Example usage for org.bouncycastle.cert X509v2CRLBuilder setNextUpdate

Introduction

In this page you can find the example usage for org.bouncycastle.cert X509v2CRLBuilder setNextUpdate.

Prototype

public X509v2CRLBuilder setNextUpdate(Time date) 

Source Link

Document

Set the date by which the next CRL will become available.

Usage

From source file:be.fedict.trust.test.PKITestUtils.java

License:Open Source License

public static X509CRL generateCrl(PrivateKey issuerPrivateKey, X509Certificate issuerCertificate,
        DateTime thisUpdate, DateTime nextUpdate, List<String> deltaCrlUris, boolean deltaCrl,
        List<RevokedCertificate> revokedCertificates, String signatureAlgorithm,
        long numberOfRevokedCertificates)
        throws InvalidKeyException, CRLException, IllegalStateException, NoSuchAlgorithmException,
        SignatureException, CertificateException, IOException, OperatorCreationException {

    X500Name issuerName = new X500Name(issuerCertificate.getSubjectX500Principal().toString());
    X509v2CRLBuilder x509v2crlBuilder = new X509v2CRLBuilder(issuerName, thisUpdate.toDate());
    x509v2crlBuilder.setNextUpdate(nextUpdate.toDate());

    for (RevokedCertificate revokedCertificate : revokedCertificates) {
        x509v2crlBuilder.addCRLEntry(revokedCertificate.serialNumber,
                revokedCertificate.revocationDate.toDate(), CRLReason.privilegeWithdrawn);
    }/*from   w  ww.java2 s  .  c  o m*/
    if (-1 != numberOfRevokedCertificates) {
        SecureRandom secureRandom = new SecureRandom();
        while (numberOfRevokedCertificates-- > 0) {
            BigInteger serialNumber = new BigInteger(128, secureRandom);
            Date revocationDate = new Date();
            x509v2crlBuilder.addCRLEntry(serialNumber, revocationDate, CRLReason.privilegeWithdrawn);
        }
    }

    JcaX509ExtensionUtils extensionUtils = new JcaX509ExtensionUtils();
    x509v2crlBuilder.addExtension(Extension.authorityKeyIdentifier, false,
            extensionUtils.createAuthorityKeyIdentifier(issuerCertificate));
    x509v2crlBuilder.addExtension(Extension.cRLNumber, false, new CRLNumber(BigInteger.ONE));

    if (null != deltaCrlUris && !deltaCrlUris.isEmpty()) {
        DistributionPoint[] deltaCrlDps = new DistributionPoint[deltaCrlUris.size()];
        for (int i = 0; i < deltaCrlUris.size(); i++) {
            deltaCrlDps[i] = getDistributionPoint(deltaCrlUris.get(i));
        }
        CRLDistPoint crlDistPoint = new CRLDistPoint((DistributionPoint[]) deltaCrlDps);
        x509v2crlBuilder.addExtension(Extension.freshestCRL, false, crlDistPoint);
    }

    if (deltaCrl) {
        x509v2crlBuilder.addExtension(Extension.deltaCRLIndicator, true, new CRLNumber(BigInteger.ONE));
    }

    AlgorithmIdentifier sigAlgId = new DefaultSignatureAlgorithmIdentifierFinder().find(signatureAlgorithm);
    AlgorithmIdentifier digAlgId = new DefaultDigestAlgorithmIdentifierFinder().find(sigAlgId);
    AsymmetricKeyParameter asymmetricKeyParameter = PrivateKeyFactory.createKey(issuerPrivateKey.getEncoded());

    ContentSigner contentSigner = new BcRSAContentSignerBuilder(sigAlgId, digAlgId)
            .build(asymmetricKeyParameter);

    X509CRLHolder x509crlHolder = x509v2crlBuilder.build(contentSigner);
    byte[] crlValue = x509crlHolder.getEncoded();
    CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509");
    X509CRL crl = (X509CRL) certificateFactory.generateCRL(new ByteArrayInputStream(crlValue));
    return crl;
}

