Java Examples for org.bouncycastle.openssl.PEMReader

@BeforeClass
public static void keyPair() throws Exception {
    ClassLoader cl = DefaultEntitlementCertServiceAdapterTest.class.getClassLoader();
    InputStream keyStream = cl.getResourceAsStream("test.key");
    PEMReader reader = null;
    keyPair = null;
    try {
        reader = new PEMReader(new InputStreamReader(keyStream));
        keyPair = (KeyPair) reader.readObject();
    } finally {
        if (reader != null) {
            reader.close();
        }
    }
}

public static Object readKey(Reader reader) throws Exception {
    try {
        PEMParser pemParser = new PEMParser(reader);
        try {
            return pemParser.readObject();
        } finally {
            pemParser.close();
        }
    } catch (NoClassDefFoundError e) {
        Class<?> pemReaderClass = Class.forName("org.bouncycastle.openssl.PEMReader");
        PemReader r = (PemReader) pemReaderClass.getConstructor(Reader.class).newInstance(reader);
        try {
            return pemReaderClass.getMethod("readObject").invoke(r);
        } finally {
            r.close();
        }
    }
}

public static X509Certificate verifySignature(final Element securityNode, final XMLSignature sig) throws WSSecurityException, XMLSignatureException, XMLSecurityException {
    final SecurityTokenReference secRef = WSSecurity.getSecurityTokenReference(sig.getKeyInfo());
    final Reference tokenRef = secRef.getReference();
    Element bstDirect = WSSecurityUtil.getElementByWsuId(securityNode.getOwnerDocument(), tokenRef.getURI());
    if (bstDirect == null) {
        bstDirect = WSSecurityUtil.getElementByGenId(securityNode.getOwnerDocument(), tokenRef.getURI());
        if (bstDirect == null) {
            throw new WSSecurityException(WSSecurityException.INVALID_SECURITY, "noCert");
        }
    }
    BinarySecurity token = new BinarySecurity(bstDirect);
    String type = token.getValueType();
    X509Certificate cert = null;
    try {
        if (useBc) {
            Node node = bstDirect.getFirstChild();
            String certStr = ("-----BEGIN CERTIFICATE-----\n" + (node == null || !(node instanceof Text) ? null : ((Text) node).getData()) + "\n-----END CERTIFICATE-----\n");
            ByteArrayInputStream pemByteIn = new ByteArrayInputStream(certStr.getBytes());
            PEMReader in = new PEMReader(new InputStreamReader(pemByteIn));
            try {
                cert = (X509Certificate) in.readObject();
            } catch (Throwable e) {
                LOG.error(e, e);
            }
        } else {
            X509Security x509 = new X509Security(bstDirect);
            byte[] bstToken = x509.getToken();
            CertificateFactory factory = getCertificateFactory();
            cert = (X509Certificate) factory.generateCertificate(new ByteArrayInputStream(bstToken));
        }
    } catch (Exception e) {
        LOG.error(e, e);
        throw new WSSecurityException(WSSecurityException.UNSUPPORTED_SECURITY_TOKEN, "unsupportedBinaryTokenType", new Object[] { type });
    }
    if (!sig.checkSignatureValue(cert)) {
        throw new WSSecurityException(WSSecurityException.FAILED_CHECK);
    }
    verifyReferences(sig);
    return cert;
}

private void loadRSAPair() {
    FileReader fileReader = null;
    PEMReader r = null;
    try {
        fileReader = new FileReader(new File("key.pem"));
        r = new PEMReader(fileReader);
        keyPair = (KeyPair) r.readObject();
    } catch (Exception ex) {
        ex.printStackTrace();
    } finally {
        try {
            if (r != null)
                r.close();
            if (fileReader != null)
                fileReader.close();
        } catch (IOException e) {
            e.printStackTrace();
        }
    }
}

@SuppressWarnings("unchecked")
public Object readPEM(Reader read, String password) throws Exception {
    // NOTE: class not longer available since BC 1.50 :
    // return new PEMReader(read, new BasicPasswordFinder(password)).readObject();
    Class PEMReader = Class.forName("org.bouncycastle.openssl.PEMReader");
    Object pemReader = PEMReader.getConstructor(java.io.Reader.class, PasswordFinder.class).newInstance(read, new BasicPasswordFinder(password));
    return PEMReader.getMethod("readObject").invoke(pemReader);
}

private KeyPair getKeyPair() {
    PEMReader pemReader = new PEMReader(new StringReader(this.getKeyFromFile()));
    KeyPair pair = null;
    try {
        pair = (KeyPair) pemReader.readObject();
    } catch (IOException e) {
        e.printStackTrace();
    } finally {
        IOUtils.closeQuietly(pemReader);
    }
    return pair;
}

@Override
protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
    Provider provider = null;
    if (null == Security.getProvider(BouncyCastleProvider.PROVIDER_NAME)) {
        provider = new BouncyCastleProvider();
        Security.addProvider(provider);
    }
    String serverCertificatePem = request.getParameter("serverCertificate");
    PEMReader pemReader = new PEMReader(new StringReader(serverCertificatePem));
    Object object = pemReader.readObject();
    pemReader.close();
    if (object instanceof X509Certificate) {
        X509Certificate serverCertificate = (X509Certificate) object;
        HttpSession httpSession = request.getSession();
        httpSession.setAttribute("test.be.fedict.eid.applet.model.ChannelBindingServiceBean.serverCertificate", serverCertificate);
    }
    response.sendRedirect("channel-binding.jsp");
    if (null != provider) {
        Security.removeProvider(BouncyCastleProvider.PROVIDER_NAME);
    }
}

public static String getPolicyString(String caCertPath) throws Exception {
    final X509Certificate cert;
    final FileReader fr = new FileReader(caCertPath);
    try {
        Security.addProvider(new BouncyCastleProvider());
        final PEMReader reader = new PEMReader(fr, null, BouncyCastleProvider.PROVIDER_NAME);
        try {
            cert = (X509Certificate) reader.readObject();
        } finally {
            reader.close();
        }
    } finally {
        fr.close();
    }
    // access_id_CA
    final X500Principal subjectDN = cert.getSubjectX500Principal();
    final String DN = subjectDN.getName(X500Principal.RFC2253);
    final String access_id_CA = CertUtil.toGlobusID(DN, false);
    // cond_subjects
    final String signingtarget = EzPzCA.deriveSigningTargetString(cert);
    final String cond_subjectsRFC2253 = EzPzCA.getTargetDNfromSchema(signingtarget, "*");
    final String cond_subjects = CertUtil.toGlobusID(cond_subjectsRFC2253, true);
    final StringBuilder sb = new StringBuilder(PREFIX);
    sb.append("\n\n access_id_CA      X509         '");
    sb.append(access_id_CA);
    sb.append("'\n\n pos_rights        globus        CA:sign\n\n cond_subjects     globus       '\"");
    sb.append(cond_subjects);
    sb.append("\"'\n\n");
    sb.append(SUFFIX);
    return sb.toString();
}

