Example usage for org.bouncycastle.cert.ocsp OCSPResp SUCCESSFUL

Introduction

In this page you can find the example usage for org.bouncycastle.cert.ocsp OCSPResp SUCCESSFUL.

Prototype

int SUCCESSFUL

To view the source code for org.bouncycastle.cert.ocsp OCSPResp SUCCESSFUL.

Click Source Link

Usage

From source file:ee.ria.xroad.common.util.healthcheck.HealthChecks.java

License:Open Source License

/**
 * A {@link HealthCheckProvider} that checks the authentication key and its OCSP response status
 *
 * @return the result of the check//from  ww w  .  j  av  a2s.  c  o  m
 */
public static HealthCheckProvider checkAuthKeyOcspStatus() {

    return () -> {

        // this fails if signer is down
        AuthKey authKey = KeyConf.getAuthKey();

        if (authKey == null) {
            return failure("No authentication key available. Signer might be down.");
        }

        CertChain certChain = authKey.getCertChain();

        if (certChain == null) {
            return failure("No certificate chain available in authentication key.");
        }
        X509Certificate certificate = certChain.getEndEntityCert();

        if (certificate == null) {
            return failure("No end entity certificate available for authentication key.");
        }

        int ocspStatus;

        try {
            ocspStatus = KeyConf.getOcspResponse(certificate).getStatus();
        } catch (Exception e) {
            log.error("Getting OCSP response for authentication key failed, got exception", e);
            return failure("Getting OCSP response for authentication key failed.");
        }

        return new HealthCheckResult(OCSPResp.SUCCESSFUL == ocspStatus,
                "Authentication key OCSP response status " + ocspStatus);
    };
}

---

From source file:ee.ria.xroad.common.util.healthcheck.HealthChecksTest.java

License:Open Source License

@Test
public void checkAuthKeyOcspStatusShouldBeOkWhenOcspStatusIsGood() throws Exception {

    // prepare/*from   w  ww.  j  ava 2 s  . co  m*/
    KeyConfProvider mockKeyConfProvider = createMockProviderWithOcspStatus(OCSPResp.SUCCESSFUL);
    KeyConf.reload(mockKeyConfProvider);

    // execute
    HealthCheckProvider testedProvider = HealthChecks.checkAuthKeyOcspStatus();
    HealthCheckResult checkedResult = testedProvider.get();

    // verify
    assertTrue("health check should pass", checkedResult.isOk());
}

---

From source file:org.cesecore.certificates.ocsp.integrated.IntegratedOcspResponseTest.java

