Example usage for org.bouncycastle.asn1.x509 X509Extension extendedKeyUsage

Introduction

In this page you can find the example usage for org.bouncycastle.asn1.x509 X509Extension extendedKeyUsage.

Prototype

ASN1ObjectIdentifier extendedKeyUsage

To view the source code for org.bouncycastle.asn1.x509 X509Extension extendedKeyUsage.

Click Source Link

Document

Extended Key Usage

Usage

From source file:com.rcn.service.CertificateService.java

License:Open Source License

private void addRegularExtension(Optional<GeneralNames> generalNames, JcaX509v3CertificateBuilder v3CertGen) {
    v3CertGen.addExtension(X509Extension.keyUsage, false,
            new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyEncipherment));

    Vector<KeyPurposeId> authTypes = new Vector<>();
    authTypes.add(KeyPurposeId.id_kp_clientAuth);
    authTypes.add(KeyPurposeId.id_kp_serverAuth);

    v3CertGen.addExtension(X509Extension.extendedKeyUsage, false, new ExtendedKeyUsage(authTypes));

    generalNames.ifPresent(n -> v3CertGen.addExtension(X509Extension.subjectAlternativeName, false, n));
}

---

From source file:eu.optimis.ics.BrokerVPNCredentials.BrokerCA.java

License:Open Source License

public byte[] getSignedCertificateBytes(byte[] sentCSRBytes) {
    X509CertificateHolder certHolder = null;
    byte[] result = null;

    try {/*from  w ww  .  jav a2 s. com*/
        PKCS10CertificationRequest certRequest = new PKCS10CertificationRequest(sentCSRBytes);
        PEMReader r = new PEMReader(new FileReader(caPath + "ca.crt"));
        X509Certificate rootCert = (X509Certificate) r.readObject();
        r.close();

        X500Name subject = certRequest.getSubject();

        MessageDigest m = MessageDigest.getInstance("MD5");
        m.update(subject.toString().getBytes(), 0, subject.toString().length());

        BigInteger serial = new BigInteger(m.digest());

        Date notBefore = new Date(System.currentTimeMillis() - 1000L * 60 * 60 * 24 * 30);
        Date notAfter = new Date(System.currentTimeMillis() + (1000L * 60 * 60 * 24 * 365));

        SubjectPublicKeyInfo publicKeyInfo = certRequest.getSubjectPublicKeyInfo();

        X500Name issuer = new X500Name(rootCert.getSubjectDN().toString());

        X509v3CertificateBuilder v3CertBuilder = new X509v3CertificateBuilder(issuer, serial, notBefore,
                notAfter, subject, publicKeyInfo);

        v3CertBuilder.addExtension(X509Extension.subjectKeyIdentifier, false,
                new JcaX509ExtensionUtils().createSubjectKeyIdentifier(publicKeyInfo));
        v3CertBuilder.addExtension(X509Extension.authorityKeyIdentifier, false,
                new JcaX509ExtensionUtils().createAuthorityKeyIdentifier(rootCert));
        v3CertBuilder.addExtension(X509Extension.basicConstraints, false, new BasicConstraints(false));
        v3CertBuilder.addExtension(X509Extension.extendedKeyUsage, false,
                new ExtendedKeyUsage(KeyPurposeId.id_kp_ipsecEndSystem));
        v3CertBuilder.addExtension(X509Extension.keyUsage, false, new KeyUsage(KeyUsage.digitalSignature));

        ContentSigner sigGen = new JcaContentSignerBuilder("SHA1withRSA").setProvider("BC")
                .build(loadCAPrivateKey(caPath));
        certHolder = v3CertBuilder.build(sigGen);
        result = certHolder.getEncoded();
    } catch (Exception e) {
        e.printStackTrace();
    }
    return result;
}

---

From source file:eu.optimis.ics.Credentials.CertificateGenerator.java

License:Open Source License

public static X509CertificateHolder genServerCertificate(PKCS10CertificationRequest certRequest,
        String credPath) {/*from   w  ww.jav a  2  s  .co m*/
    X509v3CertificateBuilder v3CertBuilder = null;
    ContentSigner sigGen = null;
    try {

        PEMReader r = new PEMReader(new FileReader(credPath + "ca.crt"));
        X509Certificate rootCert = (X509Certificate) r.readObject();
        r.close();

        BigInteger serial = BigInteger.ONE;

        Date notBefore = new Date(System.currentTimeMillis() - 1000L * 60 * 60 * 24 * 30);
        Date notAfter = new Date(System.currentTimeMillis() + (1000L * 60 * 60 * 24 * 365 * 10));

