SignedCertificateGenerator { public X509Certificate getSignedByIssuer( final KeyPair keyPair, final CertificateGenerationParameters params, final X509Certificate caCertificate, final PrivateKey caPrivateKey) throws Exception { return getSignedByIssuer( caCertificate, caPrivateKey, getSubjectNameFrom(caCertificate), getSubjectKeyIdentifierFrom(caCertificate), keyPair, params ); } @Autowired  SignedCertificateGenerator(
    final CurrentTimeProvider timeProvider,
    final RandomSerialNumberGenerator serialNumberGenerator,
    final JcaContentSignerBuilder jcaContentSignerBuilder,
    final JcaX509CertificateConverter jcaX509CertificateConverter
  ); X509Certificate getSelfSigned(final KeyPair keyPair, final CertificateGenerationParameters params); X509Certificate getSignedByIssuer(
    final KeyPair keyPair,
    final CertificateGenerationParameters params,
    final X509Certificate caCertificate,
    final PrivateKey caPrivateKey);  }
@Test public void getSignedByIssuer_generatesACertificateWithTheRightValues() throws Exception { final X509Certificate generatedCertificate = subject .getSignedByIssuer(generatedCertificateKeyPair, certificateGenerationParameters, certificateAuthorityWithSubjectKeyId, issuerKey.getPrivate()); assertThat(generatedCertificate.getIssuerDN().getName(), containsString("CN=ca DN")); assertThat(generatedCertificate.getIssuerDN().getName(), containsString("O=credhub")); assertThat(generatedCertificate.getSerialNumber(), equalTo(BigInteger.valueOf(1337L))); assertThat(generatedCertificate.getNotBefore().toString(), equalTo(Date.from(now).toString())); assertThat(generatedCertificate.getNotAfter().toString(), equalTo(Date.from(later).toString())); assertThat(generatedCertificate.getSubjectDN().toString(), containsString("CN=my cert name")); assertThat(generatedCertificate.getPublicKey(), equalTo(generatedCertificateKeyPair.getPublic())); assertThat(generatedCertificate.getSigAlgName(), equalTo("SHA256WITHRSA")); generatedCertificate.verify(issuerKey.getPublic()); final byte[] isCaExtension = generatedCertificate.getExtensionValue(Extension.basicConstraints.getId()); assertThat(Arrays.copyOfRange(isCaExtension, 2, isCaExtension.length), equalTo(new BasicConstraints(true).getEncoded())); }
@Test public void getSignedByIssuer_withoutSubjectKeyIdentifier_doesNotSetAuthorityKeyIdentifier() throws Exception { final X509Certificate generatedCertificate = subject.getSignedByIssuer(generatedCertificateKeyPair, certificateGenerationParameters, certificateAuthority, issuerKey.getPrivate()); assertThat(generatedCertificate.getExtensionValue(Extension.authorityKeyIdentifier.getId()), nullValue()); }
@Test public void getSignedByIssuer_withSubjectKeyIdentifier_setsAuthorityKeyIdentifier() throws Exception { when(serialNumberGenerator.generate()) .thenReturn(BigInteger.valueOf(1337)) .thenReturn(BigInteger.valueOf(666)); final X509Certificate generatedCertificate = subject.getSignedByIssuer(generatedCertificateKeyPair, certificateGenerationParameters, certificateAuthorityWithSubjectKeyId, issuerKey.getPrivate()); final byte[] authorityKeyIdDer = generatedCertificate.getExtensionValue(Extension.authorityKeyIdentifier.getId()); final AuthorityKeyIdentifier authorityKeyIdentifier = AuthorityKeyIdentifier.getInstance(parseExtensionValue(authorityKeyIdDer)); assertThat(authorityKeyIdentifier.getKeyIdentifier(), equalTo(caSubjectKeyIdentifier.getKeyIdentifier())); }
@Test public void getSignedByIssuer_withNonGeneratedSubjectKeyIdentifier_setsAuthorityKeyIdentifier() throws Exception { final X509Certificate caCertificate = new CertificateReader(TEST_CA_WITH_DIFFERENT_SKID).getCertificate(); PrivateKey caPrivateKey = PrivateKeyReader.getPrivateKey(TEST_KEY_WITH_DIFFERENT_SKID); final X509Certificate generatedCert = subject .getSignedByIssuer(generatedCertificateKeyPair, certificateGenerationParameters, caCertificate, caPrivateKey); final byte[] authorityKeyIdDer = generatedCert.getExtensionValue(Extension.authorityKeyIdentifier.getId()); final AuthorityKeyIdentifier authorityKeyIdentifier = AuthorityKeyIdentifier.getInstance(parseExtensionValue(authorityKeyIdDer)); final byte[] subjectKeyIdDer = caCertificate.getExtensionValue(Extension.subjectKeyIdentifier.getId()); SubjectKeyIdentifier subjectKeyIdentifier = SubjectKeyIdentifier.getInstance(parseExtensionValue(subjectKeyIdDer)); assertThat(authorityKeyIdentifier.getKeyIdentifier(), equalTo(subjectKeyIdentifier.getKeyIdentifier())); }
