Example usage for org.bouncycastle.x509 X509V2CRLGenerator addCRLEntry

Introduction

In this page you can find the example usage for org.bouncycastle.x509 X509V2CRLGenerator addCRLEntry.

Prototype

public void addCRLEntry(BigInteger userCertificate, Date revocationDate, X509Extensions extensions) 

Source Link

Document

Add a CRL entry with extensions.

Usage

From source file:chapter7.X509CRLExample.java

/**
 *
 * @param caCert//from   w w  w .  j  ava 2s . c  o  m
 * @param caKey
 * @param revokedSerialNumber
 * @return
 * @throws java.lang.Exception
 */
public static X509CRL createCRL(final X509Certificate caCert, final PrivateKey caKey,
        final BigInteger revokedSerialNumber) throws Exception {
    X509V2CRLGenerator crlGen = new X509V2CRLGenerator();
    Date now = new Date();

    crlGen.setIssuerDN(caCert.getSubjectX500Principal());

    crlGen.setThisUpdate(now);
    crlGen.setNextUpdate(new Date(now.getTime() + 100000));
    crlGen.setSignatureAlgorithm(CryptoDefs.Algorithm.SHA256withRSAEncryption.getName());

    crlGen.addCRLEntry(revokedSerialNumber, now, CRLReason.PRIVILEGE_WITHDRAWN.ordinal());

    crlGen.addExtension(X509Extensions.AuthorityKeyIdentifier, false,
            new AuthorityKeyIdentifierStructure(caCert));
    crlGen.addExtension(X509Extensions.CRLNumber, false, new CRLNumber(BigInteger.valueOf(1)));

    return crlGen.generateX509CRL(caKey, CryptoDefs.Provider.BC.getName());
}

---

From source file:io.aos.crypto.spl07.X509CRLExample.java

License:Apache License

public static X509CRL createCRL(X509Certificate caCert, PrivateKey caKey, BigInteger revokedSerialNumber)
        throws Exception {
    X509V2CRLGenerator crlGen = new X509V2CRLGenerator();
    Date now = new Date();

    crlGen.setIssuerDN(caCert.getSubjectX500Principal());

    crlGen.setThisUpdate(now);/*from ww w . jav a  2 s.  c o  m*/
    crlGen.setNextUpdate(new Date(now.getTime() + 100000));
    crlGen.setSignatureAlgorithm("SHA256WithRSAEncryption");

    crlGen.addCRLEntry(revokedSerialNumber, now, CRLReason.privilegeWithdrawn);

    crlGen.addExtension(X509Extensions.AuthorityKeyIdentifier, false,
            new AuthorityKeyIdentifierStructure(caCert));
    crlGen.addExtension(X509Extensions.CRLNumber, false, new CRLNumber(BigInteger.valueOf(1)));

    return crlGen.generateX509CRL(caKey, "BC");
}

---

From source file:org.apache.synapse.transport.certificatevalidation.CRLVerifierTest.java

License:Apache License

/**
 * Creates a fake CRL for the fake CA. The fake certificate with the given revokedSerialNumber will be marked
 * as Revoked in the returned CRL.//  w  w w.  j  a v a 2 s  .c o  m
 * @param caCert the fake CA certificate.
 * @param caPrivateKey private key of the fake CA.
 * @param revokedSerialNumber the serial number of the fake peer certificate made to be marked as revoked.
 * @return the created fake CRL
 * @throws Exception
 */
public static X509CRL createCRL(X509Certificate caCert, PrivateKey caPrivateKey, BigInteger revokedSerialNumber)
        throws Exception {