License:Open Source License

/** Tests using the default responder for external CAs for a good certificate. */
@Test//w  w w.j  a v  a 2 s . c  o m
public void testResponseWithDefaultResponderForExternal() throws Exception {
    // Make sure that a default responder is set
    GlobalOcspConfiguration ocspConfiguration = (GlobalOcspConfiguration) globalConfigurationSession
            .getCachedConfiguration(GlobalOcspConfiguration.OCSP_CONFIGURATION_ID);
    final String originalDefaultResponder = ocspConfiguration.getOcspDefaultResponderReference();
    ocspConfiguration.setOcspDefaultResponderReference(testx509ca.getSubjectDN());
    globalConfigurationSession.saveConfiguration(internalAdmin, ocspConfiguration);
    try {
        // Now, construct an external CA. 
        final String externalCaName = "testStandAloneOcspResponseExternalCa";
        final String externalCaSubjectDn = "CN=" + externalCaName;
        long validity = 3650L;
        KeyPair externalCaKeys = KeyTools.genKeys("512", AlgorithmConstants.KEYALGORITHM_RSA);
        Certificate externalCaCertificate = CertTools.genSelfCert(externalCaSubjectDn, validity, null,
                externalCaKeys.getPrivate(), externalCaKeys.getPublic(),
                AlgorithmConstants.SIGALG_SHA1_WITH_RSA, true);
        X509CAInfo externalCaInfo = new X509CAInfo(externalCaSubjectDn, externalCaName, CAConstants.CA_EXTERNAL,
                CertificateProfileConstants.CERTPROFILE_NO_PROFILE, validity, CAInfo.SELFSIGNED, null, null);
        CAToken token = new CAToken(externalCaInfo.getCAId(), new NullCryptoToken().getProperties());
        X509CA externalCa = new X509CA(externalCaInfo);
        externalCa.setCAToken(token);
        externalCa.setCertificateChain(Arrays.asList(externalCaCertificate));
        caSession.addCA(internalAdmin, externalCa);
        certificateStoreSession.storeCertificate(internalAdmin, externalCaCertificate, externalCaName, "1234",
                CertificateConstants.CERT_ACTIVE, CertificateConstants.CERTTYPE_ROOTCA,
                CertificateProfileConstants.CERTPROFILE_NO_PROFILE, null, new Date().getTime());
        ocspResponseGeneratorSession.reloadOcspSigningCache();
        try {
            final String externalUsername = "testStandAloneOcspResponseExternalUser";
            final String externalSubjectDn = "CN=" + externalUsername;
            // Create a certificate signed by the external CA and stuff it in the database (we can pretend it was imported)
            Date firstDate = new Date();
            firstDate.setTime(firstDate.getTime() - (10 * 60 * 1000));
            Date lastDate = new Date();
            lastDate.setTime(lastDate.getTime() + (24 * 60 * 60 * 1000));
            byte[] serno = new byte[8];
            SecureRandom random = SecureRandom.getInstance("SHA1PRNG");
            random.setSeed(new Date().getTime());
            random.nextBytes(serno);
            KeyPair certificateKeyPair = KeyTools.genKeys("1024", "RSA");
            final SubjectPublicKeyInfo pkinfo = new SubjectPublicKeyInfo(
                    (ASN1Sequence) ASN1Primitive.fromByteArray(certificateKeyPair.getPublic().getEncoded()));
            X509v3CertificateBuilder certbuilder = new X509v3CertificateBuilder(
                    CertTools.stringToBcX500Name(externalCaSubjectDn, false), new BigInteger(serno).abs(),
                    firstDate, lastDate, CertTools.stringToBcX500Name(externalSubjectDn, false), pkinfo);
            final ContentSigner signer = new BufferingContentSigner(new JcaContentSignerBuilder("SHA256WithRSA")
                    .setProvider(BouncyCastleProvider.PROVIDER_NAME).build(externalCaKeys.getPrivate()), 20480);
            final X509CertificateHolder certHolder = certbuilder.build(signer);
            X509Certificate importedCertificate = (X509Certificate) CertTools
                    .getCertfromByteArray(certHolder.getEncoded());
            certificateStoreSession.storeCertificate(internalAdmin, importedCertificate, externalUsername,
                    "1234", CertificateConstants.CERT_ACTIVE, CertificateConstants.CERTTYPE_ENDENTITY,
                    CertificateProfileConstants.CERTPROFILE_FIXED_ENDUSER, null, new Date().getTime());
            try {
                //Now everything is in place. Perform a request, make sure that the default responder signed it. 
                OCSPReqBuilder gen = new OCSPReqBuilder();
                gen.addRequest(new JcaCertificateID(SHA1DigestCalculator.buildSha1Instance(),
                        (X509Certificate) externalCaCertificate, importedCertificate.getSerialNumber()));
                Extension[] extensions = new Extension[1];
                extensions[0] = new Extension(OCSPObjectIdentifiers.id_pkix_ocsp_nonce, false,
                        new DEROctetString("123456789".getBytes()));
                gen.setRequestExtensions(new Extensions(extensions));
                OCSPReq ocspRequest = gen.build();
                final int localTransactionId = TransactionCounter.INSTANCE.getTransactionNumber();
                // Create the transaction logger for this transaction.
                TransactionLogger transactionLogger = new TransactionLogger(localTransactionId,
                        GuidHolder.INSTANCE.getGlobalUid(), "");
                // Create the audit logger for this transaction.
                AuditLogger auditLogger = new AuditLogger("", localTransactionId,
                        GuidHolder.INSTANCE.getGlobalUid(), "");
                byte[] responseBytes = ocspResponseGeneratorSession.getOcspResponse(ocspRequest.getEncoded(),
                        null, "", "", null, auditLogger, transactionLogger).getOcspResponse();
                assertNotNull("OCSP responder replied null", responseBytes);

