Example usage for org.bouncycastle.asn1.x509 Extension Extension

Introduction

In this page you can find the example usage for org.bouncycastle.asn1.x509 Extension Extension.

Prototype

public Extension(ASN1ObjectIdentifier extnId, boolean critical, ASN1OctetString value) 

Source Link

Document

Constructor using an OCTET STRING for the value.

Usage

From source file:org.ejbca.core.protocol.ocsp.OcspJunitHelper.java

License:Open Source License

private void verifyStatus(int caid, X509Certificate cacert, BigInteger certSerial, int ocspResponseStatus,
        Status expectedStatus, int expectedReason, Date expectedRevTime) throws NoSuchProviderException,
        IOException, OCSPException, OperatorCreationException, CertificateException {
    // And an OCSP request
    final OCSPReqBuilder gen = new OCSPReqBuilder();
    gen.addRequest(new JcaCertificateID(SHA1DigestCalculator.buildSha1Instance(), cacert, certSerial));
    log.debug("ocspTestCert.getSerialNumber() = " + certSerial);
    final String sNonce = "123456789";
    Extension[] extensions = new Extension[1];
    extensions[0] = new Extension(OCSPObjectIdentifiers.id_pkix_ocsp_nonce, false,
            new DEROctetString(sNonce.getBytes()));
    gen.setRequestExtensions(new Extensions(extensions));

    final OCSPReq req = gen.build();

    // Send the request and receive a singleResponse
    final SingleResp[] singleResps = sendOCSPPost(req.getEncoded(), sNonce, ocspResponseStatus, 200);
    // if we expected internal error, we should not expect any data, and can not make any more tests
    if (ocspResponseStatus == OCSPRespBuilder.INTERNAL_ERROR) {
        return;/* w w w  . j ava 2 s  .  co  m*/
    }

    if (ocspResponseStatus == OCSPRespBuilder.UNAUTHORIZED) {
        return;
    }
    assertEquals("No of SingleResps should be 1.", 1, singleResps.length);
    final SingleResp singleResp = singleResps[0];

    final CertificateID certId = singleResp.getCertID();
    assertEquals("Serno in response does not match serno in request.", certId.getSerialNumber(), certSerial);
    final Object status = singleResp.getCertStatus();
    final String statusClassName = status != null ? status.getClass().getName() : "GOOD";// status==null means GOOD
    switch (expectedStatus) {
    case Unknown:
        assertTrue("Status is not Unknown: " + statusClassName, status instanceof UnknownStatus);
        break;
    case Good:
        if (status != CertificateStatus.GOOD) {
            log.debug("Certificate status: " + status.getClass().getName());
        }
        assertEquals("Status is not Good, was: " + statusClassName + ".", CertificateStatus.GOOD, status);
        break;
    case Revoked:
        assertTrue("Status is not Revoked: " + statusClassName, status instanceof RevokedStatus);
        final int reason = ((RevokedStatus) status).getRevocationReason();
        assertEquals("Wrong revocation reason", expectedReason, reason);
        if (expectedRevTime != null) {
            final Date revTime = ((RevokedStatus) status).getRevocationTime();
            assertEquals("Wrong revocation time", expectedRevTime, revTime);
        }
        break;
    }
}

