ZTSUtils { public static boolean verifyCertificateRequest(PKCS10CertificationRequest certReq, final String domain, final String service, X509CertRecord certRecord) { final String cn = domain + "." + service; if (!validateCertReqCommonName(certReq, cn)) { LOGGER.error("validateCertificateRequest: unable to validate PKCS10 cert request common name"); return false; } if (!validateCertReqDNSNames(certReq, domain, service)) { LOGGER.error("validateCertificateRequest: unable to validate PKCS10 cert request DNS Name"); return false; } if (certRecord != null) { if (!cn.equals(certRecord.getService())) { LOGGER.error("verifyCertificateRequest: unable to validate cn: {} vs. cert record data: {}", cn, certRecord.getService()); return false; } if (!validateCertReqInstanceId(certReq, certRecord.getInstanceId())) { LOGGER.error("verifyCertificateRequest: unable to validate PKCS10 cert request instance id"); return false; } } return true; }  static SslContextFactory createSSLContextObject(String[] clientProtocols); static SslContextFactory createSSLContextObject(final String[] clientProtocols,
            final PrivateKeyStore privateKeyStore); static boolean emitMonmetricError(int errorCode, String caller,
            String requestDomain, String principalDomain, Metric metric); static boolean verifyCertificateRequest(PKCS10CertificationRequest certReq,
            final String domain, final String service, X509CertRecord certRecord); static boolean validateCertReqCommonName(PKCS10CertificationRequest certReq, String cn); static String extractCertReqInstanceId(PKCS10CertificationRequest certReq); static Identity generateIdentity(InstanceCertManager certManager, final String csr,
            final String cn, final String certUsage, int expiryTime); static SSLContext createServerClientSSLContext(PrivateKeyStore privateKeyStore); static int parseInt(final String value, int defaultValue); static boolean parseBoolean(final String value, boolean defaultValue); static final String ZTS_CERT_DNS_SUFFIX; }
@Test public void testVerifyCertificateRequest() throws IOException { Path path = Paths.get("src/test/resources/athenz.instanceid.csr"); String csr = new String(Files.readAllBytes(path)); X509CertRecord certRecord = new X509CertRecord(); certRecord.setService("athenz.production"); certRecord.setInstanceId("1001"); PKCS10CertificationRequest certReq = Crypto.getPKCS10CertRequest(csr); boolean result = ZTSUtils.verifyCertificateRequest(certReq, "athenz", "production", certRecord); assertTrue(result); certRecord.setService("athenz.production"); certRecord.setInstanceId("1001"); result = ZTSUtils.verifyCertificateRequest(certReq, "athenz2", "production", certRecord); assertFalse(result); certRecord.setService("athenz2.production"); certRecord.setInstanceId("1001"); result = ZTSUtils.verifyCertificateRequest(certReq, "athenz", "production", certRecord); assertFalse(result); certRecord.setService("athenz.production"); certRecord.setInstanceId("1002"); result = ZTSUtils.verifyCertificateRequest(certReq, "athenz", "production", certRecord); assertFalse(result); }
@Test public void testVerifyCertificateRequestMismatchDns() throws IOException { Path path = Paths.get("src/test/resources/athenz.mismatch.cn.csr"); String csr = new String(Files.readAllBytes(path)); PKCS10CertificationRequest certReq = Crypto.getPKCS10CertRequest(csr); boolean result = ZTSUtils.verifyCertificateRequest(certReq, "athenz2", "production", null); assertFalse(result); }
@Test public void testVerifyCertificateRequestNoCertRecord() throws IOException { Path path = Paths.get("src/test/resources/athenz.instanceid.csr"); String csr = new String(Files.readAllBytes(path)); PKCS10CertificationRequest certReq = Crypto.getPKCS10CertRequest(csr); boolean result = ZTSUtils.verifyCertificateRequest(certReq, "athenz", "production", null); assertTrue(result); result = ZTSUtils.verifyCertificateRequest(certReq, "athenz2", "production", null); assertFalse(result); }