Example usage for org.bouncycastle.operator.jcajce JcaContentSignerBuilder JcaContentSignerBuilder

List of usage examples for org.bouncycastle.operator.jcajce JcaContentSignerBuilder JcaContentSignerBuilder

  1. HOME
  2. Java
  3. org.bouncycastle
  4. org.bouncycastle.operator.jcajce.*
  5. JcaContentSignerBuilder
  6. JcaContentSignerBuilder

Introduction

In this page you can find the example usage for org.bouncycastle.operator.jcajce JcaContentSignerBuilder JcaContentSignerBuilder.

Prototype

public JcaContentSignerBuilder(String signatureAlgorithm)

Source Link

Usage

From source file:eu.optimis.ics.BrokerVPNCredentials.PeerCredManager.java

License:Open Source License

public PKCS10CertificationRequest genCertificationRequest(KeyPair peerKP) {

    X500Name name = new X500Name("CN=" + peerName + ", OU=ARSES, O=ARSES, L=Madrid, C=ES");
    SubjectPublicKeyInfo publicKeyInfo = null;
    PKCS10CertificationRequest certRequest = null;
    ContentSigner sigGen = null;/*from   www  . j a v  a 2 s. com*/

    try {
        publicKeyInfo = new SubjectPublicKeyInfo(
                (ASN1Sequence) ASN1ObjectIdentifier.fromByteArray(peerKP.getPublic().getEncoded()));
    } catch (IOException e1) {
        e1.printStackTrace();
    }

    PKCS10CertificationRequestBuilder pb = new PKCS10CertificationRequestBuilder(name, publicKeyInfo);

    try {
        sigGen = new JcaContentSignerBuilder("SHA1withRSA").setProvider("BC").build(peerKP.getPrivate());

    } catch (OperatorCreationException e) {
        e.printStackTrace();
    }

    certRequest = pb.build(sigGen);
    return certRequest;
}

From source file:eu.optimis.ics.Credentials.CACredentials.java

License:Open Source License

protected X509CertificateHolder genCACertificate(KeyPair CAKP) {
    BigInteger serial = BigInteger.valueOf(new SecureRandom().nextLong()).abs();

    Date notBefore = new Date(System.currentTimeMillis() - 1000L * 60 * 60 * 24 * 30);
    Date notAfter = new Date(System.currentTimeMillis() + (1000L * 60 * 60 * 24 * 365));

    SubjectPublicKeyInfo publicKeyInfo = SubjectPublicKeyInfo.getInstance(CAKP.getPublic().getEncoded());

    // Same issuer and subject for the self-signed CA certificate
    X500Name issuer = new X500Name(
            "C=UK, ST=Suffolk, L=Ipswich, O=BT, OU=R&T, CN=CloudShadow, Name=Ali, emailAddress=ali.sajjad@bt.com");
    X500Name subject = new X500Name(
            "C=UK, ST=Suffolk, L=Ipswich, O=BT, OU=R&T, CN=CloudShadow, Name=Ali, emailAddress=ali.sajjad@bt.com");

    X509v3CertificateBuilder v3CertBuilder = new X509v3CertificateBuilder(issuer, serial, notBefore, notAfter,
            subject, publicKeyInfo);//w  w  w.j  a va2  s  . c  o m

    GeneralNames gNames = new GeneralNames(new GeneralName(issuer));
    v3CertBuilder.addExtension(X509Extension.subjectKeyIdentifier, false,
            new SubjectKeyIdentifier(publicKeyInfo));
    v3CertBuilder.addExtension(X509Extension.authorityKeyIdentifier, false,
            new AuthorityKeyIdentifier(publicKeyInfo, gNames, serial));
    v3CertBuilder.addExtension(X509Extension.basicConstraints, false, new BasicConstraints(true));

    ContentSigner sigGen = null;

    try {
        sigGen = new JcaContentSignerBuilder("SHA1withRSA").setProvider("BC").build(CAKP.getPrivate());
    } catch (OperatorCreationException e) {
        e.printStackTrace();
    }
    return v3CertBuilder.build(sigGen);
}

