Example usage for org.bouncycastle.operator.jcajce JcaContentSignerBuilder JcaContentSignerBuilder

List of usage examples for org.bouncycastle.operator.jcajce JcaContentSignerBuilder JcaContentSignerBuilder

  1. HOME
  2. Java
  3. org.bouncycastle
  4. org.bouncycastle.operator.jcajce.*
  5. JcaContentSignerBuilder
  6. JcaContentSignerBuilder

Introduction

In this page you can find the example usage for org.bouncycastle.operator.jcajce JcaContentSignerBuilder JcaContentSignerBuilder.

Prototype

public JcaContentSignerBuilder(String signatureAlgorithm)

Source Link

Usage

From source file:net.maritimecloud.pki.CertificateBuilder.java

License:Apache License

/**
 * Builds and signs a certificate. The certificate will be build on the given subject-public-key and signed with
 * the given issuer-private-key. The issuer and subject will be identified in the strings provided.
 *
 * @param serialNumber The serialnumber of the new certificate.
 * @param signerPrivateKey Private key for signing the certificate
 * @param signerPublicKey Public key of the signing certificate
 * @param subjectPublicKey Public key for the new certificate
 * @param issuer DN of the signing certificate
 * @param subject DN of the new certificate
 * @param customAttrs The custom MC attributes to include in the certificate
 * @param type Type of certificate, can be "ROOT", "INTERMEDIATE" or "ENTITY".
 * @param ocspUrl OCSP endpoint//from w  w  w. j a v a2s . c om
 * @param crlUrl CRL endpoint - can be null
 * @return A signed X509Certificate
 * @throws Exception Throws exception on certificate generation errors.
 */
public X509Certificate buildAndSignCert(BigInteger serialNumber, PrivateKey signerPrivateKey,
        PublicKey signerPublicKey, PublicKey subjectPublicKey, X500Name issuer, X500Name subject,
        Map<String, String> customAttrs, String type, String ocspUrl, String crlUrl) throws Exception {
    // Dates are converted to GMT/UTC inside the cert builder
    Calendar cal = Calendar.getInstance();
    Date now = cal.getTime();
    Date expire = new GregorianCalendar(CERT_EXPIRE_YEAR, 0, 1).getTime();
    X509v3CertificateBuilder certV3Bldr = new JcaX509v3CertificateBuilder(issuer, serialNumber, now, // Valid from now...
            expire, // until CERT_EXPIRE_YEAR
            subject, subjectPublicKey);
    JcaX509ExtensionUtils extensionUtil = new JcaX509ExtensionUtils();
    // Create certificate extensions
    if ("ROOTCA".equals(type)) {
        certV3Bldr = certV3Bldr.addExtension(Extension.basicConstraints, true, new BasicConstraints(true))
                .addExtension(Extension.keyUsage, true,
                        new X509KeyUsage(X509KeyUsage.digitalSignature | X509KeyUsage.nonRepudiation
                                | X509KeyUsage.keyEncipherment | X509KeyUsage.keyCertSign
                                | X509KeyUsage.cRLSign));
    } else if ("INTERMEDIATE".equals(type)) {
        certV3Bldr = certV3Bldr.addExtension(Extension.basicConstraints, true, new BasicConstraints(true))
                .addExtension(Extension.keyUsage, true,
                        new X509KeyUsage(X509KeyUsage.digitalSignature | X509KeyUsage.nonRepudiation
                                | X509KeyUsage.keyEncipherment | X509KeyUsage.keyCertSign
                                | X509KeyUsage.cRLSign));
    } else {
        // Subject Alternative Name
        GeneralName[] genNames = null;
        if (customAttrs != null && !customAttrs.isEmpty()) {
            genNames = new GeneralName[customAttrs.size()];
            Iterator<Map.Entry<String, String>> it = customAttrs.entrySet().iterator();
            int idx = 0;
            while (it.hasNext()) {
                Map.Entry<String, String> pair = it.next();
                if (PKIConstants.X509_SAN_DNSNAME.equals(pair.getKey())) {
                    genNames[idx] = new GeneralName(GeneralName.dNSName, pair.getValue());
                } else {
                    //genNames[idx] = new GeneralName(GeneralName.otherName, new DERUTF8String(pair.getKey() + ";" + pair.getValue()));
                    DERSequence othernameSequence = new DERSequence(
                            new ASN1Encodable[] { new ASN1ObjectIdentifier(pair.getKey()),
                                    new DERTaggedObject(true, 0, new DERUTF8String(pair.getValue())) });
                    genNames[idx] = new GeneralName(GeneralName.otherName, othernameSequence);
                }
                idx++;
            }
        }
        if (genNames != null) {
            certV3Bldr = certV3Bldr.addExtension(Extension.subjectAlternativeName, false,
                    new GeneralNames(genNames));
        }
    }
    // Basic extension setup
    certV3Bldr = certV3Bldr
            .addExtension(Extension.authorityKeyIdentifier, false,
                    extensionUtil.createAuthorityKeyIdentifier(signerPublicKey))
            .addExtension(Extension.subjectKeyIdentifier, false,
                    extensionUtil.createSubjectKeyIdentifier(subjectPublicKey));
    // CRL Distribution Points
    DistributionPointName distPointOne = new DistributionPointName(
            new GeneralNames(new GeneralName(GeneralName.uniformResourceIdentifier, crlUrl)));
    DistributionPoint[] distPoints = new DistributionPoint[1];
    distPoints[0] = new DistributionPoint(distPointOne, null, null);
    certV3Bldr.addExtension(Extension.cRLDistributionPoints, false, new CRLDistPoint(distPoints));
    // OCSP endpoint - is not available for the CAs
    if (ocspUrl != null) {
        GeneralName ocspName = new GeneralName(GeneralName.uniformResourceIdentifier, ocspUrl);
        AuthorityInformationAccess authorityInformationAccess = new AuthorityInformationAccess(
                X509ObjectIdentifiers.ocspAccessMethod, ocspName);
        certV3Bldr.addExtension(Extension.authorityInfoAccess, false, authorityInformationAccess);
    }
    // Create the key signer
    JcaContentSignerBuilder builder = new JcaContentSignerBuilder(SIGNER_ALGORITHM);
    builder.setProvider(BC_PROVIDER_NAME);
    ContentSigner signer = builder.build(signerPrivateKey);
    return new JcaX509CertificateConverter().setProvider(BC_PROVIDER_NAME)
            .getCertificate(certV3Bldr.build(signer));
}