---

From source file:org.ejbca.core.protocol.ocsp.OCSPUnidClient.java

License:Open Source License

/**
 * @param keystore KeyStore client keystore used to authenticate TLS client authentication, or null if TLS is not used
 * @param pwd String password for the key store, or null if no keystore is used
 * @param ocspurl String url to the OCSP server, or null if we should try to use the AIA extension from the cert; e.g. http://127.0.0.1:8080/ejbca/publicweb/status/ocsp (or https for TLS)
 * @param certs certificate chain to signing key
 * @param _signKey signing key// w ww .  j  av a  2  s  . c  o  m
 * @param getfnr true if FNR should be fetched
 * @throws NoSuchAlgorithmException
 * @throws IOException if ASN1 parsing error occurs
 */
private OCSPUnidClient(KeyStore keystore, String pwd, String ocspurl, Certificate[] certs, PrivateKey _signKey,
        boolean getfnr) throws NoSuchAlgorithmException, IOException {
    this.httpReqPath = ocspurl;
    this.passphrase = pwd;
    this.ks = keystore;
    this.signKey = _signKey;
    this.certChain = certs != null ? Arrays.asList(certs).toArray(new X509Certificate[0]) : null;
    this.nonce = new byte[16];
    {
        List<Extension> extensionList = new ArrayList<Extension>();
        final Random randomSource = new Random();
        randomSource.nextBytes(nonce);
        extensionList
                .add(new Extension(OCSPObjectIdentifiers.id_pkix_ocsp_nonce, false, new DEROctetString(nonce)));
        // Don't bother adding Unid extension if we are not using client authentication
        if (getfnr) {
            extensionList.add(new Extension(FnrFromUnidExtension.FnrFromUnidOid, false,
                    new DEROctetString(new FnrFromUnidExtension("1"))));
        }
        extensions = new Extensions(extensionList.toArray(new Extension[extensionList.size()]));
    }
    CryptoProviderTools.installBCProviderIfNotAvailable();
}

---

From source file:org.ejbca.core.protocol.ocsp.ProtocolLookupServerHttpTest.java

License:Open Source License

/**
 * Tests ocsp message with good status and a valid unid
 * //  ww w. j av a  2s. c om
 * @throws Exception error
 */
@Test
public void test01OcspGoodWithFnr() throws Exception {
    // Make user that we know...
    boolean userExists = false;
    try {
        endEntityManagementSession.addUser(admin, "unidtest", "foo123",
                "C=SE,O=AnaTom,surname=Jansson,serialNumber=123456789,CN=UNIDTest", null, "unidtest@anatom.se",
                false, SecConst.EMPTY_ENDENTITYPROFILE, CertificateProfileConstants.CERTPROFILE_FIXED_ENDUSER,
                EndEntityTypes.ENDUSER.toEndEntityType(), SecConst.TOKEN_SOFT_PEM, 0, caid);
        log.debug(
                "created user: unidtest, foo123, C=SE, O=AnaTom,surname=Jansson,serialNumber=123456789, CN=UNIDTest");
    } catch (EndEntityExistsException e) {
        userExists = true;
    }
    if (userExists) {
        log.debug("User unidtest already exists.");
        EndEntityInformation userData = new EndEntityInformation("unidtest",
                "C=SE,O=AnaTom,surname=Jansson,serialNumber=123456789,CN=UNIDTest", caid, null,
                "unidtest@anatom.se", EndEntityConstants.STATUS_NEW, EndEntityTypes.ENDUSER.toEndEntityType(),
                SecConst.EMPTY_ENDENTITYPROFILE, CertificateProfileConstants.CERTPROFILE_FIXED_ENDUSER, null,
                null, SecConst.TOKEN_SOFT_PEM, 0, null);
        userData.setPassword("foo123");
        endEntityManagementSession.changeUser(admin, userData, false);
        log.debug("Reset status to NEW");
    }
    // Generate certificate for the new user

    // user that we know exists...
    ocspTestCert = (X509Certificate) signSession.createCertificate(admin, "unidtest", "foo123",
            new PublicKeyWrapper(keys.getPublic()));
    assertNotNull("Failed to create certificate", ocspTestCert);

    // And an OCSP request
    OCSPReqBuilder gen = new OCSPReqBuilder();
    gen.addRequest(new JcaCertificateID(SHA1DigestCalculator.buildSha1Instance(), cacert,
            ocspTestCert.getSerialNumber()));
    Extension[] extensions = new Extension[1];
    extensions[0] = new Extension(FnrFromUnidExtension.FnrFromUnidOid, false,
            new DEROctetString("123456789".getBytes()));
    gen.setRequestExtensions(new Extensions(extensions));

    OCSPReq req = gen.build();

