Example usage for org.bouncycastle.operator.jcajce JcaContentSignerBuilder JcaContentSignerBuilder

Introduction

In this page you can find the example usage for org.bouncycastle.operator.jcajce JcaContentSignerBuilder JcaContentSignerBuilder.

Prototype

public JcaContentSignerBuilder(String signatureAlgorithm) 

Source Link

Usage

From source file:esteidhacker.FakeEstEIDCA.java

License:Open Source License

public X509Certificate generateUserCertificate(RSAPublicKey pubkey, boolean signature, String firstname,
        String lastname, String idcode, String email)
        throws InvalidKeyException, ParseException, IOException, IllegalStateException, NoSuchProviderException,
        NoSuchAlgorithmException, SignatureException, CertificateException, OperatorCreationException {
    Date startDate = new SimpleDateFormat("yyyy-MM-dd", Locale.ENGLISH).parse("2015-01-01");
    Date endDate = new SimpleDateFormat("yyyy-MM-dd", Locale.ENGLISH).parse("2015-12-31");

    String template = "C=EE,O=ESTEID,OU=%s,CN=%s\\,%s\\,%s,SURNAME=%s,GIVENNAME=%s,SERIALNUMBER=%s";
    // Normalize.
    lastname = lastname.toUpperCase();/* ww w .j a  v  a  2  s .  com*/
    firstname = firstname.toUpperCase();
    idcode = idcode.toUpperCase();
    email = email.toLowerCase();
    String subject = String.format(template, (signature ? "digital signature" : "authentication"), lastname,
            firstname, idcode, lastname, firstname, idcode);

    byte[] serialBytes = new byte[16];
    SecureRandom rnd = SecureRandom.getInstance("SHA1PRNG");
    rnd.nextBytes(serialBytes);
    serialBytes[0] &= 0x7F; // Can't be negative
    BigInteger serial = new BigInteger(serialBytes);

    X509CertificateHolder real;
    if (signature) {
        real = getRealCert("/resources/sk-sign.pem");
    } else {
        real = getRealCert("/resources/sk-auth.pem");
    }
    serial = real.getSerialNumber();
    System.out.println("Generating from subject: " + real.getSubject());
    System.out.println("Generating subject: " + new X500Name(subject).toString());

    JcaX509v3CertificateBuilder builder = new JcaX509v3CertificateBuilder(real.getIssuer(), serial, startDate,
            endDate, new X500Name(subject), pubkey);

    @SuppressWarnings("unchecked")
    List<ASN1ObjectIdentifier> list = real.getExtensionOIDs();

    // Copy all extensions, except altName
    for (ASN1ObjectIdentifier extoid : list) {
        Extension ext = real.getExtension(extoid);
        if (ext.getExtnId().equals(Extension.subjectAlternativeName)) {
            // altName must be changed
            builder.addExtension(ext.getExtnId(), ext.isCritical(),
                    new GeneralNames(new GeneralName(GeneralName.rfc822Name, email)));
        } else {
            builder.copyAndAddExtension(ext.getExtnId(), ext.isCritical(), real);
        }
    }

    // Generate cert
    ContentSigner sigGen = new JcaContentSignerBuilder("SHA1withRSA")
            .setProvider(BouncyCastleProvider.PROVIDER_NAME).build(esteidKey);

    X509CertificateHolder cert = builder.build(sigGen);
    return new JcaX509CertificateConverter().setProvider(BouncyCastleProvider.PROVIDER_NAME)
            .getCertificate(cert);
}

---

From source file:eu.europa.ec.markt.dss.validation102853.ocsp.SKOnlineOCSPSource.java

