Example usage for org.bouncycastle.operator.jcajce JcaContentSignerBuilder JcaContentSignerBuilder

Introduction

In this page you can find the example usage for org.bouncycastle.operator.jcajce JcaContentSignerBuilder JcaContentSignerBuilder.

Prototype

public JcaContentSignerBuilder(String signatureAlgorithm) 

Source Link

Usage

From source file:net.jmhertlein.mcanalytics.api.auth.SSLUtil.java

License:Open Source License

public static PKCS10CertificationRequest newCertificateRequest(X500Name principal, KeyPair p) {
    try {/* ww w.  ja  va  2 s  .c o  m*/
        PKCS10CertificationRequestBuilder b = new JcaPKCS10CertificationRequestBuilder(principal,
                p.getPublic());
        ContentSigner s = new JcaContentSignerBuilder(SIGNING_ALGORITHM).setProvider("BC")
                .build(p.getPrivate());
        return b.build(s);
    } catch (OperatorCreationException ex) {
        Logger.getLogger(SSLUtil.class.getName()).log(Level.SEVERE, null, ex);
        return null;
    }
}

---

From source file:net.jmhertlein.mcanalytics.api.auth.SSLUtil.java

License:Open Source License

/**
 * Creates a new self-signed X509 certificate
 *
 * @param pair the public/private keypair- the pubkey will be added to the cert and the private
 * key will be used to sign the certificate
 * @param subject the distinguished name of the subject
 * @param isAuthority true to make the cert a CA cert, false otherwise
 * @return/*from w ww.  ja v  a 2s.  co  m*/
 */
public static X509Certificate newSelfSignedCertificate(KeyPair pair, X500Name subject, boolean isAuthority) {
    X509v3CertificateBuilder b = new JcaX509v3CertificateBuilder(subject,
            BigInteger.probablePrime(128, new SecureRandom()), Date.from(Instant.now().minusSeconds(1)),
            Date.from(LocalDateTime.now().plusYears(3).toInstant(ZoneOffset.UTC)), subject, pair.getPublic());
    try {
        b.addExtension(Extension.basicConstraints, true, new BasicConstraints(isAuthority));
    } catch (CertIOException ex) {
        Logger.getLogger(SSLUtil.class.getName()).log(Level.SEVERE, null, ex);
    }

    try {
        X509CertificateHolder bcCert = b.build(
                new JcaContentSignerBuilder(SIGNING_ALGORITHM).setProvider("BC").build(pair.getPrivate()));
        return new JcaX509CertificateConverter().setProvider("BC").getCertificate(bcCert);
    } catch (CertificateException | OperatorCreationException ex) {
        Logger.getLogger(SSLUtil.class.getName()).log(Level.SEVERE, null, ex);
        return null;
    }
}

---

From source file:net.jmhertlein.mcanalytics.api.auth.SSLUtil.java

License:Open Source License

/**
 * Given a certificate signing request, produce a signed certificate.
 *
 * @param caKey//from   www .  ja va  2s.  c o  m
 * @param caCert
 * @param r
 * @param makeAuthority
 * @return
 */
public static X509Certificate fulfillCertRequest(PrivateKey caKey, X509Certificate caCert,
        PKCS10CertificationRequest r, boolean makeAuthority) {
    X509v3CertificateBuilder b = new JcaX509v3CertificateBuilder(new X500Name(caCert.getSubjectDN().getName()), // the order of O,OU,CN returned is very important
            BigInteger.probablePrime(128, new SecureRandom()), Date.from(Instant.now().minusSeconds(1)),
            Date.from(LocalDateTime.now().plusYears(3).toInstant(ZoneOffset.UTC)), r.getSubject(),
            getPublicKeyFromInfo(r.getSubjectPublicKeyInfo()));

    try {
        b.addExtension(Extension.basicConstraints, true, new BasicConstraints(makeAuthority));
    } catch (CertIOException ex) {
        Logger.getLogger(SSLUtil.class.getName()).log(Level.SEVERE, null, ex);
    }

    try {
        ContentSigner signer = new JcaContentSignerBuilder(SIGNING_ALGORITHM).setProvider("BC").build(caKey);
        X509CertificateHolder build = b.build(signer);
        return new JcaX509CertificateConverter().setProvider("BC").getCertificate(build);
    } catch (OperatorCreationException | CertificateException ex) {
        Logger.getLogger(SSLUtil.class.getName()).log(Level.SEVERE, null, ex);
        return null;
    }
}