From source file:eu.optimis.ics.Credentials.CertificateGenerator.java

License:Open Source License

public static X509CertificateHolder genServerCertificate(PKCS10CertificationRequest certRequest,
        String credPath) {/*  w  w  w .j  a  v a2s  .  c o m*/
    X509v3CertificateBuilder v3CertBuilder = null;
    ContentSigner sigGen = null;
    try {

        PEMReader r = new PEMReader(new FileReader(credPath + "ca.crt"));
        X509Certificate rootCert = (X509Certificate) r.readObject();
        r.close();

        BigInteger serial = BigInteger.ONE;

        Date notBefore = new Date(System.currentTimeMillis() - 1000L * 60 * 60 * 24 * 30);
        Date notAfter = new Date(System.currentTimeMillis() + (1000L * 60 * 60 * 24 * 365 * 10));

        SubjectPublicKeyInfo publicKeyInfo = SubjectPublicKeyInfo
                .getInstance(certRequest.getPublicKey().getEncoded());

        X500Name issuer = new X500Name(rootCert.getSubjectDN().toString());
        System.out.println(issuer.toString());
        @SuppressWarnings("deprecation")
        X500Name subject = new X500Name(certRequest.getCertificationRequestInfo().getSubject().toString());

        v3CertBuilder = new X509v3CertificateBuilder(issuer, serial, notBefore, notAfter, subject,
                publicKeyInfo);

        v3CertBuilder.addExtension(X509Extension.subjectKeyIdentifier, false,
                new SubjectKeyIdentifier(publicKeyInfo));
        v3CertBuilder.addExtension(X509Extension.authorityKeyIdentifier, false,
                new AuthorityKeyIdentifierStructure(rootCert));
        v3CertBuilder.addExtension(X509Extension.basicConstraints, false, new BasicConstraints(false));
        v3CertBuilder.addExtension(X509Extension.extendedKeyUsage, false,
                new ExtendedKeyUsage(KeyPurposeId.id_kp_serverAuth));
        v3CertBuilder.addExtension(X509Extension.keyUsage, false,
                new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyEncipherment));

        sigGen = new JcaContentSignerBuilder("SHA1withRSA").setProvider("BC").build(loadCAPrivateKey(credPath));

    } catch (IOException ioe) {
        ioe.printStackTrace();
    } catch (InvalidKeyException e) {
        e.printStackTrace();
    } catch (NoSuchAlgorithmException e) {
        e.printStackTrace();
    } catch (NoSuchProviderException e) {
        e.printStackTrace();
    } catch (OperatorCreationException e) {
        e.printStackTrace();
    } catch (InvalidKeySpecException e) {
        e.printStackTrace();
    } catch (CertificateParsingException e) {
        e.printStackTrace();
    }

    return v3CertBuilder.build(sigGen);
}

From source file:eu.optimis.ics.Credentials.CertificateGenerator.java

License:Open Source License

public static X509CertificateHolder genClientCertificate(PKCS10CertificationRequest certRequest,
        String credPath) throws Exception {
    PEMReader r = new PEMReader(new FileReader(credPath + "ca.crt"));
    X509Certificate rootCert = (X509Certificate) r.readObject();
    r.close();/*w  w  w. jav a  2  s .  c o m*/

    BigInteger serial = BigInteger.valueOf(2).abs();

    Date notBefore = new Date(System.currentTimeMillis() - 1000L * 60 * 60 * 24 * 30);
    Date notAfter = new Date(System.currentTimeMillis() + (1000L * 60 * 60 * 24 * 365 * 10));

    SubjectPublicKeyInfo publicKeyInfo = SubjectPublicKeyInfo
            .getInstance(certRequest.getPublicKey().getEncoded());

    X500Name issuer = new X500Name(rootCert.getSubjectDN().toString());

    @SuppressWarnings("deprecation")
    X500Name subject = new X500Name(certRequest.getCertificationRequestInfo().getSubject().toString());

    X509v3CertificateBuilder v3CertBuilder = new X509v3CertificateBuilder(issuer, serial, notBefore, notAfter,
            subject, publicKeyInfo);

    v3CertBuilder.addExtension(X509Extension.subjectKeyIdentifier, false,
            new SubjectKeyIdentifier(publicKeyInfo));
    v3CertBuilder.addExtension(X509Extension.authorityKeyIdentifier, false,
            new AuthorityKeyIdentifierStructure(rootCert));
    v3CertBuilder.addExtension(X509Extension.basicConstraints, false, new BasicConstraints(false));
    v3CertBuilder.addExtension(X509Extension.extendedKeyUsage, false,
            new ExtendedKeyUsage(KeyPurposeId.id_kp_clientAuth));
    v3CertBuilder.addExtension(X509Extension.keyUsage, false, new KeyUsage(KeyUsage.digitalSignature));

