undefect. CWE-407 — 63 sites patched across 27 ecosystems
Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com Patches, unit tests, benchmarks, whitepaper, and outreach briefs. Public domain — no copyright claimed. Use freely.
This commit is contained in:
commit
0a580b313d
70422 changed files with 17213626 additions and 0 deletions
45
test/jdk/java/security/cert/CertPathBuilder/GetInstance.java
Normal file
45
test/jdk/java/security/cert/CertPathBuilder/GetInstance.java
Normal file
|
|
@ -0,0 +1,45 @@
|
|||
/*
|
||||
* Copyright (c) 2001, 2025, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
/*
|
||||
* @test
|
||||
* @bug 4408997
|
||||
* @summary Should be able to pass a Provider object to getInstance().
|
||||
* @compile StubProvider.java StubProviderImpl.java
|
||||
* @run main GetInstance
|
||||
* The test passes if it returns.
|
||||
* The test fails if an exception is thrown.
|
||||
*/
|
||||
import java.security.Provider;
|
||||
import java.security.cert.CertPathBuilder;
|
||||
import java.security.NoSuchAlgorithmException;
|
||||
|
||||
|
||||
public class GetInstance {
|
||||
|
||||
public static void main(String[] argv) throws Exception {
|
||||
Provider stubProvider = new StubProvider();
|
||||
CertPathBuilder cpb = CertPathBuilder.getInstance("PKIX", stubProvider);
|
||||
System.out.println("Test passed.");
|
||||
}
|
||||
}
|
||||
142
test/jdk/java/security/cert/CertPathBuilder/NoExtensions.java
Normal file
142
test/jdk/java/security/cert/CertPathBuilder/NoExtensions.java
Normal file
|
|
@ -0,0 +1,142 @@
|
|||
/*
|
||||
* Copyright (c) 2001, 2025, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
/*
|
||||
* @test
|
||||
* @bug 4519462
|
||||
* @summary Verify Sun CertPathBuilder implementation handles certificates with no extensions
|
||||
* @enablePreview
|
||||
*/
|
||||
|
||||
import java.security.PEMDecoder;
|
||||
import java.security.cert.X509Certificate;
|
||||
import java.security.cert.TrustAnchor;
|
||||
import java.security.cert.CollectionCertStoreParameters;
|
||||
import java.security.cert.CertStore;
|
||||
import java.security.cert.X509CertSelector;
|
||||
import java.security.cert.CertPathBuilder;
|
||||
import java.security.cert.PKIXBuilderParameters;
|
||||
import java.security.cert.CertPathBuilderResult;
|
||||
import java.security.cert.CertPath;
|
||||
import java.util.HashSet;
|
||||
import java.util.ArrayList;
|
||||
|
||||
// Test based on user code submitted with bug by daniel.boggs@compass.net
|
||||
public class NoExtensions {
|
||||
|
||||
private static final PEMDecoder pemDecoder = PEMDecoder.of();
|
||||
|
||||
public static void main(String[] args) {
|
||||
try {
|
||||
NoExtensions certs = new NoExtensions();
|
||||
|
||||
// the first certificate has the Authority Key Identifier extension
|
||||
certs.doBuild(getUserCertificate1());
|
||||
System.out.println("successfully built path for the first certificate");
|
||||
|
||||
// the second certificate does not have the Authority Key Identifier extension
|
||||
// this will not succeed
|
||||
certs.doBuild(getUserCertificate2());
|
||||
System.out.println("successfully built path for the second certificate");
|
||||
} catch (Exception ex) {
|
||||
ex.printStackTrace();
|
||||
}
|
||||
}
|
||||
|
||||
private void doBuild(X509Certificate userCert) throws Exception {
|
||||
// get the set of trusted CA certificates (only one in this instance)
|
||||
HashSet trustAnchors = new HashSet();
|
||||
X509Certificate trustedCert = getTrustedCertificate();
|
||||
trustAnchors.add(new TrustAnchor(trustedCert, null));
|
||||
|
||||
// put together a CertStore (repository of the certificates and CRLs)
|
||||
ArrayList certs = new ArrayList();
|
||||
certs.add(trustedCert);
|
||||
certs.add(userCert);
|
||||
CollectionCertStoreParameters certStoreParams = new CollectionCertStoreParameters(certs);
|
||||
CertStore certStore = CertStore.getInstance("Collection", certStoreParams);
|
||||
|
||||
// specify the target certificate via a CertSelector
|
||||
X509CertSelector certSelector = new X509CertSelector();
|
||||
certSelector.setCertificate(userCert);
|
||||
certSelector.setSubject(userCert.getSubjectDN().getName()); // seems to be required
|
||||
|
||||
// build a valid cerificate path
|
||||
CertPathBuilder certPathBuilder = CertPathBuilder.getInstance("PKIX", "SUN");
|
||||
PKIXBuilderParameters certPathBuilderParams = new PKIXBuilderParameters(trustAnchors, certSelector);
|
||||
certPathBuilderParams.addCertStore(certStore);
|
||||
certPathBuilderParams.setRevocationEnabled(false);
|
||||
CertPathBuilderResult result = certPathBuilder.build(certPathBuilderParams);
|
||||
|
||||
// get and show cert path
|
||||
CertPath certPath = result.getCertPath();
|
||||
// System.out.println(certPath.toString());
|
||||
}
|
||||
|
||||
private static X509Certificate getTrustedCertificate() {
|
||||
String sCert =
|
||||
"-----BEGIN CERTIFICATE-----\n"
|
||||
+ "MIIBezCCASWgAwIBAgIQyWD8dLUoqpJFyDxrfRlrsTANBgkqhkiG9w0BAQQFADAW\n"
|
||||
+ "MRQwEgYDVQQDEwtSb290IEFnZW5jeTAeFw0wMTEwMTkxMjU5MjZaFw0zOTEyMzEy\n"
|
||||
+ "MzU5NTlaMBoxGDAWBgNVBAMTD1Jvb3RDZXJ0aWZpY2F0ZTBcMA0GCSqGSIb3DQEB\n"
|
||||
+ "AQUAA0sAMEgCQQC+NFKszPjatUZKWmyWaFjir1wB93FX2u5SL+GMjgUsMs1JcTKQ\n"
|
||||
+ "Kh0cnnQKknNkV4cTW4NPn31YCoB1+0KA3mknAgMBAAGjSzBJMEcGA1UdAQRAMD6A\n"
|
||||
+ "EBLkCS0GHR1PAI1hIdwWZGOhGDAWMRQwEgYDVQQDEwtSb290IEFnZW5jeYIQBjds\n"
|
||||
+ "AKoAZIoRz7jUqlw19DANBgkqhkiG9w0BAQQFAANBACJxAfP57yqaT9N+nRgAOugM\n"
|
||||
+ "JG0aN3/peCIvL3p29epRL2xoWFvxpUUlsH2I39OZ6b8+twWCebhkv1I62segXAk=\n"
|
||||
+ "-----END CERTIFICATE-----";
|
||||
return pemDecoder.decode(sCert, X509Certificate.class);
|
||||
}
|
||||
|
||||
private static X509Certificate getUserCertificate1() {
|
||||
// this certificate includes an extension
|
||||
String sCert =
|
||||
"-----BEGIN CERTIFICATE-----\n"
|
||||
+ "MIIBfzCCASmgAwIBAgIQWFSKzCWO2ptOAc2F3MKZSzANBgkqhkiG9w0BAQQFADAa\n"
|
||||
+ "MRgwFgYDVQQDEw9Sb290Q2VydGlmaWNhdGUwHhcNMDExMDE5MTMwNzQxWhcNMzkx\n"
|
||||
+ "MjMxMjM1OTU5WjAaMRgwFgYDVQQDEw9Vc2VyQ2VydGlmaWNhdGUwXDANBgkqhkiG\n"
|
||||
+ "9w0BAQEFAANLADBIAkEA24gypa2YFGZHKznEWWbqIWNVXCM35W7RwJwhGpNsuBCj\n"
|
||||
+ "NT6KEo66F+OOMgZmb0KrEZHBJASJ3n4Cqbt4aHm/2wIDAQABo0swSTBHBgNVHQEE\n"
|
||||
+ "QDA+gBBch+eYzOPgVRbMq5vGpVWooRgwFjEUMBIGA1UEAxMLUm9vdCBBZ2VuY3mC\n"
|
||||
+ "EMlg/HS1KKqSRcg8a30Za7EwDQYJKoZIhvcNAQEEBQADQQCYBIHBqQQJePi5Hzfo\n"
|
||||
+ "CxeUaYlXmvbxVNkxM65Pplsj3h4ntfZaynmlhahH3YsnnA8wk6xPt04LjSId12RB\n"
|
||||
+ "PeuO\n"
|
||||
+ "-----END CERTIFICATE-----";
|
||||
return pemDecoder.decode(sCert, X509Certificate.class);
|
||||
}
|
||||
|
||||
private static X509Certificate getUserCertificate2() {
|
||||
// this certificate does not include any extensions
|
||||
String sCert =
|
||||
"-----BEGIN CERTIFICATE-----\n"
|
||||
+ "MIIBMjCB3aADAgECAhB6225ckZVssEukPuvk1U1PMA0GCSqGSIb3DQEBBAUAMBox\n"
|
||||
+ "GDAWBgNVBAMTD1Jvb3RDZXJ0aWZpY2F0ZTAeFw0wMTEwMTkxNjA5NTZaFw0wMjEw\n"
|
||||
+ "MTkyMjA5NTZaMBsxGTAXBgNVBAMTEFVzZXJDZXJ0aWZpY2F0ZTIwXDANBgkqhkiG\n"
|
||||
+ "9w0BAQEFAANLADBIAkEAzicGiW9aUlUoQIZnLy1l8MMV5OvA+4VJ4T/xo/PpN8Oq\n"
|
||||
+ "WgZVGKeEp6JCzMlXEJk3TGLfpXL4Ytw+Ldhv0QPhLwIDAnMpMA0GCSqGSIb3DQEB\n"
|
||||
+ "BAUAA0EAQmj9SFHEx66JyAps3ew4pcSS3QvfVZ/6qsNUYCG75rFGcTUPHcXKql9y\n"
|
||||
+ "qBT83iNLJ//krjw5Ju0WRPg/buHSww==\n"
|
||||
+ "-----END CERTIFICATE-----";
|
||||
return pemDecoder.decode(sCert, X509Certificate.class);
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,36 @@
|
|||
/*
|
||||
* Copyright (c) 2001, 2016, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
/*
|
||||
*
|
||||
* @bug 4408997 8130181
|
||||
* Used by GetInstance test.
|
||||
*/
|
||||
import java.security.Provider;
|
||||
|
||||
public class StubProvider extends Provider {
|
||||
public StubProvider() {
|
||||
super( "StubProvider", "1.1", "No Info");
|
||||
put("CertPathBuilder.PKIX", "StubProviderImpl");
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,43 @@
|
|||
/*
|
||||
* Copyright (c) 2001, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
/*
|
||||
*
|
||||
* @bug 4408997
|
||||
* Used by GetInstance test.
|
||||
*/
|
||||
import java.security.cert.CertPathParameters;
|
||||
import java.security.cert.CertPathBuilderResult;
|
||||
import java.security.cert.CertPathBuilderSpi;
|
||||
|
||||
public class StubProviderImpl extends CertPathBuilderSpi {
|
||||
public boolean called;
|
||||
public StubProviderImpl() {
|
||||
super();
|
||||
called = false;
|
||||
}
|
||||
public CertPathBuilderResult engineBuild(CertPathParameters params) {
|
||||
called = true;
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,143 @@
|
|||
/*
|
||||
* Copyright (c) 2014, 2024, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
/**
|
||||
* @test
|
||||
* @bug 8025708
|
||||
* @summary make sure a PKIX CertPathBuilder can build a path when an
|
||||
* intermediate CA certificate contains an AKI extension with a key
|
||||
* identifier and no serial number and the end-entity certificate contains
|
||||
* an AKI extension with both a key identifier and a serial number.
|
||||
*/
|
||||
|
||||
import java.io.ByteArrayInputStream;
|
||||
import java.security.cert.*;
|
||||
import java.util.ArrayList;
|
||||
import java.util.Base64;
|
||||
import java.util.Collections;
|
||||
|
||||
public class AKISerialNumber {
|
||||
|
||||
private static final String ROOT_CERT =
|
||||
"MIICfTCCAeagAwIBAgIBATANBgkqhkiG9w0BAQUFADB3MQ0wCwYDVQQDEwRSb290\n" +
|
||||
"MRYwFAYDVQQLEw1UZXN0IE9yZyBVbml0MREwDwYDVQQKEwhUZXN0IE9yZzEWMBQG\n" +
|
||||
"A1UEBxMNVGVzdCBMb2NhbGl0eTEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czELMAkG\n" +
|
||||
"A1UEBhMCVVMwHhcNMTQwMjAxMDUwMDAwWhcNMjQwMjAxMDUwMDAwWjB3MQ0wCwYD\n" +
|
||||
"VQQDEwRSb290MRYwFAYDVQQLEw1UZXN0IE9yZyBVbml0MREwDwYDVQQKEwhUZXN0\n" +
|
||||
"IE9yZzEWMBQGA1UEBxMNVGVzdCBMb2NhbGl0eTEWMBQGA1UECBMNTWFzc2FjaHVz\n" +
|
||||
"ZXR0czELMAkGA1UEBhMCVVMwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAJvL\n" +
|
||||
"cZu6Rzf9IrduEDjJxEFv5uBvUNMlIAph7NhfmFH9puPW3Ksci4a5yTCzxI9VeVf3\n" +
|
||||
"oYZ/UrZdF+mNZmS23RUh71X5tjMO+xew196M1xNpCRLbjcZ6i4tNdZYkdRIe8ejN\n" +
|
||||
"sbBoD7OAvPbQqTygeG4jYjK6ODofSrba3BndNoFxAgMBAAGjGTAXMBUGA1UdEwEB\n" +
|
||||
"/wQLMAkBAf8CBH////8wDQYJKoZIhvcNAQEFBQADgYEATvCqn69pNHv0zLiZAXk7\n" +
|
||||
"3AKwAoza0wa+1S2rVuZGfBWbV7CxmBHbgcDDbU7/I8pQVkCwOHNkVFnBgNpMuAvU\n" +
|
||||
"aDyrHSNS/av5d1yk5WAuGX2B9mSwZdhnAvtz2fsV1q9NptdF54EkIiKtQQmTGnr9\n" +
|
||||
"TID8CFEk/qje+AB272B1UJw=\n";
|
||||
|
||||
/**
|
||||
* This certificate contains an AuthorityKeyIdentifier with only the
|
||||
* keyIdentifier field filled in.
|
||||
*/
|
||||
private static final String INT_CERT_WITH_KEYID_AKI =
|
||||
"MIICqTCCAhKgAwIBAgIBAjANBgkqhkiG9w0BAQUFADB3MQ0wCwYDVQQDEwRSb290\n" +
|
||||
"MRYwFAYDVQQLEw1UZXN0IE9yZyBVbml0MREwDwYDVQQKEwhUZXN0IE9yZzEWMBQG\n" +
|
||||
"A1UEBxMNVGVzdCBMb2NhbGl0eTEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czELMAkG\n" +
|
||||
"A1UEBhMCVVMwHhcNMTQwMjAxMDUwMDAwWhcNMjQwMjAxMDUwMDAwWjCBhDEaMBgG\n" +
|
||||
"A1UEAxMRSW50ZXJtZWRpYXRlIENBIDIxFjAUBgNVBAsTDVRlc3QgT3JnIFVuaXQx\n" +
|
||||
"ETAPBgNVBAoTCFRlc3QgT3JnMRYwFAYDVQQHEw1UZXN0IExvY2FsaXR5MRYwFAYD\n" +
|
||||
"VQQIEw1NYXNzYWNodXNldHRzMQswCQYDVQQGEwJVUzCBnzANBgkqhkiG9w0BAQEF\n" +
|
||||
"AAOBjQAwgYkCgYEAwKTZekCqb9F9T54s2IXjkQbmLIjQamMpkUlZNrpjjNq9CpTT\n" +
|
||||
"POkfxv2UPwzTz3Ij4XFL/kJFBLm8NUOsS5xPJ62pGoZBPw9R0iMTsTce+Fpukqnr\n" +
|
||||
"I+8jTRaAvr0tR3pqrE6uHKg7dWYN2SsWesDia/LHhwEN38yyWtSuTTLo4hcCAwEA\n" +
|
||||
"AaM3MDUwHwYDVR0jBBgwFoAU6gZP1pO8v7+i8gsFf1gWTf/j3PkwEgYDVR0TAQH/\n" +
|
||||
"BAgwBgEB/wIBADANBgkqhkiG9w0BAQUFAAOBgQAQxeQruav4AqQM4gmEfrHr5hOq\n" +
|
||||
"mB2CNJ1ZqVfpDZ8GHijncKTpjNoXzzQtV23Ge+39JHOVBNWtk+aghB3iu6xGq7Qn\n" +
|
||||
"HlBhg9meqHFqd3igDDD/jhABL2/bEo/M9rv6saYWDFZ8nCIEE6iTLTpRRko4W2Xb\n" +
|
||||
"DyzMzMsO1kPNrJaxRg==\n";
|
||||
|
||||
/**
|
||||
* This certificate contains an AuthorityKeyIdentifier with all 3 fields
|
||||
* (keyIdentifier, authorityCertIssuer, and authorityCertSerialNumber)
|
||||
* filled in.
