Example usage for org.bouncycastle.operator.jcajce JcaContentSignerBuilder JcaContentSignerBuilder

Introduction

In this page you can find the example usage for org.bouncycastle.operator.jcajce JcaContentSignerBuilder JcaContentSignerBuilder.

Prototype

public JcaContentSignerBuilder(String signatureAlgorithm) 

Source Link

Usage

From source file:org.ejbca.ui.web.RequestHelperTest.java

License:Open Source License

@SuppressWarnings("unchecked")
@Test/* ww  w.  ja v  a 2 s.  c o  m*/
public void testPkcs10CertRequestWithCertificateChain() throws Exception {
    RequestHelper requestHelper = new RequestHelper(null, null);

    //Generate a self signed certificate to act as a CA cert, and a signed certificate.
    KeyPair caKeys = KeyTools.genKeys("512", AlgorithmConstants.KEYALGORITHM_RSA);
    Certificate caCert = CertTools.genSelfCert("CN=foo", 365, null, caKeys.getPrivate(), caKeys.getPublic(),
            AlgorithmConstants.SIGALG_SHA1_WITH_RSA, false);
    KeyPair replyKeys = KeyTools.genKeys("512", AlgorithmConstants.KEYALGORITHM_RSA);
    final SubjectPublicKeyInfo pkinfo = new SubjectPublicKeyInfo(
            (ASN1Sequence) ASN1Primitive.fromByteArray(replyKeys.getPublic().getEncoded()));
    String signedCertDn = "CN=signedcert";
    byte[] serno = new byte[8];
    SecureRandom random = SecureRandom.getInstance("SHA1PRNG");
    random.setSeed(new Date().getTime());
    random.nextBytes(serno);
    Date firstDate = new Date();
    // Set back startdate ten minutes to avoid some problems with wrongly set clocks.
    firstDate.setTime(firstDate.getTime() - (10 * 60 * 1000));
    Date lastDate = new Date();
    // validity in days = validity*24*60*60*1000 milliseconds
    lastDate.setTime(lastDate.getTime() + (24 * 60 * 60 * 1000));
    X509v3CertificateBuilder certbuilder = new X509v3CertificateBuilder(CertTools.stringToBcX500Name("CN=foo"),
            new java.math.BigInteger(serno).abs(), firstDate, lastDate,
            CertTools.stringToBcX500Name(signedCertDn), pkinfo);
    final ContentSigner signer = new BufferingContentSigner(
            new JcaContentSignerBuilder(AlgorithmConstants.SIGALG_SHA1_WITH_RSA)
                    .setProvider(BouncyCastleProvider.PROVIDER_NAME).build(caKeys.getPrivate()),
            20480);
    final X509CertificateHolder certHolder = certbuilder.build(signer);
    final X509Certificate signedCert = (X509Certificate) CertTools
            .getCertfromByteArray(certHolder.getEncoded());

    //Setup mocks
    SignSessionLocal signsession = EasyMock.createMock(SignSessionLocal.class);
    ResponseMessage responseMessage = EasyMock.createMock(X509ResponseMessage.class);
    //EasyMock.expect(signsession.createCertificate(authenticationToken, EasyMock.anyObject(RequestMessage.class), X509ResponseMessage.class, null)).andReturn(responseMessage);
    EasyMock.expect(signsession.createCertificate(EasyMock.anyObject(AuthenticationToken.class),
            EasyMock.anyObject(RequestMessage.class), EasyMock.anyObject(X509ResponseMessage.class.getClass()),
            EasyMock.anyObject(EndEntityInformation.class))).andReturn(responseMessage);
    EasyMock.expect(responseMessage.getResponseMessage()).andReturn(signedCert.getEncoded());
    CaSessionLocal caSession = EasyMock.createMock(CaSessionLocal.class);
    CA ca = EasyMock.createMock(CA.class);
    EasyMock.expect(signsession.getCAFromRequest(EasyMock.anyObject(AuthenticationToken.class),
            EasyMock.anyObject(RequestMessage.class), EasyMock.anyBoolean())).andReturn(ca);
    CAInfo caInfo = EasyMock.createMock(CAInfo.class);
    EasyMock.expect(ca.getCAInfo()).andReturn(caInfo);
    EasyMock.expect(caInfo.getCertificateChain()).andReturn(Arrays.asList(caCert));
    EasyMock.replay(caInfo, ca, responseMessage, signsession, caSession);

