/*
* Licensed to the Apache Software Foundation (ASF) under one or more
* contributor license agreements. See the NOTICE file distributed with
* this work for additional information regarding copyright ownership.
* The ASF licenses this file to You under the Apache License, Version 2.0
* (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
/**
* @author Vladimir N. Molotkov
* @version $Revision$
*/
package org.apache.harmony.security.tests.support.cert;
import tests.support.resource.Support_Resources;
import java.io.BufferedInputStream;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.math.BigInteger;
import java.security.InvalidAlgorithmParameterException;
import java.security.KeyStore;
import java.security.NoSuchAlgorithmException;
import java.security.cert.CertPath;
import java.security.cert.CertPathBuilder;
import java.security.cert.CertPathBuilderException;
import java.security.cert.CertPathBuilderResult;
import java.security.cert.CertPathParameters;
import java.security.cert.CertPathValidatorException;
import java.security.cert.CertStore;
import java.security.cert.Certificate;
import java.security.cert.CertificateException;
import java.security.cert.CertificateFactory;
import java.security.cert.CollectionCertStoreParameters;
import java.security.cert.PKIXBuilderParameters;
import java.security.cert.PKIXCertPathBuilderResult;
import java.security.cert.PKIXCertPathChecker;
import java.security.cert.PolicyNode;
import java.security.cert.PolicyQualifierInfo;
import java.security.cert.TrustAnchor;
import java.security.cert.X509CertSelector;
import java.security.cert.X509Certificate;
import java.util.ArrayList;
import java.util.Collection;
import java.util.Collections;
import java.util.HashSet;
import java.util.Iterator;
import java.util.List;
import java.util.Set;
/**
* java.security.cert test utilities
*
*/
public class TestUtils {
// Certificate type used during testing
private static final String certType = "X.509";
// Key store type used during testing
private static final String keyStoreType = "BKS";
// The file name prefix to load keystore from
private static final String keyStoreFileName = "test." + keyStoreType
+ ".ks";
//
// The file name suffixes to load keystore from
// *.ks1 - keystore containing untrusted certificates only
// *.ks2 - keystore containing trusted certificates only
// *.ks3 - keystore containing both trusted and untrusted certificates
//
public static final int UNTRUSTED = 1;
public static final int TRUSTED = 2;
public static final int TRUSTED_AND_UNTRUSTED = 3;
//
// Common passwords for all test keystores
//
private final static char[] storepass =
new char[] {'s','t','o','r','e','p','w','d'};
/**
* Creates <code>TrustAnchor</code> instance
* constructed using self signed test certificate
*
* @return <code>TrustAnchor</code> instance
*/
public static TrustAnchor getTrustAnchor() {
CertificateFactory cf = null;
try {
cf = CertificateFactory.getInstance(certType);
} catch (CertificateException e) {
// requested cert type is not available in the
// default provider package or any of the other provider packages
// that were searched
throw new RuntimeException(e);
}
BufferedInputStream bis = null;
try {
bis = new BufferedInputStream(new ByteArrayInputStream(
getEncodedX509Certificate()));
X509Certificate c1 = (X509Certificate)cf.generateCertificate(bis);
return new TrustAnchor(c1, null);
} catch (Exception e) {
// all failures are fatal
throw new RuntimeException(e);
} finally {
if (bis != null) {
try {
bis.close() ;
} catch (IOException ign) {}
}
}
}
/**
* Creates <code>Set</code> of <code>TrustAnchor</code>s
* containing single element (self signed test certificate).
* @return Returns <code>Set</code> of <code>TrustAnchor</code>s
*/
public static Set<TrustAnchor> getTrustAnchorSet() {
TrustAnchor ta = getTrustAnchor();
if (ta == null) {
return null;
}
HashSet<TrustAnchor> set = new HashSet<TrustAnchor>();
if (!set.add(ta)) {
throw new RuntimeException("Could not create trust anchor set");
}
return set;
}
/**
* Creates test <code>KeyStore</code> instance
*
* @param initialize
* Do not initialize returned <code>KeyStore</code> if false
*
* @param testKeyStoreType
* this parameter ignored if <code>initialize</code> is false;
* The following types supported:<br>
* 1 - <code>KeyStore</code> with untrusted certificates only<br>
* 2 - <code>KeyStore</code> with trusted certificates only<br>
* 3 - <code>KeyStore</code> with both trusted and untrusted certificates