---

From source file:com.aqnote.shared.cryptology.cert.main.AQCRLMain.java

License:Open Source License

public static void createCRL() throws CertException {

    try {// www .  j av  a 2  s.c  o m
        X509v2CRLBuilder crlBuilder = new X509v2CRLBuilder(X500NameUtil.createRootCaPrincipal(), new Date());
        crlBuilder.setNextUpdate(new Date(System.currentTimeMillis() + DateConstant.ONE_YEAR));
        X509CRLHolder crlHolder = crlBuilder.build(new JcaContentSignerBuilder(SHA256_RSA)
                .setProvider(JCE_PROVIDER).build(CaCertLoader.getRootCaKeyPair(USER_CERT_PASSWD).getPrivate()));
        X509CRL crl = new JcaX509CRLConverter().setProvider(JCE_PROVIDER).getCRL(crlHolder);
        FileOutputStream fostream = new FileOutputStream(CRL_FILE);
        PKCSWriter.storeCRLFile(crl, fostream);

        ASN1Dump.dumpAsString(crlHolder.toASN1Structure());
    } catch (OperatorCreationException e) {
        throw new CertException(e);
    } catch (IOException e) {
        throw new CertException(e);
    } catch (InvalidKeyException e) {
        throw new CertException(e);
    } catch (CRLException e) {
        throw new CertException(e);
    } catch (NoSuchAlgorithmException e) {
        throw new CertException(e);
    } catch (NoSuchProviderException e) {
        throw new CertException(e);
    } catch (SignatureException e) {
        throw new CertException(e);
    } catch (Exception e) {
        throw new CertException(e);
    }

    return;
}

---

From source file:com.aqnote.shared.encrypt.cert.main.bc.AQCRLCreator.java

License:Open Source License

public static void createNewCRL() throws CertException {

    try {/*from w  w w  .ja v  a2 s  .co m*/
        X509v2CRLBuilder crlBuilder = new X509v2CRLBuilder(X500NameUtil.createRootPrincipal(), new Date());
        crlBuilder.setNextUpdate(new Date(System.currentTimeMillis() + DateConstant.ONE_YEAR));
        X509CRLHolder crlHolder = crlBuilder.build(new JcaContentSignerBuilder(SHA256_RSA)
                .setProvider(JCE_PROVIDER).build(CaCertLoader.getCaKeyPair().getPrivate()));
        X509CRL crl = new JcaX509CRLConverter().setProvider(JCE_PROVIDER).getCRL(crlHolder);
        FileOutputStream fostream = new FileOutputStream(MAD_CRL_FILE);
        PKCSWriter.storeCRLFile(crl, fostream);

        ASN1Dump.dumpAsString(crlHolder.toASN1Structure());
    } catch (OperatorCreationException e) {
        throw new CertException(e);
    } catch (IOException e) {
        throw new CertException(e);
    } catch (InvalidKeyException e) {
        throw new CertException(e);
    } catch (CRLException e) {
        throw new CertException(e);
    } catch (NoSuchAlgorithmException e) {
        throw new CertException(e);
    } catch (NoSuchProviderException e) {
        throw new CertException(e);
    } catch (SignatureException e) {
        throw new CertException(e);
    } catch (Exception e) {
        throw new CertException(e);
    }

    return;
}

---

From source file:dk.itst.oiosaml.sp.IntegrationTests.java

License:Mozilla Public License

private File generateCRL(X509Certificate cert) throws CRLException, NoSuchAlgorithmException,
        SignatureException, InvalidKeyException, IOException, OperatorCreationException {
    X500Name issuer = new X500Name("CN=ca");
    Date thisUpdate = new Date();
    X509v2CRLBuilder gen = new X509v2CRLBuilder(issuer, thisUpdate);
    gen.setNextUpdate(new Date(System.currentTimeMillis() + 60000));

    if (cert != null) {
        gen.addCRLEntry(cert.getSerialNumber(), new Date(System.currentTimeMillis() - 1000),
                CRLReason.keyCompromise);
    }//www . ja  v a2  s.c o  m

    ContentSigner sigGen = new JcaContentSignerBuilder("SHA1withRSA").setProvider("BC")
            .build(credential.getPrivateKey());
    X509CRLHolder crl = gen.build(sigGen);

    final File crlFile = File.createTempFile("test", "test");
    crlFile.deleteOnExit();
    FileOutputStream fos = new FileOutputStream(crlFile);
    IOUtils.write(crl.getEncoded(), fos);
    fos.close();
    return crlFile;
}

---

From source file:eu.europa.esig.dss.test.gen.CRLGenerator.java

License:Open Source License

public X509CRL generateCRL(X509Certificate certToRevoke, MockPrivateKeyEntry issuerEntry, Date dateOfRevoke,
        int reason) throws Exception {

