private static byte[] generateCSR(KeyPair keyPair, CertificateNamesGenerator certificateNamesGenerator) throws IOException, OperatorCreationException { ExtensionsGenerator extensionsGenerator = new ExtensionsGenerator(); extensionsGenerator.addExtension(Extension.keyUsage, true, new KeyUsage(KeyUsage.digitalSignature)); extensionsGenerator.addExtension(Extension.extendedKeyUsage, true, new ExtendedKeyUsage( new KeyPurposeId[] { KeyPurposeId.id_kp_clientAuth, KeyPurposeId.id_kp_serverAuth } )); extensionsGenerator.addExtension(Extension.subjectAlternativeName, true, certificateNamesGenerator.getSANs()); PKCS10CertificationRequest csr = new JcaPKCS10CertificationRequestBuilder(certificateNamesGenerator.getSubject(), keyPair.getPublic()) .addAttribute(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest, extensionsGenerator.generate()) .build(new JcaContentSignerBuilder("SHA256withRSA").build(keyPair.getPrivate())); return PEMUtils.toPEM(csr); }
public static PKCS10CertificationRequest generateCSR(String[] commonNames, KeyPair pair) throws OperatorCreationException, IOException { X500NameBuilder namebuilder = new X500NameBuilder(X500Name.getDefaultStyle()); namebuilder.addRDN(BCStyle.CN, commonNames[0]); List<GeneralName> subjectAltNames = new ArrayList<>(commonNames.length); for (String cn:commonNames) subjectAltNames.add(new GeneralName(GeneralName.dNSName, cn)); GeneralNames subjectAltName = new GeneralNames(subjectAltNames.toArray(new GeneralName[0])); ExtensionsGenerator extGen = new ExtensionsGenerator(); extGen.addExtension(Extension.subjectAlternativeName, false, subjectAltName.toASN1Primitive()); PKCS10CertificationRequestBuilder p10Builder = new JcaPKCS10CertificationRequestBuilder(namebuilder.build(), pair.getPublic()); p10Builder.addAttribute(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest, extGen.generate()); JcaContentSignerBuilder csBuilder = new JcaContentSignerBuilder("SHA256withRSA"); ContentSigner signer = csBuilder.build(pair.getPrivate()); PKCS10CertificationRequest request = p10Builder.build(signer); return request; }
static void addExtension(ExtensionsGenerator extGenerator, ASN1ObjectIdentifier oid, boolean isCritical, ASN1Encodable value) throws CertIOException { try { extGenerator.addExtension(oid, isCritical, value); } catch (IOException e) { throw new CertIOException("cannot encode extension: " + e.getMessage(), e); } }
public CertificateRequestMessageBuilder(BigInteger certReqId) { this.certReqId = certReqId; this.extGenerator = new ExtensionsGenerator(); this.templateBuilder = new CertTemplateBuilder(); this.controls = new ArrayList(); }
/** * Basic constructor. * * @param issuer the issuer this CRL is associated with. * @param thisUpdate the date of this update. */ public X509v2CRLBuilder( X500Name issuer, Date thisUpdate) { tbsGen = new V2TBSCertListGenerator(); extGenerator = new ExtensionsGenerator(); tbsGen.setIssuer(issuer); tbsGen.setThisUpdate(new Time(thisUpdate)); }
/** * Create a builder for a version 3 certificate. * * @param issuer the certificate issuer * @param serial the certificate serial number * @param notBefore the date before which the certificate is not valid * @param notAfter the date after which the certificate is not valid * @param subject the certificate subject * @param publicKeyInfo the info structure for the public key to be associated with this certificate. */ public X509v3CertificateBuilder(X500Name issuer, BigInteger serial, Date notBefore, Date notAfter, X500Name subject, SubjectPublicKeyInfo publicKeyInfo) { tbsGen = new V3TBSCertificateGenerator(); tbsGen.setSerialNumber(new ASN1Integer(serial)); tbsGen.setIssuer(issuer); tbsGen.setStartDate(new Time(notBefore)); tbsGen.setEndDate(new Time(notAfter)); tbsGen.setSubject(subject); tbsGen.setSubjectPublicKeyInfo(publicKeyInfo); extGenerator = new ExtensionsGenerator(); }
public X509v2AttributeCertificateBuilder(AttributeCertificateHolder holder, AttributeCertificateIssuer issuer, BigInteger serialNumber, Date notBefore, Date notAfter) { acInfoGen = new V2AttributeCertificateInfoGenerator(); extGenerator = new ExtensionsGenerator(); acInfoGen.setHolder(holder.holder); acInfoGen.setIssuer(AttCertIssuer.getInstance(issuer.form)); acInfoGen.setSerialNumber(new ASN1Integer(serialNumber)); acInfoGen.setStartDate(new ASN1GeneralizedTime(notBefore)); acInfoGen.setEndDate(new ASN1GeneralizedTime(notAfter)); }
static void addExtension(ExtensionsGenerator extGenerator, ASN1ObjectIdentifier oid, boolean isCritical, ASN1Encodable value) throws TSPIOException { try { extGenerator.addExtension(oid, isCritical, value); } catch (IOException e) { throw new TSPIOException("cannot encode extension: " + e.getMessage(), e); } }