*
* @return Returns test <code>KeyStore</code> instance
*/
public static KeyStore getKeyStore(boolean initialize,
int testKeyStoreType) {
BufferedInputStream bis = null;
try {
KeyStore ks = KeyStore.getInstance(keyStoreType);
if (initialize) {
String fileName = keyStoreFileName + testKeyStoreType;
ks.load(Support_Resources.getResourceStream(fileName),
storepass);
}
return ks;
} catch (Exception e) {
throw new RuntimeException(e);
} finally {
if (initialize && bis != null) {
try {
bis.close();
} catch (IOException ign) {}
}
}
}
/**
* Creates <code>List</code> of <code>CollectionCertStores</code>
*
* @return The list created
*
* @throws InvalidAlgorithmParameterException
* @throws NoSuchAlgorithmException
*/
public static List<CertStore> getCollectionCertStoresList()
throws InvalidAlgorithmParameterException,
NoSuchAlgorithmException {
CertStore cs = CertStore.getInstance("Collection",
new CollectionCertStoreParameters());
ArrayList<CertStore> l = new ArrayList<CertStore>();
if (!l.add(cs)) {
throw new RuntimeException("Could not create cert stores list");
}
return l;
}
/**
* Creates stub implementation of the <code>PKIXCertPathChecker</code>
*
* @return Stub implementation of the <code>PKIXCertPathChecker</code>
*/
public static PKIXCertPathChecker getTestCertPathChecker() {
// stub implementation for testing purposes only
return new PKIXCertPathChecker() {
private boolean forward = false;
@SuppressWarnings({"unused", "unchecked"})
public void check(Certificate arg0, Collection arg1)
throws CertPathValidatorException {
}
public Set<String> getSupportedExtensions() {
return null;
}
@SuppressWarnings("unused")
public void init(boolean arg0) throws CertPathValidatorException {
forward = arg0;
}
public boolean isForwardCheckingSupported() {
// just to check this checker state
return forward;
}
};
}
/**
* Creates policy tree stub containing two <code>PolicyNode</code>s
* for testing purposes
*
* @return root <code>PolicyNode</code> of the policy tree
*/
public static PolicyNode getPolicyTree() {
return new PolicyNode() {
final PolicyNode parent = this;
public int getDepth() {
// parent
return 0;
}
public boolean isCritical() {
return false;
}
public String getValidPolicy() {
return null;
}
public PolicyNode getParent() {
return null;
}
public Iterator<PolicyNode> getChildren() {
PolicyNode child = new PolicyNode() {
public int getDepth() {
// child
return 1;
}
public boolean isCritical() {
return false;
}
public String getValidPolicy() {
return null;
}
public PolicyNode getParent() {
return parent;
}
public Iterator<PolicyNode> getChildren() {
return null;
}
public Set<String> getExpectedPolicies() {
return null;
}
public Set<? extends PolicyQualifierInfo> getPolicyQualifiers() {
return null;
}
};
HashSet<PolicyNode> s = new HashSet<PolicyNode>();
s.add(child);
return s.iterator();
}
public Set<String> getExpectedPolicies() {
return null;
}
public Set<? extends PolicyQualifierInfo> getPolicyQualifiers() {
return null;
}
};
}
// X.509 encoded certificate
private static final String ENCODED_X509_CERTIFICATE = "-----BEGIN CERTIFICATE-----\n"
+ "MIIDHTCCAtsCBEFT72swCwYHKoZIzjgEAwUAMHQxCzAJBgNVBAYTAlJVMQwwCgYDVQQIEwNOU08x\n"
+ "FDASBgNVBAcTC05vdm9zaWJpcnNrMQ4wDAYDVQQKEwVJbnRlbDEVMBMGA1UECxMMRFJMIFNlY3Vy\n"
+ "aXR5MRowGAYDVQQDExFWbGFkaW1pciBNb2xvdGtvdjAeFw0wNDA5MjQwOTU2NTlaFw0wNjA1MTcw\n"
+ "OTU2NTlaMHQxCzAJBgNVBAYTAlJVMQwwCgYDVQQIEwNOU08xFDASBgNVBAcTC05vdm9zaWJpcnNr\n"
+ "MQ4wDAYDVQQKEwVJbnRlbDEVMBMGA1UECxMMRFJMIFNlY3VyaXR5MRowGAYDVQQDExFWbGFkaW1p\n"
+ "ciBNb2xvdGtvdjCCAbgwggEsBgcqhkjOOAQBMIIBHwKBgQD9f1OBHXUSKVLfSpwu7OTn9hG3Ujzv\n"
+ "RADDHj+AtlEmaUVdQCJR+1k9jVj6v8X1ujD2y5tVbNeBO4AdNG/yZmC3a5lQpaSfn+gEexAiwk+7\n"
+ "qdf+t8Yb+DtX58aophUPBPuD9tPFHsMCNVQTWhaRMvZ1864rYdcq7/IiAxmd0UgBxwIVAJdgUI8V\n"
+ "IwvMspK5gqLrhAvwWBz1AoGBAPfhoIXWmz3ey7yrXDa4V7l5lK+7+jrqgvlXTAs9B4JnUVlXjrrU\n"
+ "WU/mcQcQgYC0SRZxI+hMKBYTt88JMozIpuE8FnqLVHyNKOCjrh4rs6Z1kW6jfwv6ITVi8ftiegEk\n"
+ "O8yk8b6oUZCJqIPf4VrlnwaSi2ZegHtVJWQBTDv+z0kqA4GFAAKBgQDiNmj9jgWu1ILYqYWcUhNN\n"
+ "8CjjRitf80yWP/s/565wZz3anb2w72jum63mdShDko9eOOOd1hiVuiBnNhSL7D6JfIYBJvNXr1av\n"
+ "Gw583BBv12OBgg0eAW/GRWBn2Ak2JjsoBc5x2c1HAEufakep7T6RoC+n3lqbKPKyHWVdfqQ9KTAL\n"
+ "BgcqhkjOOAQDBQADLwAwLAIUaRS3C9dXcMbrOAhmidFBr7oMvH0CFEC3LUwfLJX5gY8P6uxpkPx3\n"
+ "JDSM\n" + "-----END CERTIFICATE-----\n";
public static byte[] getEncodedX509Certificate() {
return ENCODED_X509_CERTIFICATE.getBytes();
}
/**
* Returns X.509 certificate encoding corresponding to version v1.