                OCSPResp response = new OCSPResp(responseBytes);
                assertEquals("Response status not zero.", OCSPResp.SUCCESSFUL, response.getStatus());
                final BasicOCSPResp basicOcspResponse = (BasicOCSPResp) response.getResponseObject();
                assertNotNull("Signed request generated null-response.", basicOcspResponse);
                assertTrue("OCSP response was not signed correctly.",
                        basicOcspResponse.isSignatureValid(new JcaContentVerifierProviderBuilder()
                                .build(testx509ca.getCACertificate().getPublicKey())));
                final SingleResp[] singleResponses = basicOcspResponse.getResponses();
                assertEquals("Delivered some thing else than one and exactly one response.", 1,
                        singleResponses.length);
                assertEquals("Response cert did not match up with request cert",
                        importedCertificate.getSerialNumber(),
                        singleResponses[0].getCertID().getSerialNumber());
                assertEquals("Status is not null (good)", null, singleResponses[0].getCertStatus());
            } finally {
                internalCertificateStoreSession.removeCertificate(importedCertificate);
            }
        } finally {
            caSession.removeCA(internalAdmin, externalCa.getCAId());
            internalCertificateStoreSession.removeCertificate(externalCaCertificate);
        }
    } finally {
        GlobalOcspConfiguration restoredOcspConfiguration = (GlobalOcspConfiguration) globalConfigurationSession
                .getCachedConfiguration(GlobalOcspConfiguration.OCSP_CONFIGURATION_ID);
        ocspConfiguration.setOcspDefaultResponderReference(originalDefaultResponder);
        globalConfigurationSession.saveConfiguration(internalAdmin, restoredOcspConfiguration);
    }
}

---

From source file:org.cesecore.certificates.ocsp.standalone.StandaloneOcspResponseGeneratorSessionTest.java

License:Open Source License

/** Tests the basic case of a standalone OCSP installation, i.e where this is a classic VA */
@Test//from  w  w w  .ja v  a  2 s. c o m
public void testStandAloneOcspResponseSanity() throws Exception {
    //Now delete the original CA, making this test completely standalone.
    OcspTestUtils.deleteCa(authenticationToken, x509ca);
    activateKeyBinding(internalKeyBindingId);
    ocspResponseGeneratorSession.reloadOcspSigningCache();
    // Do the OCSP request
    final OCSPReq ocspRequest = buildOcspRequest(null, null, caCertificate,
            ocspSigningCertificate.getSerialNumber());
    final OCSPResp response = sendRequest(ocspRequest);
    assertEquals("Response status not zero.", OCSPResp.SUCCESSFUL, response.getStatus());
    validateSuccessfulResponse((BasicOCSPResp) response.getResponseObject(),
            ocspSigningCertificate.getPublicKey());
}

---

From source file:org.cesecore.certificates.ocsp.standalone.StandaloneOcspResponseGeneratorSessionTest.java

