540 lines
19 KiB
Java
540 lines
19 KiB
Java
/*
|
|
* Copyright (c) 2015, Oracle and/or its affiliates. All rights reserved.
|
|
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
|
*
|
|
* This code is free software; you can redistribute it and/or modify it
|
|
* under the terms of the GNU General Public License version 2 only, as
|
|
* published by the Free Software Foundation. Oracle designates this
|
|
* particular file as subject to the "Classpath" exception as provided
|
|
* by Oracle in the LICENSE file that accompanied this code.
|
|
*
|
|
* This code is distributed in the hope that it will be useful, but WITHOUT
|
|
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
|
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
|
* version 2 for more details (a copy is included in the LICENSE file that
|
|
* accompanied this code).
|
|
*
|
|
* You should have received a copy of the GNU General Public License version
|
|
* 2 along with this work; if not, write to the Free Software Foundation,
|
|
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
|
*
|
|
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
|
* or visit www.oracle.com if you need additional information or have any
|
|
* questions.
|
|
*/
|
|
|
|
package sun.security.testlibrary;
|
|
|
|
import java.io.*;
|
|
import java.util.*;
|
|
import java.security.*;
|
|
import java.security.cert.X509Certificate;
|
|
import java.security.cert.CertificateException;
|
|
import java.security.cert.CertificateFactory;
|
|
import java.security.cert.Extension;
|
|
import javax.security.auth.x500.X500Principal;
|
|
import java.math.BigInteger;
|
|
|
|
import sun.security.util.DerOutputStream;
|
|
import sun.security.util.DerValue;
|
|
import sun.security.util.ObjectIdentifier;
|
|
import sun.security.x509.AccessDescription;
|
|
import sun.security.x509.AlgorithmId;
|
|
import sun.security.x509.AuthorityInfoAccessExtension;
|
|
import sun.security.x509.AuthorityKeyIdentifierExtension;
|
|
import sun.security.x509.SubjectKeyIdentifierExtension;
|
|
import sun.security.x509.BasicConstraintsExtension;
|
|
import sun.security.x509.ExtendedKeyUsageExtension;
|
|
import sun.security.x509.DNSName;
|
|
import sun.security.x509.GeneralName;
|
|
import sun.security.x509.GeneralNames;
|
|
import sun.security.x509.KeyUsageExtension;
|
|
import sun.security.x509.SerialNumber;
|
|
import sun.security.x509.SubjectAlternativeNameExtension;
|
|
import sun.security.x509.URIName;
|
|
import sun.security.x509.KeyIdentifier;
|
|
|
|
/**
|
|
* Helper class that builds and signs X.509 certificates.
|
|
*
|
|
* A CertificateBuilder is created with a default constructor, and then
|
|
* uses additional public methods to set the public key, desired validity
|
|
* dates, serial number and extensions. It is expected that the caller will
|
|
* have generated the necessary key pairs prior to using a CertificateBuilder
|
|
* to generate certificates.
|
|
*
|
|
* The following methods are mandatory before calling build():
|
|
* <UL>
|
|
* <LI>{@link #setSubjectName(java.lang.String)}
|
|
* <LI>{@link #setPublicKey(java.security.PublicKey)}
|
|
* <LI>{@link #setNotBefore(java.util.Date)} and
|
|
* {@link #setNotAfter(java.util.Date)}, or
|
|
* {@link #setValidity(java.util.Date, java.util.Date)}
|
|
* <LI>{@link #setSerialNumber(java.math.BigInteger)}
|
|
* </UL><BR>
|
|
*
|
|
* Additionally, the caller can either provide a {@link List} of
|
|
* {@link Extension} objects, or use the helper classes to add specific
|
|
* extension types.
|
|
*
|
|
* When all required and desired parameters are set, the
|
|
* {@link #build(java.security.cert.X509Certificate, java.security.PrivateKey,
|
|
* java.lang.String)} method can be used to create the {@link X509Certificate}
|
|
* object.
|
|
*
|
|
* Multiple certificates may be cut from the same settings using subsequent
|
|
* calls to the build method. Settings may be cleared using the
|
|
* {@link #reset()} method.
|
|
*/
|
|
public class CertificateBuilder {
|
|
private final CertificateFactory factory;
|
|
|
|
private X500Principal subjectName = null;
|
|
private BigInteger serialNumber = null;
|
|
private PublicKey publicKey = null;
|
|
private Date notBefore = null;
|
|
private Date notAfter = null;
|
|
private final Map<String, Extension> extensions = new HashMap<>();
|
|
private byte[] tbsCertBytes;
|
|
private byte[] signatureBytes;
|
|
|
|
/**
|
|
* Default constructor for a {@code CertificateBuilder} object.
