Example usage for org.bouncycastle.asn1.x509 GeneralNames getNames

Introduction

In this page you can find the example usage for org.bouncycastle.asn1.x509 GeneralNames getNames.

Prototype

public GeneralName[] getNames() 

Source Link

Usage

From source file:be.fedict.eid.pkira.crypto.csr.CSRInfo.java

License:Open Source License

public List<String> getSubjectAlternativeNames() throws CryptoException {
    List<String> result = new ArrayList<String>();

    ASN1Set attributes = certificationRequest.getCertificationRequestInfo().getAttributes();
    for (DERSet extension : getElementsFromASN1Set(attributes, CSR_EXTENSION_ATTRIBUTE_ID, DERSet.class)) {
        for (DEROctetString extensionValue : getElementsFromASN1Set(extension,
                X509Extension.subjectAlternativeName, DEROctetString.class)) {
            try {
                ASN1Object bytes = ASN1Object.fromByteArray(extensionValue.getOctets());
                GeneralNames names = GeneralNames.getInstance(bytes);
                for (GeneralName name : names.getNames()) {
                    if (name.getTagNo() == GeneralName.dNSName) {
                        String theName = name.getName().toString();
                        if (theName.indexOf('*') != -1) {
                            throw new CryptoException(
                                    "Subject Alternative Names are not allowed to contain wildcards.");
                        }//from ww w  . jav a 2  s  .  co m
                        result.add(theName);
                    } else {
                        throw new CryptoException(
                                "Only Subject Alternative Name of type DNS is allowed in the CSR.");
                    }
                }
            } catch (IOException e) {
                throw new CryptoException("Could not extract SAN value.", e);
            }
        }
    }

    return result;
}

---

From source file:be.fedict.trust.crl.CrlTrustLinker.java

License:Open Source License

/**
 * Gives back the CRL URI meta-data found within the given X509 certificate.
 * //from ww w  . ja  v a 2  s .c  o  m
 * @param certificate
 *            the X509 certificate.
 * @return the CRL URI, or <code>null</code> if the extension is not
 *         present.
 */
public static URI getCrlUri(X509Certificate certificate) {
    byte[] crlDistributionPointsValue = certificate.getExtensionValue(Extension.cRLDistributionPoints.getId());
    if (null == crlDistributionPointsValue) {
        return null;
    }
    ASN1Sequence seq;
    try {
        DEROctetString oct;
        oct = (DEROctetString) (new ASN1InputStream(new ByteArrayInputStream(crlDistributionPointsValue))
                .readObject());
        seq = (ASN1Sequence) new ASN1InputStream(oct.getOctets()).readObject();
    } catch (IOException e) {
        throw new RuntimeException("IO error: " + e.getMessage(), e);
    }
    CRLDistPoint distPoint = CRLDistPoint.getInstance(seq);
    DistributionPoint[] distributionPoints = distPoint.getDistributionPoints();
    for (DistributionPoint distributionPoint : distributionPoints) {
        DistributionPointName distributionPointName = distributionPoint.getDistributionPoint();
        if (DistributionPointName.FULL_NAME != distributionPointName.getType()) {
            continue;
        }
        GeneralNames generalNames = (GeneralNames) distributionPointName.getName();
        GeneralName[] names = generalNames.getNames();
        for (GeneralName name : names) {
            if (name.getTagNo() != GeneralName.uniformResourceIdentifier) {
                LOG.debug("not a uniform resource identifier");
                continue;
            }
            DERIA5String derStr = DERIA5String.getInstance(name.getName());
            String str = derStr.getString();
            if (false == str.startsWith("http")) {
                /*
                 * skip ldap:// protocols
                 */
                LOG.debug("not HTTP/HTTPS: " + str);
                continue;
            }
            URI uri = toURI(str);
            return uri;
        }
    }
    return null;
}

