Example usage for org.bouncycastle.asn1.x509 SubjectPublicKeyInfo equals

Introduction

In this page you can find the example usage for org.bouncycastle.asn1.x509 SubjectPublicKeyInfo equals.

Prototype

public boolean equals(Object o) 

Source Link

Usage

From source file:org.xipki.ca.qa.impl.X509CertprofileQAImpl.java

License:Open Source License

@Override
public ValidationResult checkCert(final byte[] certBytes, final X509IssuerInfo issuerInfo,
        final X500Name requestedSubject, final SubjectPublicKeyInfo requestedPublicKey,
        final Extensions requestedExtensions) {
    ParamChecker.assertNotNull("certBytes", certBytes);
    ParamChecker.assertNotNull("issuerInfo", issuerInfo);
    ParamChecker.assertNotNull("requestedSubject", requestedSubject);
    ParamChecker.assertNotNull("requestedPublicKey", requestedPublicKey);

    List<ValidationIssue> resultIssues = new LinkedList<ValidationIssue>();

    Certificate bcCert;// www.  ja  v a2  s.c  o m
    X509Certificate cert;

    // certificate encoding
    {
        ValidationIssue issue = new ValidationIssue("X509.ENCODING", "certificate encoding");
        resultIssues.add(issue);
        try {
            bcCert = Certificate.getInstance(certBytes);
            cert = X509Util.parseCert(certBytes);
        } catch (CertificateException | IOException e) {
            issue.setFailureMessage("certificate is not corrected encoded");
            return new ValidationResult(resultIssues);
        }
    }

    // syntax version
    {
        ValidationIssue issue = new ValidationIssue("X509.VERSION", "certificate version");
        resultIssues.add(issue);
        int versionNumber = cert.getVersion();
        if (versionNumber != version.getVersion()) {
            issue.setFailureMessage("is '" + versionNumber + "' but expected '" + version.getVersion() + "'");
        }
    }

    // signatureAlgorithm
    if (CollectionUtil.isNotEmpty(signatureAlgorithms)) {
        ValidationIssue issue = new ValidationIssue("X509.SIGALG", "signature algorithm");
        resultIssues.add(issue);

        AlgorithmIdentifier sigAlgId = bcCert.getSignatureAlgorithm();
        AlgorithmIdentifier tbsSigAlgId = bcCert.getTBSCertificate().getSignature();
        if (tbsSigAlgId.equals(sigAlgId) == false) {
            issue.setFailureMessage("Certificate.tbsCertificate.signature != Certificate.signatureAlgorithm");
        } else {
            try {
                String sigAlgo = AlgorithmUtil.getSignatureAlgoName(sigAlgId);
                if (signatureAlgorithms.contains(sigAlgo) == false) {
                    issue.setFailureMessage("signatureAlgorithm '" + sigAlgo + "' is not allowed");
                }
            } catch (NoSuchAlgorithmException e) {
                issue.setFailureMessage("unsupported signature algorithm " + sigAlgId.getAlgorithm().getId());
            }
        }
    }

    // notBefore
    if (notBeforeMidnight) {
        ValidationIssue issue = new ValidationIssue("X509.NOTBEFORE", "not before midnight");
        resultIssues.add(issue);
        Calendar c = Calendar.getInstance(UTC);
        c.setTime(cert.getNotBefore());
        int hourOfDay = c.get(Calendar.HOUR_OF_DAY);
        int minute = c.get(Calendar.MINUTE);
        int second = c.get(Calendar.SECOND);

        if (hourOfDay != 0 || minute != 0 || second != 0) {
            issue.setFailureMessage(" '" + cert.getNotBefore() + "' is not midnight time (UTC)");
        }
    }

    // validity
    {
        ValidationIssue issue = new ValidationIssue("X509.VALIDITY", "cert validity");
        resultIssues.add(issue);

