Example usage for org.bouncycastle.asn1.x509 GeneralName directoryName

List of usage examples for org.bouncycastle.asn1.x509 GeneralName directoryName

  1. HOME
  2. Java
  3. org.bouncycastle
  4. org.bouncycastle.asn1.x509.*
  5. GeneralName
  6. directoryName

Introduction

In this page you can find the example usage for org.bouncycastle.asn1.x509 GeneralName directoryName.

Prototype

int directoryName

To view the source code for org.bouncycastle.asn1.x509 GeneralName directoryName.

Click Source Link

Usage

From source file:org.tdmx.client.crypto.certificate.CredentialUtils.java

License:Open Source License

/**
 * Create the credentials of a DomainAdministrator.
 * /*from w w w.  j  a  v a  2 s  .  c  o m*/
 * @param req
 * @return
 * @throws CryptoCertificateException
 */
public static PKIXCredential createDomainAdministratorCredential(DomainAdministrationCredentialSpecifier req)
        throws CryptoCertificateException {
    KeyPair kp = null;
    try {
        kp = req.getKeyAlgorithm().generateNewKeyPair();
    } catch (CryptoException e) {
        throw new CryptoCertificateException(CertificateResultCode.ERROR_CA_KEYPAIR_GENERATION, e);
    }

    PublicKey publicKey = kp.getPublic();
    PrivateKey privateKey = kp.getPrivate();

    PKIXCredential issuerCredential = req.getZoneAdministratorCredential();
    PKIXCertificate issuerPublicCert = issuerCredential.getPublicCert();

    PublicKey issuerPublicKey = issuerPublicCert.getCertificate().getPublicKey();
    PrivateKey issuerPrivateKey = issuerCredential.getPrivateKey();

    X500NameBuilder subjectBuilder = new X500NameBuilder();
    if (StringUtils.hasText(issuerPublicCert.getCountry())) {
        subjectBuilder.addRDN(BCStyle.C, issuerPublicCert.getCountry());
    }
    if (StringUtils.hasText(issuerPublicCert.getLocation())) {
        subjectBuilder.addRDN(BCStyle.L, issuerPublicCert.getLocation());
    }
    if (StringUtils.hasText(issuerPublicCert.getOrganization())) {
        subjectBuilder.addRDN(BCStyle.O, issuerPublicCert.getOrganization());
    }
    if (StringUtils.hasText(issuerPublicCert.getOrgUnit())) {
        subjectBuilder.addRDN(BCStyle.OU, issuerPublicCert.getOrgUnit());
    }
    subjectBuilder.addRDN(BCStyle.OU, TDMX_DOMAIN_CA_OU);
    subjectBuilder.addRDN(BCStyle.CN, req.getDomainName());
    X500Name subject = subjectBuilder.build();
    X500Name issuer = issuerPublicCert.getSubjectName();
    JcaX509v3CertificateBuilder certBuilder = new JcaX509v3CertificateBuilder(issuer, new BigInteger("1"),
            req.getNotBefore().getTime(), req.getNotAfter().getTime(), subject, publicKey);

    try {
        BasicConstraints cA = new BasicConstraints(0);
        certBuilder.addExtension(Extension.basicConstraints, true, cA);

        JcaX509ExtensionUtils extUtils = new JcaX509ExtensionUtils();
        certBuilder.addExtension(Extension.authorityKeyIdentifier, false,
                extUtils.createAuthorityKeyIdentifier(issuerPublicKey));
        certBuilder.addExtension(Extension.subjectKeyIdentifier, false,
                extUtils.createSubjectKeyIdentifier(publicKey));

        KeyUsage ku = new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyCertSign);
        certBuilder.addExtension(Extension.keyUsage, false, ku);