    Date now = new Date();
    X500Name x500nameIssuer = new JcaX509CertificateHolder(issuerEntry.getCertificate().getCertificate())
            .getSubject();//w  w  w . j a v a  2 s. c om
    X509v2CRLBuilder crlGen = new X509v2CRLBuilder(x500nameIssuer, now);

    crlGen.setNextUpdate(new Date(now.getTime() + (60 * 60 * 1000)));

    crlGen.addCRLEntry(certToRevoke.getSerialNumber(), dateOfRevoke, reason);

    JcaX509ExtensionUtils extUtils = new JcaX509ExtensionUtils();

    crlGen.addExtension(Extension.authorityKeyIdentifier, false,
            extUtils.createAuthorityKeyIdentifier(issuerEntry.getCertificate().getPublicKey()));

    X509CRLHolder crlHolder = crlGen
            .build(new JcaContentSignerBuilder(issuerEntry.getCertificate().getCertificate().getSigAlgName())
                    .setProvider(BouncyCastleProvider.PROVIDER_NAME).build(issuerEntry.getPrivateKey()));

    JcaX509CRLConverter converter = new JcaX509CRLConverter();
    return converter.getCRL(crlHolder);
}

---

From source file:mitm.common.security.crl.X509CRLBuilderImpl.java

License:Open Source License

@Override
public X509CRL generateCRL(KeyAndCertificate issuer) throws CRLException {
    Check.notNull(issuer, "issuer");
    Check.notNull(issuer.getCertificate(), "issuer#certificate");

    Check.notNull(thisUpdate, "thisUpdate");

    try {/*from   ww w.j  a v  a  2 s . c  om*/
        X509v2CRLBuilder builder = new X509v2CRLBuilder(
                X500PrincipalUtils.toX500Name(issuer.getCertificate().getSubjectX500Principal()), thisUpdate);

        if (CollectionUtils.isNotEmpty(crls)) {
            for (X509CRL crl : crls) {
                builder.addCRL(new X509CRLHolder(crl.getEncoded()));
            }
        }

        if (CollectionUtils.isNotEmpty(entries)) {
            for (Entry entry : entries) {
                builder.addCRLEntry(entry.serialNumber, entry.revocationDate, entry.reason);
            }
        }

        if (nextUpdate != null) {
            builder.setNextUpdate(nextUpdate);
        }

        return getX509CRL(builder.build(getContentSigner(issuer.getPrivateKey())));
    } catch (IllegalStateException e) {
        throw new CRLException(e);
    } catch (IOException e) {
        throw new CRLException(e);
    } catch (OperatorCreationException e) {
        throw new CRLException(e);
    }
}

---

From source file:net.maritimecloud.identityregistry.utils.CertificateUtil.java

License:Apache License

/**
 * Creates a Certificate Revocation List (CRL) for the certificate serialnumbers given.
 * /*from   www.ja  v a2  s  . co m*/
 * @param revokedCerts  List of the serialnumbers that should be revoked.
 * @return a X509 certificate
 */
public X509CRL generateCRL(List<net.maritimecloud.identityregistry.model.database.Certificate> revokedCerts) {
    Date now = new Date();
    Calendar cal = Calendar.getInstance();
    cal.setTime(now);
    cal.add(Calendar.DATE, 7);
    X509v2CRLBuilder crlBuilder = new X509v2CRLBuilder(new X500Name(MCIDREG_CERT_X500_NAME), now);
    crlBuilder.setNextUpdate(new Date(now.getTime() + 24 * 60 * 60 * 1000 * 7)); // The next CRL is next week (dummy value)
    for (net.maritimecloud.identityregistry.model.database.Certificate cert : revokedCerts) {
        String certReason = cert.getRevokeReason().toLowerCase();
        int reason = getCRLReasonFromString(certReason);
        crlBuilder.addCRLEntry(cert.getSerialNumber(), cert.getRevokedAt(), reason);
    }
    //crlBuilder.addExtension(X509Extensions.AuthorityKeyIdentifier, false, new AuthorityKeyIdentifierStructure(caCert));
    //crlBuilder.addExtension(X509Extensions.CRLNumber, false, new CRLNumber(BigInteger.valueOf(1)));

    PrivateKeyEntry keyEntry = getSigningCertEntry();

    JcaContentSignerBuilder signBuilder = new JcaContentSignerBuilder(SIGNER_ALGORITHM);
    signBuilder.setProvider(BC_PROVIDER_NAME);
    ContentSigner signer;
    try {
        signer = signBuilder.build(keyEntry.getPrivateKey());
    } catch (OperatorCreationException e1) {
        // TODO Auto-generated catch block
        e1.printStackTrace();
        return null;
    }