@Test public void getSignedByIssuer_setsSubjectKeyIdentifier() throws Exception { final X509Certificate generatedCertificate = subject .getSignedByIssuer(generatedCertificateKeyPair, certificateGenerationParameters, certificateAuthorityWithSubjectKeyId, issuerKey.getPrivate()); expectedSubjectKeyIdentifier = jcaX509ExtensionUtils.createSubjectKeyIdentifier(generatedCertificateKeyPair.getPublic()).getKeyIdentifier(); final byte[] actual = generatedCertificate.getExtensionValue(Extension.subjectKeyIdentifier.getId()); assertThat(Arrays.copyOfRange(actual, 4, actual.length), equalTo(expectedSubjectKeyIdentifier)); }
@Test public void getSignedByIssuer_setsAlternativeName_ifPresent() throws Exception { X509Certificate generatedCertificate = subject .getSignedByIssuer(generatedCertificateKeyPair, certificateGenerationParameters, certificateAuthorityWithSubjectKeyId, issuerKey.getPrivate()); assertThat(generatedCertificate.getExtensionValue(Extension.subjectAlternativeName.getId()), nullValue()); certificateGenerationParameters = parametersContainsExtensions(); generatedCertificate = subject .getSignedByIssuer(generatedCertificateKeyPair, certificateGenerationParameters, certificateAuthorityWithSubjectKeyId, issuerKey.getPrivate()); final byte[] actualSubjectAlternativeName = generatedCertificate.getExtensionValue(Extension.subjectAlternativeName.getId()); final byte[] expectedAlternativeName = getExpectedAlternativeNames(); assertThat(Arrays.copyOfRange(actualSubjectAlternativeName, 2, actualSubjectAlternativeName.length), equalTo(expectedAlternativeName)); }
@Test public void getSignedByIssuer_setsKeyUsage_ifPresent() throws Exception { X509Certificate generatedCertificate = subject .getSignedByIssuer(generatedCertificateKeyPair, certificateGenerationParameters, certificateAuthorityWithSubjectKeyId, issuerKey.getPrivate()); assertThat(generatedCertificate.getExtensionValue(Extension.keyUsage.getId()), nullValue()); certificateGenerationParameters = parametersContainsExtensions(); generatedCertificate = subject .getSignedByIssuer(generatedCertificateKeyPair, certificateGenerationParameters, certificateAuthorityWithSubjectKeyId, issuerKey.getPrivate()); final byte[] actualKeyUsage = generatedCertificate.getExtensionValue(Extension.keyUsage.getId()); assertThat(Arrays.copyOfRange(actualKeyUsage, 5, actualKeyUsage.length), equalTo(certificateGenerationParameters.getKeyUsage().getBytes())); }
@Test public void getSignedByIssuer_setsExtendedKeyUsage_ifPresent() throws Exception { X509Certificate generatedCertificate = subject .getSignedByIssuer(generatedCertificateKeyPair, certificateGenerationParameters, certificateAuthorityWithSubjectKeyId, issuerKey.getPrivate()); assertThat(generatedCertificate.getExtensionValue(Extension.keyUsage.getId()), nullValue()); certificateGenerationParameters = parametersContainsExtensions(); generatedCertificate = subject .getSignedByIssuer(generatedCertificateKeyPair, certificateGenerationParameters, certificateAuthorityWithSubjectKeyId, issuerKey.getPrivate()); final byte[] actualKeyUsage = generatedCertificate.getExtensionValue(Extension.extendedKeyUsage.getId()); assertThat(Arrays.copyOfRange(actualKeyUsage, 2, actualKeyUsage.length), equalTo(certificateGenerationParameters.getExtendedKeyUsage().getEncoded())); }
@Test public void getSignedByIssuer_preservesIssuerBytes() throws Exception { final CertificateReader certificateReader = new CertificateReader(CERTSTRAP_GENERATED_CA_CERTIFICATE); final X509Certificate caCertificate = certificateReader.getCertificate(); final PrivateKey caPrivateKey = PrivateKeyReader.getPrivateKey(CERTSTRAP_GENERATED_CA_PRIVATE_KEY); final X509Certificate generatedCertificate = subject .getSignedByIssuer(generatedCertificateKeyPair, certificateGenerationParameters, caCertificate, caPrivateKey); assertThat(generatedCertificate.getIssuerX500Principal().getEncoded(), equalTo(caCertificate.getSubjectX500Principal().getEncoded())); }