System.out.println("Loaded certificate chain with length "+ chain1.length+" with alias '"+ialias+"'.");
debug("Loaded certificate chain with length "+ chain1.length+" with alias '"+ialias+"'.");
    public void ejbCreate() throws CreateException {        debug(">ejbCreate()");        try {            // Install BouncyCastle provider            Provider BCJce = new org.bouncycastle.jce.provider.BouncyCastleProvider();            int result = Security.addProvider(BCJce);            // get home interfaces to other session beans used            storeHome = (ICertificateStoreSessionHome) lookup("java:comp/env/ejb/CertificateStoreSession", ICertificateStoreSessionHome.class);            authHome = (IAuthenticationSessionHome)lookup("java:comp/env/ejb/AuthenticationSession",IAuthenticationSessionHome.class);            // Init the publisher session beans            int i = 1;            publishers = new Vector(0);            try {                while (true) {                    String jndiName = "PublisherSession" + i;                    IPublisherSessionHome pubHome = (IPublisherSessionHome) lookup(jndiName, IPublisherSessionHome.class);                    publishers.add(pubHome);                    info("Added publisher class '"+pubHome.getClass().getName()+"'");                    i++;                }            } catch (EJBException e) {                // We could not find this publisher                debug("Failed to find publisher at index '"+i+"', no more publishers.");            }            // Get env variables and read in nessecary data            KeyStore keyStore=KeyStore.getInstance("PKCS12", "BC");            String keyStoreFile = (String)lookup("java:comp/env/keyStore", java.lang.String.class);            debug("keystore:" + keyStoreFile);            InputStream is = new FileInputStream(keyStoreFile);            char[] keyStorePass = getPassword("java:comp/env/keyStorePass");            //debug("keystorepass: " + keyStorePass);            keyStore.load(is, keyStorePass);            String privateKeyAlias= (String)lookup("java:comp/env/privateKeyAlias", java.lang.String.class);            debug("privateKeyAlias: " + privateKeyAlias);            char[] privateKeyPass = getPassword("java:comp/env/privateKeyPass");            if ((new String(privateKeyPass)).equals("null"))                privateKeyPass = null;            //debug("privateKeyPass: " + privateKeyPass);            privateKey = (PrivateKey)keyStore.getKey(privateKeyAlias, privateKeyPass);            if (privateKey == null) {                error("Cannot load key with alias '"+privateKeyAlias+"' from keystore '"+keyStoreFile+"'");                throw new Exception("Cannot load key with alias '"+privateKeyAlias+"' from keystore '"+keyStoreFile+"'");            }            Certificate[] certchain = keyStore.getCertificateChain(privateKeyAlias);            if (certchain.length < 1) {                error("Cannot load certificate chain with alias '"+privateKeyAlias+"' from keystore '"+keyStoreFile+"'");                throw new Exception("Cannot load certificate chain with alias '"+privateKeyAlias+"' from keystore '"+keyStoreFile+"'");            }            // We only support a ca hierarchy with depth 2.            // TODO:            caCert = (X509Certificate)certchain[0];            TBSCertificateStructure tbs = new TBSCertificateStructure((DERConstructedSequence)new DERInputStream(new ByteArrayInputStream(caCert.getTBSCertificate())).readObject());            caSubjectName=tbs.getSubject();            debug("cacertIssuer: " + caCert.getIssuerDN().toString());            debug("cacertSubject: " + caSubjectName.toString());            // is there only one root cert?            if (CertTools.isSelfSigned(caCert))                rootCert = caCert;            else {                // is root cert in same chain as ca cert?                if (certchain.length > 1)                    rootCert = (X509Certificate)certchain[2];                else {                    String ialias = CertTools.getPartFromDN(caCert.getIssuerDN().toString(), "CN");                    Certificate[] chain1 = keyStore.getCertificateChain(ialias);                    System.out.println("Loaded certificate chain with length "+ chain1.length+" with alias '"+ialias+"'.");                    if (chain1.length == 0) {                        System.out.println("No RootCA certificate found!");                        System.exit(1);                    }                    rootCert = (X509Certificate)chain1[0];                }            }            debug("rootcertIssuer: " + rootCert.getIssuerDN().toString());            debug("rootcertSubject: " + rootCert.getSubjectDN().toString());            if (!CertTools.isSelfSigned(rootCert))                throw new EJBException("Root certificate is not self