Many resources are needed to download a project. Please understand that we have to compensate our server costs. Thank you in advance. Project price only 1 $
You can buy this project and download/modify it how often you want.
/*************************************************************************
* *
* CESeCore: CE Security Core *
* *
* This software is free software; you can redistribute it and/or *
* modify it under the terms of the GNU Lesser General Public *
* License as published by the Free Software Foundation; either *
* version 2.1 of the License, or any later version. *
* *
* See terms of license at gnu.org. *
* *
*************************************************************************/
package org.cesecore.certificates.certificateprofile;
import java.io.Serializable;
import java.security.PublicKey;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Calendar;
import java.util.Collection;
import java.util.Collections;
import java.util.HashMap;
import java.util.Iterator;
import java.util.LinkedHashMap;
import java.util.LinkedHashSet;
import java.util.List;
import java.util.Map;
import java.util.Map.Entry;
import java.util.Set;
import java.util.StringTokenizer;
import org.apache.commons.lang.ArrayUtils;
import org.apache.commons.lang.StringUtils;
import org.apache.log4j.Logger;
import org.bouncycastle.asn1.ocsp.OCSPObjectIdentifiers;
import org.bouncycastle.asn1.x509.Extension;
import org.bouncycastle.asn1.x509.KeyPurposeId;
import org.cesecore.certificates.ca.ApprovalRequestType;
import org.cesecore.certificates.certificate.CertificateConstants;
import org.cesecore.certificates.certificate.IllegalKeyException;
import org.cesecore.certificates.util.AlgorithmConstants;
import org.cesecore.certificates.util.AlgorithmTools;
import org.cesecore.certificates.util.DNFieldExtractor;
import org.cesecore.certificates.util.DnComponents;
import org.cesecore.internal.InternalResources;
import org.cesecore.internal.UpgradeableDataHashMap;
import org.cesecore.keys.util.KeyTools;
import org.cesecore.util.CertTools;
import org.cesecore.util.ValidityDate;
/**
* CertificateProfile is a basic class used to customize a certificate configuration or be inherited by fixed certificate profiles.
*
* @version $Id: CertificateProfile.java 31311 2019-01-24 13:54:02Z lauri_k_helmes $
*/
public class CertificateProfile extends UpgradeableDataHashMap implements Serializable, Cloneable {
private static final Logger log = Logger.getLogger(CertificateProfile.class);
/** Internal localization of logs and errors */
private static final InternalResources intres = InternalResources.getInstance();
// Public Constants
public static final float LATEST_VERSION = (float) 46.0;
public static final String ROOTCAPROFILENAME = "ROOTCA";
public static final String SUBCAPROFILENAME = "SUBCA";
public static final String ENDUSERPROFILENAME = "ENDUSER";
public static final String OCSPSIGNERPROFILENAME = "OCSPSIGNER";
public static final String SERVERPROFILENAME = "SERVER";
public static final String HARDTOKENAUTHPROFILENAME = "HARDTOKEN_AUTH";
public static final String HARDTOKENAUTHENCPROFILENAME = "HARDTOKEN_AUTHENC";
public static final String HARDTOKENENCPROFILENAME = "HARDTOKEN_ENC";
public static final String HARDTOKENSIGNPROFILENAME = "HARDTOKEN_SIGN";
public static final List FIXED_PROFILENAMES = new ArrayList<>();
static {
FIXED_PROFILENAMES.add(ROOTCAPROFILENAME);
FIXED_PROFILENAMES.add(SUBCAPROFILENAME);
FIXED_PROFILENAMES.add(ENDUSERPROFILENAME);
FIXED_PROFILENAMES.add(OCSPSIGNERPROFILENAME);
FIXED_PROFILENAMES.add(SERVERPROFILENAME);
FIXED_PROFILENAMES.add(HARDTOKENAUTHPROFILENAME);
FIXED_PROFILENAMES.add(HARDTOKENAUTHENCPROFILENAME);
FIXED_PROFILENAMES.add(HARDTOKENENCPROFILENAME);
FIXED_PROFILENAMES.add(HARDTOKENSIGNPROFILENAME);
}
/**
* Determines if a de-serialized file is compatible with this class.
*
* Maintainers must change this value if and only if the new version of this class is not compatible with old versions. See Sun docs for details.
*
*/
private static final long serialVersionUID = -8069608639716545206L;
/** Microsoft Template Constants */
public static final String MSTEMPL_DOMAINCONTROLLER = "DomainController";
public static final String[] AVAILABLE_MSTEMPLATES = { MSTEMPL_DOMAINCONTROLLER };
public static final String TRUE = "true";
public static final String FALSE = "false";
/**
* Determines the access rights in CV Certificates. CV Certificates is used by EU EAC ePassports and is issued by a CVC CA. DG3 is access to
* fingerprints and DG4 access to iris.
*/
public static final int CVC_ACCESS_NONE = 0;
public static final int CVC_ACCESS_DG3 = 1;
public static final int CVC_ACCESS_DG4 = 2;
public static final int CVC_ACCESS_DG3DG4 = 3;
// For signature terminals (defined in version 2.10 of the EAC specification)
public static final int CVC_ACCESS_SIGN = 16;
public static final int CVC_ACCESS_QUALSIGN = 32;
public static final int CVC_ACCESS_SIGN_AND_QUALSIGN = 48;
/**
* CVC terminal types. Controls which set of roles and access rights are available.
