Example usage for org.bouncycastle.x509 X509V3CertificateGenerator X509V3CertificateGenerator

List of usage examples for org.bouncycastle.x509 X509V3CertificateGenerator X509V3CertificateGenerator

  1. HOME
  2. Java
  3. org.bouncycastle
  4. org.bouncycastle.x509.*
  5. X509V3CertificateGenerator
  6. X509V3CertificateGenerator

Introduction

In this page you can find the example usage for org.bouncycastle.x509 X509V3CertificateGenerator X509V3CertificateGenerator.

Prototype

public X509V3CertificateGenerator()

Source Link

Usage

From source file:org.opcfoundation.ua.utils.CertificateUtils.java

License:Open Source License

/**
 * /*from   w ww  .  j a  v  a  2  s  .  c o  m*/
 * @param commonName - Common Name (CN) for generated certificate
 * @param organisation - Organisation (O) for generated certificate
 * @param applicationUri - Alternative name (one of x509 extensiontype) for generated certificate. Must not be null
 * @param validityTime - the time that the certificate is valid (in days)
 * @return
 * @throws IOException
 * @throws InvalidKeySpecException
 * @throws NoSuchAlgorithmException
 * @throws CertificateEncodingException
 * @throws InvalidKeyException
 * @throws IllegalStateException
 * @throws NoSuchProviderException
 * @throws SignatureException
 * @throws CertificateParsingException
 */
public static org.opcfoundation.ua.transport.security.KeyPair createApplicationInstanceCertificate(
        String commonName, String organisation, String applicationUri, int validityTime) throws IOException,
        InvalidKeySpecException, NoSuchAlgorithmException, CertificateEncodingException, InvalidKeyException,
        IllegalStateException, NoSuchProviderException, SignatureException, CertificateParsingException {
    if (applicationUri == null)
        throw new NullPointerException("applicationUri must not be null");
    //Add provider for generator
    Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());

    //Initializes generator 
    SecureRandom srForCert = new SecureRandom();
    RSAKeyPairGenerator genForCert = new RSAKeyPairGenerator();

    //Used for generating prime
    Random r = new Random(System.currentTimeMillis());
    int random = -1;

    while (random < 3) {
        random = r.nextInt(32);
    }
    //calculate(generate) possible value for public modulus
    //used method is "monte carlo -algorithm", so we calculate it as long as it generates value.
    BigInteger value = null;
    while (value == null) {
        value = BigInteger.probablePrime(random, new SecureRandom());
    }

    //Generate (Java) keypair
    genForCert.init(new RSAKeyGenerationParameters(value, srForCert, KEY_SIZE, 80));
    AsymmetricCipherKeyPair keypairForCert = genForCert.generateKeyPair();

    //Extract the keys from parameters
    logger.debug("Generated keypair, extracting components and creating public structure for certificate");
    RSAKeyParameters clientPublicKey = (RSAKeyParameters) keypairForCert.getPublic();
    RSAPrivateCrtKeyParameters clientPrivateKey = (RSAPrivateCrtKeyParameters) keypairForCert.getPrivate();
    // used to get proper encoding for the certificate
    RSAPublicKeyStructure clientPkStruct = new RSAPublicKeyStructure(clientPublicKey.getModulus(),
            clientPublicKey.getExponent());
    logger.debug("New public key is '" + makeHexString(clientPkStruct.getEncoded()) + ", exponent="
            + clientPublicKey.getExponent() + ", modulus=" + clientPublicKey.getModulus());

    // JCE format needed for the certificate - because getEncoded() is necessary...
    PublicKey certPubKey = KeyFactory.getInstance("RSA")
            .generatePublic(new RSAPublicKeySpec(clientPublicKey.getModulus(), clientPublicKey.getExponent()));
    // and this one for the KeyStore
    PrivateKey certPrivKey = KeyFactory.getInstance("RSA").generatePrivate(
            new RSAPrivateCrtKeySpec(clientPublicKey.getModulus(), clientPublicKey.getExponent(),
                    clientPrivateKey.getExponent(), clientPrivateKey.getP(), clientPrivateKey.getQ(),
                    clientPrivateKey.getDP(), clientPrivateKey.getDQ(), clientPrivateKey.getQInv()));

