Example usage for org.bouncycastle.asn1.x509 KeyUsage toString

Introduction

In this page you can find the example usage for org.bouncycastle.asn1.x509 KeyUsage toString.

Prototype

public String toString() 

Source Link

Usage

From source file:eu.betaas.taas.securitymanager.common.certificate.utils.PKCS12Utils.java

License:Apache License

/**
 * A method to create PKCS12 file that stores the certificates.
 * @param pfxOut: the output of pkcs12 file (in OutputStream) 
 * @param key: private key that is associated with the credential
 * @param chain: chain of certificates (within the credential)
 * @param keyPasswd: key password//  w ww .ja  v a2 s.  co  m
 * @throws Exception
 */
public static void createPKCS12FileBc(OutputStream pfxOut, AsymmetricKeyParameter key,
        X509CertificateHolder[] chain, char[] keyPasswd) throws Exception {

    OutputEncryptor encOut = new BcPKCS12PBEOutputEncryptorBuilder(
            PKCSObjectIdentifiers.pbeWithSHAAnd3_KeyTripleDES_CBC, new CBCBlockCipher(new DESedeEngine()))
                    .build(keyPasswd);

    PKCS12SafeBagBuilder taCertBagBuilder = null;
    PKCS12SafeBagBuilder caCertBagBuilder = null;
    PKCS12SafeBagBuilder eeCertBagBuilder = null;
    SubjectKeyIdentifier pubKeyId = null;

    // identify the type of certificate from the given certificate chain
    for (int i = 0; i < chain.length; i++) {
        Extensions exs = chain[i].getExtensions();
        if (exs != null) {
            KeyUsage ku = KeyUsage.fromExtensions(exs);
            if (ku.toString().equals("KeyUsage: 0x" + Integer.toHexString(128 | 32))) {
                // end entity certificate
                eeCertBagBuilder = new PKCS12SafeBagBuilder(chain[i]);
                BcX509ExtensionUtils extUtils = new BcX509ExtensionUtils();
                eeCertBagBuilder.addBagAttribute(PKCS12SafeBag.friendlyNameAttribute,
                        new DERBMPString("Eric's Key"));
                pubKeyId = extUtils.createSubjectKeyIdentifier(chain[i].getSubjectPublicKeyInfo());
                eeCertBagBuilder.addBagAttribute(PKCS12SafeBag.localKeyIdAttribute, pubKeyId);
            } else if (ku.toString().equals("KeyUsage: 0x" + Integer.toHexString(128 | 4 | 2))) {
                // intermediate certificate
                caCertBagBuilder = new PKCS12SafeBagBuilder(chain[i]);
                caCertBagBuilder.addBagAttribute(PKCS12SafeBag.friendlyNameAttribute,
                        new DERBMPString("BETaaS Intermediate Certificate"));
            }
        } else {
            // root certificate
            taCertBagBuilder = new PKCS12SafeBagBuilder(chain[i]);
            taCertBagBuilder.addBagAttribute(PKCS12SafeBag.friendlyNameAttribute,
                    new DERBMPString("BETaaS Primary Certificate"));
        }
    }

    //    PKCS12SafeBagBuilder taCertBagBuilder = new PKCS12SafeBagBuilder(chain[2]);

    //    PKCS12SafeBagBuilder caCertBagBuilder = new PKCS12SafeBagBuilder(chain[1]);

    //    PKCS12SafeBagBuilder eeCertBagBuilder = new PKCS12SafeBagBuilder(chain[0]);

    // the ECPrivateKey, consists of the key itself and the ECParams
    BigInteger dPriv = ((ECPrivateKeyParameters) key).getD();
    X9ECParameters ecParams = new X9ECParameters(((ECKeyParameters) key).getParameters().getCurve(),
            ((ECKeyParameters) key).getParameters().getG(), ((ECKeyParameters) key).getParameters().getN(),
            ((ECKeyParameters) key).getParameters().getH(), ((ECKeyParameters) key).getParameters().getSeed());
    ECPrivateKey privParams = new ECPrivateKey(dPriv, ecParams);

    // include the ecParams
    AlgorithmIdentifier sigAlg = new AlgorithmIdentifier(X9ObjectIdentifiers.id_ecPublicKey, ecParams);

    //    PrivateKeyInfo keyInfo = PrivateKeyInfoFactory.createPrivateKeyInfo(key);

    PKCS12SafeBagBuilder keyBagBuilder = new PKCS12SafeBagBuilder(new PrivateKeyInfo(sigAlg, privParams),
            encOut);

    keyBagBuilder.addBagAttribute(PKCS12SafeBag.friendlyNameAttribute, new DERBMPString("Eric's Key"));
    if (pubKeyId != null)
        keyBagBuilder.addBagAttribute(PKCS12SafeBag.localKeyIdAttribute, pubKeyId);

    PKCS12PfxPduBuilder builder = new PKCS12PfxPduBuilder();

    builder.addData(keyBagBuilder.build());

    // no need to insert SHA1Digest() because it is the default Digest algorithm
    // check each of the certbagbuilder
    if (caCertBagBuilder != null && taCertBagBuilder != null && eeCertBagBuilder != null) {
        // include all types of certificate in the file --> root own's credential
        builder.addEncryptedData(
                new BcPKCS12PBEOutputEncryptorBuilder(PKCSObjectIdentifiers.pbeWithSHAAnd128BitRC2_CBC,
                        new CBCBlockCipher(new RC2Engine())).build(keyPasswd),
                new PKCS12SafeBag[] { eeCertBagBuilder.build(), caCertBagBuilder.build(),
                        taCertBagBuilder.build() });
    } else if (caCertBagBuilder != null && taCertBagBuilder != null && eeCertBagBuilder == null) {
        // only root and intermediate --> signer credential
        builder.addEncryptedData(
                new BcPKCS12PBEOutputEncryptorBuilder(PKCSObjectIdentifiers.pbeWithSHAAnd128BitRC2_CBC,
                        new CBCBlockCipher(new RC2Engine())).build(keyPasswd),
                new PKCS12SafeBag[] { caCertBagBuilder.build(), taCertBagBuilder.build() });
    } else if (caCertBagBuilder == null && taCertBagBuilder == null) {
        // only end entity --> e.g. application, user, etc
        builder.addEncryptedData(
                new BcPKCS12PBEOutputEncryptorBuilder(PKCSObjectIdentifiers.pbeWithSHAAnd128BitRC2_CBC,
                        new CBCBlockCipher(new RC2Engine())).build(keyPasswd),
                new PKCS12SafeBag[] { eeCertBagBuilder.build() });
    } else if (caCertBagBuilder != null && taCertBagBuilder == null && eeCertBagBuilder != null) {
        // only intermediate and end entity --> common GW certificate
        builder.addEncryptedData(
                new BcPKCS12PBEOutputEncryptorBuilder(PKCSObjectIdentifiers.pbeWithSHAAnd128BitRC2_CBC,
                        new CBCBlockCipher(new RC2Engine())).build(keyPasswd),
                new PKCS12SafeBag[] { eeCertBagBuilder.build(), caCertBagBuilder.build() });
    }

    //    PKCS12PfxPdu pfx = builder.build(new BcPKCS12MacCalculatorBuilder(
    //          new SHA256Digest(), 
    //          new AlgorithmIdentifier(NISTObjectIdentifiers.id_sha256)), keyPasswd);
    PKCS12PfxPdu pfx = builder.build(new BcPKCS12MacCalculatorBuilder(), keyPasswd);
    // make sure we don't include indefinite length encoding
    pfxOut.write(pfx.getEncoded(ASN1Encoding.DL));

    pfxOut.close();
}

---