---

From source file:com.itextpdf.signatures.CertificateUtil.java

License:Open Source License

/**
 * Gets the URL of the Certificate Revocation List for a Certificate
 * @param certificate   the Certificate/*from   w ww.  j  a v a 2  s  .  com*/
 * @return   the String where you can check if the certificate was revoked
 * @throws CertificateParsingException
 * @throws IOException
 */
public static String getCRLURL(X509Certificate certificate) throws CertificateParsingException {
    ASN1Primitive obj;
    try {
        obj = getExtensionValue(certificate, Extension.cRLDistributionPoints.getId());
    } catch (IOException e) {
        obj = (ASN1Primitive) null;
    }
    if (obj == null) {
        return null;
    }
    CRLDistPoint dist = CRLDistPoint.getInstance(obj);
    DistributionPoint[] dists = dist.getDistributionPoints();
    for (DistributionPoint p : dists) {
        DistributionPointName distributionPointName = p.getDistributionPoint();
        if (DistributionPointName.FULL_NAME != distributionPointName.getType()) {
            continue;
        }
        GeneralNames generalNames = (GeneralNames) distributionPointName.getName();
        GeneralName[] names = generalNames.getNames();
        for (GeneralName name : names) {
            if (name.getTagNo() != GeneralName.uniformResourceIdentifier) {
                continue;
            }
            DERIA5String derStr = DERIA5String.getInstance((ASN1TaggedObject) name.toASN1Primitive(), false);
            return derStr.getString();
        }
    }
    return null;
}

---

From source file:com.itextpdf.text.pdf.security.CertificateUtil.java

License:Open Source License

/**
 * Gets the URL of the Certificate Revocation List for a Certificate
 * @param certificate   the Certificate/*from w w  w.  j  av a  2  s  .c  om*/
 * @return   the String where you can check if the certificate was revoked
 * @throws CertificateParsingException
 * @throws IOException 
 */
public static String getCRLURL(X509Certificate certificate) throws CertificateParsingException {
    ASN1Primitive obj;
    try {
        obj = getExtensionValue(certificate, Extension.cRLDistributionPoints.getId());
    } catch (IOException e) {
        obj = null;
    }
    if (obj == null) {
        return null;
    }
    CRLDistPoint dist = CRLDistPoint.getInstance(obj);
    DistributionPoint[] dists = dist.getDistributionPoints();
    for (DistributionPoint p : dists) {
        DistributionPointName distributionPointName = p.getDistributionPoint();
        if (DistributionPointName.FULL_NAME != distributionPointName.getType()) {
            continue;
        }
        GeneralNames generalNames = (GeneralNames) distributionPointName.getName();
        GeneralName[] names = generalNames.getNames();
        for (GeneralName name : names) {
            if (name.getTagNo() != GeneralName.uniformResourceIdentifier) {
                continue;
            }
            DERIA5String derStr = DERIA5String.getInstance((ASN1TaggedObject) name.toASN1Primitive(), false);
            return derStr.getString();
        }
    }
    return null;
}

---

From source file:com.yacme.ext.oxsit.cust_it.security.crl.X509CertRL.java

License:Open Source License

public static String[] getCrlDistributionPoint(X509Certificate certificate) throws CertificateParsingException {
    try {/*w  ww  . j a  v  a 2s .co m*/
        //trova i DP (OID="2.5.29.31") nel certificato
        DERObject obj = getExtensionValue(certificate, "2.5.29.31");

        if (obj == null) {
            //nessun DP presente
            return null;
        }
        CRLDistPoint crldp = CRLDistPoint.getInstance(obj);
        DistributionPoint[] dp = crldp.getDistributionPoints();
        String[] urls = new String[5];

        int p = 0;
        for (int i = 0; i < dp.length; i++) {
            DistributionPointName dpn = dp[i].getDistributionPoint();
            //custom toString
            if (dpn.getType() == DistributionPointName.FULL_NAME) {
                //stx = stx+"fullName:" + term;
            } else {
                //stx = stx+"nameRelativeToCRLIssuer:" + term;                  
            }

            GeneralNames gnx = GeneralNames.getInstance(dpn.getName());
            GeneralName[] gn = gnx.getNames();

            for (int y = 0; y < gn.length; y++) {
                String aNm = decodeAGeneralName(gn[y]);
                if (aNm != null) {
                    urls[p++] = aNm;
                }
            }
        }
        return urls;
    } catch (Throwable e) {
        e.printStackTrace();
        throw new CertificateParsingException(e.toString());
    }
}

---

From source file:com.yahoo.athenz.auth.util.Crypto.java

License:Apache License

public static String extractX509CSREmail(PKCS10CertificationRequest certReq) {

    String rfc822 = null;/*  w w w  .  ja v  a 2 s  .  c  om*/
    Attribute[] attributes = certReq.getAttributes(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest);
    for (Attribute attribute : attributes) {
        for (ASN1Encodable value : attribute.getAttributeValues()) {
            Extensions extensions = Extensions.getInstance(value);
            GeneralNames gns = GeneralNames.fromExtensions(extensions, Extension.subjectAlternativeName);
            for (GeneralName name : gns.getNames()) {
                if (name.getTagNo() == GeneralName.rfc822Name) {
                    rfc822 = (((DERIA5String) name.getName()).getString());
                    break;
                }
            }
        }
    }
    return rfc822;
}