    // Send the request and receive a BasicResponse
    BasicOCSPResp brep = sendOCSPPost(req.getEncoded(), true);
    assertEquals(getFnr(brep), "654321");
    SingleResp[] singleResps = brep.getResponses();
    assertEquals("No of SingResps should be 1.", singleResps.length, 1);
    SingleResp singleResp = singleResps[0];

    CertificateID certId = singleResp.getCertID();
    assertEquals("Serno in response does not match serno in request.", certId.getSerialNumber(),
            ocspTestCert.getSerialNumber());
    Object status = singleResp.getCertStatus();
    assertEquals("Status is not null (good)", status, null);
}

---

From source file:org.ejbca.core.protocol.ocsp.ProtocolLookupServerHttpTest.java

License:Open Source License

/**
 * Tests ocsp message with bad status and a valid unid
 * //from   ww w  .  j a  v a2  s.  c  o m
 * @throws Exception error
 */
@Test
public void test02OcspBadWithFnr() throws Exception {
    revocationSession.revokeCertificate(admin, ocspTestCert, null,
            RevokedCertInfo.REVOCATION_REASON_KEYCOMPROMISE, null);

    // And an OCSP request
    OCSPReqBuilder gen = new OCSPReqBuilder();
    gen.addRequest(new JcaCertificateID(SHA1DigestCalculator.buildSha1Instance(), cacert,
            ocspTestCert.getSerialNumber()));
    Extension[] extensions = new Extension[1];
    extensions[0] = new Extension(FnrFromUnidExtension.FnrFromUnidOid, false,
            new DEROctetString("123456789".getBytes()));
    gen.setRequestExtensions(new Extensions(extensions));
    OCSPReq req = gen.build();

    // Send the request and receive a BasicResponse
    BasicOCSPResp brep = sendOCSPPost(req.getEncoded(), true);
    // When a certificate is revoked the FNR must not be returned
    assertEquals(getFnr(brep), null);
    SingleResp[] singleResps = brep.getResponses();
    assertEquals("No of SingResps should be 1.", singleResps.length, 1);
    SingleResp singleResp = singleResps[0];

    CertificateID certId = singleResp.getCertID();
    assertEquals("Serno in response does not match serno in request.", certId.getSerialNumber(),
            ocspTestCert.getSerialNumber());
    Object status = singleResp.getCertStatus();
    assertTrue("Status is not RevokedStatus", status instanceof RevokedStatus);
    RevokedStatus rev = (RevokedStatus) status;
    assertTrue("Status does not have reason", rev.hasRevocationReason());
    int reason = rev.getRevocationReason();
    assertEquals("Wrong revocation reason", reason, RevokedCertInfo.REVOCATION_REASON_KEYCOMPROMISE);
}

---

From source file:org.ejbca.core.protocol.ocsp.ProtocolLookupServerHttpTest.java

License:Open Source License

/**
 * Tests ocsp message with good status and invalid unid
 * //from  www  .j a  v  a  2 s .c  om
 * @throws Exception error
 */
@Test
public void test03OcspGoodWithNoFnr() throws Exception {
    // Change uses to a Unid that we don't have mapping for
    EndEntityInformation userData = new EndEntityInformation("unidtest",
            "C=SE,O=AnaTom,surname=Jansson,serialNumber=123456789,CN=UNIDTest", caid, null,
            "unidtest@anatom.se", EndEntityConstants.STATUS_NEW, EndEntityTypes.ENDUSER.toEndEntityType(),
            SecConst.EMPTY_ENDENTITYPROFILE, CertificateProfileConstants.CERTPROFILE_FIXED_ENDUSER, null, null,
            SecConst.TOKEN_SOFT_PEM, 0, null);
    userData.setPassword("foo123");
    endEntityManagementSession.changeUser(admin, userData, false);
    log.debug("Reset status to NEW");
    // Generate certificate for the new/changed user
    ocspTestCert = (X509Certificate) signSession.createCertificate(admin, "unidtest", "foo123",
            new PublicKeyWrapper(keys.getPublic()));
    assertNotNull("Failed to create certificate", ocspTestCert);

