Example usage for org.bouncycastle.pkcs PKCS10CertificationRequest PKCS10CertificationRequest

List of usage examples for org.bouncycastle.pkcs PKCS10CertificationRequest PKCS10CertificationRequest

  1. HOME
  2. Java
  3. org.bouncycastle
  4. org.bouncycastle.pkcs.*
  5. PKCS10CertificationRequest
  6. PKCS10CertificationRequest

Introduction

In this page you can find the example usage for org.bouncycastle.pkcs PKCS10CertificationRequest PKCS10CertificationRequest.

Prototype

public PKCS10CertificationRequest(byte[] encoded) throws IOException

Source Link

Document

Create a PKCS10CertificationRequestHolder from the passed in bytes.

Usage

From source file:net.jmhertlein.mcanalytics.plugin.daemon.request.AuthenticationRequestHandler.java

License:Open Source License

private boolean signClientKey(JSONObject request, JSONObject response) {
    String username = request.getString("username");
    PKCS10CertificationRequest csr;//w w w . jav  a  2  s .co m
    try {
        csr = new PKCS10CertificationRequest(Base64.decodeBase64(request.getString("csr")));
    } catch (IOException ex) {
        return false;
    }

    Set<String> names = SSLUtil.getCNs(csr.getSubject());
    if (names.size() == 1 && names.contains(username)) {
        X509Certificate clientCert = SSLUtil.fulfillCertRequest(serverKey, serverCert, csr, false);
        try {
            response.put("cert", Base64.encodeBase64String(clientCert.getEncoded()));
            response.put("ca", Base64.encodeBase64String(serverCert.getEncoded()));
            return true;
        } catch (CertificateEncodingException ex) {
            Logger.getLogger(AuthenticationRequestHandler.class.getName()).log(Level.SEVERE, null, ex);
            return false;
        }
    } else {
        return false;
    }
}

From source file:net.ripe.rpki.commons.provisioning.payload.issue.request.CertificateIssuanceRequestElementConverter.java

License:BSD License

private PKCS10CertificationRequest decodeCertificateRequest(HierarchicalStreamReader reader,
        UnmarshallingContext context) throws IOException {
    String encodedCertificate = reader.getValue();
    Validate.notNull(encodedCertificate, "No certificate found");

    byte[] base64DecodedCertificate = (byte[]) context.convertAnother(encodedCertificate.getBytes(),
            byte[].class);

    return new PKCS10CertificationRequest(base64DecodedCertificate);
}

From source file:net.ripe.rpki.commons.provisioning.x509.pkcs10.RpkiCaCertificateRequestBuilderParserTest.java

License:BSD License

@Test
public void shouldBuildParseEncodedRpkiCaCertRequest() throws Exception {

    PKCS10CertificationRequest pkcs10Request = createRpkiCaCertificateRequest();

    assertNotNull(pkcs10Request);

    PKCS10CertificationRequest decodedPkcs10Request = new PKCS10CertificationRequest(
            pkcs10Request.getEncoded());

    RpkiCaCertificateRequestParser requestParser = new RpkiCaCertificateRequestParser(decodedPkcs10Request);

    Assert.assertEquals(ProvisioningObjectMother.RPKI_CA_CERT_REQUEST_CA_REPO_URI,
            requestParser.getCaRepositoryUri());
    Assert.assertEquals(ProvisioningObjectMother.RPKI_CA_CERT_REQUEST_CA_MFT_URI,
            requestParser.getManifestUri());
    Assert.assertEquals(ProvisioningObjectMother.RPKI_CA_CERT_REQUEST_KEYPAIR.getPublic(),
            requestParser.getPublicKey());
}

From source file:net.sf.keystore_explorer.crypto.csr.pkcs10.Pkcs10Util.java

License:Open Source License

/**
 * Load a PKCS #10 CSR from the specified stream. The encoding of the CSR
 * may be PEM or DER.//  w  ww. j av  a 2 s  .  c o m
 *
 * @param is
 *            Stream to load CSR from
 * @return The CSR
 * @throws IOException
 *             An I/O error occurred
 */
public static PKCS10CertificationRequest loadCsr(InputStream is) throws IOException {
    byte[] streamContents = ReadUtil.readFully(is);

    byte[] csrBytes = null;
    LineNumberReader lnr = null;