|
||||
*/
|
||||
private static final String EE_CERT_WITH_FULL_AKI =
|
||||
"MIIDLjCCApegAwIBAgIBAzANBgkqhkiG9w0BAQUFADCBhDEaMBgGA1UEAxMRSW50\n" +
|
||||
"ZXJtZWRpYXRlIENBIDIxFjAUBgNVBAsTDVRlc3QgT3JnIFVuaXQxETAPBgNVBAoT\n" +
|
||||
"CFRlc3QgT3JnMRYwFAYDVQQHEw1UZXN0IExvY2FsaXR5MRYwFAYDVQQIEw1NYXNz\n" +
|
||||
"YWNodXNldHRzMQswCQYDVQQGEwJVUzAeFw0xNDAyMDEwNTAwMDBaFw0yNDAyMDEw\n" +
|
||||
"NTAwMDBaMH0xEzARBgNVBAMTCkVuZCBFbnRpdHkxFjAUBgNVBAsTDVRlc3QgT3Jn\n" +
|
||||
"IFVuaXQxETAPBgNVBAoTCFRlc3QgT3JnMRYwFAYDVQQHEw1UZXN0IExvY2FsaXR5\n" +
|
||||
"MRYwFAYDVQQIEw1NYXNzYWNodXNldHRzMQswCQYDVQQGEwJVUzCBnzANBgkqhkiG\n" +
|
||||
"9w0BAQEFAAOBjQAwgYkCgYEAqady46PdwlKHVP1iaP11CxVyL6cDlPjpwhHCcIUv\n" +
|
||||
"nKHbzdamqmHebDcWVBNN/I0TLNCl3ga7n8KyygSN379fG7haU8SNjpy4IDAXM0/x\n" +
|
||||
"mwTWNTbKfJEkSoiqx1WUy2JTzRUMhgYPguQNECPxBXAdQrthZ7wQosv6Ro2ySP9O\n" +
|
||||
"YqsCAwEAAaOBtTCBsjCBoQYDVR0jBIGZMIGWgBQdeoKxTvlTgW2KgprD69vgHV4X\n" +
|
||||
"kKF7pHkwdzENMAsGA1UEAxMEUm9vdDEWMBQGA1UECxMNVGVzdCBPcmcgVW5pdDER\n" +
|
||||
"MA8GA1UEChMIVGVzdCBPcmcxFjAUBgNVBAcTDVRlc3QgTG9jYWxpdHkxFjAUBgNV\n" +
|
||||
"BAgTDU1hc3NhY2h1c2V0dHMxCzAJBgNVBAYTAlVTggECMAwGA1UdEwEB/wQCMAAw\n" +
|
||||
"DQYJKoZIhvcNAQEFBQADgYEAuG4mM1nLF7STQWwmceELZEl49ntapH/RVoekknmd\n" +
|
||||
"aNzcL4XQf6BTl8KFUXuThHaukQnGIzFbSZV0hrpSQ5fTN2cSZgD4Fji+HuNURmmd\n" +
|
||||
"+Kayl0piHyO1FSbrty0TFhlVNvzKXjmMp6Jdn42KyGOSCoROQcvUWN6xkV3Hvrei\n" +
|
||||
"0ZE=\n";
|
||||
|
||||
private static Base64.Decoder b64Decoder = Base64.getMimeDecoder();
|
||||
private static CertificateFactory cf;
|
||||
|
||||
public static void main(String[] args) throws Exception {
|
||||
|
||||
cf = CertificateFactory.getInstance("X.509");
|
||||
|
||||
X509Certificate rootCert = getCertFromMimeEncoding(ROOT_CERT);
|
||||
TrustAnchor anchor = new TrustAnchor(rootCert, null);
|
||||
|
||||
X509Certificate eeCert = getCertFromMimeEncoding(EE_CERT_WITH_FULL_AKI);
|
||||
X509Certificate intCert = getCertFromMimeEncoding(INT_CERT_WITH_KEYID_AKI);
|
||||
|
||||
X509CertSelector sel = new X509CertSelector();
|
||||
sel.setCertificate(eeCert);
|
||||
PKIXBuilderParameters params = new PKIXBuilderParameters
|
||||
(Collections.singleton(anchor), sel);
|
||||
params.setRevocationEnabled(false);
|
||||
// Set date to 2024-01-01 to satisfy cert constraints
|
||||
params.setDate(new java.util.Date(1704067200000l));
|
||||
|
||||
ArrayList<X509Certificate> certs = new ArrayList<>();
|
||||
certs.add(intCert);
|
||||
certs.add(eeCert);
|
||||
CollectionCertStoreParameters ccsp =
|
||||
new CollectionCertStoreParameters(certs);
|
||||
CertStore cs = CertStore.getInstance("Collection", ccsp);
|
||||
params.addCertStore(cs);
|
||||
|
||||
CertPathBuilder cpb = CertPathBuilder.getInstance("PKIX");
|
||||
CertPathBuilderResult res = cpb.build(params);
|
||||
}
|
||||
|
||||
private static X509Certificate getCertFromMimeEncoding(String encoded)
|
||||
throws CertificateException
|
||||
{
|
||||
byte[] bytes = b64Decoder.decode(encoded);
|
||||
ByteArrayInputStream stream = new ByteArrayInputStream(bytes);
|
||||
return (X509Certificate)cf.generateCertificate(stream);
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,253 @@
|
|||
/*
|
||||
* Copyright (c) 2009, 2025, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
//
|
||||
// Security properties, once set, cannot revert to unset. To avoid
|
||||
// conflicts with tests running in the same VM isolate this test by
|
||||
// running it in otherVM mode.
|
||||
//
|
||||
|
||||
/**
|
||||
* @test
|
||||
* @bug 6852744
|
||||
* @summary PIT b61: PKI test suite fails because self signed certificates
|
||||
* are being rejected
|
||||
* @modules java.base/sun.security.util
|
||||
* @run main/othervm DisableRevocation subca
|
||||
* @run main/othervm DisableRevocation subci
|
||||
* @run main/othervm DisableRevocation alice
|
||||
* @enablePreview
|
||||
* @author Xuelei Fan
|
||||
*/
|
||||
|
||||
import java.io.*;
|
||||
import java.net.SocketException;
|
||||
import java.security.DEREncodable;
|
||||
import java.security.PEMDecoder;
|
||||
import java.util.*;
|
||||
import java.security.Security;
|
||||
import java.security.cert.*;
|
||||
import java.security.cert.CertPathValidatorException.BasicReason;
|
||||
import sun.security.util.DerInputStream;
|
||||
|
||||
/**
|
||||
* A test case helps to ensure that a certification path building process is
|
||||
* able to identify a self-issued certificate from its issuer when disable
|
||||
* revocation checking.
|
||||
*/
|
||||
public final class DisableRevocation {
|
||||
|
||||
// the trust anchor
|
||||
static String selfSignedCertStr =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIICPjCCAaegAwIBAgIBADANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ\n" +
|
||||
"MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA2MjgxMzMyMThaFw0zMDA2MDgxMzMyMTha\n" +
|
||||
"MB8xCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMIGfMA0GCSqGSIb3DQEB\n" +
|
||||
"AQUAA4GNADCBiQKBgQDInJhXi0655bPXAVkz1n5I6fAcZejzPnOPuwq3hU3OxFw8\n" +
|
||||
"81Uf6o9oKI1h4w4XAD8u1cUNOgiX+wPwojronlp68bIfO6FVhNf287pLtLhNJo+7\n" +
|
||||
"m6Qxw3ymFvEKy+PVj20CHSggdKHxUa4MBZBmHMFNBuxfYmjwzn+yTMmCCXOvSwID\n" +
|
||||
"AQABo4GJMIGGMB0GA1UdDgQWBBSQ52Dpau+gtL+Kc31dusYnKj16ZTBHBgNVHSME\n" +
|
||||
"QDA+gBSQ52Dpau+gtL+Kc31dusYnKj16ZaEjpCEwHzELMAkGA1UEBhMCVVMxEDAO\n" +
|
||||
"BgNVBAoTB0V4YW1wbGWCAQAwDwYDVR0TAQH/BAUwAwEB/zALBgNVHQ8EBAMCAQYw\n" +
|
||||
"DQYJKoZIhvcNAQEEBQADgYEAjBt6ea65HCqbGsS2rs/HhlGusYXtThRVC5vwXSey\n" +
|
||||
"ZFYwSgukuq1KDzckqZFu1meNImEwdZjwxdN0e2p/nVREPC42rZliSj6V1ThayKXj\n" +
|
||||
"DWEZW1U5aR8T+3NYfDrdKcJGx4Hzfz0qKz1j4ssV1M9ptJxYYv4y2Da+592IN1S9\n" +
|
||||
"v/E=\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
// the sub-ca
|
||||
static String subCaCertStr =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIICUDCCAbmgAwIBAgIBAzANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ\n" +
|
||||
"MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA2MjgxMzMyMjRaFw0yOTAzMTUxMzMyMjRa\n" +
|
||||
"MDExCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMRAwDgYDVQQLEwdDbGFz\n" +
|
||||
"cy0xMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPFv24SK78VI0gWlyIrq/X\n" +
|
||||
"srl1431K5hJJxMYZtaQunyPmrYg3oI9KvKFykxnR0N4XDPaIi75p9dXGppVu80BA\n" +
|
||||
"+csvIPBwlBQoNmKDQWTziDOqfK4tE+IMuL/Y7pxnH6CDMY7VGpvatty2zcmH+m/v\n" +
|
||||
"E/n+HPyeELJQT2rT/3T+7wIDAQABo4GJMIGGMB0GA1UdDgQWBBRidC8Dt3dBzYES\n" +
|
||||
"KpR2tR560sZ0+zBHBgNVHSMEQDA+gBSQ52Dpau+gtL+Kc31dusYnKj16ZaEjpCEw\n" +
|
||||
"HzELMAkGA1UEBhMCVVMxEDAOBgNVBAoTB0V4YW1wbGWCAQAwDwYDVR0TAQH/BAUw\n" +
|
||||
"AwEB/zALBgNVHQ8EBAMCAQYwDQYJKoZIhvcNAQEEBQADgYEAMeMKqrMr5d3eTQsv\n" +
|
||||
"MYOD15Dl3THQGLAa4ad5Eyq5/1eUeEOpztzCgDfi0iPD8YCubIEVasBTSqTiGXqb\n" +
|
||||
"RpGuPHOwwfWvHrTeHSludiFBAUiKj7aEV+oQa0FBn4U4TT8HA62HQ93FhzTDI3jP\n" +
|
||||
"iil34GktVl6gfMKGzUEW/Dh8OM4=\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
// a delegated CRL issuer, it's a self-issued certificate of trust anchor
|
||||
static String topCrlIssuerCertStr =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIICPjCCAaegAwIBAgIBAjANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ\n" +
|
||||
"MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA2MjgxMzMyMjNaFw0yOTAzMTUxMzMyMjNa\n" +
|
||||
"MB8xCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMIGfMA0GCSqGSIb3DQEB\n" +
|
||||
"AQUAA4GNADCBiQKBgQC99u93trf+WmpfiqunJy/P31ej1l4rESxft2JSGNjKuLFN\n" +
|
||||
"/BO3SAugGJSkCARAwXjB0c8eeXhXWhVVWdNpbKepRJTxrjDfnFIavLgtUvmFwn/3\n" +
|
||||
"hPXe+RQeA8+AJ99Y+o+10kY8JAZLa2j93C2FdmwOjUbo8aIz85yhbiV1tEDjLwID\n" +
|
||||
"AQABo4GJMIGGMB0GA1UdDgQWBBSyFyA3XWLbdL6W6hksmBn7RKsQmDBHBgNVHSME\n" +
|
||||
"QDA+gBSQ52Dpau+gtL+Kc31dusYnKj16ZaEjpCEwHzELMAkGA1UEBhMCVVMxEDAO\n" +
|
||||
"BgNVBAoTB0V4YW1wbGWCAQAwDwYDVR0TAQH/BAUwAwEB/zALBgNVHQ8EBAMCAQYw\n" +
|
||||
"DQYJKoZIhvcNAQEEBQADgYEAHTm8aRTeakgCfEBCgSWK9wvMW1c18ANGMm8OFDBk\n" +
|
||||
"xabVy9BT0MVFHlaneh89oIxTZN0FMTpg21GZMAvIzhEt7DGdO7HLsW7JniN7/OZ0\n" +
|
||||
"rACmpK5frmZrLS03zUm8c+rTbazNfYLoZVG3/mDZbKIi+4y8IGnFcgLVsHsYoBNP\n" +
|
||||
"G0c=\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
// a delegated CRL issuer, it's a self-issued certificate of sub-ca
|
||||
static String subCrlIssuerCertStr =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIICUDCCAbmgAwIBAgIBBDANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ\n" +
|
||||
"MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA2MjgxMzMyMjdaFw0yOTAzMTUxMzMyMjda\n" +
|
||||
"MDExCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMRAwDgYDVQQLEwdDbGFz\n" +
|
||||
"cy0xMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC+8AcLJtGAVUWvv3ifcyQw\n" +
|
||||
"OGqwzcPrBw/XCs6vTMlcdtFzcH1M+Z3/QHN9+5VT1gqeTIZ+b8g9005Og3XKy/HX\n" +
|
||||
"obXZeLv20VZsr+jm52ySghEYOVCTJ9OyFOAp5adp6nf0cA66Feh3LsmVhpTEcDOG\n" +
|
||||
"GnyntQm0DBYxRoOT/GBlvQIDAQABo4GJMIGGMB0GA1UdDgQWBBSRWhMuZLQoHSDN\n" +
|
||||
"xhxr+vdDmfAY8jBHBgNVHSMEQDA+gBSQ52Dpau+gtL+Kc31dusYnKj16ZaEjpCEw\n" +
|
||||
"HzELMAkGA1UEBhMCVVMxEDAOBgNVBAoTB0V4YW1wbGWCAQAwDwYDVR0TAQH/BAUw\n" +
|
||||
"AwEB/zALBgNVHQ8EBAMCAQYwDQYJKoZIhvcNAQEEBQADgYEAMIDZLdOLFiPyS1bh\n" +
|
||||
"Ch4eUYHT+K1WG93skbga3kVYg3GSe+gctwkKwKK13bwfi8zc7wwz6MtmQwEYhppc\n" +
|
||||
"pKKKEwi5QirBCP54rihLCvRQaj6ZqUJ6VP+zPAqHYMDbzlBbHtVF/1lQUP30I6SV\n" +
|
||||
"Fu987DvLmZ2GuQA9FKJsnlD9pbU=\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
// the target EE certificate
|
||||
static String targetCertStr =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIICNzCCAaCgAwIBAgIBAjANBgkqhkiG9w0BAQQFADAxMQswCQYDVQQGEwJVUzEQ\n" +
|
||||
"MA4GA1UEChMHRXhhbXBsZTEQMA4GA1UECxMHQ2xhc3MtMTAeFw0wOTA2MjgxMzMy\n" +
|
||||
"MzBaFw0yOTAzMTUxMzMyMzBaMEExCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFt\n" +
|
||||
"cGxlMRAwDgYDVQQLEwdDbGFzcy0xMQ4wDAYDVQQDEwVBbGljZTCBnzANBgkqhkiG\n" +
|
||||
"9w0BAQEFAAOBjQAwgYkCgYEA7wnsvR4XEOfVznf40l8ClLod+7L0y2/+smVV+GM/\n" +
|
||||
"T1/QF/stajAJxXNy08gK00WKZ6ruTHhR9vh/Z6+EQM2RZDCpU0A7LPa3kLE/XTmS\n" +
|
||||
"1MLDu8ntkdlpURpvhdDWem+rl2HU5oZgzV8Jkcov9vXuSjqEDfr45FlPuV40T8+7\n" +
|
||||
"cxsCAwEAAaNPME0wCwYDVR0PBAQDAgPoMB0GA1UdDgQWBBSBwsAhi6Z1kriOs3ty\n" +
|
||||
"uSIujv9a3DAfBgNVHSMEGDAWgBRidC8Dt3dBzYESKpR2tR560sZ0+zANBgkqhkiG\n" +
|
||||
"9w0BAQQFAAOBgQDEiBqd5AMy2SQopFaS3dYkzj8MHlwtbCSoNVYkOfDnewcatrbk\n" +
|
||||
"yFcp6FX++PMdOQFHWvvnDdkCUAzZQp8kCkF9tGLVLBtOK7XxQ1us1LZym7kOPzsd\n" +
|
||||
"G93Dcf0U1JRO77juc61Br5paAy8Bok18Y/MeG7uKgB2MAEJYKhGKbCrfMw==\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
private static final PEMDecoder PEM_DECODER = PEMDecoder.of();
|
||||
|
||||
private static Set<TrustAnchor> generateTrustAnchors()
|
||||
throws CertificateException {
|
||||
// generate certificate from cert string
|
||||
X509Certificate selfSignedCert = PEM_DECODER.decode(selfSignedCertStr, X509Certificate.class);
|
||||
|
||||
// generate a trust anchor
|
||||
TrustAnchor anchor =
|
||||
new TrustAnchor(selfSignedCert, null);
|
||||
|
||||
return Collections.singleton(anchor);
|
||||
}
|
||||
|
||||
private static CertStore generateCertificateStore() throws Exception {
|
||||
Collection<DEREncodable> entries = new HashSet<>();
|
||||
|
||||
// generate certificate from certificate string
|
||||
entries.add(PEM_DECODER.decode(targetCertStr, X509Certificate.class));
|
||||
entries.add(PEM_DECODER.decode(subCaCertStr, X509Certificate.class));
|
||||
entries.add(PEM_DECODER.decode(selfSignedCertStr, X509Certificate.class));
|
||||
entries.add(PEM_DECODER.decode(topCrlIssuerCertStr, X509Certificate.class));
|
||||
entries.add(PEM_DECODER.decode(subCrlIssuerCertStr, X509Certificate.class));
|
||||
|
||||
return CertStore.getInstance("Collection",
|
||||
new CollectionCertStoreParameters(entries));
|
||||
}
|
||||
|
||||
private static X509CertSelector generateSelector(String name)
|
||||
throws Exception {
|
||||
X509CertSelector selector = new X509CertSelector();
|
||||
|
||||
// generate certificate from certificate string
|
||||
CertificateFactory cf = CertificateFactory.getInstance("X.509");
|
||||
ByteArrayInputStream is = null;
|
||||
String cert;
|
||||
if (name.equals("subca")) {
|
||||
cert = subCaCertStr;
|
||||
} else if (name.equals("subci")) {
|
||||
cert = subCrlIssuerCertStr;
|
||||
} else {
|
||||
cert = targetCertStr;
|
||||
}
|
||||
|
||||
X509Certificate target = PEM_DECODER.decode(cert, X509Certificate.class);
|
||||
byte[] extVal = target.getExtensionValue("2.5.29.14");
|
||||
if (extVal != null) {
|
||||
DerInputStream in = new DerInputStream(extVal);
|
||||
byte[] subjectKID = in.getOctetString();
|
||||
selector.setSubjectKeyIdentifier(subjectKID);
|
||||
} else {
|
||||
// unlikely to happen.
