BcX509CertificateGeneratorFactory implements CertificateGeneratorFactory { @Override public CertificateGenerator getInstance(Signer signer, CertificateGenerationParameters parameters) { if (!(parameters instanceof X509CertificateGenerationParameters)) { throw new IllegalArgumentException("Invalid parameters for X.509 certificate: " + parameters.getClass().getName()); } if (!signer.isForSigning()) { throw new IllegalArgumentException("Verifying signer used for signing certificates."); } X509CertificateGenerationParameters params = (X509CertificateGenerationParameters) parameters; switch (params.getX509Version()) { case V1: return new BcX509v1CertificateGenerator(signer, params, this.signerFactory, this.randomProvider.get()); case V3: return new BcX509v3CertificateGenerator(signer, params, this.signerFactory, this.randomProvider.get()); default: throw new IllegalArgumentException("Unknown X.509 certificate version: " + params.getX509Version()); } }  @Override CertificateGenerator getInstance(Signer signer, CertificateGenerationParameters parameters);  }
@Test void generateSelfSignedCertificateVersion1() throws Exception { CertifiedPublicKey certificate = factory.getInstance(signerFactory.getInstance(true, rsaPrivateKey), new X509CertificateGenerationParameters()) .generate(new DistinguishedName("CN=Test"), rsaPublicKey, new X509CertificateParameters()); checkSelfSigned(certificate, 1); }
@Test void generateSelfSignedCertificateVersion3WithoutExtension() throws Exception { CertifiedPublicKey certificate = factory.getInstance(signerFactory.getInstance(true, rsaPrivateKey), new X509CertificateGenerationParameters(null)) .generate(new DistinguishedName("CN=Test"), rsaPublicKey, new X509CertificateParameters()); checkSelfSigned(certificate, 3); }
@Test void generateSelfSignedCertificateVersion3RootCa() throws Exception { CertifiedPublicKey certificate = factory.getInstance(signerFactory.getInstance(true, rsaPrivateKey), new X509CertificateGenerationParameters( builder.addBasicConstraints(true) .addKeyUsage(true, EnumSet.of(KeyUsage.keyCertSign, KeyUsage.cRLSign)) .build())) .generate(new DistinguishedName("CN=Test"), rsaPublicKey, new X509CertificateParameters()); X509CertifiedPublicKey cert = checkSelfSigned(certificate, 3); assertTrue(cert.getExtensions().isCritical(X509Extensions.BASIC_CONSTRAINTS_OID), "Basic constraints should be critical."); assertTrue(cert.getExtensions().hasCertificateAuthorityBasicConstraints(), "Basic constraints should be set to CA."); assertTrue(cert.getExtensions().isCritical(KeyUsage.OID), "KeyUsage extension should be critical."); assertThat(cert.getExtensions().getKeyUsage(), equalTo(EnumSet.of(KeyUsage.keyCertSign, KeyUsage.cRLSign))); assertThat(cert.getAuthorityKeyIdentifier(), notNullValue()); assertThat(cert.getAuthorityKeyIdentifier(), equalTo(cert.getSubjectKeyIdentifier())); }
@Test void generateEndEntitySignedCertificateVersion1() throws Exception { CertifiedPublicKey caCertificate = factory.getInstance(signerFactory.getInstance(true, rsaPrivateKey), new X509CertificateGenerationParameters( )) .generate(new DistinguishedName("CN=Test CA"), rsaPublicKey, new X509CertificateParameters()); CertifiedPublicKey certificate = factory.getInstance( CertifyingSigner.getInstance(true, new CertifiedKeyPair(rsaPrivateKey, caCertificate), signerFactory), new X509CertificateGenerationParameters( ) ).generate(new DistinguishedName("CN=Test End Entity"), dsaPublicKey, new X509CertificateParameters()); checkRootSigned(certificate, 1); }