    // And an OCSP request
    OCSPReqBuilder gen = new OCSPReqBuilder();
    gen.addRequest(new JcaCertificateID(SHA1DigestCalculator.buildSha1Instance(), cacert,
            ocspTestCert.getSerialNumber()));
    Extension[] extensions = new Extension[1];
    extensions[0] = new Extension(FnrFromUnidExtension.FnrFromUnidOid, false,
            new DEROctetString("123456789".getBytes()));
    gen.setRequestExtensions(new Extensions(extensions));
    OCSPReq req = gen.build();

    // Send the request and receive a BasicResponse
    BasicOCSPResp brep = sendOCSPPost(req.getEncoded(), true);
    assertEquals(getFnr(brep), null);
    SingleResp[] singleResps = brep.getResponses();
    assertEquals("No of SingResps should be 1.", singleResps.length, 1);
    SingleResp singleResp = singleResps[0];

    CertificateID certId = singleResp.getCertID();
    assertEquals("Serno in response does not match serno in request.", certId.getSerialNumber(),
            ocspTestCert.getSerialNumber());
    Object status = singleResp.getCertStatus();
    assertEquals("Status is not null (good)", status, null);
}

---

From source file:org.ejbca.core.protocol.ocsp.ProtocolLookupServerHttpTest.java

License:Open Source License

/**
 * Tests ocsp message with good status but no serialNnumber in the DN
 * //from w  w  w .ja  v  a 2s . com
 * @throws Exception error
 */
@Test
public void test04OcspGoodNoSerialNo() throws Exception {
    // Change uses to not have any serialNumber
    EndEntityInformation userData = new EndEntityInformation("unidtest",
            "C=SE,O=AnaTom,surname=Jansson,serialNumber=123456789,CN=UNIDTest", caid, null,
            "unidtest@anatom.se", EndEntityConstants.STATUS_NEW, EndEntityTypes.ENDUSER.toEndEntityType(),
            SecConst.EMPTY_ENDENTITYPROFILE, CertificateProfileConstants.CERTPROFILE_FIXED_ENDUSER, null, null,
            SecConst.TOKEN_SOFT_PEM, 0, null);
    userData.setPassword("foo123");
    endEntityManagementSession.changeUser(admin, userData, false);
    log.debug("Reset status to NEW");
    // Generate certificate for the new/changed user
    ocspTestCert = (X509Certificate) signSession.createCertificate(admin, "unidtest", "foo123",
            new PublicKeyWrapper(keys.getPublic()));
    assertNotNull("Failed to create certificate", ocspTestCert);

    // And an OCSP request
    OCSPReqBuilder gen = new OCSPReqBuilder();
    gen.addRequest(new JcaCertificateID(SHA1DigestCalculator.buildSha1Instance(), cacert,
            ocspTestCert.getSerialNumber()));
    Extension[] extensions = new Extension[1];
    extensions[0] = new Extension(FnrFromUnidExtension.FnrFromUnidOid, false,
            new DEROctetString("123456789".getBytes()));
    gen.setRequestExtensions(new Extensions(extensions));
    OCSPReq req = gen.build();

    // Send the request and receive a BasicResponse
    BasicOCSPResp brep = sendOCSPPost(req.getEncoded(), true);
    assertEquals(getFnr(brep), null);
    SingleResp[] singleResps = brep.getResponses();
    assertEquals("No of SingResps should be 1.", singleResps.length, 1);
    SingleResp singleResp = singleResps[0];

    CertificateID certId = singleResp.getCertID();
    assertEquals("Serno in response does not match serno in request.", certId.getSerialNumber(),
            ocspTestCert.getSerialNumber());
    Object status = singleResp.getCertStatus();
    assertEquals("Status is not null (good)", status, null);
}