    X509V2CRLGenerator crlGen = new X509V2CRLGenerator();
    Date now = new Date();
    crlGen.setIssuerDN(caCert.getSubjectX500Principal());
    crlGen.setThisUpdate(now);
    crlGen.setNextUpdate(new Date(now.getTime() + TestConstants.NEXT_UPDATE_PERIOD));
    crlGen.setSignatureAlgorithm("SHA256WithRSAEncryption");
    crlGen.addCRLEntry(revokedSerialNumber, now, CRLReason.privilegeWithdrawn);
    crlGen.addExtension(X509Extensions.AuthorityKeyIdentifier, false,
            new AuthorityKeyIdentifierStructure(caCert));
    crlGen.addExtension(X509Extensions.CRLNumber, false, new CRLNumber(BigInteger.valueOf(1)));

    return crlGen.generateX509CRL(caPrivateKey, "BC");
}

---

From source file:org.candlepin.pki.impl.BouncyCastlePKIUtility.java

License:Open Source License

@Override
public X509CRL createX509CRL(List<X509CRLEntryWrapper> entries, BigInteger crlNumber) {

    try {//  w ww . jav  a2  s.  c o m
        X509Certificate caCert = reader.getCACert();
        X509V2CRLGenerator generator = new X509V2CRLGenerator();
        generator.setIssuerDN(caCert.getIssuerX500Principal());
        generator.setThisUpdate(new Date());
        generator.setNextUpdate(Util.tomorrow());
        generator.setSignatureAlgorithm(SIGNATURE_ALGO);
        // add all the CRL entries.
        for (X509CRLEntryWrapper entry : entries) {
            generator.addCRLEntry(entry.getSerialNumber(), entry.getRevocationDate(),
                    CRLReason.privilegeWithdrawn);
        }
        log.info("Completed adding CRL numbers to the certificate.");
        generator.addExtension(X509Extensions.AuthorityKeyIdentifier, false,
                new AuthorityKeyIdentifierStructure(caCert));
        generator.addExtension(X509Extensions.CRLNumber, false, new CRLNumber(crlNumber));
        return generator.generate(reader.getCaKey());
    } catch (Exception e) {
        throw new RuntimeException(e);
    }
}

---

From source file:org.ejbca.core.model.ca.caadmin.X509CA.java

License:Open Source License

/** Generate a CRL or a deltaCRL
 * /*from   w  ww . ja va 2 s. c  o m*/
 * @param certs list of revoked certificates
 * @param crlnumber CRLNumber for this CRL
 * @param isDeltaCRL true if we should generate a DeltaCRL
 * @param basecrlnumber caseCRLNumber for a delta CRL, use 0 for full CRLs
 * @param certProfile certificate profile for CRL Distribution point in the CRL, or null
 * @return CRL
 * @throws CATokenOfflineException
 * @throws IllegalKeyStoreException
 * @throws IOException
 * @throws SignatureException
 * @throws NoSuchProviderException
 * @throws InvalidKeyException
 * @throws CRLException
 * @throws NoSuchAlgorithmException
 */
private CRL generateCRL(Collection<RevokedCertInfo> certs, long crlPeriod, int crlnumber, boolean isDeltaCRL,
        int basecrlnumber)
        throws CATokenOfflineException, IllegalKeyStoreException, IOException, SignatureException,
        NoSuchProviderException, InvalidKeyException, CRLException, NoSuchAlgorithmException {
    final String sigAlg = getCAInfo().getCATokenInfo().getSignatureAlgorithm();

    if (log.isDebugEnabled()) {
        log.debug("generateCRL(" + certs.size() + ", " + crlPeriod + ", " + crlnumber + ", " + isDeltaCRL + ", "
                + basecrlnumber);
    }
    Date thisUpdate = new Date();
    Date nextUpdate = new Date();

    nextUpdate.setTime(nextUpdate.getTime() + crlPeriod);
    X509V2CRLGenerator crlgen = new X509V2CRLGenerator();
    crlgen.setThisUpdate(thisUpdate);
    crlgen.setNextUpdate(nextUpdate);
    crlgen.setSignatureAlgorithm(sigAlg);
    // Make DNs
    X509Certificate cacert = (X509Certificate) getCACertificate();
    if (cacert == null) {
        // This is an initial root CA, since no CA-certificate exists
        // (I don't think we can ever get here!!!)
        X509NameEntryConverter converter = null;
        if (getUsePrintableStringSubjectDN()) {
            converter = new PrintableStringEntryConverter();
        } else {
            converter = new X509DefaultEntryConverter();
        }

