints);
            certificateBuilder.addExtension(Extension.cRLDistributionPoints, false, crlDistributionPoint);
        }

    } catch (CertIOException | NoSuchAlgorithmException exception) {
        throw new IllegalStateException("Exception adding extensions", exception);
    }

    try {
        final CertificateFactory factory = CertificateFactory.getInstance("X.509");
        final String signatureAlgorithm = CryptoUtils.getSignatureAlgorithm(issuerPrivateKey, hash);
        final ContentSigner signer = new JcaContentSignerBuilder(signatureAlgorithm).build(issuerPrivateKey);
        final X509CertificateHolder certificateHolder = certificateBuilder.build(signer);
        return (X509Certificate) factory
                .generateCertificate(new ByteArrayInputStream(certificateHolder.getEncoded()));
    } catch (OperatorCreationException exception) {
        throw new IllegalStateException("Unable to create certificate signature", exception);
    } catch (IOException exception) {
        throw new IllegalStateException("Unable to generate certificate data", exception);
    } catch (CertificateException exception) {
        throw new IllegalStateException("Unable to generate certificate", exception);
    }
}

---

From source file:org.wso2.carbon.device.mgt.mobile.windows.api.services.enrollment.util.CertificateSigningService.java

License:Open Source License

/**
 * Implement certificate signing task using CSR received from the device and the MDM server key
 * store.//from   ww  w . j  a  v  a2s.co m
 * @param jcaRequest        - CSR from the device
 * @param privateKey        - Private key of CA certificate in MDM server
 * @param caCert            - CA certificate in MDM server
 * @param certParameterList - Parameter list for Signed certificate generation
 * @return - Signed certificate for CSR from device
 * @throws CertificateGenerationException
 * @throws WAPProvisioningException
 */
public static X509Certificate signCSR(JcaPKCS10CertificationRequest jcaRequest, PrivateKey privateKey,
        X509Certificate caCert, List certParameterList)
        throws CertificateGenerationException, WAPProvisioningException {

    String commonName = (String) certParameterList.get(PropertyIndex.COMMON_NAME_INDEX.getValue());
    int notBeforeDays = (Integer) certParameterList.get(PropertyIndex.NOT_BEFORE_DAYS_INDEX.getValue());
    int notAfterDays = (Integer) certParameterList.get(PropertyIndex.NOT_AFTER_DAYS_INDEX.getValue());
    X509v3CertificateBuilder certificateBuilder;
    X509Certificate signedCertificate;

    try {
        ContentSigner signer;
        BigInteger serialNumber = BigInteger.valueOf(new SecureRandom().nextInt(Integer.MAX_VALUE));
        Date notBeforeDate = new Date(System.currentTimeMillis() - (MILLI_SECONDS * notBeforeDays));
        Date notAfterDate = new Date(System.currentTimeMillis() + (MILLI_SECONDS * notAfterDays));
        certificateBuilder = new JcaX509v3CertificateBuilder(caCert, serialNumber, notBeforeDate, notAfterDate,
                new X500Principal(commonName), jcaRequest.getPublicKey());

        //Adding extensions to the signed certificate.
        certificateBuilder.addExtension(Extension.keyUsage, true, new KeyUsage(KeyUsage.digitalSignature));
        certificateBuilder.addExtension(Extension.extendedKeyUsage, false,
                new ExtendedKeyUsage(KeyPurposeId.id_kp_clientAuth));
        certificateBuilder.addExtension(Extension.basicConstraints, true, new BasicConstraints(false));

        signer = new JcaContentSignerBuilder(PluginConstants.CertificateEnrolment.ALGORITHM)
                .setProvider(PluginConstants.CertificateEnrolment.PROVIDER).build(privateKey);

        signedCertificate = new JcaX509CertificateConverter()
                .setProvider(PluginConstants.CertificateEnrolment.PROVIDER)
                .getCertificate(certificateBuilder.build(signer));
    } catch (InvalidKeyException e) {
        throw new CertificateGenerationException("CSR's public key is invalid", e);
    } catch (NoSuchAlgorithmException e) {
        throw new CertificateGenerationException("Certificate cannot be generated", e);
    } catch (CertIOException e) {
        throw new CertificateGenerationException("Cannot add extension(s) to signed certificate", e);
    } catch (OperatorCreationException e) {
        throw new CertificateGenerationException("Content signer cannot be created", e);
    } catch (CertificateException e) {
        throw new CertificateGenerationException("Signed certificate cannot be generated", e);
    }
    return signedCertificate;
}