    // Assume file is PEM until we find out otherwise
    try {
        lnr = new LineNumberReader(new InputStreamReader(new ByteArrayInputStream(streamContents)));

        String line = lnr.readLine();
        StringBuffer sbPem = new StringBuffer();

        if ((line != null) && ((line.equals(BEGIN_CSR_FORM_1) || line.equals(BEGIN_CSR_FORM_2)))) {
            while ((line = lnr.readLine()) != null) {
                if (line.equals(END_CSR_FORM_1) || line.equals(END_CSR_FORM_2)) {
                    csrBytes = Base64.decode(sbPem.toString());
                    break;
                }

                sbPem.append(line);
            }
        }
    } finally {
        IOUtils.closeQuietly(lnr);
    }

    // Not PEM - must be DER encoded
    if (csrBytes == null) {
        csrBytes = streamContents;
    }

    PKCS10CertificationRequest csr = new PKCS10CertificationRequest(csrBytes);

    return csr;
}

From source file:net.solarnetwork.node.setup.test.DefaultKeystoreServiceTest.java

License:Open Source License

@Test
public void saveCASignedCert() throws Exception {
    SetupIdentityInfo info = new SetupIdentityInfo(1L, TEST_CONF_VALUE, "localhost", 80, false, TEST_PW_VALUE);
    expect(setupIdentityDao.getSetupIdentityInfo()).andReturn(info).atLeastOnce();
    replayAll();/* ww w  .  j a v a2s. c o m*/
    service.saveCACertificate(CA_CERT);
    service.generateNodeSelfSignedCertificate(TEST_DN);
    String csr = service.generateNodePKCS10CertificateRequestString();

    PemReader pemReader = new PemReader(new StringReader(csr));
    try {
        PemObject pem = pemReader.readPemObject();
        PKCS10CertificationRequest req = new PKCS10CertificationRequest(pem.getContent());
        X509Certificate signedCert = PKITestUtils.sign(req, CA_CERT, CA_KEY_PAIR.getPrivate());
        String signedPem = PKITestUtils.getPKCS7Encoding(new X509Certificate[] { signedCert });
        service.saveNodeSignedCertificate(signedPem);

        log.debug("Saved signed node certificate:\n{}", signedPem);

        assertNotNull(csr);
    } finally {
        pemReader.close();
    }
}

From source file:net.solarnetwork.node.setup.test.DefaultKeystoreServiceTest.java

License:Open Source License

@Test
public void saveCASubSignedCert() throws Exception {
    SetupIdentityInfo info = new SetupIdentityInfo(1L, TEST_CONF_VALUE, "localhost", 80, false, TEST_PW_VALUE);
    expect(setupIdentityDao.getSetupIdentityInfo()).andReturn(info).atLeastOnce();
    replayAll();/*from w ww  .  ja  v  a 2 s  . c  o  m*/
    service.saveCACertificate(CA_CERT);
    service.generateNodeSelfSignedCertificate(TEST_DN);
    String csr = service.generateNodePKCS10CertificateRequestString();

    PemReader pemReader = new PemReader(new StringReader(csr));
    try {
        PemObject pem = pemReader.readPemObject();
        PKCS10CertificationRequest req = new PKCS10CertificationRequest(pem.getContent());
        X509Certificate signedCert = PKITestUtils.sign(req, CA_SUB_CERT, CA_SUB_KEY_PAIR.getPrivate());
        String signedPem = PKITestUtils
                .getPKCS7Encoding(new X509Certificate[] { signedCert, CA_SUB_CERT, CA_CERT });
        service.saveNodeSignedCertificate(signedPem);

        log.debug("Saved signed node certificate:\n{}", signedPem);
        assertNotNull(csr);
    } finally {
        pemReader.close();
    }
}