/** * Basic constructor. * * @param issuer the issuer this CRL is associated with. * @param thisUpdate the Time of this update. */ public X509v2CRLBuilder( X500Name issuer, Time thisUpdate) { tbsGen = new V2TBSCertListGenerator(); extGenerator = new ExtensionsGenerator(); tbsGen.setIssuer(issuer); tbsGen.setThisUpdate(thisUpdate); }
/** * Create a builder for a version 3 certificate. * * @param issuer the certificate issuer * @param serial the certificate serial number * @param notBefore the Time before which the certificate is not valid * @param notAfter the Time after which the certificate is not valid * @param subject the certificate subject * @param publicKeyInfo the info structure for the public key to be associated with this certificate. */ public X509v3CertificateBuilder(X500Name issuer, BigInteger serial, Time notBefore, Time notAfter, X500Name subject, SubjectPublicKeyInfo publicKeyInfo) { tbsGen = new V3TBSCertificateGenerator(); tbsGen.setSerialNumber(new ASN1Integer(serial)); tbsGen.setIssuer(issuer); tbsGen.setStartDate(notBefore); tbsGen.setEndDate(notAfter); tbsGen.setSubject(subject); tbsGen.setSubjectPublicKeyInfo(publicKeyInfo); extGenerator = new ExtensionsGenerator(); }
/** * Base constructor. * * @param holder holder certificate details * @param issuer issuer of this attribute certificate. * @param serialNumber serial number of this attribute certificate. * @param notBefore the date before which the certificate is not valid. * @param notAfter the date after which the certificate is not valid. */ public X509v2AttributeCertificateBuilder(AttributeCertificateHolder holder, AttributeCertificateIssuer issuer, BigInteger serialNumber, Date notBefore, Date notAfter) { acInfoGen = new V2AttributeCertificateInfoGenerator(); extGenerator = new ExtensionsGenerator(); acInfoGen.setHolder(holder.holder); acInfoGen.setIssuer(AttCertIssuer.getInstance(issuer.form)); acInfoGen.setSerialNumber(new ASN1Integer(serialNumber)); acInfoGen.setStartDate(new ASN1GeneralizedTime(notBefore)); acInfoGen.setEndDate(new ASN1GeneralizedTime(notAfter)); }
/** * Generate a CSR object. * * @param dn The CSR's Distinguished Name (DN). * @param key The CSR's key pair * @param extensions The CRT's extension objects. * @param signatureAlgorithm The signature algorithm to use. * @return The generated CSR object. * @throws IOException if an error occurs during generation. */ public static PKCS10CertificateRequest generateCSR(X500Principal dn, KeyPair key, List<X509ExtensionData> extensions, SignatureAlgorithm signatureAlgorithm) throws IOException { LOG.info("CSR generation ''{0}'' started...", dn); // Initialize CSR builder PKCS10CertificationRequestBuilder csrBuilder = new JcaPKCS10CertificationRequestBuilder(dn, key.getPublic()); // Add custom extension objects ExtensionsGenerator extensionGenerator = new ExtensionsGenerator(); for (X509ExtensionData extensionData : extensions) { extensionGenerator.addExtension(new ASN1ObjectIdentifier(extensionData.oid()), extensionData.getCritical(), extensionData.encode()); } csrBuilder.addAttribute(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest, extensionGenerator.generate()); PKCS10CertificateRequest csr; try { // Sign CSR ContentSigner csrSigner; csrSigner = new JcaContentSignerBuilder(signatureAlgorithm.algorithm()).build(key.getPrivate()); csr = fromPKCS10(csrBuilder.build(csrSigner)); } catch (OperatorCreationException e) { throw new CertProviderException(e); } LOG.info("CSR generation ''{0}'' done", dn); return csr; }
@Test public void test_signing() throws Exception { ExtensionsGenerator extGen = new ExtensionsGenerator(); String subject = "C=NO,OU=Vespa,CN=" + requestersHostname; PKCS10CertificationRequest request = makeRequest(subject, extGen.generate()); X509Certificate certificate = signer.generateX509Certificate(request, requestersHostname); assertCertificate(certificate, subject, Collections.singleton(Extension.basicConstraints.getId())); }
@Test(expected = IllegalArgumentException.class) public void extensions_test_subject_alternative_names() throws Exception { ExtensionsGenerator extGen = new ExtensionsGenerator(); extGen.addExtension(Extension.subjectAlternativeName, false, new GeneralNames(new GeneralName[] { new GeneralName(GeneralName.dNSName, "some.other.domain.tld")})); PKCS10CertificationRequest request = makeRequest("OU=Vespa", extGen.generate()); CertificateSigner.verifyCertificateExtensions(request); }