    //The data for the certificate..
    Calendar expiryTime = Calendar.getInstance();
    expiryTime.add(Calendar.DAY_OF_YEAR, validityTime);

    X509Name certificateX509Name = new X509Name(
            "CN=" + commonName + ", O=" + organisation + ", C=" + System.getProperty("user.country"));

    X509V3CertificateGenerator certGen = new X509V3CertificateGenerator();
    BigInteger serial = BigInteger.valueOf(System.currentTimeMillis());
    certGen.setSerialNumber(serial);
    //Issuer and subject must be the same (because this is self signed)
    certGen.setIssuerDN(certificateX509Name);
    certGen.setSubjectDN(certificateX509Name);

    //expiry & start time for this certificate
    certGen.setNotBefore(new Date(System.currentTimeMillis() - 1000 * 60 * 60)); //take 60 minutes (1000 ms * 60 s * 60) away from system clock (in case there is some lag in system clocks)
    certGen.setNotAfter(expiryTime.getTime());

    certGen.setPublicKey(certPubKey);
    certGen.setSignatureAlgorithm("SHA256WithRSAEncryption");

    //******* X.509 V3 Extensions *****************

    SubjectPublicKeyInfo apki = new SubjectPublicKeyInfo(
            (ASN1Sequence) new ASN1InputStream(new ByteArrayInputStream(certPubKey.getEncoded())).readObject());
    SubjectKeyIdentifier ski = new SubjectKeyIdentifier(apki);

    /*certGen.addExtension(X509Extensions.SubjectKeyIdentifier, true,
    new DEROctetString(ski//new SubjectKeyIdentifier Structure(apki/*certPubKey)));
        */
    certGen.addExtension(X509Extensions.SubjectKeyIdentifier, false, ski);
    certGen.addExtension(X509Extensions.BasicConstraints, false, new BasicConstraints(false));
    certGen.addExtension(X509Extensions.KeyUsage, true,
            /*new DEROctetString(new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyEncipherment | KeyUsage.nonRepudiation | KeyUsage.dataEncipherment | KeyUsage.keyCertSign ))*/new KeyUsage(
                    KeyUsage.digitalSignature | KeyUsage.keyEncipherment | KeyUsage.nonRepudiation
                            | KeyUsage.dataEncipherment | KeyUsage.keyCertSign));

    BasicConstraints b = new BasicConstraints(false);

    Vector<KeyPurposeId> extendedKeyUsages = new Vector<KeyPurposeId>();
    extendedKeyUsages.add(KeyPurposeId.id_kp_serverAuth);
    extendedKeyUsages.add(KeyPurposeId.id_kp_clientAuth);
    certGen.addExtension(X509Extensions.ExtendedKeyUsage, true,
            /*new DEROctetString(new ExtendedKeyUsage(extendedKeyUsages))*/new ExtendedKeyUsage(
                    extendedKeyUsages));

    // create the extension value
    ASN1EncodableVector names = new ASN1EncodableVector();
    names.add(new GeneralName(GeneralName.uniformResourceIdentifier, applicationUri));
    //      GeneralName dnsName = new GeneralName(GeneralName.dNSName, applicationUri);
    //      names.add(dnsName);
    final GeneralNames subjectAltNames = new GeneralNames(new DERSequence(names));

    certGen.addExtension(X509Extensions.SubjectAlternativeName, true, subjectAltNames);

    // AuthorityKeyIdentifier

    final GeneralNames certificateIssuer = new GeneralNames(new GeneralName(certificateX509Name));
    AuthorityKeyIdentifier aki = new AuthorityKeyIdentifier(apki, certificateIssuer, serial);

    certGen.addExtension(X509Extensions.AuthorityKeyIdentifier, false, aki);
    //***** generate certificate ***********/
    X509Certificate cert = certGen.generate(certPrivKey, "BC");

