Example usage for org.bouncycastle.cert X509v2CRLBuilder build

Introduction

In this page you can find the example usage for org.bouncycastle.cert X509v2CRLBuilder build.

Prototype

public X509CRLHolder build(ContentSigner signer) 

Source Link

Document

Generate an X.509 CRL, based on the current issuer and subject using the passed in signer.

Usage

From source file:be.fedict.trust.test.PKITestUtils.java

License:Open Source License

public static X509CRL generateCrl(PrivateKey issuerPrivateKey, X509Certificate issuerCertificate,
        DateTime thisUpdate, DateTime nextUpdate, List<String> deltaCrlUris, boolean deltaCrl,
        List<RevokedCertificate> revokedCertificates, String signatureAlgorithm,
        long numberOfRevokedCertificates)
        throws InvalidKeyException, CRLException, IllegalStateException, NoSuchAlgorithmException,
        SignatureException, CertificateException, IOException, OperatorCreationException {

    X500Name issuerName = new X500Name(issuerCertificate.getSubjectX500Principal().toString());
    X509v2CRLBuilder x509v2crlBuilder = new X509v2CRLBuilder(issuerName, thisUpdate.toDate());
    x509v2crlBuilder.setNextUpdate(nextUpdate.toDate());

    for (RevokedCertificate revokedCertificate : revokedCertificates) {
        x509v2crlBuilder.addCRLEntry(revokedCertificate.serialNumber,
                revokedCertificate.revocationDate.toDate(), CRLReason.privilegeWithdrawn);
    }//  w  w w . j ava 2 s . co m
    if (-1 != numberOfRevokedCertificates) {
        SecureRandom secureRandom = new SecureRandom();
        while (numberOfRevokedCertificates-- > 0) {
            BigInteger serialNumber = new BigInteger(128, secureRandom);
            Date revocationDate = new Date();
            x509v2crlBuilder.addCRLEntry(serialNumber, revocationDate, CRLReason.privilegeWithdrawn);
        }
    }

    JcaX509ExtensionUtils extensionUtils = new JcaX509ExtensionUtils();
    x509v2crlBuilder.addExtension(Extension.authorityKeyIdentifier, false,
            extensionUtils.createAuthorityKeyIdentifier(issuerCertificate));
    x509v2crlBuilder.addExtension(Extension.cRLNumber, false, new CRLNumber(BigInteger.ONE));

    if (null != deltaCrlUris && !deltaCrlUris.isEmpty()) {
        DistributionPoint[] deltaCrlDps = new DistributionPoint[deltaCrlUris.size()];
        for (int i = 0; i < deltaCrlUris.size(); i++) {
            deltaCrlDps[i] = getDistributionPoint(deltaCrlUris.get(i));
        }
        CRLDistPoint crlDistPoint = new CRLDistPoint((DistributionPoint[]) deltaCrlDps);
        x509v2crlBuilder.addExtension(Extension.freshestCRL, false, crlDistPoint);
    }

    if (deltaCrl) {
        x509v2crlBuilder.addExtension(Extension.deltaCRLIndicator, true, new CRLNumber(BigInteger.ONE));
    }

    AlgorithmIdentifier sigAlgId = new DefaultSignatureAlgorithmIdentifierFinder().find(signatureAlgorithm);
    AlgorithmIdentifier digAlgId = new DefaultDigestAlgorithmIdentifierFinder().find(sigAlgId);
    AsymmetricKeyParameter asymmetricKeyParameter = PrivateKeyFactory.createKey(issuerPrivateKey.getEncoded());

    ContentSigner contentSigner = new BcRSAContentSignerBuilder(sigAlgId, digAlgId)
            .build(asymmetricKeyParameter);

    X509CRLHolder x509crlHolder = x509v2crlBuilder.build(contentSigner);
    byte[] crlValue = x509crlHolder.getEncoded();
    CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509");
    X509CRL crl = (X509CRL) certificateFactory.generateCRL(new ByteArrayInputStream(crlValue));
    return crl;
}

