Example usage for org.bouncycastle.asn1.x509 Extension qCStatements

Introduction

In this page you can find the example usage for org.bouncycastle.asn1.x509 Extension qCStatements.

Prototype

ASN1ObjectIdentifier qCStatements

To view the source code for org.bouncycastle.asn1.x509 Extension qCStatements.

Click Source Link

Document

QCStatements

Usage

From source file:be.fedict.trust.constraints.QCStatementsCertificateConstraint.java

License:Open Source License

@Override
public void check(X509Certificate certificate) throws TrustLinkerResultException, Exception {
    byte[] extensionValue = certificate.getExtensionValue(Extension.qCStatements.getId());
    if (null == extensionValue) {
        throw new TrustLinkerResultException(TrustLinkerResultReason.CONSTRAINT_VIOLATION,
                "missing QCStatements extension");
    }/*  w  ww  .  j  a  v  a 2 s .  c  o m*/
    DEROctetString oct = (DEROctetString) (new ASN1InputStream(new ByteArrayInputStream(extensionValue))
            .readObject());
    ASN1Sequence qcStatements = (ASN1Sequence) new ASN1InputStream(oct.getOctets()).readObject();
    Enumeration<?> qcStatementEnum = qcStatements.getObjects();
    boolean qcCompliance = false;
    boolean qcSSCD = false;
    while (qcStatementEnum.hasMoreElements()) {
        QCStatement qcStatement = QCStatement.getInstance(qcStatementEnum.nextElement());
        ASN1ObjectIdentifier statementId = qcStatement.getStatementId();
        LOG.debug("statement Id: " + statementId.getId());
        if (QCStatement.id_etsi_qcs_QcCompliance.equals(statementId)) {
            qcCompliance = true;
        }
        if (QCStatement.id_etsi_qcs_QcSSCD.equals(statementId)) {
            qcSSCD = true;
        }
    }

    if (null != this.qcComplianceFilter) {
        if (qcCompliance != this.qcComplianceFilter) {
            LOG.error("qcCompliance QCStatements error");
            throw new TrustLinkerResultException(TrustLinkerResultReason.CONSTRAINT_VIOLATION,
                    "QCStatements not matching");
        }
    }

    if (null != this.qcSSCDFilter) {
        if (qcSSCD != this.qcSSCDFilter) {
            LOG.error("qcSSCD QCStatements error");
            throw new TrustLinkerResultException(TrustLinkerResultReason.CONSTRAINT_VIOLATION,
                    "QCStatements not matching");
        }
    }
}

---

From source file:be.fedict.trust.test.PKITestUtils.java

License:Open Source License

public static X509Certificate generateCertificate(PublicKey subjectPublicKey, String subjectDn,
        DateTime notBefore, DateTime notAfter, X509Certificate issuerCertificate, PrivateKey issuerPrivateKey,
        boolean caFlag, int pathLength, String crlUri, String ocspUri, KeyUsage keyUsage,
        String signatureAlgorithm, boolean tsa, boolean includeSKID, boolean includeAKID,
        PublicKey akidPublicKey, String certificatePolicy, Boolean qcCompliance, boolean ocspResponder,
        boolean qcSSCD) throws IOException, InvalidKeyException, IllegalStateException,
        NoSuchAlgorithmException, SignatureException, CertificateException, OperatorCreationException {

    X500Name issuerName;//from   www. j  a  va 2s.  c  o m
    if (null != issuerCertificate) {
        issuerName = new X500Name(issuerCertificate.getSubjectX500Principal().toString());
    } else {
        issuerName = new X500Name(subjectDn);
    }
    X500Name subjectName = new X500Name(subjectDn);
    BigInteger serial = new BigInteger(128, new SecureRandom());
    SubjectPublicKeyInfo publicKeyInfo = SubjectPublicKeyInfo.getInstance(subjectPublicKey.getEncoded());
    X509v3CertificateBuilder x509v3CertificateBuilder = new X509v3CertificateBuilder(issuerName, serial,
            notBefore.toDate(), notAfter.toDate(), subjectName, publicKeyInfo);

