Example usage for org.bouncycastle.asn1.x509 Extension keyUsage

List of usage examples for org.bouncycastle.asn1.x509 Extension keyUsage

  1. HOME
  2. Java
  3. org.bouncycastle
  4. org.bouncycastle.asn1.x509.*
  5. Extension
  6. keyUsage

Introduction

In this page you can find the example usage for org.bouncycastle.asn1.x509 Extension keyUsage.

Prototype

ASN1ObjectIdentifier keyUsage

To view the source code for org.bouncycastle.asn1.x509 Extension keyUsage.

Click Source Link

Document

Key Usage

Usage

From source file:co.runrightfast.core.security.cert.impl.CertificateServiceImplTest.java

License:Apache License

/**
 * creates an end entity certificate which might be used to verify one of the subject's signatures or to encrypt data to be sent to the entity represented
 * by the certificate's subject/*www. j  a  v a2 s . c  om*/
 *
 * @throws NoSuchAlgorithmException
 * @throws NoSuchProviderException
 * @throws CertificateExpiredException
 * @throws CertificateNotYetValidException
 * @throws CertificateException
 * @throws InvalidKeyException
 * @throws SignatureException
 */
@Test
public void testGenerateX509CertificateV3_endEntityCertificate() throws NoSuchAlgorithmException,
        NoSuchProviderException, CertificateExpiredException, CertificateNotYetValidException,
        CertificateException, InvalidKeyException, SignatureException, IOException {
    final DistinguishedName subject = subject();

    final X500Principal subjectPrincipal = subject.toX500Principal();

    final KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(RSA.name(), BOUNCY_CASTLE);
    final KeyPair certKeyPair = keyPairGenerator.generateKeyPair();

    final CaCert caCert = caCert();
    final JcaX509ExtensionUtils extUtils = jcaX509ExtensionUtils();
    final ImmutableList<X509CertExtension> x509CertExtensions = ImmutableList.<X509CertExtension>builder()
            .add(X509CertExtension.builder().oid(Extension.authorityKeyIdentifier)
                    .value(extUtils.createAuthorityKeyIdentifier(caCert.getCert())).critical(false).build())
            .add(X509CertExtension.builder().oid(Extension.keyUsage)
                    .value(new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyEncipherment)).critical(true)
                    .build())
            .build();

    final X509V3CertRequest request = new X509V3CertRequest(caCert.cert.getIssuerX500Principal(),
            BigInteger.ONE, Instant.now(), Instant.ofEpochMilli(System.currentTimeMillis() + (10 * 1000)),
            subjectPrincipal, certKeyPair.getPublic(), x509CertExtensions);
    log.info(String.format("request : %s", request));

    final X509Certificate cert = certificateService.generateX509CertificateV3(request, caCert.getPrivateKey());
    log.info(String.format("result.getSigAlgName() = %s, result.getVersion() = %s ", cert.getSigAlgName(),
            cert.getVersion()));
    assertThat(cert.getVersion(), is(3));

    cert.checkValidity();
    assertThat(Arrays.areEqual(subjectPrincipal.getEncoded(), cert.getSubjectX500Principal().getEncoded()),
            is(true));
    assertThat(Arrays.areEqual(caCert.getCert().getSubjectX500Principal().getEncoded(),
            cert.getIssuerX500Principal().getEncoded()), is(true));
    cert.verify(caCert.getCert().getPublicKey());

    assertThat(cert.getBasicConstraints(), is(-1));

    checkAuthorityKeyIdentifierExtenstion(cert, caCert);
    checkSubjectKeyIdentifierExtenstion(cert);
}

From source file:co.runrightfast.core.security.cert.impl.CertificateServiceImplTest.java

