Example usage for org.bouncycastle.asn1.x509 Extension nameConstraints

Introduction

In this page you can find the example usage for org.bouncycastle.asn1.x509 Extension nameConstraints.

Prototype

ASN1ObjectIdentifier nameConstraints

To view the source code for org.bouncycastle.asn1.x509 Extension nameConstraints.

Click Source Link

Document

Name Constraints

Usage

From source file:org.xipki.ca.certprofile.internal.ProfileConfCreatorDemo.java

License:Open Source License

private static X509ProfileType Certprofile_SubCA_Complex() throws Exception {
    X509ProfileType profile = getBaseProfile("Certprofile SubCA with most extensions", true, "8y", false,
            new String[] { "SHA256", "SHA1" });

    // Subject/*w  w  w  .  ja va2s.  co  m*/
    Subject subject = profile.getSubject();
    subject.setIncSerialNumber(false);

    List<RdnType> rdnControls = subject.getRdn();
    rdnControls.add(createRDN(ObjectIdentifiers.DN_C, 1, 1, new String[] { "DE|FR" }, null, null));
    rdnControls.add(createRDN(ObjectIdentifiers.DN_O, 1, 1));
    rdnControls.add(createRDN(ObjectIdentifiers.DN_OU, 0, 1));
    rdnControls.add(createRDN(ObjectIdentifiers.DN_SN, 0, 1, new String[] { REGEX_SN }, null, null));
    rdnControls.add(createRDN(ObjectIdentifiers.DN_CN, 1, 1, null, "PREFIX ", " SUFFIX"));

    // Extensions
    ExtensionsType extensions = profile.getExtensions();

    List<ExtensionType> list = extensions.getExtension();
    list.add(createExtension(Extension.subjectKeyIdentifier, true, false, null));
    list.add(createExtension(Extension.cRLDistributionPoints, false, false, null));
    list.add(createExtension(Extension.freshestCRL, false, false, null));

    // Extensions - basicConstraints
    ExtensionValueType extensionValue = createBasicConstraints(1);
    list.add(createExtension(Extension.basicConstraints, true, true, extensionValue));

    // Extensions - AuthorityInfoAccess
    extensionValue = createAuthorityInfoAccess();
    list.add(createExtension(Extension.authorityInfoAccess, true, false, extensionValue));

    // Extensions - AuthorityKeyIdentifier
    extensionValue = createAuthorityKeyIdentifier(false);
    list.add(createExtension(Extension.authorityKeyIdentifier, true, false, extensionValue));

    // Extensions - keyUsage
    extensionValue = createKeyUsages(new KeyUsageEnum[] { KeyUsageEnum.KEY_CERT_SIGN },
            new KeyUsageEnum[] { KeyUsageEnum.C_RL_SIGN });
    list.add(createExtension(Extension.keyUsage, true, true, extensionValue));

    // Certificate Policies
    extensionValue = createCertificatePolicies(new ASN1ObjectIdentifier("1.2.3.4.5"),
            new ASN1ObjectIdentifier("2.4.3.2.1"));
    list.add(createExtension(Extension.certificatePolicies, true, false, extensionValue));

    // Policy Mappings
    PolicyMappings policyMappings = new PolicyMappings();
    policyMappings.getMapping().add(createPolicyIdMapping(new ASN1ObjectIdentifier("1.1.1.1.1"),
            new ASN1ObjectIdentifier("2.1.1.1.1")));
    policyMappings.getMapping().add(createPolicyIdMapping(new ASN1ObjectIdentifier("1.1.1.1.2"),
            new ASN1ObjectIdentifier("2.1.1.1.2")));
    extensionValue = createExtensionValueType(policyMappings);
    list.add(createExtension(Extension.policyMappings, true, true, extensionValue));

    // Policy Constraints
    PolicyConstraints policyConstraints = createPolicyConstraints(2, 2);
    extensionValue = createExtensionValueType(policyConstraints);
    list.add(createExtension(Extension.policyConstraints, true, true, extensionValue));

    // Name Constrains
    NameConstraints nameConstraints = createNameConstraints();
    extensionValue = createExtensionValueType(nameConstraints);
    list.add(createExtension(Extension.nameConstraints, true, true, extensionValue));

    // Inhibit anyPolicy
    InhibitAnyPolicy inhibitAnyPolicy = createInhibitAnyPolicy(1);
    extensionValue = createExtensionValueType(inhibitAnyPolicy);
    list.add(createExtension(Extension.inhibitAnyPolicy, true, true, extensionValue));

    // SubjectAltName
    SubjectAltName subjectAltNameMode = new SubjectAltName();

    OtherName otherName = new OtherName();
    otherName.getType().add(createOidType(ObjectIdentifiers.DN_O));
    subjectAltNameMode.setOtherName(otherName);
    subjectAltNameMode.setRfc822Name("");
    subjectAltNameMode.setDNSName("");
    subjectAltNameMode.setDirectoryName("");
    subjectAltNameMode.setEdiPartyName("");
    subjectAltNameMode.setUniformResourceIdentifier("");
    subjectAltNameMode.setIPAddress("");
    subjectAltNameMode.setRegisteredID("");

    extensionValue = createExtensionValueType(subjectAltNameMode);
    list.add(createExtension(Extension.subjectAlternativeName, true, false, extensionValue));

    // SubjectInfoAccess
    SubjectInfoAccess subjectInfoAccessMode = new SubjectInfoAccess();

    SubjectInfoAccess.Access access = new SubjectInfoAccess.Access();
    access.setAccessMethod(createOidType(ObjectIdentifiers.id_ad_caRepository));

    GeneralNameType accessLocation = new GeneralNameType();
    access.setAccessLocation(accessLocation);
    accessLocation.setDirectoryName("");
    accessLocation.setUniformResourceIdentifier("");

    subjectInfoAccessMode.getAccess().add(access);

    extensionValue = createExtensionValueType(subjectInfoAccessMode);
    list.add(createExtension(Extension.subjectInfoAccess, true, false, extensionValue));

    // Custom Extension
    ASN1ObjectIdentifier customExtensionOid = new ASN1ObjectIdentifier("1.2.3.4");
    extensionValue = createConstantExtValue(DERNull.INSTANCE.getEncoded());
    list.add(createExtension(customExtensionOid, true, false, extensionValue, "custom extension 1"));

    return profile;
}

---

From source file:org.xipki.ca.certprofile.XmlX509Certprofile.java

License:Open Source License

private void doInitialize(final String data) throws CertprofileException {
    byte[] bytes;
    try {/*from   ww  w  .j  av  a2 s . c  o  m*/
        bytes = data.getBytes("UTF-8");
    } catch (UnsupportedEncodingException e) {
        bytes = data.getBytes();
    }