@Override
public Iterable<KeyPair> loadKeys() {
    if (!SecurityUtils.isBouncyCastleRegistered()) {
        throw new IllegalStateException("BouncyCastle must be registered as a JCE provider");
    }
    List<KeyPair> keys = new ArrayList<KeyPair>();
    if (key != null) {
        try {
            URLConnection conn = this.key.openConnection();
            byte[] content = IO.readAsBytes(conn.getInputStream());
            PEMReader r = new PEMReader(new InputStreamReader(new ByteArrayInputStream(content)));
            try {
                Object o = r.readObject();
                if (o instanceof KeyPair) {
                    keys.add((KeyPair) o);
                }
            } finally {
                r.close();
            }
        } catch (Exception e) {
            ExtensionSshMessageKind.ISH0001.format(key, e);
        }
    }
    return keys;
}

public KeyPair[] loadKeys() {
    if (!SecurityUtils.isBouncyCastleRegistered()) {
        throw new IllegalStateException("BouncyCastle must be registered as a JCE provider");
    }
    List<KeyPair> keys = new ArrayList<KeyPair>();
    for (int i = 0; i < files.length; i++) {
        try {
            PEMReader r = new PEMReader(new InputStreamReader(new FileInputStream(files[i])), passwordFinder);
            try {
                Object o = r.readObject();
                if (o instanceof KeyPair) {
                    keys.add((KeyPair) o);
                }
            } finally {
                r.close();
            }
        } catch (Exception e) {
            LogUtils.info(LOG, "Unable to read key {0}: {1}", files[i], e);
        }
    }
    return keys.toArray(new KeyPair[keys.size()]);
}

public static Object fromPem(byte[] pem) throws PemException {
    Object out;
    ByteArrayInputStream bas;
    InputStreamReader isr;
    PEMReader pr;
    if (pem == null) {
        throw new NotAPemObject("byte[] parameter pem in call to PemUtils.fromPem(byte[] pem) was null");
    }
    bas = new ByteArrayInputStream(pem);
    isr = new InputStreamReader(bas);
    pr = new PEMReader(isr);
    try {
        out = pr.readObject();
        pr.close();
        isr.close();
        bas.close();
    } catch (IOException ex) {
        throw new PemException("Could not read PEM data", ex);
    }
    if (out == null) {
        throw new NotAPemObject("Returned obj instance was null in call to Object obj = Object fromPem(bytes[] pem)");
    }
    return out;
}

/**
     * Retrieves delegated credentials from the MyProxy server.
     *
     * @param  credential 
     *         The local GSI credentials to use for authentication.
     *         Can be set to null if no local credentials.
     * @param  params
     *         The parameters for the get operation.
     * @return GSSCredential 
     *         The retrieved delegated credentials.
     * @exception MyProxyException
     *         If an error occurred during the operation.
     */
public GSSCredential retrieve(GSSCredential credential, final GetParams params) throws MyProxyException {
    if (params == null) {
        throw new IllegalArgumentException("params == null");
    }
    if (credential == null) {
        try {
            credential = getAnonymousCredential();
        } catch (GSSException e) {
            throw new MyProxyException("Failed to create anonymous credentials", e);
        }
    }
    String msg = params.makeRequest();
    Socket gsiSocket = null;
    OutputStream out = null;
    InputStream in = null;
    try {
        gsiSocket = getSocket(credential);
        if (credential.getName().isAnonymous()) {
            this.context.requestAnonymity(true);
        }
        out = gsiSocket.getOutputStream();
        in = gsiSocket.getInputStream();
        // send message
        out.write(msg.getBytes());
        out.flush();
        if (logger.isDebugEnabled()) {
            logger.debug("Req sent:" + params);
        }
        // may require authz handshake / without trustedroots
        handleReply(in, out, params.getAuthzCreds(), false);
        // start delegation - generate key pair
        KeyPair keyPair = CertUtil.generateKeyPair("RSA", DEFAULT_KEYBITS);
        BouncyCastleCertProcessingFactory certFactory = BouncyCastleCertProcessingFactory.getDefault();
        byte[] req = null;
        if (credential.getName().isAnonymous()) {
            req = certFactory.createCertificateRequest("CN=ignore", keyPair);
        } else {
            GlobusGSSCredentialImpl pkiCred = (GlobusGSSCredentialImpl) credential;
            req = certFactory.createCertificateRequest(pkiCred.getCertificateChain()[0], keyPair);
        }
        // send the request to server
        out.write(req);
        out.flush();
        // read the number of certificates
        // int size = in.read();
        // if (logger.isDebugEnabled()) {
        //     logger.debug("Reading " + size + " certs");
        // }
        // X509Certificate [] chain = new X509Certificate[size];
        // ---------- CUSTOM PART START ----------
        ArrayList<X509Certificate> chain = new ArrayList<X509Certificate>(1);
        PEMReader pemReader = new PEMReader(new InputStreamReader(in), new PasswordFinder() {

            @Override
            public char[] getPassword() {
                return params.getPassphrase().toCharArray();
            }
        });
        Object obj;
        while ((obj = pemReader.readObject()) != null) {
            if (obj instanceof X509Certificate) {
                X509Certificate cert = (X509Certificate) obj;
                chain.add(cert);
            } else if (obj instanceof KeyPair) {
                keyPair = (KeyPair) obj;
            } else
                logger.debug("unhandled token: " + obj.getClass().getName());
        }
        // ---------- CUSTOM PART END ----------
        //
        //            for (int i=0;i<size;i++) {
        //                chain[i] = certFactory.loadCertificate(in);
        //                System.out.println("Received cert: " + chain[i].getSubjectDN());
        //                // DEBUG: display the cert names
        //                if (logger.isDebugEnabled()) {
        //                    logger.debug("Received cert: " + chain[i].getSubjectDN());
        //                }
        //            }
        //
        //            // get the response
        //            handleReply(in);
        //
        // make sure the private key belongs to the right public key
        // currently only works with RSA keys
        RSAPublicKey pkey = (RSAPublicKey) chain.get(0).getPublicKey();
        RSAPrivateKey prkey = (RSAPrivateKey) keyPair.getPrivate();
        if (!pkey.getModulus().equals(prkey.getModulus())) {
            throw new MyProxyException("Private/Public key mismatch!");
        }
        GlobusCredential newCredential = null;
        newCredential = new GlobusCredential(keyPair.getPrivate(), chain.toArray(new X509Certificate[chain.size()]));
        return new GlobusGSSCredentialImpl(newCredential, GSSCredential.INITIATE_AND_ACCEPT);
    } catch (Exception e) {
        throw new MyProxyException("MyProxy get failed.", e);
    } finally {
        // close socket
        close(out, in, gsiSocket);
    }
}

/**
     * Obtains the fingerprint of the key in the "ab:cd:ef:...:12" format.
     */
public String getFingerprint() throws IOException {
    Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());
    Reader r = new BufferedReader(new StringReader(privateKey.toString()));
    PEMReader pem = new PEMReader(r);
    KeyPair pair = (KeyPair) pem.readObject();
    if (pair == null)
        return null;
    PrivateKey key = pair.getPrivate();
    return digest(key);
}

public static TorPrivateKey createFromPEMBuffer(String buffer) {
    final PEMReader pemReader = new PEMReader(new StringReader(buffer));
    final KeyPair kp = readPEMKeyPair(pemReader);
    if (kp.getPublic() instanceof RSAPublicKey && kp.getPrivate() instanceof RSAPrivateKey)
        return new TorPrivateKey((RSAPrivateKey) kp.getPrivate(), (RSAPublicKey) kp.getPublic());
    else
        throw new TorParsingException("Failed to extract PEM private key");
}

protected KeyPair readKeyPair() throws IOException {
    KeyPair kp = null;
    org.bouncycastle.openssl.PasswordFinder pFinder = makeBouncyPasswordFinder();
    PEMReader r = null;
    Object o = null;
    try {
        for (; ; ) {
            // while the PasswordFinder tells us we should retry
            try {
                r = new PEMReader(new InputStreamReader(new FileInputStream(resource.getDetail())), pFinder);
                o = r.readObject();
            } catch (EncryptionException e) {
                if (pwdf.shouldRetry(resource))
                    continue;
                else
                    throw e;
            } finally {
                Util.closeQuietly(r);
            }
            break;
        }
    } finally {
        PasswordUtils.blankOut(passphrase);
    }
    if (o == null)
        throw new IOException("Could not read key pair from: " + resource);
    if (o instanceof KeyPair)
        kp = (KeyPair) o;
    else
        log.debug("Expected KeyPair, got {}", o);
    return kp;
}