*
* Certificate encoding was created by hands according to X.509 Certificate
* ASN.1 notation. The certificate encoding has the following encoded
* field values:<br>
* - version: 1<br>
* - serialNumber: 5<br>
* - issuer: CN=Z<br>
* - notBefore: 13 Dec 1999 14:15:16<br>
* - notAfter: 01 Jan 2000 00:00:00<br>
* - subject: CN=Y<br>
*
* @return X.509 certificate encoding corresponding to version v1.
*/
public static byte[] getX509Certificate_v1() {
return new byte[] {
// Certificate: SEQUENCE
0x30, 0x6B,
//
// TBSCertificate: SEQUENCE {
//
0x30, 0x5C,
// version: [0] EXPLICIT Version DEFAULT v1
(byte) 0xA0, 0x03, 0x02, 0x01, 0x00,
// serialNumber: CertificateSerialNumber
0x02, 0x01, 0x05,
// signature: AlgorithmIdentifier
0x30, 0x07, // SEQUENCE
0x06, 0x02, 0x03, 0x05,//OID
0x01, 0x01, 0x07, //ANY
//issuer: Name
0x30, 0x0C, 0x31, 0x0A, 0x30, 0x08, 0x06, 0x03, 0x55, 0x04, 0x03,
0x13, 0x01, 0x5A, // CN=Z
//validity: Validity
0x30, 0x1E, // SEQUENCE
// notBefore: UTCTime
0x17, 0x0D, 0x39, 0x39, 0x31, 0x32, 0x31, 0x33, 0x31, 0x34, 0x31,
0x35, 0x31, 0x36, 0x5A, // 13 Dec 1999 14:15:16
// notAfter: UTCTime
0x17, 0x0D, 0x30, 0x30, 0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30,
0x30, 0x30, 0x30, 0x5A, // 01 Jan 2000 00:00:00
//subject: Name
0x30, 0x0C, 0x31, 0x0A, 0x30, 0x08, 0x06, 0x03, 0x55, 0x04, 0x03,
0x13, 0x01, 0x59, // CN=Y
//SubjectPublicKeyInfo ::= SEQUENCE {
// algorithm AlgorithmIdentifier,
// subjectPublicKey BIT STRING }
0x30, 0x0D, // SEQUENCE
0x30, 0x07, // SEQUENCE
0x06, 0x02, 0x03, 0x05,//OID
0x01, 0x01, 0x07, //ANY
0x03, 0x02, 0x00, 0x01, // subjectPublicKey
// issuerUniqueID - missed
// subjectUniqueID - missed
// extensions - missed
// } end TBSCertificate
//
// signatureAlgorithm: AlgorithmIdentifier
//
0x30, 0x07, // SEQUENCE
0x06, 0x02, 0x03, 0x05,//OID
0x01, 0x01, 0x07, //ANY
//
// signature: BIT STRING
//
0x03, 0x02, 0x00, 0x01 };
}
/**
* Returns X.509 certificate encoding corresponding to version v3.
*
* Certificate encoding was created by hands according to X.509 Certificate
* ASN.1 notation. The certificate encoding has the following encoded
* field values:<br>
* - version: 3<br>
* - serialNumber: 5<br>
* - issuer: CN=Z<br>
* - notBefore: 13 Dec 1999 14:15:16<br>
* - notAfter: 01 Jan 2000 00:00:00<br>
* - subject: CN=Y<br>
* - extensions:
* 1) AuthorityKeyIdentifier(OID=2.5.29.35): no values in it(empty sequence)
*
* @return X.509 certificate encoding corresponding to version v3.
*/
public static byte[] getX509Certificate_v3() {
return new byte[] {
// Certificate: SEQUENCE
0x30, 0x7D,
//
// TBSCertificate: SEQUENCE {
//
0x30, 0x6E,
// version: [0] EXPLICIT Version DEFAULT v1
(byte) 0xA0, 0x03, 0x02, 0x01, 0x02,
// serialNumber: CertificateSerialNumber
0x02, 0x01, 0x05,
// signature: AlgorithmIdentifier
0x30, 0x07, // SEQUENCE
0x06, 0x02, 0x03, 0x05,//OID
0x01, 0x01, 0x07, //ANY
//issuer: Name
0x30, 0x0C, 0x31, 0x0A, 0x30, 0x08, 0x06, 0x03, 0x55, 0x04, 0x03,
0x13, 0x01, 0x5A, // CN=Z
//validity: Validity
0x30, 0x1E, // SEQUENCE
// notBefore: UTCTime
0x17, 0x0D, 0x39, 0x39, 0x31, 0x32, 0x31, 0x33, 0x31, 0x34, 0x31,
0x35, 0x31, 0x36, 0x5A, // 13 Dec 1999 14:15:16
// notAfter: UTCTime
0x17, 0x0D, 0x30, 0x30, 0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30,
0x30, 0x30, 0x30, 0x5A, // 01 Jan 2000 00:00:00
//subject: Name
0x30, 0x0C, 0x31, 0x0A, 0x30, 0x08, 0x06, 0x03, 0x55, 0x04, 0x03,
0x13, 0x01, 0x59, // CN=Y
//SubjectPublicKeyInfo ::= SEQUENCE {
// algorithm AlgorithmIdentifier,
// subjectPublicKey BIT STRING }
0x30, 0x0D, // SEQUENCE
0x30, 0x07, // SEQUENCE
0x06, 0x02, 0x03, 0x05,//OID
0x01, 0x01, 0x07, //ANY
0x03, 0x02, 0x00, 0x01, // subjectPublicKey
// issuerUniqueID - missed
// subjectUniqueID - missed
// extensions : [3] EXPLICIT Extensions OPTIONAL
(byte) 0xA3, 0x10,
// Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension
0x30, 0x0E,
// Extension ::= SEQUENCE {
// extnID OBJECT IDENTIFIER,
// critical BOOLEAN DEFAULT FALSE,
// extnValue OCTET STRING }
// 1) AuthorityKeyIdentifier extension (see HARMONY-3384)
0x30, 0x0C,
0x06, 0x03, 0x55, 0x1D, 0x23, // OID = 2.5.29.35
0x01, 0x01, 0x00, // critical = FALSE
0x04, 0x02, 0x30, 0x00, // extnValue: MUST be empty sequence
// missed: keyIdentifier
// missed: authorityCertIssuer
// missed" authorityCertSerialNumber
// } end TBSCertificate
//
// signatureAlgorithm: AlgorithmIdentifier
//
0x30, 0x07, // SEQUENCE
0x06, 0x02, 0x03, 0x05,//OID
0x01, 0x01, 0x07, //ANY
//
// signature: BIT STRING
//
0x03, 0x02, 0x00, 0x01 };
}
/**
* Returns X.509 CRL encoding corresponding to version v1.
