Example usage for org.bouncycastle.operator.jcajce JcaContentSignerBuilder JcaContentSignerBuilder

List of usage examples for org.bouncycastle.operator.jcajce JcaContentSignerBuilder JcaContentSignerBuilder

  1. HOME
  2. Java
  3. org.bouncycastle
  4. org.bouncycastle.operator.jcajce.*
  5. JcaContentSignerBuilder
  6. JcaContentSignerBuilder

Introduction

In this page you can find the example usage for org.bouncycastle.operator.jcajce JcaContentSignerBuilder JcaContentSignerBuilder.

Prototype

public JcaContentSignerBuilder(String signatureAlgorithm)

Source Link

Usage

From source file:org.neo4j.bolt.security.ssl.Certificates.java

License:Open Source License

public void createSelfSignedCertificate(File certificatePath, File privateKeyPath, String hostName)
        throws GeneralSecurityException, IOException, OperatorCreationException {
    KeyPairGenerator keyGen = KeyPairGenerator.getInstance(DEFAULT_ENCRYPTION);
    keyGen.initialize(2048, random);//w ww . j av  a  2 s. co  m
    KeyPair keypair = keyGen.generateKeyPair();

    // Prepare the information required for generating an X.509 certificate.
    X500Name owner = new X500Name("CN=" + hostName);
    X509v3CertificateBuilder builder = new JcaX509v3CertificateBuilder(owner, new BigInteger(64, random),
            NOT_BEFORE, NOT_AFTER, owner, keypair.getPublic());

    PrivateKey privateKey = keypair.getPrivate();
    ContentSigner signer = new JcaContentSignerBuilder("SHA512WithRSAEncryption").build(privateKey);
    X509CertificateHolder certHolder = builder.build(signer);
    X509Certificate cert = new JcaX509CertificateConverter().setProvider(PROVIDER).getCertificate(certHolder);

    //check so that cert is valid
    cert.verify(keypair.getPublic());

    //write to disk
    writePem("CERTIFICATE", cert.getEncoded(), certificatePath);
    writePem("PRIVATE KEY", privateKey.getEncoded(), privateKeyPath);
}

From source file:org.neo4j.driver.v1.util.CertificateToolTest.java

License:Apache License

public static X509Certificate generateCert(X500Name issuer, X500Name subject, KeyPair issuerKeys,
        PublicKey publicKey) throws GeneralSecurityException, IOException, OperatorCreationException {
    // Create x509 certificate
    Date startDate = new Date(System.currentTimeMillis());
    Date endDate = new Date(System.currentTimeMillis() + 365L * 24L * 60L * 60L * 1000L);
    BigInteger serialNum = BigInteger.valueOf(System.currentTimeMillis());
    X509v3CertificateBuilder certBuilder = new JcaX509v3CertificateBuilder(issuer, serialNum, startDate,
            endDate, subject, publicKey);

    // Get the certificate back
    ContentSigner signer = new JcaContentSignerBuilder("SHA512WithRSAEncryption")
            .build(issuerKeys.getPrivate());
    X509CertificateHolder certHolder = certBuilder.build(signer);
    X509Certificate certificate = new JcaX509CertificateConverter().setProvider("BC")
            .getCertificate(certHolder);

    certificate.verify(issuerKeys.getPublic());
    return certificate;
}

From source file:org.opcfoundation.ua.transport.security.BcCertificateProvider.java

License:Open Source License

/**
 * Generates a new certificate using the Bouncy Castle implementation.
 * <p>/*w  w w . j  a  v  a  2 s.c  o m*/
 * The method is used from
 * {@link CertificateUtils#createApplicationInstanceCertificate(String, String, String, int, String...)}
 * and
 * {@link CertificateUtils#renewApplicationInstanceCertificate(String, String, String, int, org.opcfoundation.ua.transport.security.KeyPair, String...)}
 * 
 * @param domainName
 *            the X500 domain name for the certificate
 * @param publicKey
 *            the public key of the cert
 * @param privateKey
 *            the private key of the cert
 * @param issuerKeys
 *            the certificate and private key of the issuer
 * @param from
 *            validity start time
 * @param to
 *            validity end time
 * @param serialNumber
 *            a unique serial number for the certificate
 * @param applicationUri
 *            the OPC UA ApplicationUri of the application - added to
 *            SubjectAlternativeName
 * @param hostNames
 *            the additional host names to add to SubjectAlternativeName
 * @return the generated certificate
 * @throws GeneralSecurityException
 *             if the generation fails
 * @throws IOException
 *             if the generation fails due to an IO exception
 */
@Override
public X509Certificate generateCertificate(String domainName, PublicKey publicKey, PrivateKey privateKey,
        KeyPair issuerKeys, Date from, Date to, BigInteger serial, String applicationUri, String... hostNames)
        throws IOException, GeneralSecurityException {