/**
   * @param args
   */
public static void main(String[] args) throws Exception {
    if (args.length < 3) {
        System.err.println("Usage: OSSLoadAgent OSS_URL SECRET_NAME WRAPPED_PASSPHRASE AGENT_AUTH_SOCK [KEY_FILE]");
        System.exit(1);
    }
    SSHAgentClient sshAgent = new SSHAgentClient(args[2]);
    // Get the secret from OSS
    // FIXME ? Provide a way to specify the ssh signing key fingerprint
    byte[] secret = OSSClient.getSecret(args[0], args[1], null);
    // Use the secret to unwrap the passphrase
    byte[] unwrap = CryptoHelper.unwrapBlob(secret, Hex.decode(args[3]));
    String password = new String(unwrap, "UTF-8");
    // Read private keys
    // openssh store it in PEM format		
    List<File> sshKeyFiles;
    if (args.length > 4) {
        sshKeyFiles = new ArrayList<File>(1);
        sshKeyFiles.add(new File(args[4]));
    } else {
        sshKeyFiles = getDefaultsKeyFiles();
    }
    for (File sshKeyFile : sshKeyFiles) {
        Reader fRd = new BufferedReader(new FileReader(sshKeyFile));
        PEMReader pem = new PEMReader(fRd, new DefaultPasswordFinder(password.toCharArray()), "BC");
        Object o;
        try {
            while ((o = pem.readObject()) != null) {
                if (o instanceof KeyPair) {
                    KeyPair kp = (KeyPair) o;
                    // Add the identity in the ssh-agent
                    byte[] keyblob = CryptoHelper.sshPrivateKeyBlobFromKeyPair(kp);
                    System.out.println("Loading " + sshKeyFile.getPath());
                    sshAgent.addIdentity(keyblob, sshKeyFile.getPath());
                }
            }
        } catch (EncryptionException ee) {
            System.err.println("Can't read private key in " + sshKeyFile.getAbsolutePath());
            ee.printStackTrace();
        }
        pem.close();
    }
    System.out.println("Keys in agent:");
    List<SSHKey> identities = sshAgent.requestIdentities();
    for (SSHKey identity : identities) {
        System.out.println(identity);
    }
}

public X509Light create(Reader pemReader) {
    try {
        return create((X509Certificate) new PEMReader(pemReader).readObject());
    } catch (ClassCastException ex) {
        throw new IllegalArgumentException("Given PEM Reader is not a valid X509Certificate PEM", ex);
    } catch (IOException ex) {
        throw new CryptoException("Unable to read X509Certificate from PEM", ex);
    }
}

protected KeyPair[] loadKeys() {
    if (!SecurityUtils.isBouncyCastleRegistered()) {
        throw new IllegalStateException("BouncyCastle must be registered as a JCE provider");
    }
    List<KeyPair> keys = new ArrayList<KeyPair>();
    for (int i = 0; i < files.length; i++) {
        try {
            PEMReader r = new PEMReader(new InputStreamReader(new FileInputStream(files[i])), passwordFinder);
            try {
                Object o = r.readObject();
                if (o instanceof KeyPair) {
                    keys.add((KeyPair) o);
                }
            } finally {
                r.close();
            }
        } catch (Exception e) {
            LOG.info("Unable to read key {}: {}", files[i], e);
        }
    }
    return keys.toArray(new KeyPair[keys.size()]);
}

/** reads RSA or DSA / pem style private key files (viz {@link #toPem(KeyPair)}), extracting also the public key if possible
     * @throws IllegalStateException on errors, in particular {@link PassphraseProblem} if that is the problem */
public static KeyPair readPem(InputStream input, final String passphrase) {
    // TODO cache is only for fallback "reader" strategy (2015-01); delete when Parser confirmed working
    byte[] cache = Streams.readFully(input);
    input = new ByteArrayInputStream(cache);
    try {
        PEMParser pemParser = new PEMParser(new InputStreamReader(input));
        Object object = pemParser.readObject();
        pemParser.close();
        JcaPEMKeyConverter converter = new JcaPEMKeyConverter().setProvider("BC");
        KeyPair kp = null;
        if (object == null) {
            throw new IllegalStateException("PEM parsing failed: missing or invalid data");
        } else if (object instanceof PEMEncryptedKeyPair) {
            if (passphrase == null)
                throw new PassphraseProblem("passphrase required");
            try {
                PEMDecryptorProvider decProv = new JcePEMDecryptorProviderBuilder().build(passphrase.toCharArray());
                kp = converter.getKeyPair(((PEMEncryptedKeyPair) object).decryptKeyPair(decProv));
            } catch (Exception e) {
                Exceptions.propagateIfFatal(e);
                throw new PassphraseProblem("wrong passphrase", e);
            }
        } else if (object instanceof PEMKeyPair) {
            kp = converter.getKeyPair((PEMKeyPair) object);
        } else if (object instanceof PrivateKeyInfo) {
            PrivateKey privKey = converter.getPrivateKey((PrivateKeyInfo) object);
            kp = new KeyPair(null, privKey);
        } else {
            throw new IllegalStateException("PEM parser support missing for: " + object);
        }
        return kp;
    } catch (Exception e) {
        Exceptions.propagateIfFatal(e);
        input = new ByteArrayInputStream(cache);
        try {
            Security.addProvider(new BouncyCastleProvider());
            @SuppressWarnings("deprecation") org.bouncycastle.openssl.PEMReader pr = new org.bouncycastle.openssl.PEMReader(new InputStreamReader(input), new PasswordFinder() {

                public char[] getPassword() {
                    return passphrase != null ? passphrase.toCharArray() : new char[0];
                }
            });
            @SuppressWarnings("deprecation") KeyPair result = (KeyPair) pr.readObject();
            pr.close();
            if (result == null)
                throw Exceptions.propagate(e);
            log.warn("PEMParser failed when deprecated PEMReader succeeded, with " + result + "; had: " + e);
            return result;
        } catch (Exception e2) {
            Exceptions.propagateIfFatal(e2);
            throw Exceptions.propagate(e);
        }
    }
}

/**
     * Convert objects from PEM format, which is used for
     * CA_CERTIFICATE, USER_CERTIFICATE, and USER_PRIVATE_KEY
     * entries.
     */
public static List<Object> convertFromPem(byte[] bytes) throws IOException {
    ByteArrayInputStream bai = new ByteArrayInputStream(bytes);
    Reader reader = new InputStreamReader(bai, Charsets.US_ASCII);
    PEMReader pr = new PEMReader(reader);
    List<Object> result = new ArrayList<Object>();
    Object o;
    while ((o = pr.readObject()) != null) {
        result.add(o);
    }
    pr.close();
    return result;
}

public PrivateKey getPrivateKey(String alias) throws Exception {
    HexEncoder hex = new HexEncoder();
    if (!_initialized || !_isAuth) {
        throw new Exception("UninitializedClauerOrUnauthenticated");
    }
    byte[] block = new byte[10240];
    int nblock = clRunTime.readFirstTypeBlock(this.TYPE_PEM_PRIVATE_KEY, block);
    // System.out.println("alias = " + alias);
    while (nblock != -1) {
        ByteArrayOutputStream bOs = new ByteArrayOutputStream();
        hex.encode(block, 8 + 4 + 1, 20, bOs);
        String id = bOs.toString();
        if (id.equals(alias)) {
            ByteArrayInputStream keyIs = new ByteArrayInputStream(block);
            DataInputStream dis = new DataInputStream(keyIs);
            /* Take out the header */
            dis.readInt();
            dis.readInt();
            dis.read();
            int tam = Integer.reverseBytes(dis.readInt());
            /* Take out irrelevant info */
            for (int i = 0; i < 20; i++) {
                dis.read();
            }
            /* Read certificate information */
            byte[] bkey = new byte[tam];
            dis.read(bkey, 0, tam);
            // KeyFactory rSAKeyFactory = KeyFactory.getInstance("RSA");
            // String bk= new String(bkey);
            // System.out.println("KEY: " + bk );
            Reader fRd = new BufferedReader(new InputStreamReader(new ByteArrayInputStream(bkey)));
            _installBCprovider();
            PEMReader pemRd = new PEMReader(fRd, null);
            Object o;
            o = pemRd.readObject();
            if (o instanceof KeyPair) {
                KeyPair pair = (KeyPair) o;
                // System.out.println(pair.getPublic());
                PrivateKey p = pair.getPrivate();
                return p;
            }
        }
        nblock = clRunTime.readNextTypeBlock(this.TYPE_PEM_PRIVATE_KEY, block, nblock);
    }
    return null;
}