        SubjectPublicKeyInfo publicKeyInfo = SubjectPublicKeyInfo
                .getInstance(certRequest.getPublicKey().getEncoded());

        X500Name issuer = new X500Name(rootCert.getSubjectDN().toString());
        System.out.println(issuer.toString());
        @SuppressWarnings("deprecation")
        X500Name subject = new X500Name(certRequest.getCertificationRequestInfo().getSubject().toString());

        v3CertBuilder = new X509v3CertificateBuilder(issuer, serial, notBefore, notAfter, subject,
                publicKeyInfo);

        v3CertBuilder.addExtension(X509Extension.subjectKeyIdentifier, false,
                new SubjectKeyIdentifier(publicKeyInfo));
        v3CertBuilder.addExtension(X509Extension.authorityKeyIdentifier, false,
                new AuthorityKeyIdentifierStructure(rootCert));
        v3CertBuilder.addExtension(X509Extension.basicConstraints, false, new BasicConstraints(false));
        v3CertBuilder.addExtension(X509Extension.extendedKeyUsage, false,
                new ExtendedKeyUsage(KeyPurposeId.id_kp_serverAuth));
        v3CertBuilder.addExtension(X509Extension.keyUsage, false,
                new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyEncipherment));

        sigGen = new JcaContentSignerBuilder("SHA1withRSA").setProvider("BC").build(loadCAPrivateKey(credPath));

    } catch (IOException ioe) {
        ioe.printStackTrace();
    } catch (InvalidKeyException e) {
        e.printStackTrace();
    } catch (NoSuchAlgorithmException e) {
        e.printStackTrace();
    } catch (NoSuchProviderException e) {
        e.printStackTrace();
    } catch (OperatorCreationException e) {
        e.printStackTrace();
    } catch (InvalidKeySpecException e) {
        e.printStackTrace();
    } catch (CertificateParsingException e) {
        e.printStackTrace();
    }

    return v3CertBuilder.build(sigGen);
}

---

From source file:eu.optimis.ics.Credentials.CertificateGenerator.java

License:Open Source License

public static X509CertificateHolder genClientCertificate(PKCS10CertificationRequest certRequest,
        String credPath) throws Exception {
    PEMReader r = new PEMReader(new FileReader(credPath + "ca.crt"));
    X509Certificate rootCert = (X509Certificate) r.readObject();
    r.close();/*from w w  w  .ja va2  s  .  c  om*/

    BigInteger serial = BigInteger.valueOf(2).abs();

    Date notBefore = new Date(System.currentTimeMillis() - 1000L * 60 * 60 * 24 * 30);
    Date notAfter = new Date(System.currentTimeMillis() + (1000L * 60 * 60 * 24 * 365 * 10));

    SubjectPublicKeyInfo publicKeyInfo = SubjectPublicKeyInfo
            .getInstance(certRequest.getPublicKey().getEncoded());

    X500Name issuer = new X500Name(rootCert.getSubjectDN().toString());

    @SuppressWarnings("deprecation")
    X500Name subject = new X500Name(certRequest.getCertificationRequestInfo().getSubject().toString());

    X509v3CertificateBuilder v3CertBuilder = new X509v3CertificateBuilder(issuer, serial, notBefore, notAfter,
            subject, publicKeyInfo);

    v3CertBuilder.addExtension(X509Extension.subjectKeyIdentifier, false,
            new SubjectKeyIdentifier(publicKeyInfo));
    v3CertBuilder.addExtension(X509Extension.authorityKeyIdentifier, false,
            new AuthorityKeyIdentifierStructure(rootCert));
    v3CertBuilder.addExtension(X509Extension.basicConstraints, false, new BasicConstraints(false));
    v3CertBuilder.addExtension(X509Extension.extendedKeyUsage, false,
            new ExtendedKeyUsage(KeyPurposeId.id_kp_clientAuth));
    v3CertBuilder.addExtension(X509Extension.keyUsage, false, new KeyUsage(KeyUsage.digitalSignature));

    ContentSigner sigGen = null;

    try {
        sigGen = new JcaContentSignerBuilder("SHA1withRSA").setProvider("BC").build(loadCAPrivateKey(credPath));
    } catch (OperatorCreationException e) {
        e.printStackTrace();
    }

    return v3CertBuilder.build(sigGen);
}

---

From source file:mitm.common.security.certificate.impl.StandardX509CertificateBuilder.java