---

From source file:org.wso2.carbon.identity.certificateauthority.CAAdminService.java

License:Open Source License

protected X509Certificate signCSR(String serialNo, PKCS10CertificationRequest request, int validity,
        PrivateKey privateKey, X509Certificate caCert) throws CaException {
    try {//from   www.j av a  2s . c o  m

        Date issuedDate = new Date();
        Date expiryDate = new Date(System.currentTimeMillis() + validity * MILLIS_PER_DAY);
        JcaPKCS10CertificationRequest jcaRequest = new JcaPKCS10CertificationRequest(request);
        X509v3CertificateBuilder certificateBuilder = new JcaX509v3CertificateBuilder(caCert,
                new BigInteger(serialNo), issuedDate, expiryDate, jcaRequest.getSubject(),
                jcaRequest.getPublicKey());
        JcaX509ExtensionUtils extUtils = new JcaX509ExtensionUtils();
        certificateBuilder
                .addExtension(Extension.authorityKeyIdentifier, false,
                        extUtils.createAuthorityKeyIdentifier(caCert))
                .addExtension(Extension.subjectKeyIdentifier, false,
                        extUtils.createSubjectKeyIdentifier(jcaRequest.getPublicKey()))
                .addExtension(Extension.basicConstraints, true, new BasicConstraints(0))
                .addExtension(Extension.keyUsage, true,
                        new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyEncipherment))
                .addExtension(Extension.extendedKeyUsage, true,
                        new ExtendedKeyUsage(KeyPurposeId.id_kp_serverAuth));
        ContentSigner signer = new JcaContentSignerBuilder("SHA1withRSA").setProvider("BC").build(privateKey);
        //todo add ocsp extension
        int tenantID = PrivilegedCarbonContext.getThreadLocalCarbonContext().getTenantId();
        DistributionPointName crlEp = new DistributionPointName(new GeneralNames(new GeneralName(
                GeneralName.uniformResourceIdentifier, CAUtils.getServerURL() + "/ca/crl/" + tenantID)));
        DistributionPoint disPoint = new DistributionPoint(crlEp, null, null);
        certificateBuilder.addExtension(Extension.cRLDistributionPoints, false,
                new CRLDistPoint(new DistributionPoint[] { disPoint }));
        AccessDescription ocsp = new AccessDescription(AccessDescription.id_ad_ocsp, new GeneralName(
                GeneralName.uniformResourceIdentifier, CAUtils.getServerURL() + "/ca/ocsp/" + tenantID));
        ASN1EncodableVector authInfoAccessASN = new ASN1EncodableVector();
        authInfoAccessASN.add(ocsp);
        certificateBuilder.addExtension(Extension.authorityInfoAccess, false,
                new DERSequence(authInfoAccessASN));
        return new JcaX509CertificateConverter().setProvider("BC")
                .getCertificate(certificateBuilder.build(signer));

        //            AccessDescription ocsp = new AccessDescription(ID_AD_OCSP,
        //                    new GeneralName(GeneralName.uniformResourceIdentifier,
        //                            new DERIA5String(CAUtils.getServerURL()+"/ca/ocsp/" + tenantID))
        //            );
        //
        //            ASN1EncodableVector authInfoAccessASN = new ASN1EncodableVector();
        //            authInfoAccessASN.add(ocsp);
        //
        //            certGen.addExtension(X509Extensions.AuthorityInfoAccess, false, new DERSequence(authInfoAccessASN));
        //
        //            DistributionPointName crlEP = new DistributionPointName(DNP_TYPE, new GeneralNames(
        //                    new GeneralName(GeneralName.uniformResourceIdentifier, CAUtils.getServerURL()+"/ca/crl/" + tenantID)));
        //
        //            DistributionPoint[] distPoints = new DistributionPoint[1];
        //            distPoints[0] = new DistributionPoint(crlEP, null, null);
        //
        //            certGen.addExtension(X509Extensions.CRLDistributionPoints, false, new CRLDistPoint(distPoints));
        //
        //            ASN1Set attributes = request.getCertificationRequestInfo().getAttributes();
        //            for (int i = 0; i != attributes.size(); i++) {
        //                Attribute attr = Attribute.getInstance(attributes.getObjectAt(i));
        //
        //                if (attr.getAttrType().equals(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest)) {
        //                    X509Extensions extensions = X509Extensions.getInstance(attr.getAttrValues().getObjectAt(0));
        //
        //                    Enumeration e = extensions.oids();
        //                    while (e.hasMoreElements()) {
        //                        DERObjectIdentifier oid = (DERObjectIdentifier) e.nextElement();
        //                        X509Extension ext = extensions.getExtension(oid);
        //
        //                        certGen.addExtension(oid, ext.isCritical(), ext.getValue().getOctets());
        //                    }
        //                }
        //            }
        //            X509Certificate issuedCert = certGen.generateX509Certificate(privateKey);
        //            return issuedCert;
    } catch (Exception e) {
        throw new CaException("Error in signing the certificate", e);
    }
}