|
||||
throw new Exception("unexpected certificate: no SKID extension");
|
||||
}
|
||||
|
||||
return selector;
|
||||
}
|
||||
|
||||
private static boolean match(String name, Certificate cert)
|
||||
throws Exception {
|
||||
|
||||
// generate certificate from certificate string
|
||||
String newCert;
|
||||
if (name.equals("subca")) {
|
||||
newCert = subCaCertStr;
|
||||
} else if (name.equals("subci")) {
|
||||
newCert = subCrlIssuerCertStr;
|
||||
} else {
|
||||
newCert = targetCertStr;
|
||||
}
|
||||
X509Certificate target = PEM_DECODER.decode(newCert, X509Certificate.class);
|
||||
|
||||
return target.equals(cert);
|
||||
}
|
||||
|
||||
|
||||
public static void main(String[] args) throws Exception {
|
||||
// MD5 is used in this test case, don't disable MD5 algorithm.
|
||||
Security.setProperty(
|
||||
"jdk.certpath.disabledAlgorithms", "MD2, RSA keySize < 1024");
|
||||
|
||||
CertPathBuilder builder = CertPathBuilder.getInstance("PKIX");
|
||||
|
||||
X509CertSelector selector = generateSelector(args[0]);
|
||||
|
||||
Set<TrustAnchor> anchors = generateTrustAnchors();
|
||||
CertStore certs = generateCertificateStore();
|
||||
|
||||
|
||||
PKIXBuilderParameters params =
|
||||
new PKIXBuilderParameters(anchors, selector);
|
||||
params.addCertStore(certs);
|
||||
params.setRevocationEnabled(false);
|
||||
params.setDate(new Date(109, 7, 1)); // 2009-07-01
|
||||
Security.setProperty("ocsp.enable", "false");
|
||||
System.setProperty("com.sun.security.enableCRLDP", "false");
|
||||
|
||||
PKIXCertPathBuilderResult result =
|
||||
(PKIXCertPathBuilderResult)builder.build(params);
|
||||
|
||||
if (!match(args[0], result.getCertPath().getCertificates().get(0))) {
|
||||
throw new Exception("unexpected certificate");
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,288 @@
|
|||
/*
|
||||
* Copyright (c) 2009, 2025, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
//
|
||||
// Security properties, once set, cannot revert to unset. To avoid
|
||||
// conflicts with tests running in the same VM isolate this test by
|
||||
// running it in otherVM mode.
|
||||
//
|
||||
|
||||
/**
|
||||
* @test
|
||||
* @bug 6852744 8133489
|
||||
* @summary PIT b61: PKI test suite fails because self signed certificates
|
||||
* are being rejected
|
||||
* @enablePreview
|
||||
* @modules java.base/sun.security.util
|
||||
* @run main/othervm -Djava.security.debug=certpath KeyUsageMatters subca
|
||||
* @run main/othervm -Djava.security.debug=certpath KeyUsageMatters subci
|
||||
* @run main/othervm -Djava.security.debug=certpath KeyUsageMatters alice
|
||||
* @author Xuelei Fan
|
||||
*/
|
||||
|
||||
import java.io.*;
|
||||
import java.net.SocketException;
|
||||
import java.security.DEREncodable;
|
||||
import java.security.PEMDecoder;
|
||||
import java.util.*;
|
||||
import java.security.Security;
|
||||
import java.security.cert.*;
|
||||
import java.security.cert.CertPathValidatorException.BasicReason;
|
||||
import sun.security.util.DerInputStream;
|
||||
|
||||
/**
|
||||
* KeyUsage extension plays a important rule during looking for the issuer
|
||||
* of a certificate or CRL. A certificate issuer should have the keyCertSign
|
||||
* bit set, and a CRL issuer should have the cRLSign bit set.
|
||||
*
|
||||
* Sometime, a delegated CRL issuer would also have the keyCertSign bit set,
|
||||
* as would be troublesome to find the proper CRL issuer during certificate
|
||||
* path build if the delegated CRL issuer is a self-issued certificate, for
|
||||
* it is hard to identify it from its issuer by the "issuer" field only.
|
||||
*
|
||||
* The fix of 6852744 should addresses above issue, and allow a delegated CRL
|
||||
* issuer to have keyCertSign bit set.
|
||||
*
|
||||
* In the test case, the delegated CRL issuers have cRLSign bit set only, and
|
||||
* the CAs have the keyCertSign bit set only, it is expected to work before
|
||||
* and after the bug fix of 6852744.
|
||||
*/
|
||||
public final class KeyUsageMatters {
|
||||
|
||||
private static final PEMDecoder PEM_DECODER = PEMDecoder.of();
|
||||
|
||||
// the trust anchor
|
||||
static String selfSignedCertStr =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIICPjCCAaegAwIBAgIBADANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ\n" +
|
||||
"MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA0MjcwMjI0MzJaFw0zMDA0MDcwMjI0MzJa\n" +
|
||||
"MB8xCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMIGfMA0GCSqGSIb3DQEB\n" +
|
||||
"AQUAA4GNADCBiQKBgQC4OTag24sTxL2tXTNuvpmUEtdxrYAZoFsslFQ60T+WD9wQ\n" +
|
||||
"Jeiw87FSPsR2vxRuv0j8DNm2a4h7LNNIFcLurfNldbz5pvgZ7VqdbbUMPE9qP85n\n" +
|
||||
"jgDl4woyRTSUeRI4A7O0CO6NpES21dtbdhroWQrEkHxpnrDPxsxrz5gf2m3gqwID\n" +
|
||||
"AQABo4GJMIGGMB0GA1UdDgQWBBSCJd0hpl5PdAD9IZS+Hzng4lXLGzBHBgNVHSME\n" +
|
||||
"QDA+gBSCJd0hpl5PdAD9IZS+Hzng4lXLG6EjpCEwHzELMAkGA1UEBhMCVVMxEDAO\n" +
|
||||
"BgNVBAoTB0V4YW1wbGWCAQAwDwYDVR0TAQH/BAUwAwEB/zALBgNVHQ8EBAMCAgQw\n" +
|
||||
"DQYJKoZIhvcNAQEEBQADgYEAluy6HIjWcq009lTLmhp+Np6dxU78pInBK8RZkza0\n" +
|
||||
"484qGaxFGD3UGyZkI5uWmsH2XuMbuox5khfIq6781gmkPBHXBIEtJN8eLusOHEye\n" +
|
||||
"iE8h7WI+N3qa6Pj56WionMrioqC/3X+b06o147bbhx8U0vkYv/HyPaITOFfMXTdz\n" +
|
||||
"Vjw=\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
// the sub-ca
|
||||
static String subCaCertStr =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIICUDCCAbmgAwIBAgIBAzANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ\n" +
|
||||
"MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA0MjcwMjI0MzRaFw0yOTAxMTIwMjI0MzRa\n" +
|
||||
"MDExCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMRAwDgYDVQQLEwdDbGFz\n" +
|
||||
"cy0xMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCiAJnAQW2ad3ZMKUhSJVZj\n" +
|
||||
"8pBqxTcHSTwAVguQkDglsN/OIwUpvR5Jgp3lpRWUEt6idEp0FZzORpvtjt3pr5MG\n" +
|
||||
"Eg2CDptekC5BSPS+fIAIKlncB3HwOiFFhH6b3wTydDCdEd2fvsi4QMOSVrIYMeA8\n" +
|
||||
"P/mCz6kRhfUQPE0CMmOUewIDAQABo4GJMIGGMB0GA1UdDgQWBBT0/nNP8WpyxmYr\n" +
|
||||
"IBp4tN8y08jw2jBHBgNVHSMEQDA+gBSCJd0hpl5PdAD9IZS+Hzng4lXLG6EjpCEw\n" +
|
||||
"HzELMAkGA1UEBhMCVVMxEDAOBgNVBAoTB0V4YW1wbGWCAQAwDwYDVR0TAQH/BAUw\n" +
|
||||
"AwEB/zALBgNVHQ8EBAMCAgQwDQYJKoZIhvcNAQEEBQADgYEAS9PzI6B39R/U9fRj\n" +
|
||||
"UExzN1FXNP5awnAPtiv34kSCL6n6MryqkfG+8aaAOdZsSjmTylNFaF7cW/Xp1VBF\n" +
|
||||
"hq0bg/SbEAbK7+UwL8GSC3crhULHLbh+1iFdVTEwxCw5YmB8ji3BaZ/WKW/PkjCZ\n" +
|
||||
"7cXP6VDeZMG6oRQ4hbOcixoFPXo=\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
// a delegated CRL issuer, it's a self-issued certificate of trust anchor
|
||||
static String topCrlIssuerCertStr =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIICKzCCAZSgAwIBAgIBAjANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ\n" +
|
||||
"MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA0MjcwMjI0MzNaFw0yOTAxMTIwMjI0MzNa\n" +
|
||||
"MB8xCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMIGfMA0GCSqGSIb3DQEB\n" +
|
||||
"AQUAA4GNADCBiQKBgQDMJeBMBybHykI/YpwUJ4O9euqDSLb1kpWpceBS8TVqvgBC\n" +
|
||||
"SgUJWtFZL0i6bdvF6mMdlbuBkGzhXqHiVAi96/zRLbUC9F8SMEJ6MuD+YhQ0ZFTQ\n" +
|
||||
"atKy8zf8O9XzztelLJ26Gqb7QPV133WY3haAqHtCXOhEKkCN16NOYNC37DTaJwID\n" +
|
||||
"AQABo3cwdTAdBgNVHQ4EFgQULXSWzXzUOIpOJpzbSCpW42IJUugwRwYDVR0jBEAw\n" +
|
||||
"PoAUgiXdIaZeT3QA/SGUvh854OJVyxuhI6QhMB8xCzAJBgNVBAYTAlVTMRAwDgYD\n" +
|
||||
"VQQKEwdFeGFtcGxlggEAMAsGA1UdDwQEAwIBAjANBgkqhkiG9w0BAQQFAAOBgQAY\n" +
|
||||
"eMnf5AHSNlyUlzXk8o2S0h4gCuvKX6C3kFfKuZcWvFAbx4yQOWLS2s15/nzR4+AP\n" +
|
||||
"FGX3lgJjROyAh7fGedTQK+NFWwkM2ag1g3hXktnlnT1qHohi0w31nVBJxXEDO/Ck\n" +
|
||||
"uJTpJGt8XxxbFaw5v7cHy7XuTAeU/sekvjEiNHW00Q==\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
// a delegated CRL issuer, it's a self-issued certificate of sub-ca
|
||||
static String subCrlIssuerCertStr =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIICPTCCAaagAwIBAgIBBDANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ\n" +
|
||||
"MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA0MjcwMjI0MzRaFw0yOTAxMTIwMjI0MzRa\n" +
|
||||
"MDExCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMRAwDgYDVQQLEwdDbGFz\n" +
|
||||
"cy0xMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDWUtDQx2MB/7arDiquMJyd\n" +
|
||||
"LWwSg6p8sg5z6wKrC1v47MT4DBhFX+0RUgTMUdQgYpgxGpczn+6y4zfV76064S0N\n" +
|
||||
"4L/IQ+SunTW1w4yRGjB+xkyyJmWAqijG1nr+Dgkv5nxPI+9Er5lHcoVWVMEcvvRm\n" +
|
||||
"6jIBQdldVlSgv+VgUnFm5wIDAQABo3cwdTAdBgNVHQ4EFgQUkV3Qqtk7gIot9n60\n" +
|
||||
"jX6dloxrfMEwRwYDVR0jBEAwPoAUgiXdIaZeT3QA/SGUvh854OJVyxuhI6QhMB8x\n" +
|
||||
"CzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlggEAMAsGA1UdDwQEAwIBAjAN\n" +
|
||||
"BgkqhkiG9w0BAQQFAAOBgQADu4GM8EdmIKhC7FRvk5jF90zfvZ38wbXBzCjKI4jX\n" +
|
||||
"QJrhne1bfyeNNm5c1w+VKidT+XzBzBGH7ZqYzoZmzRIfcbLKX2brEBKiukeeAyL3\n" +
|
||||
"bctQtbp19tX+uu2dQberD188AAysKTkHcJUV+rRsTwVJ9vcYKxoRxKk8DhH7ZS3M\n" +
|
||||
"rg==\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
// the target EE certificate
|
||||
static String targetCertStr =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIICNzCCAaCgAwIBAgIBAjANBgkqhkiG9w0BAQQFADAxMQswCQYDVQQGEwJVUzEQ\n" +
|
||||
"MA4GA1UEChMHRXhhbXBsZTEQMA4GA1UECxMHQ2xhc3MtMTAeFw0wOTA0MjcwMjI0\n" +
|
||||
"MzZaFw0yOTAxMTIwMjI0MzZaMEExCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFt\n" +
|
||||
"cGxlMRAwDgYDVQQLEwdDbGFzcy0xMQ4wDAYDVQQDEwVBbGljZTCBnzANBgkqhkiG\n" +
|
||||
"9w0BAQEFAAOBjQAwgYkCgYEAvYSaU3oiE4Pxp/aUIXwMqOwSiWkZ+O3aTu13hRtK\n" +
|
||||
"ZyR+Wtj63IuvaigAC4uC+zBypF93ThjwCzVR2qKDQaQzV8CLleO96gStt7Y+i3G2\n" +
|
||||
"V3IUGgrVCqeK7N6nNYu0wW84sibcPqG/TIy0UoaQMqgB21xtRF+1DUVlFh4Z89X/\n" +
|
||||
"pskCAwEAAaNPME0wCwYDVR0PBAQDAgPoMB0GA1UdDgQWBBSynMEdcal/e9TmvlNE\n" +
|
||||
"4suXGA4+hjAfBgNVHSMEGDAWgBT0/nNP8WpyxmYrIBp4tN8y08jw2jANBgkqhkiG\n" +
|
||||
"9w0BAQQFAAOBgQB/jru7E/+piSmUwByw5qbZsoQZVcgR97pd2TErNJpJMAX2oIHR\n" +
|
||||
"wJH6w4NuYs27+fEAX7wK4whc6EUH/w1SI6o28F2rG6HqYQPPZ2E2WqwbBQL9nYE3\n" +
|
||||
"Vfzu/G9axTUQXFbf90h80UErA+mZVxqc2xtymLuH0YEaMZImtRZ2MXHfXg==\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
// CRL issued by the delegated CRL issuer, topCrlIssuerCertStr
|
||||
static String topCrlStr =
|
||||
"-----BEGIN X509 CRL-----\n" +
|
||||
"MIIBGzCBhQIBATANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQMA4GA1UE\n" +
|
||||
"ChMHRXhhbXBsZRcNMDkwNDI3MDIzODA0WhcNMjgwNjI2MDIzODA0WjAiMCACAQUX\n" +
|
||||
"DTA5MDQyNzAyMzgwMFowDDAKBgNVHRUEAwoBBKAOMAwwCgYDVR0UBAMCAQIwDQYJ\n" +
|
||||
"KoZIhvcNAQEEBQADgYEAoarfzXEtw3ZDi4f9U8eSvRIipHSyxOrJC7HR/hM5VhmY\n" +
|
||||
"CErChny6x9lBVg9s57tfD/P9PSzBLusCcHwHMAbMOEcTltVVKUWZnnbumpywlYyg\n" +
|
||||
"oKLrE9+yCOkYUOpiRlz43/3vkEL5hjIKMcDSZnPKBZi1h16Yj2hPe9GMibNip54=\n" +
|
||||
"-----END X509 CRL-----";
|
||||
|
||||
// CRL issued by the delegated CRL issuer, subCrlIssuerCertStr
|
||||
static String subCrlStr =
|
||||
"-----BEGIN X509 CRL-----\n" +
|
||||
"MIIBLTCBlwIBATANBgkqhkiG9w0BAQQFADAxMQswCQYDVQQGEwJVUzEQMA4GA1UE\n" +
|
||||
"ChMHRXhhbXBsZTEQMA4GA1UECxMHQ2xhc3MtMRcNMDkwNDI3MDIzODA0WhcNMjgw\n" +
|
||||
"NjI2MDIzODA0WjAiMCACAQQXDTA5MDQyNzAyMzgwMVowDDAKBgNVHRUEAwoBBKAO\n" +
|
||||
"MAwwCgYDVR0UBAMCAQIwDQYJKoZIhvcNAQEEBQADgYEAeS+POqYEIHIIJcsLxuUr\n" +
|
||||
"aJFzQ/ujH0QmnyMNEL3Uavyq4VQuAahF+w6aTPb5UBzms0uX8NAvD2vNoUJvmJOX\n" +
|
||||
"nGKuq4Q1DFj82E7/9d25nXdWGOmFvFCRVO+St2Xe5n8CJuZNBiz388FDSIOiFSCa\n" +
|
||||
"ARGr6Qu68MYGtLMC6ZqP3u0=\n" +
|
||||
"-----END X509 CRL-----";
|
||||
|
||||
private static Set<TrustAnchor> generateTrustAnchors()
|
||||
throws CertificateException {
|
||||
|
||||
// generate certificate from cert string
|
||||
X509Certificate selfSignedCert = PEM_DECODER.decode(selfSignedCertStr, X509Certificate.class);
|
||||
|
||||
// generate a trust anchor
|
||||
TrustAnchor anchor =
|
||||
new TrustAnchor(selfSignedCert, null);
|
||||
|
||||
return Collections.singleton(anchor);
|
||||
}
|
||||
|
||||
private static CertStore generateCertificateStore() throws Exception {
|
||||
Collection<DEREncodable> entries = new HashSet<>();
|
||||
|
||||
// Decode and add certificates
|
||||
entries.add(PEM_DECODER.decode(targetCertStr, X509Certificate.class));
|
||||
entries.add(PEM_DECODER.decode(subCaCertStr, X509Certificate.class));
|
||||
entries.add(PEM_DECODER.decode(selfSignedCertStr, X509Certificate.class));
|
||||
entries.add(PEM_DECODER.decode(topCrlIssuerCertStr, X509Certificate.class));
|
||||
entries.add(PEM_DECODER.decode(subCrlIssuerCertStr, X509Certificate.class));
|
||||
|
||||
// Decode and add CRLs
|
||||
entries.add(PEM_DECODER.decode(topCrlStr, X509CRL.class));
|
||||
entries.add(PEM_DECODER.decode(subCrlStr, X509CRL.class));
|
||||
return CertStore.getInstance("Collection",
|
||||
new CollectionCertStoreParameters(entries));
|
||||
}
|
||||
|
||||
private static X509CertSelector generateSelector(String name)
|
||||
throws Exception {
|
||||
X509CertSelector selector = new X509CertSelector();
|
||||
|
||||
// generate certificate from certificate string
|
||||
String cert;
|
||||
if (name.equals("subca")) {
|
||||
cert = subCaCertStr;
|
||||
} else if (name.equals("subci")) {
|
||||
cert = subCrlIssuerCertStr;
|
||||
} else {
|
||||
cert = targetCertStr;
|
||||
}
|
||||
|
||||
X509Certificate target = PEM_DECODER.decode(cert, X509Certificate.class);
|
||||
byte[] extVal = target.getExtensionValue("2.5.29.14");
|
||||
if (extVal != null) {
|
||||
DerInputStream in = new DerInputStream(extVal);
|
||||
byte[] subjectKID = in.getOctetString();
|
||||
selector.setSubjectKeyIdentifier(subjectKID);
|
||||
} else {
|
||||
// unlikely to happen.
|
||||
throw new Exception("unexpected certificate: no SKID extension");
|
||||
}
|
||||
|
||||
return selector;
|
||||
}
|
||||
|
||||
private static boolean match(String name, Certificate cert) {
|
||||
|
||||
// generate certificate from certificate string
|
||||
String newCert;
|
||||
if (name.equals("subca")) {
|
||||
newCert = subCaCertStr;
|
||||
} else if (name.equals("subci")) {
|
||||
newCert = subCrlIssuerCertStr;
|
||||
} else {
|
||||
newCert = targetCertStr;
|
||||
}
|
||||
X509Certificate target = PEM_DECODER.decode(newCert, X509Certificate.class);
|
||||
|
||||
return target.equals(cert);
|
||||
}
|
||||
|
||||
|
||||
public static void main(String[] args) throws Exception {
|
||||
// MD5 is used in this test case, don't disable MD5 algorithm.
|
||||
Security.setProperty(
|
||||
"jdk.certpath.disabledAlgorithms", "MD2, RSA keySize < 1024");
|
||||
|
||||
CertPathBuilder builder = CertPathBuilder.getInstance("PKIX");
|
||||
|
||||
X509CertSelector selector = generateSelector(args[0]);
|
||||
|
||||
Set<TrustAnchor> anchors = generateTrustAnchors();
|
||||
CertStore certs = generateCertificateStore();
|
||||
|
||||
|
||||
PKIXBuilderParameters params =
|
||||
new PKIXBuilderParameters(anchors, selector);
|
||||
params.addCertStore(certs);
|
||||
params.setRevocationEnabled(true);
|
||||
params.setDate(new Date(109, 5, 1)); // 2009-05-01
|
||||
Security.setProperty("ocsp.enable", "false");
|
||||
System.setProperty("com.sun.security.enableCRLDP", "true");
|
||||
|
||||
PKIXCertPathBuilderResult result =
|
||||
(PKIXCertPathBuilderResult)builder.build(params);
|
||||
|
||||
if (!match(args[0], result.getCertPath().getCertificates().get(0))) {
|
||||
throw new Exception("unexpected certificate");
|
||||
}
|
||||
}
|
||||
}
|
||||
382
test/jdk/java/security/cert/CertPathBuilder/selfIssued/README
Normal file
382
test/jdk/java/security/cert/CertPathBuilder/selfIssued/README
Normal file
|
|
@ -0,0 +1,382 @@
|
|||
/*
|
||||
* Copyright (c) 2009, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
Certificates and CRLs
|
||||
|
||||
The certificates and CRLs used by KeyUsageMatters.java are copied from
|
||||
test/java/security/cert/CertPathValidator/indirectCRL.
|
||||
|
||||
Here lists the local generated certificates and CRLs used in the test cases.
|
||||
|
||||
The generate.sh depends on openssl, and it should be run under ksh. The
|
||||
script will create many directories and files, please run it in a
|
||||
directory outside of JDK workspace.
|
||||
|
||||
1. root certifiate and key
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIICPjCCAaegAwIBAgIBADANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ
|
||||
MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA2MjgxMzMyMThaFw0zMDA2MDgxMzMyMTha
|
||||
MB8xCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMIGfMA0GCSqGSIb3DQEB
|
||||
AQUAA4GNADCBiQKBgQDInJhXi0655bPXAVkz1n5I6fAcZejzPnOPuwq3hU3OxFw8
|
||||
81Uf6o9oKI1h4w4XAD8u1cUNOgiX+wPwojronlp68bIfO6FVhNf287pLtLhNJo+7
|
||||
m6Qxw3ymFvEKy+PVj20CHSggdKHxUa4MBZBmHMFNBuxfYmjwzn+yTMmCCXOvSwID
|
||||
AQABo4GJMIGGMB0GA1UdDgQWBBSQ52Dpau+gtL+Kc31dusYnKj16ZTBHBgNVHSME
|
||||
QDA+gBSQ52Dpau+gtL+Kc31dusYnKj16ZaEjpCEwHzELMAkGA1UEBhMCVVMxEDAO
|
||||
BgNVBAoTB0V4YW1wbGWCAQAwDwYDVR0TAQH/BAUwAwEB/zALBgNVHQ8EBAMCAQYw
|
||||
DQYJKoZIhvcNAQEEBQADgYEAjBt6ea65HCqbGsS2rs/HhlGusYXtThRVC5vwXSey
|
||||
ZFYwSgukuq1KDzckqZFu1meNImEwdZjwxdN0e2p/nVREPC42rZliSj6V1ThayKXj
|
||||
DWEZW1U5aR8T+3NYfDrdKcJGx4Hzfz0qKz1j4ssV1M9ptJxYYv4y2Da+592IN1S9
|
||||
v/E=
|
||||
-----END CERTIFICATE-----
|
||||
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
Proc-Type: 4,ENCRYPTED
|
||||
DEK-Info: DES-EDE3-CBC,46F13CECA9B38323
|
||||
|
||||
AVNWPH7jiPyJVq9KfL3IlGVCwD41KVapg12yJR2t/WWlLaKr19/0oWNvimcrd040
|
||||
txFKvcFO9TFLxmaco33+actCoL0K/XbrCBICThZLybzcFTuYFMum8eqL61avQgBe
|
||||
Kt4CCjcupWLzKWkKTMV/bP6nPnPUSB9U8QeGwutjJYnLDi0TuYx8YSqZo/36vM98
|
||||
r3OvtcSA5XEN4guxxHusZJnhbclVb/Z1WtLVb4v2d5yBtPM2p3R0hK17L4Dnusjl
|
||||
n56z6Z0AIYmfAggM/Fpge2uT3D/5n//l1lZRNoSvsX5UZipKswZKLpvx7IJ+AqgA
|
||||
UO9lcmNLGnIXME3IS3smd83wPi7nxH3NCYWHbGAKLm6mkFMs5LOhofUMOBS3Rxmm
|
||||
2RjCGtuzDxBPKveo9/Y80B//6sEce2gdi7fCKgWwtR4VFuJd0hWODD6CarK3edHH
|
||||
rUG62Kt2aqiI/y/NLEbfHCHbyM37c9/OzS5Zy695dDl22r5EirVFsVgejQR1JGtP
|
||||
ANdc6kkkJW+s6GiqimShssMTp1x0L8twT/+wEa38LafiaPKk4OweleBuyz7k2FxA
|
||||
Rr2u9IOvGU3eKAeH8HSFWvaNE9S2lYFPiWWZ6O/LzVvnb847+gungQ7SPRzOkt4k
|
||||
L4PtHIoKmLWFr5tzML1Q8wiaKcTWMb5LZbRbo+2XYGoIpilxkBBuhX7cMJFwOHEf
|
||||
YJJRixBI97doPsnIQ3GkA8xY+INzQ4LWNQbnEtS7L7t26NA9tDlg4ILU/UfMoQIp
|
||||
Ol4EZY1U7gD8BeMwo2vX3x/WA+a7R2N95klBFNqn9jSkm6a5yoeCZw==
|
||||
-----END RSA PRIVATE KEY-----
|
||||
|
||||
|
||||
2. root crl issuer and key
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIICPjCCAaegAwIBAgIBAjANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ
|
||||
MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA2MjgxMzMyMjNaFw0yOTAzMTUxMzMyMjNa
|
||||
MB8xCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMIGfMA0GCSqGSIb3DQEB
|
||||
AQUAA4GNADCBiQKBgQC99u93trf+WmpfiqunJy/P31ej1l4rESxft2JSGNjKuLFN
|
||||
/BO3SAugGJSkCARAwXjB0c8eeXhXWhVVWdNpbKepRJTxrjDfnFIavLgtUvmFwn/3
|
||||
hPXe+RQeA8+AJ99Y+o+10kY8JAZLa2j93C2FdmwOjUbo8aIz85yhbiV1tEDjLwID
|
||||
AQABo4GJMIGGMB0GA1UdDgQWBBSyFyA3XWLbdL6W6hksmBn7RKsQmDBHBgNVHSME
|
||||
QDA+gBSQ52Dpau+gtL+Kc31dusYnKj16ZaEjpCEwHzELMAkGA1UEBhMCVVMxEDAO
|
||||
BgNVBAoTB0V4YW1wbGWCAQAwDwYDVR0TAQH/BAUwAwEB/zALBgNVHQ8EBAMCAQYw
|
||||
DQYJKoZIhvcNAQEEBQADgYEAHTm8aRTeakgCfEBCgSWK9wvMW1c18ANGMm8OFDBk
|
||||
xabVy9BT0MVFHlaneh89oIxTZN0FMTpg21GZMAvIzhEt7DGdO7HLsW7JniN7/OZ0
|
||||
rACmpK5frmZrLS03zUm8c+rTbazNfYLoZVG3/mDZbKIi+4y8IGnFcgLVsHsYoBNP
|
||||
G0c=
|
||||
-----END CERTIFICATE-----
|
||||
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
Proc-Type: 4,ENCRYPTED
|
||||
DEK-Info: DES-EDE3-CBC,3881A5676C1AD5E5
|
||||
|
||||
KgaAtGlIQXVnsoifcd1oTi4hS1J+InHISFcZepI1h1hrU9KVAJAlwD1GIeM2qAkG
|
||||
P1ABsA0TE0yRJpd3qHih2IPtD42osfc3HmNTw17nh4Trd3ESilrs4w/rrH8e6bR5
|
||||
WlqG0OKsw8x57t44m9yX94+pP3tdPaJwnFk5M7pDCO44IZskmy10S0NHBn7wMwM/
|
||||
mqlZ15mK6YZTwOuLzpdSDJqYPLiv77KpfeiqSN++ISXoNhIcNYHRVyErAS/DcBlx
|
||||
mbrmBaGexhuagQYqVikEDIvg8kBDWD92EjOFbz94Z6eTvliauJ/+E1/Ffefe2cN5
|
||||
LaVwuUsiyW9GjarWwBJDFrXesTikklshC9V35j/ACHVdh5CuO8FGfVijIwlbZ14N
|
||||
xKWJdSlZlJgEjkwUlWfi1KmrFrob+yK20fGMWr3oY1rTKWZdYkrqnnKEYcMQV/TH
|
||||
XNY77D5idJ3FLtvJyziqIFuohdatQsu6xFP5UEOeUi6OhptJDjjS+zDhiBlL4cqA
|
||||
klThzvuycxjZT+5xno0f8GEnZkQNcC6xxPoP6vstNMKLz1rI1CVUSXZBHc5nfMaF
|
||||
m75rrLbvf6F2NLUspaNXnW8TUMHxcu8nNCnM4/u6hkqebQo/N8X1/v1HImsewwWO
|
||||
P5uJwqmqfuRz0vZyMKAk3FzQIfrjJouxDfkNV2YHM9VP/grPlDgzmgiN0+6bCbn+
|
||||
RW2K8kvkSFZehQ1Ygdst9KYH3NEcEYVYY9pH1N1xRNAylcIDJNwrFwf9vfwjt9/q
|
||||
AVsyDxUBT/KVCcqr15LNNq9HmmcP6IZZMRjdyf2BR+/cobxxDRZq1Q==
|
||||
-----END RSA PRIVATE KEY-----
|
||||
|
||||
|
||||
3. root CRL issued by root crl issuer.