    X509ProfileType conf = XmlX509CertprofileUtil.parse(new ByteArrayInputStream(bytes));

    if (conf.getVersion() != null) {
        int intVersion = conf.getVersion().intValue();
        this.version = X509CertVersion.getInstance(intVersion);
        if (this.version == null) {
            throw new CertprofileException("invalid version " + intVersion);
        }
    } else {
        this.version = X509CertVersion.V3;
    }

    if (conf.getSignatureAlgorithms() != null) {
        List<String> algoNames = conf.getSignatureAlgorithms().getAlgorithm();
        this.signatureAlgorithms = new ArrayList<>(algoNames.size());
        for (String algoName : algoNames) {
            try {
                this.signatureAlgorithms.add(AlgorithmUtil.canonicalizeSignatureAlgo(algoName));
            } catch (NoSuchAlgorithmException e) {
                throw new CertprofileException(e.getMessage(), e);
            }
        }
    }

    this.raOnly = conf.isRaOnly();
    this.qaOnly = conf.isQaOnly();

    this.validity = CertValidity.getInstance(conf.getValidity());
    this.ca = conf.isCa();
    this.notBeforeMidnight = "midnight".equalsIgnoreCase(conf.getNotBeforeTime());

    String specialBehavior = conf.getSpecialBehavior();
    if (specialBehavior != null) {
        this.specialBehavior = SpecialX509CertprofileBehavior.getInstance(specialBehavior);
    }

    if (conf.isDuplicateKey() != null) {
        duplicateKeyPermitted = conf.isDuplicateKey().booleanValue();
    }

    if (conf.isDuplicateSubject() != null) {
        duplicateSubjectPermitted = conf.isDuplicateSubject().booleanValue();
    }

    if (conf.isSerialNumberInReq() != null) {
        serialNumberInReqPermitted = conf.isSerialNumberInReq().booleanValue();
    }

    // KeyAlgorithms
    KeyAlgorithms keyAlgos = conf.getKeyAlgorithms();
    if (keyAlgos != null) {
        this.keyAlgorithms = XmlX509CertprofileUtil.buildKeyAlgorithms(keyAlgos);
    }

    // parameters
    Parameters confParams = conf.getParameters();
    if (confParams == null) {
        parameters = null;
    } else {
        Map<String, String> tMap = new HashMap<>();
        for (NameValueType nv : confParams.getParameter()) {
            tMap.put(nv.getName(), nv.getValue());
        }
        parameters = Collections.unmodifiableMap(tMap);
    }

    // Subject
    Subject subject = conf.getSubject();
    if (subject != null) {
        this.backwardsSubject = subject.isDnBackwards();
        this.incSerialNoIfSubjectExists = subject.isIncSerialNumber();

        this.subjectDNControls = new HashSet<RDNControl>();
        this.subjectDNOptions = new HashMap<>();

        for (RdnType t : subject.getRdn()) {
            DirectoryStringType directoryStringEnum = XmlX509CertprofileUtil
                    .convertDirectoryStringType(t.getDirectoryStringType());
            ASN1ObjectIdentifier type = new ASN1ObjectIdentifier(t.getType().getValue());
            RDNControl occ = new RDNControl(type, t.getMinOccurs(), t.getMaxOccurs(), directoryStringEnum);
            this.subjectDNControls.add(occ);

            List<Pattern> patterns = null;
            if (CollectionUtil.isNotEmpty(t.getRegex())) {
                patterns = new LinkedList<>();
                for (String regex : t.getRegex()) {
                    Pattern pattern = Pattern.compile(regex);
                    patterns.add(pattern);
                }
            }

            SubjectDNOption option = new SubjectDNOption(t.getPrefix(), t.getSuffix(), patterns, t.getMinLen(),
                    t.getMaxLen());
            this.subjectDNOptions.put(type, option);
        }
    }

    // Extensions
    ExtensionsType extensionsType = conf.getExtensions();

    // Extension controls
    this.extensionControls = XmlX509CertprofileUtil.buildExtensionControls(extensionsType);

    // BasicConstrains
    ASN1ObjectIdentifier type = Extension.basicConstraints;
    if (extensionControls.containsKey(type)) {
        BasicConstraints extConf = (BasicConstraints) getExtensionValue(type, extensionsType,
                BasicConstraints.class);
        if (extConf != null) {
            this.pathLen = extConf.getPathLen();
        }
    }

    // AuthorityInfoAccess
    type = Extension.authorityInfoAccess;
    if (extensionControls.containsKey(type)) {
        AuthorityInfoAccess extConf = (AuthorityInfoAccess) getExtensionValue(type, extensionsType,
                AuthorityInfoAccess.class);
        if (extConf != null) {
            Boolean b = extConf.isIncludeCaIssuers();
            boolean includesCaIssuers = b == null ? true : b.booleanValue();

            b = extConf.isIncludeOcsp();
            boolean includesOcsp = b == null ? true : b.booleanValue();

            this.aIAControl = new AuthorityInfoAccessControl(includesCaIssuers, includesOcsp);
        }
    }

    // Extension KeyUsage
    type = Extension.keyUsage;
    if (extensionControls.containsKey(type)) {
        KeyUsage extConf = (KeyUsage) getExtensionValue(type, extensionsType, KeyUsage.class);
        if (extConf != null) {
            this.keyusages = XmlX509CertprofileUtil.buildKeyUsageOptions(extConf);
        }
    }

    // ExtendedKeyUsage
    type = Extension.extendedKeyUsage;
    if (extensionControls.containsKey(type)) {
        ExtendedKeyUsage extConf = (ExtendedKeyUsage) getExtensionValue(type, extensionsType,
                ExtendedKeyUsage.class);
        if (extConf != null) {
            this.extendedKeyusages = XmlX509CertprofileUtil.buildExtKeyUsageOptions(extConf);
        }
    }

    // AuthorityKeyIdentifier
    type = Extension.authorityKeyIdentifier;
    if (extensionControls.containsKey(type)) {
        AuthorityKeyIdentifier extConf = (AuthorityKeyIdentifier) getExtensionValue(type, extensionsType,
                AuthorityKeyIdentifier.class);
        if (extConf != null) {
            this.includeIssuerAndSerialInAKI = extConf.isIncludeIssuerAndSerial();
        }
    }

    // Certificate Policies
    type = Extension.certificatePolicies;
    if (extensionControls.containsKey(type)) {
        CertificatePolicies extConf = (CertificatePolicies) getExtensionValue(type, extensionsType,
                CertificatePolicies.class);
        if (extConf != null) {
            List<CertificatePolicyInformation> policyInfos = XmlX509CertprofileUtil
                    .buildCertificatePolicies(extConf);
            org.bouncycastle.asn1.x509.CertificatePolicies value = X509CertUtil
                    .createCertificatePolicies(policyInfos);
            this.certificatePolicies = new ExtensionValue(extensionControls.get(type).isCritical(), value);
        }
    }