    X509CRLHolder cRLHolder = crlBuilder.build(signer);
    JcaX509CRLConverter converter = new JcaX509CRLConverter();
    converter.setProvider(BC_PROVIDER_NAME);
    X509CRL crl = null;
    try {
        crl = converter.getCRL(cRLHolder);
    } catch (CRLException e) {
        // TODO Auto-generated catch block
        e.printStackTrace();
    }
    return crl;
}

---

From source file:net.maritimecloud.identityregistry.utils.CertificateUtil.java

License:Apache License

/**
 * Creates a Certificate Revocation List (CRL) for the certificate serialnumbers given.
 *
 * @param revokedCerts  List of the serialnumbers that should be revoked.
 *///from  ww w  .java 2  s .  co m
public void generateRootCACRL(String signName,
        List<net.maritimecloud.identityregistry.model.database.Certificate> revokedCerts,
        PrivateKeyEntry keyEntry, String outputCaCrlPath) {
    Date now = new Date();
    Calendar cal = Calendar.getInstance();
    cal.setTime(now);
    cal.add(Calendar.YEAR, 1);
    X509v2CRLBuilder crlBuilder = new X509v2CRLBuilder(new X500Name(signName), now);
    crlBuilder.setNextUpdate(cal.getTime()); // The next CRL is next year (dummy value)
    if (revokedCerts != null) {
        for (net.maritimecloud.identityregistry.model.database.Certificate cert : revokedCerts) {
            String certReason = cert.getRevokeReason().toLowerCase();
            int reason = getCRLReasonFromString(certReason);
            crlBuilder.addCRLEntry(cert.getSerialNumber(), cert.getRevokedAt(), reason);
        }
    }
    //crlBuilder.addExtension(X509Extensions.AuthorityKeyIdentifier, false, new AuthorityKeyIdentifierStructure(caCert));
    //crlBuilder.addExtension(X509Extensions.CRLNumber, false, new CRLNumber(BigInteger.valueOf(1)));

    JcaContentSignerBuilder signBuilder = new JcaContentSignerBuilder(SIGNER_ALGORITHM);
    signBuilder.setProvider(BC_PROVIDER_NAME);
    ContentSigner signer;
    try {
        signer = signBuilder.build(keyEntry.getPrivateKey());
    } catch (OperatorCreationException e1) {
        // TODO Auto-generated catch block
        e1.printStackTrace();
        return;
    }

    X509CRLHolder cRLHolder = crlBuilder.build(signer);
    JcaX509CRLConverter converter = new JcaX509CRLConverter();
    converter.setProvider(BC_PROVIDER_NAME);
    X509CRL crl;
    try {
        crl = converter.getCRL(cRLHolder);
    } catch (CRLException e) {
        throw new RuntimeException(e.getMessage(), e);
    }
    String pemCrl;
    try {
        pemCrl = CertificateUtil.getPemFromEncoded("X509 CRL", crl.getEncoded());
    } catch (CRLException e) {
        log.warn("unable to generate RootCACRL", e);
        return;
    }
    try {
        BufferedWriter writer = new BufferedWriter(new FileWriter(outputCaCrlPath));
        writer.write(pemCrl);
        writer.close();
    } catch (IOException e) {
        e.printStackTrace();
    }
}

---

From source file:net.maritimecloud.pki.Revocation.java

License:Apache License

/**
 * Creates a Certificate RevocationInfo List (CRL) for the certificate serialnumbers given.
 *
 * @param revokedCerts  List of the serialnumbers that should be revoked.
 * @param keyEntry Private key to sign the CRL
 * @return a CRL// w w w.  ja v a 2s .  co  m
 */
public static X509CRL generateCRL(List<RevocationInfo> revokedCerts, KeyStore.PrivateKeyEntry keyEntry) {
    Date now = new Date();
    Calendar cal = Calendar.getInstance();
    cal.setTime(now);
    cal.add(Calendar.DATE, 7);
    String signCertX500Name;
    try {
        signCertX500Name = new JcaX509CertificateHolder((X509Certificate) keyEntry.getCertificate())
                .getSubject().toString();
    } catch (CertificateEncodingException e) {
        e.printStackTrace();
        return null;
    }
    X509v2CRLBuilder crlBuilder = new X509v2CRLBuilder(new X500Name(signCertX500Name), now);
    crlBuilder.setNextUpdate(new Date(now.getTime() + 24 * 60 * 60 * 1000 * 7)); // The next CRL is next week (dummy value)
    for (RevocationInfo cert : revokedCerts) {
        crlBuilder.addCRLEntry(cert.getSerialNumber(), cert.getRevokedAt(), cert.getRevokeReason().ordinal());
    }
    //crlBuilder.addExtension(X509Extensions.AuthorityKeyIdentifier, false, new AuthorityKeyIdentifierStructure(caCert));
    //crlBuilder.addExtension(X509Extensions.CRLNumber, false, new CRLNumber(BigInteger.valueOf(1)));

