Example usage for org.bouncycastle.cert X509CertificateHolder getExtension

List of usage examples for org.bouncycastle.cert X509CertificateHolder getExtension

  1. HOME
  2. Java
  3. org.bouncycastle
  4. org.bouncycastle.cert.*
  5. X509CertificateHolder
  6. getExtension

Introduction

In this page you can find the example usage for org.bouncycastle.cert X509CertificateHolder getExtension.

Prototype

public Extension getExtension(ASN1ObjectIdentifier oid)

Source Link

Document

Look up the extension associated with the passed in OID.

Usage

From source file:co.runrightfast.core.security.cert.impl.CertificateServiceImplTest.java

License:Apache License

private void checkAuthorityKeyIdentifierExtenstion(final X509Certificate cert, final CaCert caCert)
        throws CertificateEncodingException, IOException {
    final JcaX509ExtensionUtils extUtils = jcaX509ExtensionUtils();
    final byte[] extValue = cert.getExtensionValue(OID.AUTHORITY_KEY_IDENIFIER.oid.getId());
    assertThat(extValue, is(notNullValue()));
    final byte[] expectedExtValue = X509CertExtension.builder().oid(Extension.authorityKeyIdentifier)
            .value(extUtils.createAuthorityKeyIdentifier(caCert.getCert())).critical(false).build()
            .toExtension().getExtnValue().getEncoded(DER.name());
    assertThat(Arrays.areEqual(extValue, expectedExtValue), is(true));

    final X509CertificateHolder certHolder = new JcaX509CertificateHolder(cert);
    final Extension ext = certHolder.getExtensions().getExtension(OID.AUTHORITY_KEY_IDENIFIER.oid);
    assertThat(ext, is(notNullValue()));
    assertThat(Arrays.areEqual(ext.getExtnValue().getEncoded(DER.name()), expectedExtValue), is(true));
}

From source file:co.runrightfast.core.security.cert.impl.CertificateServiceImplTest.java

License:Apache License

private void checkSubjectKeyIdentifierExtenstion(final X509Certificate cert)
        throws CertificateEncodingException, IOException {
    final JcaX509ExtensionUtils extUtils = jcaX509ExtensionUtils();
    final byte[] extValue = cert.getExtensionValue(OID.SUBJECT_KEY_IDENIFIER.oid.getId());
    assertThat(extValue, is(notNullValue()));
    final byte[] expectedExtValue = X509CertExtension.builder().oid(Extension.subjectKeyIdentifier)
            .value(extUtils.createSubjectKeyIdentifier(cert.getPublicKey())).critical(false).build()
            .toExtension().getExtnValue().getEncoded(DER.name());
    assertThat(Arrays.areEqual(extValue, expectedExtValue), is(true));

    final X509CertificateHolder certHolder = new JcaX509CertificateHolder(cert);
    final Extension ext = certHolder.getExtensions().getExtension(OID.SUBJECT_KEY_IDENIFIER.oid);
    assertThat(ext, is(notNullValue()));
    assertThat(Arrays.areEqual(ext.getExtnValue().getEncoded(DER.name()), expectedExtValue), is(true));
}

From source file:com.vvote.thirdparty.ximix.util.BLSKeyStore.java

License:Apache License

/**
 * Load the key store object from the passed in PKCS#12 encoding, using the passed in password.
 *
 * @param password the password to unlock the key store.
 * @param encoding the ASN.1 encoded bytes representing the PKCS#12 store.
 * @throws IOException on a parsing error.
 * @throws GeneralSecurityException if there's an exception decrypting the store.
 *//* w  w w  .  jav  a2 s. c o m*/
public synchronized void load(char[] password, byte[] encoding) throws IOException, GeneralSecurityException {
    try {
        PKCS12PfxPdu pfx = new PKCS12PfxPdu(encoding);
        InputDecryptorProvider inputDecryptorProvider = new JcePKCSPBEInputDecryptorProviderBuilder()
                .setProvider("BC").build(password);
        ContentInfo[] infos = pfx.getContentInfos();

        for (int i = 0; i != infos.length; i++) {
            if (infos[i].getContentType().equals(PKCSObjectIdentifiers.encryptedData)) {
                PKCS12SafeBagFactory dataFact = new PKCS12SafeBagFactory(infos[i], inputDecryptorProvider);

                PKCS12SafeBag[] bags = dataFact.getSafeBags();

                Attribute[] attributes = bags[0].getAttributes();