---

From source file:com.yahoo.athenz.auth.util.Crypto.java

License:Apache License

public static List<String> extractX509CSRDnsNames(PKCS10CertificationRequest certReq) {

    List<String> dnsNames = new ArrayList<>();
    Attribute[] attributes = certReq.getAttributes(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest);
    for (Attribute attribute : attributes) {
        for (ASN1Encodable value : attribute.getAttributeValues()) {
            Extensions extensions = Extensions.getInstance(value);
            GeneralNames gns = GeneralNames.fromExtensions(extensions, Extension.subjectAlternativeName);
            for (GeneralName name : gns.getNames()) {
                if (name.getTagNo() == GeneralName.dNSName) {
                    dnsNames.add(((DERIA5String) name.getName()).getString());
                }//from ww w . j  av  a2  s  . c o m
            }
        }
    }
    return dnsNames;
}

---

From source file:com.yahoo.athenz.auth.util.Crypto.java

License:Apache License

public static List<String> extractX509CSRIPAddresses(PKCS10CertificationRequest certReq) {

    List<String> ipAddresses = new ArrayList<>();
    Attribute[] attributes = certReq.getAttributes(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest);
    for (Attribute attribute : attributes) {
        for (ASN1Encodable value : attribute.getAttributeValues()) {
            Extensions extensions = Extensions.getInstance(value);
            GeneralNames gns = GeneralNames.fromExtensions(extensions, Extension.subjectAlternativeName);
            for (GeneralName name : gns.getNames()) {
                if (name.getTagNo() == GeneralName.iPAddress) {
                    try {
                        InetAddress addr = InetAddress
                                .getByAddress(((DEROctetString) name.getName()).getOctets());
                        ipAddresses.add(addr.getHostAddress());
                    } catch (UnknownHostException e) {
                    }//w  ww .  ja v a 2s  .  c o  m
                }
            }
        }
    }
    return ipAddresses;
}

---

From source file:com.yahoo.athenz.auth.util.Crypto.java

License:Apache License

public static X509Certificate generateX509Certificate(PKCS10CertificationRequest certReq,
        PrivateKey caPrivateKey, X500Name issuer, int validityTimeout, boolean basicConstraints) {

    // set validity for the given number of minutes from now

    Date notBefore = new Date();
    Calendar cal = Calendar.getInstance();
    cal.setTime(notBefore);// w ww .j  ava2 s.c o  m
    cal.add(Calendar.MINUTE, validityTimeout);
    Date notAfter = cal.getTime();

    // Generate self-signed certificate

    X509Certificate cert = null;
    try {
        JcaPKCS10CertificationRequest jcaPKCS10CertificationRequest = new JcaPKCS10CertificationRequest(
                certReq);
        PublicKey publicKey = jcaPKCS10CertificationRequest.getPublicKey();

        X509v3CertificateBuilder caBuilder = new JcaX509v3CertificateBuilder(issuer,
                BigInteger.valueOf(System.currentTimeMillis()), notBefore, notAfter, certReq.getSubject(),
                publicKey)
                        .addExtension(Extension.basicConstraints, false, new BasicConstraints(basicConstraints))
                        .addExtension(Extension.keyUsage, true,
                                new X509KeyUsage(X509KeyUsage.digitalSignature | X509KeyUsage.keyEncipherment))
                        .addExtension(Extension.extendedKeyUsage, true,
                                new ExtendedKeyUsage(new KeyPurposeId[] { KeyPurposeId.id_kp_clientAuth,
                                        KeyPurposeId.id_kp_serverAuth }));

        // see if we have the dns/rfc822/ip address extensions specified in the csr

        ArrayList<GeneralName> altNames = new ArrayList<>();
        Attribute[] certAttributes = jcaPKCS10CertificationRequest
                .getAttributes(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest);
        if (certAttributes != null && certAttributes.length > 0) {
            for (Attribute attribute : certAttributes) {
                Extensions extensions = Extensions.getInstance(attribute.getAttrValues().getObjectAt(0));
                GeneralNames gns = GeneralNames.fromExtensions(extensions, Extension.subjectAlternativeName);
                if (gns == null) {
                    continue;
                }
                GeneralName[] names = gns.getNames();
                for (int i = 0; i < names.length; i++) {
                    switch (names[i].getTagNo()) {
                    case GeneralName.dNSName:
                    case GeneralName.iPAddress:
                    case GeneralName.rfc822Name:
                        altNames.add(names[i]);
                        break;
                    }
                }
            }
            if (!altNames.isEmpty()) {
                caBuilder.addExtension(Extension.subjectAlternativeName, false,
                        new GeneralNames(altNames.toArray(new GeneralName[altNames.size()])));
            }
        }