    JcaX509ExtensionUtils extUtils = new JcaX509ExtensionUtils();

    X509v3CertificateBuilder certBldr;
    AuthorityKeyIdentifier authorityKeyIdentifier;
    PrivateKey signerKey;
    if (issuerKeys == null) {
        X500Name dn = new X500Name(domainName);
        certBldr = new JcaX509v3CertificateBuilder(dn, serial, from, to, dn, publicKey);
        authorityKeyIdentifier = extUtils.createAuthorityKeyIdentifier(publicKey);
        signerKey = privateKey;
    } else {
        X509Certificate caCert = issuerKeys.getCertificate().getCertificate();
        certBldr = new JcaX509v3CertificateBuilder(caCert, serial, from, to, new X500Principal(domainName),
                publicKey);
        authorityKeyIdentifier = extUtils.createAuthorityKeyIdentifier(caCert);
        signerKey = issuerKeys.getPrivateKey().getPrivateKey();
    }
    certBldr.addExtension(Extension.authorityKeyIdentifier, false, authorityKeyIdentifier)
            .addExtension(Extension.subjectKeyIdentifier, false, extUtils.createSubjectKeyIdentifier(publicKey))
            .addExtension(Extension.basicConstraints, false, new BasicConstraints(false)).addExtension(
                    Extension.keyUsage, false, new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyEncipherment
                            | KeyUsage.nonRepudiation | KeyUsage.dataEncipherment | KeyUsage.keyCertSign));

    // BC 1.49:
    certBldr.addExtension(Extension.extendedKeyUsage, false, new ExtendedKeyUsage(
            new KeyPurposeId[] { KeyPurposeId.id_kp_serverAuth, KeyPurposeId.id_kp_clientAuth }));
    // create the extension value

    // URI Name
    List<GeneralName> names = new ArrayList<GeneralName>();
    names.add(new GeneralName(GeneralName.uniformResourceIdentifier, applicationUri));

    // Add DNS name from ApplicationUri
    boolean hasDNSName = false;
    String uriHostName = null;
    try {
        String[] appUriParts = applicationUri.split("[:/]");
        if (appUriParts.length > 1) {
            uriHostName = appUriParts[1];
            if (!uriHostName.toLowerCase().equals("localhost")) {
                GeneralName dnsName = new GeneralName(GeneralName.dNSName, uriHostName);
                names.add(dnsName);
                hasDNSName = true;
            }
        }
    } catch (Exception e) {
        logger.warn("Cannot initialize DNS Name to Certificate from ApplicationUri {}", applicationUri);
    }

    // Add other DNS Names
    List<GeneralName> ipAddressNames = new ArrayList<GeneralName>();
    if (hostNames != null)
        for (String hostName : hostNames) {
            boolean isIpAddress = hostName.matches("^[0-9.]+$");
            if (!hostName.equals(uriHostName) && !hostName.toLowerCase().equals("localhost")) {
                GeneralName dnsName = new GeneralName(
                        hostName.matches("^[0-9.]+$") ? GeneralName.iPAddress : GeneralName.dNSName, hostName);
                if (isIpAddress)
                    ipAddressNames.add(dnsName);
                else {
                    names.add(dnsName);
                    hasDNSName = true;
                }
            }
        }
    // Add IP Addresses, if no host names are defined
    if (!hasDNSName)
        for (GeneralName n : ipAddressNames)
            names.add(n);

    final GeneralNames subjectAltNames = new GeneralNames(names.toArray(new GeneralName[0]));
    certBldr.addExtension(Extension.subjectAlternativeName, false, subjectAltNames);

