@Test public void testCanBeUsedForClientAuthentication() throws Exception { X509Certificate caCertificate = TestCertificatesTools.getTrustedCA(); X509Certificate[] clientCertificates = TestCertificatesTools.getClientCertificateChain(); assertFalse(CertPathUtil.canBeUsedForAuthentication(caCertificate, true)); assertTrue(CertPathUtil.canBeUsedForAuthentication(clientCertificates[0], true)); assertTrue(CertPathUtil.canBeUsedForAuthentication(clientChainExtUsage[0], true)); assertTrue(CertPathUtil.canBeUsedForAuthentication(clientSelfsigned[0], true)); }
public static boolean canBeUsedForAuthentication(X509Certificate cert, boolean client) { if ((cert.getKeyUsage() != null && !cert.getKeyUsage()[KEY_USAGE_SIGNATURE])) { LOGGER.debug("certificate: {}, not for signing!", cert.getSubjectDN()); return false; } try { List<String> list = cert.getExtendedKeyUsage(); if (list != null && !list.isEmpty()) { LOGGER.trace("certificate: {}", cert.getSubjectDN()); final String authentication = client ? CLIENT_AUTHENTICATION : SERVER_AUTHENTICATION; boolean foundUsage = false; for (String extension : list) { LOGGER.trace(" extkeyusage {}", extension); if (authentication.equals(extension)) { foundUsage = true; } } if (!foundUsage) { LOGGER.debug("certificate: {}, not for {}!", cert.getSubjectDN(), client ? "client" : "server"); return false; } } else { LOGGER.debug("certificate: {}, no extkeyusage!", cert.getSubjectDN()); } } catch (CertificateParsingException e) { LOGGER.warn("x509 certificate:", e); } return true; }
CertPathUtil { public static boolean canBeUsedForAuthentication(X509Certificate cert, boolean client) { if ((cert.getKeyUsage() != null && !cert.getKeyUsage()[KEY_USAGE_SIGNATURE])) { LOGGER.debug("certificate: {}, not for signing!", cert.getSubjectDN()); return false; } try { List<String> list = cert.getExtendedKeyUsage(); if (list != null && !list.isEmpty()) { LOGGER.trace("certificate: {}", cert.getSubjectDN()); final String authentication = client ? CLIENT_AUTHENTICATION : SERVER_AUTHENTICATION; boolean foundUsage = false; for (String extension : list) { LOGGER.trace(" extkeyusage {}", extension); if (authentication.equals(extension)) { foundUsage = true; } } if (!foundUsage) { LOGGER.debug("certificate: {}, not for {}!", cert.getSubjectDN(), client ? "client" : "server"); return false; } } else { LOGGER.debug("certificate: {}, no extkeyusage!", cert.getSubjectDN()); } } catch (CertificateParsingException e) { LOGGER.warn("x509 certificate:", e); } return true; } }
CertPathUtil { public static boolean canBeUsedForAuthentication(X509Certificate cert, boolean client) { if ((cert.getKeyUsage() != null && !cert.getKeyUsage()[KEY_USAGE_SIGNATURE])) { LOGGER.debug("certificate: {}, not for signing!", cert.getSubjectDN()); return false; } try { List<String> list = cert.getExtendedKeyUsage(); if (list != null && !list.isEmpty()) { LOGGER.trace("certificate: {}", cert.getSubjectDN()); final String authentication = client ? CLIENT_AUTHENTICATION : SERVER_AUTHENTICATION; boolean foundUsage = false; for (String extension : list) { LOGGER.trace(" extkeyusage {}", extension); if (authentication.equals(extension)) { foundUsage = true; } } if (!foundUsage) { LOGGER.debug("certificate: {}, not for {}!", cert.getSubjectDN(), client ? "client" : "server"); return false; } } else { LOGGER.debug("certificate: {}, no extkeyusage!", cert.getSubjectDN()); } } catch (CertificateParsingException e) { LOGGER.warn("x509 certificate:", e); } return true; }  }
CertPathUtil { public static boolean canBeUsedForAuthentication(X509Certificate cert, boolean client) { if ((cert.getKeyUsage() != null && !cert.getKeyUsage()[KEY_USAGE_SIGNATURE])) { LOGGER.debug("certificate: {}, not for signing!", cert.getSubjectDN()); return false; } try { List<String> list = cert.getExtendedKeyUsage(); if (list != null && !list.isEmpty()) { LOGGER.trace("certificate: {}", cert.getSubjectDN()); final String authentication = client ? CLIENT_AUTHENTICATION : SERVER_AUTHENTICATION; boolean foundUsage = false; for (String extension : list) { LOGGER.trace(" extkeyusage {}", extension); if (authentication.equals(extension)) { foundUsage = true; } } if (!foundUsage) { LOGGER.debug("certificate: {}, not for {}!", cert.getSubjectDN(), client ? "client" : "server"); return false; } } else { LOGGER.debug("certificate: {}, no extkeyusage!", cert.getSubjectDN()); } } catch (CertificateParsingException e) { LOGGER.warn("x509 certificate:", e); } return true; }  static boolean canBeUsedToVerifySignature(X509Certificate cert); static boolean canBeUsedForAuthentication(X509Certificate cert, boolean client); static CertPath generateCertPath(List<X509Certificate> certificateChain); static CertPath generateCertPath(List<X509Certificate> certificateChain, int size); static CertPath generateValidatableCertPath(List<X509Certificate> certificateChain,
			List<X500Principal> certificateAuthorities); static CertPath validateCertificatePath(boolean truncateCertificatePath, CertPath certPath,
			X509Certificate[] trustedCertificates); static List<X509Certificate> toX509CertificatesList(List<? extends Certificate> certificates); static List<X500Principal> toSubjects(List<X509Certificate> certificates); }
CertPathUtil { public static boolean canBeUsedForAuthentication(X509Certificate cert, boolean client) { if ((cert.getKeyUsage() != null && !cert.getKeyUsage()[KEY_USAGE_SIGNATURE])) { LOGGER.debug("certificate: {}, not for signing!", cert.getSubjectDN()); return false; } try { List<String> list = cert.getExtendedKeyUsage(); if (list != null && !list.isEmpty()) { LOGGER.trace("certificate: {}", cert.getSubjectDN()); final String authentication = client ? CLIENT_AUTHENTICATION : SERVER_AUTHENTICATION; boolean foundUsage = false; for (String extension : list) { LOGGER.trace(" extkeyusage {}", extension); if (authentication.equals(extension)) { foundUsage = true; } } if (!foundUsage) { LOGGER.debug("certificate: {}, not for {}!", cert.getSubjectDN(), client ? "client" : "server"); return false; } } else { LOGGER.debug("certificate: {}, no extkeyusage!", cert.getSubjectDN()); } } catch (CertificateParsingException e) { LOGGER.warn("x509 certificate:", e); } return true; }  static boolean canBeUsedToVerifySignature(X509Certificate cert); static boolean canBeUsedForAuthentication(X509Certificate cert, boolean client); static CertPath generateCertPath(List<X509Certificate> certificateChain); static CertPath generateCertPath(List<X509Certificate> certificateChain, int size); static CertPath generateValidatableCertPath(List<X509Certificate> certificateChain,
			List<X500Principal> certificateAuthorities); static CertPath validateCertificatePath(boolean truncateCertificatePath, CertPath certPath,
			X509Certificate[] trustedCertificates); static List<X509Certificate> toX509CertificatesList(List<? extends Certificate> certificates); static List<X500Principal> toSubjects(List<X509Certificate> certificates);  }