    //Encapsulate Certificate and private key to CertificateKeyPair
    Cert certificate = new Cert(cert);
    org.opcfoundation.ua.transport.security.PrivKey UAkey = new org.opcfoundation.ua.transport.security.PrivKey(
            (RSAPrivateKey) certPrivKey);
    return new org.opcfoundation.ua.transport.security.KeyPair(certificate, UAkey);
}

From source file:org.opcfoundation.ua.utils.CertificateUtils.java

License:Open Source License

@Deprecated //Use createApplicationInstanceCertificate instead of this...all the x.509 cert fields are not fulfilled in this
public static org.opcfoundation.ua.transport.security.KeyPair generateKeyPair(String CN) throws Exception {
    KeyPairGenerator keyGenerator = KeyPairGenerator.getInstance(KEY_ALG, PROV);
    keyGenerator.initialize(KEY_SIZE);/*from  w w w  .j a  va  2s.  c  o  m*/
    KeyPair key = keyGenerator.generateKeyPair();
    PublicKey publicKey = key.getPublic();
    PrivateKey privateKey = key.getPrivate();

    //Keystore not needed in this function (at the moment)
    ///KeyStore keyStore = null;

    ////keyStore = KeyStore.getInstance(STORE_TYPE);
    ///keyStore.load(null,STORE_PASSWD.toCharArray());

    //Use BouncyCastle as Security provider
    new CryptoUtil();
    //////X509Certificate[] chain = new X509Certificate[1];

    //Generates new certificate..add the information needed for the generator
    X509V3CertificateGenerator certGen = new X509V3CertificateGenerator();
    X500Principal subjectName = new X500Principal("CN=" + CN);
    certGen.setSerialNumber(BigInteger.valueOf(System.currentTimeMillis()));
    //X509Certificate caCert=null;
    certGen.setIssuerDN(subjectName);
    Date notBefore = new Date();
    Date notAfter = new Date();
    notBefore.setTime(notBefore.getTime() - 1000 * 60 * 60);
    notAfter.setTime(notAfter.getTime() + 1000 * 60 * 60 * 24 * 365);
    certGen.setNotBefore(notBefore);
    certGen.setNotAfter(notAfter);
    certGen.setSubjectDN(subjectName);
    certGen.setPublicKey(publicKey);
    certGen.setSignatureAlgorithm("SHA256WithRSAEncryption");

    //X.509 V3 Extensions...these are just examples

    //certGen.addExtension(X509Extensions.AuthorityKeyIdentifier, false,new AuthorityKeyIdentifierStructure(caCert));
    ///7certGen.addExtension(X509Extensions.SubjectKeyIdentifier, false,
    ////      new SubjectKeyIdentifierStructure(key.getPublic()));

    certGen.addExtension(X509Extensions.SubjectKeyIdentifier, true,
            new DEROctetString(new SubjectKeyIdentifierStructure(key.getPublic())));

    certGen.addExtension(X509Extensions.BasicConstraints, true, new BasicConstraints(false));

    certGen.addExtension(X509Extensions.KeyUsage, true,
            new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyEncipherment | KeyUsage.keyCertSign));
    certGen.addExtension(X509Extensions.ExtendedKeyUsage, true,
            new ExtendedKeyUsage(KeyPurposeId.id_kp_serverAuth));

    /////chain[0]= certGen.generate(privateKey, "BC"); // note: private key of CA
    //Generate
    X509Certificate caCert = certGen.generate(privateKey, "BC");

    //Encapsulate Certificate and private key to CertificateKeyPair
    Cert cert = new Cert(caCert);
    org.opcfoundation.ua.transport.security.PrivKey UAkey = new org.opcfoundation.ua.transport.security.PrivKey(
            (RSAPrivateKey) privateKey);
    return new org.opcfoundation.ua.transport.security.KeyPair(cert, UAkey);
    /*keyStore.setEntry(ALIAS,new KeyStore.PrivateKeyEntry(privateKey, chain),
    new KeyStore.PasswordProtection(KEY_PASSWD.toCharArray())
    );
            