@Nullable
private KeyPair getKeyPair(String privateKeyContent, @Nullable final char[] password) throws IOException {
    InputStream is = new ByteArrayInputStream(privateKeyContent.getBytes());
    BufferedReader reader = new BufferedReader(new InputStreamReader(is));
    PEMReader pemReader = null;
    if (password != null) {
        pemReader = new PEMReader(reader, new PasswordFinder() {

            @Override
            public char[] getPassword() {
                return password;
            }
        });
    } else {
        pemReader = new PEMReader(reader);
    }
    try {
        return (KeyPair) pemReader.readObject();
    } finally {
        reader.close();
        pemReader.close();
    }
}

/**
     * Get the private key
     * 
     * @param privateKey
     * @param keyPassword
     * @return
     * @throws IOException
     */
private static KeyPair readKeyPair(File privateKey, char[] keyPassword) throws IOException {
    FileReader fileReader = new FileReader(privateKey);
    PEMReader r = new PEMReader(fileReader, new DefaultPasswordFinder(keyPassword));
    try {
        return (KeyPair) r.readObject();
    } catch (IOException ex) {
        throw new IOException("The private key could not be decrypted", ex);
    } finally {
        r.close();
        fileReader.close();
    }
}

protected PrivateKey decodePrivateKey(String privateKeyString) {
    PEMReader reader = null;
    if (!_inited)
        init();
    try {
        reader = new PEMReader(new StringReader(privateKeyString));
        return ((KeyPair) reader.readObject()).getPrivate();
    } catch (IOException e) {
        throw ConnectorException.wrap(e);
    } finally {
        try {
            reader.close();
        } catch (Exception e) {
        }
    }
}

public void performTest() throws Exception {
    PasswordFinder pGet = new Password("secret".toCharArray());
    PEMReader pemRd = openPEMResource("test.pem", pGet);
    Object o;
    KeyPair pair;
    while ((o = pemRd.readObject()) != null) {
        if (o instanceof KeyPair) {
        //pair = (KeyPair)o;
        //System.out.println(pair.getPublic());
        //System.out.println(pair.getPrivate());
        } else {
        //System.out.println(o.toString());
        }
    }
    // test bogus lines before begin are ignored.
    pemRd = openPEMResource("extratest.pem", pGet);
    while ((o = pemRd.readObject()) != null) {
        if (!(o instanceof X509Certificate)) {
            fail("wrong object found");
        }
    }
    //
    // pkcs 7 data
    //
    pemRd = openPEMResource("pkcs7.pem", null);
    ContentInfo d = (ContentInfo) pemRd.readObject();
    if (!d.getContentType().equals(CMSObjectIdentifiers.envelopedData)) {
        fail("failed envelopedData check");
    }
    //
    // ECKey
    //
    pemRd = openPEMResource("eckey.pem", null);
    ECNamedCurveParameterSpec spec = (ECNamedCurveParameterSpec) pemRd.readObject();
    pair = (KeyPair) pemRd.readObject();
    Signature sgr = Signature.getInstance("ECDSA", "BC");
    sgr.initSign(pair.getPrivate());
    byte[] message = new byte[] { (byte) 'a', (byte) 'b', (byte) 'c' };
    sgr.update(message);
    byte[] sigBytes = sgr.sign();
    sgr.initVerify(pair.getPublic());
    sgr.update(message);
    if (!sgr.verify(sigBytes)) {
        fail("EC verification failed");
    }
    if (!pair.getPublic().getAlgorithm().equals("ECDSA")) {
        fail("wrong algorithm name on public got: " + pair.getPublic().getAlgorithm());
    }
    if (!pair.getPrivate().getAlgorithm().equals("ECDSA")) {
        fail("wrong algorithm name on private");
    }
    //
    // writer/parser test
    //
    KeyPairGenerator kpGen = KeyPairGenerator.getInstance("RSA", "BC");
    pair = kpGen.generateKeyPair();
    keyPairTest("RSA", pair);
    kpGen = KeyPairGenerator.getInstance("DSA", "BC");
    kpGen.initialize(512, new SecureRandom());
    pair = kpGen.generateKeyPair();
    keyPairTest("DSA", pair);
    //
    // PKCS7
    //
    ByteArrayOutputStream bOut = new ByteArrayOutputStream();
    PEMWriter pWrt = new PEMWriter(new OutputStreamWriter(bOut));
    pWrt.writeObject(d);
    pWrt.close();
    pemRd = new PEMReader(new InputStreamReader(new ByteArrayInputStream(bOut.toByteArray())));
    d = (ContentInfo) pemRd.readObject();
    if (!d.getContentType().equals(CMSObjectIdentifiers.envelopedData)) {
        fail("failed envelopedData recode check");
    }
    // OpenSSL test cases (as embedded resources)
    doOpenSslDsaTest("unencrypted");
    doOpenSslRsaTest("unencrypted");
    doOpenSslTests("aes128");
    doOpenSslTests("aes192");
    doOpenSslTests("aes256");
    doOpenSslTests("blowfish");
    doOpenSslTests("des1");
    doOpenSslTests("des2");
    doOpenSslTests("des3");
    doOpenSslTests("rc2_128");
    doOpenSslDsaTest("rc2_40_cbc");
    doOpenSslRsaTest("rc2_40_cbc");
    doOpenSslDsaTest("rc2_64_cbc");
    doOpenSslRsaTest("rc2_64_cbc");
    doDudPasswordTest("7fd98", 0, "corrupted stream - out of bounds length found");
    doDudPasswordTest("ef677", 1, "corrupted stream - out of bounds length found");
    doDudPasswordTest("800ce", 2, "unknown tag 26 encountered");
    doDudPasswordTest("b6cd8", 3, "DEF length 81 object truncated by 56");
    doDudPasswordTest("28ce09", 4, "DEF length 110 object truncated by 28");
    doDudPasswordTest("2ac3b9", 5, "DER length more than 4 bytes: 11");
    doDudPasswordTest("2cba96", 6, "DEF length 100 object truncated by 35");
    doDudPasswordTest("2e3354", 7, "DEF length 42 object truncated by 9");
    doDudPasswordTest("2f4142", 8, "DER length more than 4 bytes: 14");
    doDudPasswordTest("2fe9bb", 9, "DER length more than 4 bytes: 65");
    doDudPasswordTest("3ee7a8", 10, "DER length more than 4 bytes: 57");
    doDudPasswordTest("41af75", 11, "unknown tag 16 encountered");
    doDudPasswordTest("1704a5", 12, "corrupted stream detected");
    doDudPasswordTest("1c5822", 13, "unknown object in getInstance: org.bouncycastle.asn1.DERUTF8String");
    doDudPasswordTest("5a3d16", 14, "corrupted stream detected");
    doDudPasswordTest("8d0c97", 15, "corrupted stream detected");
    doDudPasswordTest("bc0daf", 16, "corrupted stream detected");
    doDudPasswordTest("aaf9c4d", 17, "corrupted stream - out of bounds length found");
    doNoPasswordTest();
    // encrypted private key test
    pGet = new Password("password".toCharArray());
    pemRd = openPEMResource("enckey.pem", pGet);
    RSAPrivateCrtKey privKey = (RSAPrivateCrtKey) pemRd.readObject();
    if (!privKey.getPublicExponent().equals(new BigInteger("10001", 16))) {
        fail("decryption of private key data check failed");
    }
    // general PKCS8 test
    pGet = new Password("password".toCharArray());
    pemRd = openPEMResource("pkcs8test.pem", pGet);
    while ((privKey = (RSAPrivateCrtKey) pemRd.readObject()) != null) {
        if (!privKey.getPublicExponent().equals(new BigInteger("10001", 16))) {
            fail("decryption of private key data check failed");
        }
    }
}