*/
public static final int CVC_TERMTYPE_IS = 0;
/** Authentication terminal */
public static final int CVC_TERMTYPE_AT = 1;
/** Signature terminal */
public static final int CVC_TERMTYPE_ST = 2;
/** Accreditation Body DV for signature terminals. ABs accredits CSPs */
public static final int CVC_SIGNTERM_DV_AB = 0;
/** Certification Service Provider DV for signature terminals */
public static final int CVC_SIGNTERM_DV_CSP = 1;
/** Supported certificate versions. */
public static final String VERSION_X509V3 = "X509v3";
public static final String CUSTOMPROFILENAME = "CUSTOM";
/** Constant indicating that any CA can be used with this certificate profile. */
public static final int ANYCA = -1;
/** Constant indicating that any elliptic curve may be used with this profile. */
public static final String ANY_EC_CURVE = "ANY_EC_CURVE";
/** Constant holding the default available bit lengths for certificate profiles */
public static final int[] DEFAULTBITLENGTHS = { 0, 192, 224, 239, 256, 384, 512, 521, 1024, 1536, 2048, 3072, 4096, 6144, 8192 };
public static final byte[] DEFAULT_CVC_RIGHTS_AT = { 0, 0, 0, 0, 0 };
/** Constants for validity and private key usage period. */
public static final String DEFAULT_CERTIFICATE_VALIDITY = "2y";
/** Constant for default validity for fixed profiles is 25 years including 6 or 7 leap days. */
public static final String DEFAULT_CERTIFICATE_VALIDITY_FOR_FIXED_CA = "25y7d";
/** Constant for default validity offset (for backward compatibility': -10m'!) */
public static final String DEFAULT_CERTIFICATE_VALIDITY_OFFSET = "-10m";
public static final long DEFAULT_PRIVATE_KEY_USAGE_PERIOD_OFFSET = 0;
public static final long DEFAULT_PRIVATE_KEY_USAGE_PERIOD_LENGTH = 730 * 24 * 3600;
// Profile fields
protected static final String CERTVERSION = "certversion";
@Deprecated
protected static final String VALIDITY = "validity";
protected static final String ENCODED_VALIDITY = "encodedvalidity";
protected static final String USE_CERTIFICATE_VALIDITY_OFFSET = "usecertificatevalidityoffset";
protected static final String CERTIFICATE_VALIDITY_OFFSET = "certificatevalidityoffset";
protected static final String USE_EXPIRATION_RESTRICTION_FOR_WEEKDAYS = "useexpirationrestrictionforweekdays";
protected static final String EXPIRATION_RESTRICTION_FOR_WEEKDAYS_BEFORE = "expirationrestrictionforweekdaysbefore";
protected static final String EXPIRATION_RESTRICTION_WEEKDAYS = "expirationrestrictionweekdays";
protected static final String ALLOWVALIDITYOVERRIDE = "allowvalidityoverride";
protected static final String ALLOWKEYUSAGEOVERRIDE = "allowkeyusageoverride";
protected static final String ALLOWBACKDATEDREVOCATION = "allowbackdatedrevokation";
protected static final String ALLOWEXTENSIONOVERRIDE = "allowextensionoverride";
protected static final String ALLOWDNOVERRIDE = "allowdnoverride";
protected static final String ALLOWDNOVERRIDEBYEEI = "allowdnoverridebyeei";
protected static final String ALLOWCERTSNOVERIDE = "allowcertsnoverride";
protected static final String AVAILABLEKEYALGORITHMS = "availablekeyalgorithms";
protected static final String AVAILABLEECCURVES = "availableeccurves";
protected static final String AVAILABLEBITLENGTHS = "availablebitlengths";
protected static final String MINIMUMAVAILABLEBITLENGTH = "minimumavailablebitlength";
protected static final String MAXIMUMAVAILABLEBITLENGTH = "maximumavailablebitlength";
public static final String TYPE = "type";
protected static final String AVAILABLECAS = "availablecas";
protected static final String USEDPUBLISHERS = "usedpublishers";
protected static final String USECNPOSTFIX = "usecnpostfix";
protected static final String CNPOSTFIX = "cnpostfix";
protected static final String USESUBJECTDNSUBSET = "usesubjectdnsubset";
protected static final String SUBJECTDNSUBSET = "subjectdnsubset";
protected static final String USESUBJECTALTNAMESUBSET = "usesubjectaltnamesubset";
protected static final String SUBJECTALTNAMESUBSET = "subjectaltnamesubset";
protected static final String USEDCERTIFICATEEXTENSIONS = "usedcertificateextensions";
/**
* @deprecated since 6.8.0, where approval settings and profiles became interlinked.
*/
@Deprecated
protected static final String APPROVALSETTINGS = "approvalsettings";
/**
* @deprecated since 6.6.0, use the appropriate approval profile instead
* Needed for a while in order to be able to import old statedumps from 6.5 and earlier
*/
@Deprecated
public static final String NUMOFREQAPPROVALS = "numofreqapprovals";
/**
* @deprecated since 6.8.0, where approval settings and profiles became interlinked.
*/
@Deprecated
protected static final String APPROVALPROFILE = "approvalProfile";
protected static final String APPROVALS = "approvals";
protected static final String SIGNATUREALGORITHM = "signaturealgorithm";
protected static final String USECERTIFICATESTORAGE = "usecertificatestorage";
protected static final String STORECERTIFICATEDATA = "storecertificatedata";
protected static final String STORESUBJECTALTNAME = "storesubjectaltname";
//
// CRL extensions
protected static final String USECRLNUMBER = "usecrlnumber";
protected static final String CRLNUMBERCRITICAL = "crlnumbercritical";
//
// Certificate extensions
protected static final String USEBASICCONSTRAINTS = "usebasicconstrants";
protected static final String BASICCONSTRAINTSCRITICAL = "basicconstraintscritical";
protected static final String USEPATHLENGTHCONSTRAINT = "usepathlengthconstraint";
protected static final String PATHLENGTHCONSTRAINT = "pathlengthconstraint";
protected static final String USEKEYUSAGE = "usekeyusage";
protected static final String KEYUSAGECRITICAL = "keyusagecritical";
protected static final String KEYUSAGE = "keyusage";
protected static final String USESUBJECTKEYIDENTIFIER = "usesubjectkeyidentifier";
protected static final String SUBJECTKEYIDENTIFIERCRITICAL = "subjectkeyidentifiercritical";
protected static final String USEAUTHORITYKEYIDENTIFIER = "useauthoritykeyidentifier";
protected static final String AUTHORITYKEYIDENTIFIERCRITICAL = "authoritykeyidentifiercritical";
protected static final String USESUBJECTALTERNATIVENAME = "usesubjectalternativename";
protected static final String SUBJECTALTERNATIVENAMECRITICAL = "subjectalternativenamecritical";
protected static final String USEISSUERALTERNATIVENAME = "useissueralternativename";
protected static final String ISSUERALTERNATIVENAMECRITICAL = "issueralternativenamecritical";
protected static final String USECRLDISTRIBUTIONPOINT = "usecrldistributionpoint";
protected static final String USEDEFAULTCRLDISTRIBUTIONPOINT = "usedefaultcrldistributionpoint";
protected static final String CRLDISTRIBUTIONPOINTCRITICAL = "crldistributionpointcritical";
protected static final String CRLDISTRIBUTIONPOINTURI = "crldistributionpointuri";
protected static final String CRLISSUER = "crlissuer";
protected static final String USEFRESHESTCRL = "usefreshestcrl";
protected static final String USECADEFINEDFRESHESTCRL = "usecadefinedfreshestcrl";