    // Policy Mappings
    type = Extension.policyMappings;
    if (extensionControls.containsKey(type)) {
        PolicyMappings extConf = (PolicyMappings) getExtensionValue(type, extensionsType, PolicyMappings.class);
        if (extConf != null) {
            org.bouncycastle.asn1.x509.PolicyMappings value = XmlX509CertprofileUtil
                    .buildPolicyMappings(extConf);
            this.policyMappings = new ExtensionValue(extensionControls.get(type).isCritical(), value);
        }
    }

    // Name Constrains
    type = Extension.nameConstraints;
    if (extensionControls.containsKey(type)) {
        NameConstraints extConf = (NameConstraints) getExtensionValue(type, extensionsType,
                NameConstraints.class);
        if (extConf != null) {
            org.bouncycastle.asn1.x509.NameConstraints value = XmlX509CertprofileUtil
                    .buildNameConstrains(extConf);
            this.nameConstraints = new ExtensionValue(extensionControls.get(type).isCritical(), value);
        }
    }

    // Policy Constraints
    type = Extension.policyConstraints;
    if (extensionControls.containsKey(type)) {
        PolicyConstraints extConf = (PolicyConstraints) getExtensionValue(type, extensionsType,
                PolicyConstraints.class);
        if (extConf != null) {
            ASN1Sequence value = XmlX509CertprofileUtil.buildPolicyConstrains(extConf);
            this.policyConstraints = new ExtensionValue(extensionControls.get(type).isCritical(), value);
        }
    }

    // Inhibit anyPolicy
    type = Extension.inhibitAnyPolicy;
    if (extensionControls.containsKey(type)) {
        InhibitAnyPolicy extConf = (InhibitAnyPolicy) getExtensionValue(type, extensionsType,
                InhibitAnyPolicy.class);
        if (extConf != null) {
            int skipCerts = extConf.getSkipCerts();
            if (skipCerts < 0) {
                throw new CertprofileException(
                        "negative inhibitAnyPolicy.skipCerts is not allowed: " + skipCerts);
            }
            ASN1Integer value = new ASN1Integer(BigInteger.valueOf(skipCerts));
            this.inhibitAnyPolicy = new ExtensionValue(extensionControls.get(type).isCritical(), value);
        }
    }

    // admission
    type = ObjectIdentifiers.id_extension_admission;
    if (extensionControls.containsKey(type)) {
        Admission extConf = (Admission) getExtensionValue(type, extensionsType, Admission.class);
        if (extConf != null) {
            List<ASN1ObjectIdentifier> professionOIDs;
            List<String> professionItems;

            List<String> items = type == null ? null : extConf.getProfessionItem();
            professionItems = CollectionUtil.unmodifiableList(items, true, true);

            List<OidWithDescType> oidWithDescs = (type == null) ? null : extConf.getProfessionOid();
            professionOIDs = XmlX509CertprofileUtil.toOIDList(oidWithDescs);

            this.admission = createAdmission(extensionControls.get(type).isCritical(), professionOIDs,
                    professionItems, extConf.getRegistrationNumber(), extConf.getAddProfessionInfo());
        }
    }

    // SubjectAltNameMode
    type = Extension.subjectAlternativeName;
    if (extensionControls.containsKey(type)) {
        SubjectAltName extConf = (SubjectAltName) getExtensionValue(type, extensionsType, SubjectAltName.class);
        if (extConf != null) {
            this.allowedSubjectAltNameModes = XmlX509CertprofileUtil.buildGeneralNameMode(extConf);
        }
    }

    // SubjectInfoAccess
    type = Extension.subjectInfoAccess;
    if (extensionControls.containsKey(type)) {
        SubjectInfoAccess extConf = (SubjectInfoAccess) getExtensionValue(type, extensionsType,
                SubjectInfoAccess.class);
        if (extConf != null) {
            List<Access> list = extConf.getAccess();
            this.allowedSubjectInfoAccessModes = new HashMap<>();
            for (Access entry : list) {
                this.allowedSubjectInfoAccessModes.put(
                        new ASN1ObjectIdentifier(entry.getAccessMethod().getValue()),
                        XmlX509CertprofileUtil.buildGeneralNameMode(entry.getAccessLocation()));
            }
        }
    }

    // constant extensions
    this.constantExtensions = XmlX509CertprofileUtil.buildConstantExtesions(extensionsType);
}

---

From source file:org.xipki.ca.certprofile.XmlX509Certprofile.java

License:Open Source License

@Override
public ExtensionValues getExtensions(final Map<ASN1ObjectIdentifier, ExtensionControl> extensionOccurences,
        final X500Name requestedSubject, final Extensions requestedExtensions)
        throws CertprofileException, BadCertTemplateException {
    ExtensionValues values = new ExtensionValues();
    if (CollectionUtil.isEmpty(extensionOccurences)) {
        return values;
    }/*from  w  w  w  .  ja  v a  2  s  .  com*/

    Map<ASN1ObjectIdentifier, ExtensionControl> occurences = new HashMap<>(extensionOccurences);

    // AuthorityKeyIdentifier
    // processed by the CA

    // SubjectKeyIdentifier
    // processed by the CA

    // KeyUsage
    // processed by the CA

    // CertificatePolicies
    ASN1ObjectIdentifier type = Extension.certificatePolicies;
    if (certificatePolicies != null && occurences.remove(type) != null) {
        values.addExtension(type, certificatePolicies);
    }

    // Policy Mappings
    type = Extension.policyMappings;
    if (policyMappings != null && occurences.remove(type) != null) {
        values.addExtension(type, policyMappings);
    }

    // SubjectAltName
    // processed by the CA

    // IssuerAltName
    // processed by the CA

    // Subject Directory Attributes
    // Will not supported

    // Basic Constraints
    // processed by the CA

    // Name Constraints
    type = Extension.nameConstraints;
    if (nameConstraints != null && occurences.remove(type) != null) {
        values.addExtension(type, nameConstraints);
    }

    // PolicyConstrains
    type = Extension.policyConstraints;
    if (policyConstraints != null && occurences.remove(type) != null) {
        values.addExtension(type, policyConstraints);
    }

    // ExtendedKeyUsage
    // processed by CA

    // CRL Distribution Points
    // processed by the CA

    // Inhibit anyPolicy
    type = Extension.inhibitAnyPolicy;
    if (inhibitAnyPolicy != null && occurences.remove(type) != null) {
        values.addExtension(type, inhibitAnyPolicy);
    }