public static PrivateKey loadPrivKeyFromFile(String filename) {
    Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());
    try {
        FileReader fr = new FileReader(filename);
        PEMReader pr = new PEMReader(fr);
        KeyPair key = (KeyPair) (pr.readObject());
        pr.close();
        fr.close();
        return key.getPrivate();
    } catch (Exception e) {
        e.printStackTrace();
        return null;
    }
}

public static String getPolicyString(String caCertPath) throws Exception {
    final X509Certificate cert;
    final FileReader fr = new FileReader(caCertPath);
    try {
        Security.addProvider(new BouncyCastleProvider());
        final PEMReader reader = new PEMReader(fr, null, BouncyCastleProvider.PROVIDER_NAME);
        try {
            cert = (X509Certificate) reader.readObject();
        } finally {
            reader.close();
        }
    } finally {
        fr.close();
    }
    // access_id_CA
    final X500Principal subjectDN = cert.getSubjectX500Principal();
    final String DN = subjectDN.getName(X500Principal.RFC2253);
    final String access_id_CA = CertUtil.toGlobusID(DN, false);
    // cond_subjects
    final String signingtarget = EzPzCA.deriveSigningTargetString(cert);
    final String cond_subjectsRFC2253 = EzPzCA.getTargetDNfromSchema(signingtarget, "*");
    final String cond_subjects = CertUtil.toGlobusID(cond_subjectsRFC2253, true);
    final StringBuilder sb = new StringBuilder(PREFIX);
    sb.append("\n\n access_id_CA      X509         '");
    sb.append(access_id_CA);
    sb.append("'\n\n pos_rights        globus        CA:sign\n\n cond_subjects     globus       '\"");
    sb.append(cond_subjects);
    sb.append("\"'\n\n");
    sb.append(SUFFIX);
    return sb.toString();
}

protected PrivateKey decodePrivateKey(String privateKeyString) {
    PEMReader reader = null;
    if (!_inited)
        init();
    try {
        reader = new PEMReader(new StringReader(privateKeyString));
        return ((KeyPair) reader.readObject()).getPrivate();
    } catch (IOException e) {
        throw ConnectorException.wrap(e);
    } finally {
        try {
            reader.close();
        } catch (Exception e) {
        }
    }
}

private PrivateKey initializePrivateKey(File file) {
    try {
        PEMReader reader = null;
        try {
            Reader fileReader = new FileReader(file);
            reader = new PEMReader(fileReader);
            KeyPair keyPair = (KeyPair) reader.readObject();
            return keyPair.getPrivate();
        } catch (Exception e) {
            throw new IllegalArgumentException("Invalid private key: ", e);
        } finally {
            reader.close();
        }
    } catch (Exception e) {
        throw new RuntimeException(e);
    }
}

private KeyPair stringToKeyPair(String keyPairString) throws IOException {
    StringReader stringReader = new StringReader(keyPairString);
    PEMReader pemReader = new PEMReader(stringReader);
    Object obj = pemReader.readObject();
    if (obj instanceof KeyPair) {
        return (KeyPair) obj;
    } else {
        throw new IOException("Reader did not produce a key pair but an object of type " + obj.getClass().getName());
    }
}

/**
     * Convert objects from PEM format, which is used for
     * CA_CERTIFICATE, USER_CERTIFICATE, and USER_PRIVATE_KEY
     * entries.
     */
public static List<Object> convertFromPem(byte[] bytes) throws IOException {
    ByteArrayInputStream bai = new ByteArrayInputStream(bytes);
    Reader reader = new InputStreamReader(bai, Charsets.US_ASCII);
    PEMReader pr = new PEMReader(reader);
    List<Object> result = new ArrayList<Object>();
    Object o;
    while ((o = pr.readObject()) != null) {
        result.add(o);
    }
    pr.close();
    return result;
}

/**
     * Reads the <b>first</b> available PEM encoded private key (PKCS1 and PKCS8
     * format) from an input stream.
     * 
     * @param is
     *            the input stream
     * @param password
     *            the password of the private key if encrypted, can be
     *            <code>null</code> if the key is not encrypted
     * @return the private key
     * @throws IOException
     *             if an error occurs while parsing the input stream
     */
protected PrivateKey readPrivateKey(InputStream is, String password) throws IOException {
    Reader inputStreamReader = new InputStreamReader(is);
    PEMReader reader = new PEMReader(inputStreamReader, new PEMPassword(password));
    KeyPair keyPair;
    Object object = null;
    do {
        object = reader.readObject();
        if (object == null) {
            String error = "No KeyPair or PrivateKey object found";
            log.error(error);
            throw new IOException(error);
        }
    } while (!(object instanceof KeyPair || object instanceof PrivateKey));
    log.debug("Object type: " + object.getClass().getCanonicalName());
    try {
        reader.close();
    } catch (Exception e) {
    }
    if (object instanceof KeyPair) {
        keyPair = (KeyPair) object;
        return keyPair.getPrivate();
    } else if (object instanceof PrivateKey) {
        return (PrivateKey) object;
    } else {
        String error = "Unknown object type: " + object.getClass().getName();
        log.error(error);
        throw new IOException(error);
    }
}

/**Reads a certificate from a stream and returns it
     */
public X509Certificate readCertificate(InputStream certStream, Provider provider) throws CertificateException {
    CertificateFactory factory;
    X509Certificate cert = null;
    try {
        if (provider != null) {
            factory = CertificateFactory.getInstance("X.509", provider);
            cert = (X509Certificate) factory.generateCertificate(certStream);
        }
        //Let the default provider parsing the certificate
        if (provider == null || cert == null) {
            factory = CertificateFactory.getInstance("X.509");
            cert = (X509Certificate) factory.generateCertificate(certStream);
        }
        //still no success, perhaps PEM encoding? Start the PEM reader and see if it could read the cert
        if (cert == null) {
            PEMReader pemReader = new PEMReader(new InputStreamReader(certStream));
            cert = (X509Certificate) pemReader.readObject();
        }
    } catch (Exception e) {
        throw new CertificateException("Not a certificate or unsupported encoding.");
    }
    if (cert != null) {
        return (cert);
    } else {
        throw new CertificateException("Not a certificate or unsupported encoding.");
    }
}

public static KeyPair getPrivateKeyFromStream(InputStream stream, final String passphrase) throws IOException {
    PEMReader reader;
    if (passphrase == null)
        reader = new PEMReader(new InputStreamReader(stream));
    else
        reader = new PEMReader(new InputStreamReader(stream), new PasswordFinder() {

            @Override
            public char[] getPassword() {
                return passphrase.toCharArray();
            }
        });
    return (KeyPair) reader.readObject();
}

/**
   * Reads a certificate from an input stream for a given provider
   * @param input the input stream
   * @param provider the certificate provider
   * @return the certificate
   * @throws CertificateException
   * @throws IOException
   */
public X509Certificate read(InputStream input, Provider provider) throws CertificateException, IOException {
    X509Certificate certificate;
    certificate = (X509Certificate) CertificateFactory.getInstance("X.509", provider).generateCertificate(input);
    if (certificate == null) {
        certificate = (X509Certificate) (new PEMReader(new InputStreamReader(input))).readObject();
    }
    return certificate;
}

