ps.close();
    public void doGet(HttpServletRequest req, HttpServletResponse res)        throws java.io.IOException, ServletException {        log.debug(">doGet()");        String command;        // Keep this for logging.        String remoteAddr = req.getRemoteAddr();        Admin administrator = new Admin(Admin.TYPE_PUBLIC_WEB_USER, remoteAddr);        command = req.getParameter(COMMAND_PROPERTY_NAME);        if (command == null) {            command = "";        }        if (command.equalsIgnoreCase(COMMAND_CRL)) {            try {                ICertificateStoreSessionRemote store = storehome.create();                byte[] crl = store.getLastCRL(administrator);                X509CRL x509crl = CertTools.getCRLfromByteArray(crl);                String dn = CertTools.getIssuerDN(x509crl);                String filename = CertTools.getPartFromDN(dn, "CN") + ".crl";                res.setHeader("Content-disposition", "attachment; filename=" + filename);                res.setContentType("application/x-x509-crl");                res.setContentLength(crl.length);                res.getOutputStream().write(crl);                log.debug("Sent latest CRL to client at " + remoteAddr);            } catch (Exception e) {                PrintStream ps = new PrintStream(res.getOutputStream());                res.sendError(HttpServletResponse.SC_NOT_FOUND, "Error getting latest CRL.");                e.printStackTrace(ps);                log.debug("Error sending latest CRL to " + remoteAddr);                log.debug(e);                return;            }        } else if (command.equalsIgnoreCase(COMMAND_CERT) ||                command.equalsIgnoreCase(COMMAND_LISTCERT)) {            String dn = req.getParameter(SUBJECT_PROPERTY);            if (dn == null) {                res.sendError(HttpServletResponse.SC_BAD_REQUEST,                    "Usage command=cert?subject=<subjectdn>.");                log.debug("Bad request, no 'dn' arg to 'lastcert' or 'listcert' command.");                return;            }            try {                log.debug("Looking for certificates for '" + dn + "'.");                ICertificateStoreSessionRemote store = storehome.create();                Collection certcoll = store.findCertificatesBySubject(administrator, dn);                Object[] certs = certcoll.toArray();                int latestcertno = -1;                if (command.equalsIgnoreCase(COMMAND_CERT)) {                    long maxdate = 0;                    for (int i = 0; i < certs.length; i++) {                        if (i == 0) {                            maxdate = ((X509Certificate) certs[i]).getNotBefore().getTime();                            latestcertno = 0;                        } else if (((X509Certificate) certs[i]).getNotBefore().getTime() > maxdate) {                            maxdate = ((X509Certificate) certs[i]).getNotBefore().getTime();                            latestcertno = i;                        }                    }                    if (latestcertno > -1) {                        byte[] cert = ((X509Certificate) certs[latestcertno]).getEncoded();                        String filename = CertTools.getPartFromDN(dn, "CN") + ".cer";                        res.setHeader("Content-disposition", "attachment; filename=" + filename);                        res.setContentType("application/octet-stream");                        res.setContentLength(cert.length);                        res.getOutputStream().write(cert);                        log.debug("Sent latest certificate for '" + dn + "' to client at " +                            remoteAddr);                    } else {                        res.sendError(HttpServletResponse.SC_NOT_FOUND,                            "No certificate found for requested subject '" + dn + "'.");                        log.debug("No certificate found for '" + dn + "'.");                    }                }                if (command.equalsIgnoreCase(COMMAND_LISTCERT)) {                    res.setContentType("text/html");                    PrintWriter pout = new PrintWriter(res.getOutputStream());                    pout.println("<html><head><title>Certificates for " + dn + "</title></head>");                    pout.println("<body><p>");                    for (int i = 0; i < certs.length; i++) {                        Date notBefore = ((X509Certificate) certs[i]).getNotBefore();                        Date notAfter = ((X509Certificate) certs[i]).getNotAfter();                        String subject = CertTools.getSubjectDN((X509Certificate) certs[i]);                        String issuer = CertTools.getIssuerDN((X509Certificate) certs[i]);                        BigInteger serno = ((X509Certificate) certs[i]).getSerialNumber();                        pout.println("<pre>Subject:" + subject);                        pout.println("Issuer:" + issuer);                        pout.println("NotBefore:" + notBefore.toString());                        pout.println("NotAfter:" + notAfter.toString());                        pout.println("Serial number:" + serno.toString());                        pout.println("</pre>");                        pout.println("<a href=\"certdist?cmd=revoked&issuer=" + issuer + "&serno=" +                            serno.toString() + "\">Check if certificate is revoked</a>");                        pout.println("<hr>");                    }                    if (certs.length == 0) {                        pout.println("No certificates exists for '" + dn + "'.");                    }                    pout.println("</body></html>");                    pout.close();                }            } catch (Exception e) {                PrintStream ps = new PrintStream(res.getOutputStream());                e.printStackTrace(ps);                res.sendError(HttpServletResponse.SC_NOT_FOUND, "Error getting certificates.");                log.debug("Error getting certificates for '" + dn + "' for " + remoteAddr);                log.debug(e);                return;            }        } else if (command.equalsIgnoreCase(COMMAND_NSCACERT) ||                command.equalsIgnoreCase(COMMAND_IECACERT) ||                command.equalsIgnoreCase(COMMAND_CACERT)) {            String lev = req.getParameter(LEVEL_PROPERTY);            int level = 0;            boolean pkcs7 = false;            if (lev != null) {                level = Integer.parseInt(lev);            } else {                pkcs7 = true;            }            // Root CA is level 0, next below root level 1 etc etc, -1 returns chain as PKCS7            try {                ISignSessionRemote ss = signhome.create();                Certificate[] chain = ss.getCertificateChain(administrator);                // chain.length-1 is last cert in chain (root CA)                if ((chain.length - 1 - level) < 0) {                    PrintStream ps = new PrintStream(res.getOutputStream());                    ps.println("No CA certificate of level " + level + "exist.");                    log.debug("No CA certificate of level " + level + "exist.");                    return;                }                X509Certificate cacert = (X509Certificate) chain[chain.length - 1 - level];                String filename = CertTools.getPartFromDN(CertTools.getSubjectDN(cacert), "CN");                if (filename == null) {                    filename = "ca";                }                byte[] enccert = null;                if (pkcs7) {                    enccert = ss.createPKCS7(administrator, null);                } else {                    enccert = cacert.getEncoded();                }                if (command.equalsIgnoreCase(COMMAND_NSCACERT)) {                    res.setContentType("application/x-x509-ca-cert");                    res.setContentLength(enccert.length);                    res.getOutputStream().write(enccert);                    log.debug("Sent CA cert to NS client, len=" + enccert.length + ".");                } else if (command.equalsIgnoreCase(COMMAND_IECACERT)) {                    if (pkcs7) {                        res.setHeader("Content-disposition",                            "attachment; filename=" + filename + ".p7c");                    } else {                        res.setHeader("Content-disposition",                            "attachment; filename=" + filename + ".crt");                    }                    res.setContentType("application/octet-stream");                    res.setContentLength(enccert.length);                    res.getOutputStream().write(enccert);                    log.debug("Sent CA cert to IE client, len=" + enccert.length + ".");                } else if (command.equalsIgnoreCase(COMMAND_CACERT)) {                    byte[] b64cert = Base64.encode(enccert);                    String out;                    if (pkcs7) {                        out = "-----BEGIN PKCS7-----\n";                    } else {                        out = "-----BEGIN CERTIFICATE-----\n";                    }                    out += new String(b64cert);                    if (pkcs7) {                        out += "\n-----END PKCS7-----\n";                    } else {                        out += "\n-----END CERTIFICATE-----\n";                    }                    res.setHeader("Content-disposition", "attachment; filename=" + filename +                        ".pem");                    res.setContentType("application/octet-stream");                    res.setContentLength(out.length());                    res.getOutputStream().write(out.getBytes());                    log.debug("Sent CA cert to client, len=" + out.length() + ".");                } else {                    res.setContentType("text/plain");                    res.getOutputStream().println("Commands=" + COMMAND_NSCACERT + " || " +                        COMMAND_IECACERT + " || " + COMMAND_CACERT);                    return;                }            } catch (Exception e) {                PrintStream ps = new PrintStream(res.getOutputStream());                e.printStackTrace(ps);                res.sendError(HttpServletResponse.SC_NOT_FOUND, "Error getting CA certificates.");                log.debug("Error getting CA certificates.");                log.debug(e);                return;            }        } else if (command.equalsIgnoreCase(COMMAND_REVOKED)) {            String dn = req.getParameter(ISSUER_PROPERTY);            if (dn == null) {                res.sendError(HttpServletResponse.SC_BAD_REQUEST,                    "Usage command=revoked?issuer=<subjectdn>&serno=<serianlnumber>.");                log.debug("Bad request, no 'issuer' arg to 'revoked' command.");                return;            }            String serno = req.getParameter(SERNO_PROPERTY);            if (serno == null) {                res.sendError(HttpServletResponse.SC_BAD_REQUEST,                    "Usage command=revoked?issuer=<subjectdn>&serno=<serianlnumber>.");                log.debug("Bad request, no 'serno' arg to 'revoked' command.");                return;            }            log.debug("Looking for certificate for '" + dn + "' and serno='" + serno + "'.");            try {                ICertificateStoreSessionRemote store = storehome.create();                RevokedCertInfo revinfo = store.isRevoked(administrator, dn, new BigInteger(serno));                res.setContentType("text/html");                PrintWriter pout = new PrintWriter(res.getOutputStream());                pout.println("<html><head><title>Check revocation</title></head>");                pout.println("<body><p>");                if (revinfo != null) {                    pout.println("<h1>REVOKED</h1>");                    pout.println("Certificate with issuer '" + dn + "' and serial number '" +                        serno + "' is revoked");                    pout.println("RevocationDate is '" + revinfo.getRevocationDate() +                        "' and reason '" + revinfo.getReason() + "'.");                } else {                    pout.println("<h1>NOT REVOKED</h1>");                    pout.println("Certificate with issuer '" + dn + "' and serial number '" +                        serno + "' is NOT revoked");                }                pout.println("</body></html>");                pout.close();            } catch (Exception e) {                PrintStream ps = new PrintStream(res.getOutputStream());                e.printStackTrace(ps);                res.sendError(HttpServletResponse.SC_NOT_FOUND, "Error checking revocation.");                log.debug("Error checking revocation for '" + dn + "' with serno '" + serno + "'.");                log.debug(e);                return;            }        } else {            res.setContentType("text/plain");            res.sendError(HttpServletResponse.SC_BAD_REQUEST,                "Commands=lastcert | listcerts | crl | revoked");            return;        }    }