    //Perform test
    byte[] result = requestHelper.pkcs10CertRequest(signsession, caSession, PRE_GENERATED_CSR, "foo", "foo123",
            CertificateResponseType.ENCODED_CERTIFICATE_CHAIN).getEncoded();
    List<Certificate> certChain = CertTools.getCertsFromPEM(new ByteArrayInputStream(result));
    assertEquals(signedCert, certChain.get(0));
    assertEquals(caCert, certChain.get(1));

    //Verify that mocks have behaved as planned
    EasyMock.verify(caInfo, ca, responseMessage, signsession, caSession);
}

---

From source file:org.ejbca.util.CMS.java

License:Open Source License

/**
 * @param is data to be signed//w  ww  .jav a 2 s.c  o m
 * @param os signed data
 * @param key to do be used for signing
 * @param providerName the provider that should do the signing
 * @throws Exception
 */
public static void sign(final InputStream is, OutputStream os, PrivateKey key, String providerName,
        X509Certificate cert) throws Exception {
    final InputStream bis = new BufferedInputStream(is, bufferSize);
    final OutputStream bos = new BufferedOutputStream(os, bufferSize);
    final CMSSignedDataStreamGenerator gen = new CMSSignedDataStreamGenerator();
    JcaDigestCalculatorProviderBuilder calculatorProviderBuilder = new JcaDigestCalculatorProviderBuilder()
            .setProvider(BouncyCastleProvider.PROVIDER_NAME);
    JcaSignerInfoGeneratorBuilder builder = new JcaSignerInfoGeneratorBuilder(
            calculatorProviderBuilder.build());
    final String digest = CMSSignedGenerator.DIGEST_SHA256;
    String signatureAlgorithmName = AlgorithmTools.getAlgorithmNameFromDigestAndKey(digest, key.getAlgorithm());
    ContentSigner contentSigner = new JcaContentSignerBuilder(signatureAlgorithmName).setProvider(providerName)
            .build(key);
    if (cert != null) {
        gen.addSignerInfoGenerator(builder.build(contentSigner, cert));
    } else {
        gen.addSignerInfoGenerator(builder.build(contentSigner, "hej".getBytes()));
    }
    final OutputStream out = gen.open(bos, true);
    fromInToOut(bis, out);
    bos.close();
    os.close();
}

---

From source file:org.ejbca.util.keystore.KeyStoreContainerBase.java

License:Open Source License

private X509Certificate getSelfCertificate(String myname, long validity, String sigAlg, KeyPair keyPair)
        throws Exception {
    final long currentTime = new Date().getTime();
    final Date firstDate = new Date(currentTime - 24 * 60 * 60 * 1000);
    final Date lastDate = new Date(currentTime + validity * 1000);
    // Add all mandatory attributes
    log.debug("keystore signing algorithm " + sigAlg);
    final PublicKey publicKey = keyPair.getPublic();
    if (publicKey == null) {
        throw new Exception("Public key is null");
    }/*from  w  ww  .  java  2 s  . c o m*/

    final SubjectPublicKeyInfo pkinfo = new SubjectPublicKeyInfo(
            (ASN1Sequence) ASN1Primitive.fromByteArray(publicKey.getEncoded()));
    X509v3CertificateBuilder certbuilder = new X509v3CertificateBuilder(new X500Name(myname),
            BigInteger.valueOf(firstDate.getTime()), firstDate, lastDate, new X500Name(myname), pkinfo);
    final ContentSigner signer = new BufferingContentSigner(
            new JcaContentSignerBuilder(sigAlg).setProvider(this.providerName).build(keyPair.getPrivate()),
            20480);
    final X509CertificateHolder certHolder = certbuilder.build(signer);
    return (X509Certificate) CertTools.getCertfromByteArray(certHolder.getEncoded());
}