---

From source file:org.wso2.carbon.mdm.mobileservices.windowspc.services.wstep.util.CertificateSigningService.java

License:Open Source License

/**
 * @param jcaRequest        - CSR from the device
 * @param privateKey        - Private key of CA certificate in MDM server
 * @param CACert            - CA certificate in MDM server
 * @param certParameterList - Parameter list for Signed certificate generation
 * @return - Signed certificate for CSR from device
 * @throws Exception//from ww  w.  j a v  a 2s  .  co m
 */
public static X509Certificate signCSR(JcaPKCS10CertificationRequest jcaRequest, PrivateKey privateKey,
        X509Certificate CACert, List certParameterList)
        throws CertificateGenerationException, XMLFileOperationException {

    String commonName = (String) certParameterList.get(FIRST_ITEM);
    int notBeforeDate = (Integer) certParameterList.get(SECOND_ITEM);
    int notAfterDate = (Integer) certParameterList.get(THIRD_ITEM);

    X509v3CertificateBuilder certificateBuilder;

    try {

        certificateBuilder = new JcaX509v3CertificateBuilder(CACert,
                BigInteger.valueOf(new SecureRandom().nextInt(Integer.MAX_VALUE)),
                new Date(System.currentTimeMillis() - (DAYS * notBeforeDate)),
                new Date(System.currentTimeMillis() + (DAYS * notAfterDate)), new X500Principal(commonName),
                jcaRequest.getPublicKey());

    } catch (InvalidKeyException e) {
        throw new CertificateGenerationException("CSR's public key is invalid", e);
    } catch (NoSuchAlgorithmException e) {
        throw new CertificateGenerationException("Certificate cannot be generated", e);
    }

    try {

        certificateBuilder.addExtension(Extension.keyUsage, true, new KeyUsage(KeyUsage.digitalSignature));
        certificateBuilder.addExtension(Extension.extendedKeyUsage, false,
                new ExtendedKeyUsage(KeyPurposeId.id_kp_clientAuth));
        certificateBuilder.addExtension(Extension.basicConstraints, true, new BasicConstraints(false));

    } catch (CertIOException e) {
        throw new CertificateGenerationException("Cannot add extension(s) to signed certificate", e);
    }

    ContentSigner signer;
    try {
        signer = new JcaContentSignerBuilder(Constants.CertificateEnrollment.ALGORITHM)
                .setProvider(Constants.CertificateEnrollment.PROVIDER).build(privateKey);
    } catch (OperatorCreationException e) {
        throw new CertificateGenerationException("Content signer cannot be created", e);
    }

    X509Certificate signedCertificate;
    try {
        signedCertificate = new JcaX509CertificateConverter()
                .setProvider(Constants.CertificateEnrollment.PROVIDER)
                .getCertificate(certificateBuilder.build(signer));
    } catch (CertificateException e) {
        throw new CertificateGenerationException("Signed certificate cannot generated", e);
    }
    return signedCertificate;
}

---

From source file:org.xipki.ca.certprofile.internal.ProfileConfCreatorDemo.java

License:Open Source License

private static X509ProfileType Certprofile_OCSP() throws Exception {
    X509ProfileType profile = getBaseProfile("Certprofile OCSP", false, "5y", false, new String[] { "SHA256" });