protected static final String FRESHESTCRLURI = "freshestcrluri";
protected static final String USECERTIFICATEPOLICIES = "usecertificatepolicies";
protected static final String CERTIFICATEPOLICIESCRITICAL = "certificatepoliciescritical";
/** Policy containing oid, User Notice and Cps Url */
protected static final String CERTIFICATE_POLICIES = "certificatepolicies";
protected static final String USEEXTENDEDKEYUSAGE = "useextendedkeyusage";
protected static final String EXTENDEDKEYUSAGE = "extendedkeyusage";
protected static final String EXTENDEDKEYUSAGECRITICAL = "extendedkeyusagecritical";
protected static final String USEDOCUMENTTYPELIST = "usedocumenttypelist";
protected static final String DOCUMENTTYPELISTCRITICAL = "documenttypelistcritical";
protected static final String DOCUMENTTYPELIST = "documenttypelist";
protected static final String USEOCSPNOCHECK = "useocspnocheck";
protected static final String USEAUTHORITYINFORMATIONACCESS = "useauthorityinformationaccess";
protected static final String USEOCSPSERVICELOCATOR = "useocspservicelocator";
protected static final String USEDEFAULTCAISSUER = "usedefaultcaissuer";
protected static final String USEDEFAULTOCSPSERVICELOCATOR = "usedefaultocspservicelocator";
protected static final String OCSPSERVICELOCATORURI = "ocspservicelocatoruri";
protected static final String USECAISSUERS = "usecaissuersuri";
protected static final String CAISSUERS = "caissuers";
protected static final String USELDAPDNORDER = "useldapdnorder";
protected static final String USEMICROSOFTTEMPLATE = "usemicrosofttemplate";
protected static final String MICROSOFTTEMPLATE = "microsofttemplate";
protected static final String USECARDNUMBER = "usecardnumber";
protected static final String USEQCSTATEMENT = "useqcstatement";
protected static final String USEPKIXQCSYNTAXV2 = "usepkixqcsyntaxv2";
protected static final String QCSTATEMENTCRITICAL = "useqcstatementcritical";
protected static final String QCSTATEMENTRANAME = "useqcstatementraname";
protected static final String QCSSEMANTICSID = "useqcsematicsid";
protected static final String USEQCETSIQCCOMPLIANCE = "useqcetsiqccompliance";
protected static final String USEQCETSIVALUELIMIT = "useqcetsivaluelimit";
protected static final String QCETSIVALUELIMIT = "qcetsivaluelimit";
protected static final String QCETSIVALUELIMITEXP = "qcetsivaluelimitexp";
protected static final String QCETSIVALUELIMITCURRENCY = "qcetsivaluelimitcurrency";
protected static final String USEQCETSIRETENTIONPERIOD = "useqcetsiretentionperiod";
protected static final String QCETSIRETENTIONPERIOD = "qcetsiretentionperiod";
protected static final String USEQCETSISIGNATUREDEVICE = "useqcetsisignaturedevice";
protected static final String USEQCETSITYPE = "useqcetsitype";
protected static final String QCETSITYPE = "qcetsitype";
protected static final String QCETSIPDS = "qcetsipds";
/** @deprecated since EJBCA 6.6.1. It was only used in 6.6.0, and is needed to handle upgrades from that version
* PDS URLs are now handled in QCETSIPDS */
@Deprecated
protected static final String QCETSIPDSURL = "qcetsipdsurl";
/** @deprecated since EJBCA 6.6.1. It was only used in 6.6.0, and is needed to handle upgrades from that version
* PDS URLs are now handled in QCETSIPDS */
@Deprecated
protected static final String QCETSIPDSLANG = "qcetsipdslang";
protected static final String USEQCPSD2 = "useqcpsd2";
protected static final String USEQCCUSTOMSTRING = "useqccustomstring";
protected static final String QCCUSTOMSTRINGOID = "qccustomstringoid";
protected static final String QCCUSTOMSTRINGTEXT = "qccustomstringtext";
protected static final String USENAMECONSTRAINTS = "usenameconstraints";
protected static final String NAMECONSTRAINTSCRITICAL = "nameconstraintscritical";
protected static final String USESUBJECTDIRATTRIBUTES = "usesubjectdirattributes";
protected static final String CVCTERMINALTYPE = "cvctermtype";
protected static final String CVCACCESSRIGHTS = "cvcaccessrights";
protected static final String CVCLONGACCESSRIGHTS = "cvclongaccessrights";
protected static final String CVCSIGNTERMDVTYPE = "cvcsigntermdvtype";
protected static final String USEPRIVKEYUSAGEPERIOD = "useprivkeyusageperiod";
protected static final String USEPRIVKEYUSAGEPERIODNOTBEFORE = "useprivkeyusageperiodnotbefore";
protected static final String USEPRIVKEYUSAGEPERIODNOTAFTER = "useprivkeyusageperiodnotafter";
protected static final String PRIVKEYUSAGEPERIODSTARTOFFSET = "privkeyusageperiodstartoffset";
protected static final String PRIVKEYUSAGEPERIODLENGTH = "privkeyusageperiodlength";
protected static final String USECERTIFICATETRANSPARENCYINCERTS = "usecertificatetransparencyincerts";
protected static final String USECERTIFICATETRANSPARENCYINOCSP = "usecertificatetransparencyinocsp";
protected static final String USECERTIFICATETRANSPARENCYINPUBLISHERS = "usecertificatetransparencyinpublisher";
/* Certificate Transparency */
protected static final String CTSUBMITEXISTING = "ctsubmitexisting";
protected static final String CTLOGS = "ctlogs";
protected static final String CTLABELS = "ctlabels";
@Deprecated
protected static final String CT_MIN_TOTAL_SCTS = "ctminscts"; // This key is the same as in previous versions
@Deprecated
protected static final String CT_MIN_TOTAL_SCTS_OCSP = "ctminsctsocsp"; // This key is also the same as in previous versions
@Deprecated
protected static final String CT_MAX_SCTS = "ctmaxscts"; // Only used to fetch old value after upgrade, replaced by CT_MAX_NON_MANDATORY_SCTS and CT_MAX_MANDATORY_SCTS
@Deprecated
protected static final String CT_MAX_SCTS_OCSP = "ctmaxsctsocsp"; // Only used to fetch old value after upgrade, replaced by CT_MAX_NONMANDATORY_SCTS_OCSP and CT_MAX_MANDATORY_SCTS
/* All deprecated below were removed in 6.10.1. Keep for upgrade purposes or move keys to UpgradeSessionBean */
@Deprecated
protected static final String CT_MIN_MANDATORY_SCTS = "ctminmandatoryscts";
@Deprecated
protected static final String CT_MAX_MANDATORY_SCTS = "ctmaxmandatoryscts";
@Deprecated
protected static final String CT_MIN_MANDATORY_SCTS_OCSP = "ctminmandatorysctsocsp";
@Deprecated
protected static final String CT_MAX_MANDATORY_SCTS_OCSP = "ctmaxmandatorysctsocsp";
@Deprecated
protected static final String CT_MIN_NONMANDATORY_SCTS = "ctminnonmandatoryscts";
@Deprecated
protected static final String CT_MAX_NONMANDATORY_SCTS = "ctmaxnonmandatoryscts";
@Deprecated
protected static final String CT_MIN_NONMANDATORY_SCTS_OCSP = "ctminnonmandatorysctsocsp";
@Deprecated
protected static final String CT_MAX_NONMANDATORY_SCTS_OCSP = "ctmaxnonmandatorysctsocsp";
protected static final String CT_SCTS_MIN = "ctsctsmin";
protected static final String CT_SCTS_MAX = "ctsctsmax";
protected static final String CT_SCTS_MIN_OCSP = "ctsctsminocsp";
protected static final String CT_SCTS_MAX_OCSP = "ctsctsmaxocsp";
protected static final String CT_NUMBER_OF_SCTS_BY_VALIDITY = "ctnumberofsctsbyvalidity";
