Example usage for org.bouncycastle.tsp TSPValidationException TSPValidationException

Introduction

In this page you can find the example usage for org.bouncycastle.tsp TSPValidationException TSPValidationException.

Prototype

public TSPValidationException(String message) 

Source Link

Usage

From source file:de.rub.dez6a3.jpdfsigner.TimeStampToken.java

License:Open Source License

public TimeStampToken(CMSSignedData signedData) throws TSPException, IOException {
    this.tsToken = signedData;

    if (!this.tsToken.getSignedContentTypeOID().equals(PKCSObjectIdentifiers.id_ct_TSTInfo.getId())) {
        throw new TSPValidationException("ContentInfo object not for a time stamp.");
    }/*www  .j av a2  s.c om*/

    Collection signers = tsToken.getSignerInfos().getSigners();

    if (signers.size() != 1) {
        throw new IllegalArgumentException("Time-stamp token signed by " + signers.size()
                + " signers, but it must contain just the TSA signature.");
    }

    tsaSignerInfo = (SignerInformation) signers.iterator().next();

    try {
        CMSProcessable content = tsToken.getSignedContent();
        ByteArrayOutputStream bOut = new ByteArrayOutputStream();

        content.write(bOut);

        ASN1InputStream aIn = new ASN1InputStream(new ByteArrayInputStream(bOut.toByteArray()));

        this.tstInfo = new TimeStampTokenInfo(TSTInfo.getInstance(aIn.readObject()));

        Attribute attr = tsaSignerInfo.getSignedAttributes()
                .get(PKCSObjectIdentifiers.id_aa_signingCertificate);

        if (attr == null) {
            throw new TSPValidationException("no signing certificate attribute found, time stamp invalid.");
        }

        SigningCertificate signCert = SigningCertificate.getInstance(attr.getAttrValues().getObjectAt(0));

        this.certID = ESSCertID.getInstance(signCert.getCerts()[0]);
    } catch (CMSException e) {
        throw new TSPException(e.getMessage(), e.getUnderlyingException());
    }
}

---

From source file:de.rub.dez6a3.jpdfsigner.TimeStampToken.java

License:Open Source License

/**
 * Validate the time stamp token.//from   ww  w .  ja  va2s  .  c o  m
 * <p>
 * To be valid the token must be signed by the passed in certificate and
 * the certificate must be the one refered to by the SigningCertificate
 * attribute included in the hashed attributes of the token. The
 * certifcate must also have the ExtendedKeyUsageExtension with only
 * KeyPurposeId.id_kp_timeStamping and have been valid at the time the
 * timestamp was created.
 * </p>
 * <p>
 * A successful call to validate means all the above are true.
 * </p>
 */
public void validate(X509Certificate cert, String provider) throws TSPException, TSPValidationException,
        CertificateExpiredException, CertificateNotYetValidException, NoSuchProviderException {
    try {
        if (!MessageDigest.isEqual(certID.getCertHash(),
                MessageDigest.getInstance("SHA-1").digest(cert.getEncoded()))) {
            throw new TSPValidationException("certificate hash does not match certID hash.");
        }

        if (certID.getIssuerSerial() != null) {
            if (!certID.getIssuerSerial().getSerial().getValue().equals(cert.getSerialNumber())) {
                throw new TSPValidationException(
                        "certificate serial number does not match certID for signature.");
            }

            GeneralName[] names = certID.getIssuerSerial().getIssuer().getNames();
            X509Principal principal = PrincipalUtil.getIssuerX509Principal(cert);
            boolean found = false;

            for (int i = 0; i != names.length; i++) {
                if (names[i].getTagNo() == 4
                        && new X509Principal(X509Name.getInstance(names[i].getName())).equals(principal)) {
                    found = true;
                    break;
                }
            }

            if (!found) {
                throw new TSPValidationException("certificate name does not match certID for signature. ");
            }
        }

        TSPUtil.validateCertificate(cert);

        cert.checkValidity(tstInfo.getGenTime());

        if (!tsaSignerInfo.verify(cert, provider)) {
            throw new TSPValidationException("signature not created by certificate.");
        }
    } catch (CMSException e) {
        if (e.getUnderlyingException() != null) {
            throw new TSPException(e.getMessage(), e.getUnderlyingException());
        } else {
            throw new TSPException("CMS exception: " + e, e);
        }
    } catch (NoSuchAlgorithmException e) {
        throw new TSPException("cannot find algorithm: " + e, e);
    } catch (CertificateEncodingException e) {
        throw new TSPException("problem processing certificate: " + e, e);
    }
}

---