*
* CRL encoding was created by hands according to X.509 CRL ASN.1
* notation. The CRL encoding has the following encoded field values:<br>
* - version: 1<br>
* - issuer: CN=Z<br>
* - thisUpdate: 01 Jan 2001 01:02:03<br>
*
* @return X.509 CRL encoding corresponding to version v1.
*/
public static byte[] getX509CRL_v1() {
return new byte[] {
//CertificateList: SEQUENCE
0x30, 0x35,
// TBSCertList: SEQUENCE
0x30, 0x27,
// Version: INTEGER OPTIONAL
// 0x02, 0x01, 0x01, - missed here cause it is v1
// signature: AlgorithmIdentifier
0x30, 0x06, // SEQUENCE
0x06, 0x01, 0x01, // OID
0x01, 0x01, 0x11, // ANY
// issuer: Name
0x30, 0x0C, 0x31, 0x0A, 0x30, 0x08, 0x06, 0x03, 0x55, 0x04,
0x03, 0x13, 0x01, 0x5A, // CN=Z
// thisUpdate: ChoiceOfTime
// GeneralizedTime: 01 Jan 2001 01:02:03
0x18, 0x0F, 0x32, 0x30, 0x30, 0x31, 0x30, 0x31, 0x30, 0x31,
0x30, 0x31, 0x30, 0x32, 0x30, 0x33, 0x5A,
// nextUpdate - missed
// revokedCertificates - missed
// crlExtensions - missed
// signatureAlgorithm: AlgorithmIdentifier
0x30, 0x06, // SEQUENCE
0x06, 0x01, 0x01, //OID
0x01, 0x01, 0x11, //ANY
// signature: BIT STRING
0x03, 0x02, 0x00, 0x01 };
}
//--------------------------------------------------------------------------
// Second example
/**
* Certificate:
* <pre>
* $ openssl req -x509 -nodes -days 365 -subj '/C=AN/ST=Android/O=Android/OU=Android/CN=Android/emailAddress=android' -newkey rsa:1024 -keyout root.pem -out root.pem -text -days 36500
* Generating a 1024 bit RSA private key
* ..........................................++++++
* .................++++++
* writing new private key to 'root.pem'
* -----BEGIN RSA PRIVATE KEY-----
* MIICXwIBAAKBgQDKS+qP2kgqYBtwY4QoJ5p0yyEl35sBr2ZKtAWn6SL4vXgvaIrj
* K7vG93CvG239bXfacniGMEBitedBlcqjdPREEY0DQn3jLXyAOd3tnlKcutNH3RjA
* fPlnDWNGKLnDdSd9QZEc0G1MsMg/HrERPm1hMfZQG85zdtbYmi2CJ/jS5wIDAQAB
* AoGBAIZhvdSHjS7RHwkeonjGLh1tnnx5OI/7AzmWsrci8L9JpZ/gk3pq39dBIhLA
* ZuVVpatwJU4GmY65BYEUz0Kb+3JY0PXagypwQKuWs9wb9C0aRnDVy9DNXkbJ+D+L
* DNvyZAG5BNknZapxsFSenR5UO4BY08wIsdBtWD/B7YcMTuvxAkEA9zKP18pJCmku
* TUDTJkonF/fGvI4PvsBm6YFyINb130yGzKJKCcEn5j2Fm+wF+lGY7nmtUIgQekRm
* WkwbjG/v3wJBANGACjKFVIFvuXH6EoyWx90uYw9C8+m2jOtrRaAMfRyUanCvF2Li
* ZYOLThPcxv/QvvQAa7RKJjxsK69Ajm+b3fkCQQCR7xWgTVmlfcbJ8LU265v8uFhp
* RGzjLe8Td0oLPRxWQXVrJXwUGiYV9MgF7ubwim+AifDZlBo2NF9Ae6Hf3M19AkEA
* nJEGDe+a0gj/HHD5f9wHjgLmwTcWNmnZMu8+X3g14DACxCf2YE4183MebLWoevI0
* YwIVe+2WWb21gAnM6RghcQJBALq0RZcYkZoQA8qr9TPuuMzi+fF3Y+4m/pDDcCd5
* zXbsroEZPdWPfAXKT95juW9yKdVzeOZHO1uwRWmQ9ZlPMhY=
* -----END RSA PRIVATE KEY-----
* -----
* Certificate:
* Data:
* Version: 3 (0x2)
* Serial Number:
* 8a:12:37:ed:2d:ad:02:6e
* Signature Algorithm: sha1WithRSAEncryption
* Issuer: C=AN, ST=Android, O=Android, OU=Android, CN=Android/emailAddress=android
* Validity
* Not Before: Oct 4 02:20:28 2010 GMT
* Not After : Sep 10 02:20:28 2110 GMT