    // Freshest CRL
    // processed by the CA

    // Authority Information Access
    // processed by the CA

    // Subject Information Access
    // processed by the CA

    // Admission
    type = ObjectIdentifiers.id_extension_admission;
    if (admission != null && occurences.remove(type) != null) {
        values.addExtension(type, admission);
    }

    // OCSP Nocheck
    // processed by the CA

    // constant extensions
    if (constantExtensions != null) {
        for (ASN1ObjectIdentifier m : constantExtensions.keySet()) {
            ExtensionControl occurence = occurences.remove(m);
            if (occurence == null) {
                continue;
            }

            ExtensionValue extensionValue = constantExtensions.get(m);
            if (extensionValue != null) {
                values.addExtension(m, extensionValue);
            }
        }
    }

    return values;
}

---

From source file:org.xipki.ca.qa.impl.X509CertprofileQAImpl.java

License:Open Source License

public X509CertprofileQAImpl(final byte[] dataBytes) throws CertprofileException {
    try {/*from w  ww . j a v a  2  s.  c  o  m*/
        X509ProfileType conf = XmlX509CertprofileUtil.parse(new ByteArrayInputStream(dataBytes));

        this.version = X509CertVersion.getInstance(conf.getVersion());
        if (this.version == null) {
            throw new CertprofileException("invalid version " + conf.getVersion());
        }

        if (conf.getSignatureAlgorithms() != null) {
            this.signatureAlgorithms = new HashSet<>();
            for (String algo : conf.getSignatureAlgorithms().getAlgorithm()) {
                String c14nAlgo;
                try {
                    c14nAlgo = AlgorithmUtil.canonicalizeSignatureAlgo(algo);
                } catch (NoSuchAlgorithmException e) {
                    throw new CertprofileException(e.getMessage(), e);
                }
                this.signatureAlgorithms.add(c14nAlgo);
            }
        }

        this.validity = CertValidity.getInstance(conf.getValidity());
        this.ca = conf.isCa();
        this.notBeforeMidnight = "midnight".equalsIgnoreCase(conf.getNotBeforeTime());
        this.specialBehavior = conf.getSpecialBehavior();
        if (this.specialBehavior != null && "gematik_gSMC_K".equalsIgnoreCase(this.specialBehavior) == false) {
            throw new CertprofileException("unknown special bahavior " + this.specialBehavior);
        }

        // KeyAlgorithms
        if (conf.getKeyAlgorithms() != null) {
            this.keyAlgorithms = XmlX509CertprofileUtil.buildKeyAlgorithms(conf.getKeyAlgorithms());
        }

        // Subject
        if (conf.getSubject() != null) {
            Subject subject = conf.getSubject();

            this.subjectDNControls = new HashSet<RDNControl>();
            this.subjectDNOptions = new HashMap<>();

            for (RdnType t : subject.getRdn()) {
                DirectoryStringType directoryStringEnum = XmlX509CertprofileUtil
                        .convertDirectoryStringType(t.getDirectoryStringType());
                ASN1ObjectIdentifier type = new ASN1ObjectIdentifier(t.getType().getValue());
                RDNControl occ = new RDNControl(type, getInt(t.getMinOccurs(), 1), getInt(t.getMaxOccurs(), 1),
                        directoryStringEnum);
                this.subjectDNControls.add(occ);

                List<Pattern> patterns = null;
                if (CollectionUtil.isNotEmpty(t.getRegex())) {
                    patterns = new LinkedList<>();
                    for (String regex : t.getRegex()) {
                        Pattern pattern = Pattern.compile(regex);
                        patterns.add(pattern);
                    }
                }

                SubjectDNOption option = new SubjectDNOption(t.getPrefix(), t.getSuffix(), patterns,
                        t.getMinLen(), t.getMaxLen());
                this.subjectDNOptions.put(type, option);
            }
        }

        // Extensions
        ExtensionsType extensionsType = conf.getExtensions();

        // Extension controls
        this.extensionControls = XmlX509CertprofileUtil.buildExtensionControls(extensionsType);

        // BasicConstrains
        ASN1ObjectIdentifier type = Extension.basicConstraints;
        if (extensionControls.containsKey(type)) {
            org.xipki.ca.certprofile.x509.jaxb.BasicConstraints extConf = (org.xipki.ca.certprofile.x509.jaxb.BasicConstraints) getExtensionValue(
                    type, extensionsType);
            if (extConf != null) {
                this.pathLen = extConf.getPathLen();
            }
        }

        // Extension KeyUsage
        type = Extension.keyUsage;
        if (extensionControls.containsKey(type)) {
            org.xipki.ca.certprofile.x509.jaxb.KeyUsage extConf = (org.xipki.ca.certprofile.x509.jaxb.KeyUsage) getExtensionValue(
                    type, extensionsType);
            if (extConf != null) {
                this.keyusages = XmlX509CertprofileUtil.buildKeyUsageOptions(extConf);
            }
        }

        // ExtendedKeyUsage
        type = Extension.extendedKeyUsage;
        if (extensionControls.containsKey(type)) {
            ExtendedKeyUsage extConf = (ExtendedKeyUsage) getExtensionValue(type, extensionsType);
            if (extConf != null) {
                this.extendedKeyusages = XmlX509CertprofileUtil.buildExtKeyUsageOptions(extConf);
            }
        }

        // AuthorityKeyIdentifier
        type = Extension.authorityKeyIdentifier;
        if (extensionControls.containsKey(type)) {
            org.xipki.ca.certprofile.x509.jaxb.AuthorityKeyIdentifier extConf = (org.xipki.ca.certprofile.x509.jaxb.AuthorityKeyIdentifier) getExtensionValue(
                    type, extensionsType);
            if (extConf != null) {
                this.includeIssuerAndSerialInAKI = extConf.isIncludeIssuerAndSerial();
            }
        }

        // Certificate Policies
        type = Extension.certificatePolicies;
        if (extensionControls.containsKey(type)) {
            org.xipki.ca.certprofile.x509.jaxb.CertificatePolicies extConf = (org.xipki.ca.certprofile.x509.jaxb.CertificatePolicies) getExtensionValue(
                    type, extensionsType);
            if (extConf != null) {
                this.certificatePolicies = new QaCertificatePolicies(extConf);
            }
        }

        // Policy Mappings
        type = Extension.policyMappings;
        if (extensionControls.containsKey(type)) {
            PolicyMappings extConf = (PolicyMappings) getExtensionValue(type, extensionsType);
            if (extConf != null) {
                this.policyMappings = new QaPolicyMappingsOption(extConf);
            }
        }

        // Name Constrains
        // Name Constrains
        type = Extension.nameConstraints;
        if (extensionControls.containsKey(type)) {
            org.xipki.ca.certprofile.x509.jaxb.NameConstraints extConf = (org.xipki.ca.certprofile.x509.jaxb.NameConstraints) getExtensionValue(
                    type, extensionsType);
            if (extConf != null) {
                this.nameConstraints = new QaNameConstraints(extConf);
            }
        }