---

From source file:net.jsign.PESigner.java

License:Apache License

private CMSSignedData createSignature(PEFile file)
        throws IOException, CMSException, OperatorCreationException, CertificateEncodingException {
    byte[] sha = file.computeDigest(algo);

    AlgorithmIdentifier algorithmIdentifier = new AlgorithmIdentifier(algo.oid, DERNull.INSTANCE);
    DigestInfo digestInfo = new DigestInfo(algorithmIdentifier, sha);
    SpcAttributeTypeAndOptionalValue data = new SpcAttributeTypeAndOptionalValue(
            AuthenticodeObjectIdentifiers.SPC_PE_IMAGE_DATA_OBJID, new SpcPeImageData());
    SpcIndirectDataContent spcIndirectDataContent = new SpcIndirectDataContent(data, digestInfo);

    ContentSigner shaSigner = new JcaContentSignerBuilder(algo + "with" + privateKey.getAlgorithm())
            .build(privateKey);/*from  w  w  w. j  a v  a2  s.c om*/
    DigestCalculatorProvider digestCalculatorProvider = new JcaDigestCalculatorProviderBuilder().build();

    // prepare the authenticated attributes
    CMSAttributeTableGenerator attributeTableGenerator = new DefaultSignedAttributeTableGenerator(
            createAuthenticatedAttributes());

    // fetch the signing certificate
    X509CertificateHolder certificate = new JcaX509CertificateHolder((X509Certificate) chain[0]);

    // prepare the signerInfo with the extra authenticated attributes
    SignerInfoGeneratorBuilder signerInfoGeneratorBuilder = new SignerInfoGeneratorBuilder(
            digestCalculatorProvider);
    signerInfoGeneratorBuilder.setSignedAttributeGenerator(attributeTableGenerator);
    SignerInfoGenerator signerInfoGenerator = signerInfoGeneratorBuilder.build(shaSigner, certificate);

    AuthenticodeSignedDataGenerator generator = new AuthenticodeSignedDataGenerator();
    generator.addCertificates(new JcaCertStore(removeRoot(chain)));
    generator.addSignerInfoGenerator(signerInfoGenerator);

    return generator.generate(AuthenticodeObjectIdentifiers.SPC_INDIRECT_DATA_OBJID, spcIndirectDataContent);
}

---

From source file:net.link.util.common.KeyUtils.java

License:Open Source License

public static X509Certificate generateCertificate(PublicKey subjectPublicKey, String subjectDn,
        PrivateKey issuerPrivateKey, @Nullable X509Certificate issuerCert, DateTime notBefore,
        DateTime notAfter, String inSignatureAlgorithm, boolean caCert, boolean timeStampingPurpose,
        @Nullable URI ocspUri) {/*w ww  .ja  va2s . co m*/

    try {
        String signatureAlgorithm = inSignatureAlgorithm;
        if (null == signatureAlgorithm)
            signatureAlgorithm = String.format("SHA1With%s", issuerPrivateKey.getAlgorithm());

        X509Principal issuerDN;
        if (null != issuerCert)
            issuerDN = new X509Principal(issuerCert.getSubjectX500Principal().toString());
        else
            issuerDN = new X509Principal(subjectDn);

        // new bc 2.0 API
        X509Principal subject = new X509Principal(subjectDn);
        SubjectPublicKeyInfo publicKeyInfo = SubjectPublicKeyInfo.getInstance(subjectPublicKey.getEncoded());
        BigInteger serialNumber = new BigInteger(SERIALNUMBER_NUM_BITS, new SecureRandom());

        X509v3CertificateBuilder certificateBuilder = new X509v3CertificateBuilder(
                X500Name.getInstance(issuerDN.toASN1Primitive()), serialNumber, notBefore.toDate(),
                notAfter.toDate(), X500Name.getInstance(subject.toASN1Primitive()), publicKeyInfo);