License:Open Source License

/** Tests using the default responder for external CAs for a good certificate. */
@Test/* www . j a  v  a  2s  . co  m*/
public void testResponseWithDefaultResponderForExternal() throws Exception {
    // Make sure that a default responder is set
    GlobalOcspConfiguration ocspConfiguration = (GlobalOcspConfiguration) globalConfigurationSession
            .getCachedConfiguration(GlobalOcspConfiguration.OCSP_CONFIGURATION_ID);
    final String originalDefaultResponder = ocspConfiguration.getOcspDefaultResponderReference();
    ocspConfiguration.setOcspDefaultResponderReference(CertTools.getIssuerDN(ocspSigningCertificate));
    globalConfigurationSession.saveConfiguration(authenticationToken, ocspConfiguration);
    try {
        //Make default responder standalone
        OcspTestUtils.deleteCa(authenticationToken, x509ca);
        activateKeyBinding(internalKeyBindingId);
        // Now, construct an external CA. 
        final String externalCaName = "testStandAloneOcspResponseExternalCa";
        final String externalCaSubjectDn = "CN=" + externalCaName;
        long validity = 3650L;
        KeyPair externalCaKeys = KeyTools.genKeys("512", AlgorithmConstants.KEYALGORITHM_RSA);
        Certificate externalCaCertificate = CertTools.genSelfCert(externalCaSubjectDn, validity, null,
                externalCaKeys.getPrivate(), externalCaKeys.getPublic(),
                AlgorithmConstants.SIGALG_SHA1_WITH_RSA, true);
        X509CAInfo externalCaInfo = new X509CAInfo(externalCaSubjectDn, externalCaName, CAConstants.CA_EXTERNAL,
                CertificateProfileConstants.CERTPROFILE_NO_PROFILE, validity, CAInfo.SELFSIGNED, null, null);
        CAToken token = new CAToken(externalCaInfo.getCAId(), new NullCryptoToken().getProperties());
        X509CA externalCa = new X509CA(externalCaInfo);
        externalCa.setCAToken(token);
        externalCa.setCertificateChain(Arrays.asList(externalCaCertificate));
        caSession.addCA(authenticationToken, externalCa);
        certificateStoreSession.storeCertificate(authenticationToken, externalCaCertificate, externalCaName,
                "1234", CertificateConstants.CERT_ACTIVE, CertificateConstants.CERTTYPE_ROOTCA,
                CertificateProfileConstants.CERTPROFILE_NO_PROFILE, null, new Date().getTime());
        ocspResponseGeneratorSession.reloadOcspSigningCache();
        try {
            final String externalUsername = "testStandAloneOcspResponseExternalUser";
            final String externalSubjectDn = "CN=" + externalUsername;
            // Create a certificate signed by the external CA and stuff it in the database (we can pretend it was imported)
            Date firstDate = new Date();
            firstDate.setTime(firstDate.getTime() - (10 * 60 * 1000));
            Date lastDate = new Date();
            lastDate.setTime(lastDate.getTime() + (24 * 60 * 60 * 1000));
            byte[] serno = new byte[8];
            SecureRandom random = SecureRandom.getInstance("SHA1PRNG");
            random.setSeed(new Date().getTime());
            random.nextBytes(serno);
            KeyPair certificateKeyPair = KeyTools.genKeys("1024", "RSA");
            final SubjectPublicKeyInfo pkinfo = new SubjectPublicKeyInfo(
                    (ASN1Sequence) ASN1Primitive.fromByteArray(certificateKeyPair.getPublic().getEncoded()));
            X509v3CertificateBuilder certbuilder = new X509v3CertificateBuilder(
                    CertTools.stringToBcX500Name(externalCaSubjectDn, false), new BigInteger(serno).abs(),
                    firstDate, lastDate, CertTools.stringToBcX500Name(externalSubjectDn, false), pkinfo);
            final ContentSigner signer = new BufferingContentSigner(new JcaContentSignerBuilder("SHA256WithRSA")
                    .setProvider(BouncyCastleProvider.PROVIDER_NAME).build(externalCaKeys.getPrivate()), 20480);
            final X509CertificateHolder certHolder = certbuilder.build(signer);
            X509Certificate importedCertificate = (X509Certificate) CertTools
                    .getCertfromByteArray(certHolder.getEncoded());
            certificateStoreSession.storeCertificate(authenticationToken, importedCertificate, externalUsername,
                    "1234", CertificateConstants.CERT_ACTIVE, CertificateConstants.CERTTYPE_ENDENTITY,
                    CertificateProfileConstants.CERTPROFILE_FIXED_ENDUSER, null, new Date().getTime());
            try {
                //Now everything is in place. Perform a request, make sure that the default responder signed it. 
                final OCSPReq ocspRequest = buildOcspRequest(null, null,
                        (X509Certificate) externalCaCertificate, importedCertificate.getSerialNumber());
                final OCSPResp response = sendRequest(ocspRequest);
                assertEquals("Response status not zero.", OCSPResp.SUCCESSFUL, response.getStatus());
                final BasicOCSPResp basicOcspResponse = (BasicOCSPResp) response.getResponseObject();
                assertNotNull("Signed request generated null-response.", basicOcspResponse);
                assertTrue("OCSP response was not signed correctly.", basicOcspResponse.isSignatureValid(
                        new JcaContentVerifierProviderBuilder().build(ocspSigningCertificate.getPublicKey())));
                final SingleResp[] singleResponses = basicOcspResponse.getResponses();
                assertEquals("Delivered some thing else than one and exactly one response.", 1,
                        singleResponses.length);
                assertEquals("Response cert did not match up with request cert",
                        importedCertificate.getSerialNumber(),
                        singleResponses[0].getCertID().getSerialNumber());
                assertEquals("Status is not null (good)", null, singleResponses[0].getCertStatus());
            } finally {
                internalCertificateStoreSession.removeCertificate(importedCertificate);
            }
        } finally {
            caSession.removeCA(authenticationToken, externalCa.getCAId());
            internalCertificateStoreSession.removeCertificate(externalCaCertificate);
        }
    } finally {
        GlobalOcspConfiguration restoredOcspConfiguration = (GlobalOcspConfiguration) globalConfigurationSession
                .getCachedConfiguration(GlobalOcspConfiguration.OCSP_CONFIGURATION_ID);
        ocspConfiguration.setOcspDefaultResponderReference(originalDefaultResponder);
        globalConfigurationSession.saveConfiguration(authenticationToken, restoredOcspConfiguration);
    }
}