        // Policy Constraints
        type = Extension.policyConstraints;
        if (extensionControls.containsKey(type)) {
            PolicyConstraints extConf = (PolicyConstraints) getExtensionValue(type, extensionsType);
            if (extConf != null) {
                this.policyConstraints = new QaPolicyConstraints(extConf);
            }
        }

        // Inhibit anyPolicy
        type = Extension.inhibitAnyPolicy;
        if (extensionControls.containsKey(type)) {
            InhibitAnyPolicy extConf = (InhibitAnyPolicy) getExtensionValue(type, extensionsType);
            if (extConf != null) {
                this.inhibitAnyPolicy = new QaInhibitAnyPolicy(extConf);
            }
        }

        // admission
        type = ObjectIdentifiers.id_extension_admission;
        if (extensionControls.containsKey(type)) {
            Admission extConf = (Admission) getExtensionValue(type, extensionsType);
            if (extConf != null) {
                this.admission = new QaAdmission(extConf);
            }
        }

        // SubjectAltNameMode
        type = Extension.subjectAlternativeName;
        if (extensionControls.containsKey(type)) {
            SubjectAltName extConf = (SubjectAltName) getExtensionValue(type, extensionsType);
            if (extConf != null) {
                this.allowedSubjectAltNameModes = XmlX509CertprofileUtil.buildGeneralNameMode(extConf);
            }
        }

        // SubjectInfoAccess
        type = Extension.subjectInfoAccess;
        if (extensionControls.containsKey(type)) {
            SubjectInfoAccess extConf = (SubjectInfoAccess) getExtensionValue(type, extensionsType);
            if (extConf != null) {
                List<Access> list = extConf.getAccess();
                this.allowedSubjectInfoAccessModes = new HashMap<>();
                for (Access entry : list) {
                    this.allowedSubjectInfoAccessModes.put(
                            new ASN1ObjectIdentifier(entry.getAccessMethod().getValue()),
                            XmlX509CertprofileUtil.buildGeneralNameMode(entry.getAccessLocation()));
                }
            }
        }

        // constant extensions
        this.constantExtensions = buildConstantExtesions(extensionsType);
    } catch (RuntimeException e) {
        final String message = "RuntimeException";
        if (LOG.isErrorEnabled()) {
            LOG.error(LogUtil.buildExceptionLogFormat(message), e.getClass().getName(), e.getMessage());
        }
        LOG.debug(message, e);
        throw new CertprofileException(
                "RuntimeException thrown while initializing certprofile: " + e.getMessage());
    }
}

---

From source file:org.xipki.ca.qa.impl.X509CertprofileQAImpl.java

License:Open Source License

private List<ValidationIssue> checkExtensions(final Certificate bcCert, final X509Certificate cert,
        final X509IssuerInfo issuerInfo, final Extensions requestExtensions) {
    List<ValidationIssue> result = new LinkedList<>();

    // detect the list of extension types in certificate
    Set<ASN1ObjectIdentifier> presentExtenionTypes = getExensionTypes(bcCert, issuerInfo, requestExtensions);

    Extensions extensions = bcCert.getTBSCertificate().getExtensions();
    ASN1ObjectIdentifier[] oids = extensions.getExtensionOIDs();

    if (oids == null) {
        ValidationIssue issue = new ValidationIssue("X509.EXT.GEN", "extension general");
        result.add(issue);/*  w w w .ja v a  2 s.  c om*/
        issue.setFailureMessage("no extension is present");
        return result;
    }

    List<ASN1ObjectIdentifier> certExtTypes = Arrays.asList(oids);

    for (ASN1ObjectIdentifier extType : presentExtenionTypes) {
        if (certExtTypes.contains(extType) == false) {
            ValidationIssue issue = createExtensionIssue(extType);
            result.add(issue);
            issue.setFailureMessage("extension is absent but is required");
        }
    }

    for (ASN1ObjectIdentifier oid : certExtTypes) {
        ValidationIssue issue = createExtensionIssue(oid);
        result.add(issue);
        if (presentExtenionTypes.contains(oid) == false) {
            issue.setFailureMessage("extension is present but is not permitted");
            continue;
        }

        Extension ext = extensions.getExtension(oid);
        StringBuilder failureMsg = new StringBuilder();
        ExtensionControl extControl = extensionControls.get(oid);

        if (extControl.isCritical() != ext.isCritical()) {
            failureMsg.append(
                    "critical is '" + ext.isCritical() + "' but expected '" + extControl.isCritical() + "'");
            failureMsg.append("; ");
        }

        byte[] extensionValue = ext.getExtnValue().getOctets();

        try {
            if (Extension.authorityKeyIdentifier.equals(oid)) {
                // AuthorityKeyIdentifier
                checkExtensionIssuerKeyIdentifier(failureMsg, extensionValue, issuerInfo);
            } else if (Extension.subjectKeyIdentifier.equals(oid)) {
                // SubjectKeyIdentifier
                checkExtensionSubjectKeyIdentifier(failureMsg, extensionValue,
                        bcCert.getSubjectPublicKeyInfo());
            } else if (Extension.keyUsage.equals(oid)) {
                // KeyUsage
                checkExtensionKeyUsage(failureMsg, extensionValue, cert.getKeyUsage(), requestExtensions,
                        extControl);
            } else if (Extension.certificatePolicies.equals(oid)) {
                // CertificatePolicies
                checkExtensionCertificatePolicies(failureMsg, extensionValue, requestExtensions, extControl);
            } else if (Extension.policyMappings.equals(oid)) {
                // Policy Mappings
                checkExtensionPolicyMappings(failureMsg, extensionValue, requestExtensions, extControl);
            } else if (Extension.subjectAlternativeName.equals(oid)) {
                // SubjectAltName
                checkExtensionSubjectAltName(failureMsg, extensionValue, requestExtensions, extControl);
            } else if (Extension.issuerAlternativeName.equals(oid)) {
                // IssuerAltName
                checkExtensionIssuerAltNames(failureMsg, extensionValue, issuerInfo);
            } else if (Extension.basicConstraints.equals(oid)) {
                // Basic Constraints
                checkExtensionBasicConstraints(failureMsg, extensionValue);
            } else if (Extension.nameConstraints.equals(oid)) {
                // Name Constraints
                checkExtensionNameConstraints(failureMsg, extensionValue, extensions, extControl);
            } else if (Extension.policyConstraints.equals(oid)) {
                // PolicyConstrains
                checkExtensionPolicyConstraints(failureMsg, extensionValue, requestExtensions, extControl);
            } else if (Extension.extendedKeyUsage.equals(oid)) {
                // ExtendedKeyUsage
                checkExtensionExtendedKeyUsage(failureMsg, extensionValue, requestExtensions, extControl);
            } else if (Extension.cRLDistributionPoints.equals(oid)) {
                // CRL Distribution Points
                checkExtensionCrlDistributionPoints(failureMsg, extensionValue, issuerInfo);
                continue;
            } else if (Extension.inhibitAnyPolicy.equals(oid)) {
                // Inhibit anyPolicy
                checkExtensionInhibitAnyPolicy(failureMsg, extensionValue, extensions, extControl);
            } else if (Extension.freshestCRL.equals(oid)) {
                // Freshest CRL
                checkExtensionDeltaCrlDistributionPoints(failureMsg, extensionValue, issuerInfo);
            } else if (Extension.authorityInfoAccess.equals(oid)) {
                // Authority Information Access
                checkExtensionAuthorityInfoAccess(failureMsg, extensionValue, issuerInfo);
            } else if (Extension.subjectInfoAccess.equals(oid)) {
                // SubjectInfoAccess
                checkExtensionSubjectInfoAccess(failureMsg, extensionValue, requestExtensions, extControl);
            } else if (ObjectIdentifiers.id_extension_admission.equals(oid)) {
                // Admission
                checkExtensionAdmission(failureMsg, extensionValue, requestExtensions, extControl);
            } else if (ObjectIdentifiers.id_extension_pkix_ocsp_nocheck.equals(oid)) {
                // ocsp-nocheck
                checkExtensionOcspNocheck(failureMsg, extensionValue);
            } else {
                byte[] expected = getExpectedExtValue(oid, requestExtensions, extControl);
                if (Arrays.equals(expected, extensionValue) == false) {
                    failureMsg.append("extension valus is '" + hex(extensionValue) + "' but expected '"
                            + (expected == null ? "not present" : hex(expected)) + "'");
                    failureMsg.append("; ");
                }
            }

