Example usage for org.bouncycastle.mail.smime SMIMESignedParser getCertificates

Introduction

In this page you can find the example usage for org.bouncycastle.mail.smime SMIMESignedParser getCertificates.

Prototype

public Store getCertificates() throws CMSException 

Source Link

Document

Return any X.509 certificate objects in this SignedData structure as a Store of X509CertificateHolder objects.

Usage

From source file:eu.peppol.as2.SignedMimeMessage.java

License:EUPL

void parseSignedMessage() {
    SMIMESignedParser smimeSignedParser = null;
    try {//from   w  w  w .j a v  a2s  . co m
        // MimeMessageHelper.dumpMimePartToFile("/tmp/parseSignedMessage.txt", mimeMessage);
        smimeSignedParser = new SMIMESignedParser(new JcaDigestCalculatorProviderBuilder().build(),
                (MimeMultipart) mimeMessage.getContent());
    } catch (MessagingException | CMSException | IOException | OperatorCreationException e) {
        throw new IllegalStateException("Unable to create SMIMESignedParser: " + e.getMessage(), e);
    }

    Store certs = null;
    try {
        certs = smimeSignedParser.getCertificates();
    } catch (CMSException e) {
        throw new IllegalStateException("Unable to retrieve the certificates from signed message.");
    }

    //
    // SignerInfo blocks which contain the signatures
    //
    SignerInformationStore signerInfos = null;
    try {
        signerInfos = smimeSignedParser.getSignerInfos();
    } catch (CMSException e) {
        throw new IllegalStateException("Unable to get the Signer information from message. " + e.getMessage(),
                e);
    }

    Collection signers = signerInfos.getSigners();
    Iterator signersIterator = signers.iterator();

    //
    // Only a single signer, get the first and only certificate
    //
    if (signersIterator.hasNext()) {

        // Retrieves information on first and only signer
        SignerInformation signer = (SignerInformation) signersIterator.next();

        // Retrieves the collection of certificates for first and only signer
        Collection certCollection = certs.getMatches(signer.getSID());

        // Retrieve the first certificate
        Iterator certIt = certCollection.iterator();
        if (certIt.hasNext()) {
            try {
                signersX509Certificate = new JcaX509CertificateConverter()
                        .setProvider(new BouncyCastleProvider())
                        .getCertificate((X509CertificateHolder) certIt.next());
            } catch (CertificateException e) {
                throw new IllegalStateException("Unable to fetch certificate for signer. " + e.getMessage(), e);
            }
        } else {
            throw new IllegalStateException(
                    "Signers certificate was not found, unable to verify the signature");
        }

        // Verify that the signature is correct and that signersIterator was generated when the certificate was current
        try {
            if (!signer.verify(new JcaSimpleSignerInfoVerifierBuilder().setProvider(new BouncyCastleProvider())
                    .build(signersX509Certificate))) {
                throw new IllegalStateException("Verification of signer failed");
            }
        } catch (CMSException e) {
            throw new IllegalStateException("Unable to verify the signer. " + e.getMessage(), e);
        } catch (OperatorCreationException e) {
            throw new IllegalStateException("Unable to verify the signer. " + e.getMessage(), e);
        }

        String issuerDN = signersX509Certificate.getIssuerDN().toString();
        log.debug("Certificate issued by: " + issuerDN);

    } else {
        throw new IllegalStateException("There is no signer information available");
    }

}

---

From source file:eu.peppol.as2.SignedMimeMessageInspector.java

License:Open Source License

void parseSignedMessage() {
    SMIMESignedParser smimeSignedParser = null;
    try {/*from w  w  w  .  j a v  a  2s  .c om*/
        // MimeMessageHelper.dumpMimePartToFile("/tmp/parseSignedMessage.txt", mimeMessage);
        smimeSignedParser = new SMIMESignedParser(new BcDigestCalculatorProvider(),
                (MimeMultipart) mimeMessage.getContent());
    } catch (MessagingException e) {
        throw new IllegalStateException("Unable to get content of message." + e.getMessage(), e);
    } catch (CMSException e) {
        throw new IllegalStateException("Unable to get content of message. " + e.getMessage(), e);
    } catch (IOException e) {
        throw new IllegalStateException("Unable to get content of message. " + e.getMessage(), e);
    }

    Store certs = null;
    try {
        certs = smimeSignedParser.getCertificates();
    } catch (CMSException e) {
        throw new IllegalStateException("Unable to retrieve the certificates from signed message.");
    }

    //
    // SignerInfo blocks which contain the signatures
    //
    SignerInformationStore signerInfos = null;
    try {
        signerInfos = smimeSignedParser.getSignerInfos();
    } catch (CMSException e) {
        throw new IllegalStateException("Unable to get the Signer information from message. " + e.getMessage(),
                e);
    }

