oidVector = new Vector<>();
for (String oid : ekuOids) {
oidVector.add(ObjectIdentifier.of(oid));
}
addExtension(new ExtendedKeyUsageExtension(oidVector));
}
}
/**
* Clear all settings and return the {@code CertificateBuilder} to
* its default state.
*/
public void reset() {
extensions.clear();
subjectName = null;
notBefore = null;
notAfter = null;
serialNumber = null;
publicKey = null;
signatureBytes = null;
tbsCertBytes = null;
}
/**
* Build the certificate.
*
* @param issuerCert The certificate of the issuing authority, or
* {@code null} if the resulting certificate is self-signed.
* @param issuerKey The private key of the issuing authority
* @param algName The signature algorithm name
*
* @return The resulting {@link X509Certificate}
*
* @throws IOException if an encoding error occurs.
* @throws CertificateException If the certificate cannot be generated
* by the underlying {@link CertificateFactory}
* @throws NoSuchAlgorithmException If an invalid signature algorithm
* is provided.
*/
public X509Certificate build(X509Certificate issuerCert,
PrivateKey issuerKey, String algName)
throws IOException, CertificateException, NoSuchAlgorithmException {
// TODO: add some basic checks (key usage, basic constraints maybe)
byte[] encodedCert = encodeTopLevel(issuerCert, issuerKey, algName);
ByteArrayInputStream bais = new ByteArrayInputStream(encodedCert);
return (X509Certificate)factory.generateCertificate(bais);
}
/**
* Encode the contents of the outer-most ASN.1 SEQUENCE:
*
*
* Certificate ::= SEQUENCE {
* tbsCertificate TBSCertificate,
* signatureAlgorithm AlgorithmIdentifier,
* signatureValue BIT STRING }
*
*
* @param issuerCert The certificate of the issuing authority, or
* {@code null} if the resulting certificate is self-signed.
* @param issuerKey The private key of the issuing authority
* @param signAlg The signature algorithm object
*
* @return The DER-encoded X.509 certificate
*
* @throws CertificateException If an error occurs during the
* signing process.
* @throws IOException if an encoding error occurs.
*/
private byte[] encodeTopLevel(X509Certificate issuerCert,
PrivateKey issuerKey, String algName)
throws CertificateException, IOException, NoSuchAlgorithmException {
AlgorithmId signAlg = AlgorithmId.get(algName);
DerOutputStream outerSeq = new DerOutputStream();
DerOutputStream topLevelItems = new DerOutputStream();
try {
Signature sig = SignatureUtil.fromKey(signAlg.getName(), issuerKey, (Provider)null);
// Rewrite signAlg, RSASSA-PSS needs some parameters.
signAlg = SignatureUtil.fromSignature(sig, issuerKey);
tbsCertBytes = encodeTbsCert(issuerCert, signAlg);
sig.update(tbsCertBytes);
signatureBytes = sig.sign();
} catch (GeneralSecurityException ge) {
throw new CertificateException(ge);
}
topLevelItems.write(tbsCertBytes);
signAlg.encode(topLevelItems);
topLevelItems.putBitString(signatureBytes);
outerSeq.write(DerValue.tag_Sequence, topLevelItems);
return outerSeq.toByteArray();
}
/**
* Encode the bytes for the TBSCertificate structure:
*
* TBSCertificate ::= SEQUENCE {
* version [0] EXPLICIT Version DEFAULT v1,
* serialNumber CertificateSerialNumber,
* signature AlgorithmIdentifier,
* issuer Name,
* validity Validity,
* subject Name,
* subjectPublicKeyInfo SubjectPublicKeyInfo,
* issuerUniqueID [1] IMPLICIT UniqueIdentifier OPTIONAL,
* -- If present, version MUST be v2 or v3
* subjectUniqueID [2] IMPLICIT UniqueIdentifier OPTIONAL,
* -- If present, version MUST be v2 or v3
* extensions [3] EXPLICIT Extensions OPTIONAL
* -- If present, version MUST be v3
* }
*
* @param issuerCert The certificate of the issuing authority, or
* {@code null} if the resulting certificate is self-signed.
* @param signAlg The signature algorithm object
*
* @return The DER-encoded bytes for the TBSCertificate structure
*
* @throws IOException if an encoding error occurs.
*/
private byte[] encodeTbsCert(X509Certificate issuerCert,
AlgorithmId signAlg) throws IOException {
DerOutputStream tbsCertSeq = new DerOutputStream();
DerOutputStream tbsCertItems = new DerOutputStream();
// Hardcode to V3
byte[] v3int = {0x02, 0x01, 0x02};
tbsCertItems.write(DerValue.createTag(DerValue.TAG_CONTEXT, true,
(byte)0), v3int);
// Serial Number
SerialNumber sn = new SerialNumber(serialNumber);
sn.encode(tbsCertItems);
// Algorithm ID
signAlg.encode(tbsCertItems);
// Issuer Name
if (issuerCert != null) {
tbsCertItems.write(
issuerCert.getSubjectX500Principal().getEncoded());
} else {
// Self-signed
tbsCertItems.write(subjectName.getEncoded());
}
// Validity period (set as UTCTime)
DerOutputStream valSeq = new DerOutputStream();
valSeq.putUTCTime(notBefore);
valSeq.putUTCTime(notAfter);
tbsCertItems.write(DerValue.tag_Sequence, valSeq);
// Subject Name
tbsCertItems.write(subjectName.getEncoded());
// SubjectPublicKeyInfo
tbsCertItems.write(publicKey.getEncoded());
// TODO: Extensions!
encodeExtensions(tbsCertItems);
// Wrap it all up in a SEQUENCE and return the bytes
tbsCertSeq.write(DerValue.tag_Sequence, tbsCertItems);
return tbsCertSeq.toByteArray();
}
/**
* Encode the extensions segment for an X.509 Certificate:
*
*
* Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension
*
* Extension ::= SEQUENCE {
* extnID OBJECT IDENTIFIER,
* critical BOOLEAN DEFAULT FALSE,
* extnValue OCTET STRING
* -- contains the DER encoding of an ASN.1 value
* -- corresponding to the extension type identified
* -- by extnID
* }
*
*
* @param tbsStream The {@code DerOutputStream} that holds the
* TBSCertificate contents.
*
* @throws IOException if an encoding error occurs.
*/
private void encodeExtensions(DerOutputStream tbsStream)
throws IOException {
DerOutputStream extSequence = new DerOutputStream();
DerOutputStream extItems = new DerOutputStream();
for (Extension ext : extensions.values()) {
ext.encode(extItems);
}
extSequence.write(DerValue.tag_Sequence, extItems);
tbsStream.write(DerValue.createTag(DerValue.TAG_CONTEXT, true,
(byte)3), extSequence);
}
}