X509v3CertificateBuilder.java

/*
 * Copyright (c) 2011-2012 ICM Uniwersytet Warszawski All rights reserved.
 * See LICENCE.txt file for licensing information.
 * 
 * this work is derived from the implementation copyrighted and licensed as follows:
 * 
 * Copyright (c) 2000 - 2011 The Legion Of The Bouncy Castle (http://www.bouncycastle.org)
 * 
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
 * INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
 * PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE
 * FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
 * TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
 * OTHER DEALINGS IN THE SOFTWARE.
 */
package eu.emi.security.authn.x509.helpers.proxy;

import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.math.BigInteger;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import java.security.NoSuchProviderException;
import java.security.PrivateKey;
import java.security.SecureRandom;
import java.security.Signature;
import java.security.SignatureException;
import java.security.cert.CertificateException;
import java.security.cert.CertificateFactory;
import java.security.cert.CertificateParsingException;
import java.security.cert.X509Certificate;
import java.util.Date;

import org.bouncycastle.asn1.ASN1Encoding;
import org.bouncycastle.asn1.ASN1Object;
import org.bouncycastle.asn1.ASN1EncodableVector;
import org.bouncycastle.asn1.ASN1Primitive;
import org.bouncycastle.asn1.ASN1ObjectIdentifier;
import org.bouncycastle.asn1.DERBitString;
import org.bouncycastle.asn1.ASN1Integer;
import org.bouncycastle.asn1.DERSequence;
import org.bouncycastle.asn1.x500.X500Name;
import org.bouncycastle.asn1.x509.AlgorithmIdentifier;
import org.bouncycastle.asn1.x509.ExtensionsGenerator;
import org.bouncycastle.asn1.x509.SubjectPublicKeyInfo;
import org.bouncycastle.asn1.x509.TBSCertificate;
import org.bouncycastle.asn1.x509.Time;
import org.bouncycastle.asn1.x509.V3TBSCertificateGenerator;

/**
 * Class to produce an X.509 Version 3 certificate. Based on the BC bcmail
 * library and deprecated class of the BC. We don't use BC mail 
 * as adding an another big dependency only for the certificate 
 * creation doesn't make much sense.
 */
public class X509v3CertificateBuilder
{
	private V3TBSCertificateGenerator tbsGen;
	private ExtensionsGenerator extGenerator;

	/**
	 * Create a builder for a version 3 certificate.
	 * 
	 * @param issuer the certificate issuer
	 * @param serial the certificate serial number
	 * @param notBefore the date before which the certificate is not valid
	 * @param notAfter the date after which the certificate is not valid
	 * @param subject the certificate subject
	 * @param publicKeyInfo the info structure for the public key to be associated
	 * with this certificate.
	 */
	public X509v3CertificateBuilder(X500Name issuer, BigInteger serial,
			Date notBefore, Date notAfter, X500Name subject,
			SubjectPublicKeyInfo publicKeyInfo)
	{
		tbsGen = new V3TBSCertificateGenerator();
		tbsGen.setSubject(subject);
		tbsGen.setSerialNumber(new ASN1Integer(serial));
		tbsGen.setIssuer(issuer);
		tbsGen.setStartDate(new Time(notBefore));
		tbsGen.setEndDate(new Time(notAfter));
		tbsGen.setSubject(subject);
		tbsGen.setSubjectPublicKeyInfo(publicKeyInfo);
		extGenerator = new ExtensionsGenerator();
	}

	/**
	 * Add a given extension field for the standard extensions tag (tag 3)
	 * 
	 * @param oid the OID defining the extension type.
	 * @param isCritical true if the extension is critical, false otherwise.
	 * @param value the ASN.1 structure that forms the extension's value.
	 * @return this builder object.
	 * @throws IOException IO exception
	 */
	public X509v3CertificateBuilder addExtension(ASN1ObjectIdentifier oid,
			boolean isCritical, ASN1Object value) throws IOException
	{
		extGenerator.addExtension(oid, isCritical, value);
		return this;
	}