|
|
*
|
|
* @throws CertificateException if the underlying {@link CertificateFactory}
|
|
* cannot be instantiated.
|
|
*/
|
|
public CertificateBuilder() throws CertificateException {
|
|
factory = CertificateFactory.getInstance("X.509");
|
|
}
|
|
|
|
/**
|
|
* Set the subject name for the certificate.
|
|
*
|
|
* @param name An {@link X500Principal} to be used as the subject name
|
|
* on this certificate.
|
|
*/
|
|
public void setSubjectName(X500Principal name) {
|
|
subjectName = name;
|
|
}
|
|
|
|
/**
|
|
* Set the subject name for the certificate.
|
|
*
|
|
* @param name The subject name in RFC 2253 format
|
|
*/
|
|
public void setSubjectName(String name) {
|
|
subjectName = new X500Principal(name);
|
|
}
|
|
|
|
/**
|
|
* Set the public key for this certificate.
|
|
*
|
|
* @param pubKey The {@link PublicKey} to be used on this certificate.
|
|
*/
|
|
public void setPublicKey(PublicKey pubKey) {
|
|
publicKey = Objects.requireNonNull(pubKey, "Caught null public key");
|
|
}
|
|
|
|
/**
|
|
* Set the NotBefore date on the certificate.
|
|
*
|
|
* @param nbDate A {@link Date} object specifying the start of the
|
|
* certificate validity period.
|
|
*/
|
|
public void setNotBefore(Date nbDate) {
|
|
Objects.requireNonNull(nbDate, "Caught null notBefore date");
|
|
notBefore = (Date)nbDate.clone();
|
|
}
|
|
|
|
/**
|
|
* Set the NotAfter date on the certificate.
|
|
*
|
|
* @param naDate A {@link Date} object specifying the end of the
|
|
* certificate validity period.
|
|
*/
|
|
public void setNotAfter(Date naDate) {
|
|
Objects.requireNonNull(naDate, "Caught null notAfter date");
|
|
notAfter = (Date)naDate.clone();
|
|
}
|
|
|
|
/**
|
|
* Set the validity period for the certificate
|
|
*
|
|
* @param nbDate A {@link Date} object specifying the start of the
|
|
* certificate validity period.
|
|
* @param naDate A {@link Date} object specifying the end of the
|
|
* certificate validity period.
|
|
*/
|
|
public void setValidity(Date nbDate, Date naDate) {
|
|
setNotBefore(nbDate);
|
|
setNotAfter(naDate);
|
|
}
|
|
|
|
/**
|
|
* Set the serial number on the certificate.
|
|
*
|
|
* @param serial A serial number in {@link BigInteger} form.
|
|
*/
|
|
public void setSerialNumber(BigInteger serial) {
|
|
Objects.requireNonNull(serial, "Caught null serial number");
|
|
serialNumber = serial;
|
|
}
|
|
|
|
|
|
/**
|
|
* Add a single extension to the certificate.
|
|
*
|
|
* @param ext The extension to be added.
|
|
*/
|
|
public void addExtension(Extension ext) {
|
|
Objects.requireNonNull(ext, "Caught null extension");
|
|
extensions.put(ext.getId(), ext);
|
|
}
|
|
|
|
/**
|
|
* Add multiple extensions contained in a {@code List}.
|
|
*
|
|
* @param extList The {@link List} of extensions to be added to
|
|
* the certificate.
|
|
*/
|
|
public void addExtensions(List<Extension> extList) {
|
|
Objects.requireNonNull(extList, "Caught null extension list");
|
|
for (Extension ext : extList) {
|
|
extensions.put(ext.getId(), ext);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Helper method to add DNSName types for the SAN extension
|
|
*
|
|
* @param dnsNames A {@code List} of names to add as DNSName types
|
|
*
|
|
* @throws IOException if an encoding error occurs.
|
|
*/
|
|
public void addSubjectAltNameDNSExt(List<String> dnsNames) throws IOException {
|
|
if (!dnsNames.isEmpty()) {
|
|
GeneralNames gNames = new GeneralNames();
|
|
for (String name : dnsNames) {
|
|
gNames.add(new GeneralName(new DNSName(name)));
|
|
}
|
|
addExtension(new SubjectAlternativeNameExtension(false,
|
|
gNames));
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Helper method to add one or more OCSP URIs to the Authority Info Access
|
|
* certificate extension.
