@Test(expected = IllegalArgumentException.class) public void testGenerateX509CertificateV3_endEntityCertificate_withBasicConstraintsNotAllowed() throws NoSuchAlgorithmException, NoSuchProviderException, CertificateExpiredException, CertificateNotYetValidException, CertificateException, InvalidKeyException, SignatureException { final DistinguishedName subject = subject(); final X500Principal subjectPrincipal = subject.toX500Principal(); final KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(RSA.name(), BOUNCY_CASTLE); final KeyPair certKeyPair = keyPairGenerator.generateKeyPair(); final CaCert caCert = caCert(); final JcaX509ExtensionUtils extUtils = jcaX509ExtensionUtils(); final ImmutableList<X509CertExtension> x509CertExtensions = ImmutableList.<X509CertExtension>builder() .add(X509CertExtension.builder() .oid(Extension.authorityKeyIdentifier) .value(extUtils.createAuthorityKeyIdentifier(caCert.getCert())) .critical(false) .build() ) .add(X509CertExtension.builder() .oid(Extension.keyUsage) .value(new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyEncipherment)) .critical(true) .build() ) .add(X509CertExtension.builder() .oid(Extension.basicConstraints) .value(new BasicConstraints(false)) .critical(true) .build() ) .build(); final X509V3CertRequest request = new X509V3CertRequest( caCert.cert.getIssuerX500Principal(), BigInteger.ONE, Instant.now(), Instant.ofEpochMilli(System.currentTimeMillis() + (10 * 1000)), subjectPrincipal, certKeyPair.getPublic(), x509CertExtensions ); log.info(String.format("request : %s", request)); final X509Certificate cert = certificateService.generateX509CertificateV3(request, caCert.getPrivateKey()); log.info(String.format("result.getSigAlgName() = %s, result.getVersion() = %s ", cert.getSigAlgName(), cert.getVersion())); assertThat(cert.getVersion(), is(3)); cert.checkValidity(); assertThat(Arrays.areEqual(subjectPrincipal.getEncoded(), cert.getSubjectX500Principal().getEncoded()), is(true)); assertThat(Arrays.areEqual(caCert.getCert().getSubjectX500Principal().getEncoded(), cert.getIssuerX500Principal().getEncoded()), is(true)); cert.verify(caCert.getCert().getPublicKey()); }
@Override public X509Certificate generateX509CertificateV3(@NonNull final X509V3CertRequest request, @NonNull final PrivateKey privateKey) throws CertificateServiceException { final ContentSigner signer = contentSigner(privateKey); final X509v3CertificateBuilder certBuilder = request.x509v3CertificateBuilder(); final X509CertificateHolder certHolder = certBuilder.build(signer); return toX509Certificate(certHolder); }
CertificateServiceImpl implements CertificateService { @Override public X509Certificate generateX509CertificateV3(@NonNull final X509V3CertRequest request, @NonNull final PrivateKey privateKey) throws CertificateServiceException { final ContentSigner signer = contentSigner(privateKey); final X509v3CertificateBuilder certBuilder = request.x509v3CertificateBuilder(); final X509CertificateHolder certHolder = certBuilder.build(signer); return toX509Certificate(certHolder); } }
CertificateServiceImpl implements CertificateService { @Override public X509Certificate generateX509CertificateV3(@NonNull final X509V3CertRequest request, @NonNull final PrivateKey privateKey) throws CertificateServiceException { final ContentSigner signer = contentSigner(privateKey); final X509v3CertificateBuilder certBuilder = request.x509v3CertificateBuilder(); final X509CertificateHolder certHolder = certBuilder.build(signer); return toX509Certificate(certHolder); }  }
CertificateServiceImpl implements CertificateService { @Override public X509Certificate generateX509CertificateV3(@NonNull final X509V3CertRequest request, @NonNull final PrivateKey privateKey) throws CertificateServiceException { final ContentSigner signer = contentSigner(privateKey); final X509v3CertificateBuilder certBuilder = request.x509v3CertificateBuilder(); final X509CertificateHolder certHolder = certBuilder.build(signer); return toX509Certificate(certHolder); }  @Override X509Certificate generateX509CertificateV1(@NonNull final X509V1CertRequest request, @NonNull final PrivateKey privateKey); @Override X509Certificate generateX509CertificateV3(@NonNull final X509V3CertRequest request, @NonNull final PrivateKey privateKey); }
CertificateServiceImpl implements CertificateService { @Override public X509Certificate generateX509CertificateV3(@NonNull final X509V3CertRequest request, @NonNull final PrivateKey privateKey) throws CertificateServiceException { final ContentSigner signer = contentSigner(privateKey); final X509v3CertificateBuilder certBuilder = request.x509v3CertificateBuilder(); final X509CertificateHolder certHolder = certBuilder.build(signer); return toX509Certificate(certHolder); }  @Override X509Certificate generateX509CertificateV1(@NonNull final X509V1CertRequest request, @NonNull final PrivateKey privateKey); @Override X509Certificate generateX509CertificateV3(@NonNull final X509V3CertRequest request, @NonNull final PrivateKey privateKey);  }