@Test void generateEndEntitySignedCertificateVersion3() throws Exception { CertifiedPublicKey caCertificate = factory.getInstance(signerFactory.getInstance(true, rsaPrivateKey), new X509CertificateGenerationParameters( builder.addBasicConstraints(true) .addKeyUsage(true, EnumSet.of(KeyUsage.keyCertSign, KeyUsage.cRLSign)) .build())) .generate(new DistinguishedName("CN=Test CA"), rsaPublicKey, new X509CertificateParameters()); builder = componentManager.getInstance(X509ExtensionBuilder.class); CertificateGenerator generator = factory.getInstance( CertifyingSigner.getInstance(true, new CertifiedKeyPair(rsaPrivateKey, caCertificate), signerFactory), new X509CertificateGenerationParameters( builder.addKeyUsage(EnumSet.of(KeyUsage.digitalSignature, KeyUsage.dataEncipherment)) .addExtendedKeyUsage(false, new ExtendedKeyUsages(new String[]{ ExtendedKeyUsages.EMAIL_PROTECTION })) .build())); builder = componentManager.getInstance(X509ExtensionBuilder.class); CertifiedPublicKey certificate = generator.generate(new DistinguishedName("CN=Test End Entity"), dsaPublicKey, new X509CertificateParameters( builder.addSubjectAltName(false, new X509GeneralName[]{ new X509Rfc822Name("test@example.com"), new X509Rfc822Name(new InternetAddress("test@test.com")), new X509DnsName("example.com"), new X509DirectoryName("CN=Test"), new X509IpAddress("192.168.1.1"), new X509IpAddress("192.168.2.0/24"), new X509IpAddress("192.168.3.0/255.255.255.0"), new X509IpAddress(InetAddress.getByName("192.168.4.1")), new X509IpAddress(InetAddress.getByName("192.168.5.0"), InetAddress.getByName("255.255.255.0")), new X509IpAddress("2001:db8:0:85a3::ac1f:8001"), new X509IpAddress("2001:db8:1f89::/48"), new X509IpAddress(InetAddress.getByName("2001:db8:0:85a3::ac1f:8001")), new X509IpAddress(InetAddress.getByName("2001:db8:1f89::"), InetAddress.getByName("ffff:ffff:ffff::")), new X509URI("http: new X509URI(new URL("http: }) .build() )); X509CertifiedPublicKey cert = checkRootSigned(certificate, 3); assertThat(cert.getExtensions().getExtensionOID(), equalTo(new String[]{ "2.5.29.35", "2.5.29.14", "2.5.29.15", "2.5.29.37", "2.5.29.17" })); assertThat(cert.getExtensions().getCriticalExtensionOID(), equalTo(new String[]{ "2.5.29.15" })); assertThat(cert.getExtensions().getNonCriticalExtensionOID(), equalTo(new String[]{ "2.5.29.35", "2.5.29.14", "2.5.29.37", "2.5.29.17" })); assertTrue(cert.getExtensions().isCritical(KeyUsage.OID), "KeyUsage extension should be critical."); assertThat(cert.getExtensions().getKeyUsage(), equalTo(EnumSet.of(KeyUsage.digitalSignature, KeyUsage.dataEncipherment))); assertFalse(cert.getExtensions().isCritical(ExtendedKeyUsages.OID), "ExtendedKeyUsage extension should be non critical."); assertThat(cert.getExtensions().getExtendedKeyUsage().getAll().toArray(new String[0]), equalTo( new String[]{ ExtendedKeyUsages.EMAIL_PROTECTION })); assertTrue(cert.getExtensions().getExtendedKeyUsage().hasUsage(ExtendedKeyUsages.EMAIL_PROTECTION), "Email data protection extended usage should be set."); List<X509GeneralName> names = cert.getExtensions().getSubjectAltName(); assertThat(names.size(), equalTo(15)); for (X509GeneralName name : names) { if (name instanceof X509Rfc822Name) { assertThat(((X509StringGeneralName) name).getName(), anyOf(equalTo("test@example.com"), equalTo("test@test.com"))); assertThat(((X509Rfc822Name) name).getAddress(), anyOf(equalTo(new InternetAddress("test@example.com")), equalTo(new InternetAddress("test@test.com")))); } else if (name instanceof X509DnsName) { assertThat(((X509StringGeneralName) name).getName(), equalTo("example.com")); assertThat(((X509DnsName) name).getDomain(), equalTo("example.com")); } else if (name instanceof X509DirectoryName) { assertThat(((X509StringGeneralName) name).getName(), equalTo("CN=Test")); } else if (name instanceof X509URI) { assertThat(((X509StringGeneralName) name).getName(), anyOf(equalTo("http: equalTo("http: assertThat(((X509URI) name).getURI(), anyOf(equalTo(new URI("http: equalTo(new URI("http: assertThat(((X509URI) name).getURL(), anyOf(equalTo(new URL("http: equalTo(new URL("http: } else if (name instanceof X509IpAddress) { assertTrue(IPAddress.isValid(((X509StringGeneralName) name).getName()) || IPAddress.isValidWithNetMask(((X509StringGeneralName) name).getName()), "Invalid IP address: " + ((X509StringGeneralName) name).getName()); } else { fail("Unexpected SubjectAltName type."); } } }