        // prepare signer
        ContentSigner signer = new JcaContentSignerBuilder(signatureAlgorithm).build(issuerPrivateKey);
        certificateBuilder.addExtension(X509Extension.subjectKeyIdentifier, false,
                createSubjectKeyId(subjectPublicKey));
        PublicKey issuerPublicKey;
        if (null != issuerCert)
            issuerPublicKey = issuerCert.getPublicKey();
        else
            issuerPublicKey = subjectPublicKey;
        certificateBuilder.addExtension(X509Extension.authorityKeyIdentifier, false,
                createAuthorityKeyId(issuerPublicKey));

        certificateBuilder.addExtension(X509Extension.basicConstraints, false, new BasicConstraints(caCert));

        if (timeStampingPurpose)
            certificateBuilder.addExtension(X509Extension.extendedKeyUsage, true,
                    new ExtendedKeyUsage(KeyPurposeId.id_kp_timeStamping));

        if (null != ocspUri) {
            GeneralName ocspName = new GeneralName(GeneralName.uniformResourceIdentifier, ocspUri.toString());
            AuthorityInformationAccess authorityInformationAccess = new AuthorityInformationAccess(
                    X509ObjectIdentifiers.ocspAccessMethod, ocspName);
            certificateBuilder.addExtension(X509Extension.authorityInfoAccess, false,
                    authorityInformationAccess);
        }

        // build
        return new JcaX509CertificateConverter().setProvider("BC")
                .getCertificate(certificateBuilder.build(signer));
    } catch (CertificateException e) {
        throw new InternalInconsistencyException("X.509 is not supported.", e);
    } catch (OperatorCreationException e) {
        throw new InternalInconsistencyException(e);
    } catch (CertIOException e) {
        throw new InternalInconsistencyException(e);
    }
}

---

From source file:net.link.util.test.pkix.PkiTestUtils.java

License:Open Source License

public static X509Certificate generateCertificate(PublicKey subjectPublicKey, String subjectDn,
        PrivateKey issuerPrivateKey, @Nullable X509Certificate issuerCert, DateTime notBefore,
        DateTime notAfter, @Nullable String signatureAlgorithm, boolean includeAuthorityKeyIdentifier,
        boolean caCert, boolean timeStampingPurpose, @Nullable URI ocspUri)
        throws IOException, CertificateException, OperatorCreationException {

    String finalSignatureAlgorithm = signatureAlgorithm;
    if (null == signatureAlgorithm)
        finalSignatureAlgorithm = "SHA512WithRSAEncryption";

    X509Principal issuerDN;/*w  ww  .j av a  2 s .co  m*/
    if (null != issuerCert)
        issuerDN = new X509Principal(issuerCert.getSubjectX500Principal().toString());
    else
        issuerDN = new X509Principal(subjectDn);

    // new bc 2.0 API
    X509Principal subject = new X509Principal(subjectDn);
    SubjectPublicKeyInfo publicKeyInfo = SubjectPublicKeyInfo.getInstance(subjectPublicKey.getEncoded());
    BigInteger serialNumber = new BigInteger(SERIALNUMBER_NUM_BITS, new SecureRandom());

    X509v3CertificateBuilder certificateBuilder = new X509v3CertificateBuilder(
            X500Name.getInstance(issuerDN.toASN1Primitive()), serialNumber, notBefore.toDate(),
            notAfter.toDate(), X500Name.getInstance(subject.toASN1Primitive()), publicKeyInfo);

    // prepare signer
    ContentSigner signer = new JcaContentSignerBuilder(finalSignatureAlgorithm).build(issuerPrivateKey);