License:Apache License

@Test(expected = IllegalArgumentException.class)
public void testGenerateX509CertificateV3_endEntityCertificate_withBasicConstraintsNotAllowed()
        throws NoSuchAlgorithmException, NoSuchProviderException, CertificateExpiredException,
        CertificateNotYetValidException, CertificateException, InvalidKeyException, SignatureException {
    final DistinguishedName subject = subject();

    final X500Principal subjectPrincipal = subject.toX500Principal();

    final KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(RSA.name(), BOUNCY_CASTLE);
    final KeyPair certKeyPair = keyPairGenerator.generateKeyPair();

    final CaCert caCert = caCert();
    final JcaX509ExtensionUtils extUtils = jcaX509ExtensionUtils();
    final ImmutableList<X509CertExtension> x509CertExtensions = ImmutableList.<X509CertExtension>builder()
            .add(X509CertExtension.builder().oid(Extension.authorityKeyIdentifier)
                    .value(extUtils.createAuthorityKeyIdentifier(caCert.getCert())).critical(false).build())
            .add(X509CertExtension.builder().oid(Extension.keyUsage)
                    .value(new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyEncipherment)).critical(true)
                    .build())/*from   w  ww.  j a v  a  2 s.  c  o  m*/
            .add(X509CertExtension.builder().oid(Extension.basicConstraints).value(new BasicConstraints(false))
                    .critical(true).build())
            .build();

    final X509V3CertRequest request = new X509V3CertRequest(caCert.cert.getIssuerX500Principal(),
            BigInteger.ONE, Instant.now(), Instant.ofEpochMilli(System.currentTimeMillis() + (10 * 1000)),
            subjectPrincipal, certKeyPair.getPublic(), x509CertExtensions);
    log.info(String.format("request : %s", request));

    final X509Certificate cert = certificateService.generateX509CertificateV3(request, caCert.getPrivateKey());
    log.info(String.format("result.getSigAlgName() = %s, result.getVersion() = %s ", cert.getSigAlgName(),
            cert.getVersion()));
    assertThat(cert.getVersion(), is(3));

    cert.checkValidity();
    assertThat(Arrays.areEqual(subjectPrincipal.getEncoded(), cert.getSubjectX500Principal().getEncoded()),
            is(true));
    assertThat(Arrays.areEqual(caCert.getCert().getSubjectX500Principal().getEncoded(),
            cert.getIssuerX500Principal().getEncoded()), is(true));
    cert.verify(caCert.getCert().getPublicKey());

}

From source file:co.runrightfast.core.security.cert.impl.CertificateServiceImplTest.java

License:Apache License

@Test(expected = IllegalArgumentException.class)
public void testGenerateX509CertificateV3_endEntityCertificate_withSubjectKeyIdentifierNoAllowed()
        throws NoSuchAlgorithmException, NoSuchProviderException, CertificateExpiredException,
        CertificateNotYetValidException, CertificateException, InvalidKeyException, SignatureException {
    final DistinguishedName subject = subject();

    final X500Principal subjectPrincipal = subject.toX500Principal();

    final KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(RSA.name(), BOUNCY_CASTLE);
    final KeyPair certKeyPair = keyPairGenerator.generateKeyPair();

    final CaCert caCert = caCert();
    final JcaX509ExtensionUtils extUtils = jcaX509ExtensionUtils();
    final ImmutableList<X509CertExtension> x509CertExtensions = ImmutableList.<X509CertExtension>builder()
            .add(X509CertExtension.builder().oid(Extension.authorityKeyIdentifier)
                    .value(extUtils.createAuthorityKeyIdentifier(caCert.getCert())).critical(false).build())
            .add(X509CertExtension.builder().oid(Extension.subjectKeyIdentifier)
                    .value(extUtils.createSubjectKeyIdentifier(certKeyPair.getPublic())).critical(false)
                    .build())// ww w .  j a  v  a2s  .  c  o  m
            .add(X509CertExtension.builder().oid(Extension.keyUsage)
                    .value(new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyEncipherment)).critical(true)
                    .build())
            .add(X509CertExtension.builder().oid(Extension.basicConstraints).value(new BasicConstraints(false))
                    .critical(true).build())
            .build();

    final X509V3CertRequest request = new X509V3CertRequest(caCert.cert.getIssuerX500Principal(),
            BigInteger.ONE, Instant.now(), Instant.ofEpochMilli(System.currentTimeMillis() + (10 * 1000)),
            subjectPrincipal, certKeyPair.getPublic(), x509CertExtensions);
}

From source file:com.aqnote.shared.cryptology.cert.gen.CertGenerator.java

License:Open Source License

public X509Certificate createClass3EndCert(long sno, X500Name sdn, Map<String, String> exts, PublicKey pubKey,
        KeyPair pKeyPair) throws Exception {
    PublicKey pPubKey = pKeyPair.getPublic();
    PrivateKey pPrivKey = pKeyPair.getPrivate();