From source file:net.maritimecloud.pki.Revocation.java

License:Apache License

/**
 * Creates a Certificate RevocationInfo List (CRL) for the certificate serialnumbers given.
 *
 * @param revokedCerts  List of the serialnumbers that should be revoked.
 * @param keyEntry Private key to sign the CRL
 * @return a CRL/*from  www. ja v  a 2 s  .  c  o m*/
 */
public static X509CRL generateCRL(List<RevocationInfo> revokedCerts, KeyStore.PrivateKeyEntry keyEntry) {
    Date now = new Date();
    Calendar cal = Calendar.getInstance();
    cal.setTime(now);
    cal.add(Calendar.DATE, 7);
    String signCertX500Name;
    try {
        signCertX500Name = new JcaX509CertificateHolder((X509Certificate) keyEntry.getCertificate())
                .getSubject().toString();
    } catch (CertificateEncodingException e) {
        e.printStackTrace();
        return null;
    }
    X509v2CRLBuilder crlBuilder = new X509v2CRLBuilder(new X500Name(signCertX500Name), now);
    crlBuilder.setNextUpdate(new Date(now.getTime() + 24 * 60 * 60 * 1000 * 7)); // The next CRL is next week (dummy value)
    for (RevocationInfo cert : revokedCerts) {
        crlBuilder.addCRLEntry(cert.getSerialNumber(), cert.getRevokedAt(), cert.getRevokeReason().ordinal());
    }
    //crlBuilder.addExtension(X509Extensions.AuthorityKeyIdentifier, false, new AuthorityKeyIdentifierStructure(caCert));
    //crlBuilder.addExtension(X509Extensions.CRLNumber, false, new CRLNumber(BigInteger.valueOf(1)));

    JcaContentSignerBuilder signBuilder = new JcaContentSignerBuilder(SIGNER_ALGORITHM);
    signBuilder.setProvider(BC_PROVIDER_NAME);
    ContentSigner signer;
    try {
        signer = signBuilder.build(keyEntry.getPrivateKey());
    } catch (OperatorCreationException e1) {
        // TODO Auto-generated catch block
        e1.printStackTrace();
        return null;
    }

    X509CRLHolder cRLHolder = crlBuilder.build(signer);
    JcaX509CRLConverter converter = new JcaX509CRLConverter();
    converter.setProvider(BC_PROVIDER_NAME);
    X509CRL crl = null;
    try {
        crl = converter.getCRL(cRLHolder);
    } catch (CRLException e) {
        // TODO Auto-generated catch block
        e.printStackTrace();
    }
    return crl;
}