    // add extensions
    certificateBuilder.addExtension(X509Extension.subjectKeyIdentifier, false,
            createSubjectKeyId(subjectPublicKey));
    PublicKey issuerPublicKey;
    if (null != issuerCert)
        issuerPublicKey = issuerCert.getPublicKey();
    else
        issuerPublicKey = subjectPublicKey;
    if (includeAuthorityKeyIdentifier)
        certificateBuilder.addExtension(X509Extension.authorityKeyIdentifier, false,
                createAuthorityKeyId(issuerPublicKey));

    certificateBuilder.addExtension(X509Extension.basicConstraints, false, new BasicConstraints(caCert));

    if (timeStampingPurpose)
        certificateBuilder.addExtension(X509Extension.extendedKeyUsage, true,
                new ExtendedKeyUsage(KeyPurposeId.id_kp_timeStamping));

    if (null != ocspUri) {
        GeneralName ocspName = new GeneralName(GeneralName.uniformResourceIdentifier,
                new DERIA5String(ocspUri.toString()));
        AuthorityInformationAccess authorityInformationAccess = new AuthorityInformationAccess(
                X509ObjectIdentifiers.ocspAccessMethod, ocspName);
        certificateBuilder.addExtension(X509Extension.authorityInfoAccess, false, authorityInformationAccess);
    }

    // build
    return new JcaX509CertificateConverter().setProvider("BC").getCertificate(certificateBuilder.build(signer));
}

---

From source file:net.maritimecloud.identityregistry.utils.CertificateUtil.java

License:Apache License

/**
 * Builds and signs a certificate. The certificate will be build on the given subject-public-key and signed with
 * the given issuer-private-key. The issuer and subject will be identified in the strings provided.
 *
 * @return A signed X509Certificate//from   w  ww .  ja  va 2  s  .c  o  m
 * @throws Exception
 */
public X509Certificate buildAndSignCert(BigInteger serialNumber, PrivateKey signerPrivateKey,
        PublicKey signerPublicKey, PublicKey subjectPublicKey, X500Name issuer, X500Name subject,
        Map<String, String> customAttrs, String type) throws Exception {
    // Dates are converted to GMT/UTC inside the cert builder 
    Calendar cal = Calendar.getInstance();
    Date now = cal.getTime();
    Date expire = new GregorianCalendar(CERT_EXPIRE_YEAR, 0, 1).getTime();
    X509v3CertificateBuilder certV3Bldr = new JcaX509v3CertificateBuilder(issuer, serialNumber, now, // Valid from now...
            expire, // until CERT_EXPIRE_YEAR
            subject, subjectPublicKey);
    JcaX509ExtensionUtils extensionUtil = new JcaX509ExtensionUtils();
    // Create certificate extensions
    if ("ROOTCA".equals(type)) {
        certV3Bldr = certV3Bldr.addExtension(Extension.basicConstraints, true, new BasicConstraints(true))
                .addExtension(Extension.keyUsage, true,
                        new X509KeyUsage(X509KeyUsage.digitalSignature | X509KeyUsage.nonRepudiation
                                | X509KeyUsage.keyEncipherment | X509KeyUsage.keyCertSign
                                | X509KeyUsage.cRLSign));
    } else if ("INTERMEDIATE".equals(type)) {
        certV3Bldr = certV3Bldr.addExtension(Extension.basicConstraints, true, new BasicConstraints(true))
                .addExtension(Extension.keyUsage, true,
                        new X509KeyUsage(X509KeyUsage.digitalSignature | X509KeyUsage.nonRepudiation
                                | X509KeyUsage.keyEncipherment | X509KeyUsage.keyCertSign
                                | X509KeyUsage.cRLSign));
    } else {
        // Subject Alternative Name
        GeneralName[] genNames = null;
        if (customAttrs != null && !customAttrs.isEmpty()) {
            genNames = new GeneralName[customAttrs.size()];
            Iterator<Map.Entry<String, String>> it = customAttrs.entrySet().iterator();
            int idx = 0;
            while (it.hasNext()) {
                Map.Entry<String, String> pair = it.next();
                //genNames[idx] = new GeneralName(GeneralName.otherName, new DERUTF8String(pair.getKey() + ";" + pair.getValue()));
                DERSequence othernameSequence = new DERSequence(
                        new ASN1Encodable[] { new ASN1ObjectIdentifier(pair.getKey()),
                                new DERTaggedObject(true, 0, new DERUTF8String(pair.getValue())) });
                genNames[idx] = new GeneralName(GeneralName.otherName, othernameSequence);
                idx++;
            }
        }
        if (genNames != null) {
            certV3Bldr = certV3Bldr.addExtension(Extension.subjectAlternativeName, false,
                    new GeneralNames(genNames));
        }
    }
    // Basic extension setup
    certV3Bldr = certV3Bldr
            .addExtension(Extension.authorityKeyIdentifier, false,
                    extensionUtil.createAuthorityKeyIdentifier(signerPublicKey))
            .addExtension(Extension.subjectKeyIdentifier, false,
                    extensionUtil.createSubjectKeyIdentifier(subjectPublicKey));
    // CRL Distribution Points
    DistributionPointName distPointOne = new DistributionPointName(
            new GeneralNames(new GeneralName(GeneralName.uniformResourceIdentifier, CRL_URL)));
    DistributionPoint[] distPoints = new DistributionPoint[1];
    distPoints[0] = new DistributionPoint(distPointOne, null, null);
    certV3Bldr.addExtension(Extension.cRLDistributionPoints, false, new CRLDistPoint(distPoints));
    // OCSP endpoint
    GeneralName ocspName = new GeneralName(GeneralName.uniformResourceIdentifier, OCSP_URL);
    AuthorityInformationAccess authorityInformationAccess = new AuthorityInformationAccess(
            X509ObjectIdentifiers.ocspAccessMethod, ocspName);
    certV3Bldr.addExtension(Extension.authorityInfoAccess, false, authorityInformationAccess);
    // Create the key signer
    JcaContentSignerBuilder builder = new JcaContentSignerBuilder(SIGNER_ALGORITHM);
    builder.setProvider(BC_PROVIDER_NAME);
    ContentSigner signer = builder.build(signerPrivateKey);
    return new JcaX509CertificateConverter().setProvider(BC_PROVIDER_NAME)
            .getCertificate(certV3Bldr.build(signer));
}