    // Subject/*from  w  w w  . j  a  va 2 s  .c o  m*/
    Subject subject = profile.getSubject();
    subject.setIncSerialNumber(false);

    List<RdnType> rdnControls = subject.getRdn();
    rdnControls.add(createRDN(ObjectIdentifiers.DN_C, 1, 1, new String[] { "DE|FR" }, null, null));
    rdnControls.add(createRDN(ObjectIdentifiers.DN_O, 1, 1));
    rdnControls.add(createRDN(ObjectIdentifiers.DN_OU, 0, 1));
    rdnControls.add(createRDN(ObjectIdentifiers.DN_SN, 0, 1, new String[] { REGEX_SN }, null, null));
    rdnControls.add(createRDN(ObjectIdentifiers.DN_CN, 1, 1));

    // Extensions
    ExtensionsType extensions = profile.getExtensions();
    List<ExtensionType> list = extensions.getExtension();

    list.add(createExtension(Extension.subjectKeyIdentifier, true, false, null));
    list.add(createExtension(Extension.cRLDistributionPoints, false, false, null));
    list.add(createExtension(Extension.freshestCRL, false, false, null));
    list.add(createExtension(ObjectIdentifiers.id_extension_pkix_ocsp_nocheck, false, false, null));

    // Extensions - basicConstraints
    ExtensionValueType extensionValue = null;
    list.add(createExtension(Extension.basicConstraints, true, true, extensionValue));

    // Extensions - AuthorityInfoAccess
    extensionValue = createAuthorityInfoAccess();
    list.add(createExtension(Extension.authorityInfoAccess, true, false, extensionValue));

    // Extensions - AuthorityKeyIdentifier
    extensionValue = createAuthorityKeyIdentifier(true);
    list.add(createExtension(Extension.authorityKeyIdentifier, true, false, extensionValue));

    // Extensions - keyUsage
    extensionValue = createKeyUsages(new KeyUsageEnum[] { KeyUsageEnum.CONTENT_COMMITMENT }, null);
    list.add(createExtension(Extension.keyUsage, true, true, extensionValue));

    // Extensions - extenedKeyUsage
    extensionValue = createExtendedKeyUsage(new ASN1ObjectIdentifier[] { ObjectIdentifiers.id_kp_OCSPSigning },
            null);
    list.add(createExtension(Extension.extendedKeyUsage, true, false, extensionValue));

    return profile;
}

---

From source file:org.xipki.ca.certprofile.internal.ProfileConfCreatorDemo.java

License:Open Source License

private static X509ProfileType Certprofile_TLS() throws Exception {
    X509ProfileType profile = getBaseProfile("Certprofile TLS", false, "5y", true, new String[] { "SHA1" });

    // Subject// w ww  .  j  a  va  2s.  co  m
    Subject subject = profile.getSubject();
    subject.setIncSerialNumber(false);

    List<RdnType> rdnControls = subject.getRdn();
    rdnControls.add(createRDN(ObjectIdentifiers.DN_C, 1, 1, new String[] { "DE|FR" }, null, null));
    rdnControls.add(createRDN(ObjectIdentifiers.DN_O, 1, 1));
    rdnControls.add(createRDN(ObjectIdentifiers.DN_OU, 0, 1));
    rdnControls.add(createRDN(ObjectIdentifiers.DN_SN, 0, 1, new String[] { REGEX_SN }, null, null));
    rdnControls.add(createRDN(ObjectIdentifiers.DN_CN, 1, 1, new String[] { REGEX_FQDN }, null, null));

    // Extensions
    // Extensions - general
    ExtensionsType extensions = profile.getExtensions();

    // Extensions - controls
    List<ExtensionType> list = extensions.getExtension();
    list.add(createExtension(Extension.subjectKeyIdentifier, true, false, null));
    list.add(createExtension(Extension.cRLDistributionPoints, false, false, null));
    list.add(createExtension(Extension.freshestCRL, false, false, null));

    // Extensions - basicConstraints
    ExtensionValueType extensionValue = null;
    list.add(createExtension(Extension.basicConstraints, true, true, extensionValue));

