• Home
• com.github.nagyesta.lowkey-vault
• lowkey-vault-app
• 2.5.31
• source code
• KeyVaultCertificateEntity.java

×

Project download

Many resources are needed to download a project. Please understand that we have to compensate our server costs. Thank you in advance.
Project price only 1 $

You can buy this project and download/modify it how often you want.

com.github.nagyesta.lowkeyvault.service.certificate.impl.KeyVaultCertificateEntity Maven / Gradle / Ivy

package com.github.nagyesta.lowkeyvault.service.certificate.impl;

import com.github.nagyesta.lowkeyvault.model.v7_2.key.request.JsonWebKeyImportRequest;
import com.github.nagyesta.lowkeyvault.model.v7_3.certificate.CertificateRestoreInput;
import com.github.nagyesta.lowkeyvault.service.EntityId;
import com.github.nagyesta.lowkeyvault.service.certificate.ReadOnlyKeyVaultCertificateEntity;
import com.github.nagyesta.lowkeyvault.service.certificate.id.VersionedCertificateEntityId;
import com.github.nagyesta.lowkeyvault.service.common.BaseVaultEntity;
import com.github.nagyesta.lowkeyvault.service.common.impl.KeyVaultBaseEntity;
import com.github.nagyesta.lowkeyvault.service.exception.CryptoException;
import com.github.nagyesta.lowkeyvault.service.key.id.KeyEntityId;
import com.github.nagyesta.lowkeyvault.service.key.id.VersionedKeyEntityId;
import com.github.nagyesta.lowkeyvault.service.key.impl.KeyVaultKeyEntity;
import com.github.nagyesta.lowkeyvault.service.secret.id.SecretEntityId;
import com.github.nagyesta.lowkeyvault.service.secret.id.VersionedSecretEntityId;
import com.github.nagyesta.lowkeyvault.service.vault.VaultFake;
import lombok.NonNull;
import lombok.extern.slf4j.Slf4j;
import org.bouncycastle.pkcs.PKCS10CertificationRequest;
import org.springframework.util.Assert;

import java.security.MessageDigest;
import java.security.cert.Certificate;
import java.security.cert.X509Certificate;
import java.time.OffsetDateTime;
import java.time.temporal.ChronoUnit;
import java.util.Date;
import java.util.Optional;

import static com.github.nagyesta.lowkeyvault.controller.common.util.CertificateRequestMapperUtil.convertPolicyToCertificateCreationInput;

@Slf4j
public class KeyVaultCertificateEntity
        extends KeyVaultBaseEntity
        implements ReadOnlyKeyVaultCertificateEntity {

    private final VersionedCertificateEntityId id;
    private final VersionedKeyEntityId kid;
    private final VersionedSecretEntityId sid;
    private final CertificateBackingEntityGenerator generator;
    private X509Certificate certificate;
    private ReadOnlyCertificatePolicy originalCertificatePolicy;
    private final String originalCertificateContents;
    private CertificatePolicy issuancePolicy;
    private PKCS10CertificationRequest csr;
    /**
     * Constructor for certificate creation.
     *
     * @param name  The name of the certificate entity.
     * @param input The input parameters.
     * @param vault The vault we need to use.
     */
    public KeyVaultCertificateEntity(@NonNull final String name,
                                     @NonNull final CertificateCreationInput input,
                                     @org.springframework.lang.NonNull final VaultFake vault) {
        super(vault);
        Assert.state(name.equals(input.getName()),
                "Certificate name (" + name + ") did not match name from certificate creation input: " + input.getName());
        final KeyEntityId kid = new KeyEntityId(vault.baseUri(), name);
        final SecretEntityId sid = new SecretEntityId(vault.baseUri(), name);
        assertNoNameCollisionWithNotManagedEntity(vault, kid, sid);
        this.issuancePolicy = new CertificatePolicy(input);
        this.originalCertificatePolicy = new CertificatePolicy(input);
        this.generator = new CertificateBackingEntityGenerator(vault);
        this.kid = generator.generateKeyPair(input);
        //reuse the generated key version to produce matching version numbers in all keys
        this.id = new VersionedCertificateEntityId(vault.baseUri(), name, this.kid.version());
        final CertificateGenerator certificateGenerator = new CertificateGenerator(vault, this.kid);
        this.certificate = certificateGenerator.generateCertificate(input);
        this.csr = certificateGenerator.generateCertificateSigningRequest(name, this.certificate);
        final VersionedSecretEntityId secretEntityId = new VersionedSecretEntityId(vault.baseUri(), input.getName(), this.kid.version());
        this.sid = generator.generateSecret(this.originalCertificatePolicy, this.certificate, this.kid, secretEntityId);
        this.originalCertificateContents = vault.secretVaultFake().getEntities().getReadOnlyEntity(this.sid).getValue();
        normalizeCoreTimeStamps(input, now());
    }