* Subject: C=AN, ST=Android, O=Android, OU=Android, CN=Android/emailAddress=android
* Subject Public Key Info:
* Public Key Algorithm: rsaEncryption
* RSA Public Key: (1024 bit)
* Modulus (1024 bit):
* 00:ca:4b:ea:8f:da:48:2a:60:1b:70:63:84:28:27:
* 9a:74:cb:21:25:df:9b:01:af:66:4a:b4:05:a7:e9:
* 22:f8:bd:78:2f:68:8a:e3:2b:bb:c6:f7:70:af:1b:
* 6d:fd:6d:77:da:72:78:86:30:40:62:b5:e7:41:95:
* ca:a3:74:f4:44:11:8d:03:42:7d:e3:2d:7c:80:39:
* dd:ed:9e:52:9c:ba:d3:47:dd:18:c0:7c:f9:67:0d:
* 63:46:28:b9:c3:75:27:7d:41:91:1c:d0:6d:4c:b0:
* c8:3f:1e:b1:11:3e:6d:61:31:f6:50:1b:ce:73:76:
* d6:d8:9a:2d:82:27:f8:d2:e7
* Exponent: 65537 (0x10001)
* X509v3 extensions:
* X509v3 Subject Key Identifier:
* 14:7D:36:ED:63:44:BF:4F:DB:7D:28:96:78:6A:E7:EC:CE:2C:40:BF
* X509v3 Authority Key Identifier:
* keyid:14:7D:36:ED:63:44:BF:4F:DB:7D:28:96:78:6A:E7:EC:CE:2C:40:BF
* DirName:/C=AN/ST=Android/O=Android/OU=Android/CN=Android/emailAddress=android
* serial:8A:12:37:ED:2D:AD:02:6E
*
* X509v3 Basic Constraints:
* CA:TRUE
* Signature Algorithm: sha1WithRSAEncryption
* 7c:f2:84:c0:ee:40:a5:b9:94:85:19:ab:36:02:1d:17:4b:98:
* f9:b9:c8:c5:1a:b0:c1:4f:0f:1d:1c:e8:c4:cf:c7:87:52:19:
* 9e:64:55:35:bb:34:e1:38:2f:27:08:c5:ca:e7:97:02:90:fd:
* 27:cd:8e:5a:08:40:f5:34:ff:70:65:c4:d6:1f:70:4f:d6:2c:
* cb:28:d8:ed:91:b7:eb:35:06:cd:0e:02:a8:51:cd:b7:3e:f9:
* 85:16:97:31:7b:42:4c:cb:6f:de:4b:dd:ae:5e:9d:ef:84:83:
* 89:f9:0f:a6:5f:e4:93:cc:30:b5:e9:1d:f4:08:f4:e6:e9:58:
* 4b:ba
* -----BEGIN CERTIFICATE-----
* MIIDLTCCApagAwIBAgIJAIoSN+0trQJuMA0GCSqGSIb3DQEBBQUAMG0xCzAJBgNV
* BAYTAkFOMRAwDgYDVQQIEwdBbmRyb2lkMRAwDgYDVQQKEwdBbmRyb2lkMRAwDgYD
* VQQLEwdBbmRyb2lkMRAwDgYDVQQDEwdBbmRyb2lkMRYwFAYJKoZIhvcNAQkBFgdh
* bmRyb2lkMCAXDTEwMTAwNDAyMjAyOFoYDzIxMTAwOTEwMDIyMDI4WjBtMQswCQYD
* VQQGEwJBTjEQMA4GA1UECBMHQW5kcm9pZDEQMA4GA1UEChMHQW5kcm9pZDEQMA4G
* A1UECxMHQW5kcm9pZDEQMA4GA1UEAxMHQW5kcm9pZDEWMBQGCSqGSIb3DQEJARYH
* YW5kcm9pZDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAykvqj9pIKmAbcGOE
* KCeadMshJd+bAa9mSrQFp+ki+L14L2iK4yu7xvdwrxtt/W132nJ4hjBAYrXnQZXK
* o3T0RBGNA0J94y18gDnd7Z5SnLrTR90YwHz5Zw1jRii5w3UnfUGRHNBtTLDIPx6x
* ET5tYTH2UBvOc3bW2Jotgif40ucCAwEAAaOB0jCBzzAdBgNVHQ4EFgQUFH027WNE
* v0/bfSiWeGrn7M4sQL8wgZ8GA1UdIwSBlzCBlIAUFH027WNEv0/bfSiWeGrn7M4s
* QL+hcaRvMG0xCzAJBgNVBAYTAkFOMRAwDgYDVQQIEwdBbmRyb2lkMRAwDgYDVQQK
* EwdBbmRyb2lkMRAwDgYDVQQLEwdBbmRyb2lkMRAwDgYDVQQDEwdBbmRyb2lkMRYw
* FAYJKoZIhvcNAQkBFgdhbmRyb2lkggkAihI37S2tAm4wDAYDVR0TBAUwAwEB/zAN
* BgkqhkiG9w0BAQUFAAOBgQB88oTA7kCluZSFGas2Ah0XS5j5ucjFGrDBTw8dHOjE
* z8eHUhmeZFU1uzThOC8nCMXK55cCkP0nzY5aCED1NP9wZcTWH3BP1izLKNjtkbfr
* NQbNDgKoUc23PvmFFpcxe0JMy2/eS92uXp3vhIOJ+Q+mX+STzDC16R30CPTm6VhL
* ug==
* -----END CERTIFICATE-----
* $
* </pre>
*/
public static final String rootCert = ""
+ "-----BEGIN CERTIFICATE-----\n"
+ "MIIDLTCCApagAwIBAgIJAIoSN+0trQJuMA0GCSqGSIb3DQEBBQUAMG0xCzAJBgNV\n"