    JcaX509ExtensionUtils extensionUtils = new JcaX509ExtensionUtils();
    if (includeSKID) {
        x509v3CertificateBuilder.addExtension(Extension.subjectKeyIdentifier, false,
                extensionUtils.createSubjectKeyIdentifier(subjectPublicKey));
    }

    if (includeAKID) {

        PublicKey authorityPublicKey;
        if (null != akidPublicKey) {
            authorityPublicKey = akidPublicKey;
        } else if (null != issuerCertificate) {
            authorityPublicKey = issuerCertificate.getPublicKey();
        } else {
            authorityPublicKey = subjectPublicKey;
        }
        x509v3CertificateBuilder.addExtension(Extension.authorityKeyIdentifier, false,
                extensionUtils.createAuthorityKeyIdentifier(authorityPublicKey));
    }

    if (caFlag) {
        if (-1 == pathLength) {
            x509v3CertificateBuilder.addExtension(Extension.basicConstraints, true,
                    new BasicConstraints(2147483647));
        } else {
            x509v3CertificateBuilder.addExtension(Extension.basicConstraints, true,
                    new BasicConstraints(pathLength));
        }
    }

    if (null != crlUri) {
        GeneralName generalName = new GeneralName(GeneralName.uniformResourceIdentifier,
                new DERIA5String(crlUri));
        GeneralNames generalNames = new GeneralNames(generalName);
        DistributionPointName distPointName = new DistributionPointName(generalNames);
        DistributionPoint distPoint = new DistributionPoint(distPointName, null, null);
        DistributionPoint[] crlDistPoints = new DistributionPoint[] { distPoint };
        CRLDistPoint crlDistPoint = new CRLDistPoint(crlDistPoints);
        x509v3CertificateBuilder.addExtension(Extension.cRLDistributionPoints, false, crlDistPoint);
    }

    if (null != ocspUri) {
        GeneralName ocspName = new GeneralName(GeneralName.uniformResourceIdentifier, ocspUri);
        AuthorityInformationAccess authorityInformationAccess = new AuthorityInformationAccess(
                X509ObjectIdentifiers.ocspAccessMethod, ocspName);
        x509v3CertificateBuilder.addExtension(Extension.authorityInfoAccess, false, authorityInformationAccess);
    }

    if (null != keyUsage) {
        x509v3CertificateBuilder.addExtension(Extension.keyUsage, true, keyUsage);
    }

    if (null != certificatePolicy) {
        ASN1ObjectIdentifier policyObjectIdentifier = new ASN1ObjectIdentifier(certificatePolicy);
        PolicyInformation policyInformation = new PolicyInformation(policyObjectIdentifier);
        x509v3CertificateBuilder.addExtension(Extension.certificatePolicies, false,
                new DERSequence(policyInformation));
    }

    if (null != qcCompliance) {
        ASN1EncodableVector vec = new ASN1EncodableVector();
        if (qcCompliance) {
            vec.add(new QCStatement(QCStatement.id_etsi_qcs_QcCompliance));
        } else {
            vec.add(new QCStatement(QCStatement.id_etsi_qcs_RetentionPeriod));
        }
        if (qcSSCD) {
            vec.add(new QCStatement(QCStatement.id_etsi_qcs_QcSSCD));
        }
        x509v3CertificateBuilder.addExtension(Extension.qCStatements, true, new DERSequence(vec));

    }

    if (tsa) {
        x509v3CertificateBuilder.addExtension(Extension.extendedKeyUsage, true,
                new ExtendedKeyUsage(KeyPurposeId.id_kp_timeStamping));
    }

    if (ocspResponder) {
        x509v3CertificateBuilder.addExtension(OCSPObjectIdentifiers.id_pkix_ocsp_nocheck, false,
                DERNull.INSTANCE);

        x509v3CertificateBuilder.addExtension(Extension.extendedKeyUsage, true,
                new ExtendedKeyUsage(KeyPurposeId.id_kp_OCSPSigning));
    }

    AlgorithmIdentifier sigAlgId = new DefaultSignatureAlgorithmIdentifierFinder().find(signatureAlgorithm);
    AlgorithmIdentifier digAlgId = new DefaultDigestAlgorithmIdentifierFinder().find(sigAlgId);
    AsymmetricKeyParameter asymmetricKeyParameter = PrivateKeyFactory.createKey(issuerPrivateKey.getEncoded());

    ContentSigner contentSigner = new BcRSAContentSignerBuilder(sigAlgId, digAlgId)
            .build(asymmetricKeyParameter);
    X509CertificateHolder x509CertificateHolder = x509v3CertificateBuilder.build(contentSigner);

    byte[] encodedCertificate = x509CertificateHolder.getEncoded();

    CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509");
    X509Certificate certificate = (X509Certificate) certificateFactory
            .generateCertificate(new ByteArrayInputStream(encodedCertificate));
    return certificate;
}