    X500Name idn = X500NameUtil.createClass3CaPrincipal();
    BigInteger _sno = BigInteger.valueOf(sno <= 0 ? System.currentTimeMillis() : sno);
    Date nb = new Date(System.currentTimeMillis() - HALF_DAY);
    Date na = new Date(nb.getTime() + FIVE_YEAR);

    X509v3CertificateBuilder certBuilder = new JcaX509v3CertificateBuilder(idn, _sno, nb, na, sdn, pubKey);

    addSubjectKID(certBuilder, pubKey);//  w  ww  .ja  v  a 2s. c o m
    addAuthorityKID(certBuilder, pPubKey);
    certBuilder.addExtension(Extension.extendedKeyUsage, false, new ExtendedKeyUsage(MOST_EKU));
    certBuilder.addExtension(Extension.keyUsage, false, new KeyUsage(END_KEY_USAGE));
    if (exts != null) {
        Set<String> key = exts.keySet();
        for (Iterator<String> it = key.iterator(); it.hasNext();) {
            String oid = it.next();
            String value = exts.get(oid);
            if (!StringUtils.isBlank(value)) {
                certBuilder.addExtension(new ASN1ObjectIdentifier(oid), false,
                        new DEROctetString(value.getBytes()));
            }
        }
    }

    X509Certificate certificate = signCert(certBuilder, pPrivKey);
    certificate.checkValidity(new Date());
    certificate.verify(pPubKey);

    setPKCS9Info(certificate);

    return certificate;
}

From source file:com.aqnote.shared.cryptology.cert.gen.CertGenerator.java

License:Open Source License

private X509Certificate createEndCert(X500Name subject, PublicKey pubKey, KeyPair pKeyPair, X500Name issuer)
        throws Exception {

    PublicKey pPubKey = pKeyPair.getPublic();
    PrivateKey pPrivKey = pKeyPair.getPrivate();

    BigInteger sno = BigInteger.valueOf(System.currentTimeMillis());
    Date nb = new Date(System.currentTimeMillis() - HALF_DAY);
    Date na = new Date(nb.getTime() + FIVE_YEAR);

    X509v3CertificateBuilder certBuilder = new JcaX509v3CertificateBuilder(issuer, sno, nb, na, subject,
            pubKey);//from   ww w.  ja v a 2s. c om

    addSubjectKID(certBuilder, pubKey);
    addAuthorityKID(certBuilder, pPubKey);
    certBuilder.addExtension(Extension.extendedKeyUsage, false, new ExtendedKeyUsage(BASE_EKU));
    certBuilder.addExtension(Extension.keyUsage, false, new KeyUsage(END_KEY_USAGE));

    X509Certificate certificate = signCert(certBuilder, pPrivKey);
    certificate.checkValidity(new Date());
    certificate.verify(pPubKey);

    setPKCS9Info(certificate);

    return certificate;
}

From source file:com.aqnote.shared.cryptology.cert.gen.SingleX509V3Creator.java

License:Open Source License

public static X509Certificate generate(CertObject certObject, KeyPair keyPair) throws CertException {

    try {//from  ww  w  .j a v a2s.  c om
        X509v3CertificateBuilder certBuilder = new JcaX509v3CertificateBuilder(
                new X500Name(certObject.getIssuer()), BigInteger.valueOf(System.currentTimeMillis()),
                certObject.getNotBefore(), certObject.getNotAfter(), new X500Name(certObject.getSubject()),
                keyPair.getPublic());

        certBuilder.addExtension(Extension.basicConstraints, true, new BasicConstraints(true));
        certBuilder.addExtension(Extension.keyUsage, true,
                new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyEncipherment));
        certBuilder.addExtension(Extension.subjectAlternativeName, false,
                new GeneralNames(new GeneralName(GeneralName.rfc822Name, "trust_device")));
        ContentSigner signer = new JcaContentSignerBuilder(ALG_SIG_SHA256_RSA).setProvider(JCE_PROVIDER)
                .build(keyPair.getPrivate());
        return new JcaX509CertificateConverter().setProvider(JCE_PROVIDER)
                .getCertificate(certBuilder.build(signer));
    } catch (CertificateEncodingException e) {
        throw new CertException(e);
    } catch (IllegalStateException e) {
        throw new CertException(e);
    } catch (CertIOException e) {
        throw new CertException(e);
    } catch (OperatorCreationException e) {
        throw new CertException(e);
    } catch (CertificateException e) {
        throw new CertException(e);
    }
}