        X509Name caname = CertTools.stringToBcX509Name(getSubjectDN(), converter, getUseLdapDNOrder());
        crlgen.setIssuerDN(caname);
    } else {
        crlgen.setIssuerDN(cacert.getSubjectX500Principal());
    }
    if (certs != null) {
        Iterator<RevokedCertInfo> it = certs.iterator();
        while (it.hasNext()) {
            RevokedCertInfo certinfo = (RevokedCertInfo) it.next();
            crlgen.addCRLEntry(certinfo.getUserCertificate(), certinfo.getRevocationDate(),
                    certinfo.getReason());
        }
    }

    // Authority key identifier
    if (getUseAuthorityKeyIdentifier() == true) {
        SubjectPublicKeyInfo apki = new SubjectPublicKeyInfo((ASN1Sequence) new ASN1InputStream(
                new ByteArrayInputStream(getCAToken().getPublicKey(SecConst.CAKEYPURPOSE_CRLSIGN).getEncoded()))
                        .readObject());
        AuthorityKeyIdentifier aki = new AuthorityKeyIdentifier(apki);
        crlgen.addExtension(X509Extensions.AuthorityKeyIdentifier.getId(), getAuthorityKeyIdentifierCritical(),
                aki);
    }
    // CRLNumber extension
    if (getUseCRLNumber() == true) {
        CRLNumber crlnum = new CRLNumber(BigInteger.valueOf(crlnumber));
        crlgen.addExtension(X509Extensions.CRLNumber.getId(), this.getCRLNumberCritical(), crlnum);
    }

    if (isDeltaCRL) {
        // DeltaCRLIndicator extension
        CRLNumber basecrlnum = new CRLNumber(BigInteger.valueOf(basecrlnumber));
        crlgen.addExtension(X509Extensions.DeltaCRLIndicator.getId(), true, basecrlnum);
    }
    // CRL Distribution point URI and Freshest CRL DP
    if (getUseCrlDistributionPointOnCrl()) {
        String crldistpoint = getDefaultCRLDistPoint();
        List<DistributionPoint> distpoints = generateDistributionPoints(crldistpoint);

        if (distpoints.size() > 0) {
            IssuingDistributionPoint idp = new IssuingDistributionPoint(
                    distpoints.get(0).getDistributionPoint(), false, false, null, false, false);

            // According to the RFC, IDP must be a critical extension.
            // Nonetheless, at the moment, Mozilla is not able to correctly
            // handle the IDP extension and discards the CRL if it is critical.
            crlgen.addExtension(X509Extensions.IssuingDistributionPoint.getId(),
                    getCrlDistributionPointOnCrlCritical(), idp);
        }

        if (!isDeltaCRL) {
            String crlFreshestDP = getCADefinedFreshestCRL();
            List<DistributionPoint> freshestDistPoints = generateDistributionPoints(crlFreshestDP);
            if (freshestDistPoints.size() > 0) {
                CRLDistPoint ext = new CRLDistPoint((DistributionPoint[]) freshestDistPoints
                        .toArray(new DistributionPoint[freshestDistPoints.size()]));

                // According to the RFC, the Freshest CRL extension on a
                // CRL must not be marked as critical. Therefore it is
                // hardcoded as not critical and is independent of
                // getCrlDistributionPointOnCrlCritical().
                crlgen.addExtension(X509Extensions.FreshestCRL.getId(), false, ext);
            }

        }
    }

    X509CRL crl;
    crl = crlgen.generate(getCAToken().getPrivateKey(SecConst.CAKEYPURPOSE_CRLSIGN),
            getCAToken().getProvider());
    // Verify using the CA certificate before returning
    // If we can not verify the issued CRL using the CA certificate we don't want to issue this CRL
    // because something is wrong...
    PublicKey verifyKey;
    if (cacert != null) {
        verifyKey = cacert.getPublicKey();
    } else {
        verifyKey = getCAToken().getPublicKey(SecConst.CAKEYPURPOSE_CRLSIGN);
    }
    crl.verify(verifyKey);

    return crl;
}

---

From source file:org.krakenapps.ca.util.CrlBuilder.java

License:Apache License

public static byte[] getCrl(X509Certificate caCert, PrivateKey caPrivateKey, List<RevokedCertificate> revokes)
        throws Exception {
    X509V2CRLGenerator generator = new X509V2CRLGenerator();
    generator.setIssuerDN(caCert.getIssuerX500Principal());

    generator.setThisUpdate(new Date());
    generator.setSignatureAlgorithm(caCert.getSigAlgName());

    for (RevokedCertificate r : revokes) {
        BigInteger serial = new BigInteger(r.getSerial());
        generator.addCRLEntry(serial, r.getRevocationDate(), r.getReason().ordinal());
    }//  w  w w .jav  a2  s. c  om