---

From source file:net.maritimecloud.identityregistry.utils.CertificateUtil.java

License:Apache License

/**
 * Creates a Certificate Revocation List (CRL) for the certificate serialnumbers given.
 * /*from   ww w.  j ava 2 s. co m*/
 * @param revokedCerts  List of the serialnumbers that should be revoked.
 * @return a X509 certificate
 */
public X509CRL generateCRL(List<net.maritimecloud.identityregistry.model.database.Certificate> revokedCerts) {
    Date now = new Date();
    Calendar cal = Calendar.getInstance();
    cal.setTime(now);
    cal.add(Calendar.DATE, 7);
    X509v2CRLBuilder crlBuilder = new X509v2CRLBuilder(new X500Name(MCIDREG_CERT_X500_NAME), now);
    crlBuilder.setNextUpdate(new Date(now.getTime() + 24 * 60 * 60 * 1000 * 7)); // The next CRL is next week (dummy value)
    for (net.maritimecloud.identityregistry.model.database.Certificate cert : revokedCerts) {
        String certReason = cert.getRevokeReason().toLowerCase();
        int reason = getCRLReasonFromString(certReason);
        crlBuilder.addCRLEntry(cert.getSerialNumber(), cert.getRevokedAt(), reason);
    }
    //crlBuilder.addExtension(X509Extensions.AuthorityKeyIdentifier, false, new AuthorityKeyIdentifierStructure(caCert));
    //crlBuilder.addExtension(X509Extensions.CRLNumber, false, new CRLNumber(BigInteger.valueOf(1)));

    PrivateKeyEntry keyEntry = getSigningCertEntry();

    JcaContentSignerBuilder signBuilder = new JcaContentSignerBuilder(SIGNER_ALGORITHM);
    signBuilder.setProvider(BC_PROVIDER_NAME);
    ContentSigner signer;
    try {
        signer = signBuilder.build(keyEntry.getPrivateKey());
    } catch (OperatorCreationException e1) {
        // TODO Auto-generated catch block
        e1.printStackTrace();
        return null;
    }

    X509CRLHolder cRLHolder = crlBuilder.build(signer);
    JcaX509CRLConverter converter = new JcaX509CRLConverter();
    converter.setProvider(BC_PROVIDER_NAME);
    X509CRL crl = null;
    try {
        crl = converter.getCRL(cRLHolder);
    } catch (CRLException e) {
        // TODO Auto-generated catch block
        e.printStackTrace();
    }
    return crl;
}

