JSSPKIUtility extends ProviderBasedPKIUtility { @Override public X509CRL createX509CRL(List<X509CRLEntryWrapper> entries, BigInteger crlNumber) { try { X509Certificate caCert = reader.getCACert(); CRLExtensions entryExtensions = new CRLExtensions(); entryExtensions.add(CRLReasonExtension.PRIVILEGE_WITHDRAWN); List<RevokedCertificate> revokedCerts = entries.stream() .map(e -> new RevokedCertImpl(e.getSerialNumber(), e.getRevocationDate(), entryExtensions)) .collect(Collectors.toCollection(ArrayList::new)); CRLExtensions crlExtensions = new CRLExtensions(); crlExtensions.add(new CRLNumberExtension(crlNumber)); crlExtensions.add(buildAuthorityKeyIdentifier(caCert)); X500Name issuer = new X500Name(caCert.getIssuerX500Principal().getEncoded()); Date until = Util.addDaysToDt(config.getInt(ConfigProperties.CRL_NEXT_UPDATE_DELTA)); X509CRLImpl crlImpl = new X509CRLImpl( issuer, new Date(), until, revokedCerts.toArray(new RevokedCertificate[] {}), crlExtensions ); crlImpl.sign(reader.getCaKey(), SIGNING_ALG_ID); CertificateFactory cf = CertificateFactory.getInstance("X.509"); return (X509CRL) cf.generateCRL(new ByteArrayInputStream(crlImpl.getEncoded())); } catch (GeneralSecurityException | IOException | InvalidBERException e) { throw new RuntimeException("Error creating CRL", e); } } @Inject  JSSPKIUtility(CertificateReader reader, SubjectKeyIdentifierWriter writer, Configuration config); @Override X509Certificate createX509Certificate(String dn, Set<X509ExtensionWrapper> extensions,
        Set<X509ByteExtensionWrapper> byteExtensions, Date startDate, Date endDate, KeyPair clientKeyPair,
        BigInteger serialNumber, String alternateName); @Override X509CRL createX509CRL(List<X509CRLEntryWrapper> entries, BigInteger crlNumber); static AuthorityKeyIdentifierExtension buildAuthorityKeyIdentifier(RSAPublicKey key); static AuthorityKeyIdentifierExtension buildAuthorityKeyIdentifier(X509Certificate caCert); @Override byte[] getPemEncoded(X509Certificate cert); @Override byte[] getPemEncoded(RSAPrivateKey key); @Override byte[] getPemEncoded(X509CRL crl); @Override void writePemEncoded(X509Certificate cert, OutputStream out); @Override void writePemEncoded(RSAPrivateKey key, OutputStream out); @Override void writePemEncoded(X509CRL crl, OutputStream out); static final byte[] LINE_SEPARATOR; static final String SIGNING_ALG_ID; static final String CRL_PEM_NAME; static final String CERTIFICATE_PEM_NAME; static final String PRIVATE_KEY_PEM_NAME; }
@Test public void testCreateCRL() throws Exception { Date start = new Date(); int deltaDays = 400; config.setProperty(ConfigProperties.CRL_NEXT_UPDATE_DELTA, String.valueOf(deltaDays)); List<X509CRLEntryWrapper> entries = new ArrayList<>(); for (long i = 0L; i < 10L; i++) { entries.add(new X509CRLEntryWrapper(BigInteger.valueOf(i), new Date())); } X509CRL crl = jssUtil.createX509CRL(entries, BigInteger.ONE); byte[] extValue = crl.getExtensionValue(PKIXExtensions.CRLNumber_Id.toString()); ASN1OctetString extOctet = (ASN1OctetString) ASN1OctetString.fromByteArray(extValue); ASN1Integer crlNumber = (ASN1Integer) ASN1Integer.fromByteArray(extOctet.getOctets()); assertEquals(BigInteger.ONE, crlNumber.getValue()); assertEquals( "Test CA", new X500Name(crl.getIssuerX500Principal().getEncoded()).getCommonName() ); assertEquals(2, crl.getVersion()); TestDateUtil.assertDatesMatch(start, crl.getThisUpdate(), ChronoUnit.HOURS); Date expectedUpdate = Date.from( start.toInstant().atZone(ZoneId.systemDefault()).plusDays(deltaDays).toInstant() ); TestDateUtil.assertDatesMatch(expectedUpdate, crl.getNextUpdate(), ChronoUnit.HOURS); for (long i = 0L; i < 10L; i++) { X509CRLEntry entry = crl.getRevokedCertificate(BigInteger.valueOf(i)); assertEquals(entry.getRevocationReason(), CRLReason.PRIVILEGE_WITHDRAWN); } byte[] extensionValue = crl.getExtensionValue(PKIXExtensions.AuthorityKey_Id.toString()); ASN1OctetString akiOc = ASN1OctetString.getInstance(extensionValue); AuthorityKeyIdentifier aki = AuthorityKeyIdentifier.getInstance(akiOc.getOctets()); CertificateReader reader = injector.getInstance(CertificateReader.class); X509Certificate ca = reader.getCACert(); byte[] caExtensionValue = ca.getExtensionValue(PKIXExtensions.SubjectKey_Id.toString()); ASN1OctetString skiOc = ASN1OctetString.getInstance(caExtensionValue); SubjectKeyIdentifier ski = SubjectKeyIdentifier.getInstance(skiOc.getOctets()); assertArrayEquals(ski.getKeyIdentifier(), aki.getKeyIdentifier()); }