        // RFC5280 http://tools.ietf.org/html/rfc5280#section-4.2.1.10
        // The CA has a CN which is not part of the name constraint - but we can constrain
        // any domain certificate issued to be limited to some OU under the O.
        X500NameBuilder subjectConstraintBuilder = new X500NameBuilder();
        if (StringUtils.hasText(issuerPublicCert.getCountry())) {
            subjectConstraintBuilder.addRDN(BCStyle.C, issuerPublicCert.getCountry());
        }
        if (StringUtils.hasText(issuerPublicCert.getLocation())) {
            subjectConstraintBuilder.addRDN(BCStyle.L, issuerPublicCert.getLocation());
        }
        if (StringUtils.hasText(issuerPublicCert.getOrganization())) {
            subjectConstraintBuilder.addRDN(BCStyle.O, issuerPublicCert.getOrganization());
        }
        if (StringUtils.hasText(issuerPublicCert.getOrgUnit())) {
            subjectConstraintBuilder.addRDN(BCStyle.OU, issuerPublicCert.getOrgUnit());
        }
        subjectConstraintBuilder.addRDN(BCStyle.OU, TDMX_DOMAIN_CA_OU);
        subjectConstraintBuilder.addRDN(BCStyle.OU, req.getDomainName());
        X500Name nameConstraint = subjectConstraintBuilder.build();

        GeneralName snc = new GeneralName(GeneralName.directoryName, nameConstraint);
        GeneralSubtree snSubtree = new GeneralSubtree(snc, new BigInteger("0"), null);
        NameConstraints nc = new NameConstraints(new GeneralSubtree[] { snSubtree }, null);
        certBuilder.addExtension(Extension.nameConstraints, true, nc);

        certBuilder.addExtension(TdmxZoneInfo.tdmxZoneInfo, false, issuerPublicCert.getTdmxZoneInfo());

        ContentSigner signer = SignatureAlgorithm.getContentSigner(issuerPrivateKey,
                req.getSignatureAlgorithm());
        byte[] certBytes = certBuilder.build(signer).getEncoded();

        PKIXCertificate c = CertificateIOUtils.decodeX509(certBytes);

        return new PKIXCredential(c, issuerCredential.getCertificateChain(), privateKey);
    } catch (CertIOException e) {
        throw new CryptoCertificateException(CertificateResultCode.ERROR_CA_CERT_GENERATION, e);
    } catch (NoSuchAlgorithmException e) {
        throw new CryptoCertificateException(CertificateResultCode.ERROR_CA_CERT_GENERATION, e);
    } catch (IOException e) {
        throw new CryptoCertificateException(CertificateResultCode.ERROR_CA_CERT_GENERATION, e);
    }
}

From source file:org.tdmx.client.crypto.certificate.PKIXCertificate.java

License:Open Source License

private X500Name getSubjectNameConstraint() {
    Extension e = holder.getExtension(Extension.nameConstraints);
    if (e != null && e.isCritical()) {
        NameConstraints nc = NameConstraints.getInstance(e.getParsedValue());
        GeneralSubtree[] permitted = nc.getPermittedSubtrees();
        if (permitted != null && permitted.length > 0) {
            GeneralName base = permitted[0].getBase();
            if (base != null) {
                if (GeneralName.directoryName == base.getTagNo()) {
                    X500Name baseName = X500Name.getInstance(base.getName());
                    return baseName;
                }//from  www.j  a  va  2 s . c o  m
            }
        }
    }
    return null;
}

From source file:org.xipki.ca.client.impl.CmpRequestor.java

License:Open Source License

private ProtectionVerificationResult verifyProtection(final String tid, final GeneralPKIMessage pkiMessage,
        final X509Certificate cert) throws CMPException, InvalidKeyException, OperatorCreationException {
    ProtectedPKIMessage pMsg = new ProtectedPKIMessage(pkiMessage);

    if (pMsg.hasPasswordBasedMacProtection()) {
        LOG.warn("NOT_SIGNAUTRE_BASED: " + pkiMessage.getHeader().getProtectionAlg().getAlgorithm().getId());
        return new ProtectionVerificationResult(null, ProtectionResult.NOT_SIGNATURE_BASED);
    }//from  ww  w . ja  v  a 2  s.  co m

    PKIHeader h = pMsg.getHeader();

    if (c14nRecipientName != null) {
        boolean authorizedResponder = true;
        if (h.getSender().getTagNo() != GeneralName.directoryName) {
            authorizedResponder = false;
        } else {
            String c14nMsgSender = getSortedRFC4519Name((X500Name) h.getSender().getName());
            authorizedResponder = c14nRecipientName.equalsIgnoreCase(c14nMsgSender);
        }

        if (authorizedResponder == false) {
            LOG.warn("tid={}: not authorized responder '{}'", tid, h.getSender());
            return new ProtectionVerificationResult(null, ProtectionResult.SENDER_NOT_AUTHORIZED);
        }
    }