License:GNU General Public License

private byte[] buildOCSPRequest(final X509Certificate signCert, final X509Certificate issuerCert,
        Extension nonceExtension) throws DSSException {
    try {/*from  w  w w.  j  ava 2  s  .  c om*/
        final CertificateID certId = DSSRevocationUtils.getOCSPCertificateID(signCert, issuerCert);
        final OCSPReqBuilder ocspReqBuilder = new OCSPReqBuilder();
        ocspReqBuilder.addRequest(certId);
        ocspReqBuilder.setRequestExtensions(new Extensions(nonceExtension));

        if (configuration.hasToBeOCSPRequestSigned()) {
            JcaContentSignerBuilder signerBuilder = new JcaContentSignerBuilder("SHA1withRSA");

            if (!configuration.isOCSPSigningConfigurationAvailable()) {
                throw new ConfigurationException(
                        "Configuration needed for OCSP request signing is not complete.");
            }

            SignatureToken ocspSigner = new PKCS12SignatureToken(
                    configuration.getOCSPAccessCertificateFileName(),
                    configuration.getOCSPAccessCertificatePassword());

            ContentSigner contentSigner = signerBuilder.build(ocspSigner.getPrivateKey());
            X509Certificate ocspSignerCert = ocspSigner.getCertificate();
            X509CertificateHolder[] chain = { new X509CertificateHolder(ocspSignerCert.getEncoded()) };
            GeneralName generalName = new GeneralName(
                    new JcaX509CertificateHolder(ocspSignerCert).getSubject());
            ocspReqBuilder.setRequestorName(generalName);

            return ocspReqBuilder.build(contentSigner, chain).getEncoded();
        }
        return ocspReqBuilder.build().getEncoded();
    } catch (Exception e) {
        throw new DSSException(e);
    }
}

---

From source file:eu.europa.esig.dss.cookbook.mock.MockTSPSource.java

License:Open Source License

@Override
public TimeStampToken getTimeStampResponse(final DigestAlgorithm digestAlgorithm, final byte[] digest)
        throws DSSException {

    final String signatureAlgorithm = getSignatureAlgorithm(digestAlgorithm, digest);

    final TimeStampRequestGenerator tsqGenerator = new TimeStampRequestGenerator();
    tsqGenerator.setCertReq(true);/*from w ww  .  j  a  v  a 2s . c  o m*/

    /**
     * The code below guarantee that the dates of the two successive
     * timestamps are different. This is activated only if timestampDate is provided at
     * construction time
     */
    Date timestampDate_ = new Date();

    if (policyOid != null) {
        tsqGenerator.setReqPolicy(policyOid);
    }

    TimeStampRequest tsRequest = null;
    if (useNonce) {
        final BigInteger nonce = BigInteger.valueOf(random.nextLong());
        tsRequest = tsqGenerator.generate(new ASN1ObjectIdentifier(digestAlgorithm.getOid()), digest, nonce);
    } else {
        tsRequest = tsqGenerator.generate(new ASN1ObjectIdentifier(digestAlgorithm.getOid()), digest);
    }

    try {
        final ContentSigner sigGen = new JcaContentSignerBuilder(signatureAlgorithm).build(key);
        final JcaX509CertificateHolder certHolder = new JcaX509CertificateHolder(cert.getCertificate());

        // that to make sure we generate the same timestamp data for the
        // same timestamp date
        AttributeTable signedAttributes = new AttributeTable(new Hashtable<ASN1ObjectIdentifier, Object>());
        signedAttributes = signedAttributes.add(PKCSObjectIdentifiers.pkcs_9_at_signingTime,
                new Time(timestampDate_));
        final DefaultSignedAttributeTableGenerator signedAttributeGenerator = new DefaultSignedAttributeTableGenerator(
                signedAttributes);
        AttributeTable unsignedAttributes = new AttributeTable(new Hashtable<ASN1ObjectIdentifier, Object>());
        final SimpleAttributeTableGenerator unsignedAttributeGenerator = new SimpleAttributeTableGenerator(
                unsignedAttributes);