    // ***** generate certificate ***********/
    try {

        ContentSigner signer = new JcaContentSignerBuilder(CertificateUtils.getCertificateSignatureAlgorithm())
                .setProvider("BC").build(signerKey);
        return new JcaX509CertificateConverter().setProvider("BC").getCertificate(certBldr.build(signer));
    } catch (OperatorCreationException e) {
        throw new GeneralSecurityException(e);
    }
}

From source file:org.opcfoundation.ua.transport.security.BcCertificateProvider.java

License:Open Source License

/**
 * Build a X509 V3 certificate to use as an issuer (CA) certificate. The
 * certificate does not define OPC UA specific fields, so it cannot be used
 * for an application instance certificate.
 * /*ww w .j  a  va2  s . c om*/
 * @param publicKey
 *            the public key to use for the certificate
 * @param privateKey
 *            the private key corresponding to the publicKey
 * @param issuerKeys
 *            the certificate and private key of the certificate issuer: if
 *            null a self-signed certificate is created.
 * @param commonName
 *            the CommonName to use for the subject of the certificate.
 * @param serialNr
 * @param startDate
 * @param expiryDate
 * @throws OperatorCreationException
 */
@Override
public X509Certificate generateIssuerCert(PublicKey publicKey, PrivateKey privateKey, KeyPair issuerKeys,
        String commonName, BigInteger serialNr, Date startDate, Date expiryDate)
        throws GeneralSecurityException, IOException {
    JcaX509v3CertificateBuilder certBldr;
    JcaX509ExtensionUtils extUtils = new JcaX509ExtensionUtils();
    AuthorityKeyIdentifier authorityKeyIdentifier;
    if (issuerKeys == null) {
        X500Name dn = new X500Name(commonName);
        certBldr = new JcaX509v3CertificateBuilder(dn, serialNr, startDate, expiryDate, dn, publicKey);
        authorityKeyIdentifier = extUtils.createAuthorityKeyIdentifier(publicKey);
    } else {
        X509Certificate caCert = issuerKeys.getCertificate().getCertificate();
        certBldr = new JcaX509v3CertificateBuilder(caCert, serialNr, startDate, expiryDate,
                new X500Principal(commonName), publicKey);
        authorityKeyIdentifier = extUtils.createAuthorityKeyIdentifier(caCert);
    }

    certBldr.addExtension(Extension.authorityKeyIdentifier, false, authorityKeyIdentifier)
            .addExtension(Extension.subjectKeyIdentifier, false, extUtils.createSubjectKeyIdentifier(publicKey))
            .addExtension(Extension.basicConstraints, true, new BasicConstraints(0))
            .addExtension(Extension.keyUsage, true,
                    new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyCertSign | KeyUsage.cRLSign));
    ContentSigner signer;
    try {
        signer = new JcaContentSignerBuilder(CertificateUtils.getCertificateSignatureAlgorithm())
                .setProvider("BC").build(privateKey);
    } catch (OperatorCreationException e) {
        throw new GeneralSecurityException("Failed to sign the certificate", e);
    }
    return new JcaX509CertificateConverter().setProvider("BC").getCertificate(certBldr.build(signer));
}