---

From source file:org.cesecore.certificates.ocsp.standalone.StandaloneOcspResponseGeneratorSessionTest.java

License:Open Source License

/** Tests using the default responder for external CAs, tests with a revoked cert */
@Test/* w  w w  .  j  a  v  a2 s .co  m*/
public void testResponseWithDefaultResponderForExternalRevoked() throws Exception {
    // Make sure that a default responder is set
    GlobalOcspConfiguration ocspConfiguration = (GlobalOcspConfiguration) globalConfigurationSession
            .getCachedConfiguration(GlobalOcspConfiguration.OCSP_CONFIGURATION_ID);
    ocspConfiguration.setOcspDefaultResponderReference(CertTools.getIssuerDN(ocspSigningCertificate));
    globalConfigurationSession.saveConfiguration(authenticationToken, ocspConfiguration);
    String originalNoneExistingIsGood = cesecoreConfigurationProxySession
            .getConfigurationValue(OcspConfiguration.NONE_EXISTING_IS_GOOD);
    cesecoreConfigurationProxySession.setConfigurationValue(OcspConfiguration.NONE_EXISTING_IS_GOOD, "false");
    try {
        //Make default responder standalone
        OcspTestUtils.deleteCa(authenticationToken, x509ca);
        activateKeyBinding(internalKeyBindingId);
        // Now, construct an external CA. 
        final String externalCaName = "testStandAloneOcspResponseExternalCa";
        final String externalCaSubjectDn = "CN=" + externalCaName;
        long validity = 3650L;
        KeyPair externalCaKeys = KeyTools.genKeys("512", AlgorithmConstants.KEYALGORITHM_RSA);
        Certificate externalCaCertificate = CertTools.genSelfCert(externalCaSubjectDn, validity, null,
                externalCaKeys.getPrivate(), externalCaKeys.getPublic(),
                AlgorithmConstants.SIGALG_SHA1_WITH_RSA, true);
        X509CAInfo externalCaInfo = new X509CAInfo(externalCaSubjectDn, externalCaName, CAConstants.CA_EXTERNAL,
                CertificateProfileConstants.CERTPROFILE_NO_PROFILE, validity, CAInfo.SELFSIGNED, null, null);
        CAToken token = new CAToken(externalCaInfo.getCAId(), new NullCryptoToken().getProperties());
        X509CA externalCa = new X509CA(externalCaInfo);
        externalCa.setCAToken(token);
        externalCa.setCertificateChain(Arrays.asList(externalCaCertificate));
        caSession.addCA(authenticationToken, externalCa);
        certificateStoreSession.storeCertificate(authenticationToken, externalCaCertificate, externalCaName,
                "1234", CertificateConstants.CERT_ACTIVE, CertificateConstants.CERTTYPE_ROOTCA,
                CertificateProfileConstants.CERTPROFILE_NO_PROFILE, null, new Date().getTime());
        ocspResponseGeneratorSession.reloadOcspSigningCache();
        try {
            final String externalUsername = "testStandAloneOcspResponseExternalUser";
            final String externalSubjectDn = "CN=" + externalUsername;
            // Create a certificate signed by the external CA and stuff it in the database (we can pretend it was imported)
            Date firstDate = new Date();
            firstDate.setTime(firstDate.getTime() - (10 * 60 * 1000));
            Date lastDate = new Date();
            lastDate.setTime(lastDate.getTime() + (24 * 60 * 60 * 1000));
            byte[] serno = new byte[8];
            SecureRandom random = SecureRandom.getInstance("SHA1PRNG");
            random.setSeed(new Date().getTime());