---

From source file:org.elasticsearch.xpack.core.ssl.CertGenUtils.java

License:Open Source License

/**
 * Generates a signed certificate//from   www  .  j a  v  a 2s.  com
 *
 * @param principal          the principal of the certificate; commonly referred to as the
 *                           distinguished name (DN)
 * @param subjectAltNames    the subject alternative names that should be added to the
 *                           certificate as an X509v3 extension. May be {@code null}
 * @param keyPair            the key pair that will be associated with the certificate
 * @param caCert             the CA certificate. If {@code null}, this results in a self signed
 *                           certificate
 * @param caPrivKey          the CA private key. If {@code null}, this results in a self signed
 *                           certificate
 * @param isCa               whether or not the generated certificate is a CA
 * @param days               no of days certificate will be valid from now
 * @param signatureAlgorithm algorithm used for signing certificate. If {@code null} or
 *                           empty, then use default algorithm {@link CertGenUtils#getDefaultSignatureAlgorithm(PrivateKey)}
 * @return a signed {@link X509Certificate}
 */
private static X509Certificate generateSignedCertificate(X500Principal principal, GeneralNames subjectAltNames,
        KeyPair keyPair, X509Certificate caCert, PrivateKey caPrivKey, boolean isCa, int days,
        String signatureAlgorithm)
        throws NoSuchAlgorithmException, CertificateException, CertIOException, OperatorCreationException {
    Objects.requireNonNull(keyPair, "Key-Pair must not be null");
    final DateTime notBefore = new DateTime(DateTimeZone.UTC);
    if (days < 1) {
        throw new IllegalArgumentException("the certificate must be valid for at least one day");
    }
    final DateTime notAfter = notBefore.plusDays(days);
    final BigInteger serial = CertGenUtils.getSerial();
    JcaX509ExtensionUtils extUtils = new JcaX509ExtensionUtils();

    X500Name subject = X500Name.getInstance(principal.getEncoded());
    final X500Name issuer;
    final AuthorityKeyIdentifier authorityKeyIdentifier;
    if (caCert != null) {
        if (caCert.getBasicConstraints() < 0) {
            throw new IllegalArgumentException("ca certificate is not a CA!");
        }
        issuer = X500Name.getInstance(caCert.getIssuerX500Principal().getEncoded());
        authorityKeyIdentifier = extUtils.createAuthorityKeyIdentifier(caCert.getPublicKey());
    } else {
        issuer = subject;
        authorityKeyIdentifier = extUtils.createAuthorityKeyIdentifier(keyPair.getPublic());
    }

    JcaX509v3CertificateBuilder builder = new JcaX509v3CertificateBuilder(issuer, serial,
            new Time(notBefore.toDate(), Locale.ROOT), new Time(notAfter.toDate(), Locale.ROOT), subject,
            keyPair.getPublic());

    builder.addExtension(Extension.subjectKeyIdentifier, false,
            extUtils.createSubjectKeyIdentifier(keyPair.getPublic()));
    builder.addExtension(Extension.authorityKeyIdentifier, false, authorityKeyIdentifier);
    if (subjectAltNames != null) {
        builder.addExtension(Extension.subjectAlternativeName, false, subjectAltNames);
    }
    builder.addExtension(Extension.basicConstraints, isCa, new BasicConstraints(isCa));

    PrivateKey signingKey = caPrivKey != null ? caPrivKey : keyPair.getPrivate();
    ContentSigner signer = new JcaContentSignerBuilder(
            (Strings.isNullOrEmpty(signatureAlgorithm)) ? getDefaultSignatureAlgorithm(signingKey)
                    : signatureAlgorithm).setProvider(CertGenUtils.BC_PROV).build(signingKey);
    X509CertificateHolder certificateHolder = builder.build(signer);
    return new JcaX509CertificateConverter().getCertificate(certificateHolder);
}