From source file:org.opcfoundation.ua.utils.BouncyCastleUtils.java

License:Open Source License

/**
 * Build a X509 V3 certificate to use as an issuer (CA) certificate. The
 * certificate does not define OPC UA specific fields, so it cannot be used
 * for an application instance certificate.
 * /*from   w  w w  .  j av a  2s  .co  m*/
 * @param publicKey
 *            the public key to use for the certificate
 * @param privateKey
 *            the private key corresponding to the publicKey
 * @param issuerKeys
 *            the certificate and private key of the certificate issuer: if
 *            null a self-signed certificate is created.
 * @param commonName
 *            the CommonName to use for the subject of the certificate.
 * @param serialNr
 * @param startDate
 * @param expiryDate
 * @throws OperatorCreationException
 */
public static X509Certificate generateIssuerCert(PublicKey publicKey, PrivateKey privateKey, KeyPair issuerKeys,
        String commonName, BigInteger serialNr, Date startDate, Date expiryDate)
        throws GeneralSecurityException, IOException {
    JcaX509v3CertificateBuilder certBldr;
    JcaX509ExtensionUtils extUtils = new JcaX509ExtensionUtils();
    AuthorityKeyIdentifier authorityKeyIdentifier;
    if (issuerKeys == null) {
        X500Name dn = new X500Name(commonName);
        certBldr = new JcaX509v3CertificateBuilder(dn, serialNr, startDate, expiryDate, dn, publicKey);
        authorityKeyIdentifier = extUtils.createAuthorityKeyIdentifier(publicKey);
    } else {
        X509Certificate caCert = issuerKeys.getCertificate().getCertificate();
        certBldr = new JcaX509v3CertificateBuilder(caCert, serialNr, startDate, expiryDate,
                new X500Principal(commonName), publicKey);
        authorityKeyIdentifier = extUtils.createAuthorityKeyIdentifier(caCert);
    }

    certBldr.addExtension(Extension.authorityKeyIdentifier, false, authorityKeyIdentifier)
            .addExtension(Extension.subjectKeyIdentifier, false, extUtils.createSubjectKeyIdentifier(publicKey))
            .addExtension(Extension.basicConstraints, true, new BasicConstraints(0))
            .addExtension(Extension.keyUsage, true,
                    new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyCertSign | KeyUsage.cRLSign));
    ContentSigner signer;
    try {
        signer = new JcaContentSignerBuilder(CertificateUtils.getCertificateSignatureAlgorithm())
                .setProvider("BC").build(privateKey);
    } catch (OperatorCreationException e) {
        throw new GeneralSecurityException("Failed to sign the certificate", e);
    }
    return new JcaX509CertificateConverter().setProvider("BC").getCertificate(certBldr.build(signer));
}

From source file:org.opcfoundation.ua.utils.BouncyCastleUtils.java

License:Open Source License

/**
 * Generates a new certificate using the Bouncy Castle implementation.
 * <p>//from   ww  w. j a v  a  2 s. c o m
 * The method is used from
 * {@link CertificateUtils#createApplicationInstanceCertificate(String, String, String, int, String...)}
 * and
 * {@link CertificateUtils#renewApplicationInstanceCertificate(String, String, String, int, org.opcfoundation.ua.transport.security.KeyPair, String...)}
 * 
 * @param domainName
 *            the X500 domain name for the certificate
 * @param publicKey
 *            the public key of the cert
 * @param privateKey
 *            the private key of the cert
 * @param issuerKeys
 *            the certificate and private key of the issuer
 * @param from
 *            validity start time
 * @param to
 *            validity end time
 * @param serialNumber
 *            a unique serial number for the certificate
 * @param applicationUri
 *            the OPC UA ApplicationUri of the application - added to
 *            SubjectAlternativeName
 * @param hostNames
 *            the additional host names to ass to SubjectAlternativeName
 * @return the generated certificate
 * @throws GeneralSecurityException
 *             if the generation fails
 * @throws IOException
 *             if the generation fails due to an IO exception
 */
public static X509Certificate generateCertificate(String domainName, PublicKey publicKey, PrivateKey privateKey,
        KeyPair issuerKeys, Date from, Date to, BigInteger serial, String applicationUri, String... hostNames)
        throws IOException, GeneralSecurityException {

    JcaX509ExtensionUtils extUtils = new JcaX509ExtensionUtils();