protected static final String CT_NUMBER_OF_SCTS_BY_CUSTOM = "ctnumberofsctsbycustom";
protected static final String CT_MAX_NUMBER_OF_SCTS_BY_VALIDITY = "ctmaxnumberofsctsbyvalidity";
protected static final String CT_MAX_NUMBER_OF_SCTS_BY_CUSTOM = "ctmaxnumberofsctsbycustom";
protected static final String CTMAXRETRIES = "ctmaxretries";
protected static final String USERSINGLEACTIVECERTIFICATECONSTRAINT = "usesingleactivecertificateconstraint";
protected static final String USECUSTOMDNORDER = "usecustomdnorder";
protected static final String USECUSTOMDNORDERLDAP = "usecustomdnorderldap";
protected static final String CUSTOMDNORDER = "customdnorder";
protected static final String OVERRIDABLEEXTENSIONOIDS = "overridableextensionoids";
protected static final String NONOVERRIDABLEEXTENSIONOIDS = "nonoverridableextensionoids";
/**
* OID for creating Smartcard Number Certificate Extension SEIS Cardnumber Extension according to SS 614330/31
*/
public static final String OID_CARDNUMBER = "1.2.752.34.2.1";
/** Constants holding the use properties for certificate extensions */
protected static final HashMap useStandardCertificateExtensions = new HashMap<>();
{
useStandardCertificateExtensions.put(USEBASICCONSTRAINTS, Extension.basicConstraints.getId());
useStandardCertificateExtensions.put(USEKEYUSAGE, Extension.keyUsage.getId());
useStandardCertificateExtensions.put(USESUBJECTKEYIDENTIFIER, Extension.subjectKeyIdentifier.getId());
useStandardCertificateExtensions.put(USEAUTHORITYKEYIDENTIFIER, Extension.authorityKeyIdentifier.getId());
useStandardCertificateExtensions.put(USESUBJECTALTERNATIVENAME, Extension.subjectAlternativeName.getId());
useStandardCertificateExtensions.put(USEISSUERALTERNATIVENAME, Extension.issuerAlternativeName.getId());
useStandardCertificateExtensions.put(USECRLDISTRIBUTIONPOINT, Extension.cRLDistributionPoints.getId());
useStandardCertificateExtensions.put(USEFRESHESTCRL, Extension.freshestCRL.getId());
useStandardCertificateExtensions.put(USECERTIFICATEPOLICIES, Extension.certificatePolicies.getId());
useStandardCertificateExtensions.put(USEEXTENDEDKEYUSAGE, Extension.extendedKeyUsage.getId());
useStandardCertificateExtensions.put(USEDOCUMENTTYPELIST, "2.23.136.1.1.6.2");
useStandardCertificateExtensions.put(USEQCSTATEMENT, Extension.qCStatements.getId());
useStandardCertificateExtensions.put(USENAMECONSTRAINTS, Extension.nameConstraints.getId());
useStandardCertificateExtensions.put(USESUBJECTDIRATTRIBUTES, Extension.subjectDirectoryAttributes.getId());
useStandardCertificateExtensions.put(USEAUTHORITYINFORMATIONACCESS, Extension.authorityInfoAccess.getId());
useStandardCertificateExtensions.put(USEPRIVKEYUSAGEPERIOD, Extension.privateKeyUsagePeriod.getId());
useStandardCertificateExtensions.put(USEOCSPNOCHECK, OCSPObjectIdentifiers.id_pkix_ocsp_nocheck.getId());
useStandardCertificateExtensions.put(USEMICROSOFTTEMPLATE, CertTools.OID_MSTEMPLATE);
useStandardCertificateExtensions.put(USECARDNUMBER, OID_CARDNUMBER);
}
// Old values used to upgrade from v22 to v23
protected static final String CERTIFICATEPOLICYID = "certificatepolicyid";
/** Policy Notice Url to CPS field alias in the data structure */
protected static final String POLICY_NOTICE_CPS_URL = "policynoticecpsurl";
/** Policy Notice User Notice field alias in the data structure */
protected static final String POLICY_NOTICE_UNOTICE_TEXT = "policynoticeunoticetext";
// Public Methods
/**
* Creates a new instance of CertificateProfile. The default contructor creates a basic CertificateProfile
* that is the same as an End User certificateProfile, except that there are _no_ key usages. this means that a certificate
* issued with a default profile should not be usable for anything. Should be used for testing and where you want to create your own
* CertificateProfile for specific purposes.
*
*/
public CertificateProfile() {
setCommonDefaults();
}
/**
* Creates a new instance of CertificateProfile
*
* These settings are general for all sub-profiles, only differing values are overridden in the sub-profiles. If changing any present value here
* you must therefore go through all sub-profiles and add an override there. I.e. only add new values here, don't change any present settings.
*
* @param type
* one of CertificateProfileConstants.CERTPROFILE_FIXED_XX, for example CertificateConstants.CERTPROFILE_NO_PROFILE, CERTPROFILE_NO_ENDUSER, etc
*/
public CertificateProfile(int type) {
setCommonDefaults();
setDefaultValues(type);
}
private void setCommonDefaults() {
setType(CertificateConstants.CERTTYPE_ENDENTITY);
setCertificateVersion(VERSION_X509V3);
setEncodedValidity(DEFAULT_CERTIFICATE_VALIDITY);
setUseCertificateValidityOffset(false);
setCertificateValidityOffset(DEFAULT_CERTIFICATE_VALIDITY_OFFSET);
setUseExpirationRestrictionForWeekdays(false);
setExpirationRestrictionForWeekdaysExpireBefore(true);
setDefaultExpirationRestrictionWeekdays();
setAllowValidityOverride(false);
setAllowExtensionOverride(false);
setAllowDNOverride(false);
setAllowDNOverrideByEndEntityInformation(false);
setAllowBackdatedRevocation(false);
setUseCertificateStorage(true);
setStoreCertificateData(true);
setStoreSubjectAlternativeName(true); // New profiles created after EJBCA 6.6.0 will store SAN by default
setUseBasicConstraints(true);
setBasicConstraintsCritical(true);
setUseSubjectKeyIdentifier(true);
setSubjectKeyIdentifierCritical(false);
setUseAuthorityKeyIdentifier(true);
setAuthorityKeyIdentifierCritical(false);
setUseSubjectAlternativeName(true);
setSubjectAlternativeNameCritical(false);
setUseIssuerAlternativeName(true);
setIssuerAlternativeNameCritical(false);
setUseCRLDistributionPoint(false);
setUseDefaultCRLDistributionPoint(false);
setCRLDistributionPointCritical(false);
setCRLDistributionPointURI("");
setUseFreshestCRL(false);
setUseCADefinedFreshestCRL(false);
setFreshestCRLURI("");
setCRLIssuer(null);
setUseCertificatePolicies(false);
setCertificatePoliciesCritical(false);
ArrayList policies = new ArrayList<>();
setCertificatePolicies(policies);
setAvailableKeyAlgorithmsAsList(AlgorithmTools.getAvailableKeyAlgorithms());
setAvailableEcCurvesAsList(Arrays.asList(ANY_EC_CURVE));
setAvailableBitLengths(DEFAULTBITLENGTHS);
setSignatureAlgorithm(null);
setUseKeyUsage(true);
setKeyUsage(new boolean[9]);
setAllowKeyUsageOverride(false);
setKeyUsageCritical(true);
setUseExtendedKeyUsage(false);
setExtendedKeyUsage(new ArrayList());
setExtendedKeyUsageCritical(false);
setUseDocumentTypeList(false);
setDocumentTypeListCritical(false);
setDocumentTypeList(new ArrayList());
ArrayList availablecas = new ArrayList<>();
availablecas.add(Integer.valueOf(ANYCA));
setAvailableCAs(availablecas);
setPublisherList(new ArrayList());
setUseOcspNoCheck(false);
setUseLdapDnOrder(true);
setUseCustomDnOrder(false);
setUseMicrosoftTemplate(false);
setMicrosoftTemplate("");
setUseCardNumber(false);
setUseCNPostfix(false);
setCNPostfix("");
setUseSubjectDNSubSet(false);
setSubjectDNSubSet(new ArrayList());