License:Open Source License

protected X509v3CertificateBuilder createX509v3CertificateBuilder(X509Certificate issuerCertificate)
        throws IOException, CertificateParsingException, NoSuchAlgorithmException {
    X500Principal issuerPrincipal = getIssuer();

    if (issuerCertificate != null) {
        issuerPrincipal = issuerCertificate.getSubjectX500Principal();
    }/*from   w  ww .  j a  va2 s.co m*/

    X509v3CertificateBuilder builder = new X509v3CertificateBuilder(
            X500PrincipalUtils.toX500Name(issuerPrincipal), serialNumber, notBefore, notAfter,
            X500PrincipalUtils.toX500Name(subject), SubjectPublicKeyInfo.getInstance(publicKey.getEncoded()));

    if (isCA) {
        BasicConstraints basicConstraints = pathLengthConstraint == null ? new BasicConstraints(true)
                : new BasicConstraints(pathLengthConstraint);

        builder.addExtension(X509Extension.basicConstraints, cACritical, basicConstraints);
    }

    if (keyUsage != null && keyUsage.size() > 0) {
        builder.addExtension(X509Extension.keyUsage, keyUsageCritical, getKeyUsageASN1());
    }

    if (extendedKeyUsage != null && extendedKeyUsage.size() > 0) {
        builder.addExtension(X509Extension.extendedKeyUsage, extendedKeyUsageCritical,
                getExtendedKeyUsageASN1());
    }

    if (altNames != null) {
        builder.addExtension(X509Extension.subjectAlternativeName, altNamesCritical, altNames);
    }

    if (addSubjectKeyIdentier) {
        builder.addExtension(X509Extension.subjectKeyIdentifier, false, createSubjectKeyIdentifier(publicKey));
    }

    if (issuerCertificate != null && addAuthorityKeyIdentier) {
        builder.addExtension(X509Extension.authorityKeyIdentifier, false,
                getAuthorityKeyIdentifier(issuerCertificate));
    }

    if (crlDistributionPointURIs != null && crlDistributionPointURIs.size() > 0) {
        CRLDistributionPointsBuilder distPointBuilder = new CRLDistributionPointsBuilder();

        for (String uri : crlDistributionPointURIs) {
            distPointBuilder.addDistributionPoint(uri);
        }

        builder.addExtension(X509Extension.cRLDistributionPoints, false /* not critical */,
                distPointBuilder.buildCRLDistPoint());
    }

    return builder;
}

---

From source file:mitm.common.security.certpath.SMIMEExtendedKeyUsageCertPathChecker.java

License:Open Source License

@Override
public void check(Certificate certificate, Collection<String> unresolvedCritExts)
        throws CertPathValidatorException {
    if (!(certificate instanceof X509Certificate)) {
        throw new CertPathValidatorException("Certificate is not a X509Certificate.");
    }//from   w ww  .j a va  2 s . co m

    /*
     * Check if the certificate has extended key usage set and if so that it contains EMAILPROTECTION ANYKEYUSAGE.
     */
    try {
        Set<ExtendedKeyUsageType> extendedKeyUsages = X509CertificateInspector
                .getExtendedKeyUsage((X509Certificate) certificate);

        if (extendedKeyUsages != null && !extendedKeyUsages.contains(ExtendedKeyUsageType.ANYKEYUSAGE)
                && !extendedKeyUsages.contains(ExtendedKeyUsageType.EMAILPROTECTION)) {
            throw new MissingSMIMExtendedKeyUsageException(MISSING_SMIME_EXTENDED_KEY_USAGE);
        }

        /*
         * Check if the unresolved critical extensions contains the extended key usage. If so we have
         * to remove it because we have handled it.
         */
        if (unresolvedCritExts != null && unresolvedCritExts.contains(X509Extension.extendedKeyUsage.getId())) {
            unresolvedCritExts.remove(X509Extension.extendedKeyUsage.getId());
        }
    } catch (CertificateParsingException e) {
        throw new CertPathValidatorException(e);
    }
}

---

From source file:mitm.common.security.certpath.SMIMEExtendedKeyUsageCertPathChecker.java

License:Open Source License

@Override
public Set<String> getSupportedExtensions() {
    Set<String> supported = new HashSet<String>();

    supported.add(X509Extension.extendedKeyUsage.getId());

    return supported;
}

---

From source file:net.link.util.common.KeyUtils.java

License:Open Source License

public static X509Certificate generateCertificate(PublicKey subjectPublicKey, String subjectDn,
        PrivateKey issuerPrivateKey, @Nullable X509Certificate issuerCert, DateTime notBefore,
        DateTime notAfter, String inSignatureAlgorithm, boolean caCert, boolean timeStampingPurpose,
        @Nullable URI ocspUri) {/*from w ww . j  av a2s . c  o m*/

    try {
        String signatureAlgorithm = inSignatureAlgorithm;
        if (null == signatureAlgorithm)
            signatureAlgorithm = String.format("SHA1With%s", issuerPrivateKey.getAlgorithm());