---

From source file:org.elasticsearch.xpack.core.ssl.CertGenUtils.java

License:Open Source License

/**
 * Generates a certificate signing request
 *
 * @param keyPair   the key pair that will be associated by the certificate generated from the certificate signing request
 * @param principal the principal of the certificate; commonly referred to as the distinguished name (DN)
 * @param sanList   the subject alternative names that should be added to the certificate as an X509v3 extension. May be
 *                  {@code null}//from  w  ww.ja va 2s .com
 * @return a certificate signing request
 */
static PKCS10CertificationRequest generateCSR(KeyPair keyPair, X500Principal principal, GeneralNames sanList)
        throws IOException, OperatorCreationException {
    Objects.requireNonNull(keyPair, "Key-Pair must not be null");
    Objects.requireNonNull(keyPair.getPublic(), "Public-Key must not be null");
    Objects.requireNonNull(principal, "Principal must not be null");
    JcaPKCS10CertificationRequestBuilder builder = new JcaPKCS10CertificationRequestBuilder(principal,
            keyPair.getPublic());
    if (sanList != null) {
        ExtensionsGenerator extGen = new ExtensionsGenerator();
        extGen.addExtension(Extension.subjectAlternativeName, false, sanList);
        builder.addAttribute(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest, extGen.generate());
    }

    return builder.build(new JcaContentSignerBuilder("SHA256withRSA").setProvider(CertGenUtils.BC_PROV)
            .build(keyPair.getPrivate()));
}

---

From source file:org.forgerock.openidm.security.impl.SecurityResourceProvider.java

License:Open Source License

/**
 * Generates a self signed certificate using the given properties.
 *
 * @param commonName the subject's common name
 * @param organization the subject's organization name
 * @param organizationUnit the subject's organization unit name
 * @param stateOrProvince the subject's state or province
 * @param country the subject's country code
 * @param locality the subject's locality
 * @param algorithm the algorithm to use
 * @param keySize the keysize to use/*w  w w  . ja  v  a 2  s  .  co  m*/
 * @param signatureAlgorithm the signature algorithm to use
 * @param validFrom when the certificate is valid from
 * @param validTo when the certificate is valid until
 * @return The generated certificate
 * @throws Exception
 */
protected Pair<X509Certificate, PrivateKey> generateCertificate(String commonName, String organization,
        String organizationUnit, String stateOrProvince, String country, String locality, String algorithm,
        int keySize, String signatureAlgorithm, String validFrom, String validTo) throws Exception {

    KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(algorithm); // "RSA","BC"
    keyPairGenerator.initialize(keySize);
    KeyPair keyPair = keyPairGenerator.generateKeyPair();

    // Generate self-signed certificate
    X500NameBuilder builder = new X500NameBuilder(BCStyle.INSTANCE);
    builder.addRDN(BCStyle.C, country);
    builder.addRDN(BCStyle.ST, stateOrProvince);
    builder.addRDN(BCStyle.L, locality);
    builder.addRDN(BCStyle.OU, organizationUnit);
    builder.addRDN(BCStyle.O, organization);
    builder.addRDN(BCStyle.CN, commonName);

    Date notBefore = null;
    Date notAfter = null;
    if (validFrom == null) {
        notBefore = new Date(System.currentTimeMillis() - 1000L * 60 * 60 * 24 * 30);
    } else {
        DateTime notBeforeDateTime = DateUtil.getDateUtil().parseIfDate(validFrom);
        if (notBeforeDateTime == null) {
            throw new InternalServerErrorException("Invalid date format for 'validFrom' property");
        } else {
            notBefore = notBeforeDateTime.toDate();
        }
    }
    if (validTo == null) {
        Calendar date = Calendar.getInstance();
        date.setTime(new Date());
        date.add(Calendar.YEAR, 10);
        notAfter = date.getTime();
    } else {
        DateTime notAfterDateTime = DateUtil.getDateUtil().parseIfDate(validTo);
        if (notAfterDateTime == null) {
            throw new InternalServerErrorException("Invalid date format for 'validTo' property");
        } else {
            notAfter = notAfterDateTime.toDate();
        }
    }