    // Write out the keystore
    FileOutputStream keyStoreOutputStream = new FileOutputStream(keystorePath);
    keyStore.store(keyStoreOutputStream, "123456".toCharArray());
    keyStoreOutputStream.close();*/

}

From source file:org.opcfoundation.ua.utils.CertificateUtils.java

License:Open Source License

/**
 * generates new certificate chain and returns it..
 * first certificate in the returned chain is the issued certificate and the second one is CA certificate
 * /*w  w w  .ja  v  a  2 s  . com*/
 * @return certificates 
 * @throws Exception
 */
public static X509Certificate[] createCertificateChain() throws Exception {

    Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());
    // create the keys
    KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA", "BC");
    keyGen.initialize(1024, new SecureRandom());
    KeyPair pair = keyGen.generateKeyPair();

    X509Certificate rootCert = generateRootCertificate(pair);

    //Create certificate request
    PKCS10CertificationRequest request = createCertificateRequest();

    // validate the certification request
    if (!request.verify("BC")) {
        System.out.println("request failed to verify!");
        System.exit(1);
    }

    // create the certificate using the information in the request
    X509V3CertificateGenerator certGen = new X509V3CertificateGenerator();

    certGen.setSerialNumber(BigInteger.valueOf(System.currentTimeMillis()));
    certGen.setIssuerDN(rootCert.getSubjectX500Principal());
    certGen.setNotBefore(new Date(System.currentTimeMillis()));
    certGen.setNotAfter(new Date(System.currentTimeMillis() + 50000));
    certGen.setSubjectDN(request.getCertificationRequestInfo().getSubject());
    certGen.setPublicKey(request.getPublicKey("BC"));
    certGen.setSignatureAlgorithm("SHA256WithRSAEncryption");

    certGen.addExtension(X509Extensions.AuthorityKeyIdentifier, false,
            new AuthorityKeyIdentifierStructure(rootCert));
    certGen.addExtension(X509Extensions.SubjectKeyIdentifier, false,
            new SubjectKeyIdentifierStructure(request.getPublicKey("BC")));
    certGen.addExtension(X509Extensions.BasicConstraints, true, new BasicConstraints(false));
    certGen.addExtension(X509Extensions.KeyUsage, true,
            new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyEncipherment));
    certGen.addExtension(X509Extensions.ExtendedKeyUsage, true,
            new ExtendedKeyUsage(KeyPurposeId.id_kp_serverAuth));

    X509Certificate issuedCert = certGen.generate(pair.getPrivate());
    X509Certificate[] chain = { issuedCert, rootCert };

    //Write certificates to file so we are able to retrieve the also te private key
    /* URL certURL = CertificateUtils.class.getResource( "createdCerts.pem" );
             
     URLConnection connection = certURL.openConnection();
    InputStream is = connection.getInputStream();
     CertificateFactory servercf = CertificateFactory.getInstance("X.509");
    X509Certificate cert = (X509Certificate) servercf.generateCertificate(is);
            
    PEMWriter        testWriter = new PEMWriter(new OutputStreamWriter(System.out));
    testWriter.writeObject(cert);*/
    return chain;
}

From source file:org.opcfoundation.ua.utils.CertificateUtils.java

License:Open Source License

private static X509Certificate generateRootCertificate(KeyPair pair)
        throws CertificateEncodingException, InvalidKeyException, IllegalStateException,
        NoSuchProviderException, NoSuchAlgorithmException, SignatureException {
    // generate root certificate
    X509V3CertificateGenerator certGenRoot = new X509V3CertificateGenerator();
    certGenRoot.setSerialNumber(BigInteger.valueOf(System.currentTimeMillis()));
    certGenRoot.setIssuerDN(new X500Principal("CN=Test Certificate"));
    certGenRoot.setNotBefore(new Date(System.currentTimeMillis() - 50000));
    certGenRoot.setNotAfter(new Date(System.currentTimeMillis() + 50000));
    certGenRoot.setSubjectDN(new X500Principal("CN=Test Certificate"));
    certGenRoot.setPublicKey(pair.getPublic());
    certGenRoot.setSignatureAlgorithm("SHA1WithRSAEncryption");
    return certGenRoot.generate(pair.getPrivate(), "BC");
}