    X509CRL crl = generator.generate(caPrivateKey);
    return crl.getEncoded();
}

---

From source file:org.qipki.crypto.x509.X509GeneratorImpl.java

License:Open Source License

@Override
public X509CRL updateX509CRL(X509Certificate caCertificate, PrivateKey caPrivateKey,
        X509Certificate revokedCertificate, RevocationReason reason, X509CRL previousCRL,
        BigInteger lastCRLNumber) {
    try {//ww  w.j  a  v  a 2s.  c om
        X509V2CRLGenerator crlGen = new X509V2CRLGenerator();
        crlGen.setIssuerDN(caCertificate.getSubjectX500Principal());
        DateTime skewedNow = new DateTime().minus(Time.CLOCK_SKEW);
        crlGen.setThisUpdate(skewedNow.toDate());
        crlGen.setNextUpdate(skewedNow.plusHours(12).toDate());
        crlGen.setSignatureAlgorithm(SignatureAlgorithm.SHA256withRSA.jcaString());
        crlGen.addExtension(X509Extensions.AuthorityKeyIdentifier, false,
                new AuthorityKeyIdentifierStructure(caCertificate));
        crlGen.addExtension(X509Extensions.CRLNumber, false, new CRLNumber(lastCRLNumber));
        crlGen.addCRL(previousCRL);
        crlGen.addCRLEntry(revokedCertificate.getSerialNumber(), skewedNow.toDate(), reason.reason());
        return crlGen.generate(caPrivateKey, BouncyCastleProvider.PROVIDER_NAME);
    } catch (GeneralSecurityException ex) {
        throw new CryptoFailure("Unable to update CRL", ex);
    }
}

---

From source file:org.signserver.validationservice.server.ValidationTestUtils.java

License:Open Source License

public static X509CRL genCRL(X509Certificate cacert, PrivateKey privKey, DistributionPoint dp,
        Collection<RevokedCertInfo> certs, int crlPeriod, int crlnumber)
        throws CATokenOfflineException, IllegalKeyStoreException, IOException, SignatureException,
        NoSuchProviderException, InvalidKeyException, CRLException, NoSuchAlgorithmException {
    final String sigAlg = "SHA1WithRSA";

    boolean crlDistributionPointOnCrlCritical = true;
    boolean crlNumberCritical = false;

    Date thisUpdate = new Date();
    Date nextUpdate = new Date();

    // crlperiod is hours = crlperiod*60*60*1000 milliseconds
    nextUpdate.setTime(nextUpdate.getTime() + (crlPeriod * (long) (60 * 60 * 1000)));
    X509V2CRLGenerator crlgen = new X509V2CRLGenerator();
    crlgen.setThisUpdate(thisUpdate);/*from w w w . j  ava2s.c om*/
    crlgen.setNextUpdate(nextUpdate);
    crlgen.setSignatureAlgorithm(sigAlg);

    CRLNumber crlnum = new CRLNumber(BigInteger.valueOf(crlnumber));
    crlgen.addExtension(X509Extensions.CRLNumber.getId(), crlNumberCritical, crlnum);

    // Make DNs
    crlgen.setIssuerDN(cacert.getSubjectX500Principal());

    if (certs != null) {
        Iterator<RevokedCertInfo> it = certs.iterator();
        while (it.hasNext()) {
            RevokedCertInfo certinfo = it.next();
            crlgen.addCRLEntry(certinfo.getUserCertificate(), certinfo.getRevocationDate(),
                    certinfo.getReason());
        }
    }

    // CRL Distribution point URI         
    IssuingDistributionPoint idp = new IssuingDistributionPoint(dp.getDistributionPoint(), false, false, null,
            false, false);

