Example usage for org.bouncycastle.asn1.x509 KeyUsage cRLSign

List of usage examples for org.bouncycastle.asn1.x509 KeyUsage cRLSign

  1. HOME
  2. Java
  3. org.bouncycastle
  4. org.bouncycastle.asn1.x509.*
  5. KeyUsage
  6. cRLSign

Introduction

In this page you can find the example usage for org.bouncycastle.asn1.x509 KeyUsage cRLSign.

Prototype

int cRLSign

To view the source code for org.bouncycastle.asn1.x509 KeyUsage cRLSign.

Click Source Link

Usage

From source file:beta01.SimpleRootCA.java

/**
 * Build a sample V3 certificate to use as an intermediate CA certificate
 * @param intKey//from  www  .j  av  a  2 s  .  c om
 * @param caKey
 * @param caCert
 * @return 
 * @throws java.lang.Exception 
 */
public static X509CertificateHolder buildIntermediateCert(AsymmetricKeyParameter intKey,
        AsymmetricKeyParameter caKey, X509CertificateHolder caCert) throws Exception {
    SubjectPublicKeyInfo intKeyInfo = SubjectPublicKeyInfoFactory.createSubjectPublicKeyInfo(intKey);

    X509v3CertificateBuilder certBldr = new X509v3CertificateBuilder(caCert.getSubject(), BigInteger.valueOf(1),
            new Date(System.currentTimeMillis()), new Date(System.currentTimeMillis() + VALIDITY_PERIOD),
            new X500Name("CN=Test CA Certificate"), intKeyInfo);

    X509ExtensionUtils extUtils = new X509ExtensionUtils(new SHA1DigestCalculator());

    certBldr.addExtension(Extension.authorityKeyIdentifier, false,
            extUtils.createAuthorityKeyIdentifier(caCert))
            .addExtension(Extension.subjectKeyIdentifier, false,
                    extUtils.createSubjectKeyIdentifier(intKeyInfo))
            .addExtension(Extension.basicConstraints, true, new BasicConstraints(0))
            .addExtension(Extension.keyUsage, true,
                    new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyCertSign | KeyUsage.cRLSign));

    AlgorithmIdentifier sigAlg = algFinder.find("SHA1withRSA");
    AlgorithmIdentifier digAlg = new DefaultDigestAlgorithmIdentifierFinder().find(sigAlg);

    ContentSigner signer = new BcRSAContentSignerBuilder(sigAlg, digAlg).build(caKey);

    return certBldr.build(signer);
}

From source file:chapter7.Utils.java

/**
 * Generate a sample V3 certificate to use as an intermediate CA certificate.
 * @param intKey/*from   w  ww.j av  a2  s .  co  m*/
 * @param caKey
 * @param caCert
 * @return
 * @throws Exception
 */
public static X509Certificate generateIntermediateCert(final PublicKey intKey, final PrivateKey caKey,
        final X509Certificate caCert) throws Exception {
    X509V3CertificateGenerator certGen = new X509V3CertificateGenerator();

    certGen.setSerialNumber(BigInteger.ONE);
    certGen.setIssuerDN(caCert.getSubjectX500Principal());
    certGen.setNotBefore(new Date(System.currentTimeMillis()));
    certGen.setNotAfter(new Date(System.currentTimeMillis() + VALIDITY_PERIOD));
    certGen.setSubjectDN(new X500Principal("CN=Test Intermediate Certificate"));
    certGen.setPublicKey(intKey);
    certGen.setSignatureAlgorithm("SHA1WithRSAEncryption");

    certGen.addExtension(X509Extensions.AuthorityKeyIdentifier, false,
            new AuthorityKeyIdentifierStructure(caCert));
    certGen.addExtension(X509Extensions.SubjectKeyIdentifier, false, new SubjectKeyIdentifierStructure(intKey));
    certGen.addExtension(X509Extensions.BasicConstraints, true, new BasicConstraints(0));
    certGen.addExtension(X509Extensions.KeyUsage, true,
            new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyCertSign | KeyUsage.cRLSign));

    return certGen.generateX509Certificate(caKey, CryptoDefs.Provider.BC.getName());
}

From source file:co.runrightfast.core.security.cert.impl.CertificateServiceImplTest.java