---

From source file:org.ejbca.core.protocol.ocsp.ProtocolLookupServerHttpTest.java

License:Open Source License

/**
 * test a lookup message from an untrusted requestor, should not work
 * /*  ww w.j  ava 2s  .c o m*/
 * @throws Exception
 */
@Test
public void test05HttpsNotAuthorized() throws Exception {
    // Change uses to a Unid that is OK
    EndEntityInformation userData = new EndEntityInformation("unidtest",
            "C=SE,O=AnaTom,surname=Jansson,serialNumber=123456789,CN=UNIDTest", caid, null,
            "unidtest@anatom.se", EndEntityConstants.STATUS_NEW, EndEntityTypes.ENDUSER.toEndEntityType(),
            SecConst.EMPTY_ENDENTITYPROFILE, CertificateProfileConstants.CERTPROFILE_FIXED_ENDUSER, null, null,
            SecConst.TOKEN_SOFT_PEM, 0, null);
    userData.setPassword("foo123");
    userData.setStatus(EndEntityConstants.STATUS_NEW);
    endEntityManagementSession.changeUser(admin, userData, false);
    log.debug("Reset status to NEW");
    // Generate certificate for the new/changed user
    ocspTestCert = (X509Certificate) signSession.createCertificate(admin, "unidtest", "foo123",
            new PublicKeyWrapper(keys.getPublic()));
    assertNotNull("Failed to create certificate", ocspTestCert);

    // And an OCSP request
    OCSPReqBuilder gen = new OCSPReqBuilder();
    gen.addRequest(new JcaCertificateID(SHA1DigestCalculator.buildSha1Instance(), cacert,
            ocspTestCert.getSerialNumber()));
    Extension[] extensions = new Extension[1];
    extensions[0] = new Extension(FnrFromUnidExtension.FnrFromUnidOid, false,
            new DEROctetString("123456789".getBytes()));
    gen.setRequestExtensions(new Extensions(extensions));
    OCSPReq req = gen.build();

    // Send the request and receive a BasicResponse
    BasicOCSPResp brep = sendOCSPPost(req.getEncoded(), false);
    assertEquals(getFnr(brep), null);
    SingleResp[] singleResps = brep.getResponses();
    assertEquals("No of SingResps should be 1.", singleResps.length, 1);
    SingleResp singleResp = singleResps[0];

    CertificateID certId = singleResp.getCertID();
    assertEquals("Serno in response does not match serno in request.", certId.getSerialNumber(),
            ocspTestCert.getSerialNumber());
    Object status = singleResp.getCertStatus();
    assertEquals("Status is not null (good)", status, null);
}

---

From source file:org.ejbca.core.protocol.ocsp.ProtocolLookupServerHttpTest.java

License:Open Source License

/**
 * test a lookup request with regular http, should not work
 * //w  w w.  j a va  2 s  . com
 * @throws Exception
 */
@Test
public void test06HttpNotAuthorized() throws Exception {
    // Change to use plain http, we should be able to get a OCSP response, but the FNR mapping
    // will not be returned bacuse it requires https with client authentication
    httpReqPath = "http://127.0.0.1:8080/ejbca";
    // Change uses to a Unid that is OK
    EndEntityInformation userData = new EndEntityInformation("unidtest",
            "C=SE,O=AnaTom,surname=Jansson,serialNumber=123456789,CN=UNIDTest", caid, null,
            "unidtest@anatom.se", EndEntityConstants.STATUS_NEW, EndEntityTypes.ENDUSER.toEndEntityType(),
            SecConst.EMPTY_ENDENTITYPROFILE, CertificateProfileConstants.CERTPROFILE_FIXED_ENDUSER, null, null,
            SecConst.TOKEN_SOFT_PEM, 0, null);
    userData.setPassword("foo123");
    endEntityManagementSession.changeUser(admin, userData, false);
    log.debug("Reset status to NEW");
    // Generate certificate for the new/changed user
    ocspTestCert = (X509Certificate) signSession.createCertificate(admin, "unidtest", "foo123",
            new PublicKeyWrapper(keys.getPublic()));
    assertNotNull("Failed to create certificate", ocspTestCert);