    X509v3CertificateBuilder certBldr;
    AuthorityKeyIdentifier authorityKeyIdentifier;
    PrivateKey signerKey;
    if (issuerKeys == null) {
        X500Name dn = new X500Name(domainName);
        certBldr = new JcaX509v3CertificateBuilder(dn, serial, from, to, dn, publicKey);
        authorityKeyIdentifier = extUtils.createAuthorityKeyIdentifier(publicKey);
        signerKey = privateKey;
    } else {
        X509Certificate caCert = issuerKeys.getCertificate().getCertificate();
        certBldr = new JcaX509v3CertificateBuilder(caCert, serial, from, to, new X500Principal(domainName),
                publicKey);
        authorityKeyIdentifier = extUtils.createAuthorityKeyIdentifier(caCert);
        signerKey = issuerKeys.getPrivateKey().getPrivateKey();
    }
    certBldr.addExtension(Extension.authorityKeyIdentifier, false, authorityKeyIdentifier)
            .addExtension(Extension.subjectKeyIdentifier, false, extUtils.createSubjectKeyIdentifier(publicKey))
            .addExtension(Extension.basicConstraints, false, new BasicConstraints(false)).addExtension(
                    Extension.keyUsage, false, new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyEncipherment
                            | KeyUsage.nonRepudiation | KeyUsage.dataEncipherment | KeyUsage.keyCertSign));

    certBldr.addExtension(Extension.extendedKeyUsage, false, new ExtendedKeyUsage(
            new KeyPurposeId[] { KeyPurposeId.id_kp_serverAuth, KeyPurposeId.id_kp_clientAuth }));

    //      Vector<KeyPurposeId> extendedKeyUsages = new Vector<KeyPurposeId>();
    //      extendedKeyUsages.add(KeyPurposeId.id_kp_serverAuth);
    //      extendedKeyUsages.add(KeyPurposeId.id_kp_clientAuth);
    //      certBldr.addExtension(Extension.extendedKeyUsage, false,
    //            new ExtendedKeyUsage(extendedKeyUsages));

    // BC 1.49:
    //      certBldr.addExtension(X509Extension.extendedKeyUsage, false,
    //            new ExtendedKeyUsage(new KeyPurposeId[] {
    //                  KeyPurposeId.id_kp_serverAuth,
    //                  KeyPurposeId.id_kp_clientAuth }));
    // create the extension value

    // URI Name
    List<GeneralName> names = new ArrayList<GeneralName>();
    names.add(new GeneralName(GeneralName.uniformResourceIdentifier, applicationUri));

    // Add DNS name from ApplicationUri
    boolean hasDNSName = false;
    String uriHostName = null;
    try {
        String[] appUriParts = applicationUri.split("[:/]");
        if (appUriParts.length > 1) {
            uriHostName = appUriParts[1];
            if (!uriHostName.toLowerCase().equals("localhost")) {
                GeneralName dnsName = new GeneralName(GeneralName.dNSName, uriHostName);
                names.add(dnsName);
                hasDNSName = true;
            }
        }
    } catch (Exception e) {
        logger.warn("Cannot initialize DNS Name to Certificate from ApplicationUri {}", applicationUri);
    }

    // Add other DNS Names
    List<GeneralName> ipAddressNames = new ArrayList<GeneralName>();
    if (hostNames != null)
        for (String hostName : hostNames) {
            boolean isIpAddress = hostName.matches("^[0-9.]+$");
            if (!hostName.equals(uriHostName) && !hostName.toLowerCase().equals("localhost")) {
                GeneralName dnsName = new GeneralName(
                        hostName.matches("^[0-9.]+$") ? GeneralName.iPAddress : GeneralName.dNSName, hostName);
                if (isIpAddress)
                    ipAddressNames.add(dnsName);
                else {
                    names.add(dnsName);
                    hasDNSName = true;
                }
            }
        }
    // Add IP Addresses, if no host names are defined
    if (!hasDNSName)
        for (GeneralName n : ipAddressNames)
            names.add(n);

    final GeneralNames subjectAltNames = new GeneralNames(names.toArray(new GeneralName[0]));
    certBldr.addExtension(Extension.subjectAlternativeName, false, subjectAltNames);

    //***** generate certificate ***********/
    try {
        ContentSigner signer = new JcaContentSignerBuilder(CertificateUtils.getCertificateSignatureAlgorithm())
                .setProvider("BC").build(signerKey);
        return new JcaX509CertificateConverter().setProvider("BC").getCertificate(certBldr.build(signer));
    } catch (OperatorCreationException e) {
        throw new GeneralSecurityException(e);
    }
}