    // According to the RFC, IDP must be a critical extension.
    // Nonetheless, at the moment, Mozilla is not able to correctly
    // handle the IDP extension and discards the CRL if it is critical.
    crlgen.addExtension(X509Extensions.IssuingDistributionPoint.getId(), crlDistributionPointOnCrlCritical,
            idp);

    X509CRL crl;
    crl = crlgen.generate(privKey, "BC");
    // Verify before sending back
    crl.verify(cacert.getPublicKey());

    return crl;
}

---

From source file:org.wso2.carbon.identity.certificateauthority.crl.CrlFactory.java

License:Open Source License

/**
 * @param caCert              Certoficate authority's certificate
 * @param caKey               CA private key
 * @param revokedCertificates list of revoked certificates
 * @param crlNumber           unique number of the crl
 * @param baseCrlNumber       base crl number
 * @param isDeltaCrl          whether the crl is a delta crl or a full crl
 * @return returns the X509 Crl//from w ww  .j a v a  2 s  .c om
 * @throws Exception
 */
private X509CRL createCRL(X509Certificate caCert, PrivateKey caKey, RevokedCertificate[] revokedCertificates,
        int crlNumber, int baseCrlNumber, boolean isDeltaCrl) throws Exception {
    X509V2CRLGenerator crlGen = new X509V2CRLGenerator();
    Date now = new Date();
    CertificateDAO certificateDAO = new CertificateDAO();
    RevocationDAO revocationDAO = new RevocationDAO();
    crlGen.setIssuerDN(caCert.getSubjectX500Principal());
    crlGen.setThisUpdate(now);
    crlGen.setNextUpdate(new Date(now.getTime() + CRL_UPDATE_TIME));
    crlGen.setSignatureAlgorithm("SHA256WithRSAEncryption");
    for (RevokedCertificate cert : revokedCertificates) {
        BigInteger serialNo = new BigInteger(cert.getSerialNo());
        crlGen.addCRLEntry(serialNo, cert.getRevokedDate(), cert.getReason());
    }
    crlGen.addExtension(X509Extensions.AuthorityKeyIdentifier, false,
            new AuthorityKeyIdentifierStructure(caCert));
    crlGen.addExtension(X509Extensions.CRLNumber, false, new CRLNumber(BigInteger.valueOf(crlNumber)));
    if (isDeltaCrl) {
        crlGen.addExtension(X509Extensions.DeltaCRLIndicator, true,
                new CRLNumber(BigInteger.valueOf(baseCrlNumber)));
    }
    return crlGen.generateX509CRL(caKey, "BC");
}

---

From source file:test.integ.be.fedict.trust.util.TestUtils.java

License:Open Source License

public static X509V2CRLGenerator getCrlGenerator(int crlNumber, X509Certificate issuerCertificate,
        DateTime thisUpdate, DateTime nextUpdate, List<BigInteger> revokedCertificateSerialNumbers)
        throws CertificateParsingException {

    X509V2CRLGenerator crlGenerator = new X509V2CRLGenerator();
    crlGenerator.setThisUpdate(thisUpdate.toDate());
    crlGenerator.setNextUpdate(nextUpdate.toDate());
    crlGenerator.setSignatureAlgorithm("SHA1withRSA");
    crlGenerator.setIssuerDN(issuerCertificate.getSubjectX500Principal());

    List<RevokedCertificate> revokedCertificates = new LinkedList<RevokedCertificate>();
    for (BigInteger revokedCertificateSerialNumber : revokedCertificateSerialNumbers) {
        revokedCertificates.add(new RevokedCertificate(revokedCertificateSerialNumber, thisUpdate));
    }/*from  w w w .  j a  va 2  s . c om*/
    for (RevokedCertificate revokedCertificate : revokedCertificates) {
        crlGenerator.addCRLEntry(revokedCertificate.serialNumber, revokedCertificate.revocationDate.toDate(),
                CRLReason.privilegeWithdrawn);
    }

    crlGenerator.addExtension(X509Extensions.AuthorityKeyIdentifier, false,
            new AuthorityKeyIdentifierStructure(issuerCertificate));
    crlGenerator.addExtension(X509Extensions.CRLNumber, false,
            new CRLNumber(new BigInteger(Integer.toString(crlNumber))));
    return crlGenerator;
}

---

• «
• 1
• 2
• »