                X509CertificateHolder cert = (X509CertificateHolder) bags[0].getBagValue();

                String keyID = getKeyID(attributes);
                BLS01PublicKeyParameters publicKeyParameters = BLSPublicKeyFactory
                        .createKey(cert.getSubjectPublicKeyInfo());

                paramsMap.put(keyID, publicKeyParameters.getParameters());
                sequenceNoMap.put(keyID, ASN1Integer.getInstance(
                        cert.getExtension(XimixObjectIdentifiers.ximixShareIdExtension).getParsedValue())
                        .getValue().intValue());
                sharedPublicKeyMap.put(keyID, publicKeyParameters.getPk());

                if (KeyUsage.fromExtensions(cert.getExtensions()).hasUsages(KeyUsage.digitalSignature)) {
                    signingKeys.add(keyID);
                }
            } else {
                PKCS12SafeBagFactory dataFact = new PKCS12SafeBagFactory(infos[i]);

                PKCS12SafeBag[] bags = dataFact.getSafeBags();
                String keyID = getKeyID(bags[0].getAttributes());

                PKCS8EncryptedPrivateKeyInfo encInfo = (PKCS8EncryptedPrivateKeyInfo) bags[0].getBagValue();
                PrivateKeyInfo info = encInfo.decryptPrivateKeyInfo(inputDecryptorProvider);

                sharedPrivateKeyMap.put(keyID, ASN1Integer.getInstance(info.parsePrivateKey()).getValue());
            }
        }
    } catch (PKCSException e) {
        throw new GeneralSecurityException("Unable to load key store: " + e.getMessage(), e);
    }
}

From source file:esteidhacker.FakeEstEIDCA.java

License:Open Source License

private X509Certificate makeRootCert(KeyPair kp)
        throws InvalidKeyException, IllegalStateException, NoSuchProviderException, SignatureException,
        IOException, NoSuchAlgorithmException, ParseException, OperatorCreationException, CertificateException {

    // Load real root certificate
    X509CertificateHolder real = getRealCert("/resources/sk-root.pem");
    // Use values from real certificate
    // TODO/FIXME: GeneralizedTime instead of UTCTime for root
    JcaX509v3CertificateBuilder builder = new JcaX509v3CertificateBuilder(real.getIssuer(),
            real.getSerialNumber(), real.getNotBefore(), real.getNotAfter(), real.getSubject(), kp.getPublic());

    @SuppressWarnings("unchecked")
    List<ASN1ObjectIdentifier> list = real.getExtensionOIDs();

    // Copy all extensions verbatim
    for (ASN1ObjectIdentifier extoid : list) {
        Extension ext = real.getExtension(extoid);
        builder.copyAndAddExtension(ext.getExtnId(), ext.isCritical(), real);
    }/*from ww  w . j  ava2 s  . c om*/

    // Generate cert
    ContentSigner sigGen = new JcaContentSignerBuilder("SHA1withRSA")
            .setProvider(BouncyCastleProvider.PROVIDER_NAME).build(kp.getPrivate());

    X509CertificateHolder cert = builder.build(sigGen);
    return new JcaX509CertificateConverter().setProvider(BouncyCastleProvider.PROVIDER_NAME)
            .getCertificate(cert);

}

From source file:esteidhacker.FakeEstEIDCA.java

License:Open Source License

private X509Certificate makeEsteidCert(KeyPair esteid, KeyPair root)
        throws InvalidKeyException, IllegalStateException, NoSuchProviderException, SignatureException,
        IOException, NoSuchAlgorithmException, ParseException, OperatorCreationException, CertificateException {

    // Load current root certificate
    X509CertificateHolder real = getRealCert("/resources/sk-esteid.pem");

    JcaX509v3CertificateBuilder builder = new JcaX509v3CertificateBuilder(real.getIssuer(),
            real.getSerialNumber(), real.getNotBefore(), real.getNotAfter(), real.getSubject(),
            esteid.getPublic());/*from  ww w. j ava 2 s  . c  om*/

    // Basic constraints
    @SuppressWarnings("unchecked")
    List<ASN1ObjectIdentifier> list = real.getExtensionOIDs();

    // Copy all extensions
    for (ASN1ObjectIdentifier extoid : list) {
        Extension ext = real.getExtension(extoid);
        builder.copyAndAddExtension(ext.getExtnId(), ext.isCritical(), real);
    }

    // Generate cert
    ContentSigner sigGen = new JcaContentSignerBuilder("SHA1withRSA")
            .setProvider(BouncyCastleProvider.PROVIDER_NAME).build(root.getPrivate());