	/**
	 * Generate the certificate, signing it with the provided private key and
	 * using the specified algorithm. 
	 * @param key to be used for signing
	 * @param sigAlg oid and paramters  of the signature alg
	 * @param sigAlgName name of the signature alg
	 * @param provider can be null -> default will be used
	 * @param random can be null -> default will be used
	 * @return generated certificate
	 * @throws InvalidKeyException invalid key exception
	 * @throws CertificateParsingException certificate parsing exception
	 * @throws NoSuchProviderException no such provider exception
	 * @throws NoSuchAlgorithmException no such algorithm exception
	 * @throws SignatureException signature exception
	 * @throws IOException IO exception
	 */
	public X509Certificate build(PrivateKey key, AlgorithmIdentifier sigAlg,
			String sigAlgName, String provider, SecureRandom random) 
			throws InvalidKeyException, CertificateParsingException, 
			NoSuchProviderException, NoSuchAlgorithmException, 
			SignatureException, IOException
	{
		if (sigAlg == null || sigAlgName == null)
			throw new IllegalStateException(
					"no signature algorithm specified");
		if (key == null)
			throw new IllegalStateException(
					"no private key specified");
		tbsGen.setSignature(sigAlg);

		if (!extGenerator.isEmpty())
			tbsGen.setExtensions(extGenerator.generate());

		TBSCertificate toSign = tbsGen.generateTBSCertificate();
		return sign(toSign, sigAlg, sigAlgName, key, provider, random);
	}

	private X509Certificate sign(TBSCertificate toSign, AlgorithmIdentifier sigAlg, 
			String sigAlgName,
			PrivateKey key, String provider, SecureRandom random) 
		throws InvalidKeyException, NoSuchProviderException, NoSuchAlgorithmException, 
		SignatureException, IOException, CertificateParsingException
		
	{
		byte[] signature = calculateSignature(sigAlgName, 
				provider, key, random, toSign);

		ASN1EncodableVector v = new ASN1EncodableVector();
		v.add(toSign);
		v.add(sigAlg.toASN1Primitive());
		v.add(new DERBitString(signature));
		DERSequence derCertificate = new DERSequence(v);
		CertificateFactory factory;
		try
		{
			factory = CertificateFactory.getInstance("X.509");
			ByteArrayInputStream bais = new ByteArrayInputStream(derCertificate.getEncoded(ASN1Encoding.DER));
			return (X509Certificate) factory.generateCertificate(bais);
		} catch (CertificateException e)
		{
			throw new RuntimeException("The generated proxy " +
					"certificate was not parsed by the JDK", e);
		}
	}
	
	private byte[] calculateSignature(String sigName, String provider, PrivateKey key,
			SecureRandom random, ASN1Object object)
			throws IOException, NoSuchProviderException,
			NoSuchAlgorithmException, InvalidKeyException,
			SignatureException
	{
		Signature sig;

		if (provider != null)
			sig = Signature.getInstance(sigName, provider);
		else
			sig = Signature.getInstance(sigName);

		if (random != null)
			sig.initSign(key, random);
		else
			sig.initSign(key);

		sig.update(object.getEncoded(ASN1Encoding.DER));
		return sig.sign();
	}
	
	/**
	 * Extracts the full algorithm identifier from the given certificate.
	 * @param cert input certificate
	 * @return extracted algorithm id
	 * @throws IOException if parameters of the algorithm can not be parsed 
	 */
	public static AlgorithmIdentifier extractAlgorithmId(X509Certificate cert) 
			throws IOException
	{
		String oid = cert.getSigAlgOID();
		byte params[] = cert.getSigAlgParams();
		if (params != null)
		{
			ASN1Primitive derParams = ASN1Primitive.fromByteArray(params);
			return new AlgorithmIdentifier(new ASN1ObjectIdentifier(oid), 
					derParams);
		} else
		{
			return new AlgorithmIdentifier(new ASN1ObjectIdentifier(oid));
		}
	}
}