setUseSubjectAltNameSubSet(false);
setSubjectAltNameSubSet(new ArrayList());
setUsePathLengthConstraint(false);
setPathLengthConstraint(0);
setUseQCStatement(false);
setUsePkixQCSyntaxV2(false);
setQCStatementCritical(false);
setQCStatementRAName(null);
setQCSemanticsId(null);
setUseQCEtsiQCCompliance(false);
setUseQCEtsiSignatureDevice(false);
setUseQCEtsiValueLimit(false);
setQCEtsiValueLimit(0);
setQCEtsiValueLimitExp(0);
setQCEtsiValueLimitCurrency(null);
setUseQCEtsiRetentionPeriod(false);
setQCEtsiRetentionPeriod(0);
setUseQCCustomString(false);
setQCCustomStringOid(null);
setQCCustomStringText(null);
setQCEtsiPds(null);
setQCEtsiType(null);
setUseCertificateTransparencyInCerts(false);
setUseCertificateTransparencyInOCSP(false);
setUseCertificateTransparencyInPublishers(false);
setUseSubjectDirAttributes(false);
setUseNameConstraints(false);
setUseAuthorityInformationAccess(false);
setCaIssuers(new ArrayList());
setUseDefaultCAIssuer(false);
setUseDefaultOCSPServiceLocator(false);
setOCSPServiceLocatorURI("");
// Default to have access to fingerprint and iris
setCVCAccessRights(CertificateProfile.CVC_ACCESS_DG3DG4);
setUsedCertificateExtensions(new ArrayList());
setApprovals(new LinkedHashMap());
// PrivateKeyUsagePeriod extension
setUsePrivateKeyUsagePeriodNotBefore(false);
setUsePrivateKeyUsagePeriodNotAfter(false);
setPrivateKeyUsagePeriodStartOffset(DEFAULT_PRIVATE_KEY_USAGE_PERIOD_OFFSET);
setPrivateKeyUsagePeriodLength(DEFAULT_PRIVATE_KEY_USAGE_PERIOD_LENGTH);
setSingleActiveCertificateConstraint(false);
setOverridableExtensionOIDs(new LinkedHashSet());
setNonOverridableExtensionOIDs(new LinkedHashSet());
}
/**
* @param type
* one of CertificateProfileConstants.CERTPROFILE_FIXED_XX, for example CertificateConstants.CERTPROFILE_FIXED_ROOTCA
*/
private void setDefaultValues(int type) {
if (type == CertificateProfileConstants.CERTPROFILE_FIXED_ROOTCA) {
setType(CertificateConstants.CERTTYPE_ROOTCA);
setAllowValidityOverride(true);
setUseKeyUsage(true);
setKeyUsage(new boolean[9]);
setKeyUsage(CertificateConstants.DIGITALSIGNATURE, true);
setKeyUsage(CertificateConstants.KEYCERTSIGN, true);
setKeyUsage(CertificateConstants.CRLSIGN, true);
setKeyUsageCritical(true);
setEncodedValidity(DEFAULT_CERTIFICATE_VALIDITY_FOR_FIXED_CA);
} else if (type == CertificateProfileConstants.CERTPROFILE_FIXED_SUBCA) {
setType(CertificateConstants.CERTTYPE_SUBCA);
setAllowValidityOverride(true);
setUseKeyUsage(true);
setKeyUsage(new boolean[9]);
setKeyUsage(CertificateConstants.DIGITALSIGNATURE, true);
setKeyUsage(CertificateConstants.KEYCERTSIGN, true);
setKeyUsage(CertificateConstants.CRLSIGN, true);
setKeyUsageCritical(true);
setEncodedValidity(DEFAULT_CERTIFICATE_VALIDITY_FOR_FIXED_CA);
} else if (type == CertificateProfileConstants.CERTPROFILE_FIXED_ENDUSER) {
setType(CertificateConstants.CERTTYPE_ENDENTITY);
// Standard key usages for end users are: digitalSignature | nonRepudiation, and/or (keyEncipherment or keyAgreement)
// Default key usage is digitalSignature | nonRepudiation | keyEncipherment
// Create an array for KeyUsage according to X509Certificate.getKeyUsage()
setUseKeyUsage(true);
setKeyUsage(new boolean[9]);
setKeyUsage(CertificateConstants.DIGITALSIGNATURE, true);
setKeyUsage(CertificateConstants.NONREPUDIATION, true);
setKeyUsage(CertificateConstants.KEYENCIPHERMENT, true);
setKeyUsageCritical(true);
setUseExtendedKeyUsage(true);
ArrayList eku = new ArrayList<>();
eku.add(KeyPurposeId.id_kp_clientAuth.getId());
eku.add(KeyPurposeId.id_kp_emailProtection.getId());
setExtendedKeyUsage(eku);
setExtendedKeyUsageCritical(false);
} else if (type == CertificateProfileConstants.CERTPROFILE_FIXED_OCSPSIGNER) {
setType(CertificateConstants.CERTTYPE_ENDENTITY);
// Default key usage for an OCSP signer is digitalSignature
// Create an array for KeyUsage acoording to X509Certificate.getKeyUsage()
setUseKeyUsage(true);
setKeyUsage(new boolean[9]);
setKeyUsage(CertificateConstants.DIGITALSIGNATURE, true);
setKeyUsageCritical(true);
setUseExtendedKeyUsage(true);
ArrayList eku = new ArrayList<>();
eku.add(KeyPurposeId.id_kp_OCSPSigning.getId());
setExtendedKeyUsage(eku);
setExtendedKeyUsageCritical(false);
setUseOcspNoCheck(true);
} else if (type == CertificateProfileConstants.CERTPROFILE_FIXED_SERVER) {
setType(CertificateConstants.CERTTYPE_ENDENTITY);
// Standard key usages for server are: digitalSignature | (keyEncipherment or keyAgreement)
// Default key usage is digitalSignature | keyEncipherment
// Create an array for KeyUsage acoording to X509Certificate.getKeyUsage()
setUseKeyUsage(true);
setKeyUsage(new boolean[9]);
setKeyUsage(CertificateConstants.DIGITALSIGNATURE, true);
setKeyUsage(CertificateConstants.KEYENCIPHERMENT, true);
setKeyUsageCritical(true);
setUseExtendedKeyUsage(true);
ArrayList eku = new ArrayList<>();
eku.add(KeyPurposeId.id_kp_serverAuth.getId());
setExtendedKeyUsage(eku);
setExtendedKeyUsageCritical(false);
} else if (type == CertificateProfileConstants.CERTPROFILE_FIXED_HARDTOKENAUTH) {
setType(CertificateConstants.CERTTYPE_ENDENTITY);
setUseKeyUsage(true);
setKeyUsage(new boolean[9]);
setKeyUsage(CertificateConstants.DIGITALSIGNATURE, true);
setKeyUsageCritical(true);
setUseExtendedKeyUsage(true);
ArrayList eku = new ArrayList<>();
eku.add(KeyPurposeId.id_kp_clientAuth.getId());
eku.add(KeyPurposeId.id_kp_smartcardlogon.getId());
setExtendedKeyUsage(eku);
setExtendedKeyUsageCritical(false);
} else if (type == CertificateProfileConstants.CERTPROFILE_FIXED_HARDTOKENAUTHENC) {
setType(CertificateConstants.CERTTYPE_ENDENTITY);
setUseKeyUsage(true);
setKeyUsage(new boolean[9]);
setKeyUsage(CertificateConstants.KEYENCIPHERMENT, true);
setKeyUsage(CertificateConstants.DIGITALSIGNATURE, true);
setKeyUsageCritical(true);
setUseExtendedKeyUsage(true);
ArrayList eku = new ArrayList<>();
eku.add(KeyPurposeId.id_kp_clientAuth.getId());
eku.add(KeyPurposeId.id_kp_emailProtection.getId());
eku.add(KeyPurposeId.id_kp_smartcardlogon.getId());
setExtendedKeyUsage(eku);
setExtendedKeyUsageCritical(false);
} else if (type == CertificateProfileConstants.CERTPROFILE_FIXED_HARDTOKENENC) {
setType(CertificateConstants.CERTTYPE_ENDENTITY);
setUseKeyUsage(true);
setKeyUsage(new boolean[9]);
setKeyUsage(CertificateConstants.KEYENCIPHERMENT, true);
setKeyUsageCritical(true);
setUseExtendedKeyUsage(true);
ArrayList eku = new ArrayList<>();
eku.add(KeyPurposeId.id_kp_emailProtection.getId());
setExtendedKeyUsage(eku);
setExtendedKeyUsageCritical(false);
} else if (type == CertificateProfileConstants.CERTPROFILE_FIXED_HARDTOKENSIGN) {
setType(CertificateConstants.CERTTYPE_ENDENTITY);
setUseKeyUsage(true);
setKeyUsage(new boolean[9]);
setKeyUsage(CertificateConstants.NONREPUDIATION, true);
setKeyUsageCritical(true);
setUseExtendedKeyUsage(true);
ArrayList eku = new ArrayList<>();
eku.add(KeyPurposeId.id_kp_emailProtection.getId());
setExtendedKeyUsage(eku);
setExtendedKeyUsageCritical(false);
}
}
// Public Methods.