/**
   * Reads a certificate from an input stream for a given provider
   * @param input the input stream
   * @param provider the certificate provider
   * @return the certificate
   * @throws CertificateException
   * @throws IOException
   */
public X509Certificate read(InputStream input, Provider provider) throws CertificateException, IOException {
    X509Certificate certificate;
    certificate = (X509Certificate) CertificateFactory.getInstance("X.509", provider).generateCertificate(input);
    if (certificate == null) {
        certificate = (X509Certificate) (new PEMReader(new InputStreamReader(input))).readObject();
    }
    return certificate;
}

/**
     * Convert objects from PEM format, which is used for
     * CA_CERTIFICATE, USER_CERTIFICATE, and USER_PRIVATE_KEY
     * entries.
     */
public static List<Object> convertFromPem(byte[] bytes) throws IOException {
    ByteArrayInputStream bai = new ByteArrayInputStream(bytes);
    Reader reader = new InputStreamReader(bai, Charsets.US_ASCII);
    PEMReader pr = new PEMReader(reader);
    List<Object> result = new ArrayList<Object>();
    Object o;
    while ((o = pr.readObject()) != null) {
        result.add(o);
    }
    pr.close();
    return result;
}

private KeyStore loadCAsFromPath() throws AuthenticationException {
    try {
        File CADir = new File(CAPath);
        if (!CADir.isDirectory()) {
            throw new AuthenticationException("'" + CAPath + "' is not a directory.");
        }
        FilenameFilter fileNameFilter = new FilenameFilter() {

            @Override
            public boolean accept(File dir, String name) {
                if (name.lastIndexOf('.') > 0) {
                    int lastIndex = name.lastIndexOf('.');
                    String str = name.substring(lastIndex);
                    if (str.equals(".pem")) {
                        return true;
                    }
                }
                return false;
            }
        };
        File[] certs = CADir.listFiles(fileNameFilter);
        KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
        ks.load(null);
        List<Certificate> rootCertificates = new ArrayList<>();
        PEMReader reader;
        for (File cert : certs) {
            reader = new PEMReader(new InputStreamReader(new FileInputStream(cert)));
            rootCertificates.add((X509Certificate) reader.readObject());
        }
        for (Certificate cert : rootCertificates) {
            X509Certificate x509Cert = (X509Certificate) cert;
            ks.setCertificateEntry(x509Cert.getSubjectX500Principal().getName(), x509Cert);
            LOGGER.debug("adding certificate: " + x509Cert.getSubjectX500Principal().getName());
        }
        return ks;
    } catch (KeyStoreExceptionIOException | NoSuchAlgorithmException | CertificateException |  ex) {
        throw new AuthenticationException(ex);
    }
}

public static KeyManager[] loadKeyManager(String type, InputStream in, String password) throws Exception {
    loadBC();
    final char[] pwd = (password == null || password.length() == 0) ? null : password.toCharArray();
    if (type.equalsIgnoreCase("pem")) {
        PEMReader pemReader = new PEMReader(new InputStreamReader(in), new PasswordFinder() {

            public char[] getPassword() {
                return pwd;
            }
        });
        Object obj, keyObj = null, certObj = null, keyPair = null;
        while ((obj = pemReader.readObject()) != null) {
            if (obj instanceof X509Certificate)
                certObj = obj;
            else if (obj instanceof PrivateKey)
                keyObj = obj;
            else if (obj instanceof KeyPair)
                keyPair = obj;
        }
        if ((keyObj != null || keyPair != null) && certObj != null) {
            final PrivateKey key = keyPair != null ? ((KeyPair) keyPair).getPrivate() : (PrivateKey) keyObj;
            final X509Certificate cert = (X509Certificate) certObj;
            KeyStore ksKeys = KeyStore.getInstance("JKS");
            ksKeys.load(null, pwd == null ? "".toCharArray() : pwd);
            ksKeys.setCertificateEntry("", cert);
            ksKeys.setKeyEntry("", key, pwd == null ? "".toCharArray() : pwd, new Certificate[] { cert });
            KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
            kmf.init(ksKeys, pwd == null ? "".toCharArray() : pwd);
            return kmf.getKeyManagers();
        /*
				return new KeyManager[] { new X509KeyManager()
			    {
					public String chooseClientAlias(String[] keyType, Principal[] issuers, Socket socket) {
						return "a";
					}

					public String chooseServerAlias(String keyType, Principal[] issuers, Socket socket) {
						return "a";
					}

					public X509Certificate[] getCertificateChain(String alias) {
						return new X509Certificate[] { cert };
					}

					public String[] getClientAliases(String keyType, Principal[] issuers) {
						return new String[] {"a"};
					}

					public PrivateKey getPrivateKey(String alias) {
						return key;
					}

					public String[] getServerAliases(String keyType, Principal[] issuers) {
						return new String[] {"a"};
					}
			    }};
    */
        } else {
            throw new RuntimeException("Could not load PEM source");
        }
    }
    KeyStore ksKeys = KeyStore.getInstance(type);
    ksKeys.load(in, pwd);
    Enumeration<String> aliases = ksKeys.aliases();
    while (aliases.hasMoreElements()) {
        String alias = (String) aliases.nextElement();
        System.err.println("KeyStore Alias: " + alias);
    }
    KeyManagerFactory kmf = KeyManagerFactory.getInstance("SunX509");
    kmf.init(ksKeys, pwd);
    return kmf.getKeyManagers();
}

private KeyStore initializeTrustStore(String name, String pemCertificate) throws CertificateException {
    try {
        PEMReader reader = new PEMReader(new InputStreamReader(new ByteArrayInputStream(pemCertificate.getBytes())));
        X509Certificate certificate = (X509Certificate) reader.readObject();
        if (certificate == null) {
            throw new CertificateException("No certificate found in parsing!");
        }
        KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
        keyStore.load(null);
        keyStore.setCertificateEntry(name, certificate);
        return keyStore;
    } catch (IOExceptionKeyStoreException |  e) {
        throw new CertificateException(e);
    } catch (NoSuchAlgorithmException e) {
        throw new AssertionError(e);
    }
}

/**
     * Return an array of all X509Certificates stored in a PEM encoded source.
     * The certificate order of the source is respected.
     * 
     * @param reader
     *            The Reader used to read the source.
     * @return The array of all X509 certificates found in the PEM source.
     * @throws IOException
     *             If an error occurs while reading the source.
     */
public static X509Certificate[] readPEMEncodedCertificates(Reader reader) throws IOException {
    Vector<X509Certificate> certificates = new Vector<X509Certificate>();
    LOG.debug("read all certificates");
    PEMReader pr = new PEMReader(reader);
    boolean haveNext = true;
    while (haveNext) {
        X509Certificate certificate = (X509Certificate) pr.readObject();
        if (certificate == null) {
            // stop loop
            haveNext = false;
        } else {
            certificates.add(certificate);
        }
    }
    int length = certificates.size();
    LOG.debug(length + " certificates found");
    X509Certificate certificatesArray[] = (X509Certificate[]) certificates.toArray(new X509Certificate[length]);
    return certificatesArray;
}

protected PrivateKey toPrivateKey(String privateKey) {
    StringReader reader = new StringReader(privateKey);
    // プライベートキーを読�込�
    PEMReader pemReader = new PEMReader(reader);
    try {
        Object pemObject = pemReader.readObject();
        KeyPair keyPair = KeyPair.class.cast(pemObject);
        return keyPair.getPrivate();
    } catch (Exception e) {
        throw new AutoApplicationException("ESERVICE-000705", e);
    } finally {
        try {
            pemReader.close();
        } catch (IOException ignore) {
        }
    }
}

private KeyStore initializeTrustStore(String name, String pemCertificate) throws CertificateException {
    try {
        PEMReader reader = new PEMReader(new InputStreamReader(new ByteArrayInputStream(pemCertificate.getBytes())));
        X509Certificate certificate = (X509Certificate) reader.readObject();
        if (certificate == null) {
            throw new CertificateException("No certificate found in parsing!");
        }
        KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
        keyStore.load(null);
        keyStore.setCertificateEntry(name, certificate);
        return keyStore;
    } catch (IOExceptionKeyStoreException |  e) {
        throw new CertificateException(e);
    } catch (NoSuchAlgorithmException e) {
        throw new AssertionError(e);
    }
}