            random.nextBytes(serno);
            KeyPair certificateKeyPair = KeyTools.genKeys("1024", "RSA");
            final SubjectPublicKeyInfo pkinfo = new SubjectPublicKeyInfo(
                    (ASN1Sequence) ASN1Primitive.fromByteArray(certificateKeyPair.getPublic().getEncoded()));
            X509v3CertificateBuilder certbuilder = new X509v3CertificateBuilder(
                    CertTools.stringToBcX500Name(externalCaSubjectDn, false), new BigInteger(serno).abs(),
                    firstDate, lastDate, CertTools.stringToBcX500Name(externalSubjectDn, false), pkinfo);
            final ContentSigner signer = new BufferingContentSigner(new JcaContentSignerBuilder("SHA256WithRSA")
                    .setProvider(BouncyCastleProvider.PROVIDER_NAME).build(externalCaKeys.getPrivate()), 20480);
            final X509CertificateHolder certHolder = certbuilder.build(signer);
            X509Certificate importedCertificate = (X509Certificate) CertTools
                    .getCertfromByteArray(certHolder.getEncoded());
            certificateStoreSession.storeCertificate(authenticationToken, importedCertificate, externalUsername,
                    "1234", CertificateConstants.CERT_REVOKED, CertificateConstants.CERTTYPE_ENDENTITY,
                    CertificateProfileConstants.CERTPROFILE_FIXED_ENDUSER, null, new Date().getTime());
            try {
                //Now everything is in place. Perform a request, make sure that the default responder signed it. 
                final OCSPReq ocspRequest = buildOcspRequest(null, null,
                        (X509Certificate) externalCaCertificate, importedCertificate.getSerialNumber());
                final OCSPResp response = sendRequest(ocspRequest);
                assertEquals("Response status not zero.", OCSPResp.SUCCESSFUL, response.getStatus());
                final BasicOCSPResp basicOcspResponse = (BasicOCSPResp) response.getResponseObject();
                assertNotNull("Signed request generated null-response.", basicOcspResponse);
                assertTrue("OCSP response was not signed correctly.", basicOcspResponse.isSignatureValid(
                        new JcaContentVerifierProviderBuilder().build(ocspSigningCertificate.getPublicKey())));
                final SingleResp[] singleResponses = basicOcspResponse.getResponses();
                assertEquals("Delivered some thing else than one and exactly one response.", 1,
                        singleResponses.length);
                assertEquals("Response cert did not match up with request cert",
                        importedCertificate.getSerialNumber(),
                        singleResponses[0].getCertID().getSerialNumber());
                assertTrue("Status is not revoked",
                        singleResponses[0].getCertStatus() instanceof RevokedStatus);
            } finally {
                internalCertificateStoreSession.removeCertificate(importedCertificate);
            }
        } finally {
            caSession.removeCA(authenticationToken, externalCa.getCAId());
            internalCertificateStoreSession.removeCertificate(externalCaCertificate);
        }
    } finally {
        cesecoreConfigurationProxySession.setConfigurationValue(OcspConfiguration.NONE_EXISTING_IS_GOOD,
                originalNoneExistingIsGood);
    }
}

