org.bouncycastle.est.jcajce.JcaJceUtils Maven / Gradle / Ivy

Go to download
Show more of this group Show more artifacts with this name
Show all versions of bcpkix-jdk15on Show documentation
The Bouncy Castle Java APIs for CMS, PKCS, EAC, TSP, CMP, CRMF, OCSP, and certificate generation. This jar contains APIs for JDK 1.5 to JDK 1.8. The APIs can be used in conjunction with a JCE/JCA provider such as the one provided with the Bouncy Castle Cryptography APIs.
There is a newer version: 1.70
Show newest version
package org.bouncycastle.est.jcajce;

import java.security.GeneralSecurityException;
import java.security.KeyStore;
import java.security.KeyStoreException;
import java.security.NoSuchAlgorithmException;
import java.security.NoSuchProviderException;
import java.security.UnrecoverableKeyException;
import java.security.cert.CRL;
import java.security.cert.CertPathBuilder;
import java.security.cert.CertStore;
import java.security.cert.CertificateException;
import java.security.cert.CollectionCertStoreParameters;
import java.security.cert.PKIXBuilderParameters;
import java.security.cert.PKIXCertPathValidatorResult;
import java.security.cert.TrustAnchor;
import java.security.cert.X509CertSelector;
import java.security.cert.X509Certificate;
import java.util.Arrays;
import java.util.Iterator;
import java.util.Set;

import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.X509TrustManager;

import org.bouncycastle.asn1.x509.ExtendedKeyUsage;
import org.bouncycastle.asn1.x509.KeyPurposeId;
import org.bouncycastle.asn1.x509.KeyUsage;
import org.bouncycastle.cert.X509CertificateHolder;


/**
 * General utility methods for building common objects for supporting the JCA/JCE/JSSE.
 */
public class JcaJceUtils
{

    public static X509TrustManager getTrustAllTrustManager()
    {

        //
        // Trust manager signal distrust by throwing exceptions.
        // This one trust all by doing nothing.
        //

        return new X509TrustManager()
        {
            public void checkClientTrusted(java.security.cert.X509Certificate[] x509Certificates, String s)
                throws java.security.cert.CertificateException
            {

            }

            public void checkServerTrusted(java.security.cert.X509Certificate[] x509Certificates, String s)
                throws java.security.cert.CertificateException
            {

            }

            public java.security.cert.X509Certificate[] getAcceptedIssuers()
            {
                return new java.security.cert.X509Certificate[0];
            }
        };

    }

    public static X509TrustManager[] getCertPathTrustManager(final Set anchors, final CRL[] revocationLists)
    {
        final X509Certificate[] x509CertificateTrustAnchors = new X509Certificate[anchors.size()];
        int c = 0;
        for (Iterator it = anchors.iterator(); it.hasNext();)
        {
            TrustAnchor ta = (TrustAnchor)it.next();

            x509CertificateTrustAnchors[c++] = ta.getTrustedCert();
        }

        return new X509TrustManager[]{new X509TrustManager()
        {
            public void checkClientTrusted(X509Certificate[] x509Certificates, String s)
                throws CertificateException
            {

            }

            public void checkServerTrusted(X509Certificate[] x509Certificates, String s)
                throws CertificateException
            {
                try
                {
                    CertStore certStore = CertStore.getInstance("Collection",
                        new CollectionCertStoreParameters(Arrays.asList(x509Certificates)), "BC");

                    CertPathBuilder pathBuilder = CertPathBuilder.getInstance("PKIX", "BC");

                    X509CertSelector constraints = new X509CertSelector();

                    constraints.setCertificate(x509Certificates[0]);


                    PKIXBuilderParameters param = new PKIXBuilderParameters(anchors, constraints);
                    param.addCertStore(certStore);
                    if (revocationLists != null)
                    {
                        param.setRevocationEnabled(true);
                        param.addCertStore(
                            CertStore.getInstance(
                                "Collection",
                                new CollectionCertStoreParameters(Arrays.asList(revocationLists)
                                )));
                    }
                    else
                    {
                        param.setRevocationEnabled(false);
                    }

                    PKIXCertPathValidatorResult result = (PKIXCertPathValidatorResult)pathBuilder.build(param);

                    validateServerCertUsage(x509Certificates[0]);

                }
                catch (CertificateException e)
                {
                    throw e;
                }
                catch (GeneralSecurityException e)
                {
                    throw new CertificateException("unable to process certificates: " + e.getMessage(), e);
                }
            }

            public X509Certificate[] getAcceptedIssuers()
            {
                X509Certificate[] rv = new X509Certificate[x509CertificateTrustAnchors.length];

                System.arraycopy(x509CertificateTrustAnchors, 0, rv, 0, rv.length);

                return rv;
            }
        }
        };
    }

    public static void validateServerCertUsage(X509Certificate x509Certificate)
        throws CertificateException
    {
        try
        {
            X509CertificateHolder cert = new X509CertificateHolder(x509Certificate.getEncoded());

            KeyUsage keyUsage = KeyUsage.fromExtensions(cert.getExtensions());

            if (keyUsage != null)
            {
                if (keyUsage.hasUsages(KeyUsage.keyCertSign))
                {
                    throw new CertificateException("Key usage must not contain keyCertSign");
                }

                if (!(keyUsage.hasUsages(KeyUsage.digitalSignature) || keyUsage.hasUsages(KeyUsage.keyEncipherment)))
                {
                    throw new CertificateException("Key usage must be none, digitalSignature or keyEncipherment");
                }
            }

            //
            // Check extended key usage.
            //
            ExtendedKeyUsage extendedKeyUsage = ExtendedKeyUsage.fromExtensions(cert.getExtensions());

            if (extendedKeyUsage != null)
            {
                if (!(extendedKeyUsage.hasKeyPurposeId(KeyPurposeId.id_kp_serverAuth) ||
                    extendedKeyUsage.hasKeyPurposeId(KeyPurposeId.id_kp_msSGC) ||
                    extendedKeyUsage.hasKeyPurposeId(KeyPurposeId.id_kp_nsSGC)))
                {
                    throw new CertificateException("Certificate extended key usage must include serverAuth, msSGC or nsSGC");
                }
            }

        }
        catch (CertificateException c)
        {
            throw c;
        }
        catch (Exception e)
        {
            throw new CertificateException(e.getMessage(), e);
        }
    }


    public static KeyManagerFactory createKeyManagerFactory(
        String type,
        String provider,
        KeyStore clientKeyStore,
        char[] clientKeyStorePass)
        throws UnrecoverableKeyException, NoSuchAlgorithmException, KeyStoreException, NoSuchProviderException
    {
        KeyManagerFactory keyManagerFactory = null;
        if (type == null && provider == null)
        {
            keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
        }
        else if (provider == null)
        {
            keyManagerFactory = KeyManagerFactory.getInstance(type);
        }
        else
        {
            keyManagerFactory = KeyManagerFactory.getInstance(type, provider);
        }
        keyManagerFactory.init(clientKeyStore, clientKeyStorePass);
        return keyManagerFactory;
    }
}