@Test public void generateCertRequest() throws Exception { try { tokenCertificateService.generateCertRequest(AUTH_KEY_ID, client, KeyUsageInfo.SIGNING, "ca", new HashMap<>(), null); fail("should throw exception"); } catch (WrongKeyUsageException expected) { } try { tokenCertificateService.generateCertRequest(SIGN_KEY_ID, client, KeyUsageInfo.AUTHENTICATION, "ca", new HashMap<>(), null); fail("should throw exception"); } catch (WrongKeyUsageException expected) { } tokenCertificateService.generateCertRequest(SIGN_KEY_ID, client, KeyUsageInfo.SIGNING, "ca", ImmutableMap.of("O", "baz"), CertificateRequestFormat.DER); }
public GeneratedCertRequestInfo generateCertRequest(String keyId, ClientId memberId, KeyUsageInfo keyUsage, String caName, Map<String, String> subjectFieldValues, CertificateRequestFormat format) throws CertificateAuthorityNotFoundException, ClientNotFoundException, WrongKeyUsageException, KeyNotFoundException, DnFieldHelper.InvalidDnParameterException, ActionNotPossibleException { TokenInfo tokenInfo = tokenService.getTokenForKeyId(keyId); auditDataHelper.put(tokenInfo); KeyInfo key = keyService.getKey(tokenInfo, keyId); auditDataHelper.put(key); auditDataHelper.put(KEY_USAGE, keyUsage); auditDataHelper.put(memberId); if (keyUsage == KeyUsageInfo.SIGNING) { if (!clientService.getLocalClientMemberIds().contains(memberId)) { throw new ClientNotFoundException("client with id " + memberId + ", or subsystem for it, " + NOT_FOUND); } } if (key.getUsage() != null) { if (key.getUsage() != keyUsage) { throw new WrongKeyUsageException(); } } if (keyUsage == KeyUsageInfo.SIGNING) { possibleActionsRuleEngine.requirePossibleKeyAction(PossibleActionEnum.GENERATE_SIGN_CSR, tokenInfo, key); } else { possibleActionsRuleEngine.requirePossibleKeyAction(PossibleActionEnum.GENERATE_AUTH_CSR, tokenInfo, key); } CertificateProfileInfo profile = null; try { profile = certificateAuthorityService.getCertificateProfile(caName, keyUsage, memberId, false); } catch (CertificateProfileInstantiationException e) { throw new DeviationAwareRuntimeException(e, e.getErrorDeviation()); } List<DnFieldValue> dnFieldValues = dnFieldHelper.processDnParameters(profile, subjectFieldValues); String subjectName = dnFieldHelper.createSubjectName(dnFieldValues); auditDataHelper.put(SUBJECT_NAME, subjectName); auditDataHelper.put(CERTIFICATION_SERVICE_NAME, caName); auditDataHelper.put(CSR_FORMAT, format); try { return signerProxyFacade.generateCertRequest(keyId, memberId, keyUsage, subjectName, format); } catch (CodedException e) { throw e; } catch (Exception e) { throw new SignerNotReachableException("Generate cert request failed", e); } }
TokenCertificateService { public GeneratedCertRequestInfo generateCertRequest(String keyId, ClientId memberId, KeyUsageInfo keyUsage, String caName, Map<String, String> subjectFieldValues, CertificateRequestFormat format) throws CertificateAuthorityNotFoundException, ClientNotFoundException, WrongKeyUsageException, KeyNotFoundException, DnFieldHelper.InvalidDnParameterException, ActionNotPossibleException { TokenInfo tokenInfo = tokenService.getTokenForKeyId(keyId); auditDataHelper.put(tokenInfo); KeyInfo key = keyService.getKey(tokenInfo, keyId); auditDataHelper.put(key); auditDataHelper.put(KEY_USAGE, keyUsage); auditDataHelper.put(memberId); if (keyUsage == KeyUsageInfo.SIGNING) { if (!clientService.getLocalClientMemberIds().contains(memberId)) { throw new ClientNotFoundException("client with id " + memberId + ", or subsystem for it, " + NOT_FOUND); } } if (key.getUsage() != null) { if (key.getUsage() != keyUsage) { throw new WrongKeyUsageException(); } } if (keyUsage == KeyUsageInfo.SIGNING) { possibleActionsRuleEngine.requirePossibleKeyAction(PossibleActionEnum.GENERATE_SIGN_CSR, tokenInfo, key); } else { possibleActionsRuleEngine.requirePossibleKeyAction(PossibleActionEnum.GENERATE_AUTH_CSR, tokenInfo, key); } CertificateProfileInfo profile = null; try { profile = certificateAuthorityService.getCertificateProfile(caName, keyUsage, memberId, false); } catch (CertificateProfileInstantiationException e) { throw new DeviationAwareRuntimeException(e, e.getErrorDeviation()); } List<DnFieldValue> dnFieldValues = dnFieldHelper.processDnParameters(profile, subjectFieldValues); String subjectName = dnFieldHelper.createSubjectName(dnFieldValues); auditDataHelper.put(SUBJECT_NAME, subjectName); auditDataHelper.put(CERTIFICATION_SERVICE_NAME, caName); auditDataHelper.put(CSR_FORMAT, format); try { return signerProxyFacade.generateCertRequest(keyId, memberId, keyUsage, subjectName, format); } catch (CodedException e) { throw e; } catch (Exception e) { throw new SignerNotReachableException("Generate cert request failed", e); } } }
TokenCertificateService { public GeneratedCertRequestInfo generateCertRequest(String keyId, ClientId memberId, KeyUsageInfo keyUsage, String caName, Map<String, String> subjectFieldValues, CertificateRequestFormat format) throws CertificateAuthorityNotFoundException, ClientNotFoundException, WrongKeyUsageException, KeyNotFoundException, DnFieldHelper.InvalidDnParameterException, ActionNotPossibleException { TokenInfo tokenInfo = tokenService.getTokenForKeyId(keyId); auditDataHelper.put(tokenInfo); KeyInfo key = keyService.getKey(tokenInfo, keyId); auditDataHelper.put(key); auditDataHelper.put(KEY_USAGE, keyUsage); auditDataHelper.put(memberId); if (keyUsage == KeyUsageInfo.SIGNING) { if (!clientService.getLocalClientMemberIds().contains(memberId)) { throw new ClientNotFoundException("client with id " + memberId + ", or subsystem for it, " + NOT_FOUND); } } if (key.getUsage() != null) { if (key.getUsage() != keyUsage) { throw new WrongKeyUsageException(); } } if (keyUsage == KeyUsageInfo.SIGNING) { possibleActionsRuleEngine.requirePossibleKeyAction(PossibleActionEnum.GENERATE_SIGN_CSR, tokenInfo, key); } else { possibleActionsRuleEngine.requirePossibleKeyAction(PossibleActionEnum.GENERATE_AUTH_CSR, tokenInfo, key); } CertificateProfileInfo profile = null; try { profile = certificateAuthorityService.getCertificateProfile(caName, keyUsage, memberId, false); } catch (CertificateProfileInstantiationException e) { throw new DeviationAwareRuntimeException(e, e.getErrorDeviation()); } List<DnFieldValue> dnFieldValues = dnFieldHelper.processDnParameters(profile, subjectFieldValues); String subjectName = dnFieldHelper.createSubjectName(dnFieldValues); auditDataHelper.put(SUBJECT_NAME, subjectName); auditDataHelper.put(CERTIFICATION_SERVICE_NAME, caName); auditDataHelper.put(CSR_FORMAT, format); try { return signerProxyFacade.generateCertRequest(keyId, memberId, keyUsage, subjectName, format); } catch (CodedException e) { throw e; } catch (Exception e) { throw new SignerNotReachableException("Generate cert request failed", e); } } @Autowired @SuppressWarnings("checkstyle:ParameterNumber")  TokenCertificateService(SignerProxyFacade signerProxyFacade, ClientService clientService,
            CertificateAuthorityService certificateAuthorityService, KeyService keyService, DnFieldHelper dnFieldHelper,
            GlobalConfService globalConfService, GlobalConfFacade globalConfFacade, ClientRepository clientRepository,
            ManagementRequestSenderService managementRequestSenderService, ServerConfService serverConfService,
            PossibleActionsRuleEngine possibleActionsRuleEngine, TokenService tokenService,
            SecurityHelper securityHelper, AuditDataHelper auditDataHelper,
            AuditEventHelper auditEventHelper); }