        X509Principal issuerDN;
        if (null != issuerCert)
            issuerDN = new X509Principal(issuerCert.getSubjectX500Principal().toString());
        else
            issuerDN = new X509Principal(subjectDn);

        // new bc 2.0 API
        X509Principal subject = new X509Principal(subjectDn);
        SubjectPublicKeyInfo publicKeyInfo = SubjectPublicKeyInfo.getInstance(subjectPublicKey.getEncoded());
        BigInteger serialNumber = new BigInteger(SERIALNUMBER_NUM_BITS, new SecureRandom());

        X509v3CertificateBuilder certificateBuilder = new X509v3CertificateBuilder(
                X500Name.getInstance(issuerDN.toASN1Primitive()), serialNumber, notBefore.toDate(),
                notAfter.toDate(), X500Name.getInstance(subject.toASN1Primitive()), publicKeyInfo);

        // prepare signer
        ContentSigner signer = new JcaContentSignerBuilder(signatureAlgorithm).build(issuerPrivateKey);
        certificateBuilder.addExtension(X509Extension.subjectKeyIdentifier, false,
                createSubjectKeyId(subjectPublicKey));
        PublicKey issuerPublicKey;
        if (null != issuerCert)
            issuerPublicKey = issuerCert.getPublicKey();
        else
            issuerPublicKey = subjectPublicKey;
        certificateBuilder.addExtension(X509Extension.authorityKeyIdentifier, false,
                createAuthorityKeyId(issuerPublicKey));

        certificateBuilder.addExtension(X509Extension.basicConstraints, false, new BasicConstraints(caCert));

        if (timeStampingPurpose)
            certificateBuilder.addExtension(X509Extension.extendedKeyUsage, true,
                    new ExtendedKeyUsage(KeyPurposeId.id_kp_timeStamping));

        if (null != ocspUri) {
            GeneralName ocspName = new GeneralName(GeneralName.uniformResourceIdentifier, ocspUri.toString());
            AuthorityInformationAccess authorityInformationAccess = new AuthorityInformationAccess(
                    X509ObjectIdentifiers.ocspAccessMethod, ocspName);
            certificateBuilder.addExtension(X509Extension.authorityInfoAccess, false,
                    authorityInformationAccess);
        }

        // build
        return new JcaX509CertificateConverter().setProvider("BC")
                .getCertificate(certificateBuilder.build(signer));
    } catch (CertificateException e) {
        throw new InternalInconsistencyException("X.509 is not supported.", e);
    } catch (OperatorCreationException e) {
        throw new InternalInconsistencyException(e);
    } catch (CertIOException e) {
        throw new InternalInconsistencyException(e);
    }
}

---

From source file:net.link.util.test.pkix.PkiTestUtils.java

License:Open Source License

public static X509Certificate generateCertificate(PublicKey subjectPublicKey, String subjectDn,
        PrivateKey issuerPrivateKey, @Nullable X509Certificate issuerCert, DateTime notBefore,
        DateTime notAfter, @Nullable String signatureAlgorithm, boolean includeAuthorityKeyIdentifier,
        boolean caCert, boolean timeStampingPurpose, @Nullable URI ocspUri)
        throws IOException, CertificateException, OperatorCreationException {

    String finalSignatureAlgorithm = signatureAlgorithm;
    if (null == signatureAlgorithm)
        finalSignatureAlgorithm = "SHA512WithRSAEncryption";

    X509Principal issuerDN;/*ww  w .j  a  v  a 2 s.co  m*/
    if (null != issuerCert)
        issuerDN = new X509Principal(issuerCert.getSubjectX500Principal().toString());
    else
        issuerDN = new X509Principal(subjectDn);

    // new bc 2.0 API
    X509Principal subject = new X509Principal(subjectDn);
    SubjectPublicKeyInfo publicKeyInfo = SubjectPublicKeyInfo.getInstance(subjectPublicKey.getEncoded());
    BigInteger serialNumber = new BigInteger(SERIALNUMBER_NUM_BITS, new SecureRandom());