From source file:net.solarnetwork.node.setup.test.DefaultSetupServiceTest.java

License:Open Source License

@Test
public void handleRenewCertificateInstruction() throws Exception {
    SetupIdentityInfo info = new SetupIdentityInfo(1L, TEST_CONF_VALUE, "localhost", 80, false, TEST_PW_VALUE);
    expect(setupIdentityDao.getSetupIdentityInfo()).andReturn(info).atLeastOnce();
    replayAll();/*from  w  ww .ja va2  s.  c  o m*/
    keystoreService.saveCACertificate(CA_CERT);
    keystoreService.generateNodeSelfSignedCertificate(TEST_DN);
    String csr = keystoreService.generateNodePKCS10CertificateRequestString();

    X509Certificate originalCert;

    PemReader pemReader = new PemReader(new StringReader(csr));
    try {
        PemObject pem = pemReader.readPemObject();
        PKCS10CertificationRequest req = new PKCS10CertificationRequest(pem.getContent());
        originalCert = PKITestUtils.sign(req, CA_CERT, CA_KEY_PAIR.getPrivate());
        String signedPem = PKITestUtils.getPKCS7Encoding(new X509Certificate[] { originalCert });
        keystoreService.saveNodeSignedCertificate(signedPem);

        log.debug("Saved signed node certificate {}:\n{}", originalCert.getSerialNumber(), signedPem);

        assertThat("Generated CSR", csr, notNullValue());
    } finally {
        pemReader.close();
    }

    // now let's renew!
    KeyStore keyStore = loadKeyStore();
    PrivateKey nodeKey = (PrivateKey) keyStore.getKey("node", TEST_PW_VALUE.toCharArray());
    JcaContentSignerBuilder signerBuilder = new JcaContentSignerBuilder("SHA256WithRSA");
    ContentSigner signer = signerBuilder.build(nodeKey);
    PKCS10CertificationRequestBuilder builder = new PKCS10CertificationRequestBuilder(
            JcaX500NameUtil.getSubject(originalCert),
            SubjectPublicKeyInfo.getInstance(originalCert.getPublicKey().getEncoded()));
    X509Certificate renewedCert = PKITestUtils.sign(builder.build(signer), CA_CERT, CA_KEY_PAIR.getPrivate());
    String renewedSignedPem = PKITestUtils.getPKCS7Encoding(new X509Certificate[] { renewedCert });

    BasicInstruction instr = new BasicInstruction(DefaultSetupService.INSTRUCTION_TOPIC_RENEW_CERTIFICATE,
            new Date(), "123", "456", new BasicInstructionStatus(456L, InstructionState.Received, new Date()));
    for (int i = 0; i < renewedSignedPem.length(); i += 256) {
        int end = i + (i + 256 < renewedSignedPem.length() ? 256 : renewedSignedPem.length() - i);
        instr.addParameter(DefaultSetupService.INSTRUCTION_PARAM_CERTIFICATE,
                renewedSignedPem.substring(i, end));
    }

    InstructionState state = service.processInstruction(instr);
    assertThat("Instruction state", state, equalTo(InstructionState.Completed));

    X509Certificate nodeCert = keystoreService.getNodeCertificate();
    assertThat("Node cert is now renewed cert", nodeCert, equalTo(renewedCert));
}

From source file:net.solarnetwork.node.setup.test.DefaultSetupServiceTest.java

License:Open Source License

@Test
public void renewNetworkCertificate() throws Exception {
    SetupIdentityInfo info = new SetupIdentityInfo(1L, TEST_CONF_VALUE, TEST_SOLARIN_HOST, getHttpServerPort(),
            false, TEST_PW_VALUE);//from  ww w  . j  a va  2  s . co m
    expect(setupIdentityDao.getSetupIdentityInfo()).andReturn(info).atLeastOnce();
    replayAll();
    keystoreService.saveCACertificate(CA_CERT);
    keystoreService.generateNodeSelfSignedCertificate(TEST_DN);
    String csr = keystoreService.generateNodePKCS10CertificateRequestString();

    X509Certificate originalCert;