/** Returns the version of the certificate, should be one of the VERSION_ constants defined in CertificateProfile class. */
public String getCertificateVersion() {
return (String) data.get(CERTVERSION);
}
/**
* Returns the version of the certificate, should be one of the VERSION_ constants defined in CertificateProfile class.
*/
public void setCertificateVersion(String version) {
data.put(CERTVERSION, version);
}
/**
* @see ValidityDate#getDateBeforeVersion661(long, java.util.Date)
* @return a long that is used to provide the end date of certificates for this profile, interpreted by ValidityDate#getDate
* @deprecated since since EJBCA 6.6.1
*/
@Deprecated
public long getValidity() {
return ((Long) data.get(VALIDITY)).longValue();
}
/**
* Gets the encoded validity.
* @return the validity as ISO8601 date or relative time.
* @See {@link org.cesecore.util.ValidityDate ValidityDate}
* @See {@link org.cesecore.util.SimpleTime SimpleTime}
*/
@SuppressWarnings("deprecation")
public String getEncodedValidity() {
String result = (String) data.get(ENCODED_VALIDITY);
if (StringUtils.isBlank(result)) {
result = ValidityDate.getStringBeforeVersion661(getValidity());
setEncodedValidity(result);
}
return result;
}
/**
* Sets the encoded validity .
* @param encodedValidity the validity as ISO8601 date or relative time.
* @See {@link org.cesecore.util.ValidityDate ValidityDate}
* @See {@link org.cesecore.util.SimpleTime SimpleTime}
*/
public void setEncodedValidity(String encodedValidity) {
data.put(ENCODED_VALIDITY, encodedValidity);
}
/**
* Gets the certificate validity offset.
* @return true if we should overwrite the default certificate validity offset with the one specified in the certificate profile.
* @see {@link #setCertificateValidityOffset(String)}
*/
public boolean getUseCertificateValidityOffset() {
// Extra null check to handle in-development upgrades
if (data.get(USE_CERTIFICATE_VALIDITY_OFFSET) != null) {
return Boolean.valueOf((Boolean) data.get(USE_CERTIFICATE_VALIDITY_OFFSET));
} else {
return false;
}
}
/**
* Use certificate validity offset.
* @param enabled
*/
public void setUseCertificateValidityOffset(boolean enabled) {
data.put(USE_CERTIFICATE_VALIDITY_OFFSET, Boolean.valueOf(enabled));
}
/**
* Gets the certificate validity offset.
* @return the offset as simple time string with seconds precision (i.e. '-10m')
* @see #link{org.cesecore.util.SimpleTime}
*/
public String getCertificateValidityOffset() {
return (String) data.get(CERTIFICATE_VALIDITY_OFFSET);
}
/**
* Sets the certificate not before offset.
* @param simpleTime the offset as simple time string with seconds precision.
* @see org.cesecore.util.SimpleTime
*/
public void setCertificateValidityOffset(String simpleTime) {
data.put(CERTIFICATE_VALIDITY_OFFSET, simpleTime);
}
/**
* @return true if we should apply restrictions that certificate expiration can only occur on week days specified by setExpirationRestrictionWeekday
* @see #setExpirationRestrictionWeekdays(boolean[])
*/
public boolean getUseExpirationRestrictionForWeekdays() {
return Boolean.valueOf((Boolean) data.get(USE_EXPIRATION_RESTRICTION_FOR_WEEKDAYS));
}
/**
* Use validity expiration restriction.
* @param enabled
*/
public void setUseExpirationRestrictionForWeekdays(boolean enabled) {
data.put(USE_EXPIRATION_RESTRICTION_FOR_WEEKDAYS, Boolean.valueOf(enabled));
}
/**
* @return true if we should roll back expiration or false of we should roll forward expiration to match week days specified by setExpirationRestrictionWeekday
* @see #setExpirationRestrictionWeekdays(boolean[])
*/
public boolean getExpirationRestrictionForWeekdaysExpireBefore() {
return Boolean.valueOf((Boolean) data.get(EXPIRATION_RESTRICTION_FOR_WEEKDAYS_BEFORE));
}
/**
* Sets if the certificate validity shall expire earlier as requested if a the expiration
* restriction was applied?
*
* @param enabled true, otherwise false.
*/
public void setExpirationRestrictionForWeekdaysExpireBefore(boolean enabled) {
data.put(EXPIRATION_RESTRICTION_FOR_WEEKDAYS_BEFORE, Boolean.valueOf(enabled));
}
/**
* @param weekday (see java.util.Calendar.MONDAY - SUNDAY)
* @return true if the weekday is selected as validity expiration restriction.
*/
@SuppressWarnings("unchecked")
public boolean getExpirationRestrictionWeekday(int weekday) {
return ((ArrayList) data.get(EXPIRATION_RESTRICTION_WEEKDAYS)).get(weekday-1).booleanValue();
}
/**
* Include a weekday as validity expiration restriction.
* @param weekday (see java.util.Calendar.MONDAY - SUNDAY)
* @param enabled
*/
@SuppressWarnings("unchecked")
public void setExpirationRestrictionWeekday(int weekday, boolean enabled) {
((ArrayList) data.get(EXPIRATION_RESTRICTION_WEEKDAYS)).set(weekday-1, Boolean.valueOf(enabled));
}
/**
* Gets a copy of the List where validity restriction for weekdays are stored.