From source file:com.aqnote.shared.encrypt.cert.gen.BCCertGenerator.java

License:Open Source License

public X509Certificate createClass1EndCert(X500Name sdn, PublicKey pubKey, KeyPair pKeyPair) throws Exception {

    PublicKey pPubKey = pKeyPair.getPublic();
    PrivateKey pPrivKey = pKeyPair.getPrivate();

    X500Name issuer = X500NameUtil.createClass1RootPrincipal();
    BigInteger sno = BigInteger.valueOf(System.currentTimeMillis());
    Date nb = new Date(System.currentTimeMillis() - HALF_DAY);
    Date na = new Date(nb.getTime() + FIVE_YEAR);

    X509v3CertificateBuilder certBuilder = new JcaX509v3CertificateBuilder(issuer, sno, nb, na, sdn, pubKey);

    addSubjectKID(certBuilder, pubKey);/*from w ww . ja  v a 2s.  c  o  m*/
    addAuthorityKID(certBuilder, pPubKey);
    certBuilder.addExtension(Extension.extendedKeyUsage, false, new ExtendedKeyUsage(BASE_EKU));
    certBuilder.addExtension(Extension.keyUsage, false, new KeyUsage(END_KEY_USAGE));

    X509Certificate certificate = signCert(certBuilder, pPrivKey);
    certificate.checkValidity(new Date());
    certificate.verify(pPubKey);

    setPKCS9Info(certificate);

    return certificate;
}

From source file:com.aqnote.shared.encrypt.cert.gen.BCCertGenerator.java

License:Open Source License

public X509Certificate createClass3EndCert(long sno, X500Name sdn, Map<String, String> exts, KeyPair keyPair,
        KeyPair pKeyPair) throws Exception {
    PublicKey pPubKey = pKeyPair.getPublic();
    PrivateKey pPrivKey = pKeyPair.getPrivate();

    X500Name idn = X500NameUtil.createClass3RootPrincipal();
    BigInteger _sno = BigInteger.valueOf(sno <= 0 ? System.currentTimeMillis() : sno);
    Date nb = new Date(System.currentTimeMillis() - HALF_DAY);
    Date na = new Date(nb.getTime() + FIVE_YEAR);
    PublicKey pubKey = keyPair.getPublic();

    X509v3CertificateBuilder certBuilder = new JcaX509v3CertificateBuilder(idn, _sno, nb, na, sdn, pubKey);

    addSubjectKID(certBuilder, pubKey);//from   w  ww  .  j a  v a 2  s  .com
    addAuthorityKID(certBuilder, pPubKey);
    certBuilder.addExtension(Extension.extendedKeyUsage, false, new ExtendedKeyUsage(MOST_EKU));
    certBuilder.addExtension(Extension.keyUsage, false, new KeyUsage(END_KEY_USAGE));
    if (exts != null) {
        Set<String> key = exts.keySet();
        for (Iterator<String> it = key.iterator(); it.hasNext();) {
            String oid = it.next();
            String value = exts.get(oid);
            if (!StringUtils.isBlank(value)) {
                certBuilder.addExtension(new ASN1ObjectIdentifier(oid), false,
                        new DEROctetString(value.getBytes()));
            }
        }
    }

    X509Certificate certificate = signCert(certBuilder, pPrivKey);
    certificate.checkValidity(new Date());
    certificate.verify(pPubKey);

    setPKCS9Info(certificate);

    return certificate;
}

From source file:com.aqnote.shared.encrypt.cert.gen.SingleX509V3Creator.java

License:Open Source License

public static X509Certificate generate(MadCertificateObject certObject, KeyPair keyPair) throws CertException {

    try {/*from   w  w w.ja va  2  s . co m*/
        X509v3CertificateBuilder certBuilder = new JcaX509v3CertificateBuilder(
                new X500Name(certObject.getIssuer()), BigInteger.valueOf(System.currentTimeMillis()),
                certObject.getNotBefore(), certObject.getNotAfter(), new X500Name(certObject.getSubject()),
                keyPair.getPublic());