        Date expectedNotAfter = validity.add(cert.getNotBefore());
        if (Math.abs(expectedNotAfter.getTime() - cert.getNotAfter().getTime()) > 60 * SECOND) {
            issue.setFailureMessage("cert validity is not within " + validity.toString());
        }
    }

    // public key
    {
        SubjectPublicKeyInfo publicKey = bcCert.getSubjectPublicKeyInfo();
        if (keyAlgorithms != null) {
            ValidationIssue issue = new ValidationIssue("X509.PUBKEY.SYN", "whether public key is permitted");
            resultIssues.add(issue);
            try {
                checkPublicKey(publicKey);
            } catch (BadCertTemplateException e) {
                issue.setFailureMessage(e.getMessage());
            }
        }

        ValidationIssue issue = new ValidationIssue("X509.PUBKEY.REQ",
                "whether public key matches the request one");
        resultIssues.add(issue);
        SubjectPublicKeyInfo c14nRequestedPublicKey;
        try {
            c14nRequestedPublicKey = X509Util.toRfc3279Style(requestedPublicKey);
            if (c14nRequestedPublicKey.equals(publicKey) == false) {
                issue.setFailureMessage("public key in the certificate does not equal the requested one");
            }
        } catch (InvalidKeySpecException e) {
            issue.setFailureMessage("public key in request is invalid");
        }
    }

    // Signature
    {
        ValidationIssue issue = new ValidationIssue("X509.SIG", "whether certificate is signed by CA");
        resultIssues.add(issue);
        try {
            cert.verify(issuerInfo.getCert().getPublicKey(), "BC");
        } catch (Exception e) {
            issue.setFailureMessage("invalid signature");
        }
    }

    // issuer
    {
        ValidationIssue issue = new ValidationIssue("X509.ISSUER", "certificate issuer");
        resultIssues.add(issue);
        if (cert.getIssuerX500Principal().equals(issuerInfo.getCert().getSubjectX500Principal()) == false) {
            issue.setFailureMessage("issue in certificate does not equal the subject of CA certificate");
        }
    }

    // subject
    X500Name subject = bcCert.getTBSCertificate().getSubject();
    resultIssues.addAll(checkSubject(subject, requestedSubject));

    // extensions
    resultIssues.addAll(checkExtensions(bcCert, cert, issuerInfo, requestedExtensions));

    return new ValidationResult(resultIssues);
}

---

From source file:org.xipki.pki.ca.qa.PublicKeyChecker.java

License:Open Source License

public List<ValidationIssue> checkPublicKey(final SubjectPublicKeyInfo publicKey,
        final SubjectPublicKeyInfo requestedPublicKey) {
    ParamUtil.requireNonNull("publicKey", publicKey);
    ParamUtil.requireNonNull("requestedPublicKey", requestedPublicKey);

    List<ValidationIssue> resultIssues = new LinkedList<>();
    if (keyAlgorithms != null) {
        ValidationIssue issue = new ValidationIssue("X509.PUBKEY.SYN",
                "whether the public key in certificate is permitted");
        resultIssues.add(issue);/*from ww  w  .  j av a 2 s  . co m*/
        try {
            checkPublicKey(publicKey);
        } catch (BadCertTemplateException ex) {
            issue.setFailureMessage(ex.getMessage());
        }
    }

    ValidationIssue issue = new ValidationIssue("X509.PUBKEY.REQ",
            "whether public key matches the request one");
    resultIssues.add(issue);
    SubjectPublicKeyInfo c14nRequestedPublicKey;
    try {
        c14nRequestedPublicKey = X509Util.toRfc3279Style(requestedPublicKey);
        if (!c14nRequestedPublicKey.equals(publicKey)) {
            issue.setFailureMessage("public key in the certificate does not equal the requested one");
        }
    } catch (InvalidKeySpecException ex) {
        issue.setFailureMessage("public key in request is invalid");
    }

    return resultIssues;
}

---