TokenCertificateService { public GeneratedCertRequestInfo generateCertRequest(String keyId, ClientId memberId, KeyUsageInfo keyUsage, String caName, Map<String, String> subjectFieldValues, CertificateRequestFormat format) throws CertificateAuthorityNotFoundException, ClientNotFoundException, WrongKeyUsageException, KeyNotFoundException, DnFieldHelper.InvalidDnParameterException, ActionNotPossibleException { TokenInfo tokenInfo = tokenService.getTokenForKeyId(keyId); auditDataHelper.put(tokenInfo); KeyInfo key = keyService.getKey(tokenInfo, keyId); auditDataHelper.put(key); auditDataHelper.put(KEY_USAGE, keyUsage); auditDataHelper.put(memberId); if (keyUsage == KeyUsageInfo.SIGNING) { if (!clientService.getLocalClientMemberIds().contains(memberId)) { throw new ClientNotFoundException("client with id " + memberId + ", or subsystem for it, " + NOT_FOUND); } } if (key.getUsage() != null) { if (key.getUsage() != keyUsage) { throw new WrongKeyUsageException(); } } if (keyUsage == KeyUsageInfo.SIGNING) { possibleActionsRuleEngine.requirePossibleKeyAction(PossibleActionEnum.GENERATE_SIGN_CSR, tokenInfo, key); } else { possibleActionsRuleEngine.requirePossibleKeyAction(PossibleActionEnum.GENERATE_AUTH_CSR, tokenInfo, key); } CertificateProfileInfo profile = null; try { profile = certificateAuthorityService.getCertificateProfile(caName, keyUsage, memberId, false); } catch (CertificateProfileInstantiationException e) { throw new DeviationAwareRuntimeException(e, e.getErrorDeviation()); } List<DnFieldValue> dnFieldValues = dnFieldHelper.processDnParameters(profile, subjectFieldValues); String subjectName = dnFieldHelper.createSubjectName(dnFieldValues); auditDataHelper.put(SUBJECT_NAME, subjectName); auditDataHelper.put(CERTIFICATION_SERVICE_NAME, caName); auditDataHelper.put(CSR_FORMAT, format); try { return signerProxyFacade.generateCertRequest(keyId, memberId, keyUsage, subjectName, format); } catch (CodedException e) { throw e; } catch (Exception e) { throw new SignerNotReachableException("Generate cert request failed", e); } } @Autowired @SuppressWarnings("checkstyle:ParameterNumber")  TokenCertificateService(SignerProxyFacade signerProxyFacade, ClientService clientService,
            CertificateAuthorityService certificateAuthorityService, KeyService keyService, DnFieldHelper dnFieldHelper,
            GlobalConfService globalConfService, GlobalConfFacade globalConfFacade, ClientRepository clientRepository,
            ManagementRequestSenderService managementRequestSenderService, ServerConfService serverConfService,
            PossibleActionsRuleEngine possibleActionsRuleEngine, TokenService tokenService,
            SecurityHelper securityHelper, AuditDataHelper auditDataHelper,
            AuditEventHelper auditEventHelper); GeneratedCertRequestInfo generateCertRequest(String keyId, ClientId memberId, KeyUsageInfo keyUsage,
            String caName, Map<String, String> subjectFieldValues, CertificateRequestFormat format); GeneratedCertRequestInfo regenerateCertRequest(String keyId, String csrId, CertificateRequestFormat format); CertificateInfo getCertificateInfo(String hash); CertificateInfo importCertificateFromToken(String hash); void activateCertificate(String hash); void deactivateCertificate(String hash); CertificateInfo importCertificate(byte[] certificateBytes); boolean isAuthCertBytes(byte[] certificateBytes); void registerAuthCert(String hash, String securityServerAddress); void unregisterAuthCert(String hash); void markAuthCertForDeletion(String hash); EnumSet<PossibleActionEnum> getPossibleActionsForCertificate(String hash); EnumSet<PossibleActionEnum> getPossibleActionsForCsr(
            String csrId); void deleteCertificates(List<CertificateInfo> certificateInfos); void deleteCertificate(String hash); String getKeyIdForCertificateHash(String hash); void deleteCsr(String csrId); }