---

From source file:com.aqnote.shared.cryptology.cert.main.AQCRLMain.java

License:Open Source License

public static void createCRL() throws CertException {

    try {// w  w w .j  a v  a  2s.  c o m
        X509v2CRLBuilder crlBuilder = new X509v2CRLBuilder(X500NameUtil.createRootCaPrincipal(), new Date());
        crlBuilder.setNextUpdate(new Date(System.currentTimeMillis() + DateConstant.ONE_YEAR));
        X509CRLHolder crlHolder = crlBuilder.build(new JcaContentSignerBuilder(SHA256_RSA)
                .setProvider(JCE_PROVIDER).build(CaCertLoader.getRootCaKeyPair(USER_CERT_PASSWD).getPrivate()));
        X509CRL crl = new JcaX509CRLConverter().setProvider(JCE_PROVIDER).getCRL(crlHolder);
        FileOutputStream fostream = new FileOutputStream(CRL_FILE);
        PKCSWriter.storeCRLFile(crl, fostream);

        ASN1Dump.dumpAsString(crlHolder.toASN1Structure());
    } catch (OperatorCreationException e) {
        throw new CertException(e);
    } catch (IOException e) {
        throw new CertException(e);
    } catch (InvalidKeyException e) {
        throw new CertException(e);
    } catch (CRLException e) {
        throw new CertException(e);
    } catch (NoSuchAlgorithmException e) {
        throw new CertException(e);
    } catch (NoSuchProviderException e) {
        throw new CertException(e);
    } catch (SignatureException e) {
        throw new CertException(e);
    } catch (Exception e) {
        throw new CertException(e);
    }

    return;
}

---

From source file:com.aqnote.shared.encrypt.cert.main.bc.AQCRLCreator.java

License:Open Source License

public static void createNewCRL() throws CertException {

    try {/* www  . j a  va2 s.co m*/
        X509v2CRLBuilder crlBuilder = new X509v2CRLBuilder(X500NameUtil.createRootPrincipal(), new Date());
        crlBuilder.setNextUpdate(new Date(System.currentTimeMillis() + DateConstant.ONE_YEAR));
        X509CRLHolder crlHolder = crlBuilder.build(new JcaContentSignerBuilder(SHA256_RSA)
                .setProvider(JCE_PROVIDER).build(CaCertLoader.getCaKeyPair().getPrivate()));
        X509CRL crl = new JcaX509CRLConverter().setProvider(JCE_PROVIDER).getCRL(crlHolder);
        FileOutputStream fostream = new FileOutputStream(MAD_CRL_FILE);
        PKCSWriter.storeCRLFile(crl, fostream);

        ASN1Dump.dumpAsString(crlHolder.toASN1Structure());
    } catch (OperatorCreationException e) {
        throw new CertException(e);
    } catch (IOException e) {
        throw new CertException(e);
    } catch (InvalidKeyException e) {
        throw new CertException(e);
    } catch (CRLException e) {
        throw new CertException(e);
    } catch (NoSuchAlgorithmException e) {
        throw new CertException(e);
    } catch (NoSuchProviderException e) {
        throw new CertException(e);
    } catch (SignatureException e) {
        throw new CertException(e);
    } catch (Exception e) {
        throw new CertException(e);
    }

    return;
}

---

From source file:com.gitblit.utils.X509Utils.java

License:Apache License

/**
 * Creates a new certificate revocation list (CRL).  This function will
 * destroy any existing CRL file./*from w  w w .  j  av a  2s .com*/
 *
 * @param caRevocationList
 * @param storeFile
 * @param keystorePassword
 * @return
 */
public static void newCertificateRevocationList(File caRevocationList, File caKeystoreFile,
        String caKeystorePassword) {
    try {
        // read the Gitblit CA key and certificate
        KeyStore store = openKeyStore(caKeystoreFile, caKeystorePassword);
        PrivateKey caPrivateKey = (PrivateKey) store.getKey(CA_ALIAS, caKeystorePassword.toCharArray());
        X509Certificate caCert = (X509Certificate) store.getCertificate(CA_ALIAS);