    Collection signers = signerInfos.getSigners();
    Iterator signersIterator = signers.iterator();

    //
    // Only a single signer, get the first and only certificate
    //
    if (signersIterator.hasNext()) {

        // Retrieves information on first and only signer
        SignerInformation signer = (SignerInformation) signersIterator.next();

        // Retrieves the collection of certificates for first and only signer
        Collection certCollection = certs.getMatches(signer.getSID());

        // Retrieve the first certificate
        Iterator certIt = certCollection.iterator();
        if (certIt.hasNext()) {
            try {
                signersX509Certificate = new JcaX509CertificateConverter().setProvider(provider)
                        .getCertificate((X509CertificateHolder) certIt.next());
            } catch (CertificateException e) {
                throw new IllegalStateException("Unable to fetch certificate for signer. " + e.getMessage(), e);
            }
        } else {
            throw new IllegalStateException(
                    "Signers certificate was not found, unable to verify the signature");
        }

        // Verify that the signature is correct and that signersIterator was generated when the certificate was current
        try {
            if (!signer.verify(new JcaSimpleSignerInfoVerifierBuilder().setProvider(provider)
                    .build(signersX509Certificate))) {
                throw new IllegalStateException("Verification of signer failed");
            }
        } catch (CMSException e) {
            throw new IllegalStateException("Unable to verify the signer. " + e.getMessage(), e);
        } catch (OperatorCreationException e) {
            throw new IllegalStateException("Unable to verify the signer. " + e.getMessage(), e);
        }

        // Verify that the certificate issuer is trusted
        String issuerDN = signersX509Certificate.getIssuerDN().toString();
        log.debug("Verify the certificate issuer : " + issuerDN);
        //TODO validateCertificate(signersX509Certificate);

    } else {
        throw new IllegalStateException("There is no signer information available");
    }

}

---

From source file:no.difi.oxalis.as2.util.SignedMimeMessage.java

License:EUPL

void parseSignedMessage() {
    SMIMESignedParser smimeSignedParser;
    try {/* ww w .ja va  2  s  . com*/
        // MimeMessageHelper.dumpMimePartToFile("/tmp/parseSignedMessage.txt", mimeMessage);
        smimeSignedParser = new SMIMESignedParser(new JcaDigestCalculatorProviderBuilder().build(),
                (MimeMultipart) mimeMessage.getContent());
    } catch (MessagingException | CMSException | IOException | OperatorCreationException e) {
        throw new IllegalStateException("Unable to create SMIMESignedParser: " + e.getMessage(), e);
    }

    Store certs;
    try {
        certs = smimeSignedParser.getCertificates();
    } catch (CMSException e) {
        throw new IllegalStateException("Unable to retrieve the certificates from signed message.");
    }

    //
    // SignerInfo blocks which contain the signatures
    //
    SignerInformationStore signerInfos;
    try {
        signerInfos = smimeSignedParser.getSignerInfos();
    } catch (CMSException e) {
        throw new IllegalStateException("Unable to get the Signer information from message. " + e.getMessage(),
                e);
    }

    Collection signers = signerInfos.getSigners();
    Iterator signersIterator = signers.iterator();

    //
    // Only a single signer, get the first and only certificate
    //
    if (signersIterator.hasNext()) {

        // Retrieves information on first and only signer
        SignerInformation signer = (SignerInformation) signersIterator.next();

        // Retrieves the collection of certificates for first and only signer
        @SuppressWarnings("unchecked")
        Collection certCollection = certs.getMatches(signer.getSID());

        // Retrieve the first certificate
        Iterator certIt = certCollection.iterator();
        if (certIt.hasNext()) {
            try {
                signersX509Certificate = new JcaX509CertificateConverter()
                        .setProvider(BouncyCastleProvider.PROVIDER_NAME)
                        .getCertificate((X509CertificateHolder) certIt.next());
            } catch (CertificateException e) {
                throw new IllegalStateException("Unable to fetch certificate for signer. " + e.getMessage(), e);
            }
        } else {
            throw new IllegalStateException(
                    "Signers certificate was not found, unable to verify the signature");
        }

        // Verify that the signature is correct and that signersIterator was generated when the certificate was current
        /*
        try {
        if (!signer.verify(new JcaSimpleSignerInfoVerifierBuilder().setProvider(BouncyCastleProvider.PROVIDER_NAME).build(signersX509Certificate))) {
            throw new IllegalStateException("Verification of signer failed");
        }
        } catch (CMSException | OperatorCreationException e) {
        throw new IllegalStateException("Unable to verify the signer. " + e.getMessage(), e);
        }
        */

        String issuerDN = signersX509Certificate.getIssuerDN().toString();
        log.debug("Certificate issued by: " + issuerDN);

    } else {
        throw new IllegalStateException("There is no signer information available");
    }