|
||||
-----BEGIN X509 CRL-----
|
||||
MIIBGzCBhQIBATANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQMA4GA1UE
|
||||
ChMHRXhhbXBsZRcNMDkwNjI4MTMzMjM4WhcNMjgwODI3MTMzMjM4WjAiMCACAQUX
|
||||
DTA5MDYyODEzMzIzN1owDDAKBgNVHRUEAwoBBKAOMAwwCgYDVR0UBAMCAQEwDQYJ
|
||||
KoZIhvcNAQEEBQADgYEAVUIeu2x7ZwsliafoCBOg+u8Q4S/VFfTe/SQnRyTM3/V1
|
||||
v+Vn5Acc7eo8Rh4AHcnFFbLNk38n6lllov/CaVR0IPZ6hnrNHVa7VYkNlRAwV2aN
|
||||
GUUhkMMOLVLnN25UOrN9J637SHmRE6pB+TRMaEQ73V7UNlWxuSMK4KofWen0A34=
|
||||
-----END X509 CRL-----
|
||||
|
||||
|
||||
4. subca certificate and key
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIICUDCCAbmgAwIBAgIBAzANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ
|
||||
MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA2MjgxMzMyMjRaFw0yOTAzMTUxMzMyMjRa
|
||||
MDExCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMRAwDgYDVQQLEwdDbGFz
|
||||
cy0xMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPFv24SK78VI0gWlyIrq/X
|
||||
srl1431K5hJJxMYZtaQunyPmrYg3oI9KvKFykxnR0N4XDPaIi75p9dXGppVu80BA
|
||||
+csvIPBwlBQoNmKDQWTziDOqfK4tE+IMuL/Y7pxnH6CDMY7VGpvatty2zcmH+m/v
|
||||
E/n+HPyeELJQT2rT/3T+7wIDAQABo4GJMIGGMB0GA1UdDgQWBBRidC8Dt3dBzYES
|
||||
KpR2tR560sZ0+zBHBgNVHSMEQDA+gBSQ52Dpau+gtL+Kc31dusYnKj16ZaEjpCEw
|
||||
HzELMAkGA1UEBhMCVVMxEDAOBgNVBAoTB0V4YW1wbGWCAQAwDwYDVR0TAQH/BAUw
|
||||
AwEB/zALBgNVHQ8EBAMCAQYwDQYJKoZIhvcNAQEEBQADgYEAMeMKqrMr5d3eTQsv
|
||||
MYOD15Dl3THQGLAa4ad5Eyq5/1eUeEOpztzCgDfi0iPD8YCubIEVasBTSqTiGXqb
|
||||
RpGuPHOwwfWvHrTeHSludiFBAUiKj7aEV+oQa0FBn4U4TT8HA62HQ93FhzTDI3jP
|
||||
iil34GktVl6gfMKGzUEW/Dh8OM4=
|
||||
-----END CERTIFICATE-----
|
||||
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
Proc-Type: 4,ENCRYPTED
|
||||
DEK-Info: DES-EDE3-CBC,35408AD3018F0049
|
||||
|
||||
4t6WfpFNqpOr47Wc/OAt8+KZK0+WX7d3nlJn47W+QN7AkPfBlLBpcQJkImhP4/eh
|
||||
aJyk8fPOdUhT/4rgc5ORuKk4d9boD36KK5Iz/+/oNBxzuld6TybVb+Hvw41cIZTW
|
||||
CtkvADQpR8XWbPre+3ZH2eAKoTeWX0xR7pYg1JsFk9vxee6U82iqsAYRdUOdot8D
|
||||
9zdDbbeaLWs78UbZkxFtuXREuyNVX880Q17t8qszJL2KmmtMQpUvxTlW04Ope1Ug
|
||||
uIuOxeannzpKRD+37fj+oacM3GRqVFOP47/NVaziOexDBn4b5nlW6OMro6t0qiHt
|
||||
1GLJcw1oLXoFe8ycexfzYWUiHymSz5Vh3wIflsQY+Ik6dopL+fpk2cVD0bncKJlf
|
||||
Ie9PvL04RwannRjgtPl9X05tzcgeyznp2Ix1/rsriZQQpdPTLGA6w6kUhQeK6TwT
|
||||
eX7pXn3iLTGK+VoHRfbxBQR2Fvq1nRJbvsmJFhPOcJU5CYSaDPGGdA6NorbdVgbc
|
||||
14DlkhzojhEpZ7DaUeFNUXUMlQOR5UUTZB+wL3zQoY/FzHci3JD1Gj4NlbC9mMEg
|
||||
ncWZcpZWOnP2kHSz2o/UOxQM80gerukI7NOr020iJ+ZZRb/gyAAzLPnD+mCZ7/e2
|
||||
JJ3x6yHOtVA6WzZiQH1d9/bm79rtcWaRH83X/idG1lHuKXQJFAaw5f7Z2n2/yuF1
|
||||
9pZf7el1M7UoBf74oc68klAl46f4inroy8anAtc/qjSTXUYQrNvKZsWU9AZVS7oH
|
||||
iEuYMVW4KiZh3SHsIg5TZdMbdVYtZpcTsl/Kh6XuY0o0Xsi+rTK5AA==
|
||||
-----END RSA PRIVATE KEY-----
|
||||
|
||||
|
||||
5. crl issuer of subca, the certificate and key
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIICUDCCAbmgAwIBAgIBBDANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ
|
||||
MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA2MjgxMzMyMjdaFw0yOTAzMTUxMzMyMjda
|
||||
MDExCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMRAwDgYDVQQLEwdDbGFz
|
||||
cy0xMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC+8AcLJtGAVUWvv3ifcyQw
|
||||
OGqwzcPrBw/XCs6vTMlcdtFzcH1M+Z3/QHN9+5VT1gqeTIZ+b8g9005Og3XKy/HX
|
||||
obXZeLv20VZsr+jm52ySghEYOVCTJ9OyFOAp5adp6nf0cA66Feh3LsmVhpTEcDOG
|
||||
GnyntQm0DBYxRoOT/GBlvQIDAQABo4GJMIGGMB0GA1UdDgQWBBSRWhMuZLQoHSDN
|
||||
xhxr+vdDmfAY8jBHBgNVHSMEQDA+gBSQ52Dpau+gtL+Kc31dusYnKj16ZaEjpCEw
|
||||
HzELMAkGA1UEBhMCVVMxEDAOBgNVBAoTB0V4YW1wbGWCAQAwDwYDVR0TAQH/BAUw
|
||||
AwEB/zALBgNVHQ8EBAMCAQYwDQYJKoZIhvcNAQEEBQADgYEAMIDZLdOLFiPyS1bh
|
||||
Ch4eUYHT+K1WG93skbga3kVYg3GSe+gctwkKwKK13bwfi8zc7wwz6MtmQwEYhppc
|
||||
pKKKEwi5QirBCP54rihLCvRQaj6ZqUJ6VP+zPAqHYMDbzlBbHtVF/1lQUP30I6SV
|
||||
Fu987DvLmZ2GuQA9FKJsnlD9pbU=
|
||||
-----END CERTIFICATE-----
|
||||
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
Proc-Type: 4,ENCRYPTED
|
||||
DEK-Info: DES-EDE3-CBC,4CD10EAA24AF8C25
|
||||
|
||||
6pTRc9jsn6CJ2EMYhuGX3aWrDThhacnqdtsKIqUzX8Ga7Jz9kq6HseTRlqPkzBfb
|
||||
rCl+eVIkgugrPbf93375mP/ozY8LkEgD9TRAL1uXqha2N6TRLC2ozQJQSoIc441e
|
||||
UZ9XkB6tPGRfPNvi1xE0WTP7bjOUkvkPU9wM9QFuBW6B7mRf3tG2nqkFiTpY6nz8
|
||||
5X5+h9jafcCvMwYhfJm0JFTGWmX4WJWubs8QeYndvIriDDw2zpVNcno45sClSQCb
|
||||
YVekMLgGlKPmNGub5iRfXsozykE3jbMnXRokxrvzk20jjo0XYPVGfCRe9IhJh8Ud
|
||||
iCG/kPaJspbUkUlKXfvIOdp2pnoDFZI5hbfc75YrFYJ8x8dwRYBUl6yRtBkw5Yo/
|
||||
VQDuNq3d7YpxiGxVTwFox6HQ5+rs6jwSGzOilgOCxPSs41fYcdAlogNqLzjvhn+e
|
||||
0GU1XTVyMJbO0Ae6Sgm4PmxU7QM2bdzESuZWbYRFbH2ywwmoR8SahB3ICBhuIA/l
|
||||
lsCrBbq+jL/K2IL1VXBKuaKBN1ShKUPZD/ABWNv4uENNg2AFq1XQ6kvTU8Glfhd9
|
||||
tyK8YnJ0ViY4VLGhdf0s2eEPmbfxOv0HCW0sz/57eASoQSTJTdVApYopWHBOwaNq
|
||||
8qQUEPDMTKaPNqCjA2m/NwGrLPHhU0d5dHmp+9gTbCTmWy4sVenhBPbOy6wvFpNA
|
||||
F+35tJVaZQOOurm/KC2dLOYkKyAvqnB7D2q4zducpWkiyCweg7uYL14Mo5JQmGuq
|
||||
2DwfRiMxdqqoqHFKEOxsoAMrKSwJlYojUknfz/LEaqxtMePQtNwhjw==
|
||||
-----END RSA PRIVATE KEY-----
|
||||
|
||||
|
||||
6. CLR issued by subca CRL issuer
|
||||
-----BEGIN X509 CRL-----
|
||||
MIIBLTCBlwIBATANBgkqhkiG9w0BAQQFADAxMQswCQYDVQQGEwJVUzEQMA4GA1UE
|
||||
ChMHRXhhbXBsZTEQMA4GA1UECxMHQ2xhc3MtMRcNMDkwNjI4MTMzMjQzWhcNMjgw
|
||||
ODI3MTMzMjQzWjAiMCACAQQXDTA5MDYyODEzMzIzOFowDDAKBgNVHRUEAwoBBKAO
|
||||
MAwwCgYDVR0UBAMCAQEwDQYJKoZIhvcNAQEEBQADgYEACQZEf6ydb3fKTMPJ8DBO
|
||||
oo630MsrT3P0x0AC4+aQOueCBaGpNqW/H379uZxXAad7yr+aXUBwaeBMYVKUbwOe
|
||||
5TrN5QWPe2eCkU+MSQvh1SHASDDMH4jhWFMRdO3aPMDKKPlO/Q3s0G72eD7Zo5dr
|
||||
N9AvUXxGxU4DruoJuFPcrCI=
|
||||
-----END X509 CRL-----
|
||||
|
||||
|
||||
7. dumca certificate and key
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIICUDCCAbmgAwIBAgIBBTANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ
|
||||
MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA2MjgxMzMyMjhaFw0yOTAzMTUxMzMyMjha
|
||||
MDExCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMRAwDgYDVQQLEwdDbGFz
|
||||
cy1EMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDeWn+ulgls9+dK3KzzfC1b
|
||||
a9RMSf+gjv/Olw5386Vw6pJOVngR11RytWJoLiKbjYPyGhP1cms2FoUKuAEO31gD
|
||||
3AoUCa+nXgaMLiDtmdC5ATqVv3Oap5aNgAqq0mxMxOylKgcUhfuH2icEnfBtHzEe
|
||||
ST11S69zQr5GGfa/XslbDQIDAQABo4GJMIGGMB0GA1UdDgQWBBRCmXIsp4G3iP7Z
|
||||
Qv4gS19W8W/cLzBHBgNVHSMEQDA+gBSQ52Dpau+gtL+Kc31dusYnKj16ZaEjpCEw
|
||||
HzELMAkGA1UEBhMCVVMxEDAOBgNVBAoTB0V4YW1wbGWCAQAwDwYDVR0TAQH/BAUw
|
||||
AwEB/zALBgNVHQ8EBAMCAQYwDQYJKoZIhvcNAQEEBQADgYEAkRiLpJesXyNQ34ZP
|
||||
Oc4d0gvCl4pyNHx5gsV0yHtxP7oYoIa7Bw4setplQ9Y2YcH5xuXK84xvAby9csWp
|
||||
cod1QOkFzZfb9qj10PXfD8bMoLOyrZfr5nsNAl2scvOtnM1TFL/ll5/S2PVcPthx
|
||||
Z5t128UNQYMu93OmVjZANL5L6Jw=
|
||||
-----END CERTIFICATE-----
|
||||
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
Proc-Type: 4,ENCRYPTED
|
||||
DEK-Info: DES-EDE3-CBC,11485599004D2482
|
||||
|
||||
R+TgUoQo1Ksqpnwh1B1x3u7jxd1qJsfG5st7WJaeJzSY3v+ZnmTS4O008eKgw6Z1
|
||||
eGJevsNW8Z8ButjChzlesCm+90jpKpOqA6MlvzeknAxtGdEfe8rUEytfNOorjJTy
|
||||
1Mu9T8Tlk6tmmmXNTDX1lQytYaHA4e4VVEbYGNceMNcPonT1Y0SyebJwtfd4XKkG
|
||||
Ty40kMnb+qrFr1ZxVRG+LWKDR/bS0S2K2zY6Ha45d8yoYZlgLZ7yVAlrp0T0PF4B
|
||||
UWvSyNK9VOBLrvqXSofK5gNGkR/C63x8FU2V25ISicBQBXLNo9OgIsbrryHF330T
|
||||
2TxhnOpFU1AwgTSfp4Fy/Htkvgo7/jmFRa3r4xelTdEUKvRrwaZeMjg0fT+24529
|
||||
8o8MMOF0YWNtIDNUVRFg9/DgAsD/LoXbOGc/E2ryJdq1D4N914s4m/D5Sox27iu4
|
||||
3op/dt+WMoA0g/YbjhWn2cAfWcH9P8p8/n/FUO8APmGI3aHbtOhJQ8qwxcalp6kO
|
||||
fICWsW4ygWtdpnyJWzAY0Udtsl8mglTppGTl59OYZmlDQTLhJ1hWiXLeNKj0pGPz
|
||||
bAJ5jGQN8zXAk83j019rI5WveAdWp+w1XRGvmPxLL3heojHrkutuYLQ0LOcFwNvg
|
||||
OqmPvZneRBoy6Yshp0XyYy+qioxDm+Vd/NV1/aCWgQXJA3vFqUg3AURLFHHTh+7h
|
||||
fa3DDCLtdg/wJkRtOWjFhq0hgx5sb9zVv8HCuMERbZJbWwDOfSrHJwXj4KaTHVqY
|
||||
OWfBE9vzeAxRpdpe69SZWYg3tyu7uSf6a5Rp55iMI3kjuQMCanvsNA==
|
||||
-----END RSA PRIVATE KEY-----
|
||||
|
||||
|
||||
8. crl issuer for dumca, the certificate and key
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIICUDCCAbmgAwIBAgIBBjANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ
|
||||
MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA2MjgxMzMyMjlaFw0yOTAzMTUxMzMyMjla
|
||||
MDExCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMRAwDgYDVQQLEwdDbGFz
|
||||
cy1EMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDF7NjUUWji4pPmFg3qx4HB
|
||||
kjtInwe7i2lPjRUN0ZwTcWob2RaD1+fhc7seeNmnypjERTa9TXF5cs2PgSHWNISC
|
||||
QbQpbobOUcSsV/6Lr0kvrHJuVowcX13VsApGSJavVs2oJqUiFGNpnch8yR/pMHJf