    // And an OCSP request
    OCSPReqBuilder gen = new OCSPReqBuilder();
    gen.addRequest(new JcaCertificateID(SHA1DigestCalculator.buildSha1Instance(), cacert,
            ocspTestCert.getSerialNumber()));
    Extension[] extensions = new Extension[1];
    extensions[0] = new Extension(FnrFromUnidExtension.FnrFromUnidOid, false,
            new DEROctetString("123456789".getBytes()));
    gen.setRequestExtensions(new Extensions(extensions));
    OCSPReq req = gen.build();

    // Send the request and receive a BasicResponse
    BasicOCSPResp brep = sendOCSPPost(req.getEncoded(), true);
    assertEquals(getFnr(brep), null);
    SingleResp[] singleResps = brep.getResponses();
    assertEquals("No of SingResps should be 1.", singleResps.length, 1);
    SingleResp singleResp = singleResps[0];

    CertificateID certId = singleResp.getCertID();
    assertEquals("Serno in response does not match serno in request.", certId.getSerialNumber(),
            ocspTestCert.getSerialNumber());
    Object status = singleResp.getCertStatus();
    assertEquals("Status is not null (good)", status, null);
}

---

From source file:org.ejbca.core.protocol.ocsp.ProtocolOcspHttpTest.java

License:Open Source License

@Test
public void test07SignedOcsp() throws Exception {
    assertTrue("This test can only be run on a full EJBCA installation.",
            ((HttpURLConnection) new URL(httpReqPath + '/').openConnection()).getResponseCode() == 200);

    // find a CA (TestCA?) create a user and generate his cert
    // send OCSP req to server and get good response
    // change status of cert to bad status
    // send OCSP req and get bad status
    // (send crap message and get good error)
    try {//  w w  w.  j ava 2 s. co  m
        KeyPair keys = createUserCert(caid);

        // And an OCSP request
        OCSPReqBuilder gen = new OCSPReqBuilder();
        gen.addRequest(new JcaCertificateID(SHA1DigestCalculator.buildSha1Instance(), cacert,
                ocspTestCert.getSerialNumber()));
        Extension[] extensions = new Extension[1];
        extensions[0] = new Extension(OCSPObjectIdentifiers.id_pkix_ocsp_nonce, false,
                new DEROctetString("123456789".getBytes()));
        gen.setRequestExtensions(new Extensions(extensions));

        X509CertificateHolder chain[] = new X509CertificateHolder[2];
        chain[0] = new JcaX509CertificateHolder(ocspTestCert);
        chain[1] = new JcaX509CertificateHolder(cacert);
        gen.setRequestorName(chain[0].getSubject());
        OCSPReq req = gen.build(new JcaContentSignerBuilder("SHA1WithRSA")
                .setProvider(BouncyCastleProvider.PROVIDER_NAME).build(keys.getPrivate()), chain);

        // First test with a signed OCSP request that can be verified
        Collection<Certificate> cacerts = new ArrayList<Certificate>();
        cacerts.add(cacert);
        CaCertificateCache certcache = CaCertificateCache.INSTANCE;
        certcache.loadCertificates(cacerts);
        X509Certificate signer = checkRequestSignature("127.0.0.1", req, certcache);
        assertNotNull(signer);
        assertEquals(ocspTestCert.getSerialNumber().toString(16), signer.getSerialNumber().toString(16));

        // Try with an unsigned request, we should get a SignRequestException
        req = gen.build();
        boolean caught = false;
        try {
            signer = checkRequestSignature("127.0.0.1", req, certcache);
        } catch (SignRequestException e) {
            caught = true;
        }
        assertTrue(caught);