    X509CertificateHolder cert = builder.build(sigGen);
    return new JcaX509CertificateConverter().setProvider(BouncyCastleProvider.PROVIDER_NAME)
            .getCertificate(cert);

}

From source file:esteidhacker.FakeEstEIDCA.java

License:Open Source License

public X509Certificate cloneUserCertificate(RSAPublicKey pubkey, X509Certificate cert)
        throws OperatorCreationException, CertificateException, IOException {
    X509CertificateHolder holder = new X509CertificateHolder(cert.getEncoded());
    // Clone everything
    JcaX509v3CertificateBuilder builder = new JcaX509v3CertificateBuilder(holder.getIssuer(),
            cert.getSerialNumber(), cert.getNotBefore(), cert.getNotAfter(), holder.getSubject(), pubkey);
    @SuppressWarnings("unchecked")
    List<ASN1ObjectIdentifier> list = holder.getExtensionOIDs();

    // Copy all extensions
    for (ASN1ObjectIdentifier extoid : list) {
        Extension ext = holder.getExtension(extoid);
        builder.copyAndAddExtension(ext.getExtnId(), ext.isCritical(), holder);
    }/*  w w w . j  ava  2s  .c  o m*/
    // Generate cert
    ContentSigner sigGen = new JcaContentSignerBuilder("SHA1withRSA")
            .setProvider(BouncyCastleProvider.PROVIDER_NAME).build(esteidKey);

    X509CertificateHolder newcert = builder.build(sigGen);
    return new JcaX509CertificateConverter().setProvider(BouncyCastleProvider.PROVIDER_NAME)
            .getCertificate(newcert);

}

From source file:esteidhacker.FakeEstEIDCA.java

License:Open Source License

public X509Certificate generateUserCertificate(RSAPublicKey pubkey, boolean signature, String firstname,
        String lastname, String idcode, String email)
        throws InvalidKeyException, ParseException, IOException, IllegalStateException, NoSuchProviderException,
        NoSuchAlgorithmException, SignatureException, CertificateException, OperatorCreationException {
    Date startDate = new SimpleDateFormat("yyyy-MM-dd", Locale.ENGLISH).parse("2015-01-01");
    Date endDate = new SimpleDateFormat("yyyy-MM-dd", Locale.ENGLISH).parse("2015-12-31");

    String template = "C=EE,O=ESTEID,OU=%s,CN=%s\\,%s\\,%s,SURNAME=%s,GIVENNAME=%s,SERIALNUMBER=%s";
    // Normalize.
    lastname = lastname.toUpperCase();/* w ww .j  a  v  a2  s .  c o  m*/
    firstname = firstname.toUpperCase();
    idcode = idcode.toUpperCase();
    email = email.toLowerCase();
    String subject = String.format(template, (signature ? "digital signature" : "authentication"), lastname,
            firstname, idcode, lastname, firstname, idcode);

    byte[] serialBytes = new byte[16];
    SecureRandom rnd = SecureRandom.getInstance("SHA1PRNG");
    rnd.nextBytes(serialBytes);
    serialBytes[0] &= 0x7F; // Can't be negative
    BigInteger serial = new BigInteger(serialBytes);

    X509CertificateHolder real;
    if (signature) {
        real = getRealCert("/resources/sk-sign.pem");
    } else {
        real = getRealCert("/resources/sk-auth.pem");
    }
    serial = real.getSerialNumber();
    System.out.println("Generating from subject: " + real.getSubject());
    System.out.println("Generating subject: " + new X500Name(subject).toString());

    JcaX509v3CertificateBuilder builder = new JcaX509v3CertificateBuilder(real.getIssuer(), serial, startDate,
            endDate, new X500Name(subject), pubkey);

    @SuppressWarnings("unchecked")
    List<ASN1ObjectIdentifier> list = real.getExtensionOIDs();

    // Copy all extensions, except altName
    for (ASN1ObjectIdentifier extoid : list) {
        Extension ext = real.getExtension(extoid);
        if (ext.getExtnId().equals(Extension.subjectAlternativeName)) {
            // altName must be changed
            builder.addExtension(ext.getExtnId(), ext.isCritical(),
                    new GeneralNames(new GeneralName(GeneralName.rfc822Name, email)));
        } else {
            builder.copyAndAddExtension(ext.getExtnId(), ext.isCritical(), real);
        }
    }