        X500Name issuerDN = new X500Name(PrincipalUtil.getIssuerX509Principal(caCert).getName());
        X509v2CRLBuilder crlBuilder = new X509v2CRLBuilder(issuerDN, new Date());

        // build and sign CRL with CA private key
        ContentSigner signer = new JcaContentSignerBuilder(SIGNING_ALGORITHM).setProvider(BC)
                .build(caPrivateKey);
        X509CRLHolder crl = crlBuilder.build(signer);

        File tmpFile = new File(caRevocationList.getParentFile(),
                Long.toHexString(System.currentTimeMillis()) + ".tmp");
        FileOutputStream fos = null;
        try {
            fos = new FileOutputStream(tmpFile);
            fos.write(crl.getEncoded());
            fos.flush();
            fos.close();
            if (caRevocationList.exists()) {
                caRevocationList.delete();
            }
            tmpFile.renameTo(caRevocationList);
        } finally {
            if (fos != null) {
                fos.close();
            }
            if (tmpFile.exists()) {
                tmpFile.delete();
            }
        }
    } catch (Exception e) {
        throw new RuntimeException("Failed to create new certificate revocation list " + caRevocationList, e);
    }
}

---

From source file:com.gitblit.utils.X509Utils.java

License:Apache License

/**
 * Revoke a certificate./*from www  .j  a v  a  2s. c  o  m*/
 *
 * @param cert
 * @param reason
 * @param caRevocationList
 * @param caPrivateKey
 * @param x509log
 * @return true if the certificate has been revoked
 */
public static boolean revoke(X509Certificate cert, RevocationReason reason, File caRevocationList,
        PrivateKey caPrivateKey, X509Log x509log) {
    try {
        X500Name issuerDN = new X500Name(PrincipalUtil.getIssuerX509Principal(cert).getName());
        X509v2CRLBuilder crlBuilder = new X509v2CRLBuilder(issuerDN, new Date());
        if (caRevocationList.exists()) {
            byte[] data = FileUtils.readContent(caRevocationList);
            X509CRLHolder crl = new X509CRLHolder(data);
            crlBuilder.addCRL(crl);
        }
        crlBuilder.addCRLEntry(cert.getSerialNumber(), new Date(), reason.ordinal());

        // build and sign CRL with CA private key
        ContentSigner signer = new JcaContentSignerBuilder("SHA1WithRSA").setProvider(BC).build(caPrivateKey);
        X509CRLHolder crl = crlBuilder.build(signer);

        File tmpFile = new File(caRevocationList.getParentFile(),
                Long.toHexString(System.currentTimeMillis()) + ".tmp");
        FileOutputStream fos = null;
        try {
            fos = new FileOutputStream(tmpFile);
            fos.write(crl.getEncoded());
            fos.flush();
            fos.close();
            if (caRevocationList.exists()) {
                caRevocationList.delete();
            }
            tmpFile.renameTo(caRevocationList);

        } finally {
            if (fos != null) {
                fos.close();
            }
            if (tmpFile.exists()) {
                tmpFile.delete();
            }
        }

        x509log.log(MessageFormat.format("Revoked certificate {0,number,0} reason: {1} [{2}]",
                cert.getSerialNumber(), reason.toString(), cert.getSubjectDN().getName()));
        return true;
    } catch (IOException | OperatorCreationException | CertificateEncodingException e) {
        logger.error(MessageFormat.format("Failed to revoke certificate {0,number,0} [{1}] in {2}",
                cert.getSerialNumber(), cert.getSubjectDN().getName(), caRevocationList));
    }
    return false;
}

---

From source file:dk.itst.oiosaml.sp.IntegrationTests.java

License:Mozilla Public License

private File generateCRL(X509Certificate cert) throws CRLException, NoSuchAlgorithmException,
        SignatureException, InvalidKeyException, IOException, OperatorCreationException {
    X500Name issuer = new X500Name("CN=ca");
    Date thisUpdate = new Date();
    X509v2CRLBuilder gen = new X509v2CRLBuilder(issuer, thisUpdate);
    gen.setNextUpdate(new Date(System.currentTimeMillis() + 60000));

    if (cert != null) {
        gen.addCRLEntry(cert.getSerialNumber(), new Date(System.currentTimeMillis() - 1000),
                CRLReason.keyCompromise);
    }//from   ww  w. j a  v a2  s.  c  o m