}

---

From source file:org.apache.jmeter.assertions.SMIMEAssertion.java

License:Apache License

private static AssertionResult verifySignature(SMIMEAssertionTestElement testElement, SMIMESignedParser s,
        String name) throws CMSException {
    AssertionResult res = new AssertionResult(name);

    try {/*from  w w w.  ja v  a2  s . c  o m*/
        Store certs = s.getCertificates();
        SignerInformationStore signers = s.getSignerInfos();
        Iterator<?> signerIt = signers.getSigners().iterator();

        if (signerIt.hasNext()) {

            SignerInformation signer = (SignerInformation) signerIt.next();
            Iterator<?> certIt = certs.getMatches(signer.getSID()).iterator();

            if (certIt.hasNext()) {
                // the signer certificate
                X509CertificateHolder cert = (X509CertificateHolder) certIt.next();

                if (testElement.isVerifySignature()) {

                    SignerInformationVerifier verifier = null;
                    try {
                        verifier = new JcaSimpleSignerInfoVerifierBuilder().setProvider("BC").build(cert);
                    } catch (OperatorCreationException e) {
                        log.error("Can't create a provider", e);
                    }
                    if (verifier == null || !signer.verify(verifier)) {
                        res.setFailure(true);
                        res.setFailureMessage("Signature is invalid");
                    }
                }

                if (testElement.isSignerCheckConstraints()) {
                    StringBuilder failureMessage = new StringBuilder();

                    String serial = testElement.getSignerSerial();
                    if (!JOrphanUtils.isBlank(serial)) {
                        BigInteger serialNbr = readSerialNumber(serial);
                        if (!serialNbr.equals(cert.getSerialNumber())) {
                            res.setFailure(true);
                            failureMessage.append("Serial number ").append(serialNbr)
                                    .append(" does not match serial from signer certificate: ")
                                    .append(cert.getSerialNumber()).append("\n");
                        }
                    }

                    String email = testElement.getSignerEmail();
                    if (!JOrphanUtils.isBlank(email)) {
                        List<String> emailFromCert = getEmailFromCert(cert);
                        if (!emailFromCert.contains(email)) {
                            res.setFailure(true);
                            failureMessage.append("Email address \"").append(email)
                                    .append("\" not present in signer certificate\n");
                        }

                    }

                    String subject = testElement.getSignerDn();
                    if (subject.length() > 0) {
                        final X500Name certPrincipal = cert.getSubject();
                        log.debug("DN from cert: " + certPrincipal.toString());
                        X500Name principal = new X500Name(subject);
                        log.debug("DN from assertion: " + principal.toString());
                        if (!principal.equals(certPrincipal)) {
                            res.setFailure(true);
                            failureMessage.append("Distinguished name of signer certificate does not match \"")
                                    .append(subject).append("\"\n");
                        }
                    }

                    String issuer = testElement.getIssuerDn();
                    if (issuer.length() > 0) {
                        final X500Name issuerX500Name = cert.getIssuer();
                        log.debug("IssuerDN from cert: " + issuerX500Name.toString());
                        X500Name principal = new X500Name(issuer);
                        log.debug("IssuerDN from assertion: " + principal);
                        if (!principal.equals(issuerX500Name)) {
                            res.setFailure(true);
                            failureMessage
                                    .append("Issuer distinguished name of signer certificate does not match \"")
                                    .append(subject).append("\"\n");
                        }
                    }

                    if (failureMessage.length() > 0) {
                        res.setFailureMessage(failureMessage.toString());
                    }
                }

                if (testElement.isSignerCheckByFile()) {
                    CertificateFactory cf = CertificateFactory.getInstance("X.509");
                    X509CertificateHolder certFromFile;
                    InputStream inStream = null;
                    try {
                        inStream = new BufferedInputStream(
                                new FileInputStream(testElement.getSignerCertFile()));
                        certFromFile = new JcaX509CertificateHolder(
                                (X509Certificate) cf.generateCertificate(inStream));
                    } finally {
                        IOUtils.closeQuietly(inStream);
                    }

                    if (!certFromFile.equals(cert)) {
                        res.setFailure(true);
                        res.setFailureMessage("Signer certificate does not match certificate "
                                + testElement.getSignerCertFile());
                    }
                }

            } else {
                res.setFailure(true);
                res.setFailureMessage("No signer certificate found in signature");
            }

        }

        // TODO support multiple signers
        if (signerIt.hasNext()) {
            log.warn("SMIME message contains multiple signers! Checking multiple signers is not supported.");
        }

    } catch (GeneralSecurityException e) {
        log.error(e.getMessage(), e);
        res.setError(true);
        res.setFailureMessage(e.getMessage());
    } catch (FileNotFoundException e) {
        res.setFailure(true);
        res.setFailureMessage("certificate file not found: " + e.getMessage());
    }

    return res;
}

---