From source file:org.opendaylight.snbi.southplugin.CertificateMgmt.java

License:Open Source License

@SuppressWarnings("deprecation")
public static X509Certificate generateSelfSignedCACertificate(String hostname, String provider, KeyPair pair) {
    logger.info("Creating self signed certificate ");
    X509Certificate cert = null;/*from w  w w . j  a  v  a2s.  c o  m*/
    try {
        Security.addProvider(new BouncyCastleProvider());
        String subject = hostname;
        String issuerName = hostname;
        X500Name subjectFormated = new X500NameBuilder(BCStyle.INSTANCE).addRDN(BCStyle.CN, subject).build();
        X500Name issuerFormated = new X500NameBuilder(BCStyle.INSTANCE).addRDN(BCStyle.CN, issuerName).build();
        BigInteger serialNumber = BigInteger.ONE;
        Calendar now = Calendar.getInstance();
        now.add(Calendar.YEAR, -1);
        Date notBefore = now.getTime();
        now.add(Calendar.YEAR, 4);
        Date notAfter = now.getTime();
        JcaX509v3CertificateBuilder builder = null;
        builder = new JcaX509v3CertificateBuilder(issuerFormated, serialNumber, notBefore, notAfter,
                subjectFormated, pair.getPublic());
        // Generate self-signed certificate
        //  X500NameBuilder builder = new X500NameBuilder(BCStyle.INSTANCE);
        // builder.addRDN(BCStyle.CN, hostname);
        builder.addExtension(X509Extension.basicConstraints, true, new BasicConstraints(true));
        SubjectKeyIdentifier subjectKeyIdentifier = new JcaX509ExtensionUtils()
                .createSubjectKeyIdentifier(pair.getPublic());
        builder.addExtension(X509Extension.subjectKeyIdentifier, false, subjectKeyIdentifier);
        KeyUsage keyUsage = new KeyUsage(KeyUsage.keyCertSign);
        builder.addExtension(X509Extension.keyUsage, true, keyUsage);
        ExtendedKeyUsage extendedKeyUsage = new ExtendedKeyUsage(KeyPurposeId.anyExtendedKeyUsage);
        builder.addExtension(X509Extension.extendedKeyUsage, false, extendedKeyUsage);
        ContentSigner signer = new JcaContentSignerBuilder(
                CertManagerConstants.CERT_ALGORITHM.SHA1withRSA.toString()).setProvider(provider)
                        .build(pair.getPrivate());
        X509CertificateHolder holder = builder.build(signer);
        cert = (X509Certificate) java.security.cert.CertificateFactory.getInstance("X.509")
                .generateCertificate(new ByteArrayInputStream(holder.getEncoded()));
    } catch (Throwable t) {
        t.printStackTrace();
    }
    logger.info("Created self signed certificate ");
    return cert;
}

From source file:org.opendaylight.snbi.southplugin.CertificateMgmt.java

License:Open Source License

public static PKCS10CertificationRequest generateCSRRequest(String name, KeyPair pair) throws Exception {
    X500NameBuilder builder = new X500NameBuilder(BCStyle.INSTANCE);
    //        builder.addRDN(BCStyle.C, defaults.get("COUNTRY"));
    //        builder.addRDN(BCStyle.O, defaults.get("ORGANIZATION"));
    // builder.addRDN(BCStyle.ST, defaults.get("STATE"));
    // builder.addRDN(BCStyle.T, defaults.get("TITLE"));
    builder.addRDN(BCStyle.SN, BigInteger.valueOf(System.currentTimeMillis()).toString());
    builder.addRDN(BCStyle.CN, name);//from www . j av  a 2  s  .co  m
    PKCS10CertificationRequestBuilder p10Builder = new JcaPKCS10CertificationRequestBuilder(builder.build(),
            pair.getPublic());
    JcaContentSignerBuilder csBuilder = new JcaContentSignerBuilder(
            CertManagerConstants.CERT_ALGORITHM.SHA1withRSA.toString());
    ContentSigner signer = csBuilder.build(pair.getPrivate());
    PKCS10CertificationRequest csr = p10Builder.build(signer);
    return csr;
}