            if (failureMsg.length() > 0) {
                issue.setFailureMessage(failureMsg.toString());
            }

        } catch (IllegalArgumentException | ClassCastException | ArrayIndexOutOfBoundsException e) {
            LOG.debug("extension value does not have correct syntax", e);
            issue.setFailureMessage("extension value does not have correct syntax");
        }
    }

    return result;
}

---

From source file:org.xipki.ca.qa.impl.X509CertprofileQAImpl.java

License:Open Source License

private Set<ASN1ObjectIdentifier> getExensionTypes(final Certificate cert, final X509IssuerInfo issuerInfo,
        final Extensions requestedExtensions) {
    Set<ASN1ObjectIdentifier> types = new HashSet<>();
    // profile required extension types
    for (ASN1ObjectIdentifier oid : extensionControls.keySet()) {
        if (extensionControls.get(oid).isRequired()) {
            types.add(oid);//from  www . j  a v  a 2 s . c  o m
        }
    }

    Set<ASN1ObjectIdentifier> wantedExtensionTypes = new HashSet<>();

    if (requestedExtensions != null) {
        Extension reqExtension = requestedExtensions
                .getExtension(ObjectIdentifiers.id_xipki_ext_cmpRequestExtensions);
        if (reqExtension != null) {
            ExtensionExistence ee = ExtensionExistence.getInstance(reqExtension.getParsedValue());
            types.addAll(ee.getNeedExtensions());
            wantedExtensionTypes.addAll(ee.getWantExtensions());
        }
    }

    if (CollectionUtil.isEmpty(wantedExtensionTypes)) {
        return types;
    }

    // wanted extension types
    // Authority key identifier
    ASN1ObjectIdentifier type = Extension.authorityKeyIdentifier;
    if (wantedExtensionTypes.contains(type)) {
        types.add(type);
    }

    // Subject key identifier
    type = Extension.subjectKeyIdentifier;
    if (wantedExtensionTypes.contains(type)) {
        types.add(type);
    }

    // KeyUsage
    type = Extension.keyUsage;
    if (wantedExtensionTypes.contains(type)) {
        boolean required = false;
        if (requestedExtensions.getExtension(type) != null) {
            required = true;
        }

        if (required == false) {
            Set<KeyUsageControl> requiredKeyusage = getKeyusage(true);
            if (CollectionUtil.isNotEmpty(requiredKeyusage)) {
                required = true;
            }
        }

        if (required) {
            types.add(type);
        }
    }

    // CertificatePolicies
    type = Extension.certificatePolicies;
    if (wantedExtensionTypes.contains(type)) {
        if (certificatePolicies != null) {
            types.add(type);
        }
    }

    // Policy Mappings
    type = Extension.policyMappings;
    if (wantedExtensionTypes.contains(type)) {
        if (policyMappings != null) {
            types.add(type);
        }
    }

    // SubjectAltNames
    type = Extension.subjectAlternativeName;
    if (wantedExtensionTypes.contains(type)) {
        if (requestedExtensions.getExtension(type) != null) {
            types.add(type);
        }
    }

    // IssuerAltName
    type = Extension.issuerAlternativeName;
    if (wantedExtensionTypes.contains(type)) {
        if (cert.getTBSCertificate().getExtensions().getExtension(Extension.subjectAlternativeName) != null) {
            types.add(type);
        }
    }

    // BasicConstraints
    type = Extension.basicConstraints;
    if (wantedExtensionTypes.contains(type)) {
        types.add(type);
    }

    // Name Constraints
    type = Extension.nameConstraints;
    if (wantedExtensionTypes.contains(type)) {
        if (nameConstraints != null) {
            types.add(type);
        }
    }

    // PolicyConstrains
    type = Extension.policyConstraints;
    if (wantedExtensionTypes.contains(type)) {
        if (policyConstraints != null) {
            types.add(type);
        }
    }

    // ExtendedKeyUsage
    type = Extension.extendedKeyUsage;
    if (wantedExtensionTypes.contains(type)) {
        boolean required = false;
        if (requestedExtensions.getExtension(type) != null) {
            required = true;
        }

        if (required == false) {
            Set<ExtKeyUsageControl> requiredExtKeyusage = getExtKeyusage(true);
            if (CollectionUtil.isNotEmpty(requiredExtKeyusage)) {
                required = true;
            }
        }

        if (required) {
            types.add(type);
        }
    }

    // CRLDistributionPoints
    type = Extension.cRLDistributionPoints;
    if (wantedExtensionTypes.contains(type)) {
        if (issuerInfo.getCrlURLs() != null) {
            types.add(type);
        }
    }

    // Inhibit anyPolicy
    type = Extension.inhibitAnyPolicy;
    if (wantedExtensionTypes.contains(type)) {
        if (inhibitAnyPolicy != null) {
            types.add(type);
        }
    }