    // Generate cert
    ContentSigner sigGen = new JcaContentSignerBuilder("SHA1withRSA")
            .setProvider(BouncyCastleProvider.PROVIDER_NAME).build(esteidKey);

    X509CertificateHolder cert = builder.build(sigGen);
    return new JcaX509CertificateConverter().setProvider(BouncyCastleProvider.PROVIDER_NAME)
            .getCertificate(cert);
}

From source file:org.apache.jmeter.assertions.SMIMEAssertion.java

License:Apache License

/**
 * Extract email addresses from a certificate
 * //from   w ww .jav a  2s .c o  m
 * @param cert the X509 certificate holder
 * @return a List of all email addresses found
 * @throws CertificateException
 */
private static List<String> getEmailFromCert(X509CertificateHolder cert) throws CertificateException {
    List<String> res = new ArrayList<>();

    X500Name subject = cert.getSubject();
    for (RDN emails : subject.getRDNs(BCStyle.EmailAddress)) {
        for (AttributeTypeAndValue emailAttr : emails.getTypesAndValues()) {
            log.debug("Add email from RDN: " + IETFUtils.valueToString(emailAttr.getValue()));
            res.add(IETFUtils.valueToString(emailAttr.getValue()));
        }
    }

    Extension subjectAlternativeNames = cert.getExtension(Extension.subjectAlternativeName);
    if (subjectAlternativeNames != null) {
        for (GeneralName name : GeneralNames.getInstance(subjectAlternativeNames.getParsedValue()).getNames()) {
            if (name.getTagNo() == GeneralName.rfc822Name) {
                String email = IETFUtils.valueToString(name.getName());
                log.debug("Add email from subjectAlternativeName: " + email);
                res.add(email);
            }
        }
    }

    return res;
}

From source file:org.codice.ddf.security.certificate.generator.CertificateCommandTest.java

License:Open Source License

private static void validateSans(KeyStoreFile ksf, String alias, boolean withAdditionalSans) throws Exception {
    final KeyStore.Entry ke = ksf.getEntry(alias);
    assertThat(ke, instanceOf(KeyStore.PrivateKeyEntry.class));

    final KeyStore.PrivateKeyEntry pke = (KeyStore.PrivateKeyEntry) ke;
    final Certificate c = pke.getCertificate();
    final X509CertificateHolder holder = new X509CertificateHolder(c.getEncoded());
    final Extension csn = holder.getExtension(Extension.subjectAlternativeName);

    assertThat(csn.getParsedValue().toASN1Primitive().getEncoded(ASN1Encoding.DER),
            equalTo(expectedSanGeneralName(alias, withAdditionalSans)));
}

From source file:org.codice.ddf.security.certificate.generator.CertificateSigningRequestTest.java

License:Open Source License

@Test
public void testNewCertificateBuilderWithoutSan() throws Exception {
    final DateTime start = DateTime.now().minusDays(1);
    final DateTime end = start.plusYears(100);
    final KeyPair kp = makeKeyPair();

    csr.setSerialNumber(1);/*from  w  w w.  jav a  2 s  .c  o  m*/
    csr.setNotBefore(start);
    csr.setNotAfter(end);
    csr.setCommonName("A");
    csr.setSubjectKeyPair(kp);
    final X509Certificate issuerCert = mock(X509Certificate.class);

    doReturn(new X500Principal("CN=Duke, OU=JavaSoft, O=Sun Microsystems, C=US")).when(issuerCert)
            .getSubjectX500Principal();
    final JcaX509v3CertificateBuilder builder = csr.newCertificateBuilder(issuerCert);
    final X509CertificateHolder holder = builder.build(new DemoCertificateAuthority().getContentSigner());

    assertThat(holder.getSerialNumber(), equalTo(BigInteger.ONE));
    assertThat(holder.getNotBefore(), equalTo(new Time(start.toDate()).getDate()));
    assertThat(holder.getNotAfter(), equalTo(new Time(end.toDate()).getDate()));
    assertThat(holder.getSubject().toString(), equalTo("cn=A"));
    assertThat("Unable to validate public key", holder.getSubjectPublicKeyInfo(),
            equalTo(SubjectPublicKeyInfo.getInstance(kp.getPublic().getEncoded())));
    assertThat("There should be no subject alternative name extension",
            holder.getExtension(org.bouncycastle.asn1.x509.Extension.subjectAlternativeName),
            nullValue(org.bouncycastle.asn1.x509.Extension.class));
}