From source file:org.opendaylight.snbi.southplugin.CertificateMgmt.java

License:Open Source License

public static X509Certificate[] buildChain(String provider, KeyPair pair) throws Exception {
    X509Certificate rootCert = CertificateMgmt.getSavedCertificate(CertManagerConstants.BC,
            CertManagerConstants.SELF_SIGNED_CERT_FILE);
    KeyPair rootPair = KeyPairMgmt.getKeyPairFromStore(CertManagerConstants.KEY_STORE_ALIAS,
            CertManagerConstants.KEY_STORE_CERT_ALIAS, CertManagerConstants.STORE_TYPE.JKS);
    KeyPair keyPair = KeyPairMgmt.generateKeyPair(CertManagerConstants.ALGORITHM.RSA);
    PKCS10CertificationRequest request = generateCSRRequest("Node", pair);
    Calendar now = Calendar.getInstance();
    Date notBefore = now.getTime();
    now.add(Calendar.YEAR, 3);//from ww  w  .j av a2s  .co  m
    Date notAfter = now.getTime();
    BigInteger serial = BigInteger.valueOf(System.currentTimeMillis());
    X509v3CertificateBuilder certGen = new JcaX509v3CertificateBuilder(request.getSubject(), serial, notBefore,
            notAfter, request.getSubject(), rootCert.getPublicKey());
    ContentSigner sigGen = new JcaContentSignerBuilder(
            CertManagerConstants.CERT_ALGORITHM.SHA1withRSA.toString()).setProvider(provider)
                    .build(rootPair.getPrivate());
    X509Certificate issuedCert = new JcaX509CertificateConverter().setProvider(provider)
            .getCertificate(certGen.build(sigGen));
    return new X509Certificate[] { issuedCert, rootCert };
}

From source file:org.opendaylight.snbi.southplugin.CertificateMgmt.java

License:Open Source License

public static X509Certificate signCSR(CertificationRequest inputCSR, PrivateKey caPrivate, KeyPair pair)
        throws InvalidKeyException, NoSuchAlgorithmException, NoSuchProviderException, SignatureException,
        IOException, OperatorCreationException, CertException {

    PKCS10CertificationRequest pk10Holder = new PKCS10CertificationRequest(inputCSR);
    X500NameBuilder builder = new X500NameBuilder(BCStyle.INSTANCE);
    //        builder.addRDN(BCStyle.C, defaults.get("COUNTRY"));
    //        builder.addRDN(BCStyle.O, defaults.get("ORGANIZATION"));
    //builder.addRDN(BCStyle.ST, defaults.get("STATE"));
    // builder.addRDN(BCStyle.T, defaults.get("TITLE"));
    builder.addRDN(BCStyle.CN, inputCSR.getSignature());
    Calendar now = Calendar.getInstance();
    Date notBefore = now.getTime();
    now.add(Calendar.YEAR, 3);/*from   w  w  w .  j a v  a 2 s.co m*/
    Date notAfter = now.getTime();
    BigInteger serial = BigInteger.valueOf(System.currentTimeMillis());
    X509v3CertificateBuilder certGen = new JcaX509v3CertificateBuilder(builder.build(), serial, notBefore,
            notAfter, builder.build(), pair.getPublic());
    ContentSigner sigGen = new JcaContentSignerBuilder(
            CertManagerConstants.CERT_ALGORITHM.SHA1withRSA.toString()).setProvider(CertManagerConstants.BC)
                    .build(pair.getPrivate());
    X509CertificateHolder holder = certGen.build(sigGen);
    Certificate eeX509CertificateStructure = holder.toASN1Structure();
    CertificateFactory cf = null;
    try {
        cf = CertificateFactory.getInstance(CertManagerConstants.CERT_TYPE.X509.toString(),
                CertManagerConstants.BC);
    } catch (CertificateException e) {
        e.printStackTrace();
    }
    // Read Certificate
    InputStream is1 = new ByteArrayInputStream(eeX509CertificateStructure.getEncoded());
    X509Certificate theCert = null;
    try {
        theCert = (X509Certificate) cf.generateCertificate(is1);
    } catch (CertificateException e) {
        e.printStackTrace();
    }
    is1.close();
    return theCert;
}