    ContentSigner sigGen = new JcaContentSignerBuilder("SHA1withRSA").setProvider("BC")
            .build(credential.getPrivateKey());
    X509CRLHolder crl = gen.build(sigGen);

    final File crlFile = File.createTempFile("test", "test");
    crlFile.deleteOnExit();
    FileOutputStream fos = new FileOutputStream(crlFile);
    IOUtils.write(crl.getEncoded(), fos);
    fos.close();
    return crlFile;
}

---

From source file:eu.europa.esig.dss.test.gen.CRLGenerator.java

License:Open Source License

public X509CRL generateCRL(X509Certificate certToRevoke, MockPrivateKeyEntry issuerEntry, Date dateOfRevoke,
        int reason) throws Exception {

    Date now = new Date();
    X500Name x500nameIssuer = new JcaX509CertificateHolder(issuerEntry.getCertificate().getCertificate())
            .getSubject();//from   w ww . j ava 2 s .c  o m
    X509v2CRLBuilder crlGen = new X509v2CRLBuilder(x500nameIssuer, now);

    crlGen.setNextUpdate(new Date(now.getTime() + (60 * 60 * 1000)));

    crlGen.addCRLEntry(certToRevoke.getSerialNumber(), dateOfRevoke, reason);

    JcaX509ExtensionUtils extUtils = new JcaX509ExtensionUtils();

    crlGen.addExtension(Extension.authorityKeyIdentifier, false,
            extUtils.createAuthorityKeyIdentifier(issuerEntry.getCertificate().getPublicKey()));

    X509CRLHolder crlHolder = crlGen
            .build(new JcaContentSignerBuilder(issuerEntry.getCertificate().getCertificate().getSigAlgName())
                    .setProvider(BouncyCastleProvider.PROVIDER_NAME).build(issuerEntry.getPrivateKey()));

    JcaX509CRLConverter converter = new JcaX509CRLConverter();
    return converter.getCRL(crlHolder);
}

---

From source file:fathom.x509.X509Utils.java

License:Apache License

/**
 * Creates a new certificate revocation list (CRL).  This function will
 * destroy any existing CRL file.//from   ww  w  .j  a v  a 2 s  .  c om
 *
 * @param caRevocationList
 * @param caKeystoreFile
 * @param caKeystorePassword
 * @return
 */
public static void newCertificateRevocationList(File caRevocationList, File caKeystoreFile,
        String caKeystorePassword) {
    try {
        // read the Fathom CA key and certificate
        KeyStore store = openKeyStore(caKeystoreFile, caKeystorePassword);
        PrivateKey caPrivateKey = (PrivateKey) store.getKey(CA_ALIAS, caKeystorePassword.toCharArray());
        X509Certificate caCert = (X509Certificate) store.getCertificate(CA_ALIAS);

        X500Name issuerDN = new X500Name(PrincipalUtil.getIssuerX509Principal(caCert).getName());
        X509v2CRLBuilder crlBuilder = new X509v2CRLBuilder(issuerDN, new Date());

        // build and sign CRL with CA private key
        ContentSigner signer = new JcaContentSignerBuilder(SIGNING_ALGORITHM).setProvider(BC)
                .build(caPrivateKey);
        X509CRLHolder crl = crlBuilder.build(signer);

        File tmpFile = new File(caRevocationList.getParentFile(),
                Long.toHexString(System.currentTimeMillis()) + ".tmp");
        FileOutputStream fos = null;
        try {
            fos = new FileOutputStream(tmpFile);
            fos.write(crl.getEncoded());
            fos.flush();
            fos.close();
            if (caRevocationList.exists()) {
                caRevocationList.delete();
            }
            tmpFile.renameTo(caRevocationList);
        } finally {
            if (fos != null) {
                fos.close();
            }
            if (tmpFile.exists()) {
                tmpFile.delete();
            }
        }
    } catch (Exception e) {
        throw new RuntimeException("Failed to create new certificate revocation list " + caRevocationList, e);
    }
}