        // sign with a keystore where the CA-certificate is not known
        KeyStore store = KeyStore.getInstance("PKCS12", "BC");
        ByteArrayInputStream fis = new ByteArrayInputStream(ks3);
        store.load(fis, "foo123".toCharArray());
        Certificate[] certs = KeyTools.getCertChain(store, "privateKey");
        chain[0] = new JcaX509CertificateHolder((X509Certificate) certs[0]);
        chain[1] = new JcaX509CertificateHolder((X509Certificate) certs[1]);
        PrivateKey pk = (PrivateKey) store.getKey("privateKey", "foo123".toCharArray());
        req = gen.build(new BufferingContentSigner(new JcaContentSignerBuilder("SHA1WithRSA").build(pk), 20480),
                chain);
        // Send the request and receive a singleResponse, this response should
        // throw an SignRequestSignatureException
        caught = false;
        try {
            signer = checkRequestSignature("127.0.0.1", req, certcache);
        } catch (SignRequestSignatureException e) {
            caught = true;
        }
        assertTrue(caught);

        // sign with a keystore where the signing certificate has expired
        store = KeyStore.getInstance("PKCS12", "BC");
        fis = new ByteArrayInputStream(ksexpired);
        store.load(fis, "foo123".toCharArray());
        certs = KeyTools.getCertChain(store, "ocspclient");
        chain[0] = new JcaX509CertificateHolder((X509Certificate) certs[0]);
        chain[1] = new JcaX509CertificateHolder((X509Certificate) certs[1]);
        pk = (PrivateKey) store.getKey("ocspclient", "foo123".toCharArray());
        req = gen.build(new BufferingContentSigner(new JcaContentSignerBuilder("SHA1WithRSA").build(pk), 20480),
                chain);
        // Send the request and receive a singleResponse, this response should
        // throw an SignRequestSignatureException
        caught = false;
        try {
            signer = checkRequestSignature("127.0.0.1", req, certcache);
        } catch (SignRequestSignatureException e) {
            caught = true;
        }
        assertTrue(caught);
    } finally {
        endEntityManagementSession.deleteUser(admin, "ocsptest");
    }

}

---

From source file:org.ejbca.core.protocol.ocsp.ProtocolOcspHttpTest.java

License:Open Source License

/**
 * Verify that Internal OCSP responses are signed by CA signing key.
 *//*from w  ww . j a v  a 2 s. c om*/
@Test
public void test17OCSPResponseSignature() throws Exception {

    // Get user and ocspTestCert that we know...
    loadUserCert(caid);
    this.helper.reloadKeys();
    // And an OCSP request
    OCSPReqBuilder gen = new OCSPReqBuilder();
    gen.addRequest(new JcaCertificateID(SHA1DigestCalculator.buildSha1Instance(), cacert,
            ocspTestCert.getSerialNumber()));
    Extension[] extensions = new Extension[1];
    extensions[0] = new Extension(OCSPObjectIdentifiers.id_pkix_ocsp_nonce, false,
            new DEROctetString("123456789".getBytes()));
    gen.setRequestExtensions(new Extensions(extensions));
    OCSPReq req = gen.build();

    // POST the OCSP request
    URL url = new URL(httpReqPath + '/' + resourceOcsp);
    HttpURLConnection con = (HttpURLConnection) url.openConnection();
    // we are going to do a POST
    con.setDoOutput(true);
    con.setRequestMethod("POST");

    // POST it
    con.setRequestProperty("Content-Type", "application/ocsp-request");
    OutputStream os = con.getOutputStream();
    os.write(req.getEncoded());
    os.close();
    assertTrue("HTTP error", con.getResponseCode() == 200);

    // Some appserver (Weblogic) responds with
    // "application/ocsp-response; charset=UTF-8"
    assertNotNull("No Content-Type in reply.", con.getContentType());
    assertTrue(con.getContentType().startsWith("application/ocsp-response"));
    OCSPResp response = new OCSPResp(IOUtils.toByteArray(con.getInputStream()));
    assertTrue("Response status not the expected.", response.getStatus() != 200);

    BasicOCSPResp brep = (BasicOCSPResp) response.getResponseObject();
    boolean verify = brep
            .isSignatureValid(new JcaContentVerifierProviderBuilder().build(cacert.getPublicKey()));
    assertTrue("Signature verification", verify);
}

---

• «
• 1
• 2
• 3
• 4
• 5
• 6
• 7
• 8
• 9
• 10
• »