|
|
*
|
|
* @param locations A list of one or more OCSP responder URIs as strings
|
|
*
|
|
* @throws IOException if an encoding error occurs.
|
|
*/
|
|
public void addAIAExt(List<String> locations)
|
|
throws IOException {
|
|
if (!locations.isEmpty()) {
|
|
List<AccessDescription> acDescList = new ArrayList<>();
|
|
for (String ocspUri : locations) {
|
|
acDescList.add(new AccessDescription(
|
|
AccessDescription.Ad_OCSP_Id,
|
|
new GeneralName(new URIName(ocspUri))));
|
|
}
|
|
addExtension(new AuthorityInfoAccessExtension(acDescList));
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Set a Key Usage extension for the certificate. The extension will
|
|
* be marked critical.
|
|
*
|
|
* @param bitSettings Boolean array for all nine bit settings in the order
|
|
* documented in RFC 5280 section 4.2.1.3.
|
|
*
|
|
* @throws IOException if an encoding error occurs.
|
|
*/
|
|
public void addKeyUsageExt(boolean[] bitSettings) throws IOException {
|
|
addExtension(new KeyUsageExtension(bitSettings));
|
|
}
|
|
|
|
/**
|
|
* Set the Basic Constraints Extension for a certificate.
|
|
*
|
|
* @param crit {@code true} if critical, {@code false} otherwise
|
|
* @param isCA {@code true} if the extension will be on a CA certificate,
|
|
* {@code false} otherwise
|
|
* @param maxPathLen The maximum path length issued by this CA. Values
|
|
* less than zero will omit this field from the resulting extension and
|
|
* no path length constraint will be asserted.
|
|
*
|
|
* @throws IOException if an encoding error occurs.
|
|
*/
|
|
public void addBasicConstraintsExt(boolean crit, boolean isCA,
|
|
int maxPathLen) throws IOException {
|
|
addExtension(new BasicConstraintsExtension(crit, isCA, maxPathLen));
|
|
}
|
|
|
|
/**
|
|
* Add the Authority Key Identifier extension.
|
|
*
|
|
* @param authorityCert The certificate of the issuing authority.
|
|
*
|
|
* @throws IOException if an encoding error occurs.
|
|
*/
|
|
public void addAuthorityKeyIdExt(X509Certificate authorityCert)
|
|
throws IOException {
|
|
addAuthorityKeyIdExt(authorityCert.getPublicKey());
|
|
}
|
|
|
|
/**
|
|
* Add the Authority Key Identifier extension.
|
|
*
|
|
* @param authorityKey The public key of the issuing authority.
|
|
*
|
|
* @throws IOException if an encoding error occurs.
|
|
*/
|
|
public void addAuthorityKeyIdExt(PublicKey authorityKey) throws IOException {
|
|
KeyIdentifier kid = new KeyIdentifier(authorityKey);
|
|
addExtension(new AuthorityKeyIdentifierExtension(kid, null, null));
|
|
}
|
|
|
|
/**
|
|
* Add the Subject Key Identifier extension.
|
|
*
|
|
* @param subjectKey The public key to be used in the resulting certificate
|
|
*
|
|
* @throws IOException if an encoding error occurs.
|
|
*/
|
|
public void addSubjectKeyIdExt(PublicKey subjectKey) throws IOException {
|
|
byte[] keyIdBytes = new KeyIdentifier(subjectKey).getIdentifier();
|
|
addExtension(new SubjectKeyIdentifierExtension(keyIdBytes));
|
|
}
|
|
|
|
/**
|
|
* Add the Extended Key Usage extension.
|
|
*
|
|
* @param ekuOids A {@link List} of object identifiers in string form.
|
|
*
|
|
* @throws IOException if an encoding error occurs.
|
|
*/
|
|
public void addExtendedKeyUsageExt(List<String> ekuOids)
|
|
throws IOException {
|
|
if (!ekuOids.isEmpty()) {
|
|
Vector<ObjectIdentifier> oidVector = new Vector<>();
|
|
for (String oid : ekuOids) {
|
|
oidVector.add(new ObjectIdentifier(oid));
|
|
}
|
|
addExtension(new ExtendedKeyUsageExtension(oidVector));
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Clear all settings and return the {@code CertificateBuilder} to
|
|
* its default state.