|
||||
hsd/Go+nUXMOl2xN31DMFQIDAQABo4GJMIGGMB0GA1UdDgQWBBS1XVE2CYKHgO7t
|
||||
1koYVTu2w7xgNTBHBgNVHSMEQDA+gBSQ52Dpau+gtL+Kc31dusYnKj16ZaEjpCEw
|
||||
HzELMAkGA1UEBhMCVVMxEDAOBgNVBAoTB0V4YW1wbGWCAQAwDwYDVR0TAQH/BAUw
|
||||
AwEB/zALBgNVHQ8EBAMCAQYwDQYJKoZIhvcNAQEEBQADgYEAHYraYtdetZFOiTUR
|
||||
dhvUi556el1WT25O8pF21YAzRI7KI4yzl6deD29DtcIPiBc8H1A4U6OhwXSQsqTd
|
||||
taOHHdZxnU+m078mb231OPVvo48uZwpnX35g/qItW+Nb/dIEb08537oQKoGgL0hV
|
||||
sKZPWod70JBkJabDuUirorhlk4A=
|
||||
-----END CERTIFICATE-----
|
||||
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
Proc-Type: 4,ENCRYPTED
|
||||
DEK-Info: DES-EDE3-CBC,1E0E5983F90A10E0
|
||||
|
||||
KdPTRmJjeKXFTgdVIgP0eu+m0evwVD2QFMkT3pPI9HELRxtkgIQzjK8F0KIHK9vi
|
||||
Ur0CMgJkX0zs2v7HIG7jvfQ2fREidRTk1g3xCjHXVbpwjWN2dbo+mR0J2zzxNILy
|
||||
mSs13PlDPdV81Vkn1WkMY0lhdrEpR6senQ4KIiMJTMsWZabG3lyFM6d7ag7CDVC+
|
||||
jnsUFg2XW5dYP/kb09p14+CdiQwruNVeVEWhWPG1pAjl7hXCEM5ssz9fNk6Gyh2X
|
||||
OXB2mMysqTkt+qB+OIqLKj3NTUs2ovVQZnaCaynsnMYTcIEFmv3lC0gJHYAZtBXf
|
||||
IkySb+VaB7wmk1CI1+texDU8+B2sq7wmqX0SLY7dMwkbxP1kydn9U5i4Gqmdxpw5
|
||||
4+jn7dB6oKfVFlXIZTZzhmN44cIdai48qVmse1BRDxUdfmlgd9C2W1mw4N60BXbt
|
||||
DeNr8ua5UtcUOXBGJk6VEJapDU/dnnANhVR4R48Y9t+g1qlhwHB4zbSrAIJ5Rsbg
|
||||
6pvdt7BQmFXtm4flZbf21Lr8awWkNFdc/k/3uXA6xemgsFNxPZXlpXO26KpIP+nz
|
||||
lt9Q82WxIkzE+BvO+qd5wMqQ/GC/ztO8GJeGdRIo6un7KkNKs2AZDoCELo2lO53B
|
||||
EBWHeABtJpB1Fw3lW3iJn0A6YbYzK1omztoNMkesBIi0QI5L/e0tq4Mp+LUjLm+Y
|
||||
ywdrofTiYTu8R7mgS1b5q3eFtwUR9MZuKJGvhsBcSfS41vH2hDezYHg8vW55UIE3
|
||||
h7EhOUnTkHY43OKZnmXHwh3pTEmHv1TfMpeaktiU/w0=
|
||||
-----END RSA PRIVATE KEY-----
|
||||
|
||||
9. end entity certificate issued by subca, Alice
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIICNzCCAaCgAwIBAgIBAjANBgkqhkiG9w0BAQQFADAxMQswCQYDVQQGEwJVUzEQ
|
||||
MA4GA1UEChMHRXhhbXBsZTEQMA4GA1UECxMHQ2xhc3MtMTAeFw0wOTA2MjgxMzMy
|
||||
MzBaFw0yOTAzMTUxMzMyMzBaMEExCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFt
|
||||
cGxlMRAwDgYDVQQLEwdDbGFzcy0xMQ4wDAYDVQQDEwVBbGljZTCBnzANBgkqhkiG
|
||||
9w0BAQEFAAOBjQAwgYkCgYEA7wnsvR4XEOfVznf40l8ClLod+7L0y2/+smVV+GM/
|
||||
T1/QF/stajAJxXNy08gK00WKZ6ruTHhR9vh/Z6+EQM2RZDCpU0A7LPa3kLE/XTmS
|
||||
1MLDu8ntkdlpURpvhdDWem+rl2HU5oZgzV8Jkcov9vXuSjqEDfr45FlPuV40T8+7
|
||||
cxsCAwEAAaNPME0wCwYDVR0PBAQDAgPoMB0GA1UdDgQWBBSBwsAhi6Z1kriOs3ty
|
||||
uSIujv9a3DAfBgNVHSMEGDAWgBRidC8Dt3dBzYESKpR2tR560sZ0+zANBgkqhkiG
|
||||
9w0BAQQFAAOBgQDEiBqd5AMy2SQopFaS3dYkzj8MHlwtbCSoNVYkOfDnewcatrbk
|
||||
yFcp6FX++PMdOQFHWvvnDdkCUAzZQp8kCkF9tGLVLBtOK7XxQ1us1LZym7kOPzsd
|
||||
G93Dcf0U1JRO77juc61Br5paAy8Bok18Y/MeG7uKgB2MAEJYKhGKbCrfMw==
|
||||
-----END CERTIFICATE-----
|
||||
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
Proc-Type: 4,ENCRYPTED
|
||||
DEK-Info: DES-EDE3-CBC,9E29E1901B338431
|
||||
|
||||
796Bj4/MwwHdy6+yZQcq3pS12EZPlEm7qsCCTl787y+DYEnnj+9W4WX4+1zWsUGV
|
||||
1+39oe/KOUfi5O9ytMuKiroIrklmkskWHDoW6sr4VcDprnLYL+75AhTfgpOtY+gK
|
||||
q+++N7P2o9V6YF7PiGxaBqGy/3bt0nTu0sjctfzbo4g0PniiId9sus2Y+iRHKebJ
|
||||
r9V0b0jB8USuIsZ+4IQJFZ+/zeKuqqqPM/4v5VKNUahER8oykhRd4L9UactnVH5t
|
||||
dsfowtHmOmKE6ObJX3m+HgJMvauMMf7zJVdqJquU2vy0bUk9ufCrA7t5ws7JDRzd
|
||||
SG5gt7EVQzd5x/yXsQdKbDew5mXsYPB8vz4moTgj4YJU+m6k0t1PH00pz7LUrDHl
|
||||
E8ZAmXIKLEBIih1AWkdASR/YZsfB3URIC8mLyDSZJN5iEVJxl/JWm6pbJlP3Xn3J
|
||||
fraVEXP6uerf29CNhizq520AfGdsSqga6atdx6PXBVm67V0TZ+zmBMUQJrWmJUUC
|
||||
NFGAac+M58lYX9uwsrO9x/x6GSZvhQQu1kfD1m8DHN3IV5m3uHxsEvhmuHaqFEMJ
|
||||
uH336HbqWYENXwZfDHZvOU1o2FejsLZ7QmFjB72iAxhVNQt53pCXed2gF/bERGSn
|
||||
qi0PsYtjyzfEUefqlVRSWVulbQfGwkvl8dX9s6BxmOG1q0BzlDu+cQLYXPS+XOww
|
||||
H8GgkGp6XTd04qT/qCm8gcuxAvdkYkj2zgAIKaqeJ53S3Ua9lrIKnA3L3btiEG5F
|
||||
JTYutSdRqB4liukkB1TciiDVSmOisszjrMHhRRYPfgeLfnRFdX9U9g==
|
||||
-----END RSA PRIVATE KEY-----
|
||||
|
||||
10. end entity certificate issued by subca, Bob
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIICNTCCAZ6gAwIBAgIBAzANBgkqhkiG9w0BAQQFADAxMQswCQYDVQQGEwJVUzEQ
|
||||
MA4GA1UEChMHRXhhbXBsZTEQMA4GA1UECxMHQ2xhc3MtMTAeFw0wOTA2MjgxMzMy
|
||||
MzVaFw0yOTAzMTUxMzMyMzVaMD8xCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFt
|
||||
cGxlMRAwDgYDVQQLEwdDbGFzcy0xMQwwCgYDVQQDEwNCb2IwgZ8wDQYJKoZIhvcN
|
||||
AQEBBQADgY0AMIGJAoGBALLrxd3DpXuH7yiAoyi/Rc1F7WsyyeNE1Ra2ymHpcee/
|
||||
3sbldekcgPl6lGQF/JJ5ARBbfeDtaf6ZtAK3j6aXqxVFxDKKu86r96v74gWJB7Vv
|
||||
CHcUPvmE/EGESq3VNFI998DbmvqICLC97nFLUIrKWDH1rRFZjjkmouln40UxQXvV
|
||||
AgMBAAGjTzBNMAsGA1UdDwQEAwID6DAdBgNVHQ4EFgQUTXz1J2viNSKvRHIRVhD6
|
||||
cJE4lgYwHwYDVR0jBBgwFoAUYnQvA7d3Qc2BEiqUdrUeetLGdPswDQYJKoZIhvcN
|
||||
AQEEBQADgYEApsKyLf4FbXb26KsQrxgFn/w0d/7ck4cE8a6oXQqi5OLheNSWfD3S
|
||||
fgD1dR28mGmhBiyOkdLmrhA1+6BuEr4FsuyLgrFnEqKL0ZhVhiqvwKLGqvasWxfU
|
||||
Edaw4WXvRcfRWXfgjtwB6PSj/3nqGKSGRPif/OFIjO6UqHwEM7JEWO4=
|
||||
-----END CERTIFICATE-----
|
||||
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
Proc-Type: 4,ENCRYPTED
|
||||
DEK-Info: DES-EDE3-CBC,4A820975D251613F
|
||||
|
||||
GseD8MIztC0oYMxwpxeBO4/YPs9ZFFjgncXXcy+1oYZdlEsrS1xw87unjeHigL8m
|
||||
QPIn8Guv3DiOsBdvweuMAgPPaA1zlophPClbGZMk7BB3T2acEfjBQH1DZz7kd7Bf
|
||||
OmI2DrqcEg1yDi7l7YutBuTQPiy3nj3d7pbScuFd5YVMu6yH0YpS7JsPvviabFk2
|
||||
eYVlkaiejtQwV+4rUb7sH/0iyqX2uqvnpnGAwVzGp+tfSOl71SByz240nOODBRgY
|
||||
3Uvxkrw6XhCBAayJE0t7rkPMEe1KgZaGO2IU2jsJJbyHVjvNPSugdbsT28prZHN1
|
||||
5M1J1NSOssq/kAq6S3f9sC5j7OzP7oUlx8uMUUSaz09/Ttq22tUoqmTue2IqqxAt
|
||||
lDaeR8duHP5VV1wWnDsW/XaVYlBFQ4eFPJcXqmWsNAkDQVJp327GrcT6ngevP8fD
|
||||
BcIxyX6J0rETPruAE+1+PAGjqy+C+oB0ssyZvKcjzdajHcNxSlRpCuOO2ekDvNPO
|
||||
h+mVukNpHCEBsh3jYmk3z9i7VPLCM0BI+vheJ1TbM+homWP6bXyTQxtLfaKzXZJH
|
||||
jRJ+zGTMBNJoPVKkou03uXFpT6hdWr9nYwbMT6G9hmC0If3wEl8nRjDKbmyMS29B
|
||||
p3im1kPxVJA0DjhghC+7tACy42ffw6KZPALwaVDKHGeitrQBc3xTGfrjOGQOTTcm
|
||||
hZ8icYCY0cjl5KQ2kq2GpXa2zQMujNV/Oj7D4sE0xcASMRXl3tst77R/j0eowx1M
|
||||
niCTRphxx4iTPkieIbjWWeFTpVmSzUBrm4hSw3tiRapVWf6Zo3aAIg==
|
||||
-----END RSA PRIVATE KEY-----
|
||||
|
||||
11. end entity certificate issued by subca, Susan
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIICNzCCAaCgAwIBAgIBBDANBgkqhkiG9w0BAQQFADAxMQswCQYDVQQGEwJVUzEQ
|
||||
MA4GA1UEChMHRXhhbXBsZTEQMA4GA1UECxMHQ2xhc3MtMTAeFw0wOTA2MjgxMzMy
|
||||
MzZaFw0yOTAzMTUxMzMyMzZaMEExCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFt
|
||||
cGxlMRAwDgYDVQQLEwdDbGFzcy0xMQ4wDAYDVQQDEwVTdXNhbjCBnzANBgkqhkiG
|
||||
9w0BAQEFAAOBjQAwgYkCgYEAr2u6mdjqAVtfcgPze+9OUFZu3pi+HqoNBoygm2gq
|
||||
qRAe+FVNSUeNAMQesQBo/eB0F1Iv/BjnYJ/7pYMLaf90MLoYr0Q5vNKYlBdcyUee
|
||||
Jn1WmfN2Qk+UoUaiM4HAKHNJnZk13vWpZW54mcW1q09oj0oMjAZtaZsqpY6CtW6/
|
||||
+J8CAwEAAaNPME0wCwYDVR0PBAQDAgPoMB0GA1UdDgQWBBQVK9naug5W9pQlBqD2
|
||||
fVaCXooa1TAfBgNVHSMEGDAWgBRidC8Dt3dBzYESKpR2tR560sZ0+zANBgkqhkiG
|
||||
9w0BAQQFAAOBgQDKYoM8EbP78ucjtsdvw4ywyo21hhSeP9PmRnNz/U3F9sQATmn+
|
||||
QBl6sBsrmbML2yrhkM1ctZTVUVp0S72fAbLgVjNk86p/CF+a2tmi0+lJh1aR7zQi
|
||||
opt+68Nec2/52kgWi64ruF7YITmGHBxS/RDooFbscZbdrPgcow/Jw+5HnQ==
|
||||
-----END CERTIFICATE-----
|
||||
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
Proc-Type: 4,ENCRYPTED
|
||||
DEK-Info: DES-EDE3-CBC,9025CDB2AB43B0DE
|
||||
|
||||
q4hvYnqkhDSDCsbXfxtMjPvzT38ql5wscOsGwDM/xMANSyPk9h/aqAxvB8G+8v6E
|
||||
63x9Q5jRi2YY6z2sOpvu0utu7Xn6KA/H1YrpYFURTEjBbK2Qd41vPQ/NYcIO3nQd
|
||||
PR2Qm3kpNumBSZomyNfJk9oegGxfw+P0af2GIb6YqmTDot+LLCLwpqxrGyQQ1LYp
|
||||
zc4A9D/b19Y0eD+TU9S2KEYszvfUo7RBxRFSZ6QN1rT2SEa7IJN9wb6TvgeB2lRB
|
||||
Ds90tmLtkbuwLTZre+aqbM8mU40+RI9GHh+mPw0Qz55Kw2CUe+PnGsLQnOTm7p/I
|
||||
mLiPTNMJKvwaR18Z88IE9UwL0zE/ND7vZfrhqTn9bHRnzHU4NtBCBsS8zloI+rXZ
|
||||
EIWKMDyzMH3wpbNYq/AemSvvUz1wGOxit5TjG2QwwCNt8hPLl0Es6Q5aWdAPPrLM
|
||||
EfX/6gL7bLTHNyLPz/U32o0H4hz5J7FQ7SuYUPLI3ybiPC2qL11jbtrZMesAYEAX
|
||||
mvRnqO+6dPEpwGmKz8kUj2mC8X8FPKCCiy4kbc8NjLTMao+/vOgD+wBuIePaC3yE
|
||||
vpuZrsUSFZWRJ824sDMmmZFoi2DKsp1zqCV1kXozaPGigaOxtkdp890nBcGkPijQ
|
||||
8F+jCGwSFda6UfuJHCQ/eJB+8LQUWa8u1TeJ9zo98oD2OBfQ5maZU0Vfv1EXvwbp
|
||||
pz2R6HXFaPrQDeGO0xVzD453AbY/fZCGnhIwrEYvPAbwpIKde397MP66gYFMNFhA
|
||||
IaMimFnBv7IHL08Ka0KtqbVhLpEKWFpZ6LsOnyispeB4KF0md+lpGg==
|
||||
-----END RSA PRIVATE KEY-----
|
||||
|
|
@ -0,0 +1,314 @@
|
|||
/*
|
||||
* Copyright (c) 2009, 2025, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
//
|
||||
// Security properties, once set, cannot revert to unset. To avoid
|
||||
// conflicts with tests running in the same VM isolate this test by
|
||||
// running it in otherVM mode.