From source file:org.opendaylight.aaa.cert.impl.ODLKeyTool.java

License:Open Source License

public boolean createKeyStoreWithSelfSignCert(final String keyStoreName, final String keyStorePwd,
        final String dName, final String keyAlias, final int validity) {
    try {/*w  w  w. j  av a 2s  . c o  m*/
        final KeyPairGenerator keyPairGenerator = KeyPairGenerator
                .getInstance(KeyStoreConstant.DEFAULT_KEY_ALG);
        keyPairGenerator.initialize(KeyStoreConstant.DEFAULT_KEY_SIZE);
        final KeyPair keyPair = keyPairGenerator.generateKeyPair();
        final X509V3CertificateGenerator x509V3CertGen = new X509V3CertificateGenerator();
        x509V3CertGen.setSerialNumber(getSecureRandomeInt());
        x509V3CertGen.setIssuerDN(new X509Principal(dName));
        x509V3CertGen.setNotBefore(new Date(System.currentTimeMillis()));
        x509V3CertGen
                .setNotAfter(new Date(System.currentTimeMillis() + (KeyStoreConstant.DAY_TIME * validity)));
        x509V3CertGen.setSubjectDN(new X509Principal(dName));
        x509V3CertGen.setPublicKey(keyPair.getPublic());
        x509V3CertGen.setSignatureAlgorithm(KeyStoreConstant.DEFAULT_SIGN_ALG);
        final X509Certificate x509Cert = x509V3CertGen.generateX509Certificate(keyPair.getPrivate());
        final KeyStore ctlKeyStore = KeyStore.getInstance("JKS");
        ctlKeyStore.load(null, keyStorePwd.toCharArray());
        ctlKeyStore.setKeyEntry(keyAlias, keyPair.getPrivate(), keyStorePwd.toCharArray(),
                new java.security.cert.Certificate[] { x509Cert });
        final FileOutputStream fOutputStream = new FileOutputStream(workingDir + keyStoreName);
        ctlKeyStore.store(fOutputStream, keyStorePwd.toCharArray());
        LOG.info("{} is created", keyStoreName);
        return true;
    } catch (NoSuchAlgorithmException | InvalidKeyException | SecurityException | SignatureException
            | KeyStoreException | CertificateException | IOException e) {
        LOG.error("Fatal error creating key", e);
        return false;
    }
}

From source file:org.opendaylight.aaa.cert.impl.ODLMdsalKeyTool.java

License:Open Source License

public KeyStore createKeyStoreWithSelfSignCert(final String keyStoreName, final String keyStorePwd,
        final String dName, final String keyAlias, final int validity, final String keyAlg, final int keySize,
        final String signAlg) {
    try {/*from   w ww .ja  v  a2 s  . c  o m*/
        final KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(keyAlg);
        keyPairGenerator.initialize(keySize);
        final KeyPair keyPair = keyPairGenerator.generateKeyPair();
        final X509V3CertificateGenerator x509V3CertGen = new X509V3CertificateGenerator();
        x509V3CertGen.setSerialNumber(getSecureRandomeInt());
        x509V3CertGen.setIssuerDN(new X509Principal(dName));
        x509V3CertGen.setNotBefore(new Date(System.currentTimeMillis()));
        x509V3CertGen
                .setNotAfter(new Date(System.currentTimeMillis() + (KeyStoreConstant.DAY_TIME * validity)));
        x509V3CertGen.setSubjectDN(new X509Principal(dName));
        x509V3CertGen.setPublicKey(keyPair.getPublic());
        x509V3CertGen.setSignatureAlgorithm(signAlg);
        final X509Certificate x509Cert = x509V3CertGen.generateX509Certificate(keyPair.getPrivate());
        final KeyStore ctlKeyStore = KeyStore.getInstance("JKS");
        ctlKeyStore.load(null, keyStorePwd.toCharArray());
        ctlKeyStore.setKeyEntry(keyAlias, keyPair.getPrivate(), keyStorePwd.toCharArray(),
                new java.security.cert.Certificate[] { x509Cert });
        LOG.info("{} is created", keyStoreName);
        return ctlKeyStore;
    } catch (final NoSuchAlgorithmException | InvalidKeyException | SecurityException | SignatureException
            | KeyStoreException | CertificateException | IOException e) {
        LOG.error("Fatal error creating keystore", e);
        return null;
    }
}