        final DigestCalculatorProvider digestCalculatorProvider = new BcDigestCalculatorProvider();
        SignerInfoGeneratorBuilder sigInfoGeneratorBuilder = new SignerInfoGeneratorBuilder(
                digestCalculatorProvider);
        sigInfoGeneratorBuilder.setSignedAttributeGenerator(signedAttributeGenerator);
        sigInfoGeneratorBuilder.setUnsignedAttributeGenerator(unsignedAttributeGenerator);
        final SignerInfoGenerator sig = sigInfoGeneratorBuilder.build(sigGen, certHolder);

        final DigestCalculator sha1DigestCalculator = DSSRevocationUtils.getSHA1DigestCalculator();

        final TimeStampTokenGenerator tokenGenerator = new TimeStampTokenGenerator(sig, sha1DigestCalculator,
                policyOid);
        final Set<X509Certificate> singleton = new HashSet<X509Certificate>();
        singleton.add(cert.getCertificate());
        tokenGenerator.addCertificates(new JcaCertStore(singleton));
        final TimeStampResponseGenerator generator = new TimeStampResponseGenerator(tokenGenerator,
                TSPAlgorithms.ALLOWED);

        Date responseDate = new Date();
        TimeStampResponse tsResponse = generator.generate(tsRequest, BigInteger.ONE, responseDate);
        final TimeStampToken timeStampToken = tsResponse.getTimeStampToken();
        return timeStampToken;
    } catch (OperatorCreationException e) {
        throw new DSSException(e);
    } catch (CertificateEncodingException e) {
        throw new DSSException(e);
    } catch (TSPException e) {
        throw new DSSException(e);
    }
}

---

From source file:eu.europa.esig.dss.cookbook.sources.AlwaysValidOCSPSource.java

License:Open Source License

@Override
public OCSPToken getOCSPToken(CertificateToken certificateToken, CertificateToken issuerCertificateToken) {

    try {/* w w  w.j  a  va 2s.c  o m*/

        final X509Certificate cert = certificateToken.getCertificate();
        final BigInteger serialNumber = cert.getSerialNumber();
        X509Certificate issuerCert = issuerCertificateToken.getCertificate();
        final OCSPReq ocspReq = generateOCSPRequest(issuerCert, serialNumber);

        final DigestCalculator digestCalculator = DSSRevocationUtils.getSHA1DigestCalculator();
        final BasicOCSPRespBuilder basicOCSPRespBuilder = new JcaBasicOCSPRespBuilder(issuerCert.getPublicKey(),
                digestCalculator);
        final Extension extension = ocspReq.getExtension(OCSPObjectIdentifiers.id_pkix_ocsp_nonce);
        if (extension != null) {

            basicOCSPRespBuilder.setResponseExtensions(new Extensions(new Extension[] { extension }));
        }
        final Req[] requests = ocspReq.getRequestList();
        for (int ii = 0; ii != requests.length; ii++) {

            final Req req = requests[ii];
            final CertificateID certID = req.getCertID();

            boolean isOK = true;

            if (isOK) {

                basicOCSPRespBuilder.addResponse(certID, CertificateStatus.GOOD, ocspDate, null, null);
            } else {

                Date revocationDate = DSSUtils.getDate(ocspDate, -1);
                basicOCSPRespBuilder.addResponse(certID,
                        new RevokedStatus(revocationDate, CRLReason.privilegeWithdrawn));
            }
        }

        final ContentSigner contentSigner = new JcaContentSignerBuilder("SHA1withRSA").setProvider("BC")
                .build(privateKey);
        final X509CertificateHolder x509CertificateHolder = new X509CertificateHolder(issuerCert.getEncoded());
        final X509CertificateHolder[] chain = { x509CertificateHolder };
        BasicOCSPResp basicResp = basicOCSPRespBuilder.build(contentSigner, chain, ocspDate);
        final SingleResp[] responses = basicResp.getResponses();

        final OCSPToken ocspToken = new OCSPToken();
        ocspToken.setBasicOCSPResp(basicResp);
        ocspToken.setBestSingleResp(responses[0]);
        return ocspToken;
    } catch (OCSPException e) {
        throw new DSSException(e);
    } catch (IOException e) {
        throw new DSSException(e);
    } catch (CertificateEncodingException e) {
        throw new DSSException(e);
    } catch (OperatorCreationException e) {
        throw new DSSException(e);
    }
}