    /**
     * Constructor for certificate import.
     *
     * @param name  The name of the certificate entity.
     * @param input The input parameters.
     * @param vault The vault we need to use.
     */
    public KeyVaultCertificateEntity(@NonNull final String name,
                                     @NonNull final CertificateImportInput input,
                                     @org.springframework.lang.NonNull final VaultFake vault) {
        super(vault);
        final ReadOnlyCertificatePolicy policy = Optional.ofNullable(input.getCertificateData())
                .orElseThrow(() -> new IllegalArgumentException("Certificate data must not be null."));
        final ReadOnlyCertificatePolicy originalCertificateData = Optional.ofNullable(input.getParsedCertificateData())
                .orElseThrow(() -> new IllegalArgumentException("Parsed certificate data must not be null."));
        final X509Certificate certificate = Optional.ofNullable(input.getCertificate())
                .orElseThrow(() -> new IllegalArgumentException("Certificate must not be null."));
        final JsonWebKeyImportRequest keyImportRequest = Optional.ofNullable(input.getKeyData())
                .orElseThrow(() -> new IllegalArgumentException("Key data must not be null."));
        Assert.state(name.equals(policy.getName()),
                "Certificate name (" + name + ") did not match name from certificate creation input: " + policy.getName());
        final KeyEntityId kid = new KeyEntityId(vault.baseUri(), name);
        final SecretEntityId sid = new SecretEntityId(vault.baseUri(), name);
        assertNoNameCollisionWithNotManagedEntity(vault, kid, sid);
        this.issuancePolicy = new CertificatePolicy(policy);
        this.originalCertificatePolicy = new CertificatePolicy(originalCertificateData);
        this.generator = new CertificateBackingEntityGenerator(vault);
        this.kid = generator.importKeyPair(policy, keyImportRequest);
        //reuse the generated key version to produce matching version numbers in all keys
        this.id = new VersionedCertificateEntityId(vault.baseUri(), name, this.kid.version());
        final CertificateGenerator certificateGenerator = new CertificateGenerator(vault, this.kid);
        this.certificate = certificate;
        this.csr = certificateGenerator.generateCertificateSigningRequest(name, this.certificate);
        final VersionedSecretEntityId secretEntityId = new VersionedSecretEntityId(vault.baseUri(), input.getName(), this.kid.version());
        this.sid = generator.generateSecret(this.originalCertificatePolicy, this.certificate, this.kid, secretEntityId);
        this.originalCertificateContents = vault.secretVaultFake().getEntities().getReadOnlyEntity(this.sid).getValue();
        normalizeCoreTimeStamps(policy, now());
    }

    /**
     * Constructor for certificate renewal.
     *
     * @param input The input parameters defining how the certificate should look like.
     * @param kid   The Id of the key entity version we need to use.
     * @param id    The Id of the new certificate entity.
     * @param vault The vault we are using.
     */
    public KeyVaultCertificateEntity(@NonNull final ReadOnlyCertificatePolicy input,
                                     @NonNull final VersionedKeyEntityId kid,
                                     @NonNull final VersionedCertificateEntityId id,
                                     @org.springframework.lang.NonNull final VaultFake vault) {
        super(vault);
        Assert.state(vault.keyVaultFake().getEntities().containsEntity(kid),
                "Key must exist to be able to renew certificate using it. " + kid.asUriNoVersion(vault.baseUri()));
        Assert.state(vault.secretVaultFake().getEntities().containsEntityMatching(input.getName(), BaseVaultEntity::isManaged),
                "A version of the Secret must exist to be able to generate a new version using name: " + input.getName());
        this.issuancePolicy = new CertificatePolicy(input);
        this.originalCertificatePolicy = new CertificatePolicy(input);
        this.kid = kid;
        //use the provided id, it might be different from the key id in case the key is reused.
        this.id = id;
        final CertificateGenerator certificateGenerator = new CertificateGenerator(vault, this.kid);
        this.certificate = certificateGenerator.generateCertificate(input);
        this.csr = certificateGenerator.generateCertificateSigningRequest(input.getName(), this.certificate);
        final VersionedSecretEntityId secretEntityId = new VersionedSecretEntityId(vault.baseUri(), input.getName(), id.version());
        this.generator = new CertificateBackingEntityGenerator(vault);
        this.sid = generator.generateSecret(this.originalCertificatePolicy, this.certificate, this.kid, secretEntityId);
        this.originalCertificateContents = vault.secretVaultFake().getEntities().getReadOnlyEntity(this.sid).getValue();
        normalizeCoreTimeStamps(input, input.getValidityStart());
    }