signed!");            // The validity in days is specified in environment            validity = (Long)lookup("java:comp/env/validity", java.lang.Long.class);            // Should extensions be used? Critical or not?            if ((usebc = (Boolean)lookup("java:comp/env/BasicConstraints", java.lang.Boolean.class)).booleanValue() == true)                bccritical = (Boolean)lookup("java:comp/env/BasicConstraintsCritical", java.lang.Boolean.class);            if ((useku = (Boolean)lookup("java:comp/env/KeyUsage", java.lang.Boolean.class)).booleanValue() == true)                kucritical = (Boolean)lookup("java:comp/env/KeyUsageCritical", java.lang.Boolean.class);            if ((useski = (Boolean)lookup("java:comp/env/SubjectKeyIdentifier", java.lang.Boolean.class)).booleanValue() == true)                skicritical = (Boolean)lookup("java:comp/env/SubjectKeyIdentifierCritical", java.lang.Boolean.class);            if ((useaki = (Boolean)lookup("java:comp/env/AuthorityKeyIdentifier", java.lang.Boolean.class)).booleanValue() == true)                akicritical = (Boolean)lookup("java:comp/env/AuthorityKeyIdentifierCritical", java.lang.Boolean.class);            if ((usecrln = (Boolean)lookup("java:comp/env/CRLNumber", java.lang.Boolean.class)).booleanValue() == true)                crlncritical = (Boolean)lookup("java:comp/env/CRLNumberCritical", java.lang.Boolean.class);            if ((usesan = (Boolean)lookup("java:comp/env/SubjectAlternativeName", java.lang.Boolean.class)).booleanValue() == true)                sancritical = (Boolean)lookup("java:comp/env/SubjectAlternativeNameCritical", java.lang.Boolean.class);            if ((usecrldist = (Boolean)lookup("java:comp/env/CRLDistributionPoint", java.lang.Boolean.class)).booleanValue() == true) {                crldistcritical = (Boolean)lookup("java:comp/env/CRLDistributionPointCritical", java.lang.Boolean.class);                crldisturi = (String)lookup("java:comp/env/CRLDistURI", java.lang.String.class);            }            // Use old style email address in DN? (really deprecated but old habits die hard...)            emailindn = (Boolean)lookup("java:comp/env/EmailInDN", java.lang.Boolean.class);            // The period between CRL issue            crlperiod = (Long)lookup("java:comp/env/CRLPeriod", java.lang.Long.class);            // Should we set user to finished state after generating certificate? Probably means onyl one cert can be issued            // without resetting users state in user DB            finishUser = (Boolean)lookup("java:comp/env/FinishUser", java.lang.Boolean.class);            // Init random number generator for random serialnumbers            random = SecureRandom.getInstance("SHA1PRNG");            // Using this seed we should get a different seed every time.            // We are not concerned about the security of the random bits, only that they are different every time.            // Extracting 64 bit random numbers out of this should give us 2^32 (4 294 967 296) serialnumbers before            // collisions (which are seriously BAD), well anyhow sufficien for pretty large scale installations.            // Design criteria: 1. No counter to keep track on. 2. Multiple thereads can generate numbers at once, in            // a clustered environment etc.            long seed = (new Date().getTime()) + this.hashCode();            random.setSeed(seed);            /* Another possibility is to use SecureRandom's default seeding which is designed to be secure:            * <p>The seed is produced by counting the number of times the VM            * manages to loop in a given period. This number roughly            * reflects the machine load at that point in time.            * The samples are translated using a permutation (s-box)            * and then XORed together. This process is non linear and            * should prevent the samples from "averaging out". The s-box            * was designed to have even statistical distribution; it's specific            * values are not crucial for the security of the seed.            * We also create a number of sleeper threads which add entropy            * to the system by keeping the scheduler busy.            * Twenty such samples should give us roughly 160 bits of randomness.            * <P> These values are gathered in the background by a daemon thread            * thus allowing the system to continue performing it's different            * activites, which in turn add entropy to the random seed.            * <p> The class also gathers miscellaneous system information, some            * machine dependent, some not. This information is then hashed together            * with the 20 seed bytes. */        } catch( Exception e ) {            throw new EJBException(e.toString());        }        debug("<ejbCreate()");    }