    ContentVerifierProvider verifierProvider = securityFactory.getContentVerifierProvider(cert);
    if (verifierProvider == null) {
        LOG.warn("tid={}: not authorized responder '{}'", tid, h.getSender());
        return new ProtectionVerificationResult(cert, ProtectionResult.SENDER_NOT_AUTHORIZED);
    }

    boolean signatureValid = pMsg.verify(verifierProvider);
    return new ProtectionVerificationResult(cert,
            signatureValid ? ProtectionResult.VALID : ProtectionResult.INVALID);
}

From source file:org.xipki.ca.qa.impl.X509CertprofileQAImpl.java

License:Open Source License

private void checkExtensionIssuerKeyIdentifier(final StringBuilder failureMsg, final byte[] extensionValue,
        final X509IssuerInfo issuerInfo) {
    AuthorityKeyIdentifier asn1 = AuthorityKeyIdentifier.getInstance(extensionValue);
    byte[] keyIdentifier = asn1.getKeyIdentifier();
    if (keyIdentifier == null) {
        failureMsg.append("keyIdentifier is 'absent' but expected 'present'");
        failureMsg.append("; ");
    } else if (Arrays.equals(issuerInfo.getSubjectKeyIdentifier(), keyIdentifier) == false) {
        failureMsg.append("keyIdentifier is '" + hex(keyIdentifier) + "' but expected '"
                + hex(issuerInfo.getSubjectKeyIdentifier()) + "'");
        failureMsg.append("; ");
    }//  w  w w .j  a v  a 2s .  c  o m

    BigInteger serialNumber = asn1.getAuthorityCertSerialNumber();
    GeneralNames names = asn1.getAuthorityCertIssuer();

    if (includeIssuerAndSerialInAKI) {
        if (serialNumber == null) {
            failureMsg.append("authorityCertSerialNumber is 'absent' but expected 'present'");
            failureMsg.append("; ");
        } else {
            if (issuerInfo.getCert().getSerialNumber().equals(serialNumber) == false) {
                failureMsg.append("authorityCertSerialNumber is '" + serialNumber + "' but expected '"
                        + issuerInfo.getCert().getSerialNumber() + "'");
                failureMsg.append("; ");
            }
        }

        if (names == null) {
            failureMsg.append("authorityCertIssuer is 'absent' but expected 'present'");
            failureMsg.append("; ");
        } else {
            GeneralName[] genNames = names.getNames();
            X500Name x500GenName = null;
            for (GeneralName genName : genNames) {
                if (genName.getTagNo() != GeneralName.directoryName) {
                    continue;
                }

                if (x500GenName != null) {
                    failureMsg.append(
                            "authorityCertIssuer contains at least two directoryName " + "but expected one");
                    failureMsg.append("; ");
                    break;
                } else {
                    x500GenName = (X500Name) genName.getName();
                }
            }

            if (x500GenName == null) {
                failureMsg.append("authorityCertIssuer does not contain directoryName but expected one");
                failureMsg.append("; ");
            } else {
                X500Name caSubject = issuerInfo.getBcCert().getTBSCertificate().getSubject();
                if (caSubject.equals(x500GenName) == false) {
                    failureMsg.append("authorityCertIssuer is '" + x500GenName.toString() + "' but expected '"
                            + caSubject.toString() + "'");
                    failureMsg.append("; ");
                }
            }
        }
    } else {
        if (serialNumber != null) {
            failureMsg.append("authorityCertSerialNumber is 'absent' but expected 'present'");
            failureMsg.append("; ");
        }

        if (names != null) {
            failureMsg.append("authorityCertIssuer is 'absent' but expected 'present'");
            failureMsg.append("; ");
        }
    }
}