    // Extensions - AuthorityInfoAccess
    extensionValue = createAuthorityInfoAccess();
    list.add(createExtension(Extension.authorityInfoAccess, true, false, extensionValue));

    // Extensions - AuthorityKeyIdentifier
    extensionValue = createAuthorityKeyIdentifier(true);
    list.add(createExtension(Extension.authorityKeyIdentifier, true, false, extensionValue));

    // Extensions - keyUsage
    extensionValue = createKeyUsages(new KeyUsageEnum[] { KeyUsageEnum.DIGITAL_SIGNATURE,
            KeyUsageEnum.DATA_ENCIPHERMENT, KeyUsageEnum.KEY_ENCIPHERMENT }, null);
    list.add(createExtension(Extension.keyUsage, true, true, extensionValue));

    // Extensions - extenedKeyUsage
    extensionValue = createExtendedKeyUsage(new ASN1ObjectIdentifier[] { ObjectIdentifiers.id_kp_serverAuth },
            new ASN1ObjectIdentifier[] { ObjectIdentifiers.id_kp_clientAuth });
    list.add(createExtension(Extension.extendedKeyUsage, true, false, extensionValue));

    // Admission - just DEMO, does not belong to TLS certificate
    extensionValue = createAdmission(new ASN1ObjectIdentifier("1.1.1.2"), "demo item");
    list.add(createExtension(ObjectIdentifiers.id_extension_admission, true, false, extensionValue));

    return profile;
}

---

From source file:org.xipki.ca.certprofile.internal.ProfileConfCreatorDemo.java

License:Open Source License

private static X509ProfileType Certprofile_TLS_C() throws Exception {
    X509ProfileType profile = getBaseProfile("Certprofile TLS_C", false, "5y", false, new String[] { "SHA1" });

    // Subject//  w  ww.  j av a  2s. c  o m
    Subject subject = profile.getSubject();
    subject.setIncSerialNumber(false);

    List<RdnType> rdnControls = subject.getRdn();
    rdnControls.add(createRDN(ObjectIdentifiers.DN_C, 1, 1, new String[] { "DE|FR" }, null, null));
    rdnControls.add(createRDN(ObjectIdentifiers.DN_O, 1, 1));
    rdnControls.add(createRDN(ObjectIdentifiers.DN_OU, 0, 1));
    rdnControls.add(createRDN(ObjectIdentifiers.DN_SN, 0, 1, new String[] { REGEX_SN }, null, null));
    rdnControls.add(createRDN(ObjectIdentifiers.DN_CN, 1, 1));

    // Extensions
    ExtensionsType extensions = profile.getExtensions();
    List<ExtensionType> list = extensions.getExtension();

    list.add(createExtension(Extension.subjectKeyIdentifier, true, false, null));
    list.add(createExtension(Extension.cRLDistributionPoints, false, false, null));
    list.add(createExtension(Extension.freshestCRL, false, false, null));

    // Extensions - basicConstraints
    ExtensionValueType extensionValue = null;
    list.add(createExtension(Extension.basicConstraints, true, true, extensionValue));

    // Extensions - AuthorityInfoAccess
    extensionValue = createAuthorityInfoAccess();
    list.add(createExtension(Extension.authorityInfoAccess, true, false, extensionValue));

    // Extensions - AuthorityKeyIdentifier
    extensionValue = createAuthorityKeyIdentifier(true);
    list.add(createExtension(Extension.authorityKeyIdentifier, true, false, extensionValue));

    // Extensions - keyUsage
    extensionValue = createKeyUsages(new KeyUsageEnum[] { KeyUsageEnum.DIGITAL_SIGNATURE,
            KeyUsageEnum.DATA_ENCIPHERMENT, KeyUsageEnum.KEY_ENCIPHERMENT }, null);
    list.add(createExtension(Extension.keyUsage, true, true, extensionValue));

    // Extensions - extenedKeyUsage
    extensionValue = createExtendedKeyUsage(new ASN1ObjectIdentifier[] { ObjectIdentifiers.id_kp_clientAuth },
            null);
    list.add(createExtension(Extension.extendedKeyUsage, true, false, extensionValue));

    return profile;
}

---

• «
• 1
• 2
• 3
• 4
• 5
• 6
• 7
• 8
• 9
• »