---

From source file:net.maritimecloud.identityregistry.utils.CertificateUtil.java

License:Apache License

/**
 * Creates a Certificate Revocation List (CRL) for the certificate serialnumbers given.
 *
 * @param revokedCerts  List of the serialnumbers that should be revoked.
 *//*from   w w  w  .  j  a v a  2  s.com*/
public void generateRootCACRL(String signName,
        List<net.maritimecloud.identityregistry.model.database.Certificate> revokedCerts,
        PrivateKeyEntry keyEntry, String outputCaCrlPath) {
    Date now = new Date();
    Calendar cal = Calendar.getInstance();
    cal.setTime(now);
    cal.add(Calendar.YEAR, 1);
    X509v2CRLBuilder crlBuilder = new X509v2CRLBuilder(new X500Name(signName), now);
    crlBuilder.setNextUpdate(cal.getTime()); // The next CRL is next year (dummy value)
    if (revokedCerts != null) {
        for (net.maritimecloud.identityregistry.model.database.Certificate cert : revokedCerts) {
            String certReason = cert.getRevokeReason().toLowerCase();
            int reason = getCRLReasonFromString(certReason);
            crlBuilder.addCRLEntry(cert.getSerialNumber(), cert.getRevokedAt(), reason);
        }
    }
    //crlBuilder.addExtension(X509Extensions.AuthorityKeyIdentifier, false, new AuthorityKeyIdentifierStructure(caCert));
    //crlBuilder.addExtension(X509Extensions.CRLNumber, false, new CRLNumber(BigInteger.valueOf(1)));

    JcaContentSignerBuilder signBuilder = new JcaContentSignerBuilder(SIGNER_ALGORITHM);
    signBuilder.setProvider(BC_PROVIDER_NAME);
    ContentSigner signer;
    try {
        signer = signBuilder.build(keyEntry.getPrivateKey());
    } catch (OperatorCreationException e1) {
        // TODO Auto-generated catch block
        e1.printStackTrace();
        return;
    }

    X509CRLHolder cRLHolder = crlBuilder.build(signer);
    JcaX509CRLConverter converter = new JcaX509CRLConverter();
    converter.setProvider(BC_PROVIDER_NAME);
    X509CRL crl;
    try {
        crl = converter.getCRL(cRLHolder);
    } catch (CRLException e) {
        throw new RuntimeException(e.getMessage(), e);
    }
    String pemCrl;
    try {
        pemCrl = CertificateUtil.getPemFromEncoded("X509 CRL", crl.getEncoded());
    } catch (CRLException e) {
        log.warn("unable to generate RootCACRL", e);
        return;
    }
    try {
        BufferedWriter writer = new BufferedWriter(new FileWriter(outputCaCrlPath));
        writer.write(pemCrl);
        writer.close();
    } catch (IOException e) {
        e.printStackTrace();
    }
}

---

From source file:net.maritimecloud.identityregistry.utils.CertificateUtil.java

License:Apache License

public OCSPResp generateOCSPResponse(BasicOCSPRespBuilder respBuilder) {
    PrivateKeyEntry signingCert = getSigningCertEntry();
    try {/* www. j  ava  2 s .c  o m*/
        ContentSigner contentSigner = new JcaContentSignerBuilder(SIGNER_ALGORITHM)
                .setProvider(BC_PROVIDER_NAME).build(signingCert.getPrivateKey());
        BasicOCSPResp basicResp = respBuilder
                .build(contentSigner,
                        new X509CertificateHolder[] {
                                new X509CertificateHolder(signingCert.getCertificate().getEncoded()) },
                        new Date());
        // Set response as successful
        int response = OCSPRespBuilder.SUCCESSFUL;
        // build the response
        return new OCSPRespBuilder().build(response, basicResp);
    } catch (Exception e) {
        return null;
    }
}

---

• «
• 1
• 2
• 3
• 4
• 5
• 6
• 7
• 8
• 9
• 10
• 11
• 12
• 13
• 14
• 15
• 16
• 17
• 18
• 19
• 20
• 21
• 22
• 23
• 24
• 25
• 26
• 27
• 28
• 29
• 30
• 31
• 32
• 33
• 34
• 35
• 36
• 37
• 38
• 39
• 40
• 41
• 42
• 43
• »