    // FreshestCRL
    type = Extension.freshestCRL;
    if (wantedExtensionTypes.contains(type)) {
        if (issuerInfo.getDeltaCrlURLs() != null) {
            types.add(type);
        }
    }

    // AuthorityInfoAccess
    type = Extension.authorityInfoAccess;
    if (wantedExtensionTypes.contains(type)) {
        if (issuerInfo.getOcspURLs() != null) {
            types.add(type);
        }
    }

    // SubjectInfoAccess
    type = Extension.subjectInfoAccess;
    if (wantedExtensionTypes.contains(type)) {
        if (requestedExtensions.getExtension(type) != null) {
            types.add(type);
        }
    }

    // Admission
    type = ObjectIdentifiers.id_extension_admission;
    if (wantedExtensionTypes.contains(type)) {
        if (admission != null) {
            types.add(type);
        }
    }

    // ocsp-nocheck
    type = ObjectIdentifiers.id_extension_pkix_ocsp_nocheck;
    if (wantedExtensionTypes.contains(type)) {
        types.add(type);
    }

    wantedExtensionTypes.removeAll(types);

    for (ASN1ObjectIdentifier oid : wantedExtensionTypes) {
        if (requestedExtensions.getExtension(oid) != null) {
            if (constantExtensions.containsKey(oid)) {
                types.add(oid);
            }
        }
    }

    return types;
}

---

From source file:org.xipki.ca.qa.impl.X509CertprofileQAImpl.java

License:Open Source License

private void checkExtensionNameConstraints(final StringBuilder failureMsg, final byte[] extensionValue,
        final Extensions requestExtensions, final ExtensionControl extControl) {
    QaNameConstraints conf = nameConstraints;

    if (conf == null) {
        byte[] expected = getExpectedExtValue(Extension.nameConstraints, requestExtensions, extControl);
        if (Arrays.equals(expected, extensionValue) == false) {
            failureMsg.append("extension valus is '" + hex(extensionValue) + "' but expected '"
                    + (expected == null ? "not present" : hex(expected)) + "'");
            failureMsg.append("; ");
        }//from w  w  w .j  a v a  2  s.  c o m
        return;
    }

    org.bouncycastle.asn1.x509.NameConstraints iNameConstraints = org.bouncycastle.asn1.x509.NameConstraints
            .getInstance(extensionValue);

    checkExtensionNameConstraintsSubtrees(failureMsg, "PermittedSubtrees",
            iNameConstraints.getPermittedSubtrees(), conf.getPermittedSubtrees());
    checkExtensionNameConstraintsSubtrees(failureMsg, "ExcludedSubtrees",
            iNameConstraints.getExcludedSubtrees(), conf.getExcludedSubtrees());
}

---

From source file:org.xipki.commons.console.karaf.completer.ExtensionNameCompleter.java

License:Open Source License

public ExtensionNameCompleter() {
    List<ASN1ObjectIdentifier> oids = new LinkedList<>();
    oids.add(ObjectIdentifiers.id_extension_pkix_ocsp_nocheck);
    oids.add(ObjectIdentifiers.id_extension_admission);
    oids.add(Extension.auditIdentity);
    oids.add(Extension.authorityInfoAccess);
    oids.add(Extension.authorityKeyIdentifier);
    oids.add(Extension.basicConstraints);
    oids.add(Extension.biometricInfo);
    oids.add(Extension.certificateIssuer);
    oids.add(Extension.certificatePolicies);
    oids.add(Extension.cRLDistributionPoints);
    oids.add(Extension.cRLNumber);
    oids.add(Extension.deltaCRLIndicator);
    oids.add(Extension.extendedKeyUsage);
    oids.add(Extension.freshestCRL);
    oids.add(Extension.inhibitAnyPolicy);
    oids.add(Extension.instructionCode);
    oids.add(Extension.invalidityDate);
    oids.add(Extension.issuerAlternativeName);
    oids.add(Extension.issuingDistributionPoint);
    oids.add(Extension.keyUsage);
    oids.add(Extension.logoType);
    oids.add(Extension.nameConstraints);
    oids.add(Extension.noRevAvail);
    oids.add(Extension.policyConstraints);
    oids.add(Extension.policyMappings);
    oids.add(Extension.privateKeyUsagePeriod);
    oids.add(Extension.qCStatements);
    oids.add(Extension.reasonCode);
    oids.add(Extension.subjectAlternativeName);
    oids.add(Extension.subjectDirectoryAttributes);
    oids.add(Extension.subjectInfoAccess);
    oids.add(Extension.subjectKeyIdentifier);
    oids.add(Extension.targetInformation);
    oids.add(ObjectIdentifiers.id_pe_tlsfeature);

    StringBuilder enums = new StringBuilder();

    for (ASN1ObjectIdentifier oid : oids) {
        String name = ObjectIdentifiers.getName(oid);
        if (StringUtil.isBlank(name)) {
            name = oid.getId();/*from   ww  w. j  av a  2  s.com*/
        }
        enums.append(name).append(",");
    }
    enums.deleteCharAt(enums.length() - 1);
    setTokens(enums.toString());
}

---

From source file:org.xipki.console.karaf.impl.completer.ExtensionNameCompleterImpl.java

License:Open Source License

public ExtensionNameCompleterImpl() {
    List<ASN1ObjectIdentifier> oids = new LinkedList<>();
    oids.add(ObjectIdentifiers.id_extension_pkix_ocsp_nocheck);
    oids.add(ObjectIdentifiers.id_extension_admission);
    oids.add(Extension.auditIdentity);
    oids.add(Extension.authorityInfoAccess);
    oids.add(Extension.authorityKeyIdentifier);
    oids.add(Extension.basicConstraints);
    oids.add(Extension.biometricInfo);
    oids.add(Extension.certificateIssuer);
    oids.add(Extension.certificatePolicies);
    oids.add(Extension.cRLDistributionPoints);
    oids.add(Extension.cRLNumber);
    oids.add(Extension.deltaCRLIndicator);
    oids.add(Extension.extendedKeyUsage);
    oids.add(Extension.freshestCRL);
    oids.add(Extension.inhibitAnyPolicy);
    oids.add(Extension.instructionCode);
    oids.add(Extension.invalidityDate);
    oids.add(Extension.issuerAlternativeName);
    oids.add(Extension.issuingDistributionPoint);
    oids.add(Extension.keyUsage);
    oids.add(Extension.logoType);
    oids.add(Extension.nameConstraints);
    oids.add(Extension.noRevAvail);
    oids.add(Extension.policyConstraints);
    oids.add(Extension.policyMappings);
    oids.add(Extension.privateKeyUsagePeriod);
    oids.add(Extension.qCStatements);
    oids.add(Extension.reasonCode);
    oids.add(Extension.subjectAlternativeName);
    oids.add(Extension.subjectDirectoryAttributes);
    oids.add(Extension.subjectInfoAccess);
    oids.add(Extension.subjectKeyIdentifier);
    oids.add(Extension.targetInformation);