|
|
*/
|
|
public void reset() {
|
|
extensions.clear();
|
|
subjectName = null;
|
|
notBefore = null;
|
|
notAfter = null;
|
|
serialNumber = null;
|
|
publicKey = null;
|
|
signatureBytes = null;
|
|
tbsCertBytes = null;
|
|
}
|
|
|
|
/**
|
|
* Build the certificate.
|
|
*
|
|
* @param issuerCert The certificate of the issuing authority, or
|
|
* {@code null} if the resulting certificate is self-signed.
|
|
* @param issuerKey The private key of the issuing authority
|
|
* @param algName The signature algorithm name
|
|
*
|
|
* @return The resulting {@link X509Certificate}
|
|
*
|
|
* @throws IOException if an encoding error occurs.
|
|
* @throws CertificateException If the certificate cannot be generated
|
|
* by the underlying {@link CertificateFactory}
|
|
* @throws NoSuchAlgorithmException If an invalid signature algorithm
|
|
* is provided.
|
|
*/
|
|
public X509Certificate build(X509Certificate issuerCert,
|
|
PrivateKey issuerKey, String algName)
|
|
throws IOException, CertificateException, NoSuchAlgorithmException {
|
|
// TODO: add some basic checks (key usage, basic constraints maybe)
|
|
|
|
AlgorithmId signAlg = AlgorithmId.get(algName);
|
|
byte[] encodedCert = encodeTopLevel(issuerCert, issuerKey, signAlg);
|
|
ByteArrayInputStream bais = new ByteArrayInputStream(encodedCert);
|
|
return (X509Certificate)factory.generateCertificate(bais);
|
|
}
|
|
|
|
/**
|
|
* Encode the contents of the outer-most ASN.1 SEQUENCE:
|
|
*
|
|
* <PRE>
|
|
* Certificate ::= SEQUENCE {
|
|
* tbsCertificate TBSCertificate,
|
|
* signatureAlgorithm AlgorithmIdentifier,
|
|
* signatureValue BIT STRING }
|
|
* </PRE>
|
|
*
|
|
* @param issuerCert The certificate of the issuing authority, or
|
|
* {@code null} if the resulting certificate is self-signed.
|
|
* @param issuerKey The private key of the issuing authority
|
|
* @param signAlg The signature algorithm object
|
|
*
|
|
* @return The DER-encoded X.509 certificate
|
|
*
|
|
* @throws CertificateException If an error occurs during the
|
|
* signing process.
|
|
* @throws IOException if an encoding error occurs.
|
|
*/
|
|
private byte[] encodeTopLevel(X509Certificate issuerCert,
|
|
PrivateKey issuerKey, AlgorithmId signAlg)
|
|
throws CertificateException, IOException {
|
|
DerOutputStream outerSeq = new DerOutputStream();
|
|
DerOutputStream topLevelItems = new DerOutputStream();
|
|
|
|
tbsCertBytes = encodeTbsCert(issuerCert, signAlg);
|
|
topLevelItems.write(tbsCertBytes);
|
|
try {
|
|
signatureBytes = signCert(issuerKey, signAlg);
|
|
} catch (GeneralSecurityException ge) {
|
|
throw new CertificateException(ge);
|
|
}
|
|
signAlg.derEncode(topLevelItems);
|
|
topLevelItems.putBitString(signatureBytes);
|
|
outerSeq.write(DerValue.tag_Sequence, topLevelItems);
|
|
|
|
return outerSeq.toByteArray();
|
|
}
|
|
|
|
/**
|
|
* Encode the bytes for the TBSCertificate structure:
|
|
* <PRE>
|
|
* TBSCertificate ::= SEQUENCE {
|
|
* version [0] EXPLICIT Version DEFAULT v1,
|
|
* serialNumber CertificateSerialNumber,
|
|
* signature AlgorithmIdentifier,
|
|
* issuer Name,
|
|
* validity Validity,
|
|
* subject Name,
|
|
* subjectPublicKeyInfo SubjectPublicKeyInfo,
|
|
* issuerUniqueID [1] IMPLICIT UniqueIdentifier OPTIONAL,
|
|
* -- If present, version MUST be v2 or v3
|
|
* subjectUniqueID [2] IMPLICIT UniqueIdentifier OPTIONAL,
|
|
* -- If present, version MUST be v2 or v3
|
|
* extensions [3] EXPLICIT Extensions OPTIONAL
|
|
* -- If present, version MUST be v3
|
|
* }
|
|
*
|
|
* @param issuerCert The certificate of the issuing authority, or
|
|
* {@code null} if the resulting certificate is self-signed.