    PemReader pemReader = new PemReader(new StringReader(csr));
    try {
        PemObject pem = pemReader.readPemObject();
        PKCS10CertificationRequest req = new PKCS10CertificationRequest(pem.getContent());
        originalCert = PKITestUtils.sign(req, CA_CERT, CA_KEY_PAIR.getPrivate());
        String signedPem = PKITestUtils.getPKCS7Encoding(new X509Certificate[] { originalCert });
        keystoreService.saveNodeSignedCertificate(signedPem);

        log.debug("Saved signed node certificate {}:\n{}", originalCert.getSerialNumber(), signedPem);

        assertThat("Generated CSR", csr, notNullValue());
    } finally {
        pemReader.close();
    }

    // now let's renew!
    AbstractTestHandler handler = new AbstractTestHandler() {

        @Override
        protected boolean handleInternal(String target, HttpServletRequest request,
                HttpServletResponse response, int dispatch) throws Exception {
            assertEquals("POST", request.getMethod());
            assertEquals("/solarin/api/v1/sec/cert/renew", target);
            String password = request.getParameter("password");
            assertEquals("foobar", password);

            String keystoreData = request.getParameter("keystore");
            assertNotNull(keystoreData);
            byte[] data = Base64.decodeBase64(keystoreData);
            KeyStore keyStore = KeyStore.getInstance("pkcs12");
            keyStore.load(new ByteArrayInputStream(data), password.toCharArray());
            Certificate cert = keyStore.getCertificate("node");
            assertNotNull(cert);
            assertTrue(cert instanceof X509Certificate);
            X509Certificate nodeCert = (X509Certificate) cert;
            assertEquals(new X500Principal(TEST_DN), nodeCert.getSubjectX500Principal());
            assertEquals(CA_CERT.getSubjectX500Principal(), nodeCert.getIssuerX500Principal());

            response.setContentType("application/json");
            PrintWriter out = response.getWriter();
            out.write("{\"success\":true}");
            out.flush();
            response.flushBuffer();
            return true;
        }

    };
    httpServer.addHandler(handler);

    service.renewNetworkCertificate("foobar");
}

From source file:net.solarnetwork.pki.bc.BCCertificateService.java

License:Open Source License

@Override
public X509Certificate signCertificate(String csrPEM, X509Certificate caCert, PrivateKey privateKey)
        throws CertificateException {
    if (!csrPEM.matches("(?is)^\\s*-----BEGIN.*")) {
        // let's throw in the guards
        csrPEM = "-----BEGIN CERTIFICATE REQUEST-----\n" + csrPEM + "\n-----END CERTIFICATE REQUEST-----\n";
    }//from   w ww.  ja v  a2  s .co  m
    PemReader reader = null;
    try {
        reader = new PemReader(new StringReader(csrPEM));
        PemObject pemObj = reader.readPemObject();
        log.debug("Parsed PEM type {}", pemObj.getType());
        PKCS10CertificationRequest csr = new PKCS10CertificationRequest(pemObj.getContent());

        Date now = new Date();
        Date expire = new Date(now.getTime() + (1000L * 60L * 60L * 24L * certificateExpireDays));
        X509v3CertificateBuilder builder = new X509v3CertificateBuilder(JcaX500NameUtil.getIssuer(caCert),
                new BigInteger(String.valueOf(counter.incrementAndGet())), now, expire, csr.getSubject(),
                csr.getSubjectPublicKeyInfo());

        JcaContentSignerBuilder signerBuilder = new JcaContentSignerBuilder(signatureAlgorithm);
        ContentSigner signer;
        DefaultDigestAlgorithmIdentifierFinder digestAlgFinder = new DefaultDigestAlgorithmIdentifierFinder();
        try {
            DigestCalculatorProvider digestCalcProvider = new JcaDigestCalculatorProviderBuilder()
                    .setProvider(new BouncyCastleProvider()).build();
            JcaX509ExtensionUtils extUtils = new JcaX509ExtensionUtils(
                    digestCalcProvider.get(digestAlgFinder.find("SHA-256")));
            builder.addExtension(X509Extension.basicConstraints, false, new BasicConstraints(false));
            builder.addExtension(X509Extension.subjectKeyIdentifier, false,
                    extUtils.createSubjectKeyIdentifier(csr.getSubjectPublicKeyInfo()));
            builder.addExtension(X509Extension.authorityKeyIdentifier, false,
                    extUtils.createAuthorityKeyIdentifier(caCert));