    ContentSigner sigGen = null;

    try {
        sigGen = new JcaContentSignerBuilder("SHA1withRSA").setProvider("BC").build(loadCAPrivateKey(credPath));
    } catch (OperatorCreationException e) {
        e.printStackTrace();
    }

    return v3CertBuilder.build(sigGen);
}

From source file:eu.peppol.security.x509.CertificateTest.java

License:EUPL

/**
 * Creates a X509 V3 certificate using Bouncy Castle
 *
 * @throws NoSuchAlgorithmException//  ww  w  .j  a  v  a  2 s .c  o  m
 * @throws OperatorCreationException
 * @throws CertificateException
 * @throws NoSuchProviderException
 */
@Test(enabled = false)
public void createSampleCertificate() throws NoSuchAlgorithmException, OperatorCreationException,
        CertificateException, NoSuchProviderException {
    KeyPair keyPair = generateKeyPair();

    ContentSigner sigGen = new JcaContentSignerBuilder("SHA256WithRSAEncryption")
            .setProvider(BouncyCastleProvider.PROVIDER_NAME).build(keyPair.getPrivate());

    Date startDate = new Date(System.currentTimeMillis() - 24 * 60 * 60 * 1000);
    Date endDate = new Date(System.currentTimeMillis() + 365 * 24 * 60 * 60 * 1000);

    SubjectPublicKeyInfo subjectPublicKeyInfo = SubjectPublicKeyInfo
            .getInstance(keyPair.getPublic().getEncoded());

    X509v3CertificateBuilder x509v3CertificateBuilder = new X509v3CertificateBuilder(
            new X500Name("CN=AP_UNIT_TEST"), BigInteger.ONE, startDate, endDate,
            new X500Name("CN=AP_UNIT_TEST"), subjectPublicKeyInfo);
    X509CertificateHolder x509CertificateHolder = x509v3CertificateBuilder.build(sigGen);
    X509Certificate cert = new JcaX509CertificateConverter().setProvider(BouncyCastleProvider.PROVIDER_NAME)
            .getCertificate(x509CertificateHolder);

}

From source file:ezbake.crypto.RSAKeyCrypto.java

License:Apache License

private String generatePKCS10(String dn) {
    String pem = null;/*  w  w  w.j  a v a  2s.  c  om*/
    X500Principal x500p = new X500Principal(dn);
    PKCS10CertificationRequestBuilder p10Builder = new JcaPKCS10CertificationRequestBuilder(x500p,
            this.publicKey);

    JcaContentSignerBuilder csBuilder = new JcaContentSignerBuilder(algorithm);

    try {
        ContentSigner signer = csBuilder.build(this.privateKey);
        org.bouncycastle.pkcs.PKCS10CertificationRequest csr = p10Builder.build(signer);

        ByteArrayOutputStream baos = new ByteArrayOutputStream();
        PrintWriter writer = new PrintWriter(baos);

        PEMWriter out = new PEMWriter(writer);
        out.writeObject(csr);
        out.close();

        pem = new String(baos.toByteArray());

    } catch (OperatorCreationException e) {
        // TODO Auto-generated catch block
        e.printStackTrace();
    } catch (IOException e) {
        // TODO Auto-generated catch block
        e.printStackTrace();
    }

    return pem;

}

From source file:fathom.x509.X509Utils.java

License:Apache License

/**
 * Creates a new SSL certificate signed by the CA private key and stored in
 * keyStore./*  w ww . j  a  v a 2  s  . c o m*/
 *
 * @param sslMetadata
 * @param caPrivateKey
 * @param caCert
 * @param targetStoreFile
 * @param x509log
 */
public static X509Certificate newSSLCertificate(X509Metadata sslMetadata, PrivateKey caPrivateKey,
        X509Certificate caCert, File targetStoreFile, X509Log x509log) {
    try {
        KeyPair pair = newKeyPair();