From source file:org.xipki.ca.qa.impl.X509CertprofileQAImpl.java

License:Open Source License

private static GeneralName createGeneralName(final GeneralName reqName, final Set<GeneralNameMode> modes)
        throws BadCertTemplateException {
    int tag = reqName.getTagNo();
    GeneralNameMode mode = null;/*from w ww . j  a v a  2  s .  co  m*/
    for (GeneralNameMode m : modes) {
        if (m.getTag().getTag() == tag) {
            mode = m;
            break;
        }
    }

    if (mode == null) {
        throw new BadCertTemplateException("generalName tag " + tag + " is not allowed");
    }

    switch (tag) {
    case GeneralName.rfc822Name:
    case GeneralName.dNSName:
    case GeneralName.uniformResourceIdentifier:
    case GeneralName.iPAddress:
    case GeneralName.registeredID:
    case GeneralName.directoryName: {
        return new GeneralName(tag, reqName.getName());
    }
    case GeneralName.otherName: {
        ASN1Sequence reqSeq = ASN1Sequence.getInstance(reqName.getName());
        ASN1ObjectIdentifier type = ASN1ObjectIdentifier.getInstance(reqSeq.getObjectAt(0));
        if (mode.getAllowedTypes().contains(type) == false) {
            throw new BadCertTemplateException("otherName.type " + type.getId() + " is not allowed");
        }

        ASN1Encodable value = ((ASN1TaggedObject) reqSeq.getObjectAt(1)).getObject();
        String text;
        if (value instanceof ASN1String == false) {
            throw new BadCertTemplateException("otherName.value is not a String");
        } else {
            text = ((ASN1String) value).getString();
        }

        ASN1EncodableVector vector = new ASN1EncodableVector();
        vector.add(type);
        vector.add(new DERTaggedObject(true, 0, new DERUTF8String(text)));
        DERSequence seq = new DERSequence(vector);

        return new GeneralName(GeneralName.otherName, seq);
    }
    case GeneralName.ediPartyName: {
        ASN1Sequence reqSeq = ASN1Sequence.getInstance(reqName.getName());

        int n = reqSeq.size();
        String nameAssigner = null;
        int idx = 0;
        if (n > 1) {
            DirectoryString ds = DirectoryString
                    .getInstance(((ASN1TaggedObject) reqSeq.getObjectAt(idx++)).getObject());
            nameAssigner = ds.getString();
        }

        DirectoryString ds = DirectoryString
                .getInstance(((ASN1TaggedObject) reqSeq.getObjectAt(idx++)).getObject());
        String partyName = ds.getString();

        ASN1EncodableVector vector = new ASN1EncodableVector();
        if (nameAssigner != null) {
            vector.add(new DERTaggedObject(false, 0, new DirectoryString(nameAssigner)));
        }
        vector.add(new DERTaggedObject(false, 1, new DirectoryString(partyName)));
        ASN1Sequence seq = new DERSequence(vector);
        return new GeneralName(GeneralName.ediPartyName, seq);
    }
    default: {
        throw new RuntimeException("should not reach here, unknwon GeneralName tag " + tag);
    }
    } // end switch
}

From source file:org.xipki.ca.server.impl.CmpResponder.java

License:Open Source License

private CmpRequestorInfo getRequestor(final PKIHeader reqHeader) {
    GeneralName requestSender = reqHeader.getSender();
    if (requestSender.getTagNo() != GeneralName.directoryName) {
        return null;
    }//w ww .j a  v  a  2s . c  o m

    return getRequestor((X500Name) requestSender.getName());
}

From source file:org.xipki.ca.server.impl.IdentifiedX509Certprofile.java

License:Open Source License

private static GeneralName createGeneralName(final GeneralName reqName, final Set<GeneralNameMode> modes)
        throws BadCertTemplateException {
    int tag = reqName.getTagNo();
    GeneralNameMode mode = null;//  w  ww . j  a  va 2 s  .  c  om
    for (GeneralNameMode m : modes) {
        if (m.getTag().getTag() == tag) {
            mode = m;
            break;
        }
    }

    if (mode == null) {
        throw new BadCertTemplateException("generalName tag " + tag + " is not allowed");
    }

    switch (tag) {
    case GeneralName.rfc822Name:
    case GeneralName.dNSName:
    case GeneralName.uniformResourceIdentifier:
    case GeneralName.iPAddress:
    case GeneralName.registeredID:
    case GeneralName.directoryName: {
        return new GeneralName(tag, reqName.getName());
    }
    case GeneralName.otherName: {
        ASN1Sequence reqSeq = ASN1Sequence.getInstance(reqName.getName());
        ASN1ObjectIdentifier type = ASN1ObjectIdentifier.getInstance(reqSeq.getObjectAt(0));
        if (mode.getAllowedTypes().contains(type) == false) {
            throw new BadCertTemplateException("otherName.type " + type.getId() + " is not allowed");
        }