---

From source file:eu.europa.esig.dss.DSSASN1Utils.java

License:Open Source License

/**
 * @param x509Certificate/*ww w  . j a v a2s.c  om*/
 * @return
 */
public static List<String> getQCStatementsIdList(final CertificateToken certToken) {
    final List<String> extensionIdList = new ArrayList<String>();
    final byte[] qcStatement = certToken.getCertificate().getExtensionValue(Extension.qCStatements.getId());
    if (qcStatement != null) {
        final ASN1Sequence seq = getAsn1SequenceFromDerOctetString(qcStatement);
        // Sequence of QCStatement
        for (int ii = 0; ii < seq.size(); ii++) {
            final QCStatement statement = QCStatement.getInstance(seq.getObjectAt(ii));
            extensionIdList.add(statement.getStatementId().getId());
        }
    }
    return extensionIdList;
}

---

From source file:org.cesecore.certificates.certificate.certextensions.standard.QcStatement.java

License:Open Source License

@Override
public void init(final CertificateProfile certProf) {
    super.setOID(Extension.qCStatements.getId());
    super.setCriticalFlag(certProf.getQCStatementCritical());
}

---

From source file:org.cesecore.certificates.certificateprofile.CertificateProfileTest.java

License:Open Source License

@Test
public void test06CertificateExtensions() throws Exception {
    CertificateProfile profile = new CertificateProfile(CertificateProfileConstants.CERTPROFILE_NO_PROFILE);

    // Check standard values for the certificate profile
    List<String> l = profile.getUsedStandardCertificateExtensions();
    assertEquals(6, l.size());// w  ww  . ja  v  a  2  s . com
    assertTrue(l.contains(Extension.keyUsage.getId()));
    assertTrue(l.contains(Extension.basicConstraints.getId()));
    assertTrue(l.contains(Extension.subjectKeyIdentifier.getId()));
    assertTrue(l.contains(Extension.authorityKeyIdentifier.getId()));
    assertTrue(l.contains(Extension.subjectAlternativeName.getId()));
    assertTrue(l.contains(Extension.issuerAlternativeName.getId()));

    CertificateProfile eprofile = new CertificateProfile(CertificateProfileConstants.CERTPROFILE_FIXED_ENDUSER);

    // Check standard values for the certificate profile
    l = eprofile.getUsedStandardCertificateExtensions();
    assertEquals(7, l.size());
    assertTrue(l.contains(Extension.keyUsage.getId()));
    assertTrue(l.contains(Extension.basicConstraints.getId()));
    assertTrue(l.contains(Extension.subjectKeyIdentifier.getId()));
    assertTrue(l.contains(Extension.authorityKeyIdentifier.getId()));
    assertTrue(l.contains(Extension.subjectAlternativeName.getId()));
    assertTrue(l.contains(Extension.issuerAlternativeName.getId()));
    assertTrue(l.contains(Extension.extendedKeyUsage.getId()));

    profile = new CertificateProfile(CertificateProfileConstants.CERTPROFILE_NO_PROFILE);
    profile.setUseAuthorityInformationAccess(true);
    profile.setUseCertificatePolicies(true);
    profile.setUseCRLDistributionPoint(true);
    profile.setUseFreshestCRL(true);
    profile.setUseMicrosoftTemplate(true);
    profile.setUseOcspNoCheck(true);
    profile.setUseQCStatement(true);
    profile.setUseExtendedKeyUsage(true);
    profile.setUseSubjectDirAttributes(true);
    l = profile.getUsedStandardCertificateExtensions();
    assertEquals(15, l.size());
    assertTrue(l.contains(Extension.keyUsage.getId()));
    assertTrue(l.contains(Extension.basicConstraints.getId()));
    assertTrue(l.contains(Extension.subjectKeyIdentifier.getId()));
    assertTrue(l.contains(Extension.authorityKeyIdentifier.getId()));
    assertTrue(l.contains(Extension.subjectAlternativeName.getId()));
    assertTrue(l.contains(Extension.issuerAlternativeName.getId()));
    assertTrue(l.contains(Extension.extendedKeyUsage.getId()));
    assertTrue(l.contains(Extension.authorityInfoAccess.getId()));
    assertTrue(l.contains(Extension.certificatePolicies.getId()));
    assertTrue(l.contains(Extension.cRLDistributionPoints.getId()));
    assertTrue(l.contains(Extension.freshestCRL.getId()));
    assertTrue(l.contains(OCSPObjectIdentifiers.id_pkix_ocsp_nocheck.getId()));
    assertTrue(l.contains(Extension.qCStatements.getId()));
    assertTrue(l.contains(Extension.subjectDirectoryAttributes.getId()));
    assertTrue(l.contains(CertTools.OID_MSTEMPLATE));
}