        X500Name webDN = buildDistinguishedName(sslMetadata);
        X500Name issuerDN = new X500Name(PrincipalUtil.getIssuerX509Principal(caCert).getName());

        X509v3CertificateBuilder certBuilder = new JcaX509v3CertificateBuilder(issuerDN,
                BigInteger.valueOf(System.currentTimeMillis()), sslMetadata.notBefore, sslMetadata.notAfter,
                webDN, pair.getPublic());

        JcaX509ExtensionUtils extUtils = new JcaX509ExtensionUtils();
        certBuilder.addExtension(X509Extension.subjectKeyIdentifier, false,
                extUtils.createSubjectKeyIdentifier(pair.getPublic()));
        certBuilder.addExtension(X509Extension.basicConstraints, false, new BasicConstraints(false));
        certBuilder.addExtension(X509Extension.authorityKeyIdentifier, false,
                extUtils.createAuthorityKeyIdentifier(caCert.getPublicKey()));

        // support alternateSubjectNames for SSL certificates
        List<GeneralName> altNames = new ArrayList<GeneralName>();
        if (isIpAddress(sslMetadata.commonName)) {
            altNames.add(new GeneralName(GeneralName.iPAddress, sslMetadata.commonName));
        }
        if (altNames.size() > 0) {
            GeneralNames subjectAltName = new GeneralNames(altNames.toArray(new GeneralName[altNames.size()]));
            certBuilder.addExtension(X509Extension.subjectAlternativeName, false, subjectAltName);
        }

        ContentSigner caSigner = new JcaContentSignerBuilder(SIGNING_ALGORITHM).setProvider(BC)
                .build(caPrivateKey);
        X509Certificate cert = new JcaX509CertificateConverter().setProvider(BC)
                .getCertificate(certBuilder.build(caSigner));

        cert.checkValidity(new Date());
        cert.verify(caCert.getPublicKey());

        // Save to keystore
        KeyStore serverStore = openKeyStore(targetStoreFile, sslMetadata.password);
        serverStore.setKeyEntry(sslMetadata.commonName, pair.getPrivate(), sslMetadata.password.toCharArray(),
                new Certificate[] { cert, caCert });
        saveKeyStore(targetStoreFile, serverStore, sslMetadata.password);

        x509log.log(MessageFormat.format("New SSL certificate {0,number,0} [{1}]", cert.getSerialNumber(),
                cert.getSubjectDN().getName()));

        // update serial number in metadata object
        sslMetadata.serialNumber = cert.getSerialNumber().toString();

        return cert;
    } catch (Throwable t) {
        throw new RuntimeException("Failed to generate SSL certificate!", t);
    }
}

From source file:fathom.x509.X509Utils.java

License:Apache License

/**
 * Creates a new certificate authority PKCS#12 store.  This function will
 * destroy any existing CA store.//from www. ja  va 2  s  . c om
 *
 * @param metadata
 * @param storeFile
 * @param x509log
 * @return
 */
public static X509Certificate newCertificateAuthority(X509Metadata metadata, File storeFile, X509Log x509log) {
    try {
        KeyPair caPair = newKeyPair();

        ContentSigner caSigner = new JcaContentSignerBuilder(SIGNING_ALGORITHM).setProvider(BC)
                .build(caPair.getPrivate());

        // clone metadata
        X509Metadata caMetadata = metadata.clone(CA_CN, metadata.password);
        X500Name issuerDN = buildDistinguishedName(caMetadata);

        // Generate self-signed certificate
        X509v3CertificateBuilder caBuilder = new JcaX509v3CertificateBuilder(issuerDN,
                BigInteger.valueOf(System.currentTimeMillis()), caMetadata.notBefore, caMetadata.notAfter,
                issuerDN, caPair.getPublic());

        JcaX509ExtensionUtils extUtils = new JcaX509ExtensionUtils();
        caBuilder.addExtension(X509Extension.subjectKeyIdentifier, false,
                extUtils.createSubjectKeyIdentifier(caPair.getPublic()));
        caBuilder.addExtension(X509Extension.authorityKeyIdentifier, false,
                extUtils.createAuthorityKeyIdentifier(caPair.getPublic()));
        caBuilder.addExtension(X509Extension.basicConstraints, false, new BasicConstraints(true));
        caBuilder.addExtension(X509Extension.keyUsage, true,
                new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyCertSign | KeyUsage.cRLSign));