    BigInteger serial = BigInteger.valueOf(System.currentTimeMillis());

    X509v3CertificateBuilder v3CertGen = new JcaX509v3CertificateBuilder(builder.build(), serial, notBefore,
            notAfter, builder.build(), keyPair.getPublic());

    ContentSigner sigGen = new JcaContentSignerBuilder(signatureAlgorithm).setProvider(BC)
            .build(keyPair.getPrivate());

    X509Certificate cert = new JcaX509CertificateConverter().setProvider(BC)
            .getCertificate(v3CertGen.build(sigGen));
    cert.checkValidity(new Date());
    cert.verify(cert.getPublicKey());

    return Pair.of(cert, keyPair.getPrivate());
}

---

From source file:org.fuin.esmp.EventStoreCertificateMojo.java

License:Open Source License

private static X509Certificate signCertificate(final X509v3CertificateBuilder certificateBuilder,
        final PrivateKey privateKey) {
    try {//from  www. ja  v  a2s  .  c o m
        final ContentSigner signer = new JcaContentSignerBuilder("SHA256WithRSAEncryption")
                .setProvider(BouncyCastleProvider.PROVIDER_NAME).build(privateKey);
        return new JcaX509CertificateConverter().setProvider(BouncyCastleProvider.PROVIDER_NAME)
                .getCertificate(certificateBuilder.build(signer));
    } catch (final OperatorCreationException | CertificateException ex) {
        throw new RuntimeException("Couldn't sign certificate", ex);
    }
}

---

From source file:org.gluu.oxtrust.action.UpdateTrustRelationshipAction.java

License:MIT License

/**
 * If there is no certificate selected, or certificate is invalid -
 * generates one.//w w w . j  ava 2s  . c om
 * 
 * @author Oleksiy Tataryn
 * @return certificate for generated SP
 * @throws CertificateEncodingException
 */
private String getCertForGeneratedSP() {
    X509Certificate cert = SSLService.instance().getCertificate(certWrapper.getStream());
    if (cert == null) {
        facesMessages.add(Severity.INFO,
                "Certificate were not provided, or was incorrect. Appliance will create a self-signed certificate.");
        if (Security.getProvider(BouncyCastleProvider.PROVIDER_NAME) == null) {
            Security.addProvider(new BouncyCastleProvider());
        }
        try {
            JDKKeyPairGenerator.RSA keyPairGen = new JDKKeyPairGenerator.RSA();
            keyPairGen.initialize(2048);
            KeyPair pair = keyPairGen.generateKeyPair();
            StringWriter keyWriter = new StringWriter();
            PEMWriter pemFormatWriter = new PEMWriter(keyWriter);
            pemFormatWriter.writeObject(pair.getPrivate());
            pemFormatWriter.close();

            String url = trustRelationship.getUrl().replaceFirst(".*//", "");

            X509v3CertificateBuilder v3CertGen = new JcaX509v3CertificateBuilder(
                    new X500Name("CN=" + url + ", OU=None, O=None L=None, C=None"),
                    BigInteger.valueOf(new SecureRandom().nextInt()),
                    new Date(System.currentTimeMillis() - 1000L * 60 * 60 * 24 * 30),
                    new Date(System.currentTimeMillis() + (1000L * 60 * 60 * 24 * 365 * 10)),
                    new X500Name("CN=" + url + ", OU=None, O=None L=None, C=None"), pair.getPublic());
            cert = new JcaX509CertificateConverter().setProvider("BC").getCertificate(v3CertGen.build(
                    new JcaContentSignerBuilder("MD5withRSA").setProvider("BC").build(pair.getPrivate())));
            org.apache.commons.codec.binary.Base64 encoder = new org.apache.commons.codec.binary.Base64(64);
            byte[] derCert = cert.getEncoded();
            String pemCertPre = new String(encoder.encode(derCert));
            log.debug(Shibboleth2ConfService.PUBLIC_CERTIFICATE_START_LINE);
            log.debug(pemCertPre);
            log.debug(Shibboleth2ConfService.PUBLIC_CERTIFICATE_END_LINE);

            saveCert(trustRelationship, pemCertPre);
            saveKey(trustRelationship, keyWriter.toString());