---

From source file:org.cesecore.certificates.util.cert.QCStatementExtension.java

License:Open Source License

/** Returns true if the certificate contains a QC-statements extension.
 * /*from w ww.ja va  2s  .  co  m*/
 * @param cert Certificate containing the extension
 * @return true or false.
 * @throws IOException if there is a problem parsing the certificate
 */
public static boolean hasQcStatement(final Certificate cert) throws IOException {
    boolean ret = false;
    if (cert instanceof X509Certificate) {
        final X509Certificate x509cert = (X509Certificate) cert;
        final ASN1Primitive obj = getExtensionValue(x509cert, Extension.qCStatements.getId());
        if (obj != null) {
            ret = true;
        }
    }
    return ret;
}

---

From source file:org.cesecore.certificates.util.cert.QCStatementExtension.java

License:Open Source License

/** Returns all the 'statementId' defined in the QCStatement extension (rfc3739).
 * // w ww. jav  a 2 s. c  om
 * @param cert Certificate containing the extension
 * @return Collection of String with the oid, for example "1.1.1.2", or empty Collection if no identifier is found, never returns null.
 * @throws IOException if there is a problem parsing the certificate
 */
public static Collection<String> getQcStatementIds(final Certificate cert) throws IOException {
    final ArrayList<String> ret = new ArrayList<String>();
    if (cert instanceof X509Certificate) {
        final X509Certificate x509cert = (X509Certificate) cert;
        final ASN1Primitive obj = getExtensionValue(x509cert, Extension.qCStatements.getId());
        if (obj == null) {
            return ret;
        }
        final ASN1Sequence seq = (ASN1Sequence) obj;
        for (int i = 0; i < seq.size(); i++) {
            final QCStatement qc = QCStatement.getInstance(seq.getObjectAt(i));
            final ASN1ObjectIdentifier oid = qc.getStatementId();
            if (oid != null) {
                ret.add(oid.getId());
            }
        }
    }
    return ret;
}

---

From source file:org.cesecore.certificates.util.cert.QCStatementExtension.java

License:Open Source License

/** Returns the value limit ETSI QCStatement if present.
 * //from w  w  w .  j  a v a  2 s  .co m
 * @param cert Certificate possibly containing the QCStatement extension
 * @return String with the value and currency (ex '50000 SEK')or null if the extension is not present
 * @throws IOException if there is a problem parsing the certificate
 */
public static String getQcStatementValueLimit(final Certificate cert) throws IOException {
    String ret = null;
    if (cert instanceof X509Certificate) {
        final X509Certificate x509cert = (X509Certificate) cert;
        final ASN1Primitive obj = getExtensionValue(x509cert, Extension.qCStatements.getId());
        if (obj == null) {
            return null;
        }
        final ASN1Sequence seq = (ASN1Sequence) obj;
        MonetaryValue mv = null;
        // Look through all the QCStatements and see if we have a stadard ETSI LimitValue
        for (int i = 0; i < seq.size(); i++) {
            final QCStatement qc = QCStatement.getInstance(seq.getObjectAt(i));
            final ASN1ObjectIdentifier oid = qc.getStatementId();
            if ((oid != null) && oid.equals(ETSIQCObjectIdentifiers.id_etsi_qcs_LimiteValue)) {
                // We MAY have a MonetaryValue object here
                final ASN1Encodable enc = qc.getStatementInfo();
                if (enc != null) {
                    mv = MonetaryValue.getInstance(enc);
                    // We can break the loop now, we got it!
                    break;
                }
            }
        }
        if (mv != null) {
            final BigInteger amount = mv.getAmount();
            final BigInteger exp = mv.getExponent();
            final BigInteger ten = BigInteger.valueOf(10);
            // A possibly gotcha here if the monetary value is larger than what fits in a long...
            final long value = amount.longValue() * (ten.pow(exp.intValue())).longValue();
            if (value < 0) {
                log.error("ETSI LimitValue amount is < 0.");
            }
            final String curr = mv.getCurrency().getAlphabetic();
            if (curr == null) {
                log.error("ETSI LimitValue currency is null");
            }
            if ((value >= 0) && (curr != null)) {
                ret = value + " " + curr;
            }
        }
    }
    return ret;
}