        JcaX509CertificateConverter converter = new JcaX509CertificateConverter().setProvider(BC);
        X509Certificate cert = converter.getCertificate(caBuilder.build(caSigner));

        // confirm the validity of the CA certificate
        cert.checkValidity(new Date());
        cert.verify(cert.getPublicKey());

        // Delete existing keystore
        if (storeFile.exists()) {
            storeFile.delete();
        }

        // Save private key and certificate to new keystore
        KeyStore store = openKeyStore(storeFile, caMetadata.password);
        store.setKeyEntry(CA_ALIAS, caPair.getPrivate(), caMetadata.password.toCharArray(),
                new Certificate[] { cert });
        saveKeyStore(storeFile, store, caMetadata.password);

        x509log.log(MessageFormat.format("New CA certificate {0,number,0} [{1}]", cert.getSerialNumber(),
                cert.getIssuerDN().getName()));

        // update serial number in metadata object
        caMetadata.serialNumber = cert.getSerialNumber().toString();

        return cert;
    } catch (Throwable t) {
        throw new RuntimeException("Failed to generate Fathom CA certificate!", t);
    }
}

From source file:fathom.x509.X509Utils.java

License:Apache License

/**
 * Creates a new certificate revocation list (CRL).  This function will
 * destroy any existing CRL file.//from   w  w  w.java 2s  . c  o m
 *
 * @param caRevocationList
 * @param caKeystoreFile
 * @param caKeystorePassword
 * @return
 */
public static void newCertificateRevocationList(File caRevocationList, File caKeystoreFile,
        String caKeystorePassword) {
    try {
        // read the Fathom CA key and certificate
        KeyStore store = openKeyStore(caKeystoreFile, caKeystorePassword);
        PrivateKey caPrivateKey = (PrivateKey) store.getKey(CA_ALIAS, caKeystorePassword.toCharArray());
        X509Certificate caCert = (X509Certificate) store.getCertificate(CA_ALIAS);

        X500Name issuerDN = new X500Name(PrincipalUtil.getIssuerX509Principal(caCert).getName());
        X509v2CRLBuilder crlBuilder = new X509v2CRLBuilder(issuerDN, new Date());

        // build and sign CRL with CA private key
        ContentSigner signer = new JcaContentSignerBuilder(SIGNING_ALGORITHM).setProvider(BC)
                .build(caPrivateKey);
        X509CRLHolder crl = crlBuilder.build(signer);

        File tmpFile = new File(caRevocationList.getParentFile(),
                Long.toHexString(System.currentTimeMillis()) + ".tmp");
        FileOutputStream fos = null;
        try {
            fos = new FileOutputStream(tmpFile);
            fos.write(crl.getEncoded());
            fos.flush();
            fos.close();
            if (caRevocationList.exists()) {
                caRevocationList.delete();
            }
            tmpFile.renameTo(caRevocationList);
        } finally {
            if (fos != null) {
                fos.close();
            }
            if (tmpFile.exists()) {
                tmpFile.delete();
            }
        }
    } catch (Exception e) {
        throw new RuntimeException("Failed to create new certificate revocation list " + caRevocationList, e);
    }
}

From source file:fathom.x509.X509Utils.java

License:Apache License

/**
 * Creates a new client certificate PKCS#12 and PEM store.  Any existing
 * stores are destroyed.// ww w.j  ava  2  s . com
 *
 * @param clientMetadata a container for dynamic parameters needed for generation
 * @param caPrivateKey
 * @param caCert
 * @param targetFolder
 * @return
 */
public static X509Certificate newClientCertificate(X509Metadata clientMetadata, PrivateKey caPrivateKey,
        X509Certificate caCert, File targetFolder) {
    try {
        KeyPair pair = newKeyPair();

        X500Name userDN = buildDistinguishedName(clientMetadata);
        X500Name issuerDN = new X500Name(PrincipalUtil.getIssuerX509Principal(caCert).getName());