License:Apache License

/**
 * SubjectKeyIdentifier is not allowed to be specified
 *
 * @throws NoSuchAlgorithmException/*from   w  ww. j  a v  a2 s .  c om*/
 * @throws NoSuchProviderException
 * @throws CertificateExpiredException
 * @throws CertificateNotYetValidException
 * @throws CertificateException
 * @throws InvalidKeyException
 * @throws SignatureException
 */
@Test(expected = IllegalArgumentException.class)
public void testGenerateX509CertificateV3_intermediateCACertificate_withSubjectKeyIdentifierNoAllowed()
        throws NoSuchAlgorithmException, NoSuchProviderException, CertificateExpiredException,
        CertificateNotYetValidException, CertificateException, InvalidKeyException, SignatureException {
    final DistinguishedName subject = subject();

    final X500Principal subjectPrincipal = subject.toX500Principal();

    final KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(RSA.name(), BOUNCY_CASTLE);
    final KeyPair certKeyPair = keyPairGenerator.generateKeyPair();

    final CaCert caCert = caCert();
    final JcaX509ExtensionUtils extUtils = jcaX509ExtensionUtils();
    final ImmutableList<X509CertExtension> x509CertExtensions = ImmutableList.<X509CertExtension>builder()
            .add(X509CertExtension.builder().oid(Extension.authorityKeyIdentifier)
                    .value(extUtils.createAuthorityKeyIdentifier(caCert.getCert())).critical(false).build())
            .add(X509CertExtension.builder().oid(Extension.subjectKeyIdentifier)
                    .value(extUtils.createSubjectKeyIdentifier(certKeyPair.getPublic())).critical(false)
                    .build())
            .add(X509CertExtension.builder().oid(Extension.keyUsage)
                    .value(new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyCertSign | KeyUsage.cRLSign))
                    .critical(true).build())
            .build();

    final X509V3CertRequest request = new X509V3CertRequest(caCert.cert.getIssuerX500Principal(),
            BigInteger.ONE, Instant.now(), Instant.ofEpochMilli(System.currentTimeMillis() + (10 * 1000)),
            subjectPrincipal, certKeyPair.getPublic(), x509CertExtensions);
}

From source file:co.runrightfast.core.security.cert.impl.CertificateServiceImplTest.java

License:Apache License

@Test
public void testGenerateX509CertificateV3_intermediateCACertificate()
        throws NoSuchAlgorithmException, NoSuchProviderException, CertificateExpiredException,
        CertificateNotYetValidException, CertificateException, InvalidKeyException, SignatureException,
        CertificateEncodingException, IOException {
    final DistinguishedName subject = subject();

    final X500Principal subjectPrincipal = subject.toX500Principal();

    final KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(RSA.name(), BOUNCY_CASTLE);
    final KeyPair certKeyPair = keyPairGenerator.generateKeyPair();

    final CaCert caCert = caCert();
    final JcaX509ExtensionUtils extUtils = jcaX509ExtensionUtils();
    final ImmutableList<X509CertExtension> x509CertExtensions = ImmutableList.<X509CertExtension>builder()
            .add(X509CertExtension.builder().oid(Extension.authorityKeyIdentifier)
                    .value(extUtils.createAuthorityKeyIdentifier(caCert.getCert())).critical(false).build())
            .add(X509CertExtension.builder().oid(Extension.keyUsage)
                    .value(new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyCertSign | KeyUsage.cRLSign))
                    .critical(true).build())
            .build();//from  w w  w  .ja v  a 2 s  . c o m

    final X509V3CertRequest request = new X509V3CertRequest(caCert.cert.getIssuerX500Principal(),
            BigInteger.ONE, Instant.now(), Instant.ofEpochMilli(System.currentTimeMillis() + (10 * 1000)),
            subjectPrincipal, certKeyPair.getPublic(), x509CertExtensions, new BasicConstraints(0));
    log.info(String.format("request : %s", request));

    final X509Certificate cert = certificateService.generateX509CertificateV3(request, caCert.getPrivateKey());
    log.info(String.format("result.getSigAlgName() = %s, result.getVersion() = %s ", cert.getSigAlgName(),
            cert.getVersion()));
    assertThat(cert.getVersion(), is(3));

    cert.checkValidity();
    assertThat(Arrays.areEqual(subjectPrincipal.getEncoded(), cert.getSubjectX500Principal().getEncoded()),
            is(true));
    assertThat(Arrays.areEqual(caCert.getCert().getSubjectX500Principal().getEncoded(),
            cert.getIssuerX500Principal().getEncoded()), is(true));
    cert.verify(caCert.getCert().getPublicKey());

    assertThat(cert.getBasicConstraints(), is(0));
    checkAuthorityKeyIdentifierExtenstion(cert, caCert);
    checkSubjectKeyIdentifierExtenstion(cert);
}