    /**
     * Constructor for certificate restore.
     *
     * @param id  The id of the certificate entity.
     * @param input The input parameters.
     * @param vault The vault we need to use.
     */
    public KeyVaultCertificateEntity(@NonNull final VersionedCertificateEntityId id,
                                     @NonNull final CertificateRestoreInput input,
                                     @org.springframework.lang.NonNull final VaultFake vault) {
        super(vault);
        final ReadOnlyCertificatePolicy policy = input.getCertificateData();
        final ReadOnlyCertificatePolicy originalCertificateData = input.getParsedCertificateData();
        final X509Certificate certificate = input.getCertificate();
        final JsonWebKeyImportRequest keyImportRequest = input.getKeyData();
        final VersionedKeyEntityId kid = new VersionedKeyEntityId(vault.baseUri(), id.id(), input.getKeyVersion());
        final VersionedSecretEntityId sid = new VersionedSecretEntityId(vault.baseUri(), id.id(), id.version());
        assertNoNameCollisionWithNotManagedEntity(vault, kid, sid);
        this.issuancePolicy = new CertificatePolicy(policy);
        this.originalCertificatePolicy = new CertificatePolicy(originalCertificateData);
        this.generator = new CertificateBackingEntityGenerator(vault);
        if (vault.keyVaultFake().getEntities().containsEntity(kid)) {
            //key already exists, just extend expiry
            this.kid = kid;
            vault.keyVaultFake().getEntities().getEntity(kid, KeyVaultKeyEntity.class).setExpiry(input.getExpires());
        } else {
            this.kid = generator.importKeyPair(kid, policy, keyImportRequest, input.isEnabled());
        }
        this.id = new VersionedCertificateEntityId(vault.baseUri(), id.id(), id.version());
        final CertificateGenerator certificateGenerator = new CertificateGenerator(vault, this.kid);
        this.certificate = certificate;
        this.csr = certificateGenerator.generateCertificateSigningRequest(id.id(), this.certificate);
        this.sid = generator.generateSecret(this.originalCertificatePolicy, this.certificate, this.kid, sid);
        this.originalCertificateContents = vault.secretVaultFake().getEntities().getReadOnlyEntity(this.sid).getValue();
        this.updateIssuancePolicy(convertPolicyToCertificateCreationInput(input.getName(), input.getIssuancePolicy()));
        this.setExpiry(input.getExpires());
        this.setEnabled(input.isEnabled());
        this.setTags(input.getTags());
        this.setNotBefore(input.getNotBefore());
        this.setCreatedOn(input.getCreated());
        this.setUpdatedOn(input.getUpdated());
    }


    @Override
    public VersionedCertificateEntityId getId() {
        return id;
    }

    @Override
    public VersionedKeyEntityId getKid() {
        return kid;
    }

    @Override
    public VersionedSecretEntityId getSid() {
        return sid;
    }

    @Override
    public Certificate getCertificate() {
        return certificate;
    }

    @Override
    public ReadOnlyCertificatePolicy getIssuancePolicy() {
        return issuancePolicy;
    }

    @Override
    public void updateIssuancePolicy(@NonNull final ReadOnlyCertificatePolicy policy) {
        Assert.isTrue(this.id.id().equals(policy.getName()), "Updated policy must have the same name for: " + this.id);
        this.issuancePolicy = new CertificatePolicy(policy);
        this.updatedNow();
    }

    @Override
    public ReadOnlyCertificatePolicy getOriginalCertificatePolicy() {
        return originalCertificatePolicy;
    }

    @Override
    public String getOriginalCertificateContents() {
        return originalCertificateContents;
    }