/**
	 *
	 * @param privateKeyBytes
	 * @param password
	 * @return
	 * @throws java.security.GeneralSecurityException
	 * @throws java.io.IOException
	 */
public static PrivateKey parsePrivateKey(final byte[] privateKeyBytes, final char[] password) throws GeneralSecurityException, IOException {
    ByteArrayInputStream bais = new ByteArrayInputStream(privateKeyBytes);
    InputStreamReader reader = new InputStreamReader(bais);
    PEMReader parser = null;
    try {
        if (password != null) {
            parser = new PEMReader(reader, getPasswordFinder(password));
        } else {
            parser = new PEMReader(reader);
        }
        KeyPair caKeyPair = (KeyPair) parser.readObject();
        if (caKeyPair == null) {
            throw new GeneralSecurityException("Reading CA private key failed");
        }
        return caKeyPair.getPrivate();
    } finally {
        if (parser != null) {
            parser.close();
        }
        bais.close();
        reader.close();
    }
}

/**
	 *
	 * @param privateKeyBytes
	 * @param password
	 * @return
	 * @throws java.security.GeneralSecurityException
	 * @throws java.io.IOException
	 */
public static PrivateKey parsePrivateKey(final byte[] privateKeyBytes, final char[] password) throws GeneralSecurityException, IOException {
    ByteArrayInputStream bais = new ByteArrayInputStream(privateKeyBytes);
    InputStreamReader reader = new InputStreamReader(bais);
    PEMReader parser = null;
    try {
        if (password != null) {
            parser = new PEMReader(reader, getPasswordFinder(password));
        } else {
            parser = new PEMReader(reader);
        }
        KeyPair caKeyPair = (KeyPair) parser.readObject();
        if (caKeyPair == null) {
            throw new GeneralSecurityException("Reading CA private key failed");
        }
        return caKeyPair.getPrivate();
    } finally {
        if (parser != null) {
            parser.close();
        }
        bais.close();
        reader.close();
    }
}

protected KeyPair getKeyPair(InputStream privateKey) {
    try (PEMReader pemReader = getPEMReader(privateKey)) {
        Object object = getPemObject(pemReader);
        if (object instanceof KeyPair) {
            return (KeyPair) object;
        }
        throw new RuntimeException("Unexpected type [" + object + "]. Expected KeyPair.");
    } catch (IOException e) {
        throw new RuntimeException(e);
    }
}

/**
	 * Crypts with private key
	 * @param array	data to encrypt
	 * @return encrypted data
	 */
public byte[] encryptRSA(byte[] array) {
    try {
        Security.addProvider(new BouncyCastleProvider());
        PEMReader pemReader = new PEMReader(new StringReader(key));
        KeyPair pObj = (KeyPair) pemReader.readObject();
        // Encrypt
        Cipher cipher = Cipher.getInstance("RSA/NONE/PKCS1Padding");
        cipher.init(Cipher.ENCRYPT_MODE, pObj.getPrivate());
        return cipher.doFinal(array);
    } catch (Exception e) {
        e.printStackTrace();
    }
    return null;
}

/**
     * makes RSA public key from string
     * 
     * @param s
     *            string that contais the key
     * @return
     * @see JCERSAPublicKey
     */
public static RSAPublicKeyStructure extractRSAKey(String s) {
    PEMReader reader = new PEMReader(new StringReader(s));
    JCERSAPublicKey JCEKey;
    RSAPublicKeyStructure theKey;
    try {
        Object o = reader.readObject();
        if (!(o instanceof JCERSAPublicKey))
            throw new IOException("Common.extractRSAKey: no public key found for signing key in string '" + s + "' type " + o.getClass().getName());
        JCEKey = (JCERSAPublicKey) o;
        theKey = new RSAPublicKeyStructure(JCEKey.getModulus(), JCEKey.getPublicExponent());
    } catch (IOException e) {
        Logger.logDirectory(Logger.WARNING, "Common.extractRSAKey: Caught exception:" + e.getMessage());
        theKey = null;
    }
    return theKey;
}