From source file:org.openmaji.implementation.server.security.auth.CoreAdminHelper.java

License:Open Source License

private static void userAdd(String userID, char[] userPass, String userName, String emailAddress,
        Date expiryDate) throws Exception {
    if (!userID.toLowerCase().equals(userID)) {
        throw new IllegalArgumentException("username's cannot have mixed case - must be lower case only.");
    }//from w w w. j ava2 s  .com

    String keyStorePasswd = System.getProperty(MeemCoreRootAuthority.KEYSTORE_PASSWD);
    if (keyStorePasswd == null) {
        throw new RuntimeException("unable to find property for key store password.");
    }

    X509V3CertificateGenerator certGen = new X509V3CertificateGenerator();
    MajiKeyStore keyStore = MeemCoreRootAuthority.getMajiKeyStore();
    KeyPairGenerator kpGen = KeyPairGenerator.getInstance("RSA");

    kpGen.initialize(1024);

    // get "server" key
    PrivateKey signingKey = (PrivateKey) keyStore.getKey(MeemCoreRootAuthority.KEY_ID,
            keyStorePasswd.toCharArray());
    Certificate[] certs = keyStore.getCertificateChain(MeemCoreRootAuthority.KEY_ID);
    X509Certificate signingCert = (X509Certificate) certs[0];
    KeyPair userKey = kpGen.generateKeyPair();

    certGen.setSerialNumber(BigInteger.valueOf(System.currentTimeMillis()));
    certGen.setIssuerDN(PrincipalUtil.getSubjectX509Principal(signingCert));
    certGen.setNotBefore(new Date());
    certGen.setNotAfter(expiryDate);
    certGen.setPublicKey(userKey.getPublic());

    if (emailAddress != null) {
        certGen.setSubjectDN(new X509Principal(new X500Principal("CN=" + userName + ", T=" + userID
                + ", EMAILADDRESS=" + emailAddress + ", OU=Maji, O=Majitek, C=AU").getEncoded()));
    } else {
        certGen.setSubjectDN(new X509Principal(
                new X500Principal("CN=" + userName + ", T=" + userID + ", OU=Maji, O=Majitek, C=AU")
                        .getEncoded()));
    }
    certGen.setSignatureAlgorithm("SHA1WithRSAEncryption");

    certGen.addExtension(X509Extensions.SubjectKeyIdentifier, false, createSubjectKeyId(userKey.getPublic()));

    certGen.addExtension(X509Extensions.AuthorityKeyIdentifier, false,
            createAuthorityKeyId(certs[0].getPublicKey(), PrincipalUtil.getSubjectX509Principal(signingCert),
                    signingCert.getSerialNumber()));

    X509Certificate newCert = certGen.generateX509Certificate(signingKey);

    Certificate[] chain = new Certificate[certs.length + 1];

    chain[0] = newCert;
    System.arraycopy(certs, 0, chain, 1, certs.length);

    //
    // having set up the chain add the user.
    //
    MajiKeyStore userKeyStore = MeemCoreRootAuthority.getUserKeyStore();

    try {
        Certificate[] testCerts = userKeyStore.getCertificateChain(userID);
        if (testCerts != null) {
            logger.log(Level.WARNING,
                    "User, \"" + userID + "\" already exists.  The certificate chain might not be updated");
        }
    } catch (KeyStoreException e) {
    }

    userKeyStore.setKeyEntry(userID, userKey.getPrivate(), userPass, chain);

    logger.log(Level.INFO, "User, \"" + userID + "\" added.");

    userKeyStore.store();