            signer = signerBuilder.build(privateKey);
        } catch (OperatorException e) {
            log.error("Error signing CSR {}", csr.getSubject(), e);
            throw new CertificateException("Error signing CSR" + csr.getSubject() + ": " + e.getMessage());
        } catch (CertificateEncodingException e) {
            log.error("Error signing CSR {}", csr.getSubject().toString(), e);
            throw new CertificateException("Error signing CSR" + csr.getSubject() + ": " + e.getMessage());
        }

        X509CertificateHolder holder = builder.build(signer);
        JcaX509CertificateConverter converter = new JcaX509CertificateConverter();
        try {
            return converter.getCertificate(holder);
        } catch (java.security.cert.CertificateException e) {
            throw new CertificateException("Error creating certificate", e);
        }
    } catch (IOException e) {
        throw new CertificateException("Error signing CSR", e);
    } finally {
        if (reader != null) {
            try {
                reader.close();
            } catch (IOException e2) {
                log.warn("IOException closing PemReader", e2);
            }
        }
    }
}

From source file:org.cesecore.certificates.ca.X509CATest.java

License:Open Source License

@SuppressWarnings("unchecked")
private void doTestX509CABasicOperations(String algName) throws Exception {
    final CryptoToken cryptoToken = getNewCryptoToken();
    final X509CA x509ca = createTestCA(cryptoToken, CADN);
    Certificate cacert = x509ca.getCACertificate();

    // Start by creating a PKCS7
    byte[] p7 = x509ca.createPKCS7(cryptoToken, cacert, true);
    assertNotNull(p7);//from   w w w  .  j  a  v a 2  s  .  c  o m
    CMSSignedData s = new CMSSignedData(p7);
    Store certstore = s.getCertificates();
    Collection<X509CertificateHolder> certs = certstore.getMatches(null);
    assertEquals(2, certs.size());
    p7 = x509ca.createPKCS7(cryptoToken, cacert, false);
    assertNotNull(p7);
    s = new CMSSignedData(p7);
    certstore = s.getCertificates();
    certs = certstore.getMatches(null);
    assertEquals(1, certs.size());

    // Create a certificate request (will be pkcs10)
    byte[] req = x509ca.createRequest(cryptoToken, null, algName, cacert,
            CATokenConstants.CAKEYPURPOSE_CERTSIGN);
    PKCS10CertificationRequest p10 = new PKCS10CertificationRequest(req);
    assertNotNull(p10);
    String dn = p10.getSubject().toString();
    assertEquals(CADN, dn);

    // Make a request with some pkcs11 attributes as well
    Collection<ASN1Encodable> attributes = new ArrayList<ASN1Encodable>();
    // Add a subject alternative name
    ASN1EncodableVector altnameattr = new ASN1EncodableVector();
    altnameattr.add(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest);
    GeneralNames san = CertTools.getGeneralNamesFromAltName("dNSName=foobar.bar.com");
    ExtensionsGenerator extgen = new ExtensionsGenerator();
    extgen.addExtension(Extension.subjectAlternativeName, false, san);
    Extensions exts = extgen.generate();
    altnameattr.add(new DERSet(exts));
    // Add a challenge password as well
    ASN1EncodableVector pwdattr = new ASN1EncodableVector();
    pwdattr.add(PKCSObjectIdentifiers.pkcs_9_at_challengePassword);
    ASN1EncodableVector pwdvalues = new ASN1EncodableVector();
    pwdvalues.add(new DERUTF8String("foobar123"));
    pwdattr.add(new DERSet(pwdvalues));
    attributes.add(new DERSequence(altnameattr));
    attributes.add(new DERSequence(pwdattr));
    // create the p10
    req = x509ca.createRequest(cryptoToken, attributes, algName, cacert,
            CATokenConstants.CAKEYPURPOSE_CERTSIGN);
    p10 = new PKCS10CertificationRequest(req);
    assertNotNull(p10);
    dn = p10.getSubject().toString();
    assertEquals(CADN, dn);
    Attribute[] attrs = p10.getAttributes();
    assertEquals(2, attrs.length);
    PKCS10RequestMessage p10msg = new PKCS10RequestMessage(new JcaPKCS10CertificationRequest(p10));
    assertEquals("foobar123", p10msg.getPassword());
    assertEquals("dNSName=foobar.bar.com", p10msg.getRequestAltNames());