        ASN1Encodable value = ((ASN1TaggedObject) reqSeq.getObjectAt(1)).getObject();
        String text;
        if (value instanceof ASN1String == false) {
            throw new BadCertTemplateException("otherName.value is not a String");
        } else {
            text = ((ASN1String) value).getString();
        }

        ASN1EncodableVector vector = new ASN1EncodableVector();
        vector.add(type);
        vector.add(new DERTaggedObject(true, 0, new DERUTF8String(text)));
        DERSequence seq = new DERSequence(vector);

        return new GeneralName(GeneralName.otherName, seq);
    }
    case GeneralName.ediPartyName: {
        ASN1Sequence reqSeq = ASN1Sequence.getInstance(reqName.getName());

        int n = reqSeq.size();
        String nameAssigner = null;
        int idx = 0;
        if (n > 1) {
            DirectoryString ds = DirectoryString
                    .getInstance(((ASN1TaggedObject) reqSeq.getObjectAt(idx++)).getObject());
            nameAssigner = ds.getString();
        }

        DirectoryString ds = DirectoryString
                .getInstance(((ASN1TaggedObject) reqSeq.getObjectAt(idx++)).getObject());
        String partyName = ds.getString();

        ASN1EncodableVector vector = new ASN1EncodableVector();
        if (nameAssigner != null) {
            vector.add(new DERTaggedObject(false, 0, new DirectoryString(nameAssigner)));
        }
        vector.add(new DERTaggedObject(false, 1, new DirectoryString(partyName)));
        ASN1Sequence seq = new DERSequence(vector);
        return new GeneralName(GeneralName.ediPartyName, seq);
    }
    default: {
        throw new RuntimeException("should not reach here, unknown GeneralName tag " + tag);
    }
    }// end switch(tag)
}

From source file:org.xipki.ca.server.impl.X509CACmpResponder.java

License:Open Source License

@Override
protected boolean intendsMe(final GeneralName requestRecipient) throws ConfigurationException {
    if (requestRecipient == null) {
        return false;
    }/*ww  w. j  a  v  a2s.  c  om*/

    if (getSender().equals(requestRecipient)) {
        return true;
    }

    if (requestRecipient.getTagNo() == GeneralName.directoryName) {
        X500Name x500Name = X500Name.getInstance(requestRecipient.getName());
        if (x500Name.equals(caManager.getCmpResponderWrapper(getResponderName()).getSubjectAsX500Name())) {
            return true;
        }
    }

    return false;
}

From source file:org.xipki.commons.security.shell.p12.P12ComplexCertRequestGenCmd.java

License:Open Source License

private static GeneralNames createComplexGeneralNames(String prefix) {
    List<GeneralName> list = new LinkedList<>();
    // otherName/*from   w  ww. j a  v a 2 s  .  c  o  m*/
    ASN1EncodableVector vec = new ASN1EncodableVector();
    vec.add(new ASN1ObjectIdentifier("1.2.3.1"));
    vec.add(new DERTaggedObject(true, 0, new DERUTF8String(prefix + "I am otherName 1.2.3.1")));
    list.add(new GeneralName(GeneralName.otherName, new DERSequence(vec)));

    vec = new ASN1EncodableVector();
    vec.add(new ASN1ObjectIdentifier("1.2.3.2"));
    vec.add(new DERTaggedObject(true, 0, new DERUTF8String(prefix + "I am otherName 1.2.3.2")));
    list.add(new GeneralName(GeneralName.otherName, new DERSequence(vec)));

    // rfc822Name
    list.add(new GeneralName(GeneralName.rfc822Name, prefix + "info@example.org"));

    // dNSName
    list.add(new GeneralName(GeneralName.dNSName, prefix + "dns.example.org"));