        // create a new certificate signed by the Fathom CA certificate
        X509v3CertificateBuilder certBuilder = new JcaX509v3CertificateBuilder(issuerDN,
                BigInteger.valueOf(System.currentTimeMillis()), clientMetadata.notBefore,
                clientMetadata.notAfter, userDN, pair.getPublic());

        JcaX509ExtensionUtils extUtils = new JcaX509ExtensionUtils();
        certBuilder.addExtension(X509Extension.subjectKeyIdentifier, false,
                extUtils.createSubjectKeyIdentifier(pair.getPublic()));
        certBuilder.addExtension(X509Extension.basicConstraints, false, new BasicConstraints(false));
        certBuilder.addExtension(X509Extension.authorityKeyIdentifier, false,
                extUtils.createAuthorityKeyIdentifier(caCert.getPublicKey()));
        certBuilder.addExtension(X509Extension.keyUsage, true,
                new KeyUsage(KeyUsage.keyEncipherment | KeyUsage.digitalSignature));
        if (!Strings.isNullOrEmpty(clientMetadata.emailAddress)) {
            GeneralNames subjectAltName = new GeneralNames(
                    new GeneralName(GeneralName.rfc822Name, clientMetadata.emailAddress));
            certBuilder.addExtension(X509Extension.subjectAlternativeName, false, subjectAltName);
        }

        ContentSigner signer = new JcaContentSignerBuilder(SIGNING_ALGORITHM).setProvider(BC)
                .build(caPrivateKey);

        X509Certificate userCert = new JcaX509CertificateConverter().setProvider(BC)
                .getCertificate(certBuilder.build(signer));
        PKCS12BagAttributeCarrier bagAttr = (PKCS12BagAttributeCarrier) pair.getPrivate();
        bagAttr.setBagAttribute(PKCSObjectIdentifiers.pkcs_9_at_localKeyId,
                extUtils.createSubjectKeyIdentifier(pair.getPublic()));

        // confirm the validity of the user certificate
        userCert.checkValidity();
        userCert.verify(caCert.getPublicKey());
        userCert.getIssuerDN().equals(caCert.getSubjectDN());

        // verify user certificate chain
        verifyChain(userCert, caCert);

        targetFolder.mkdirs();

        // save certificate, stamped with unique name
        String date = new SimpleDateFormat("yyyyMMdd").format(new Date());
        String id = date;
        File certFile = new File(targetFolder, id + ".cer");
        int count = 0;
        while (certFile.exists()) {
            id = date + "_" + Character.toString((char) (0x61 + count));
            certFile = new File(targetFolder, id + ".cer");
            count++;
        }

        // save user private key, user certificate and CA certificate to a PKCS#12 store
        File p12File = new File(targetFolder, clientMetadata.commonName + ".p12");
        if (p12File.exists()) {
            p12File.delete();
        }
        KeyStore userStore = openKeyStore(p12File, clientMetadata.password);
        userStore.setKeyEntry(
                MessageFormat.format("Fathom ({0}) {1} {2}", clientMetadata.serverHostname,
                        clientMetadata.userDisplayname, id),
                pair.getPrivate(), null, new Certificate[] { userCert });
        userStore.setCertificateEntry(
                MessageFormat.format("Fathom ({0}) Certificate Authority", clientMetadata.serverHostname),
                caCert);
        saveKeyStore(p12File, userStore, clientMetadata.password);

        // save user private key, user certificate, and CA certificate to a PEM store
        File pemFile = new File(targetFolder, clientMetadata.commonName + ".pem");
        if (pemFile.exists()) {
            pemFile.delete();
        }
        PEMWriter pemWriter = new PEMWriter(new FileWriter(pemFile));
        pemWriter.writeObject(pair.getPrivate(), "DES-EDE3-CBC", clientMetadata.password.toCharArray(),
                new SecureRandom());
        pemWriter.writeObject(userCert);
        pemWriter.writeObject(caCert);
        pemWriter.flush();
        pemWriter.close();

        // save certificate after successfully creating the key stores
        saveCertificate(userCert, certFile);

        // update serial number in metadata object
        clientMetadata.serialNumber = userCert.getSerialNumber().toString();

        return userCert;
    } catch (Throwable t) {
        throw new RuntimeException("Failed to generate client certificate!", t);
    }
}