Example usage for org.bouncycastle.asn1.x509 Time Time

Introduction

In this page you can find the example usage for org.bouncycastle.asn1.x509 Time Time.

Prototype

public Time(Date time, Locale locale) 

Source Link

Document

Creates a time object from a given date and locale - if the date is between 1950 and 2049 a UTCTime object is generated, otherwise a GeneralizedTime is used.

Usage

From source file:org.elasticsearch.xpack.core.ssl.CertGenUtils.java

License:Open Source License

/**
 * Generates a signed certificate/*from   www  .ja  v  a2 s. c o  m*/
 *
 * @param principal          the principal of the certificate; commonly referred to as the
 *                           distinguished name (DN)
 * @param subjectAltNames    the subject alternative names that should be added to the
 *                           certificate as an X509v3 extension. May be {@code null}
 * @param keyPair            the key pair that will be associated with the certificate
 * @param caCert             the CA certificate. If {@code null}, this results in a self signed
 *                           certificate
 * @param caPrivKey          the CA private key. If {@code null}, this results in a self signed
 *                           certificate
 * @param isCa               whether or not the generated certificate is a CA
 * @param days               no of days certificate will be valid from now
 * @param signatureAlgorithm algorithm used for signing certificate. If {@code null} or
 *                           empty, then use default algorithm {@link CertGenUtils#getDefaultSignatureAlgorithm(PrivateKey)}
 * @return a signed {@link X509Certificate}
 */
private static X509Certificate generateSignedCertificate(X500Principal principal, GeneralNames subjectAltNames,
        KeyPair keyPair, X509Certificate caCert, PrivateKey caPrivKey, boolean isCa, int days,
        String signatureAlgorithm)
        throws NoSuchAlgorithmException, CertificateException, CertIOException, OperatorCreationException {
    Objects.requireNonNull(keyPair, "Key-Pair must not be null");
    final DateTime notBefore = new DateTime(DateTimeZone.UTC);
    if (days < 1) {
        throw new IllegalArgumentException("the certificate must be valid for at least one day");
    }
    final DateTime notAfter = notBefore.plusDays(days);
    final BigInteger serial = CertGenUtils.getSerial();
    JcaX509ExtensionUtils extUtils = new JcaX509ExtensionUtils();

    X500Name subject = X500Name.getInstance(principal.getEncoded());
    final X500Name issuer;
    final AuthorityKeyIdentifier authorityKeyIdentifier;
    if (caCert != null) {
        if (caCert.getBasicConstraints() < 0) {
            throw new IllegalArgumentException("ca certificate is not a CA!");
        }
        issuer = X500Name.getInstance(caCert.getIssuerX500Principal().getEncoded());
        authorityKeyIdentifier = extUtils.createAuthorityKeyIdentifier(caCert.getPublicKey());
    } else {
        issuer = subject;
        authorityKeyIdentifier = extUtils.createAuthorityKeyIdentifier(keyPair.getPublic());
    }

    JcaX509v3CertificateBuilder builder = new JcaX509v3CertificateBuilder(issuer, serial,
            new Time(notBefore.toDate(), Locale.ROOT), new Time(notAfter.toDate(), Locale.ROOT), subject,
            keyPair.getPublic());

    builder.addExtension(Extension.subjectKeyIdentifier, false,
            extUtils.createSubjectKeyIdentifier(keyPair.getPublic()));
    builder.addExtension(Extension.authorityKeyIdentifier, false, authorityKeyIdentifier);
    if (subjectAltNames != null) {
        builder.addExtension(Extension.subjectAlternativeName, false, subjectAltNames);
    }
    builder.addExtension(Extension.basicConstraints, isCa, new BasicConstraints(isCa));

    PrivateKey signingKey = caPrivKey != null ? caPrivKey : keyPair.getPrivate();
    ContentSigner signer = new JcaContentSignerBuilder(
            (Strings.isNullOrEmpty(signatureAlgorithm)) ? getDefaultSignatureAlgorithm(signingKey)
                    : signatureAlgorithm).setProvider(CertGenUtils.BC_PROV).build(signingKey);
    X509CertificateHolder certificateHolder = builder.build(signer);
    return new JcaX509CertificateConverter().getCertificate(certificateHolder);
}

---