---

From source file:eu.europa.esig.dss.test.gen.CertificateService.java

License:Open Source License

/**
 * Generate a CertificateToken suitable for a TSA
 *
 * @param algorithm/*  w  w  w  . j  av  a  2 s .c o  m*/
 * @param keyPair
 * @param issuer
 * @param subject
 * @param notBefore
 * @param notAfter
 * @return
 * @throws CertIOException
 * @throws OperatorCreationException
 * @throws CertificateException
 * @throws IOException
 */
public CertificateToken generateTspCertificate(final SignatureAlgorithm algorithm, KeyPair keyPair,
        X500Name issuer, X500Name subject, final Date notBefore, final Date notAfter)
        throws CertIOException, OperatorCreationException, CertificateException, IOException {
    final SubjectPublicKeyInfo keyInfo = SubjectPublicKeyInfo.getInstance(keyPair.getPublic().getEncoded());

    final X509v3CertificateBuilder certBuilder = new X509v3CertificateBuilder(issuer,
            new BigInteger("" + new Random().nextInt(10) + System.currentTimeMillis()), notBefore, notAfter,
            subject, keyInfo);

    certBuilder.addExtension(Extension.extendedKeyUsage, true,
            new ExtendedKeyUsage(KeyPurposeId.id_kp_timeStamping));

    final ContentSigner signer = new JcaContentSignerBuilder(algorithm.getJCEId())
            .setProvider(BouncyCastleProvider.PROVIDER_NAME).build(keyPair.getPrivate());
    final X509CertificateHolder holder = certBuilder.build(signer);

    final X509Certificate cert = (X509Certificate) CertificateFactory.getInstance("X509")
            .generateCertificate(new ByteArrayInputStream(holder.getEncoded()));

    return new CertificateToken(cert);
}

---

From source file:eu.europa.esig.dss.test.gen.CertificateService.java

License:Open Source License

public CertificateToken generateRootCertificateWithCrl(SignatureAlgorithm algorithm, X500Name subject,
        X500Name issuer, PrivateKey issuerPrivateKey, PublicKey publicKey, Date notBefore, Date notAfter)
        throws Exception {

    // generate certificate
    final SubjectPublicKeyInfo keyInfo = SubjectPublicKeyInfo.getInstance(publicKey.getEncoded());

    final X509v3CertificateBuilder certBuilder = new X509v3CertificateBuilder(issuer,
            new BigInteger("" + new Random().nextInt(10) + System.currentTimeMillis()), notBefore, notAfter,
            subject, keyInfo);/*from w ww  .  j  a  v a  2s.c  o m*/

    certBuilder.addExtension(Extension.keyUsage, true, new KeyUsage(KeyUsage.keyCertSign | KeyUsage.cRLSign));

    // Sign the new certificate with the private key of the trusted third
    final ContentSigner signer = new JcaContentSignerBuilder(algorithm.getJCEId())
            .setProvider(BouncyCastleProvider.PROVIDER_NAME).build(issuerPrivateKey);
    final X509CertificateHolder holder = certBuilder.build(signer);

    final X509Certificate cert = (X509Certificate) CertificateFactory.getInstance("X509")
            .generateCertificate(new ByteArrayInputStream(holder.getEncoded()));

    return new CertificateToken(cert);
}

---

From source file:eu.europa.esig.dss.test.gen.CertificateService.java

License:Open Source License

public CertificateToken generateRootCertificateWithoutCrl(SignatureAlgorithm algorithm, X500Name subject,
        X500Name issuer, PrivateKey issuerPrivateKey, PublicKey publicKey, Date notBefore, Date notAfter)
        throws Exception {