From source file:co.runrightfast.core.security.cert.impl.CertificateServiceImplTest.java

License:Apache License

@Test
public void testGenerateX509CertificateV3_CAIssuedX509V3CertRequest_endCert()
        throws NoSuchAlgorithmException, NoSuchProviderException, CertificateExpiredException,
        CertificateNotYetValidException, CertificateException, InvalidKeyException, SignatureException,
        CertificateEncodingException, IOException {
    final DistinguishedName subject = subject();

    final X500Principal subjectPrincipal = subject.toX500Principal();

    final KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(RSA.name(), BOUNCY_CASTLE);
    final KeyPair certKeyPair = keyPairGenerator.generateKeyPair();

    final CaCert caCert = caCert();
    final JcaX509ExtensionUtils extUtils = jcaX509ExtensionUtils();
    final ImmutableList<X509CertExtension> x509CertExtensions = ImmutableList.<X509CertExtension>builder()
            .add(X509CertExtension.builder().oid(Extension.keyUsage)
                    .value(new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyCertSign | KeyUsage.cRLSign))
                    .critical(true).build())
            .build();//www.  ja va2  s  .c  o m

    final CAIssuedX509V3CertRequest request = new CAIssuedX509V3CertRequest(caCert.cert, BigInteger.ONE,
            Instant.now(), Instant.ofEpochMilli(System.currentTimeMillis() + (10 * 1000)), subjectPrincipal,
            certKeyPair.getPublic(), x509CertExtensions);
    log.info(String.format("request : %s", request));

    final X509Certificate cert = certificateService.generateX509CertificateV3(request, caCert.getPrivateKey());
    log.info(String.format("result.getSigAlgName() = %s, result.getVersion() = %s ", cert.getSigAlgName(),
            cert.getVersion()));
    assertThat(cert.getVersion(), is(3));

    cert.checkValidity();
    assertThat(Arrays.areEqual(subjectPrincipal.getEncoded(), cert.getSubjectX500Principal().getEncoded()),
            is(true));
    assertThat(Arrays.areEqual(caCert.getCert().getSubjectX500Principal().getEncoded(),
            cert.getIssuerX500Principal().getEncoded()), is(true));
    cert.verify(caCert.getCert().getPublicKey());

    assertThat(cert.getBasicConstraints(), is(-1));
    checkAuthorityKeyIdentifierExtenstion(cert, caCert);
    checkSubjectKeyIdentifierExtenstion(cert);

}

From source file:co.runrightfast.core.security.cert.impl.CertificateServiceImplTest.java

License:Apache License

@Test
public void testGenerateX509CertificateV3_CAIssuedX509V3CertRequest_IntermediateCert()
        throws NoSuchAlgorithmException, NoSuchProviderException, CertificateExpiredException,
        CertificateNotYetValidException, CertificateException, InvalidKeyException, SignatureException,
        CertificateEncodingException, IOException {
    final DistinguishedName subject = subject();

    final X500Principal subjectPrincipal = subject.toX500Principal();

    final KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(RSA.name(), BOUNCY_CASTLE);
    final KeyPair certKeyPair = keyPairGenerator.generateKeyPair();

    final CaCert caCert = caCert();
    final ImmutableList<X509CertExtension> x509CertExtensions = ImmutableList.<X509CertExtension>builder()
            .add(keyUsage(new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyCertSign | KeyUsage.cRLSign)))
            .build();/*from  w ww .  java  2  s. co m*/

    final CAIssuedX509V3CertRequest request = new CAIssuedX509V3CertRequest(caCert.cert, BigInteger.ONE,
            Instant.now(), Instant.ofEpochMilli(System.currentTimeMillis() + (10 * 1000)), subjectPrincipal,
            certKeyPair.getPublic(), x509CertExtensions, new BasicConstraints(0));
    log.info(String.format("request : %s", request));

