@Test public void testCreateChainBasedOnRootCa() throws NotAnX509CertificateException, RsaException { List<String> subjNames = new ArrayList<String>(); subjNames.add("O=Rackspace hosting,OU=Platform CloudSites,CN=IMD 1"); subjNames.add("O=Rackspace hosting,OU=Platform CloudSites,CN=IMD 2"); subjNames.add("O=Rackspace hosting,OU=Platform CloudSites,CN=IMD 3"); subjNames.add("O=Rackspace hosting,OU=Platform CloudSites,CN=IMD 4"); subjNames.add("O=Rackspace hosting,OU=Platform CloudSites,CN=IMD 5"); subjNames.add("O=Rackspace hosting,OU=Platform CloudSites,C=US,ST=Texas,L=San Antonio,CN=www.rackexp.org"); long now = System.currentTimeMillis(); long hourAgo = 1000L * 60L * 60L; long yearFromNow = 1000L * 60L * 60L * 24L * 364L; Date before = new Date(now - hourAgo); Date after = new Date(now + yearFromNow); List<X509ChainEntry> chain = X509PathBuilder.newChain(rootKey, rootCrt, subjNames, KEY_SIZE, before, after); assertTrue(chain.size() == 6); for (int i = 0; i < chain.size(); i++) { X509CertificateHolder xh = chain.get(i).getX509Holder(); String subj = xh.getSubject().toString(); String expSubj = subjNames.get(i); assertEquals(expSubj, subj); } X509Certificate rootCrtXC = CertUtils.getX509Certificate(rootCrt); assertTrue(CertUtils.isSelfSigned(rootCrtXC)); assertTrue(CertUtils.validateKeyMatchesCrt(rootKey, rootCrt).isEmpty()); assertTrue(CertUtils.validateKeySignsCert(rootKey, rootCrt).isEmpty()); assertTrue(CertUtils.verifyIssuerAndSubjectCert(rootCrt, chain.get(0).getX509Holder()).isEmpty()); for (int i = 1; i < chain.size(); i++) { X509CertificateHolder issuerCrt = chain.get(i - 1).getX509Holder(); X509CertificateHolder subjectCrt = chain.get(i).getX509Holder(); KeyPair issuerKey = chain.get(i - 1).getKey(); KeyPair subjectKey = chain.get(i).getKey(); assertTrue(CertUtils.validateKeyMatchesCrt(subjectKey, subjectCrt).isEmpty()); assertTrue(CertUtils.validateKeySignsCert(issuerKey, subjectCrt).isEmpty()); assertFalse(CertUtils.validateKeySignsCert(issuerKey, rootCrt).isEmpty()); assertTrue(CertUtils.verifyIssuerAndSubjectCert(issuerCrt, subjectCrt).isEmpty()); assertFalse(CertUtils.verifyIssuerAndSubjectCert(subjectCrt, issuerCrt).isEmpty()); StringBuilder pemChain = new StringBuilder(4096); for (X509ChainEntry entry : chain) { pemChain.append(PemUtils.toPemString(entry.getX509Holder())); } X509ChainEntry userEntry = chain.get(chain.size() - 1); KeyPair userKey = userEntry.getKey(); X509CertificateHolder userCrt = userEntry.getX509Holder(); PKCS10CertificationRequest userCsr = userEntry.getCsr(); System.out.printf("chain:\n%s\n\n", pemChain.toString()); System.out.printf("RootCa:\n%s\n\n", PemUtils.toPemString(rootCrt)); System.out.printf("RootKey:\n%s\n\n", PemUtils.toPemString(rootKey)); System.out.printf("userKey:\n%s\n\n", PemUtils.toPemString(userKey)); System.out.printf("userCrt:\n%s\n\n", PemUtils.toPemString(userCrt)); System.out.printf("userCsr:\n%s\n\n", PemUtils.toPemString(userCsr)); } }
public static List<X509ChainEntry> newChain(List<String> subjNames, int keySize, Date notBefore, Date notAfter) throws NotAnX509CertificateException, RsaException { List<X509ChainEntry> chain = new ArrayList<X509ChainEntry>(); String rootSubj = subjNames.get(0); KeyPair rootKey = RSAKeyUtils.genKeyPair(keySize); PKCS10CertificationRequest rootCsr = CsrUtils.newCsr(rootSubj, rootKey, true); Object obj = CertUtils.selfSignCsrCA(rootCsr, rootKey, notBefore, notAfter); if (!(obj instanceof X509CertificateHolder)) { String fmt = "Could not generate X509CertificateObject for subj \"%s\""; String msg = String.format(fmt, rootSubj); throw new NotAnX509CertificateException(msg); } X509CertificateHolder rootCrt = (X509CertificateHolder) obj; chain.add(new X509ChainEntry(rootKey, rootCsr, rootCrt)); List<String> subjNamesForSubChain = new ArrayList<String>(); for (int i = 1; i < subjNames.size(); i++) { subjNamesForSubChain.add(subjNames.get(i)); } chain.addAll(newChain(rootKey, rootCrt, subjNamesForSubChain, keySize, notBefore, notAfter)); return chain; }