    // generate certificate
    final SubjectPublicKeyInfo keyInfo = SubjectPublicKeyInfo.getInstance(publicKey.getEncoded());

    final X509v3CertificateBuilder certBuilder = new X509v3CertificateBuilder(issuer,
            new BigInteger("" + new Random().nextInt(10) + System.currentTimeMillis()), notBefore, notAfter,
            subject, keyInfo);//from  www. j  a  va2  s  .co m

    certBuilder.addExtension(Extension.keyUsage, true, new KeyUsage(KeyUsage.keyCertSign));

    // Sign the new certificate with the private key of the trusted third
    final ContentSigner signer = new JcaContentSignerBuilder(algorithm.getJCEId())
            .setProvider(BouncyCastleProvider.PROVIDER_NAME).build(issuerPrivateKey);
    final X509CertificateHolder holder = certBuilder.build(signer);

    final X509Certificate cert = (X509Certificate) CertificateFactory.getInstance("X509")
            .generateCertificate(new ByteArrayInputStream(holder.getEncoded()));

    return new CertificateToken(cert);
}

---

From source file:eu.europa.esig.dss.test.gen.CRLGenerator.java

License:Open Source License

public X509CRL generateCRL(X509Certificate certToRevoke, MockPrivateKeyEntry issuerEntry, Date dateOfRevoke,
        int reason) throws Exception {

    Date now = new Date();
    X500Name x500nameIssuer = new JcaX509CertificateHolder(issuerEntry.getCertificate().getCertificate())
            .getSubject();// w w w.j a  va2s. c o m
    X509v2CRLBuilder crlGen = new X509v2CRLBuilder(x500nameIssuer, now);

    crlGen.setNextUpdate(new Date(now.getTime() + (60 * 60 * 1000)));

    crlGen.addCRLEntry(certToRevoke.getSerialNumber(), dateOfRevoke, reason);

    JcaX509ExtensionUtils extUtils = new JcaX509ExtensionUtils();

    crlGen.addExtension(Extension.authorityKeyIdentifier, false,
            extUtils.createAuthorityKeyIdentifier(issuerEntry.getCertificate().getPublicKey()));

    X509CRLHolder crlHolder = crlGen
            .build(new JcaContentSignerBuilder(issuerEntry.getCertificate().getCertificate().getSigAlgName())
                    .setProvider(BouncyCastleProvider.PROVIDER_NAME).build(issuerEntry.getPrivateKey()));

    JcaX509CRLConverter converter = new JcaX509CRLConverter();
    return converter.getCRL(crlHolder);
}

---

From source file:eu.optimis.ics.BrokerVPNCredentials.BrokerCA.java

License:Open Source License

public byte[] getSignedCertificateBytes(byte[] sentCSRBytes) {
    X509CertificateHolder certHolder = null;
    byte[] result = null;

    try {/*from w w  w  .j  av a 2 s  . c o  m*/
        PKCS10CertificationRequest certRequest = new PKCS10CertificationRequest(sentCSRBytes);
        PEMReader r = new PEMReader(new FileReader(caPath + "ca.crt"));
        X509Certificate rootCert = (X509Certificate) r.readObject();
        r.close();

        X500Name subject = certRequest.getSubject();

        MessageDigest m = MessageDigest.getInstance("MD5");
        m.update(subject.toString().getBytes(), 0, subject.toString().length());

        BigInteger serial = new BigInteger(m.digest());

        Date notBefore = new Date(System.currentTimeMillis() - 1000L * 60 * 60 * 24 * 30);
        Date notAfter = new Date(System.currentTimeMillis() + (1000L * 60 * 60 * 24 * 365));

        SubjectPublicKeyInfo publicKeyInfo = certRequest.getSubjectPublicKeyInfo();

        X500Name issuer = new X500Name(rootCert.getSubjectDN().toString());