---

From source file:org.cesecore.certificates.ocsp.standalone.StandaloneOcspResponseGeneratorSessionTest.java

License:Open Source License

/**
 * This tests the use case where a key binding has been added but the cache hasn't been updated yet, due to long update times.
 * OcspResponseGeneratorSession should handle this without problems. 
 *//*from  w  ww  . java 2  s .c o m*/
@Test
public void testCacheMissHandling() throws Exception {
    //Now delete the original CA, making this test completely standalone.
    OcspTestUtils.deleteCa(authenticationToken, x509ca);
    ocspResponseGeneratorSession.reloadOcspSigningCache();
    activateKeyBinding(internalKeyBindingId);
    final OCSPReq ocspRequest = buildOcspRequest(null, null, caCertificate,
            ocspSigningCertificate.getSerialNumber());
    final OCSPResp response = sendRequest(ocspRequest);
    assertEquals("Response status not zero.", OCSPResp.SUCCESSFUL, response.getStatus());
    validateSuccessfulResponse((BasicOCSPResp) response.getResponseObject(),
            ocspSigningCertificate.getPublicKey());
}

---

From source file:org.cesecore.certificates.ocsp.standalone.StandaloneOcspResponseGeneratorSessionTest.java

License:Open Source License

/** Tests asking about an unknown CA, and making sure that the response is correctly signed */
@Test/*from  ww  w  . ja  v a 2  s.co m*/
public void testStandAloneOcspResponseDefaultResponder() throws Exception {
    // Make sure that a default responder is set
    GlobalOcspConfiguration ocspConfiguration = (GlobalOcspConfiguration) globalConfigurationSession
            .getCachedConfiguration(GlobalOcspConfiguration.OCSP_CONFIGURATION_ID);
    ocspConfiguration.setOcspDefaultResponderReference(CertTools.getIssuerDN(ocspSigningCertificate));
    globalConfigurationSession.saveConfiguration(authenticationToken, ocspConfiguration);
    cesecoreConfigurationProxySession.setConfigurationValue("ocsp.nonexistingisgood", "false");
    try {
        //Now delete the original CA, making this test completely standalone.
        OcspTestUtils.deleteCa(authenticationToken, x509ca);
        activateKeyBinding(internalKeyBindingId);
        ocspResponseGeneratorSession.reloadOcspSigningCache();
        // Do the OCSP request
        final KeyPair keys = KeyTools.genKeys("512", AlgorithmConstants.KEYALGORITHM_RSA);
        final X509Certificate fakeIssuerCertificate = CertTools.genSelfCert("CN=fakeCA", 365, null,
                keys.getPrivate(), keys.getPublic(), AlgorithmConstants.SIGALG_SHA1_WITH_RSA, true);
        final BigInteger fakeSerialNumber = new BigInteger("4711");
        final OCSPReq ocspRequest = buildOcspRequest(null, null, fakeIssuerCertificate, fakeSerialNumber);
        final OCSPResp response = sendRequest(ocspRequest);
        assertEquals("Response status not zero.", OCSPResp.SUCCESSFUL, response.getStatus());
        BasicOCSPResp basicOcspResponse = (BasicOCSPResp) response.getResponseObject();
        //Response will be signed with the OCSP signing certificate, because that certificate's issuing CA was given as a default responder.
        assertTrue("OCSP response was not signed correctly.", basicOcspResponse.isSignatureValid(
                new JcaContentVerifierProviderBuilder().build(ocspSigningCertificate.getPublicKey())));
        SingleResp[] singleResponses = basicOcspResponse.getResponses();
        assertEquals("Delivered some thing else than one and exactly one response.", 1, singleResponses.length);
        assertEquals("Response cert did not match up with request cert", fakeSerialNumber,
                singleResponses[0].getCertID().getSerialNumber());
        assertTrue(singleResponses[0].getCertStatus() instanceof UnknownStatus);
    } finally {
        cesecoreConfigurationProxySession.setConfigurationValue("ocsp.nonexistingisgood", "false");
    }
}