|
||||
//
|
||||
|
||||
/**
|
||||
* @test
|
||||
* @bug 6852744
|
||||
* @summary PIT b61: PKI test suite fails because self signed certificates
|
||||
* are being rejected
|
||||
* @modules java.base/sun.security.util
|
||||
* @enablePreview
|
||||
* @run main/othervm StatusLoopDependency subca
|
||||
* @run main/othervm StatusLoopDependency subci
|
||||
* @run main/othervm StatusLoopDependency alice
|
||||
*/
|
||||
|
||||
import java.security.DEREncodable;
|
||||
import java.security.PEMDecoder;
|
||||
import java.security.Security;
|
||||
import java.security.cert.CertPathBuilder;
|
||||
import java.security.cert.CertStore;
|
||||
import java.security.cert.Certificate;
|
||||
import java.security.cert.CollectionCertStoreParameters;
|
||||
import java.security.cert.PKIXBuilderParameters;
|
||||
import java.security.cert.PKIXCertPathBuilderResult;
|
||||
import java.security.cert.TrustAnchor;
|
||||
import java.security.cert.X509CRL;
|
||||
import java.security.cert.X509CertSelector;
|
||||
import java.security.cert.X509Certificate;
|
||||
import java.util.Collection;
|
||||
import java.util.Collections;
|
||||
import java.util.Date;
|
||||
import java.util.HashSet;
|
||||
import java.util.Set;
|
||||
|
||||
import sun.security.util.DerInputStream;
|
||||
|
||||
/**
|
||||
* KeyUsage extension plays a important rule during looking for the issuer
|
||||
* of a certificate or CRL. A certificate issuer should have the keyCertSign
|
||||
* bit set, and a CRL issuer should have the cRLSign bit set.
|
||||
*
|
||||
* Sometime, a delegated CRL issuer would also have the keyCertSign bit set,
|
||||
* as would be troublesome to find the proper CRL issuer during certificate
|
||||
* path build if the delegated CRL issuer is a self-issued certificate, for
|
||||
* it is hard to identify it from its issuer by the "issuer" field only.
|
||||
*
|
||||
* In the test case, the delegated CRL issuers have keyCertSign bit set, and
|
||||
* the CAs have the cRLSign bit set also. If we cannot identify the delegated
|
||||
* CRL issuer from its issuer, there is a potential loop to find the correct
|
||||
* CRL.
|
||||
*
|
||||
* And when revocation enabled, needs to check the status of the delegated
|
||||
* CRL issuers. If the delegated CRL issuer issues itself status, there is
|
||||
* a potential loop to verify the CRL and check the status of delegated CRL
|
||||
* issuer.
|
||||
*
|
||||
* The fix of 6852744 should addresses above issues.
|
||||
*/
|
||||
public final class StatusLoopDependency {
|
||||
|
||||
// the trust anchor
|
||||
static String selfSignedCertStr =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIICPjCCAaegAwIBAgIBADANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ\n" +
|
||||
"MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA2MjgxMzMyMThaFw0zMDA2MDgxMzMyMTha\n" +
|
||||
"MB8xCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMIGfMA0GCSqGSIb3DQEB\n" +
|
||||
"AQUAA4GNADCBiQKBgQDInJhXi0655bPXAVkz1n5I6fAcZejzPnOPuwq3hU3OxFw8\n" +
|
||||
"81Uf6o9oKI1h4w4XAD8u1cUNOgiX+wPwojronlp68bIfO6FVhNf287pLtLhNJo+7\n" +
|
||||
"m6Qxw3ymFvEKy+PVj20CHSggdKHxUa4MBZBmHMFNBuxfYmjwzn+yTMmCCXOvSwID\n" +
|
||||
"AQABo4GJMIGGMB0GA1UdDgQWBBSQ52Dpau+gtL+Kc31dusYnKj16ZTBHBgNVHSME\n" +
|
||||
"QDA+gBSQ52Dpau+gtL+Kc31dusYnKj16ZaEjpCEwHzELMAkGA1UEBhMCVVMxEDAO\n" +
|
||||
"BgNVBAoTB0V4YW1wbGWCAQAwDwYDVR0TAQH/BAUwAwEB/zALBgNVHQ8EBAMCAQYw\n" +
|
||||
"DQYJKoZIhvcNAQEEBQADgYEAjBt6ea65HCqbGsS2rs/HhlGusYXtThRVC5vwXSey\n" +
|
||||
"ZFYwSgukuq1KDzckqZFu1meNImEwdZjwxdN0e2p/nVREPC42rZliSj6V1ThayKXj\n" +
|
||||
"DWEZW1U5aR8T+3NYfDrdKcJGx4Hzfz0qKz1j4ssV1M9ptJxYYv4y2Da+592IN1S9\n" +
|
||||
"v/E=\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
// the sub-ca
|
||||
static String subCaCertStr =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIICUDCCAbmgAwIBAgIBAzANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ\n" +
|
||||
"MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA2MjgxMzMyMjRaFw0yOTAzMTUxMzMyMjRa\n" +
|
||||
"MDExCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMRAwDgYDVQQLEwdDbGFz\n" +
|
||||
"cy0xMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPFv24SK78VI0gWlyIrq/X\n" +
|
||||
"srl1431K5hJJxMYZtaQunyPmrYg3oI9KvKFykxnR0N4XDPaIi75p9dXGppVu80BA\n" +
|
||||
"+csvIPBwlBQoNmKDQWTziDOqfK4tE+IMuL/Y7pxnH6CDMY7VGpvatty2zcmH+m/v\n" +
|
||||
"E/n+HPyeELJQT2rT/3T+7wIDAQABo4GJMIGGMB0GA1UdDgQWBBRidC8Dt3dBzYES\n" +
|
||||
"KpR2tR560sZ0+zBHBgNVHSMEQDA+gBSQ52Dpau+gtL+Kc31dusYnKj16ZaEjpCEw\n" +
|
||||
"HzELMAkGA1UEBhMCVVMxEDAOBgNVBAoTB0V4YW1wbGWCAQAwDwYDVR0TAQH/BAUw\n" +
|
||||
"AwEB/zALBgNVHQ8EBAMCAQYwDQYJKoZIhvcNAQEEBQADgYEAMeMKqrMr5d3eTQsv\n" +
|
||||
"MYOD15Dl3THQGLAa4ad5Eyq5/1eUeEOpztzCgDfi0iPD8YCubIEVasBTSqTiGXqb\n" +
|
||||
"RpGuPHOwwfWvHrTeHSludiFBAUiKj7aEV+oQa0FBn4U4TT8HA62HQ93FhzTDI3jP\n" +
|
||||
"iil34GktVl6gfMKGzUEW/Dh8OM4=\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
// a delegated CRL issuer, it's a self-issued certificate of trust anchor
|
||||
static String topCrlIssuerCertStr =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIICPjCCAaegAwIBAgIBAjANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ\n" +
|
||||
"MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA2MjgxMzMyMjNaFw0yOTAzMTUxMzMyMjNa\n" +
|
||||
"MB8xCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMIGfMA0GCSqGSIb3DQEB\n" +
|
||||
"AQUAA4GNADCBiQKBgQC99u93trf+WmpfiqunJy/P31ej1l4rESxft2JSGNjKuLFN\n" +
|
||||
"/BO3SAugGJSkCARAwXjB0c8eeXhXWhVVWdNpbKepRJTxrjDfnFIavLgtUvmFwn/3\n" +
|
||||
"hPXe+RQeA8+AJ99Y+o+10kY8JAZLa2j93C2FdmwOjUbo8aIz85yhbiV1tEDjLwID\n" +
|
||||
"AQABo4GJMIGGMB0GA1UdDgQWBBSyFyA3XWLbdL6W6hksmBn7RKsQmDBHBgNVHSME\n" +
|
||||
"QDA+gBSQ52Dpau+gtL+Kc31dusYnKj16ZaEjpCEwHzELMAkGA1UEBhMCVVMxEDAO\n" +
|
||||
"BgNVBAoTB0V4YW1wbGWCAQAwDwYDVR0TAQH/BAUwAwEB/zALBgNVHQ8EBAMCAQYw\n" +
|
||||
"DQYJKoZIhvcNAQEEBQADgYEAHTm8aRTeakgCfEBCgSWK9wvMW1c18ANGMm8OFDBk\n" +
|
||||
"xabVy9BT0MVFHlaneh89oIxTZN0FMTpg21GZMAvIzhEt7DGdO7HLsW7JniN7/OZ0\n" +
|
||||
"rACmpK5frmZrLS03zUm8c+rTbazNfYLoZVG3/mDZbKIi+4y8IGnFcgLVsHsYoBNP\n" +
|
||||
"G0c=\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
// a delegated CRL issuer, it's a self-issued certificate of sub-ca
|
||||
static String subCrlIssuerCertStr =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIICUDCCAbmgAwIBAgIBBDANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ\n" +
|
||||
"MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA2MjgxMzMyMjdaFw0yOTAzMTUxMzMyMjda\n" +
|
||||
"MDExCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMRAwDgYDVQQLEwdDbGFz\n" +
|
||||
"cy0xMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC+8AcLJtGAVUWvv3ifcyQw\n" +
|
||||
"OGqwzcPrBw/XCs6vTMlcdtFzcH1M+Z3/QHN9+5VT1gqeTIZ+b8g9005Og3XKy/HX\n" +
|
||||
"obXZeLv20VZsr+jm52ySghEYOVCTJ9OyFOAp5adp6nf0cA66Feh3LsmVhpTEcDOG\n" +
|
||||
"GnyntQm0DBYxRoOT/GBlvQIDAQABo4GJMIGGMB0GA1UdDgQWBBSRWhMuZLQoHSDN\n" +
|
||||
"xhxr+vdDmfAY8jBHBgNVHSMEQDA+gBSQ52Dpau+gtL+Kc31dusYnKj16ZaEjpCEw\n" +
|
||||
"HzELMAkGA1UEBhMCVVMxEDAOBgNVBAoTB0V4YW1wbGWCAQAwDwYDVR0TAQH/BAUw\n" +
|
||||
"AwEB/zALBgNVHQ8EBAMCAQYwDQYJKoZIhvcNAQEEBQADgYEAMIDZLdOLFiPyS1bh\n" +
|
||||
"Ch4eUYHT+K1WG93skbga3kVYg3GSe+gctwkKwKK13bwfi8zc7wwz6MtmQwEYhppc\n" +
|
||||
"pKKKEwi5QirBCP54rihLCvRQaj6ZqUJ6VP+zPAqHYMDbzlBbHtVF/1lQUP30I6SV\n" +
|
||||
"Fu987DvLmZ2GuQA9FKJsnlD9pbU=\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
// the target EE certificate
|
||||
static String targetCertStr =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIICNzCCAaCgAwIBAgIBAjANBgkqhkiG9w0BAQQFADAxMQswCQYDVQQGEwJVUzEQ\n" +
|
||||
"MA4GA1UEChMHRXhhbXBsZTEQMA4GA1UECxMHQ2xhc3MtMTAeFw0wOTA2MjgxMzMy\n" +
|
||||
"MzBaFw0yOTAzMTUxMzMyMzBaMEExCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFt\n" +
|
||||
"cGxlMRAwDgYDVQQLEwdDbGFzcy0xMQ4wDAYDVQQDEwVBbGljZTCBnzANBgkqhkiG\n" +
|
||||
"9w0BAQEFAAOBjQAwgYkCgYEA7wnsvR4XEOfVznf40l8ClLod+7L0y2/+smVV+GM/\n" +
|
||||
"T1/QF/stajAJxXNy08gK00WKZ6ruTHhR9vh/Z6+EQM2RZDCpU0A7LPa3kLE/XTmS\n" +
|
||||
"1MLDu8ntkdlpURpvhdDWem+rl2HU5oZgzV8Jkcov9vXuSjqEDfr45FlPuV40T8+7\n" +
|
||||
"cxsCAwEAAaNPME0wCwYDVR0PBAQDAgPoMB0GA1UdDgQWBBSBwsAhi6Z1kriOs3ty\n" +
|
||||
"uSIujv9a3DAfBgNVHSMEGDAWgBRidC8Dt3dBzYESKpR2tR560sZ0+zANBgkqhkiG\n" +
|
||||
"9w0BAQQFAAOBgQDEiBqd5AMy2SQopFaS3dYkzj8MHlwtbCSoNVYkOfDnewcatrbk\n" +
|
||||
"yFcp6FX++PMdOQFHWvvnDdkCUAzZQp8kCkF9tGLVLBtOK7XxQ1us1LZym7kOPzsd\n" +
|
||||
"G93Dcf0U1JRO77juc61Br5paAy8Bok18Y/MeG7uKgB2MAEJYKhGKbCrfMw==\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
// CRL issued by the delegated CRL issuer, topCrlIssuerCertStr
|
||||
static String topCrlStr =
|
||||
"-----BEGIN X509 CRL-----\n" +
|
||||
"MIIBGzCBhQIBATANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQMA4GA1UE\n" +
|
||||
"ChMHRXhhbXBsZRcNMDkwNjI4MTMzMjM4WhcNMjgwODI3MTMzMjM4WjAiMCACAQUX\n" +
|
||||
"DTA5MDYyODEzMzIzN1owDDAKBgNVHRUEAwoBBKAOMAwwCgYDVR0UBAMCAQEwDQYJ\n" +
|
||||
"KoZIhvcNAQEEBQADgYEAVUIeu2x7ZwsliafoCBOg+u8Q4S/VFfTe/SQnRyTM3/V1\n" +
|
||||
"v+Vn5Acc7eo8Rh4AHcnFFbLNk38n6lllov/CaVR0IPZ6hnrNHVa7VYkNlRAwV2aN\n" +
|
||||
"GUUhkMMOLVLnN25UOrN9J637SHmRE6pB+TRMaEQ73V7UNlWxuSMK4KofWen0A34=\n" +
|
||||
"-----END X509 CRL-----";
|
||||
|
||||
// CRL issued by the delegated CRL issuer, subCrlIssuerCertStr
|
||||
static String subCrlStr =
|
||||
"-----BEGIN X509 CRL-----\n" +
|
||||
"MIIBLTCBlwIBATANBgkqhkiG9w0BAQQFADAxMQswCQYDVQQGEwJVUzEQMA4GA1UE\n" +
|
||||
"ChMHRXhhbXBsZTEQMA4GA1UECxMHQ2xhc3MtMRcNMDkwNjI4MTMzMjQzWhcNMjgw\n" +
|
||||
"ODI3MTMzMjQzWjAiMCACAQQXDTA5MDYyODEzMzIzOFowDDAKBgNVHRUEAwoBBKAO\n" +
|
||||
"MAwwCgYDVR0UBAMCAQEwDQYJKoZIhvcNAQEEBQADgYEACQZEf6ydb3fKTMPJ8DBO\n" +
|
||||
"oo630MsrT3P0x0AC4+aQOueCBaGpNqW/H379uZxXAad7yr+aXUBwaeBMYVKUbwOe\n" +
|
||||
"5TrN5QWPe2eCkU+MSQvh1SHASDDMH4jhWFMRdO3aPMDKKPlO/Q3s0G72eD7Zo5dr\n" +
|
||||
"N9AvUXxGxU4DruoJuFPcrCI=\n" +
|
||||
"-----END X509 CRL-----";
|
||||
|
||||
private static final PEMDecoder pemDecoder = PEMDecoder.of();
|
||||
|
||||
private static Set<TrustAnchor> generateTrustAnchors() {
|
||||
X509Certificate selfSignedCert = pemDecoder.decode(selfSignedCertStr, X509Certificate.class);
|
||||
|
||||
// generate a trust anchor
|
||||
TrustAnchor anchor =
|
||||
new TrustAnchor(selfSignedCert, null);
|
||||
|
||||
return Collections.singleton(anchor);
|
||||
}
|
||||
|
||||
private static CertStore generateCertificateStore() throws Exception {
|
||||
|
||||
Collection<DEREncodable> entries = new HashSet<>();
|
||||
|
||||
DEREncodable cert = pemDecoder.decode(targetCertStr, X509Certificate.class);
|
||||
entries.add(cert);
|
||||
|
||||
cert = pemDecoder.decode(subCaCertStr, X509Certificate.class);
|
||||
entries.add(cert);
|
||||
|
||||
cert = pemDecoder.decode(selfSignedCertStr, X509Certificate.class);
|
||||
entries.add(cert);
|
||||
|
||||
cert = pemDecoder.decode(topCrlIssuerCertStr, X509Certificate.class);
|
||||
entries.add(cert);
|
||||
|
||||
cert = pemDecoder.decode(subCrlIssuerCertStr, X509Certificate.class);
|
||||
entries.add(cert);
|
||||
|
||||
// generate CRL from CRL string
|
||||
DEREncodable mixes = pemDecoder.decode(topCrlStr, X509CRL.class);
|
||||
entries.add(mixes);
|
||||
|
||||
mixes = pemDecoder.decode(subCrlStr, X509CRL.class);
|
||||
entries.add(mixes);
|
||||
|
||||
return CertStore.getInstance("Collection",
|
||||
new CollectionCertStoreParameters(entries));
|
||||
}
|
||||
|
||||
private static X509CertSelector generateSelector(String name)
|
||||
throws Exception {
|
||||
X509CertSelector selector = new X509CertSelector();
|
||||
|
||||
// generate certificate from certificate string
|
||||
String cert;
|
||||
if (name.equals("subca")) {
|
||||
cert = subCaCertStr;
|
||||
} else if (name.equals("subci")) {
|
||||
cert = subCrlIssuerCertStr;
|
||||
} else {
|
||||
cert = targetCertStr;
|
||||
}
|
||||
|
||||
X509Certificate target = pemDecoder.decode(cert, X509Certificate.class);
|
||||
byte[] extVal = target.getExtensionValue("2.5.29.14");
|
||||
if (extVal != null) {
|
||||
DerInputStream in = new DerInputStream(extVal);
|
||||
byte[] subjectKID = in.getOctetString();
|
||||
selector.setSubjectKeyIdentifier(subjectKID);
|
||||
} else {
|
||||
// unlikely to happen.