        X509v3CertificateBuilder v3CertBuilder = new X509v3CertificateBuilder(issuer, serial, notBefore,
                notAfter, subject, publicKeyInfo);

        v3CertBuilder.addExtension(X509Extension.subjectKeyIdentifier, false,
                new JcaX509ExtensionUtils().createSubjectKeyIdentifier(publicKeyInfo));
        v3CertBuilder.addExtension(X509Extension.authorityKeyIdentifier, false,
                new JcaX509ExtensionUtils().createAuthorityKeyIdentifier(rootCert));
        v3CertBuilder.addExtension(X509Extension.basicConstraints, false, new BasicConstraints(false));
        v3CertBuilder.addExtension(X509Extension.extendedKeyUsage, false,
                new ExtendedKeyUsage(KeyPurposeId.id_kp_ipsecEndSystem));
        v3CertBuilder.addExtension(X509Extension.keyUsage, false, new KeyUsage(KeyUsage.digitalSignature));

        ContentSigner sigGen = new JcaContentSignerBuilder("SHA1withRSA").setProvider("BC")
                .build(loadCAPrivateKey(caPath));
        certHolder = v3CertBuilder.build(sigGen);
        result = certHolder.getEncoded();
    } catch (Exception e) {
        e.printStackTrace();
    }
    return result;
}

---

From source file:eu.optimis.ics.BrokerVPNCredentials.CACredentials.java

License:Open Source License

public X509CertificateHolder genCACertificate(KeyPair CAKP) throws CertIOException, NoSuchAlgorithmException {
    BigInteger serial = BigInteger.valueOf(42);

    Date notBefore = new Date(System.currentTimeMillis() - 1000L * 60 * 60 * 24 * 30);
    Date notAfter = new Date(System.currentTimeMillis() + (1000L * 60 * 60 * 24 * 365));

    SubjectPublicKeyInfo publicKeyInfo = SubjectPublicKeyInfo.getInstance(CAKP.getPublic().getEncoded());

    // Same issuer and subject for the self-signed CA certificate
    X500Name issuer = new X500Name(
            "C=UK, ST=Suffolk, L=Ipswich, O=BT, OU=R&T, CN=CloudShadow, Name=Ali, emailAddress=ali.sajjad@bt.com");
    X500Name subject = new X500Name(
            "C=UK, ST=Suffolk, L=Ipswich, O=BT, OU=R&T, CN=CloudShadow, Name=Ali, emailAddress=ali.sajjad@bt.com");

    X509v3CertificateBuilder v3CertBuilder = new X509v3CertificateBuilder(issuer, serial, notBefore, notAfter,
            subject, publicKeyInfo);/*  www .  j  av  a2 s.com*/

    GeneralNames gNames = new GeneralNames(new GeneralName(issuer));
    v3CertBuilder.addExtension(X509Extension.subjectKeyIdentifier, false,
            new JcaX509ExtensionUtils().createSubjectKeyIdentifier(publicKeyInfo));
    v3CertBuilder.addExtension(X509Extension.authorityKeyIdentifier, false,
            new AuthorityKeyIdentifier(publicKeyInfo, gNames, serial));
    v3CertBuilder.addExtension(X509Extension.basicConstraints, false, new BasicConstraints(true));

    ContentSigner sigGen = null;

    try {
        sigGen = new JcaContentSignerBuilder("SHA1withRSA").setProvider("BC").build(CAKP.getPrivate());
    } catch (OperatorCreationException e) {
        e.printStackTrace();
    }
    return v3CertBuilder.build(sigGen);
}

---

• «
• 1
• 2
• 3
• 4
• 5
• 6
• 7
• 8
• 9
• 10
• 11
• 12
• 13
• 14
• 15
• 16
• 17
• 18
• 19
• 20
• 21
• 22
• 23
• 24
• 25
• 26
• 27
• 28
• 29
• 30
• 31
• 32
• 33
• 34
• 35
• 36
• 37
• 38
• 39
• 40
• 41
• 42
• 43
• »