*
* @return boolean array.
*/
@SuppressWarnings("unchecked")
public boolean[] getExpirationRestrictionWeekdays() {
final ArrayList list = (ArrayList) data.get(EXPIRATION_RESTRICTION_WEEKDAYS);
final boolean[] result = new boolean[list.size()];
for (int i = 0; i < list.size(); i++) {
result[i] = list.get(i).booleanValue();
}
return result;
}
private void setExpirationRestrictionWeekdays(boolean[] weekdays) {
final ArrayList list = new ArrayList(weekdays.length);
for (int i = 0; i < weekdays.length; i++) {
list.add(Boolean.valueOf(weekdays[i]));
}
data.put(EXPIRATION_RESTRICTION_WEEKDAYS, list);
}
private void setDefaultExpirationRestrictionWeekdays() {
setExpirationRestrictionWeekdays(new boolean[7]);
setExpirationRestrictionWeekday(Calendar.MONDAY, true);
setExpirationRestrictionWeekday(Calendar.FRIDAY, true);
setExpirationRestrictionWeekday(Calendar.SATURDAY, true);
setExpirationRestrictionWeekday(Calendar.SUNDAY, true);
}
/**
* If validity override is allowed, a certificate can have a shorter validity than the one specified in the certificate profile, but never longer.
* A certificate created with validity override can hava a starting point in the future.
*
* @return true if validity override is allowed
*/
public boolean getAllowValidityOverride() {
return ((Boolean) data.get(ALLOWVALIDITYOVERRIDE)).booleanValue();
}
/**
* If validity override is allowed, a certificate can have a shorter validity than the one specified in the certificate profile, but never longer.
* A certificate created with validity override can hava a starting point in the future.
*/
public void setAllowValidityOverride(boolean allowvalidityoverride) {
data.put(ALLOWVALIDITYOVERRIDE, Boolean.valueOf(allowvalidityoverride));
}
/**
* If extension override is allowed, the X509 certificate extension created in a certificate can come from the request sent by the user. If the
* request contains an extension than will be used instead of the one defined in the profile. If the request does not contain an extension, the
* one defined in the profile will be used.
*/
public boolean getAllowExtensionOverride() {
Object d = data.get(ALLOWEXTENSIONOVERRIDE);
if (d == null) {
return false;
}
return ((Boolean) d).booleanValue();
}
/** @see #getAllowExtensionOverride() */
public void setAllowExtensionOverride(boolean allowextensionoverride) {
data.put(ALLOWEXTENSIONOVERRIDE, Boolean.valueOf(allowextensionoverride));
}
/**
* If DN override is allowed, the X509 subject DN extension created in a certificate can
* come directly from the CSR in the request sent by the user. This is instead of the normal way where the user's
* registered DN is used.
*/
public boolean getAllowDNOverride() {
Object d = data.get(ALLOWDNOVERRIDE);
if (d == null) {
return false;
}
return ((Boolean) d).booleanValue();
}
/** @see #getAllowDNOverride() */
public void setAllowDNOverride(boolean allowdnoverride) {
data.put(ALLOWDNOVERRIDE, Boolean.valueOf(allowdnoverride));
}
/**
* If DN override by End Entity Information is allowed, the X509 subject DN extension created in a certificate can
* come directly from the request meta information sent by the user. This is instead of the normal way where the
* user's registered DN is used.
*/
public boolean getAllowDNOverrideByEndEntityInformation() {
Object d = data.get(ALLOWDNOVERRIDEBYEEI);
if (d == null) {
return false;
}
return ((Boolean) d).booleanValue();
}
/** @see #getAllowDNOverrideByEndEntityInformation() */
public void setAllowDNOverrideByEndEntityInformation(final boolean value) {
data.put(ALLOWDNOVERRIDEBYEEI, Boolean.valueOf(value));
}
/**
* If override is allowed the serial number could be specified.
*
* @return true if allowed
*/
public boolean getAllowCertSerialNumberOverride() {
Object d = data.get(ALLOWCERTSNOVERIDE);
if (d == null) {
return false;
}
return ((Boolean) d).booleanValue();
}
/**
* @see #getAllowDNOverride()
* @param allowdnoverride
* new value
*/
public void setAllowCertSerialNumberOverride(boolean allowdnoverride) {
data.put(ALLOWCERTSNOVERIDE, Boolean.valueOf(allowdnoverride));
}
public boolean getUseBasicConstraints() {
return ((Boolean) data.get(USEBASICCONSTRAINTS)).booleanValue();
}
public void setUseBasicConstraints(boolean usebasicconstraints) {
data.put(USEBASICCONSTRAINTS, Boolean.valueOf(usebasicconstraints));
}
public boolean getBasicConstraintsCritical() {
return ((Boolean) data.get(BASICCONSTRAINTSCRITICAL)).booleanValue();
}
public void setBasicConstraintsCritical(boolean basicconstraintscritical) {
data.put(BASICCONSTRAINTSCRITICAL, Boolean.valueOf(basicconstraintscritical));
}
public boolean getUseKeyUsage() {
return ((Boolean) data.get(USEKEYUSAGE)).booleanValue();
}
public void setUseKeyUsage(boolean usekeyusage) {
data.put(USEKEYUSAGE, Boolean.valueOf(usekeyusage));
}
public boolean getKeyUsageCritical() {
return ((Boolean) data.get(KEYUSAGECRITICAL)).booleanValue();
}
public void setKeyUsageCritical(boolean keyusagecritical) {
data.put(KEYUSAGECRITICAL, Boolean.valueOf(keyusagecritical));
}
public boolean getUseSubjectKeyIdentifier() {
return ((Boolean) data.get(USESUBJECTKEYIDENTIFIER)).booleanValue();
}
public void setUseSubjectKeyIdentifier(boolean usesubjectkeyidentifier) {
data.put(USESUBJECTKEYIDENTIFIER, Boolean.valueOf(usesubjectkeyidentifier));
}
public boolean getSubjectKeyIdentifierCritical() {
return ((Boolean) data.get(SUBJECTKEYIDENTIFIERCRITICAL)).booleanValue();
}
public void setSubjectKeyIdentifierCritical(boolean subjectkeyidentifiercritical) {
data.put(SUBJECTKEYIDENTIFIERCRITICAL, Boolean.valueOf(subjectkeyidentifiercritical));
}
public boolean getUseAuthorityKeyIdentifier() {
return ((Boolean) data.get(USEAUTHORITYKEYIDENTIFIER)).booleanValue();
}
public void setUseAuthorityKeyIdentifier(boolean useauthoritykeyidentifier) {
data.put(USEAUTHORITYKEYIDENTIFIER, Boolean.valueOf(useauthoritykeyidentifier));
}
public boolean getAuthorityKeyIdentifierCritical() {
return ((Boolean) data.get(AUTHORITYKEYIDENTIFIERCRITICAL)).booleanValue();
}
public void setAuthorityKeyIdentifierCritical(boolean authoritykeyidentifiercritical) {
data.put(AUTHORITYKEYIDENTIFIERCRITICAL, Boolean.valueOf(authoritykeyidentifiercritical));
}
public boolean getUseSubjectAlternativeName() {
return ((Boolean) data.get(USESUBJECTALTERNATIVENAME)).booleanValue();
}
public void setUseSubjectAlternativeName(boolean usesubjectalternativename) {
data.put(USESUBJECTALTERNATIVENAME, Boolean.valueOf(usesubjectalternativename));
}
public boolean getStoreCertificateData() {
// Lazy upgrade for profiles created prior to EJBCA 6.2.10
final Boolean value = (Boolean) data.get(STORECERTIFICATEDATA);
if (value == null) {
// Default for existing profiles is true
setStoreCertificateData(true);
return true;
} else {
return value.booleanValue();
}
}
public void setStoreCertificateData(boolean storeCertificateData) {
data.put(STORECERTIFICATEDATA, Boolean.valueOf(storeCertificateData));
}
/** @return true if the CertificateData.subjectAltName column should be populated. */
public boolean getStoreSubjectAlternativeName() {
// Lazy upgrade for profiles created prior to EJBCA 6.6.0
final Boolean value = (Boolean) data.get(STORESUBJECTALTNAME);
if (value == null) {
// Old profiles created before EJBCA 6.6.0 will not store SAN by default.