    final X509Certificate cert = certificateService.generateX509CertificateV3(request, caCert.getPrivateKey());
    log.info(String.format("result.getSigAlgName() = %s, result.getVersion() = %s ", cert.getSigAlgName(),
            cert.getVersion()));
    assertThat(cert.getVersion(), is(3));

    cert.checkValidity();
    assertThat(Arrays.areEqual(subjectPrincipal.getEncoded(), cert.getSubjectX500Principal().getEncoded()),
            is(true));
    assertThat(Arrays.areEqual(caCert.getCert().getSubjectX500Principal().getEncoded(),
            cert.getIssuerX500Principal().getEncoded()), is(true));
    cert.verify(caCert.getCert().getPublicKey());

    assertThat(cert.getBasicConstraints(), is(0));

    checkAuthorityKeyIdentifierExtenstion(cert, caCert);
    checkSubjectKeyIdentifierExtenstion(cert);
}

From source file:co.runrightfast.core.security.cert.impl.CertificateServiceImplTest.java

License:Apache License

@Test(expected = IllegalArgumentException.class)
public void testGenerateX509CertificateV3_CAIssuedX509V3CertRequest_withBasicConstraintsExtensionNotAllowed()
        throws NoSuchAlgorithmException, NoSuchProviderException, CertificateExpiredException,
        CertificateNotYetValidException, CertificateException, InvalidKeyException, SignatureException {
    final DistinguishedName subject = subject();

    final X500Principal subjectPrincipal = subject.toX500Principal();

    final KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(RSA.name(), BOUNCY_CASTLE);
    final KeyPair certKeyPair = keyPairGenerator.generateKeyPair();

    final CaCert caCert = caCert();
    final JcaX509ExtensionUtils extUtils = jcaX509ExtensionUtils();
    final ImmutableList<X509CertExtension> x509CertExtensions = ImmutableList.<X509CertExtension>builder()
            .add(X509CertExtension.builder().oid(Extension.keyUsage)
                    .value(new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyCertSign | KeyUsage.cRLSign))
                    .critical(true).build())
            .add(X509CertExtension.builder().oid(Extension.basicConstraints).value(new BasicConstraints(0))
                    .critical(true).build())
            .build();//w w w .  jav  a 2  s .  co  m

    final CAIssuedX509V3CertRequest request = new CAIssuedX509V3CertRequest(caCert.cert, BigInteger.ONE,
            Instant.now(), Instant.ofEpochMilli(System.currentTimeMillis() + (10 * 1000)), subjectPrincipal,
            certKeyPair.getPublic(), x509CertExtensions);
    log.info(String.format("request : %s", request));

    final X509Certificate cert = certificateService.generateX509CertificateV3(request, caCert.getPrivateKey());
    log.info(String.format("result.getSigAlgName() = %s, result.getVersion() = %s ", cert.getSigAlgName(),
            cert.getVersion()));
    assertThat(cert.getVersion(), is(3));

    cert.checkValidity();
    assertThat(Arrays.areEqual(subjectPrincipal.getEncoded(), cert.getSubjectX500Principal().getEncoded()),
            is(true));
    assertThat(Arrays.areEqual(caCert.getCert().getSubjectX500Principal().getEncoded(),
            cert.getIssuerX500Principal().getEncoded()), is(true));
    cert.verify(caCert.getCert().getPublicKey());

}

From source file:co.runrightfast.core.security.cert.impl.CertificateServiceImplTest.java

License:Apache License

@Test(expected = IllegalArgumentException.class)
public void testGenerateX509CertificateV3_CAIssuedX509V3CertRequest_withSubjectKeyIdentifierNoAllowed()
        throws NoSuchAlgorithmException, NoSuchProviderException, CertificateExpiredException,
        CertificateNotYetValidException, CertificateException, InvalidKeyException, SignatureException {
    final DistinguishedName subject = subject();

    final X500Principal subjectPrincipal = subject.toX500Principal();

    final KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(RSA.name(), BOUNCY_CASTLE);
    final KeyPair certKeyPair = keyPairGenerator.generateKeyPair();