    @Override
    public PKCS10CertificationRequest getCertificateSigningRequest() {
        return csr;
    }

    @Override
    public byte[] getThumbprint() throws CryptoException {
        try {
            final MessageDigest messageDigest = MessageDigest.getInstance("SHA-1");
            messageDigest.update(getEncodedCertificate());
            return messageDigest.digest();
        } catch (final Exception e) {
            throw new CryptoException("Failed to calculate thumbprint for certificate: " + getId().toString(), e);
        }
    }

    @Override
    public byte[] getEncodedCertificate() throws CryptoException {
        try {
            return getCertificate().getEncoded();
        } catch (final Exception e) {
            throw new CryptoException("Failed to obtain encoded certificate: " + getId().toString(), e);
        }
    }

    @Override
    public byte[] getEncodedCertificateSigningRequest() {
        try {
            byte[] encoded = null;
            if (getCertificateSigningRequest() != null) {
                encoded = getCertificateSigningRequest().getEncoded();
            }
            return encoded;
        } catch (final Exception e) {
            throw new CryptoException("Failed to obtain encoded certificate signing request: " + getId().toString(), e);
        }
    }

    @Override
    public void timeShift(final int offsetSeconds) {
        super.timeShift(offsetSeconds);
        //reset expiry as it is measured in months while timeShift is using seconds
        //it is better to stay consistent with the behavior of the certificates
        this.setExpiry(this.getNotBefore().orElse(this.getCreated()).plusMonths(this.originalCertificatePolicy.getValidityMonths()));
    }

    public void regenerateCertificate(final VaultFake vault) {
        if (this.getDeletedDate().isPresent()) {
            log.warn("Deleted certificate is regeneration is skipped for: {}", id);
        } else if (validityStartDateNoLongerAccurate()) {
            log.debug("Regenerating certificate: {}", id);
            final CertificatePolicy updated = new CertificatePolicy(originalCertificatePolicy);
            updated.setValidityStart(getCreated());
            regenerateCertificateData(vault, updated);
            generator.updateSecretValueWithNewCertificate(updated, certificate, kid, sid);
        } else {
            log.debug("Validity start date is still accurate certificate won't be changed: {}", id);
        }
    }

    private static void assertNoNameCollisionWithNotManagedEntity(
            final VaultFake vault, final KeyEntityId kid, final SecretEntityId sid) {
        Assert.state(!vault.keyVaultFake().getEntities().containsEntityMatching(kid.id(), KeyVaultCertificateEntity::isNotManaged),
                "Key must not exist to be able to store certificate data in it. " + kid.asUriNoVersion(vault.baseUri()));
        Assert.state(!vault.secretVaultFake().getEntities().containsEntityMatching(sid.id(), KeyVaultCertificateEntity::isNotManaged),
                "Secret must not exist to be able to store certificate data in it. " + sid.asUriNoVersion(vault.baseUri()));
    }

    private static boolean isNotManaged(final BaseVaultEntity e) {
        return !e.isManaged();
    }

    private void normalizeCoreTimeStamps(final ReadOnlyCertificatePolicy certPolicy, final OffsetDateTime createOrUpdate) {
        this.setNotBefore(certPolicy.getValidityStart());
        this.setExpiry(certPolicy.getValidityStart().plusMonths(certPolicy.getValidityMonths()));
        this.setEnabled(true);
        //update timestamps of certificate as the constructor can run for more than a second
        this.setCreatedOn(createOrUpdate);
        this.setUpdatedOn(createOrUpdate);
    }

    private void regenerateCertificateData(final VaultFake vaultFake, final CertificatePolicy updated) {
        final CertificateGenerator certificateGenerator = new CertificateGenerator(vaultFake, this.kid);
        this.certificate = certificateGenerator.generateCertificate(updated);
        this.csr = certificateGenerator.generateCertificateSigningRequest(this.id.id(), this.certificate);
        this.originalCertificatePolicy = updated;
    }

    private boolean validityStartDateNoLongerAccurate() {
        final OffsetDateTime validityStart = this.getNotBefore().orElse(this.getCreated());
        final Date desiredStartOfValidity = Date.from(validityStart.truncatedTo(ChronoUnit.DAYS).toInstant());
        final Date existingStartOfValidity = certificate.getNotBefore();
        return !desiredStartOfValidity.equals(existingStartOfValidity);
    }
}