setStoreSubjectAlternativeName(false);
return false;
} else {
return value.booleanValue();
}
}
public void setStoreSubjectAlternativeName(final boolean storeSubjectAlternativeName) {
data.put(STORESUBJECTALTNAME, Boolean.valueOf(storeSubjectAlternativeName));
}
public boolean getSubjectAlternativeNameCritical() {
return ((Boolean) data.get(SUBJECTALTERNATIVENAMECRITICAL)).booleanValue();
}
public void setSubjectAlternativeNameCritical(boolean subjectalternativenamecritical) {
data.put(SUBJECTALTERNATIVENAMECRITICAL, Boolean.valueOf(subjectalternativenamecritical));
}
public boolean getUseIssuerAlternativeName() {
return ((Boolean) data.get(USEISSUERALTERNATIVENAME)).booleanValue();
}
public void setUseIssuerAlternativeName(boolean useissueralternativename) {
data.put(USEISSUERALTERNATIVENAME, Boolean.valueOf(useissueralternativename));
}
public boolean getIssuerAlternativeNameCritical() {
return ((Boolean) data.get(ISSUERALTERNATIVENAMECRITICAL)).booleanValue();
}
public void setIssuerAlternativeNameCritical(boolean issueralternativenamecritical) {
data.put(ISSUERALTERNATIVENAMECRITICAL, Boolean.valueOf(issueralternativenamecritical));
}
public boolean getUseCRLDistributionPoint() {
return ((Boolean) data.get(USECRLDISTRIBUTIONPOINT)).booleanValue();
}
public void setUseCRLDistributionPoint(boolean usecrldistributionpoint) {
data.put(USECRLDISTRIBUTIONPOINT, Boolean.valueOf(usecrldistributionpoint));
}
public boolean getUseDefaultCRLDistributionPoint() {
return ((Boolean) data.get(USEDEFAULTCRLDISTRIBUTIONPOINT)).booleanValue();
}
public void setUseDefaultCRLDistributionPoint(boolean usedefaultcrldistributionpoint) {
data.put(USEDEFAULTCRLDISTRIBUTIONPOINT, Boolean.valueOf(usedefaultcrldistributionpoint));
}
public boolean getCRLDistributionPointCritical() {
return ((Boolean) data.get(CRLDISTRIBUTIONPOINTCRITICAL)).booleanValue();
}
public void setCRLDistributionPointCritical(boolean crldistributionpointcritical) {
data.put(CRLDISTRIBUTIONPOINTCRITICAL, Boolean.valueOf(crldistributionpointcritical));
}
public String getCRLDistributionPointURI() {
return (String) data.get(CRLDISTRIBUTIONPOINTURI);
}
public void setCRLDistributionPointURI(String crldistributionpointuri) {
if (crldistributionpointuri == null) {
data.put(CRLDISTRIBUTIONPOINTURI, "");
} else {
data.put(CRLDISTRIBUTIONPOINTURI, crldistributionpointuri);
}
}
public String getCRLIssuer() {
return (String) data.get(CRLISSUER);
}
public void setCRLIssuer(String crlissuer) {
if (crlissuer == null) {
data.put(CRLISSUER, "");
} else {
data.put(CRLISSUER, crlissuer);
}
}
public boolean getUseFreshestCRL() {
Object obj = data.get(USEFRESHESTCRL);
if (obj == null) {
return false;
} else {
return ((Boolean) obj).booleanValue();
}
}
public void setUseFreshestCRL(boolean usefreshestcrl) {
data.put(USEFRESHESTCRL, Boolean.valueOf(usefreshestcrl));
}
public boolean getUseCADefinedFreshestCRL() {
Object obj = data.get(USECADEFINEDFRESHESTCRL);
if (obj == null) {
return false;
} else {
return ((Boolean) obj).booleanValue();
}
}
public void setUseCADefinedFreshestCRL(boolean usecadefinedfreshestcrl) {
data.put(USECADEFINEDFRESHESTCRL, Boolean.valueOf(usecadefinedfreshestcrl));
}
public String getFreshestCRLURI() {
return ((String) data.get(FRESHESTCRLURI));
}
public void setFreshestCRLURI(String freshestcrluri) {
if (freshestcrluri == null) {
data.put(FRESHESTCRLURI, "");
} else {
data.put(FRESHESTCRLURI, freshestcrluri);
}
}
public boolean getUseCertificatePolicies() {
return ((Boolean) data.get(USECERTIFICATEPOLICIES)).booleanValue();
}
public void setUseCertificatePolicies(boolean usecertificatepolicies) {
data.put(USECERTIFICATEPOLICIES, Boolean.valueOf(usecertificatepolicies));
}
public boolean getUseCertificateStorage() {
//Lazy upgrade for profiles created prior to EJBCA 6.2.10
Boolean value = (Boolean) data.get(USECERTIFICATESTORAGE);
if (value == null) {
//Default is true
setUseCertificateStorage(true);
return true;
} else {
return value.booleanValue();
}
}
public void setUseCertificateStorage(boolean useCertificateStorage) {
data.put(USECERTIFICATESTORAGE, Boolean.valueOf(useCertificateStorage));
}
public boolean getCertificatePoliciesCritical() {
return ((Boolean) data.get(CERTIFICATEPOLICIESCRITICAL)).booleanValue();
}
public void setCertificatePoliciesCritical(boolean certificatepoliciescritical) {
data.put(CERTIFICATEPOLICIESCRITICAL, Boolean.valueOf(certificatepoliciescritical));
}
public List getCertificatePolicies() {
@SuppressWarnings("unchecked")
List l = (List) data.get(CERTIFICATE_POLICIES);
if (l == null) {
l = new ArrayList();
} else {
// Check class name, because we changed this in EJBCA 5 and need to support older versions in the database for 100% upgrade
if (l.size() > 0) {
try {
// Don't remove the unused test object
CertificatePolicy test = l.get(0); // NOPMD: we need to actually get the text object, otherwise the cast will not be tried
test.getPolicyID();
} catch (ClassCastException e) {
if (log.isDebugEnabled()) {
log.debug("CertificatePolicy in profile is old class name (< EJBCA 5), post-upgrade has not been run. Converting in code to return new class type.");
}
@SuppressWarnings("unchecked")
List