    final CaCert caCert = caCert();
    final JcaX509ExtensionUtils extUtils = jcaX509ExtensionUtils();
    final ImmutableList<X509CertExtension> x509CertExtensions = ImmutableList.<X509CertExtension>builder()
            .add(X509CertExtension.builder().oid(Extension.subjectKeyIdentifier)
                    .value(extUtils.createSubjectKeyIdentifier(certKeyPair.getPublic())).critical(false)
                    .build())/*from w  ww  . jav a  2 s  .  c  o  m*/
            .add(X509CertExtension.builder().oid(Extension.keyUsage)
                    .value(new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyCertSign | KeyUsage.cRLSign))
                    .critical(true).build())
            .add(X509CertExtension.builder().oid(Extension.basicConstraints).value(new BasicConstraints(0))
                    .critical(true).build())
            .build();

    final CAIssuedX509V3CertRequest request = new CAIssuedX509V3CertRequest(caCert.cert, BigInteger.ONE,
            Instant.now(), Instant.ofEpochMilli(System.currentTimeMillis() + (10 * 1000)), subjectPrincipal,
            certKeyPair.getPublic(), x509CertExtensions);

}

From source file:co.runrightfast.core.security.cert.impl.CertificateServiceImplTest.java

License:Apache License

@Test(expected = IllegalArgumentException.class)
public void testGenerateX509CertificateV3_CAIssuedX509V3CertRequest_withAuthorityKeyIdentifierNotAllowed()
        throws NoSuchAlgorithmException, NoSuchProviderException, CertificateExpiredException,
        CertificateNotYetValidException, CertificateException, InvalidKeyException, SignatureException {
    final DistinguishedName subject = subject();

    final X500Principal subjectPrincipal = subject.toX500Principal();

    final KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(RSA.name(), BOUNCY_CASTLE);
    final KeyPair certKeyPair = keyPairGenerator.generateKeyPair();

    final CaCert caCert = caCert();
    final JcaX509ExtensionUtils extUtils = jcaX509ExtensionUtils();
    final ImmutableList<X509CertExtension> x509CertExtensions = ImmutableList.<X509CertExtension>builder()
            .add(X509CertExtension.builder().oid(Extension.authorityKeyIdentifier)
                    .value(extUtils.createAuthorityKeyIdentifier(caCert.getCert())).critical(false).build())
            .add(X509CertExtension.builder().oid(Extension.keyUsage)
                    .value(new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyCertSign | KeyUsage.cRLSign))
                    .critical(true).build())
            .add(X509CertExtension.builder().oid(Extension.basicConstraints).value(new BasicConstraints(0))
                    .critical(true).build())
            .build();/*from   w ww  . j  av  a2s . c o m*/

    final CAIssuedX509V3CertRequest request = new CAIssuedX509V3CertRequest(caCert.cert, BigInteger.ONE,
            Instant.now(), Instant.ofEpochMilli(System.currentTimeMillis() + (10 * 1000)), subjectPrincipal,
            certKeyPair.getPublic(), x509CertExtensions);

}

From source file:co.runrightfast.core.security.cert.impl.CertificateServiceImplTest.java

License:Apache License

private CaCert caCert() throws NoSuchAlgorithmException, NoSuchProviderException {
    final DistinguishedName issuer = issuer();

    final X500Principal issuerPrincipal = issuer.toX500Principal();

    final KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(RSA.name(), BOUNCY_CASTLE);
    final KeyPair certKeyPair = keyPairGenerator.generateKeyPair();

    final ImmutableList<X509CertExtension> x509CertExtensions = ImmutableList.<X509CertExtension>builder()
            .add(keyUsage(new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyCertSign | KeyUsage.cRLSign)))
            .build();// w w  w  .j a v a  2 s.  co  m
    final SelfSignedX509V3CertRequest selfSignedRequest = new SelfSignedX509V3CertRequest(issuerPrincipal,
            BigInteger.ONE, Instant.now(), Instant.ofEpochMilli(System.currentTimeMillis() + (10 * 1000)),
            certKeyPair, x509CertExtensions, new BasicConstraints(Integer.MAX_VALUE));

    return new CaCert(certificateService.generateSelfSignedX509CertificateV3(selfSignedRequest),
            certKeyPair.getPrivate());
}