TokenCertificateService { public GeneratedCertRequestInfo generateCertRequest(String keyId, ClientId memberId, KeyUsageInfo keyUsage, String caName, Map<String, String> subjectFieldValues, CertificateRequestFormat format) throws CertificateAuthorityNotFoundException, ClientNotFoundException, WrongKeyUsageException, KeyNotFoundException, DnFieldHelper.InvalidDnParameterException, ActionNotPossibleException { TokenInfo tokenInfo = tokenService.getTokenForKeyId(keyId); auditDataHelper.put(tokenInfo); KeyInfo key = keyService.getKey(tokenInfo, keyId); auditDataHelper.put(key); auditDataHelper.put(KEY_USAGE, keyUsage); auditDataHelper.put(memberId); if (keyUsage == KeyUsageInfo.SIGNING) { if (!clientService.getLocalClientMemberIds().contains(memberId)) { throw new ClientNotFoundException("client with id " + memberId + ", or subsystem for it, " + NOT_FOUND); } } if (key.getUsage() != null) { if (key.getUsage() != keyUsage) { throw new WrongKeyUsageException(); } } if (keyUsage == KeyUsageInfo.SIGNING) { possibleActionsRuleEngine.requirePossibleKeyAction(PossibleActionEnum.GENERATE_SIGN_CSR, tokenInfo, key); } else { possibleActionsRuleEngine.requirePossibleKeyAction(PossibleActionEnum.GENERATE_AUTH_CSR, tokenInfo, key); } CertificateProfileInfo profile = null; try { profile = certificateAuthorityService.getCertificateProfile(caName, keyUsage, memberId, false); } catch (CertificateProfileInstantiationException e) { throw new DeviationAwareRuntimeException(e, e.getErrorDeviation()); } List<DnFieldValue> dnFieldValues = dnFieldHelper.processDnParameters(profile, subjectFieldValues); String subjectName = dnFieldHelper.createSubjectName(dnFieldValues); auditDataHelper.put(SUBJECT_NAME, subjectName); auditDataHelper.put(CERTIFICATION_SERVICE_NAME, caName); auditDataHelper.put(CSR_FORMAT, format); try { return signerProxyFacade.generateCertRequest(keyId, memberId, keyUsage, subjectName, format); } catch (CodedException e) { throw e; } catch (Exception e) { throw new SignerNotReachableException("Generate cert request failed", e); } } @Autowired @SuppressWarnings("checkstyle:ParameterNumber")  TokenCertificateService(SignerProxyFacade signerProxyFacade, ClientService clientService,
            CertificateAuthorityService certificateAuthorityService, KeyService keyService, DnFieldHelper dnFieldHelper,
            GlobalConfService globalConfService, GlobalConfFacade globalConfFacade, ClientRepository clientRepository,
            ManagementRequestSenderService managementRequestSenderService, ServerConfService serverConfService,
            PossibleActionsRuleEngine possibleActionsRuleEngine, TokenService tokenService,
            SecurityHelper securityHelper, AuditDataHelper auditDataHelper,
            AuditEventHelper auditEventHelper); GeneratedCertRequestInfo generateCertRequest(String keyId, ClientId memberId, KeyUsageInfo keyUsage,
            String caName, Map<String, String> subjectFieldValues, CertificateRequestFormat format); GeneratedCertRequestInfo regenerateCertRequest(String keyId, String csrId, CertificateRequestFormat format); CertificateInfo getCertificateInfo(String hash); CertificateInfo importCertificateFromToken(String hash); void activateCertificate(String hash); void deactivateCertificate(String hash); CertificateInfo importCertificate(byte[] certificateBytes); boolean isAuthCertBytes(byte[] certificateBytes); void registerAuthCert(String hash, String securityServerAddress); void unregisterAuthCert(String hash); void markAuthCertForDeletion(String hash); EnumSet<PossibleActionEnum> getPossibleActionsForCertificate(String hash); EnumSet<PossibleActionEnum> getPossibleActionsForCsr(
            String csrId); void deleteCertificates(List<CertificateInfo> certificateInfos); void deleteCertificate(String hash); String getKeyIdForCertificateHash(String hash); void deleteCsr(String csrId);  }