    try {
        x509ca.createAuthCertSignRequest(cryptoToken, p10.getEncoded());
    } catch (UnsupportedOperationException e) {
        // Expected for a X509 CA
    }

    // Generate a client certificate and check that it was generated correctly
    EndEntityInformation user = new EndEntityInformation("username", "CN=User", 666, "rfc822Name=user@user.com",
            "user@user.com", new EndEntityType(EndEntityTypes.ENDUSER), 0, 0, EndEntityConstants.TOKEN_USERGEN,
            0, null);
    KeyPair keypair = genTestKeyPair(algName);
    CertificateProfile cp = new CertificateProfile(CertificateProfileConstants.CERTPROFILE_FIXED_ENDUSER);
    cp.addCertificatePolicy(new CertificatePolicy("1.1.1.2", null, null));
    cp.setUseCertificatePolicies(true);
    Certificate usercert = x509ca.generateCertificate(cryptoToken, user, keypair.getPublic(), 0, null, 10L, cp,
            "00000");
    assertNotNull(usercert);
    assertEquals("CN=User", CertTools.getSubjectDN(usercert));
    assertEquals(CADN, CertTools.getIssuerDN(usercert));
    assertEquals(getTestKeyPairAlgName(algName).toUpperCase(),
            AlgorithmTools.getCertSignatureAlgorithmNameAsString(usercert).toUpperCase());
    assertEquals(new String(CertTools.getSubjectKeyId(cacert)),
            new String(CertTools.getAuthorityKeyId(usercert)));
    assertEquals("user@user.com", CertTools.getEMailAddress(usercert));
    assertEquals("rfc822name=user@user.com", CertTools.getSubjectAlternativeName(usercert));
    assertNull(CertTools.getUPNAltName(usercert));
    assertFalse(CertTools.isSelfSigned(usercert));
    usercert.verify(cryptoToken
            .getPublicKey(x509ca.getCAToken().getAliasFromPurpose(CATokenConstants.CAKEYPURPOSE_CERTSIGN)));
    usercert.verify(x509ca.getCACertificate().getPublicKey());
    assertTrue(CertTools.isCA(x509ca.getCACertificate()));
    assertFalse(CertTools.isCA(usercert));
    assertEquals("1.1.1.2", CertTools.getCertificatePolicyId(usercert, 0));
    X509Certificate cert = (X509Certificate) usercert;
    boolean[] ku = cert.getKeyUsage();
    assertTrue(ku[0]);
    assertTrue(ku[1]);
    assertTrue(ku[2]);
    assertFalse(ku[3]);
    assertFalse(ku[4]);
    assertFalse(ku[5]);
    assertFalse(ku[6]);
    assertFalse(ku[7]);
    int bcku = CertTools.sunKeyUsageToBC(ku);
    assertEquals(X509KeyUsage.digitalSignature | X509KeyUsage.nonRepudiation | X509KeyUsage.keyEncipherment,
            bcku);