    //
    // store the encrypted password
    //
    byte[] userPassBytes = new byte[userPass.length];
    for (int i = 0; i != userPass.length; i++) {
        userPassBytes[i] = (byte) userPass[i];
    }

    Cipher cipher = Cipher.getInstance("RSA/NONE/OAEPPadding", "BC");

    cipher.init(Cipher.ENCRYPT_MODE, certs[0].getPublicKey());

    MeemCoreRootAuthority.getUserPasswordFile().setPassword(userID, cipher.doFinal(userPassBytes));
}

From source file:org.opensc.test.pkcs11.SaveCertificateTest.java

License:Open Source License

public void testX509CertificateGeneration() throws KeyStoreException, NoSuchProviderException,
        NoSuchAlgorithmException, CertificateException, IOException, UnrecoverableKeyException,
        InvalidKeyException, IllegalStateException, SignatureException, InvalidKeySpecException {
    KeyStore ks = KeyStore.getInstance("PKCS11", "OpenSC-PKCS11");

    PKCS11LoadStoreParameter params = new PKCS11LoadStoreParameter();

    PINEntry pe = new PINEntry();

    params.setWaitForSlot(true);//from  w  ww.j  a  v  a 2 s .  c o m
    params.setProtectionCallback(pe);
    params.setSOProtectionCallback(pe);
    params.setWriteEnabled(true);
    params.setEventHandler(pe);

    ks.load(params);

    // well, find a private key.
    Enumeration<String> aliases = ks.aliases();

    String alias = null;

    while (aliases.hasMoreElements()) {
        String s = aliases.nextElement();
        if (ks.isKeyEntry(s)) {
            alias = s;
            break;
        }
    }

    assertNotNull(alias);

    PKCS11PrivateKey privKey = (PKCS11PrivateKey) ks.getKey(alias, null);
    PKCS11PublicKey pubKey = privKey.getPublicKey();

    KeyFactory kf = KeyFactory.getInstance(pubKey.getAlgorithm());

    PublicKey dup = (PublicKey) kf.translateKey(pubKey);

    PKCS11Id enc1 = new PKCS11Id(pubKey.getEncoded());
    PKCS11Id enc2 = new PKCS11Id(dup.getEncoded());

    System.out.println("enc1=" + enc1);
    System.out.println("enc2=" + enc2);

    X509V3CertificateGenerator certGen = new X509V3CertificateGenerator();

    long now = System.currentTimeMillis();

    certGen.setSerialNumber(BigInteger.valueOf(now));

    X509Principal subject = new X509Principal("CN=PKCS11 Test CA,DC=opensc-project,DC=org");

    certGen.setIssuerDN(subject);
    certGen.setSubjectDN(subject);

    Date from_date = new Date(now);
    certGen.setNotBefore(from_date);
    Calendar cal = new GregorianCalendar();
    cal.setTime(from_date);
    cal.add(Calendar.YEAR, 4);
    Date to_date = cal.getTime();
    certGen.setNotAfter(to_date);

    certGen.setPublicKey(dup);
    certGen.setSignatureAlgorithm("SHA256withRSA");
    certGen.addExtension(X509Extensions.BasicConstraints, true, new BasicConstraints(false));
    certGen.addExtension(X509Extensions.KeyUsage, true, new KeyUsage(
            KeyUsage.digitalSignature | KeyUsage.keyEncipherment | KeyUsage.keyCertSign | KeyUsage.cRLSign));

    X509Certificate x509 = certGen.generate(privKey, "OpenSC-PKCS11");

    ks.setCertificateEntry(alias, x509);
}

From source file:org.ourgrid.common.util.SelfSignedCertificateGenerator.java

License:Open Source License

public static void generateX509Certificate(KeyPair keyPair, String dnData, String certFilePath)
        throws CertificateEncodingException, InvalidKeyException, IllegalStateException,
        NoSuchAlgorithmException, SignatureException, IOException {