    // directoryName
    list.add(new GeneralName(GeneralName.directoryName, new X500Name("CN=demo,C=DE")));

    // ediPartyName
    vec = new ASN1EncodableVector();
    vec.add(new DERTaggedObject(false, 0, new DirectoryString(prefix + "assigner1")));
    vec.add(new DERTaggedObject(false, 1, new DirectoryString(prefix + "party1")));
    list.add(new GeneralName(GeneralName.ediPartyName, new DERSequence(vec)));

    // uniformResourceIdentifier
    list.add(new GeneralName(GeneralName.uniformResourceIdentifier, prefix + "uri.example.org"));

    // iPAddress
    list.add(new GeneralName(GeneralName.iPAddress, "69.1.2.190"));

    // registeredID
    list.add(new GeneralName(GeneralName.registeredID, "2.3.4.5"));

    return new GeneralNames(list.toArray(new GeneralName[0]));
}

From source file:org.xipki.commons.security.util.X509Util.java

License:Open Source License

/**
*
* @param taggedValue [tag]value, and the value for tags otherName and ediPartyName is
*     type=value./* w  w  w.ja  v a2  s .c  om*/
*/
public static GeneralName createGeneralName(final String taggedValue) throws BadInputException {
    ParamUtil.requireNonBlank("taggedValue", taggedValue);

    int tag = -1;
    String value = null;
    if (taggedValue.charAt(0) == '[') {
        int idx = taggedValue.indexOf(']', 1);
        if (idx > 1 && idx < taggedValue.length() - 1) {
            String tagS = taggedValue.substring(1, idx);
            try {
                tag = Integer.parseInt(tagS);
                value = taggedValue.substring(idx + 1);
            } catch (NumberFormatException ex) {
                throw new BadInputException("invalid tag '" + tagS + "'");
            }
        }
    }

    if (tag == -1) {
        throw new BadInputException("invalid taggedValue " + taggedValue);
    }

    switch (tag) {
    case GeneralName.otherName:
        if (value == null) {
            throw new BadInputException("invalid otherName: no value specified");
        }

        int idxSep = value.indexOf("=");
        if (idxSep == -1 || idxSep == 0 || idxSep == value.length() - 1) {
            throw new BadInputException("invalid otherName " + value);
        }
        String otherTypeOid = value.substring(0, idxSep);
        ASN1ObjectIdentifier type = new ASN1ObjectIdentifier(otherTypeOid);
        String otherValue = value.substring(idxSep + 1);
        ASN1EncodableVector vector = new ASN1EncodableVector();
        vector.add(type);
        vector.add(new DERTaggedObject(true, 0, new DERUTF8String(otherValue)));
        DERSequence seq = new DERSequence(vector);
        return new GeneralName(GeneralName.otherName, seq);
    case GeneralName.rfc822Name:
        return new GeneralName(tag, value);
    case GeneralName.dNSName:
        return new GeneralName(tag, value);
    case GeneralName.directoryName:
        X500Name x500Name = reverse(new X500Name(value));
        return new GeneralName(GeneralName.directoryName, x500Name);
    case GeneralName.ediPartyName:
        if (value == null) {
            throw new BadInputException("invalid ediPartyName: no value specified");
        }
        idxSep = value.indexOf("=");
        if (idxSep == -1 || idxSep == value.length() - 1) {
            throw new BadInputException("invalid ediPartyName " + value);
        }
        String nameAssigner = (idxSep == 0) ? null : value.substring(0, idxSep);
        String partyName = value.substring(idxSep + 1);
        vector = new ASN1EncodableVector();
        if (nameAssigner != null) {
            vector.add(new DERTaggedObject(false, 0, new DirectoryString(nameAssigner)));
        }
        vector.add(new DERTaggedObject(false, 1, new DirectoryString(partyName)));
        seq = new DERSequence(vector);
        return new GeneralName(GeneralName.ediPartyName, seq);
    case GeneralName.uniformResourceIdentifier:
        return new GeneralName(tag, value);
    case GeneralName.iPAddress:
        return new GeneralName(tag, value);
    case GeneralName.registeredID:
        return new GeneralName(tag, value);
    default:
        throw new RuntimeException("unsupported tag " + tag);
    } // end switch (tag)
}