@Test void generateIntermediateCertificateVersion3() throws Exception { CertifiedPublicKey caCertificate = factory.getInstance(signerFactory.getInstance(true, rsaPrivateKey), new X509CertificateGenerationParameters( builder.addBasicConstraints(true) .addKeyUsage(true, EnumSet.of(KeyUsage.keyCertSign, KeyUsage.cRLSign)) .build())) .generate(new DistinguishedName("CN=Test CA"), rsaPublicKey, new X509CertificateParameters()); X509CertifiedPublicKey caKey = (X509CertifiedPublicKey) caCertificate; builder = componentManager.getInstance(X509ExtensionBuilder.class); CertificateGenerator generator = factory.getInstance( CertifyingSigner.getInstance(true, new CertifiedKeyPair(rsaPrivateKey, caCertificate), signerFactory), new X509CertificateGenerationParameters( builder.addBasicConstraints(0) .addKeyUsage(EnumSet.of(KeyUsage.keyCertSign, KeyUsage.cRLSign)) .build())); CertifiedPublicKey interCAcert = generator.generate(new DistinguishedName("CN=Test Intermediate CA"), interCaDsaPublicKey, new X509CertificateParameters()); assertTrue(interCAcert.isSignedBy(rsaPublicKey), "Signature should match Root CA key."); assertThat(interCAcert.getIssuer(), equalTo(caCertificate.getSubject())); assertThat(interCAcert.getSubject(), equalTo(new DistinguishedName("CN=Test Intermediate CA"))); assertThat(interCAcert, instanceOf(X509CertifiedPublicKey.class)); X509CertifiedPublicKey interCaKey = (X509CertifiedPublicKey) interCAcert; assertThat(interCaKey.getVersionNumber(), equalTo(3)); assertTrue(interCaKey.getExtensions().isCritical(X509Extensions.BASIC_CONSTRAINTS_OID), "Basic constraints should be critical."); assertTrue(interCaKey.getExtensions().hasCertificateAuthorityBasicConstraints(), "Basic constraints should be set to CA."); assertThat(interCaKey.getExtensions().getBasicConstraintsPathLen(), Matchers.equalTo(0)); assertTrue(interCaKey.getExtensions().isCritical(KeyUsage.OID), "KeyUsage extension should be critical."); assertThat(interCaKey.getExtensions().getKeyUsage(), equalTo(EnumSet.of(KeyUsage.keyCertSign, KeyUsage.cRLSign))); assertThat(interCaKey.getAuthorityKeyIdentifier(), equalTo(caKey.getSubjectKeyIdentifier())); builder = componentManager.getInstance(X509ExtensionBuilder.class); generator = factory.getInstance( CertifyingSigner.getInstance(true, new CertifiedKeyPair(interCaDsaPrivateKey, interCAcert), componentManager.getInstance(SignerFactory.class, "DSAwithSHA1")), new X509CertificateGenerationParameters( builder.addKeyUsage(EnumSet.of(KeyUsage.digitalSignature, KeyUsage.dataEncipherment)) .addExtendedKeyUsage(false, new ExtendedKeyUsages(new String[]{ ExtendedKeyUsages.EMAIL_PROTECTION })) .build())); builder = componentManager.getInstance(X509ExtensionBuilder.class); CertifiedPublicKey certificate = generator.generate(new DistinguishedName("CN=Test End Entity"), dsaPublicKey, new X509CertificateParameters( builder.addSubjectAltName(false, new X509GeneralName[]{ new X509Rfc822Name("test@example.com") }) .build() )); assertTrue(certificate.isSignedBy(interCaDsaPublicKey), "Signature should match intermediate CA key."); assertThat(certificate.getIssuer(), equalTo(interCAcert.getSubject())); assertThat(certificate.getSubject(), equalTo(new DistinguishedName("CN=Test End Entity"))); assertThat(certificate, instanceOf(X509CertifiedPublicKey.class)); X509CertifiedPublicKey key = (X509CertifiedPublicKey) certificate; assertThat(key.getAuthorityKeyIdentifier(), equalTo(interCaKey.getSubjectKeyIdentifier())); }