    // Create a CRL
    Collection<RevokedCertInfo> revcerts = new ArrayList<RevokedCertInfo>();
    X509CRLHolder crl = x509ca.generateCRL(cryptoToken, revcerts, 1);
    assertNotNull(crl);
    X509CRL xcrl = CertTools.getCRLfromByteArray(crl.getEncoded());
    assertEquals(CADN, CertTools.getIssuerDN(xcrl));
    Set<?> set = xcrl.getRevokedCertificates();
    assertNull(set);
    BigInteger num = CrlExtensions.getCrlNumber(xcrl);
    assertEquals(1, num.intValue());
    BigInteger deltanum = CrlExtensions.getDeltaCRLIndicator(xcrl);
    assertEquals(-1, deltanum.intValue());
    // Revoke some cert
    Date revDate = new Date();
    revcerts.add(new RevokedCertInfo(CertTools.getFingerprintAsString(usercert).getBytes(),
            CertTools.getSerialNumber(usercert).toByteArray(), revDate.getTime(),
            RevokedCertInfo.REVOCATION_REASON_CERTIFICATEHOLD, CertTools.getNotAfter(usercert).getTime()));
    crl = x509ca.generateCRL(cryptoToken, revcerts, 2);
    assertNotNull(crl);
    xcrl = CertTools.getCRLfromByteArray(crl.getEncoded());
    set = xcrl.getRevokedCertificates();
    assertEquals(1, set.size());
    num = CrlExtensions.getCrlNumber(xcrl);
    assertEquals(2, num.intValue());
    X509CRLEntry entry = (X509CRLEntry) set.iterator().next();
    assertEquals(CertTools.getSerialNumber(usercert).toString(), entry.getSerialNumber().toString());
    assertEquals(revDate.toString(), entry.getRevocationDate().toString());
    // Getting the revocation reason is a pita...
    byte[] extval = entry.getExtensionValue(Extension.reasonCode.getId());
    ASN1InputStream aIn = new ASN1InputStream(new ByteArrayInputStream(extval));
    ASN1OctetString octs = (ASN1OctetString) aIn.readObject();
    aIn = new ASN1InputStream(new ByteArrayInputStream(octs.getOctets()));
    ASN1Primitive obj = aIn.readObject();
    CRLReason reason = CRLReason.getInstance((ASN1Enumerated) obj);
    assertEquals("CRLReason: certificateHold", reason.toString());
    //DEROctetString ostr = (DEROctetString)obj;

    // Create a delta CRL
    revcerts = new ArrayList<RevokedCertInfo>();
    crl = x509ca.generateDeltaCRL(cryptoToken, revcerts, 3, 2);
    assertNotNull(crl);
    xcrl = CertTools.getCRLfromByteArray(crl.getEncoded());
    assertEquals(CADN, CertTools.getIssuerDN(xcrl));
    set = xcrl.getRevokedCertificates();
    assertNull(set);
    num = CrlExtensions.getCrlNumber(xcrl);
    assertEquals(3, num.intValue());
    deltanum = CrlExtensions.getDeltaCRLIndicator(xcrl);
    assertEquals(2, deltanum.intValue());
    revcerts.add(new RevokedCertInfo(CertTools.getFingerprintAsString(usercert).getBytes(),
            CertTools.getSerialNumber(usercert).toByteArray(), revDate.getTime(),
            RevokedCertInfo.REVOCATION_REASON_CERTIFICATEHOLD, CertTools.getNotAfter(usercert).getTime()));
    crl = x509ca.generateDeltaCRL(cryptoToken, revcerts, 4, 3);
    assertNotNull(crl);
    xcrl = CertTools.getCRLfromByteArray(crl.getEncoded());
    deltanum = CrlExtensions.getDeltaCRLIndicator(xcrl);
    assertEquals(3, deltanum.intValue());
    set = xcrl.getRevokedCertificates();
    assertEquals(1, set.size());
    entry = (X509CRLEntry) set.iterator().next();
    assertEquals(CertTools.getSerialNumber(usercert).toString(), entry.getSerialNumber().toString());
    assertEquals(revDate.toString(), entry.getRevocationDate().toString());
    // Getting the revocation reason is a pita...
    extval = entry.getExtensionValue(Extension.reasonCode.getId());
    aIn = new ASN1InputStream(new ByteArrayInputStream(extval));
    octs = (ASN1OctetString) aIn.readObject();
    aIn = new ASN1InputStream(new ByteArrayInputStream(octs.getOctets()));
    obj = aIn.readObject();
    reason = CRLReason.getInstance((ASN1Enumerated) obj);
    assertEquals("CRLReason: certificateHold", reason.toString());
}