    X509V3CertificateGenerator certGenerator = new X509V3CertificateGenerator();

    certGenerator.setSerialNumber(BigInteger.valueOf(1));
    certGenerator.setPublicKey(keyPair.getPublic());
    certGenerator.setSubjectDN(new X500Principal(dnData));
    certGenerator.setIssuerDN(new X500Principal(dnData));
    certGenerator.setNotBefore(new Date(System.currentTimeMillis() - VALIDITY_INTERVAL));
    certGenerator.setNotAfter(new Date(System.currentTimeMillis() + VALIDITY_INTERVAL));
    certGenerator.setSignatureAlgorithm(SignatureConstants.SIGN_ALGORITHM);

    X509Certificate certificate = certGenerator.generate(keyPair.getPrivate());

    File file = new File(certFilePath);
    if (!file.exists()) {
        FileUtils.touch(file);/*w  ww  .j  av  a  2 s  .c o  m*/
    }

    FileOutputStream fosP = new FileOutputStream(file);
    fosP.write(certificate.getEncoded());

    fosP.close();
}

From source file:org.overlord.commons.karaf.commands.saml.GenerateSamlKeystoreUtil.java

License:Apache License

/**
 * Creates a new key pair and self-signed certificate.
 *
 * @param alias/*w  w  w.ja v  a  2s.  c o  m*/
 *            the alias
 * @param dname
 *            the dname
 * @param keyAlgName
 *            the key alg name
 * @param keysize
 *            the keysize
 * @param sigAlgName
 *            the sig alg name
 * @throws Exception
 *             the exception
 */
private void doGenKeyPair(String alias, String dname, String keyAlgName, int keysize, String sigAlgName)
        throws Exception {

    if (keysize == -1) {
        if ("EC".equalsIgnoreCase(keyAlgName)) { //$NON-NLS-1$
            keysize = 256;
        } else if ("RSA".equalsIgnoreCase(keyAlgName)) { //$NON-NLS-1$
            keysize = 2048;
        } else {
            keysize = 1024;
        }
    }

    if (keyStore.containsAlias(alias)) {
        throw new Exception(Messages.getString("Key.pair.not.generated.alias.alias.already.exists")); //$NON-NLS-1$
    }

    if (sigAlgName == null) {
        sigAlgName = getCompatibleSigAlgName(keyAlgName);
    }

    KeyPairGenerator generator = KeyPairGenerator.getInstance(keyAlgName);
    generator.initialize(keysize);
    KeyPair keypair = generator.generateKeyPair();
    PrivateKey privKey = keypair.getPrivate();

    X509Certificate[] chain = new X509Certificate[1];

    Date date = getStartDate(startDate);
    Calendar calendar = Calendar.getInstance();
    calendar.setTime(date); // Configuramos la fecha que se recibe
    calendar.add(Calendar.DAY_OF_YEAR, validity);
    // time from which certificate is valid
    Date expiryDate = calendar.getTime(); // time after which certificate is not valid
    BigInteger serialNumber = new BigInteger("10"); // serial number for certificate //$NON-NLS-1$
    // private key of the certifying authority (ca) certificate

    X509V3CertificateGenerator certGen = new X509V3CertificateGenerator();
    X500Principal subjectName = new X500Principal(dname);

    certGen.setSerialNumber(serialNumber);
    certGen.setIssuerDN(subjectName);
    certGen.setNotBefore(date);
    certGen.setNotAfter(expiryDate);
    certGen.setSubjectDN(subjectName);
    certGen.setPublicKey(keypair.getPublic());
    certGen.setSignatureAlgorithm("SHA256withRSA"); //$NON-NLS-1$

    certGen.addExtension(X509Extensions.SubjectKeyIdentifier, false,
            new SubjectKeyIdentifierStructure(keypair.getPublic()));

    X509Certificate cert = certGen.generate(keypair.getPrivate(), providerName);
    chain[0] = cert;

    keyStore.setKeyEntry(alias, privKey, keyPass, chain);
}