From source file:net.maritimecloud.pki.Revocation.java

License:Apache License

/**
 * Creates a Certificate RevocationInfo List (CRL) for the certificate serialnumbers given.
 *
 * @param signName DN name of the signing certificate
 * @param revokedCerts  List of the serialnumbers that should be revoked.
 * @param keyEntry Private key to sign the CRL
 * @param outputCaCrlPath Where to place the CRL
 *///w  ww .  java2 s . co m
public static void generateRootCACRL(String signName, List<RevocationInfo> revokedCerts,
        KeyStore.PrivateKeyEntry keyEntry, String outputCaCrlPath) {
    Date now = new Date();
    Calendar cal = Calendar.getInstance();
    cal.setTime(now);
    cal.add(Calendar.YEAR, 1);
    X509v2CRLBuilder crlBuilder = new X509v2CRLBuilder(new X500Name(signName), now);
    crlBuilder.setNextUpdate(cal.getTime()); // The next CRL is next year (dummy value)
    if (revokedCerts != null) {
        for (RevocationInfo cert : revokedCerts) {
            crlBuilder.addCRLEntry(cert.getSerialNumber(), cert.getRevokedAt(),
                    cert.getRevokeReason().ordinal());
        }
    }
    //crlBuilder.addExtension(X509Extensions.AuthorityKeyIdentifier, false, new AuthorityKeyIdentifierStructure(caCert));
    //crlBuilder.addExtension(X509Extensions.CRLNumber, false, new CRLNumber(BigInteger.valueOf(1)));

    JcaContentSignerBuilder signBuilder = new JcaContentSignerBuilder(SIGNER_ALGORITHM);
    signBuilder.setProvider(BC_PROVIDER_NAME);
    ContentSigner signer;
    try {
        signer = signBuilder.build(keyEntry.getPrivateKey());
    } catch (OperatorCreationException e1) {
        // TODO Auto-generated catch block
        e1.printStackTrace();
        return;
    }

    X509CRLHolder cRLHolder = crlBuilder.build(signer);
    JcaX509CRLConverter converter = new JcaX509CRLConverter();
    converter.setProvider(BC_PROVIDER_NAME);
    X509CRL crl;
    try {
        crl = converter.getCRL(cRLHolder);
    } catch (CRLException e) {
        throw new RuntimeException(e.getMessage(), e);
    }
    String pemCrl;
    try {
        pemCrl = getPemFromEncoded("X509 CRL", crl.getEncoded());
    } catch (CRLException e) {
        //log.warn("unable to generate RootCACRL", e);
        return;
    }
    try {
        BufferedWriter writer = new BufferedWriter(new FileWriter(outputCaCrlPath));
        writer.write(pemCrl);
        writer.close();
    } catch (IOException e) {
        e.printStackTrace();
    }
}

From source file:net.maritimecloud.pki.Revocation.java

License:Apache License

/**
 * Generates a OCSPResp.//from w  w w  .j a va2  s  .  c  o  m
 *
 * @param respBuilder A BasicOCSPRespBuilder
 * @param signingCert PrivateKeyEntry of the signing certificate.
 * @return a OCSPResp
 */
public static OCSPResp generateOCSPResponse(BasicOCSPRespBuilder respBuilder,
        KeyStore.PrivateKeyEntry signingCert) {
    try {
        ContentSigner contentSigner = new JcaContentSignerBuilder(SIGNER_ALGORITHM)
                .setProvider(BC_PROVIDER_NAME).build(signingCert.getPrivateKey());
        BasicOCSPResp basicResp = respBuilder
                .build(contentSigner,
                        new X509CertificateHolder[] {
                                new X509CertificateHolder(signingCert.getCertificate().getEncoded()) },
                        new Date());
        // Set response as successful
        int response = OCSPRespBuilder.SUCCESSFUL;
        // build the response
        return new OCSPRespBuilder().build(response, basicResp);
    } catch (Exception e) {
        return null;
    }
}

From source file:net.ripe.rpki.commons.crypto.cms.RpkiSignedObjectBuilder.java

License:BSD License

private void addSignerInfo(CMSSignedDataGenerator generator, PrivateKey privateKey, String signatureProvider,
        X509Certificate signingCertificate) throws OperatorCreationException {
    ContentSigner signer = new JcaContentSignerBuilder(X509CertificateBuilderHelper.DEFAULT_SIGNATURE_ALGORITHM)
            .setProvider(signatureProvider).build(privateKey);
    DigestCalculatorProvider digestProvider = BouncyCastleUtil.DIGEST_CALCULATOR_PROVIDER;
    SignerInfoGenerator gen = new JcaSignerInfoGeneratorBuilder(digestProvider)
            .setSignedAttributeGenerator(new DefaultSignedAttributeTableGenerator(
                    createSignedAttributes(signingCertificate.getNotBefore())))
            .build(signer, X509CertificateUtil.getSubjectKeyIdentifier(signingCertificate));
    generator.addSignerInfoGenerator(gen);
}