    StringBuilder enums = new StringBuilder();

    for (ASN1ObjectIdentifier oid : oids) {
        String name = ObjectIdentifiers.getName(oid);
        if (StringUtil.isBlank(name)) {
            name = oid.getId();/*from   ww  w .  j a  v  a2s  .  c  o m*/
        }
        enums.append(name).append(",");
    }
    enums.deleteCharAt(enums.length() - 1);
    setTokens(enums.toString());
}

---

From source file:org.xipki.pki.ca.certprofile.test.ProfileConfCreatorDemo.java

License:Open Source License

private static X509ProfileType certprofileSubCaComplex() throws Exception {
    X509ProfileType profile = getBaseProfile("Certprofile SubCA with most extensions", X509CertLevel.SubCA,
            "8y", false);

    // Subject//from w  ww  .j av  a  2 s.  c o m
    Subject subject = profile.getSubject();
    subject.setIncSerialNumber(false);

    List<RdnType> rdnControls = subject.getRdn();
    rdnControls.add(createRdn(ObjectIdentifiers.DN_C, 1, 1, new String[] { "DE|FR" }, null, null));
    rdnControls.add(createRdn(ObjectIdentifiers.DN_O, 1, 1));
    rdnControls.add(createRdn(ObjectIdentifiers.DN_OU, 0, 1));
    rdnControls.add(createRdn(ObjectIdentifiers.DN_SN, 0, 1, new String[] { REGEX_SN }, null, null));
    rdnControls.add(createRdn(ObjectIdentifiers.DN_CN, 1, 1, null, "PREFIX ", " SUFFIX"));

    // Extensions
    ExtensionsType extensions = profile.getExtensions();

    List<ExtensionType> list = extensions.getExtension();
    list.add(createExtension(Extension.subjectKeyIdentifier, true, false, null));
    list.add(createExtension(Extension.cRLDistributionPoints, false, false, null));
    list.add(createExtension(Extension.freshestCRL, false, false, null));

    // Extensions - basicConstraints
    ExtensionValueType extensionValue = createBasicConstraints(1);
    list.add(createExtension(Extension.basicConstraints, true, true, extensionValue));

    // Extensions - AuthorityInfoAccess
    extensionValue = createAuthorityInfoAccess();
    list.add(createExtension(Extension.authorityInfoAccess, true, false, extensionValue));

    // Extensions - AuthorityKeyIdentifier
    extensionValue = createAuthorityKeyIdentifier(false);
    list.add(createExtension(Extension.authorityKeyIdentifier, true, false, extensionValue));

    // Extensions - keyUsage
    extensionValue = createKeyUsages(new KeyUsageEnum[] { KeyUsageEnum.KEY_CERT_SIGN },
            new KeyUsageEnum[] { KeyUsageEnum.CRL_SIGN });
    list.add(createExtension(Extension.keyUsage, true, true, extensionValue));

    // Certificate Policies
    extensionValue = createCertificatePolicies(new ASN1ObjectIdentifier("1.2.3.4.5"),
            new ASN1ObjectIdentifier("2.4.3.2.1"));
    list.add(createExtension(Extension.certificatePolicies, true, false, extensionValue));

    // Policy Mappings
    PolicyMappings policyMappings = new PolicyMappings();
    policyMappings.getMapping().add(createPolicyIdMapping(new ASN1ObjectIdentifier("1.1.1.1.1"),
            new ASN1ObjectIdentifier("2.1.1.1.1")));
    policyMappings.getMapping().add(createPolicyIdMapping(new ASN1ObjectIdentifier("1.1.1.1.2"),
            new ASN1ObjectIdentifier("2.1.1.1.2")));
    extensionValue = createExtensionValueType(policyMappings);
    list.add(createExtension(Extension.policyMappings, true, true, extensionValue));

    // Policy Constraints
    PolicyConstraints policyConstraints = createPolicyConstraints(2, 2);
    extensionValue = createExtensionValueType(policyConstraints);
    list.add(createExtension(Extension.policyConstraints, true, true, extensionValue));

    // Name Constrains
    NameConstraints nameConstraints = createNameConstraints();
    extensionValue = createExtensionValueType(nameConstraints);
    list.add(createExtension(Extension.nameConstraints, true, true, extensionValue));

    // Inhibit anyPolicy
    InhibitAnyPolicy inhibitAnyPolicy = createInhibitAnyPolicy(1);
    extensionValue = createExtensionValueType(inhibitAnyPolicy);
    list.add(createExtension(Extension.inhibitAnyPolicy, true, true, extensionValue));

    // SubjectAltName
    SubjectAltName subjectAltNameMode = new SubjectAltName();

    OtherName otherName = new OtherName();
    otherName.getType().add(createOidType(ObjectIdentifiers.DN_O));
    subjectAltNameMode.setOtherName(otherName);
    subjectAltNameMode.setRfc822Name("");
    subjectAltNameMode.setDnsName("");
    subjectAltNameMode.setDirectoryName("");
    subjectAltNameMode.setEdiPartyName("");
    subjectAltNameMode.setUniformResourceIdentifier("");
    subjectAltNameMode.setIpAddress("");
    subjectAltNameMode.setRegisteredID("");

    extensionValue = createExtensionValueType(subjectAltNameMode);
    list.add(createExtension(Extension.subjectAlternativeName, true, false, extensionValue));

    // SubjectInfoAccess
    SubjectInfoAccess subjectInfoAccessMode = new SubjectInfoAccess();
    SubjectInfoAccess.Access access = new SubjectInfoAccess.Access();
    subjectInfoAccessMode.getAccess().add(access);

    access.setAccessMethod(createOidType(ObjectIdentifiers.id_ad_caRepository));

    GeneralNameType accessLocation = new GeneralNameType();
    access.setAccessLocation(accessLocation);
    accessLocation.setDirectoryName("");
    accessLocation.setUniformResourceIdentifier("");

    extensionValue = createExtensionValueType(subjectInfoAccessMode);
    list.add(createExtension(Extension.subjectInfoAccess, true, false, extensionValue));

    // Custom Extension
    ASN1ObjectIdentifier customExtensionOid = new ASN1ObjectIdentifier("1.2.3.4");
    extensionValue = createConstantExtValue(DERNull.INSTANCE.getEncoded(), "DER Null");
    list.add(createExtension(customExtensionOid, true, false, extensionValue, "custom extension 1"));

    return profile;
}

---

• «
• 1
• 2
• 3
• »