        String signatureAlgorithm = getSignatureAlgorithm(caPrivateKey.getAlgorithm(), SHA256);
        ContentSigner caSigner = new JcaContentSignerBuilder(signatureAlgorithm).setProvider(BC_PROVIDER)
                .build(caPrivateKey);

        JcaX509CertificateConverter converter = new JcaX509CertificateConverter().setProvider(BC_PROVIDER);
        cert = converter.getCertificate(caBuilder.build(caSigner));

    } catch (CertificateException ex) {
        LOG.error("generateX509Certificate: Caught CertificateException when generating certificate: "
                + ex.getMessage());
        throw new CryptoException(ex);
    } catch (OperatorCreationException ex) {
        LOG.error(
                "generateX509Certificate: Caught OperatorCreationException when creating JcaContentSignerBuilder: "
                        + ex.getMessage());
        throw new CryptoException(ex);
    } catch (InvalidKeyException ex) {
        LOG.error("generateX509Certificate: Caught InvalidKeySpecException, invalid key spec is being used: "
                + ex.getMessage());
        throw new CryptoException(ex);
    } catch (NoSuchAlgorithmException ex) {
        LOG.error(
                "generateX509Certificate: Caught NoSuchAlgorithmException, check to make sure the algorithm is supported by the provider: "
                        + ex.getMessage());
        throw new CryptoException(ex);
    } catch (Exception ex) {
        LOG.error("generateX509Certificate: unable to generate X509 Certificate: " + ex.getMessage());
        throw new CryptoException("Unable to generate X509 Certificate");
    }

    return cert;
}

---

From source file:com.zimbra.cs.service.authenticator.CertUtil.java

License:Open Source License

private void printCRLDistributionPoints(PrintStream outStream) throws Exception {

    outStream.format("X509v3 CRL Distribution Points: \n");

    String extOid = X509Extension.cRLDistributionPoints.getId(); // 2.5.29.31
    byte[] extVal = cert.getExtensionValue(extOid);
    if (extVal == null) {
        return;/*  ww  w . j  a v a  2s  .c  o  m*/
    }

    /* http://download.oracle.com/javase/6/docs/api/java/security/cert/X509Extension.html#getExtensionValue(java.lang.String)
     *
       The ASN.1 definition for this is:
            
     Extensions  ::=  SEQUENCE SIZE (1..MAX) OF Extension
            
     Extension  ::=  SEQUENCE  {
         extnId        OBJECT IDENTIFIER,
         critical      BOOLEAN DEFAULT FALSE,
         extnValue     OCTET STRING
                       -- contains a DER encoding of a value
                       -- of the type registered for use with
                       -- the extnId object identifier value
     }
     */

    byte[] extnValue = DEROctetString.getInstance(ASN1Object.fromByteArray(extVal)).getOctets();

    CRLDistPoint crlDistPoint = CRLDistPoint.getInstance(ASN1Object.fromByteArray(extnValue));
    DistributionPoint[] distPoints = crlDistPoint.getDistributionPoints();

    for (DistributionPoint distPoint : distPoints) {
        DistributionPointName distPointName = distPoint.getDistributionPoint();
        int type = distPointName.getType();

        if (DistributionPointName.FULL_NAME == type) {
            outStream.format("Full Name: \n");
            GeneralNames generalNames = GeneralNames.getInstance(distPointName.getName());
            GeneralName[] names = generalNames.getNames();
            for (GeneralName generalname : names) {
                int tag = generalname.getTagNo();
                if (GeneralName.uniformResourceIdentifier == tag) {
                    DEREncodable name = generalname.getName();
                    DERIA5String str = DERIA5String.getInstance(name);
                    String value = str.getString();
                    outStream.format("    %s\n", value);
                } else {
                    outStream.format("tag %d not yet implemented", tag);
                }
            }
        } else {
            outStream.format("type %d not yet implemented", type);
        }
    }
}

---

• «
• 1
• 2
• 3
• 4
• 5
• 6
• 7
• 8
• 9
• »