From source file:net.ripe.rpki.commons.crypto.crl.X509CrlBuilder.java

License:BSD License

public X509Crl build(PrivateKey key) {
    validateCrlFields();/*from ww w .  java 2 s  .  c o  m*/
    try {
        X509v2CRLBuilder generator = createCrlGenerator();
        ContentSigner signer = new JcaContentSignerBuilder(
                X509CertificateBuilderHelper.DEFAULT_SIGNATURE_ALGORITHM).setProvider(signatureProvider)
                        .build(key);
        return new X509Crl(generator.build(signer).getEncoded());
    } catch (OperatorCreationException e) {
        throw new X509CrlBuilderException(e);
    } catch (IOException e) {
        throw new X509CrlBuilderException(e);
    }
}

From source file:net.ripe.rpki.commons.crypto.util.KeyStoreUtil.java

License:BSD License

public static X509Certificate generateCertificate(KeyPair keyPair, String signatureProvider) {
    X509v3CertificateBuilder builder = new JcaX509v3CertificateBuilder(new X500Principal("CN=issuer"),
            BigInteger.ONE, new DateTime().minusYears(2).toDate(), new DateTime().minusYears(1).toDate(),
            new X500Principal("CN=subject"), keyPair.getPublic());
    try {//  w  ww .j a v a  2s . co  m
        ContentSigner sigGen = new JcaContentSignerBuilder(
                X509CertificateBuilderHelper.DEFAULT_SIGNATURE_ALGORITHM).setProvider(signatureProvider)
                        .build(keyPair.getPrivate());
        return new JcaX509CertificateConverter().getCertificate(builder.build(sigGen));
    } catch (OperatorCreationException e) {
        throw new RuntimeException(e);
    } catch (CertificateException e) {
        throw new RuntimeException(e);
    }
}

From source file:net.ripe.rpki.commons.crypto.x509cert.X509CertificateBuilderHelper.java

License:BSD License

public X509Certificate generateCertificate() {
    X509v3CertificateBuilder certificateGenerator = createCertificateGenerator();
    try {/*from   w w w  .j av  a  2 s.  co m*/
        ContentSigner signer = new JcaContentSignerBuilder(signatureAlgorithm).setProvider(signatureProvider)
                .build(signingKeyPair.getPrivate());
        return new JcaX509CertificateConverter().getCertificate(certificateGenerator.build(signer));
    } catch (CertificateEncodingException e) {
        throw new X509ResourceCertificateBuilderException(e);
    } catch (IllegalStateException e) {
        throw new X509ResourceCertificateBuilderException(e);
    } catch (OperatorCreationException e) {
        throw new X509ResourceCertificateBuilderException(e);
    } catch (CertificateException e) {
        throw new X509ResourceCertificateBuilderException(e);
    }
}

From source file:net.ripe.rpki.commons.provisioning.cms.ProvisioningCmsObjectBuilder.java

License:BSD License

private void addSignerInfo(CMSSignedDataGenerator generator, PrivateKey privateKey)
        throws OperatorCreationException {
    ContentSigner signer = new JcaContentSignerBuilder(X509CertificateBuilderHelper.DEFAULT_SIGNATURE_ALGORITHM)
            .setProvider(signatureProvider).build(privateKey);
    DigestCalculatorProvider digestProvider = BouncyCastleUtil.DIGEST_CALCULATOR_PROVIDER;
    SignerInfoGenerator gen = new JcaSignerInfoGeneratorBuilder(digestProvider)
            .setSignedAttributeGenerator(new DefaultSignedAttributeTableGenerator(createSignedAttributes()))
            .build(signer, X509CertificateUtil.getSubjectKeyIdentifier(cmsCertificate));
    generator.addSignerInfoGenerator(gen);
}

From source file:net.ripe.rpki.commons.provisioning.x509.pkcs10.RpkiCaCertificateRequestBuilder.java

License:BSD License

public PKCS10CertificationRequest build(KeyPair keyPair) {
    try {//from  www.java2 s.  co  m
        Extensions extensions = createExtensions();

        ContentSigner signer = new JcaContentSignerBuilder(signatureAlgorithm).setProvider(signatureProvider)
                .build(keyPair.getPrivate());

        JcaPKCS10CertificationRequestBuilder builder = new JcaPKCS10CertificationRequestBuilder(subject,
                keyPair.getPublic());
        builder.addAttribute(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest, extensions);
        return builder.build(signer);
    } catch (Exception e) {
        throw new RpkiCaCertificateRequestBuilderException(e);
    }
}