X509PathBuilder { public static List<X509ChainEntry> newChain(List<String> subjNames, int keySize, Date notBefore, Date notAfter) throws NotAnX509CertificateException, RsaException { List<X509ChainEntry> chain = new ArrayList<X509ChainEntry>(); String rootSubj = subjNames.get(0); KeyPair rootKey = RSAKeyUtils.genKeyPair(keySize); PKCS10CertificationRequest rootCsr = CsrUtils.newCsr(rootSubj, rootKey, true); Object obj = CertUtils.selfSignCsrCA(rootCsr, rootKey, notBefore, notAfter); if (!(obj instanceof X509CertificateHolder)) { String fmt = "Could not generate X509CertificateObject for subj \"%s\""; String msg = String.format(fmt, rootSubj); throw new NotAnX509CertificateException(msg); } X509CertificateHolder rootCrt = (X509CertificateHolder) obj; chain.add(new X509ChainEntry(rootKey, rootCsr, rootCrt)); List<String> subjNamesForSubChain = new ArrayList<String>(); for (int i = 1; i < subjNames.size(); i++) { subjNamesForSubChain.add(subjNames.get(i)); } chain.addAll(newChain(rootKey, rootCrt, subjNamesForSubChain, keySize, notBefore, notAfter)); return chain; } }
X509PathBuilder { public static List<X509ChainEntry> newChain(List<String> subjNames, int keySize, Date notBefore, Date notAfter) throws NotAnX509CertificateException, RsaException { List<X509ChainEntry> chain = new ArrayList<X509ChainEntry>(); String rootSubj = subjNames.get(0); KeyPair rootKey = RSAKeyUtils.genKeyPair(keySize); PKCS10CertificationRequest rootCsr = CsrUtils.newCsr(rootSubj, rootKey, true); Object obj = CertUtils.selfSignCsrCA(rootCsr, rootKey, notBefore, notAfter); if (!(obj instanceof X509CertificateHolder)) { String fmt = "Could not generate X509CertificateObject for subj \"%s\""; String msg = String.format(fmt, rootSubj); throw new NotAnX509CertificateException(msg); } X509CertificateHolder rootCrt = (X509CertificateHolder) obj; chain.add(new X509ChainEntry(rootKey, rootCsr, rootCrt)); List<String> subjNamesForSubChain = new ArrayList<String>(); for (int i = 1; i < subjNames.size(); i++) { subjNamesForSubChain.add(subjNames.get(i)); } chain.addAll(newChain(rootKey, rootCrt, subjNamesForSubChain, keySize, notBefore, notAfter)); return chain; } X509PathBuilder(); }
X509PathBuilder { public static List<X509ChainEntry> newChain(List<String> subjNames, int keySize, Date notBefore, Date notAfter) throws NotAnX509CertificateException, RsaException { List<X509ChainEntry> chain = new ArrayList<X509ChainEntry>(); String rootSubj = subjNames.get(0); KeyPair rootKey = RSAKeyUtils.genKeyPair(keySize); PKCS10CertificationRequest rootCsr = CsrUtils.newCsr(rootSubj, rootKey, true); Object obj = CertUtils.selfSignCsrCA(rootCsr, rootKey, notBefore, notAfter); if (!(obj instanceof X509CertificateHolder)) { String fmt = "Could not generate X509CertificateObject for subj \"%s\""; String msg = String.format(fmt, rootSubj); throw new NotAnX509CertificateException(msg); } X509CertificateHolder rootCrt = (X509CertificateHolder) obj; chain.add(new X509ChainEntry(rootKey, rootCsr, rootCrt)); List<String> subjNamesForSubChain = new ArrayList<String>(); for (int i = 1; i < subjNames.size(); i++) { subjNamesForSubChain.add(subjNames.get(i)); } chain.addAll(newChain(rootKey, rootCrt, subjNamesForSubChain, keySize, notBefore, notAfter)); return chain; } X509PathBuilder(); static List<X509ChainEntry> newChain(List<String> subjNames, int keySize, Date notBefore, Date notAfter); static List<X509ChainEntry> newChain(KeyPair rootKey, X509CertificateHolder rootCert, List<String> subjNames, int keySize, Date notBefore, Date notAfter); }
X509PathBuilder { public static List<X509ChainEntry> newChain(List<String> subjNames, int keySize, Date notBefore, Date notAfter) throws NotAnX509CertificateException, RsaException { List<X509ChainEntry> chain = new ArrayList<X509ChainEntry>(); String rootSubj = subjNames.get(0); KeyPair rootKey = RSAKeyUtils.genKeyPair(keySize); PKCS10CertificationRequest rootCsr = CsrUtils.newCsr(rootSubj, rootKey, true); Object obj = CertUtils.selfSignCsrCA(rootCsr, rootKey, notBefore, notAfter); if (!(obj instanceof X509CertificateHolder)) { String fmt = "Could not generate X509CertificateObject for subj \"%s\""; String msg = String.format(fmt, rootSubj); throw new NotAnX509CertificateException(msg); } X509CertificateHolder rootCrt = (X509CertificateHolder) obj; chain.add(new X509ChainEntry(rootKey, rootCsr, rootCrt)); List<String> subjNamesForSubChain = new ArrayList<String>(); for (int i = 1; i < subjNames.size(); i++) { subjNamesForSubChain.add(subjNames.get(i)); } chain.addAll(newChain(rootKey, rootCrt, subjNamesForSubChain, keySize, notBefore, notAfter)); return chain; } X509PathBuilder(); static List<X509ChainEntry> newChain(List<String> subjNames, int keySize, Date notBefore, Date notAfter); static List<X509ChainEntry> newChain(KeyPair rootKey, X509CertificateHolder rootCert, List<String> subjNames, int keySize, Date notBefore, Date notAfter);  }