|
|
* @param signAlg The signature algorithm object
|
|
*
|
|
* @return The DER-encoded bytes for the TBSCertificate structure
|
|
*
|
|
* @throws IOException if an encoding error occurs.
|
|
*/
|
|
private byte[] encodeTbsCert(X509Certificate issuerCert,
|
|
AlgorithmId signAlg) throws IOException {
|
|
DerOutputStream tbsCertSeq = new DerOutputStream();
|
|
DerOutputStream tbsCertItems = new DerOutputStream();
|
|
|
|
// Hardcode to V3
|
|
byte[] v3int = {0x02, 0x01, 0x02};
|
|
tbsCertItems.write(DerValue.createTag(DerValue.TAG_CONTEXT, true,
|
|
(byte)0), v3int);
|
|
|
|
// Serial Number
|
|
SerialNumber sn = new SerialNumber(serialNumber);
|
|
sn.encode(tbsCertItems);
|
|
|
|
// Algorithm ID
|
|
signAlg.derEncode(tbsCertItems);
|
|
|
|
// Issuer Name
|
|
if (issuerCert != null) {
|
|
tbsCertItems.write(
|
|
issuerCert.getSubjectX500Principal().getEncoded());
|
|
} else {
|
|
// Self-signed
|
|
tbsCertItems.write(subjectName.getEncoded());
|
|
}
|
|
|
|
// Validity period (set as UTCTime)
|
|
DerOutputStream valSeq = new DerOutputStream();
|
|
valSeq.putUTCTime(notBefore);
|
|
valSeq.putUTCTime(notAfter);
|
|
tbsCertItems.write(DerValue.tag_Sequence, valSeq);
|
|
|
|
// Subject Name
|
|
tbsCertItems.write(subjectName.getEncoded());
|
|
|
|
// SubjectPublicKeyInfo
|
|
tbsCertItems.write(publicKey.getEncoded());
|
|
|
|
// TODO: Extensions!
|
|
encodeExtensions(tbsCertItems);
|
|
|
|
// Wrap it all up in a SEQUENCE and return the bytes
|
|
tbsCertSeq.write(DerValue.tag_Sequence, tbsCertItems);
|
|
return tbsCertSeq.toByteArray();
|
|
}
|
|
|
|
/**
|
|
* Encode the extensions segment for an X.509 Certificate:
|
|
*
|
|
* <PRE>
|
|
* Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension
|
|
*
|
|
* Extension ::= SEQUENCE {
|
|
* extnID OBJECT IDENTIFIER,
|
|
* critical BOOLEAN DEFAULT FALSE,
|
|
* extnValue OCTET STRING
|
|
* -- contains the DER encoding of an ASN.1 value
|
|
* -- corresponding to the extension type identified
|
|
* -- by extnID
|
|
* }
|
|
* </PRE>
|
|
*
|
|
* @param tbsStream The {@code DerOutputStream} that holds the
|
|
* TBSCertificate contents.
|
|
*
|
|
* @throws IOException if an encoding error occurs.
|
|
*/
|
|
private void encodeExtensions(DerOutputStream tbsStream)
|
|
throws IOException {
|
|
DerOutputStream extSequence = new DerOutputStream();
|
|
DerOutputStream extItems = new DerOutputStream();
|
|
|
|
for (Extension ext : extensions.values()) {
|
|
ext.encode(extItems);
|
|
}
|
|
extSequence.write(DerValue.tag_Sequence, extItems);
|
|
tbsStream.write(DerValue.createTag(DerValue.TAG_CONTEXT, true,
|
|
(byte)3), extSequence);
|
|
}
|
|
|
|
/**
|
|
* Digitally sign the X.509 certificate.
|
|
*
|
|
* @param issuerKey The private key of the issuing authority
|
|
* @param signAlg The signature algorithm object
|
|
*
|
|
* @return The digital signature bytes.
|
|
*
|
|
* @throws GeneralSecurityException If any errors occur during the
|
|
* digital signature process.
|
|
*/
|
|
private byte[] signCert(PrivateKey issuerKey, AlgorithmId signAlg)
|
|
throws GeneralSecurityException {
|
|
Signature sig = Signature.getInstance(signAlg.getName());
|
|
sig.initSign(issuerKey);
|
|
sig.update(tbsCertBytes);
|
|
return sig.sign();
|
|
}
|
|
}
|