+ "BAYTAkFOMRAwDgYDVQQIEwdBbmRyb2lkMRAwDgYDVQQKEwdBbmRyb2lkMRAwDgYD\n"
+ "VQQLEwdBbmRyb2lkMRAwDgYDVQQDEwdBbmRyb2lkMRYwFAYJKoZIhvcNAQkBFgdh\n"
+ "bmRyb2lkMCAXDTEwMTAwNDAyMjAyOFoYDzIxMTAwOTEwMDIyMDI4WjBtMQswCQYD\n"
+ "VQQGEwJBTjEQMA4GA1UECBMHQW5kcm9pZDEQMA4GA1UEChMHQW5kcm9pZDEQMA4G\n"
+ "A1UECxMHQW5kcm9pZDEQMA4GA1UEAxMHQW5kcm9pZDEWMBQGCSqGSIb3DQEJARYH\n"
+ "YW5kcm9pZDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAykvqj9pIKmAbcGOE\n"
+ "KCeadMshJd+bAa9mSrQFp+ki+L14L2iK4yu7xvdwrxtt/W132nJ4hjBAYrXnQZXK\n"
+ "o3T0RBGNA0J94y18gDnd7Z5SnLrTR90YwHz5Zw1jRii5w3UnfUGRHNBtTLDIPx6x\n"
+ "ET5tYTH2UBvOc3bW2Jotgif40ucCAwEAAaOB0jCBzzAdBgNVHQ4EFgQUFH027WNE\n"
+ "v0/bfSiWeGrn7M4sQL8wgZ8GA1UdIwSBlzCBlIAUFH027WNEv0/bfSiWeGrn7M4s\n"
+ "QL+hcaRvMG0xCzAJBgNVBAYTAkFOMRAwDgYDVQQIEwdBbmRyb2lkMRAwDgYDVQQK\n"
+ "EwdBbmRyb2lkMRAwDgYDVQQLEwdBbmRyb2lkMRAwDgYDVQQDEwdBbmRyb2lkMRYw\n"
+ "FAYJKoZIhvcNAQkBFgdhbmRyb2lkggkAihI37S2tAm4wDAYDVR0TBAUwAwEB/zAN\n"
+ "BgkqhkiG9w0BAQUFAAOBgQB88oTA7kCluZSFGas2Ah0XS5j5ucjFGrDBTw8dHOjE\n"
+ "z8eHUhmeZFU1uzThOC8nCMXK55cCkP0nzY5aCED1NP9wZcTWH3BP1izLKNjtkbfr\n"
+ "NQbNDgKoUc23PvmFFpcxe0JMy2/eS92uXp3vhIOJ+Q+mX+STzDC16R30CPTm6VhL\n"
+ "ug==\n"
+ "-----END CERTIFICATE-----\n";
/**
* Certificate:
* <pre>
* $ openssl req -nodes -days 365 -subj '/C=AN/ST=Android/L=Android/O=Android/OU=Android/CN=Android Certificate/emailAddress=android' -newkey rsa:1024 -keyout certreq.pem -out certreq.pem -text -days 36500
* Generating a 1024 bit RSA private key
* .......++++++
* ......................++++++
* writing new private key to 'certreq.pem'
* -----
* $ openssl x509 -req -in certreq.pem -CA root.pem -CAcreateserial -out cert.pem -days 36500
* Signature ok
* subject=/C=AN/ST=Android/L=Android/O=Android/OU=Android/CN=Android Certificate/emailAddress=android
* Getting Private key
* $ rm root.srl
* $ openssl rsa -in certreq.pem
* writing RSA key
* -----BEGIN RSA PRIVATE KEY-----
* MIICXQIBAAKBgQDGvQZRB7fsuLvnZ0Sx43sTCkvwv/SEYrzRumyV16OC+lvKGC2X
* lYW9qv7of88hqSVq5823MB+uEP1xZLWaiKkYyEn72RwgV/HqB8KEgGYXEbMKKzUv
* j0D1X8kZ/EDGqsZjFKlk/7sZYcg3UqCcGUiEEszTadhyJ6FcowHM1EhrcQIDAQAB
* AoGAS4CQn8Qw6ewc5wLipDpqDYfB5grnGExys7MBgcPUyPPYX2TkHUye7LnD8gxs
* YrtiDcVW8BuGTZkC0EuUesskgiwGLimNiU3vU3LwH7OvtfUTMdvhv9nd2GFlfiQo
* PfwhITZ85GwhDkhiBBXjToDcNc0ntXVgACNAKU1ZlJyoyukCQQDwsGmD0GwKFtJH
* cGXI+IK0aB+pXjujZJU/Ikg+eTPMSWDsKD6ReZu9uJJc8W36Xiki/No1/NZvj0gB
* MwgIkwh7AkEA02FzaGcWLFSHaRfV1wpx1F3Iuu3X2wWqTzBlhGG9ZDQyy7gWZqHJ
* jElCdajiMnbh0mk62hobYy4FcLuvkkJWAwJBAK7FKpkQaqMY1zAQqZg4+4/MW9E8
* H8oRa14gopzanYYlcj+JKYWw7CnjMERU+yrl3LEPMdQp9/uh6wMT7y1qtqkCQCNG
* mxTsRzYEsUhnkuc9Nfvj3tDbSm+hxWdLw1VRXmLvlx6KTSq5i0IfI7kxAva7Ajq0
* Fv845iMqFfxXRhiZe3MCQQCxD0vLzEBegLQPgiavGXfBnRPrRrXgkuAJg7Fq/1Vt
* 3InSGat3Tv8GW+pCWWVgmV8iQ4wWReg+Bd03SCSP5uAY
* -----END RSA PRIVATE KEY-----
* $ openssl x509 -in cert.pem -text
* Certificate:
* Data:
* Version: 1 (0x0)
* Serial Number:
* 89:34:5f:d5:01:2e:a2:2b
* Signature Algorithm: sha1WithRSAEncryption
* Issuer: C=AN, ST=Android, O=Android, OU=Android, CN=Android/emailAddress=android
* Validity
* Not Before: Oct 4 04:41:54 2010 GMT
* Not After : Sep 10 04:41:54 2110 GMT
* Subject: C=AN, ST=Android, L=Android, O=Android, OU=Android, CN=Android Certificate/emailAddress=android
* Subject Public Key Info:
* Public Key Algorithm: rsaEncryption
* RSA Public Key: (1024 bit)
* Modulus (1024 bit):
* 00:c6:bd:06:51:07:b7:ec:b8:bb:e7:67:44:b1:e3:
* 7b:13:0a:4b:f0:bf:f4:84:62:bc:d1:ba:6c:95:d7:
* a3:82:fa:5b:ca:18:2d:97:95:85:bd:aa:fe:e8:7f:
* cf:21:a9:25:6a:e7:cd:b7:30:1f:ae:10:fd:71:64:
* b5:9a:88:a9:18:c8:49:fb:d9:1c:20:57:f1:ea:07:
* c2:84:80:66:17:11:b3:0a:2b:35:2f:8f:40:f5:5f:
* c9:19:fc:40:c6:aa:c6:63:14:a9:64:ff:bb:19:61:
* c8:37:52:a0:9c:19:48:84:12:cc:d3:69:d8:72:27:
* a1:5c:a3:01:cc:d4:48:6b:71
* Exponent: 65537 (0x10001)
* Signature Algorithm: sha1WithRSAEncryption
* 80:06:54:ba:4c:a2:0d:2e:6b:d5:b0:b1:89:b2:fa:c2:fd:d6:
* 02:ab:74:af:fb:1c:bc:47:43:58:89:57:80:ad:59:79:e9:2e:
* d9:60:a7:a6:0f:9c:10:9f:e1:80:a1:66:19:59:7e:11:28:17:
* 17:0a:1d:e9:8d:78:e8:c2:61:36:03:fc:42:b1:54:bd:28:39:
* 3c:48:fd:3c:79:e7:ca:1a:16:c3:8a:77:42:07:96:14:8c:d2:
* 51:ca:8e:db:b8:82:31:84:5e:3f:68:b1:a5:f0:96:ae:a9:ca:
* 86:f3:01:76:63:98:65:dd:41:81:11:d7:71:c8:ae:17:c7:20:
* e7:22
* -----BEGIN CERTIFICATE-----
* MIICcjCCAdsCCQCJNF/VAS6iKzANBgkqhkiG9w0BAQUFADBtMQswCQYDVQQGEwJB
* TjEQMA4GA1UECBMHQW5kcm9pZDEQMA4GA1UEChMHQW5kcm9pZDEQMA4GA1UECxMH
* QW5kcm9pZDEQMA4GA1UEAxMHQW5kcm9pZDEWMBQGCSqGSIb3DQEJARYHYW5kcm9p
* ZDAgFw0xMDEwMDQwNDQxNTRaGA8yMTEwMDkxMDA0NDE1NFowgYsxCzAJBgNVBAYT
* AkFOMRAwDgYDVQQIEwdBbmRyb2lkMRAwDgYDVQQHEwdBbmRyb2lkMRAwDgYDVQQK
* EwdBbmRyb2lkMRAwDgYDVQQLEwdBbmRyb2lkMRwwGgYDVQQDExNBbmRyb2lkIENl
* cnRpZmljYXRlMRYwFAYJKoZIhvcNAQkBFgdhbmRyb2lkMIGfMA0GCSqGSIb3DQEB
* AQUAA4GNADCBiQKBgQDGvQZRB7fsuLvnZ0Sx43sTCkvwv/SEYrzRumyV16OC+lvK
* GC2XlYW9qv7of88hqSVq5823MB+uEP1xZLWaiKkYyEn72RwgV/HqB8KEgGYXEbMK
* KzUvj0D1X8kZ/EDGqsZjFKlk/7sZYcg3UqCcGUiEEszTadhyJ6FcowHM1EhrcQID
* AQABMA0GCSqGSIb3DQEBBQUAA4GBAIAGVLpMog0ua9WwsYmy+sL91gKrdK/7HLxH
* Q1iJV4CtWXnpLtlgp6YPnBCf4YChZhlZfhEoFxcKHemNeOjCYTYD/EKxVL0oOTxI
* /Tx558oaFsOKd0IHlhSM0lHKjtu4gjGEXj9osaXwlq6pyobzAXZjmGXdQYER13HI
* rhfHIOci
* -----END CERTIFICATE-----
* $
* </pre>
*/
public static final String endCert = ""
+ "-----BEGIN CERTIFICATE-----\n"
+ "MIICcjCCAdsCCQCJNF/VAS6iKzANBgkqhkiG9w0BAQUFADBtMQswCQYDVQQGEwJB\n"
+ "TjEQMA4GA1UECBMHQW5kcm9pZDEQMA4GA1UEChMHQW5kcm9pZDEQMA4GA1UECxMH\n"
+ "QW5kcm9pZDEQMA4GA1UEAxMHQW5kcm9pZDEWMBQGCSqGSIb3DQEJARYHYW5kcm9p\n"
+ "ZDAgFw0xMDEwMDQwNDQxNTRaGA8yMTEwMDkxMDA0NDE1NFowgYsxCzAJBgNVBAYT\n"
+ "AkFOMRAwDgYDVQQIEwdBbmRyb2lkMRAwDgYDVQQHEwdBbmRyb2lkMRAwDgYDVQQK\n"
+ "EwdBbmRyb2lkMRAwDgYDVQQLEwdBbmRyb2lkMRwwGgYDVQQDExNBbmRyb2lkIENl\n"
+ "cnRpZmljYXRlMRYwFAYJKoZIhvcNAQkBFgdhbmRyb2lkMIGfMA0GCSqGSIb3DQEB\n"