public int execute(String[] args) throws ParseException, HelpMessageException, RemoteException {
    CommandLine commandLine = parser.parse(options, args);
    if (commandLine.hasOption(OPT_HELP)) {
        throw new HelpMessageException();
    }
    if (commandLine.hasOption(OPT_VERBOSE)) {
        verboseMode = true;
    }
    if (commandLine.hasOption(OPT_URL_LONG)) {
        serviceClient.setTargetEndpoint(commandLine.getOptionValue(OPT_URL_LONG));
    } else {
        String host = Pap.DEFAULT_HOST;
        String papHostProperty = System.getProperty(PAP_HOST_PROPERTY);
        if (papHostProperty != null && !"".equals(papHostProperty.trim())) {
            host = papHostProperty;
        }
        String port = Pap.DEFAULT_PORT;
        String papPortProperty = System.getProperty(PAP_PORT_PROPERTY);
        if (papPortProperty != null && !"".equals(papPortProperty.trim())) {
            port = papPortProperty;
        }
        if (commandLine.hasOption(OPT_HOST_LONG)) {
            host = commandLine.getOptionValue(OPT_HOST_LONG);
        }
        if (commandLine.hasOption(OPT_PORT)) {
            port = commandLine.getOptionValue(OPT_PORT);
        }
        try {
            Integer.valueOf(port);
        } catch (NumberFormatException e) {
            throw new ParseException(String.format("Invalid port number \"%s\" (option -%s, --%s)", port, OPT_PORT, OPT_PORT_LONG));
        }
        serviceClient.setTargetEndpoint(String.format(DEFAULT_SERVICE_URL, host, port, Pap.DEFAULT_SERVICES_ROOT_PATH));
    }
    boolean credentialsNotRetrieved = true;
    if (commandLine.hasOption(OPT_PROXY_LONG)) {
        serviceClient.setClientProxy(commandLine.getOptionValue(OPT_PROXY_LONG));
        credentialsNotRetrieved = false;
    }
    if (commandLine.hasOption(OPT_CERT_LONG)) {
        if (commandLine.hasOption(OPT_PROXY_LONG)) {
            throw new ParseException(String.format("Conflicting options --%s and --%s.", OPT_PROXY_LONG, OPT_CERT_LONG));
        } else {
            if (!commandLine.hasOption(OPT_KEY_LONG)) {
                throw new ParseException(String.format("Option --%s requires also option --%s.", OPT_CERT_LONG, OPT_KEY_LONG));
            }
            serviceClient.setClientCertificate(commandLine.getOptionValue(OPT_CERT_LONG));
            credentialsNotRetrieved = false;
        }
    }
    if (commandLine.hasOption(OPT_KEY_LONG)) {
        if (commandLine.hasOption(OPT_PROXY_LONG)) {
            throw new ParseException(String.format("Conflicting options --%s and --%s.", OPT_PROXY_LONG, OPT_KEY_LONG));
        } else {
            if (!commandLine.hasOption(OPT_CERT_LONG)) {
                throw new ParseException(String.format("Option --%s requires also option --%s.", OPT_KEY_LONG, OPT_CERT_LONG));
            }
            serviceClient.setClientPrivateKey(commandLine.getOptionValue(OPT_KEY_LONG));
            credentialsNotRetrieved = false;
        }
    }
    if (credentialsNotRetrieved) {
        // 1. if running as root take the cert /etc/grid-security/hostcert.pem
        // 2. check the env variable X509_USER_PROXY
        // 3. check the env variable X509_USER_CERT (and X509_USER_KEY)
        // 4. check the proxy /tmp/x509up_u<id_utente>
        // 5. check the cert $HOME/.globus/usercert.pem and key $HOME/.globus/userkey.pem
        String euid = getEUID();
        if (euid == null) {
            log.error("Cannot enstabilish user's effective user id.");
            throw new PAPException(String.format("Cannot enstabilish user's effective user id, please use the --%s or --%s, --%s options.", OPT_PROXY_LONG, OPT_CERT_LONG, OPT_KEY_LONG));
        }
        String messageString = null;
        if ("0".equals(euid)) {
            if (setCertFromEnvironment()) {
                messageString = String.format("Connecting to %s using %s and %s (from environment X509_USER_CERT and X509_USER_KEY)", serviceClient.getTargetEndpoint(), serviceClient.getClientCertificate(), serviceClient.getClientPrivateKey());
            } else {
                serviceClient.setClientCertificate("/etc/grid-security/hostcert.pem");
                serviceClient.setClientPrivateKey("/etc/grid-security/hostkey.pem");
                messageString = String.format("Connecting to %s using %s and %s", serviceClient.getTargetEndpoint(), serviceClient.getClientCertificate(), serviceClient.getClientPrivateKey());
            }
        } else {
            if (setProxyFromEnvironment()) {
                messageString = String.format("Connecting to %s using proxy (from environment X509_USER_PROXY)  %s", serviceClient.getTargetEndpoint(), serviceClient.getClientProxy());
            } else if (setCertFromEnvironment()) {
                messageString = String.format("Connecting to %s using %s and %s (from environment X509_USER_CERT and X509_USER_KEY)", serviceClient.getTargetEndpoint(), serviceClient.getClientCertificate(), serviceClient.getClientPrivateKey());
            } else if (setProxyFromStandardLocation(euid)) {
                messageString = String.format("Connecting to %s using proxy %s", serviceClient.getTargetEndpoint(), serviceClient.getClientProxy());
            } else if (setCertFromHomeDir()) {
                messageString = String.format("Connecting to %s using %s and %s", serviceClient.getTargetEndpoint(), serviceClient.getClientCertificate(), serviceClient.getClientPrivateKey());
            } else {
                throw new ParseException(String.format("Unable to find a certificate or a proxy, please specify a proxy file with option --%s or certificate and key with options --%s and --%s", OPT_PROXY_LONG, OPT_CERT_LONG, OPT_KEY_LONG));
            }
        }
        log.info(messageString);
        if (verboseMode) {
            System.out.println(messageString);
        }
    }
    // is a host certificate key which doesn't need the password
    if (serviceClient.getClientPrivateKey() != null) {
        try {
            Reader reader = new FileReader(serviceClient.getClientPrivateKey());
            String prompt = "Please enter the passphrase for the private key file " + serviceClient.getClientPrivateKey() + ": ";
            PasswordFinderImpl passwordFinder = new PasswordFinderImpl(prompt);
            PEMReader pm = new PEMReader(reader, passwordFinder);
            char[] password = null;
            try {
                pm.readObject();
            } catch (IOException e) {
            }
            password = passwordFinder.getTypedPassword();
            if (password != null) {
                serviceClient.setClientPrivateKeyPassword(new String(password));
            }
        } catch (FileNotFoundException e) {
            throw new CLIException(e);
        }
    }
    return executeCommandService(commandLine, serviceClient);
}

/**
	 * Get the user's public key
	 * 
	 */
public PublicKey getPublicKey() {
    NodeRef person = serviceRegistry.getPersonService().getPerson(user);
    NodeRef keyNode = counterSignService.getSignatureArtifact(person, CounterSignSignatureModel.ASSOC_SIGNERPUBLICKEY);
    if (keyNode != null) {
        PEMReader parser = null;
        try {
            ContentReader keyReader = serviceRegistry.getContentService().getReader(keyNode, ContentModel.PROP_CONTENT);
            parser = new PEMReader(new InputStreamReader(keyReader.getContentInputStream()));
            PublicKey key = (PublicKey) parser.readObject();
            parser.close();
            return key;
        } catch (Exception ioex) {
            logger.warn("Error reading user public key: " + ioex.getLocalizedMessage());
        } finally {
            try {
                if (parser != null)
                    parser.close();
            } catch (IOException ioex) {
                logger.warn("Error closing PEMReader");
            }
        }
    }
    return null;
}

/**
     * Reads a certificate from a supplied string representation, and a supplied type.
     * 
     * @param certString A String representation of a certificate
     * @param type The type of certificate ("X509").
     * @return The certificate
     * @throws Exception
     */
protected Certificate readCertificate(String certString, String type) throws Exception {
    StringReader sr = new StringReader(certString);
    PEMReader pw = new PEMReader(sr);
    Object object = pw.readObject();
    if (object instanceof X509Certificate) {
        return (X509Certificate) object;
    } else {
        throw ResourceException.getException(ResourceException.BAD_REQUEST, "Unsupported certificate format");
    }
}

/**
   * Converts a PEM to an X509Certificate. Requires the Bouncy Castle provider
   * to be installed.
   *
   * @param pemURL URL of the PEM file
   * @return X509Certificate
   * @throws GuanxiException if an error occurs
   */
public static X509Certificate pem2x509(String pemURL) throws GuanxiException {
    try {
        URL pem = new URL(pemURL);
        PEMReader pemReader = new PEMReader(new InputStreamReader(pem.openStream()));
        return (X509Certificate) pemReader.readObject();
    } catch (MalformedURLException mue) {
        throw new GuanxiException(mue);
    } catch (IOException ioe) {
        throw new GuanxiException(ioe);
    }
}

public static KeyPair fromPem(String keyData) throws IOException {
    PEMReader r = new PEMReader(new StringReader(keyData), null, BouncyCastleLoader.getName());
    try {
        return (KeyPair) r.readObject();
    } finally {
        IoUtils.safeClose(r);
    }
}

private Object readPEM(InputPort in, SerializeOpts sopts) throws CoreException, IOException {
    try (PEMReader reader = new PEMReader(in.asReader(sopts))) {
        Object obj = reader.readObject();
        return obj;
    }
}

public static PublicKey loadPublicKey(String provider, String key) throws IOException, GeneralSecurityException {
    StringReader in = new StringReader(key);
    PEMReader reader = new PEMReader(in, null, provider);
    PublicKey pk = (PublicKey) reader.readObject();
    reader.close();
    return pk;
}

private Object readPEM(XValue sPrivate) throws IOException, UnsupportedEncodingException, CoreException {
    PEMReader reader = new PEMReader(getInput(sPrivate).asReader(this.getSerializeOpts()));
    Object obj = reader.readObject();
    reader.close();
    return obj;
}

/**
     * Does a getProxy operation in a CREAM service.
     * @param delegationId The delegation ID.
     * @return A CSR returned by the CREAM service.
     * @throws Exception If something fails.
     */
private PKCS10CertificationRequest doGetProxyRequest(String delegationId) throws Exception {
    String csrAsString = delegationService.getProxyReq(delegationId);
    Reader csrReader = new StringReader(csrAsString);
    PEMReader r = new PEMReader(csrReader);
    PKCS10CertificationRequest csr = (PKCS10CertificationRequest) r.readObject();
    return csr;
}