    X509v3CertificateBuilder certificateBuilder = new X509v3CertificateBuilder(
            X500Name.getInstance(issuerDN.toASN1Primitive()), serialNumber, notBefore.toDate(),
            notAfter.toDate(), X500Name.getInstance(subject.toASN1Primitive()), publicKeyInfo);

    // prepare signer
    ContentSigner signer = new JcaContentSignerBuilder(finalSignatureAlgorithm).build(issuerPrivateKey);

    // add extensions
    certificateBuilder.addExtension(X509Extension.subjectKeyIdentifier, false,
            createSubjectKeyId(subjectPublicKey));
    PublicKey issuerPublicKey;
    if (null != issuerCert)
        issuerPublicKey = issuerCert.getPublicKey();
    else
        issuerPublicKey = subjectPublicKey;
    if (includeAuthorityKeyIdentifier)
        certificateBuilder.addExtension(X509Extension.authorityKeyIdentifier, false,
                createAuthorityKeyId(issuerPublicKey));

    certificateBuilder.addExtension(X509Extension.basicConstraints, false, new BasicConstraints(caCert));

    if (timeStampingPurpose)
        certificateBuilder.addExtension(X509Extension.extendedKeyUsage, true,
                new ExtendedKeyUsage(KeyPurposeId.id_kp_timeStamping));

    if (null != ocspUri) {
        GeneralName ocspName = new GeneralName(GeneralName.uniformResourceIdentifier,
                new DERIA5String(ocspUri.toString()));
        AuthorityInformationAccess authorityInformationAccess = new AuthorityInformationAccess(
                X509ObjectIdentifiers.ocspAccessMethod, ocspName);
        certificateBuilder.addExtension(X509Extension.authorityInfoAccess, false, authorityInformationAccess);
    }

    // build
    return new JcaX509CertificateConverter().setProvider("BC").getCertificate(certificateBuilder.build(signer));
}

---

From source file:org.apache.nifi.web.security.x509.ocsp.OcspCertificateValidatorTest.java

License:Apache License

/**
 * Generates a signed certificate with a specific keypair.
 *
 * @param dn      the DN/* w w  w  . j a  v  a 2  s .  co m*/
 * @param keyPair the public key will be included in the certificate and the the private key is used to sign the certificate
 * @return the certificate
 * @throws IOException               if an exception occurs
 * @throws NoSuchAlgorithmException  if an exception occurs
 * @throws CertificateException      if an exception occurs
 * @throws NoSuchProviderException   if an exception occurs
 * @throws SignatureException        if an exception occurs
 * @throws InvalidKeyException       if an exception occurs
 * @throws OperatorCreationException if an exception occurs
 */
private static X509Certificate generateCertificate(String dn, KeyPair keyPair)
        throws IOException, NoSuchAlgorithmException, CertificateException, NoSuchProviderException,
        SignatureException, InvalidKeyException, OperatorCreationException {
    PrivateKey privateKey = keyPair.getPrivate();
    ContentSigner sigGen = new JcaContentSignerBuilder(SIGNATURE_ALGORITHM).setProvider(PROVIDER)
            .build(privateKey);
    SubjectPublicKeyInfo subPubKeyInfo = SubjectPublicKeyInfo.getInstance(keyPair.getPublic().getEncoded());
    Date startDate = new Date(YESTERDAY);
    Date endDate = new Date(ONE_YEAR_FROM_NOW);

    X509v3CertificateBuilder certBuilder = new X509v3CertificateBuilder(new X500Name(dn),
            BigInteger.valueOf(System.currentTimeMillis()), startDate, endDate, new X500Name(dn),
            subPubKeyInfo);

    // Set certificate extensions
    // (1) digitalSignature extension
    certBuilder.addExtension(X509Extension.keyUsage, true, new KeyUsage(KeyUsage.digitalSignature
            | KeyUsage.keyEncipherment | KeyUsage.dataEncipherment | KeyUsage.keyAgreement));

    // (2) extendedKeyUsage extension
    Vector<KeyPurposeId> ekUsages = new Vector<>();
    ekUsages.add(KeyPurposeId.id_kp_clientAuth);
    ekUsages.add(KeyPurposeId.id_kp_serverAuth);
    certBuilder.addExtension(X509Extension.extendedKeyUsage, false, new ExtendedKeyUsage(ekUsages));

    // Sign the certificate
    X509CertificateHolder certificateHolder = certBuilder.build(sigGen);
    return new JcaX509CertificateConverter().setProvider(PROVIDER).getCertificate(certificateHolder);
}

---

• «
• 1
• 2
• 3
• »