+ "AQUAA4GNADCBiQKBgQDGvQZRB7fsuLvnZ0Sx43sTCkvwv/SEYrzRumyV16OC+lvK\n"
+ "GC2XlYW9qv7of88hqSVq5823MB+uEP1xZLWaiKkYyEn72RwgV/HqB8KEgGYXEbMK\n"
+ "KzUvj0D1X8kZ/EDGqsZjFKlk/7sZYcg3UqCcGUiEEszTadhyJ6FcowHM1EhrcQID\n"
+ "AQABMA0GCSqGSIb3DQEBBQUAA4GBAIAGVLpMog0ua9WwsYmy+sL91gKrdK/7HLxH\n"
+ "Q1iJV4CtWXnpLtlgp6YPnBCf4YChZhlZfhEoFxcKHemNeOjCYTYD/EKxVL0oOTxI\n"
+ "/Tx558oaFsOKd0IHlhSM0lHKjtu4gjGEXj9osaXwlq6pyobzAXZjmGXdQYER13HI\n"
+ "rhfHIOci\n"
+ "-----END CERTIFICATE-----\n";
/**
* a self signed certificate
*/
public static X509Certificate rootCertificateSS;
public static X509Certificate endCertificate;
public static MyCRL crl;
public static X509CertSelector theCertSelector;
public static CertPathBuilder builder;
private static CertStore store;
public static void initCertPathSSCertChain() throws CertificateException,
InvalidAlgorithmParameterException, NoSuchAlgorithmException,
IOException {
// create certificates and CRLs
CertificateFactory cf = CertificateFactory.getInstance("X.509");
ByteArrayInputStream bi = new ByteArrayInputStream(rootCert.getBytes());
rootCertificateSS = (X509Certificate) cf.generateCertificate(bi);
bi = new ByteArrayInputStream(endCert.getBytes());
endCertificate = (X509Certificate) cf.generateCertificate(bi);
BigInteger revokedSerialNumber = BigInteger.valueOf(1);
crl = new MyCRL("X.509");
// X509CRL rootCRL = X509CRL;
// X509CRL interCRL = X509CRLExample.createCRL(interCert, interPair
// .getPrivate(), revokedSerialNumber);
// create CertStore to support path building
List<Object> list = new ArrayList<Object>();
list.add(rootCertificateSS);
list.add(endCertificate);
CollectionCertStoreParameters params = new CollectionCertStoreParameters(
list);
store = CertStore.getInstance("Collection", params);
theCertSelector = new X509CertSelector();
theCertSelector.setCertificate(endCertificate);
theCertSelector.setIssuer(endCertificate.getIssuerX500Principal()
.getEncoded());
// build the path
builder = CertPathBuilder.getInstance("PKIX");
}
public static CertPathBuilder getCertPathBuilder() {
if (builder == null) {
throw new RuntimeException(
"Call initCertPathSSCertChain prior to initCertPathSSCertChain");
}
return builder;
}
public static CertPath buildCertPathSSCertChain() throws Exception {
return builder.build(getCertPathParameters()).getCertPath();
}
public static CertPathParameters getCertPathParameters()
throws InvalidAlgorithmParameterException {
if ((rootCertificateSS == null) || (theCertSelector == null)
|| (builder == null)) {
throw new RuntimeException(
"Call initCertPathSSCertChain prior to buildCertPath");
}
PKIXBuilderParameters buildParams = new PKIXBuilderParameters(
Collections.singleton(new TrustAnchor(rootCertificateSS, null)),
theCertSelector);
buildParams.addCertStore(store);
buildParams.setRevocationEnabled(false);
return buildParams;
}
}