---

From source file:org.cesecore.certificates.util.cert.QCStatementExtension.java

License:Open Source License

/** Returns the 'NameRegistrationAuthorities' defined in the QCStatement extension (rfc3739).
 * /*www  . j a v a  2  s  .com*/
 * @param cert Certificate containing the extension
 * @return String with for example 'rfc822Name=foo2bar.se, rfc822Name=bar2foo.se' etc. Supports email, dns and uri name, or null of no RAs are found.
 * @throws IOException if there is a problem parsing the certificate
 */
public static String getQcStatementAuthorities(final Certificate cert) throws IOException {
    String ret = null;
    if (cert instanceof X509Certificate) {
        final X509Certificate x509cert = (X509Certificate) cert;
        final ASN1Primitive obj = getExtensionValue(x509cert, Extension.qCStatements.getId());
        if (obj == null) {
            return null;
        }
        final ASN1Sequence seq = (ASN1Sequence) obj;
        SemanticsInformation si = null;
        // Look through all the QCStatements and see if we have a standard RFC3739 pkixQCSyntax
        for (int i = 0; i < seq.size(); i++) {
            final QCStatement qc = QCStatement.getInstance(seq.getObjectAt(i));
            final ASN1ObjectIdentifier oid = qc.getStatementId();
            if ((oid != null) && (oid.equals(RFC3739QCObjectIdentifiers.id_qcs_pkixQCSyntax_v1)
                    || oid.equals(RFC3739QCObjectIdentifiers.id_qcs_pkixQCSyntax_v2))) {
                // We MAY have a SemanticsInformation object here
                final ASN1Encodable enc = qc.getStatementInfo();
                if (enc != null) {
                    si = SemanticsInformation.getInstance(enc);
                    // We can break the loop now, we got it!
                    break;
                }
            }
        }
        if (si != null) {
            final GeneralName[] gns = si.getNameRegistrationAuthorities();
            if (gns == null) {
                return null;
            }
            final StringBuilder strBuf = new StringBuilder();
            for (int i = 0; i < gns.length; i++) {
                final GeneralName gn = gns[i];
                if (strBuf.length() != 0) {
                    // Append comma so we get nice formatting if there are more than one authority
                    strBuf.append(", ");
                }
                final String str = getGeneralNameString(gn.getTagNo(), gn.getName());
                if (str != null) {
                    strBuf.append(str);
                }
            }
            if (strBuf.length() > 0) {
                ret = strBuf.toString();
            }
        }
    }
    return ret;
}

---

From source file:org.xipki.commons.console.karaf.completer.ExtensionNameCompleter.java

License:Open Source License

public ExtensionNameCompleter() {
    List<ASN1ObjectIdentifier> oids = new LinkedList<>();
    oids.add(ObjectIdentifiers.id_extension_pkix_ocsp_nocheck);
    oids.add(ObjectIdentifiers.id_extension_admission);
    oids.add(Extension.auditIdentity);
    oids.add(Extension.authorityInfoAccess);
    oids.add(Extension.authorityKeyIdentifier);
    oids.add(Extension.basicConstraints);
    oids.add(Extension.biometricInfo);
    oids.add(Extension.certificateIssuer);
    oids.add(Extension.certificatePolicies);
    oids.add(Extension.cRLDistributionPoints);
    oids.add(Extension.cRLNumber);
    oids.add(Extension.deltaCRLIndicator);
    oids.add(Extension.extendedKeyUsage);
    oids.add(Extension.freshestCRL);
    oids.add(Extension.inhibitAnyPolicy);
    oids.add(Extension.instructionCode);
    oids.add(Extension.invalidityDate);
    oids.add(Extension.issuerAlternativeName);
    oids.add(Extension.issuingDistributionPoint);
    oids.add(Extension.keyUsage);
    oids.add(Extension.logoType);
    oids.add(Extension.nameConstraints);
    oids.add(Extension.noRevAvail);
    oids.add(Extension.policyConstraints);
    oids.add(Extension.policyMappings);
    oids.add(Extension.privateKeyUsagePeriod);
    oids.add(Extension.qCStatements);
    oids.add(Extension.reasonCode);
    oids.add(Extension.subjectAlternativeName);
    oids.add(Extension.subjectDirectoryAttributes);
    oids.add(Extension.subjectInfoAccess);
    oids.add(Extension.subjectKeyIdentifier);
    oids.add(Extension.targetInformation);
    oids.add(ObjectIdentifiers.id_pe_tlsfeature);

    StringBuilder enums = new StringBuilder();

    for (ASN1ObjectIdentifier oid : oids) {
        String name = ObjectIdentifiers.getName(oid);
        if (StringUtil.isBlank(name)) {
            name = oid.getId();/*from  ww  w. j  av a 2s . com*/
        }
        enums.append(name).append(",");
    }
    enums.deleteCharAt(enums.length() - 1);
    setTokens(enums.toString());
}

---

• «
• 1
• 2
• 3
• »