@Test public void extensions_allowed() throws Exception { ExtensionsGenerator extGen = new ExtensionsGenerator(); extGen.addExtension(Extension.certificateIssuer, true, new byte[0]); PKCS10CertificationRequest request = makeRequest("OU=Vespa", extGen.generate()); CertificateSigner.verifyCertificateExtensions(request); }
/** * Basic constructor with Locale. You may need to use this constructor if the default locale * doesn't use a Gregorian calender so that the Time produced is compatible with other ASN.1 implementations. * * @param issuer the issuer this CRL is associated with. * @param thisUpdate the date of this update. * @param dateLocale locale to be used for date interpretation. */ public X509v2CRLBuilder( X500Name issuer, Date thisUpdate, Locale dateLocale) { tbsGen = new V2TBSCertListGenerator(); extGenerator = new ExtensionsGenerator(); tbsGen.setIssuer(issuer); tbsGen.setThisUpdate(new Time(thisUpdate, dateLocale)); }
/** * Base constructor with locale for interpreting dates. You may need to use this constructor if the default locale * doesn't use a Gregorian calender so that the GeneralizedTime produced is compatible with other ASN.1 implementations. * * @param holder holder certificate details * @param issuer issuer of this attribute certificate. * @param serialNumber serial number of this attribute certificate. * @param notBefore the date before which the certificate is not valid. * @param notAfter the date after which the certificate is not valid. * @param dateLocale locale to be used for date interpretation. */ public X509v2AttributeCertificateBuilder(AttributeCertificateHolder holder, AttributeCertificateIssuer issuer, BigInteger serialNumber, Date notBefore, Date notAfter, Locale dateLocale) { acInfoGen = new V2AttributeCertificateInfoGenerator(); extGenerator = new ExtensionsGenerator(); acInfoGen.setHolder(holder.holder); acInfoGen.setIssuer(AttCertIssuer.getInstance(issuer.form)); acInfoGen.setSerialNumber(new ASN1Integer(serialNumber)); acInfoGen.setStartDate(new ASN1GeneralizedTime(notBefore, dateLocale)); acInfoGen.setEndDate(new ASN1GeneralizedTime(notAfter, dateLocale)); }
public static String generateX509CSR(PrivateKey privateKey, PublicKey publicKey, String x500Principal, GeneralName[] sanArray) throws OperatorCreationException, IOException { // Create Distinguished Name X500Principal subject = new X500Principal(x500Principal); // Create ContentSigner JcaContentSignerBuilder csBuilder = new JcaContentSignerBuilder(Crypto.RSA_SHA256); ContentSigner signer = csBuilder.build(privateKey); // Create the CSR PKCS10CertificationRequestBuilder p10Builder = new JcaPKCS10CertificationRequestBuilder( subject, publicKey); // Add SubjectAlternativeNames (SAN) if specified if (sanArray != null) { ExtensionsGenerator extGen = new ExtensionsGenerator(); GeneralNames subjectAltNames = new GeneralNames(sanArray); extGen.addExtension(Extension.subjectAlternativeName, false, subjectAltNames); p10Builder.addAttribute(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest, extGen.generate()); } PKCS10CertificationRequest csr = p10Builder.build(signer); // write to openssl PEM format PemObject pemObject = new PemObject("CERTIFICATE REQUEST", csr.getEncoded()); StringWriter strWriter; try (JcaPEMWriter pemWriter = new JcaPEMWriter(strWriter = new StringWriter())) { pemWriter.writeObject(pemObject); } return strWriter.toString(); }
/** * Signs the completed CSR. * * @param keypair * {@link KeyPair} to sign the CSR with */ public void sign(KeyPair keypair) throws IOException { Objects.requireNonNull(keypair, "keypair"); if (namelist.isEmpty()) { throw new IllegalStateException("No domain was set"); } try { GeneralName[] gns = new GeneralName[namelist.size()]; for (int ix = 0; ix < namelist.size(); ix++) { gns[ix] = new GeneralName(GeneralName.dNSName, namelist.get(ix)); } GeneralNames subjectAltName = new GeneralNames(gns); PKCS10CertificationRequestBuilder p10Builder = new JcaPKCS10CertificationRequestBuilder(namebuilder.build(), keypair.getPublic()); ExtensionsGenerator extensionsGenerator = new ExtensionsGenerator(); extensionsGenerator.addExtension(Extension.subjectAlternativeName, false, subjectAltName); p10Builder.addAttribute(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest, extensionsGenerator.generate()); PrivateKey pk = keypair.getPrivate(); JcaContentSignerBuilder csBuilder = new JcaContentSignerBuilder( pk instanceof ECKey ? EC_SIGNATURE_ALG : SIGNATURE_ALG); ContentSigner signer = csBuilder.build(pk); csr = p10Builder.build(signer); } catch (OperatorCreationException ex) { throw new IOException("Could not generate CSR", ex); } }