---

From source file:org.cesecore.certificates.ocsp.standalone.StandaloneOcspResponseGeneratorSessionTest.java

License:Open Source License

/** Tests the case where there exists both a CA and a key binding for that CA on the same machine. The Key Binding should have priority. */
@Test/*from   ww  w.j a v  a2s.  c o m*/
public void testStandAloneOcspResponseWithBothCaAndInternalKeyBinding() throws Exception {
    //Note: The CA never gets deleted in this test, so there exists both a CA and a key binding at the same time. 
    activateKeyBinding(internalKeyBindingId);
    ocspResponseGeneratorSession.reloadOcspSigningCache();
    // Do the OCSP request
    final OCSPReq ocspRequest = buildOcspRequest(null, null, caCertificate,
            ocspSigningCertificate.getSerialNumber());
    final OCSPResp response = sendRequest(ocspRequest);
    assertEquals("Response status not zero.", OCSPResp.SUCCESSFUL, response.getStatus());
    validateSuccessfulResponse((BasicOCSPResp) response.getResponseObject(),
            ocspSigningCertificate.getPublicKey());
}

---

From source file:org.cesecore.certificates.ocsp.standalone.StandaloneOcspResponseGeneratorSessionTest.java

License:Open Source License

/**
 * Request signature requirement: None.//from  www. ja v  a2 s  . com
 * Request signature:             Present.
 * Expected outcome:              0 (OCSPResp.SUCCESSFUL)
 */
@Test
public void testNoSignatureRequiredButSignaturePresent() throws Exception {
    // Issue a request authentication certificate while we still have the CA
    final String ocspAuthenticationUsername = Thread.currentThread().getStackTrace()[1].getMethodName();
    final KeyPair ocspAuthenticationKeyPair = KeyTools.genKeys("1024", AlgorithmConstants.KEYALGORITHM_RSA);
    final X509Certificate ocspAuthenticationCertificate = issueOcspAuthenticationCertificate(
            ocspAuthenticationUsername, ocspAuthenticationKeyPair.getPublic());
    try {
        //Now delete the original CA, making this test completely standalone.
        OcspTestUtils.deleteCa(authenticationToken, x509ca);
        activateKeyBinding(internalKeyBindingId);
        // Configure the OcspKeyBinding to require a signature (by any certificate)
        final OcspKeyBinding ocspKeyBinding = (OcspKeyBinding) internalKeyBindingMgmtSession
                .getInternalKeyBinding(authenticationToken, internalKeyBindingId);
        ocspKeyBinding.setRequireTrustedSignature(false);
        internalKeyBindingMgmtSession.persistInternalKeyBinding(authenticationToken, ocspKeyBinding);
        ocspResponseGeneratorSession.reloadOcspSigningCache();
        internalCertificateStoreSession.reloadCaCertificateCache();
        // Try to send a signed OCSP requests
        final OCSPReq ocspRequestSigned = buildOcspRequest(ocspAuthenticationCertificate,
                ocspAuthenticationKeyPair.getPrivate(), caCertificate,
                ocspSigningCertificate.getSerialNumber());
        final OCSPResp ocspResponseSigned = sendRequest(ocspRequestSigned);
        assertEquals("We expected a 'Successful' status code: ", OCSPResp.SUCCESSFUL,
                ocspResponseSigned.getStatus());
        validateSuccessfulResponse((BasicOCSPResp) ocspResponseSigned.getResponseObject(),
                ocspSigningCertificate.getPublicKey());
    } finally {
        internalCertificateStoreSession.removeCertificate(ocspAuthenticationCertificate);
    }
}

---

• «
• 1
• 2
• »