private void checkScepResponse(byte[] retMsg, String userDN, String senderNonce, String transId, boolean crlRep) throws CMSException, NoSuchProviderException, NoSuchAlgorithmException, CertStoreException, InvalidKeyException, CertificateException, SignatureException, CRLException {
private void checkScepResponse(byte[] retMsg, String userDN, String senderNonce, String transId, boolean crlRep, String digestOid) throws CMSException, NoSuchProviderException, NoSuchAlgorithmException, CertStoreException, InvalidKeyException, CertificateException, SignatureException, CRLException {
    private void checkScepResponse(byte[] retMsg, String userDN, String senderNonce, String transId, boolean crlRep) throws CMSException, NoSuchProviderException, NoSuchAlgorithmException, CertStoreException, InvalidKeyException, CertificateException, SignatureException, CRLException {        //        // Parse response message        //        CMSSignedData s = new CMSSignedData(retMsg);        // The signer, i.e. the CA, check it's the right CA        SignerInformationStore signers = s.getSignerInfos();        Collection col = signers.getSigners();        assertTrue(col.size() > 0);        Iterator iter = col.iterator();        SignerInformation signerInfo = (SignerInformation)iter.next();        SignerId sinfo = signerInfo.getSID();        // Check that the signer is the expected CA        assertEquals(CertTools.stringToBCDNString(cacert.getIssuerDN().getName()), CertTools.stringToBCDNString(sinfo.getIssuerAsString()));        // Get authenticated attributes        AttributeTable tab = signerInfo.getSignedAttributes();        // --Fail info        Attribute attr = tab.get(new DERObjectIdentifier(ScepRequestMessage.id_failInfo));        // No failInfo on this success message        assertNull(attr);         // --Message type        attr = tab.get(new DERObjectIdentifier(ScepRequestMessage.id_messageType));        assertNotNull(attr);        ASN1Set values = attr.getAttrValues();        assertEquals(values.size(), 1);        DERString str = DERPrintableString.getInstance((values.getObjectAt(0)));        String messageType = str.getString();        assertEquals("3", messageType);        // --Success status        attr = tab.get(new DERObjectIdentifier(ScepRequestMessage.id_pkiStatus));        assertNotNull(attr);        values = attr.getAttrValues();        assertEquals(values.size(), 1);        str = DERPrintableString.getInstance((values.getObjectAt(0)));        assertEquals(ResponseStatus.SUCCESS.getValue(), str.getString());        // --SenderNonce        attr = tab.get(new DERObjectIdentifier(ScepRequestMessage.id_senderNonce));        assertNotNull(attr);        values = attr.getAttrValues();        assertEquals(values.size(), 1);        ASN1OctetString octstr = ASN1OctetString.getInstance(values.getObjectAt(0));        // SenderNonce is something the server came up with, but it should be 16 chars        assertTrue(octstr.getOctets().length == 16);        // --Recipient Nonce        attr = tab.get(new DERObjectIdentifier(ScepRequestMessage.id_recipientNonce));        assertNotNull(attr);        values = attr.getAttrValues();        assertEquals(values.size(), 1);        octstr = ASN1OctetString.getInstance(values.getObjectAt(0));        // recipient nonce should be the same as we sent away as sender nonce        assertEquals(senderNonce, new String(Base64.encode(octstr.getOctets())));        // --Transaction ID        attr = tab.get(new DERObjectIdentifier(ScepRequestMessage.id_transId));        assertNotNull(attr);        values = attr.getAttrValues();        assertEquals(values.size(), 1);        str = DERPrintableString.getInstance((values.getObjectAt(0)));        // transid should be the same as the one we sent        assertEquals(transId, str.getString());                //        // Check different message types        //        if (messageType.equals("3")) {            // First we extract the encrypted data from the CMS enveloped data contained            // within the CMS signed data            CMSProcessable sp = s.getSignedContent();            byte[] content = (byte[])sp.getContent();            CMSEnvelopedData ed = new CMSEnvelopedData(content);            RecipientInformationStore recipients = ed.getRecipientInfos();            Collection c = recipients.getRecipients();            assertEquals(c.size(), 1);            Iterator it = c.iterator();            byte[] decBytes = null;            RecipientInformation recipient = (RecipientInformation) it.next();            decBytes = recipient.getContent(keys.getPrivate(), "BC");            // This is yet another CMS signed data            CMSSignedData sd = new CMSSignedData(decBytes);            // Get certificates from the signed data            CertStore certstore = sd.getCertificatesAndCRLs("Collection","BC");            if (crlRep) {                // We got a reply with a requested CRL                Collection crls = certstore.getCRLs(null);                assertEquals(crls.size(), 1);                it = crls.iterator();                X509CRL retCrl = null;                // CRL is first (and only)                retCrl = (X509CRL)it.next();                System.out.println("Got CRL with DN: "+ retCrl.getIssuerDN().getName());//                try {//                    FileOutputStream fos = new FileOutputStream("sceptest.der");//                    fos.write(retCrl.getEncoded());//                    fos.close();//                } catch (Exception e) {}                // check the returned CRL                assertEquals(cacert.getSubjectDN().getName(), retCrl.getIssuerDN().getName());                retCrl.verify(cacert.getPublicKey());            } else {                // We got a reply with a requested certificate                 Collection certs = certstore.getCertificates(null);                // EJBCA returns the issued cert and the CA cert (cisco vpn client requires that the ca cert is included)                assertEquals(certs.size(), 2);                it = certs.iterator();                // Issued certificate must be first                boolean verified = false;                boolean gotcacert = false;                String mysubjectdn = CertTools.stringToBCDNString("C=SE,O=PrimeKey,CN=sceptest");                while (it.hasNext()) {                    X509Certificate retcert = (X509Certificate)it.next();                    System.out.println("Got cert with DN: "+ retcert.getSubjectDN().getName());//                    try {//                        FileOutputStream fos = new FileOutputStream("sceptest.der");//                        fos.write(retcert.getEncoded());//                        fos.close();//                    } catch (Exception e) {}                                    // check the returned certificate                    String subjectdn = CertTools.stringToBCDNString(retcert.getSubjectDN().getName());                    if (mysubjectdn.equals(subjectdn)) {                        // issued certificate                        assertEquals(CertTools.stringToBCDNString("C=SE,O=PrimeKey,CN=sceptest"), subjectdn);                        retcert.verify(cacert.getPublicKey());                        assertTrue(checkKeys(keys.getPrivate(), retcert.getPublicKey()));                        verified = true;                    } else {                        // ca certificate                        assertEquals(cacert.getSubjectDN().getName(), retcert.getIssuerDN().getName());                        gotcacert = true;                    }                }                assertTrue(verified);                assertTrue(gotcacert);            }        }            }