        } catch (Exception e) {

            e.printStackTrace();
        }

        //         String certName = applicationConfiguration.getCertDir() + File.separator + StringHelper.removePunctuation(applicationConfiguration.getOrgInum())
        //               + "-shib.crt";
        //         File certFile = new File(certName);
        //         if (certFile.exists()) {
        //            cert = SSLService.instance().getCertificate(certName);
        //         }
    }
    String certificate = null;
    if (cert != null) {
        try {
            certificate = new String(Base64.encode(cert.getEncoded()));
        } catch (CertificateEncodingException e) {
            certificate = null;
            facesMessages.add(Severity.ERROR,
                    "Failed to encode provided certificate. Please notify Gluu support about this.");
            log.error("Failed to encode certificate to DER", e);
        }
    } else {
        facesMessages.add(Severity.INFO,
                "Certificate were not provided, or was incorrect. Appliance will create a self-signed certificate.");
    }

    return certificate;
}

---

From source file:org.hyperledger.fabric.sdk.security.certgen.TLSCertificateBuilder.java

License:Open Source License

private X509Certificate createSelfSignedCertificate(CertType certType, KeyPair keyPair, String san)
        throws Exception {
    X509v3CertificateBuilder certBuilder = createCertBuilder(keyPair);

    // Basic constraints
    BasicConstraints constraints = new BasicConstraints(false);
    certBuilder.addExtension(Extension.basicConstraints, true, constraints.getEncoded());
    // Key usage/*from  ww w .j  a  va 2s  .co m*/
    KeyUsage usage = new KeyUsage(KeyUsage.keyEncipherment | KeyUsage.digitalSignature);
    certBuilder.addExtension(Extension.keyUsage, false, usage.getEncoded());
    // Extended key usage
    certBuilder.addExtension(Extension.extendedKeyUsage, false, certType.keyUsage().getEncoded());

    if (san != null) {
        addSAN(certBuilder, san);
    }

    ContentSigner signer = new JcaContentSignerBuilder(signatureAlgorithm).build(keyPair.getPrivate());
    X509CertificateHolder holder = certBuilder.build(signer);

    JcaX509CertificateConverter converter = new JcaX509CertificateConverter();
    converter.setProvider(new BouncyCastleProvider());
    return converter.getCertificate(holder);
}

---

From source file:org.hyperledger.fabric.sdk.security.CryptoPrimitives.java

License:Open Source License

/**
 * generateCertificationRequest/*from  ww w  . ja  v a 2 s . c o  m*/
 *
 * @param subject The subject to be added to the certificate
 * @param pair    Public private key pair
 * @return PKCS10CertificationRequest Certificate Signing Request.
 * @throws OperatorCreationException
 */

public PKCS10CertificationRequest generateCertificationRequest(String subject, KeyPair pair)
        throws OperatorCreationException {

    PKCS10CertificationRequestBuilder p10Builder = new JcaPKCS10CertificationRequestBuilder(
            new X500Principal("CN=" + subject), pair.getPublic());

    JcaContentSignerBuilder csBuilder = new JcaContentSignerBuilder("SHA256withECDSA");

    // csBuilder.setProvider("EC");
    ContentSigner signer = csBuilder.build(pair.getPrivate());

    return p10Builder.build(signer);
}

---

• «
• 1
• 2
• 3
• 4
• 5
• 6
• 7
• 8
• 9
• 10
• 11
• 12
• 13
• 14
• 15
• 16
• 17
• 18
• 19
• 20
• 21
• 22
• 23
• 24
• 25
• 26
• 27
• 28
• 29
• 30
• 31
• 32
• 33
• 34
• 35
• 36
• 37
• 38
• 39
• 40
• 41
• 42
• 43
• »