        certBuilder.addExtension(Extension.basicConstraints, true, new BasicConstraints(true));
        certBuilder.addExtension(Extension.keyUsage, true,
                new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyEncipherment));
        certBuilder.addExtension(Extension.subjectAlternativeName, false,
                new GeneralNames(new GeneralName(GeneralName.rfc822Name, "trust_device")));
        ContentSigner signer = new JcaContentSignerBuilder(ALG_SIG_SHA256_RSA).setProvider(JCE_PROVIDER)
                .build(keyPair.getPrivate());
        return new JcaX509CertificateConverter().setProvider(JCE_PROVIDER)
                .getCertificate(certBuilder.build(signer));
    } catch (CertificateEncodingException e) {
        throw new CertException(e);
    } catch (IllegalStateException e) {
        throw new CertException(e);
    } catch (CertIOException e) {
        throw new CertException(e);
    } catch (OperatorCreationException e) {
        throw new CertException(e);
    } catch (CertificateException e) {
        throw new CertException(e);
    }
}

From source file:com.difference.historybook.server.CertManager.java

License:Apache License

/**
 * Create a self-signed certificate and store in a keystore (if it doesn't already exist)
 * /*from w  w  w. ja va 2  s .c  om*/
 * @param keystore path to the keystore to save to
 * @param password password to use to encrypt keystore
 * @param alias name to give the certificate in the keystore
 * @param x500String X500 name for the certificate. (e.g. "CN=localhost,OU=issuer)
 * @param duration length of time a newly created certificate should remain valid (in seconds)
 * 
 * @throws @RuntimeException if an error occurs in creating the certificate
 */
public static void initialize(Path keystore, String password, String alias, String commonName,
        String organization, long duration) {
    if (keystore.toFile().exists()) {
        LOG.info("Keystore {} found.", keystore);
        return;
    }

    try {
        Security.addProvider(new BouncyCastleProvider());

        // generate a key pair
        KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA", PROVIDER_NAME);
        keyPairGenerator.initialize(KEY_LENGTH, new SecureRandom());
        KeyPair keyPair = keyPairGenerator.generateKeyPair();
        PublicKey pubKey = keyPair.getPublic();
        PrivateKey privateKey = keyPair.getPrivate();

        // build name
        X500NameBuilder nameBuilder = new X500NameBuilder(BCStyle.INSTANCE);
        nameBuilder.addRDN(BCStyle.CN, commonName);
        nameBuilder.addRDN(BCStyle.O, organization);
        nameBuilder.addRDN(BCStyle.OU, organization);
        X500Name issuerName = nameBuilder.build();
        X500Name subjectName = issuerName;

        // build serial
        BigInteger serial = BigInteger.valueOf(new Random().nextInt());

        // build a certificate generator
        X509v3CertificateBuilder certBuilder = new JcaX509v3CertificateBuilder(issuerName, serial,
                new Date(System.currentTimeMillis() - 24 * 60 * 60 * 1000), // yesterday
                new Date(System.currentTimeMillis() + duration * 1000), subjectName, pubKey);

        KeyUsage usage = new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyEncipherment);
        certBuilder.addExtension(Extension.keyUsage, true, usage);

        ASN1EncodableVector purposes = new ASN1EncodableVector();
        purposes.add(KeyPurposeId.id_kp_serverAuth);
        certBuilder.addExtension(Extension.extendedKeyUsage, false, new DERSequence(purposes));

        X509Certificate[] chain = new X509Certificate[1];
        chain[0] = signCertificate(certBuilder, keyPair.getPrivate());

        KeyStore keyStore = KeyStore.getInstance("JKS");
        keyStore.load(null, null);

        keyStore.setKeyEntry(alias, privateKey, password.toCharArray(), chain);
        keyStore.store(new FileOutputStream(keystore.toFile()), password.toCharArray());
        Files.setPosixFilePermissions(keystore, ImmutableSet.of(PosixFilePermission.OWNER_READ));
        LOG.info("Created keystore at {}.", keystore);
    } catch (NoSuchAlgorithmException | NoSuchProviderException | CertificateException | KeyStoreException
            | IOException | OperatorCreationException e) {
        LOG.error(e.getLocalizedMessage());
        throw new RuntimeException(e);
    }
}