org.cesecore.certificates.certificate.certextensions.standard.AuthorityKeyIdentifier Maven / Gradle / Ivy

/*************************************************************************
 *                                                                       *
 *  CESeCore: CE Security Core                                           *
 *                                                                       *
 *  This software is free software; you can redistribute it and/or       *
 *  modify it under the terms of the GNU Lesser General Public           *
 *  License as published by the Free Software Foundation; either         *
 *  version 2.1 of the License, or any later version.                    *
 *                                                                       *
 *  See terms of license at gnu.org.                                     *
 *                                                                       *
 *************************************************************************/
package org.cesecore.certificates.certificate.certextensions.standard;

import java.security.PublicKey;
import java.security.cert.Certificate;
import java.security.cert.X509Certificate;
import java.util.List;

import org.apache.log4j.Logger;
import org.bouncycastle.asn1.ASN1Encodable;
import org.bouncycastle.asn1.ASN1EncodableVector;
import org.bouncycastle.asn1.ASN1OctetString;
import org.bouncycastle.asn1.ASN1Sequence;
import org.bouncycastle.asn1.DEROctetString;
import org.bouncycastle.asn1.DERSequence;
import org.bouncycastle.asn1.DERTaggedObject;
import org.bouncycastle.asn1.x509.Extension;
import org.bouncycastle.cert.jcajce.JcaX509ExtensionUtils;
import org.cesecore.certificates.ca.CA;
import org.cesecore.certificates.ca.internal.CertificateValidity;
import org.cesecore.certificates.certificate.CertificateConstants;
import org.cesecore.certificates.certificate.certextensions.CertificateExtensionException;
import org.cesecore.certificates.certificateprofile.CertificateProfile;
import org.cesecore.certificates.endentity.EndEntityInformation;
import org.cesecore.certificates.ocsp.SHA1DigestCalculator;
import org.cesecore.util.CertTools;

/**
 * 
 * Class for standard X509 certificate extension. See rfc3280 or later for spec of this extension.
 * 
 * @version $Id: AuthorityKeyIdentifier.java 22618 2016-01-20 15:00:45Z marko $
 */
public class AuthorityKeyIdentifier extends StandardCertificateExtension {
    private static final long serialVersionUID = 1L;
    private static final Logger log = Logger.getLogger(AuthorityKeyIdentifier.class);

    @Override
    public void init(final CertificateProfile certProf) {
        super.setOID(Extension.authorityKeyIdentifier.getId());
        super.setCriticalFlag(certProf.getAuthorityKeyIdentifierCritical());
    }

    @Override
    public ASN1Encodable getValue(final EndEntityInformation subject, final CA ca, final CertificateProfile certProfile, final PublicKey userPublicKey,
            final PublicKey caPublicKey, CertificateValidity val) throws CertificateExtensionException {
        org.bouncycastle.asn1.x509.AuthorityKeyIdentifier ret = null;
        // Default value is that we calculate it from scratch!
        // (If this is a root CA we must calculate the AuthorityKeyIdentifier from scratch)
        // (If the CA signing this cert does not have a SubjectKeyIdentifier we must calculate the AuthorityKeyIdentifier from scratch)
        JcaX509ExtensionUtils extensionUtils = new JcaX509ExtensionUtils(SHA1DigestCalculator.buildSha1Instance());
        ret = extensionUtils.createAuthorityKeyIdentifier(caPublicKey);
        // If we have a CA-certificate (i.e. this is not a Root CA), we must take the authority key identifier from
        // the CA-certificates SubjectKeyIdentifier if it exists. If we don't do that we will get the wrong identifier if the
        // CA does not follow RFC3280 (guess if MS-CA follows RFC3280?)
        final X509Certificate cacert = getCACertificate(ca, caPublicKey);
        final boolean isRootCA = (certProfile.getType() == CertificateConstants.CERTTYPE_ROOTCA);
        if ((cacert != null) && (!isRootCA)) {
            byte[] akibytes;
            akibytes = CertTools.getSubjectKeyId(cacert);
            if (akibytes != null) {
                // TODO: The code below is snipped from AuthorityKeyIdentifier.java in BC 1.36, because there is no method there
                // to set only a pre-computed key identifier
                // This should be replaced when such a method is added to BC
                final ASN1OctetString keyidentifier = new DEROctetString(akibytes);
                final ASN1EncodableVector v = new ASN1EncodableVector();
                v.add(new DERTaggedObject(false, 0, keyidentifier));
                final ASN1Sequence seq = new DERSequence(v);
                ret = org.bouncycastle.asn1.x509.AuthorityKeyIdentifier.getInstance(seq);
                if (log.isDebugEnabled()) {
                    log.debug("Using AuthorityKeyIdentifier from CA-certificates SubjectKeyIdentifier.");
                }
            }
        }
        return ret;
    }

    private X509Certificate getCACertificate(final CA ca, final PublicKey caPublicKey) {
        final List rolloverChain = ca.getRolloverCertificateChain();
        if (rolloverChain != null && rolloverChain.get(0).getPublicKey().equals(caPublicKey)) {
            return (X509Certificate) rolloverChain.get(0);
        } else {
            return (X509Certificate) ca.getCACertificate();
        }
    }
}