    JcaContentSignerBuilder signBuilder = new JcaContentSignerBuilder(SIGNER_ALGORITHM);
    signBuilder.setProvider(BC_PROVIDER_NAME);
    ContentSigner signer;
    try {
        signer = signBuilder.build(keyEntry.getPrivateKey());
    } catch (OperatorCreationException e1) {
        // TODO Auto-generated catch block
        e1.printStackTrace();
        return null;
    }

    X509CRLHolder cRLHolder = crlBuilder.build(signer);
    JcaX509CRLConverter converter = new JcaX509CRLConverter();
    converter.setProvider(BC_PROVIDER_NAME);
    X509CRL crl = null;
    try {
        crl = converter.getCRL(cRLHolder);
    } catch (CRLException e) {
        // TODO Auto-generated catch block
        e.printStackTrace();
    }
    return crl;
}

---

From source file:net.maritimecloud.pki.Revocation.java

License:Apache License

/**
 * Creates a Certificate RevocationInfo List (CRL) for the certificate serialnumbers given.
 *
 * @param signName DN name of the signing certificate
 * @param revokedCerts  List of the serialnumbers that should be revoked.
 * @param keyEntry Private key to sign the CRL
 * @param outputCaCrlPath Where to place the CRL
 *///from  w  w w.  java 2 s  .  c  om
public static void generateRootCACRL(String signName, List<RevocationInfo> revokedCerts,
        KeyStore.PrivateKeyEntry keyEntry, String outputCaCrlPath) {
    Date now = new Date();
    Calendar cal = Calendar.getInstance();
    cal.setTime(now);
    cal.add(Calendar.YEAR, 1);
    X509v2CRLBuilder crlBuilder = new X509v2CRLBuilder(new X500Name(signName), now);
    crlBuilder.setNextUpdate(cal.getTime()); // The next CRL is next year (dummy value)
    if (revokedCerts != null) {
        for (RevocationInfo cert : revokedCerts) {
            crlBuilder.addCRLEntry(cert.getSerialNumber(), cert.getRevokedAt(),
                    cert.getRevokeReason().ordinal());
        }
    }
    //crlBuilder.addExtension(X509Extensions.AuthorityKeyIdentifier, false, new AuthorityKeyIdentifierStructure(caCert));
    //crlBuilder.addExtension(X509Extensions.CRLNumber, false, new CRLNumber(BigInteger.valueOf(1)));

    JcaContentSignerBuilder signBuilder = new JcaContentSignerBuilder(SIGNER_ALGORITHM);
    signBuilder.setProvider(BC_PROVIDER_NAME);
    ContentSigner signer;
    try {
        signer = signBuilder.build(keyEntry.getPrivateKey());
    } catch (OperatorCreationException e1) {
        // TODO Auto-generated catch block
        e1.printStackTrace();
        return;
    }

    X509CRLHolder cRLHolder = crlBuilder.build(signer);
    JcaX509CRLConverter converter = new JcaX509CRLConverter();
    converter.setProvider(BC_PROVIDER_NAME);
    X509CRL crl;
    try {
        crl = converter.getCRL(cRLHolder);
    } catch (CRLException e) {
        throw new RuntimeException(e.getMessage(), e);
    }
    String pemCrl;
    try {
        pemCrl = getPemFromEncoded("X509 CRL", crl.getEncoded());
    } catch (CRLException e) {
        //log.warn("unable to generate RootCACRL", e);
        return;
    }
    try {
        BufferedWriter writer = new BufferedWriter(new FileWriter(outputCaCrlPath));
        writer.write(pemCrl);
        writer.close();
    } catch (IOException e) {
        e.printStackTrace();
    }
}

---

• «
• 1
• 2
• 3
• »