---

From source file:mitm.common.security.crl.X509CRLBuilderImpl.java

License:Open Source License

@Override
public X509CRL generateCRL(KeyAndCertificate issuer) throws CRLException {
    Check.notNull(issuer, "issuer");
    Check.notNull(issuer.getCertificate(), "issuer#certificate");

    Check.notNull(thisUpdate, "thisUpdate");

    try {//from  w  w w.ja va 2s  . co m
        X509v2CRLBuilder builder = new X509v2CRLBuilder(
                X500PrincipalUtils.toX500Name(issuer.getCertificate().getSubjectX500Principal()), thisUpdate);

        if (CollectionUtils.isNotEmpty(crls)) {
            for (X509CRL crl : crls) {
                builder.addCRL(new X509CRLHolder(crl.getEncoded()));
            }
        }

        if (CollectionUtils.isNotEmpty(entries)) {
            for (Entry entry : entries) {
                builder.addCRLEntry(entry.serialNumber, entry.revocationDate, entry.reason);
            }
        }

        if (nextUpdate != null) {
            builder.setNextUpdate(nextUpdate);
        }

        return getX509CRL(builder.build(getContentSigner(issuer.getPrivateKey())));
    } catch (IllegalStateException e) {
        throw new CRLException(e);
    } catch (IOException e) {
        throw new CRLException(e);
    } catch (OperatorCreationException e) {
        throw new CRLException(e);
    }
}

---

From source file:net.maritimecloud.identityregistry.utils.CertificateUtil.java

License:Apache License

/**
 * Creates a Certificate Revocation List (CRL) for the certificate serialnumbers given.
 * /* w  ww.  ja va 2s . co m*/
 * @param revokedCerts  List of the serialnumbers that should be revoked.
 * @return a X509 certificate
 */
public X509CRL generateCRL(List<net.maritimecloud.identityregistry.model.database.Certificate> revokedCerts) {
    Date now = new Date();
    Calendar cal = Calendar.getInstance();
    cal.setTime(now);
    cal.add(Calendar.DATE, 7);
    X509v2CRLBuilder crlBuilder = new X509v2CRLBuilder(new X500Name(MCIDREG_CERT_X500_NAME), now);
    crlBuilder.setNextUpdate(new Date(now.getTime() + 24 * 60 * 60 * 1000 * 7)); // The next CRL is next week (dummy value)
    for (net.maritimecloud.identityregistry.model.database.Certificate cert : revokedCerts) {
        String certReason = cert.getRevokeReason().toLowerCase();
        int reason = getCRLReasonFromString(certReason);
        crlBuilder.addCRLEntry(cert.getSerialNumber(), cert.getRevokedAt(), reason);
    }
    //crlBuilder.addExtension(X509Extensions.AuthorityKeyIdentifier, false, new AuthorityKeyIdentifierStructure(caCert));
    //crlBuilder.addExtension(X509Extensions.CRLNumber, false, new CRLNumber(BigInteger.valueOf(1)));

    PrivateKeyEntry keyEntry = getSigningCertEntry();

    JcaContentSignerBuilder signBuilder = new JcaContentSignerBuilder(SIGNER_ALGORITHM);
    signBuilder.setProvider(BC_PROVIDER_NAME);
    ContentSigner signer;
    try {
        signer = signBuilder.build(keyEntry.getPrivateKey());
    } catch (OperatorCreationException e1) {
        // TODO Auto-generated catch block
        e1.printStackTrace();
        return null;
    }

    X509CRLHolder cRLHolder = crlBuilder.build(signer);
    JcaX509CRLConverter converter = new JcaX509CRLConverter();
    converter.setProvider(BC_PROVIDER_NAME);
    X509CRL crl = null;
    try {
        crl = converter.getCRL(cRLHolder);
    } catch (CRLException e) {
        // TODO Auto-generated catch block
        e.printStackTrace();
    }
    return crl;
}

---

• «
• 1
• 2
• 3
• 4
• 5
• »