|
||||
throw new Exception("unexpected certificate: no SKID extension");
|
||||
}
|
||||
|
||||
return selector;
|
||||
}
|
||||
|
||||
private static boolean match(String name, Certificate cert) {
|
||||
|
||||
// generate certificate from certificate string
|
||||
String newCert;
|
||||
if (name.equals("subca")) {
|
||||
newCert = subCaCertStr;
|
||||
} else if (name.equals("subci")) {
|
||||
newCert = subCrlIssuerCertStr;
|
||||
} else {
|
||||
newCert = targetCertStr;
|
||||
}
|
||||
X509Certificate target = pemDecoder.decode(newCert, X509Certificate.class);
|
||||
|
||||
return target.equals(cert);
|
||||
}
|
||||
|
||||
|
||||
public static void main(String[] args) throws Exception {
|
||||
// MD5 is used in this test case, don't disable MD5 algorithm.
|
||||
Security.setProperty(
|
||||
"jdk.certpath.disabledAlgorithms", "MD2, RSA keySize < 1024");
|
||||
|
||||
CertPathBuilder builder = CertPathBuilder.getInstance("PKIX");
|
||||
|
||||
X509CertSelector selector = generateSelector(args[0]);
|
||||
|
||||
Set<TrustAnchor> anchors = generateTrustAnchors();
|
||||
CertStore certs = generateCertificateStore();
|
||||
|
||||
|
||||
PKIXBuilderParameters params =
|
||||
new PKIXBuilderParameters(anchors, selector);
|
||||
params.addCertStore(certs);
|
||||
params.setRevocationEnabled(true);
|
||||
params.setDate(new Date(109, 7, 1)); // 2009-07-01
|
||||
Security.setProperty("ocsp.enable", "false");
|
||||
System.setProperty("com.sun.security.enableCRLDP", "true");
|
||||
|
||||
PKIXCertPathBuilderResult result =
|
||||
(PKIXCertPathBuilderResult)builder.build(params);
|
||||
|
||||
if (!match(args[0], result.getCertPath().getCertificates().get(0))) {
|
||||
throw new Exception("unexpected certificate");
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,219 @@
|
|||
#
|
||||
# Copyright (c) 2009, 2013, Oracle and/or its affiliates. All rights reserved.
|
||||
# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
#
|
||||
# This code is free software; you can redistribute it and/or modify it
|
||||
# under the terms of the GNU General Public License version 2 only, as
|
||||
# published by the Free Software Foundation.
|
||||
#
|
||||
# This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
# FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
# version 2 for more details (a copy is included in the LICENSE file that
|
||||
# accompanied this code).
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License version
|
||||
# 2 along with this work; if not, write to the Free Software Foundation,
|
||||
# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
#
|
||||
# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
# or visit www.oracle.com if you need additional information or have any
|
||||
# questions.
|
||||
#
|
||||
|
||||
#!/bin/ksh
|
||||
#
|
||||
# needs ksh to run the script.
|
||||
|
||||
# generate a self-signed root certificate
|
||||
if [ ! -f root/root_cert.pem ]; then
|
||||
if [ ! -d root ]; then
|
||||
mkdir root
|
||||
fi
|
||||
|
||||
openssl req -x509 -newkey rsa:1024 -keyout root/root_key.pem \
|
||||
-out root/root_cert.pem -subj "/C=US/O=Example" \
|
||||
-config openssl.cnf -reqexts cert_issuer -days 7650 \
|
||||
-passin pass:passphrase -passout pass:passphrase
|
||||
fi
|
||||
|
||||
# generate a sele-issued root crl issuer certificate
|
||||
if [ ! -f root/top_crlissuer_cert.pem ]; then
|
||||
if [ ! -d root ]; then
|
||||
mkdir root
|
||||
fi
|
||||
|
||||
openssl req -newkey rsa:1024 -keyout root/top_crlissuer_key.pem \
|
||||
-out root/top_crlissuer_req.pem -subj "/C=US/O=Example" -days 7650 \
|
||||
-passin pass:passphrase -passout pass:passphrase
|
||||
|
||||
openssl x509 -req -in root/top_crlissuer_req.pem -extfile openssl.cnf \
|
||||
-extensions crl_issuer -CA root/root_cert.pem \
|
||||
-CAkey root/root_key.pem -out root/top_crlissuer_cert.pem \
|
||||
-CAcreateserial -CAserial root/root_cert.srl -days 7200 \
|
||||
-passin pass:passphrase
|
||||
fi
|
||||
|
||||
# generate subca cert issuer and crl iuuser certificates
|
||||
if [ ! -f subca/subca_cert.pem ]; then
|
||||
if [ ! -d subca ]; then
|
||||
mkdir subca
|
||||
fi
|
||||
|
||||
openssl req -newkey rsa:1024 -keyout subca/subca_key.pem \
|
||||
-out subca/subca_req.pem -subj "/C=US/O=Example/OU=Class-1" \
|
||||
-days 7650 -passin pass:passphrase -passout pass:passphrase
|
||||
|
||||
openssl x509 -req -in subca/subca_req.pem -extfile openssl.cnf \
|
||||
-extensions cert_issuer -CA root/root_cert.pem \
|
||||
-CAkey root/root_key.pem -out subca/subca_cert.pem -CAcreateserial \
|
||||
-CAserial root/root_cert.srl -days 7200 -passin pass:passphrase
|
||||
|
||||
openssl req -newkey rsa:1024 -keyout subca/subca_crlissuer_key.pem \
|
||||
-out subca/subca_crlissuer_req.pem -subj "/C=US/O=Example/OU=Class-1" \
|
||||
-days 7650 -passin pass:passphrase -passout pass:passphrase
|
||||
|
||||
openssl x509 -req -in subca/subca_crlissuer_req.pem -extfile openssl.cnf \
|
||||
-extensions crl_issuer -CA root/root_cert.pem \
|
||||
-CAkey root/root_key.pem -out subca/subca_crlissuer_cert.pem \
|
||||
-CAcreateserial -CAserial root/root_cert.srl -days 7200 \
|
||||
-passin pass:passphrase
|
||||
fi
|
||||
|
||||
# generate dumca cert issuer and crl iuuser certificates
|
||||
if [ ! -f dumca/dumca_cert.pem ]; then
|
||||
if [ ! -d sumca ]; then
|
||||
mkdir dumca
|
||||
fi
|
||||
|
||||
openssl req -newkey rsa:1024 -keyout dumca/dumca_key.pem \
|
||||
-out dumca/dumca_req.pem -subj "/C=US/O=Example/OU=Class-D" \
|
||||
-days 7650 -passin pass:passphrase -passout pass:passphrase
|
||||
|
||||
openssl x509 -req -in dumca/dumca_req.pem -extfile openssl.cnf \
|
||||
-extensions cert_issuer -CA root/root_cert.pem \
|
||||
-CAkey root/root_key.pem -out dumca/dumca_cert.pem \
|
||||
-CAcreateserial -CAserial root/root_cert.srl -days 7200 \
|
||||
-passin pass:passphrase
|
||||
|
||||
openssl req -newkey rsa:1024 -keyout dumca/dumca_crlissuer_key.pem \
|
||||
-out dumca/dumca_crlissuer_req.pem -subj "/C=US/O=Example/OU=Class-D" \
|
||||
-days 7650 -passin pass:passphrase -passout pass:passphrase
|
||||
|
||||
openssl x509 -req -in dumca/dumca_crlissuer_req.pem \
|
||||
-extfile openssl.cnf -extensions crl_issuer -CA root/root_cert.pem \
|
||||
-CAkey root/root_key.pem -out dumca/dumca_crlissuer_cert.pem \
|
||||
-CAcreateserial -CAserial root/root_cert.srl -days 7200 \
|
||||
-passin pass:passphrase
|
||||
fi
|
||||
|
||||
# generate certifiacte for Alice
|
||||
if [ ! -f subca/alice/alice_cert.pem ]; then
|
||||
if [ ! -d subca/alice ]; then
|
||||
mkdir -p subca/alice
|
||||
fi
|
||||
|
||||
openssl req -newkey rsa:1024 -keyout subca/alice/alice_key.pem \
|
||||
-out subca/alice/alice_req.pem \
|
||||
-subj "/C=US/O=Example/OU=Class-1/CN=Alice" -days 7650 \
|
||||
-passin pass:passphrase -passout pass:passphrase
|
||||
|
||||
openssl x509 -req -in subca/alice/alice_req.pem \
|
||||
-extfile openssl.cnf -extensions ee_of_subca \
|
||||
-CA subca/subca_cert.pem -CAkey subca/subca_key.pem \
|
||||
-out subca/alice/alice_cert.pem -CAcreateserial \
|
||||
-CAserial subca/subca_cert.srl -days 7200 -passin pass:passphrase
|
||||
fi
|
||||
|
||||
# generate certifiacte for Bob
|
||||
if [ ! -f subca/bob/bob_cert.pem ]; then
|
||||
if [ ! -d subca/bob ]; then
|
||||
mkdir -p subca/bob
|
||||
fi
|
||||
|
||||
openssl req -newkey rsa:1024 -keyout subca/bob/bob_key.pem \
|
||||
-out subca/bob/bob_req.pem \
|
||||
-subj "/C=US/O=Example/OU=Class-1/CN=Bob" -days 7650 \
|
||||
-passin pass:passphrase -passout pass:passphrase
|
||||
|
||||
openssl x509 -req -in subca/bob/bob_req.pem \
|
||||
-extfile openssl.cnf -extensions ee_of_subca \
|
||||
-CA subca/subca_cert.pem -CAkey subca/subca_key.pem \
|
||||
-out subca/bob/bob_cert.pem -CAcreateserial \
|
||||
-CAserial subca/subca_cert.srl -days 7200 -passin pass:passphrase
|
||||
fi
|
||||
|
||||
# generate certifiacte for Susan
|
||||
if [ ! -f subca/susan/susan_cert.pem ]; then
|
||||
if [ ! -d subca/susan ]; then
|
||||
mkdir -p subca/susan
|
||||
fi
|
||||
|
||||
openssl req -newkey rsa:1024 -keyout subca/susan/susan_key.pem \
|
||||
-out subca/susan/susan_req.pem \
|
||||
-subj "/C=US/O=Example/OU=Class-1/CN=Susan" -days 7650 \
|
||||
-passin pass:passphrase -passout pass:passphrase
|
||||
|
||||
openssl x509 -req -in subca/susan/susan_req.pem -extfile openssl.cnf \
|
||||
-extensions ee_of_subca -CA subca/subca_cert.pem \
|
||||
-CAkey subca/subca_key.pem -out subca/susan/susan_cert.pem \
|
||||
-CAcreateserial -CAserial subca/subca_cert.srl -days 7200 \
|
||||
-passin pass:passphrase
|
||||
fi
|
||||
|
||||
|
||||
# generate the top CRL
|
||||
if [ ! -f root/top_crl.pem ]; then
|
||||
if [ ! -d root ]; then
|
||||
mkdir root
|
||||
fi
|
||||
|
||||
if [ ! -f root/index.txt ]; then
|
||||
touch root/index.txt
|
||||
echo 00 > root/crlnumber
|
||||
fi
|
||||
|
||||
openssl ca -gencrl -config openssl.cnf -name ca_top -crldays 7000 \
|
||||
-crl_reason superseded -keyfile root/top_crlissuer_key.pem \
|
||||
-cert root/top_crlissuer_cert.pem -out root/top_crl.pem \
|
||||
-passin pass:passphrase
|
||||
fi
|
||||
|
||||
# revoke dumca
|
||||
openssl ca -revoke dumca/dumca_cert.pem -config openssl.cnf \
|
||||
-name ca_top -crl_reason superseded \
|
||||
-keyfile root/top_crlissuer_key.pem -cert root/top_crlissuer_cert.pem \
|
||||
-passin pass:passphrase
|
||||
|
||||
openssl ca -gencrl -config openssl.cnf -name ca_top -crldays 7000 \
|
||||
-crl_reason superseded -keyfile root/top_crlissuer_key.pem \
|
||||
-cert root/top_crlissuer_cert.pem -out root/top_crl.pem \
|
||||
-passin pass:passphrase
|
||||
|
||||
# revoke for subca
|
||||
if [ ! -f subca/subca_crl.pem ]; then
|
||||
if [ ! -d subca ]; then
|
||||
mkdir subca
|
||||
fi
|
||||
|
||||
if [ ! -f subca/index.txt ]; then
|
||||
touch subca/index.txt
|
||||
echo 00 > subca/crlnumber
|
||||
fi
|
||||
|
||||
openssl ca -gencrl -config openssl.cnf -name ca_subca -crldays 7000 \
|
||||
-crl_reason superseded -keyfile subca/subca_crlissuer_key.pem \
|
||||
-cert subca/subca_crlissuer_cert.pem -out subca/subca_crl.pem \
|
||||
-passin pass:passphrase
|
||||
fi
|
||||
|
||||
# revoke susan
|
||||
openssl ca -revoke subca/susan/susan_cert.pem -config openssl.cnf \
|
||||
-name ca_subca -crl_reason superseded \
|
||||
-keyfile subca/subca_crlissuer_key.pem \
|
||||
-cert subca/subca_crlissuer_cert.pem -passin pass:passphrase
|
||||
|
||||
openssl ca -gencrl -config openssl.cnf -name ca_subca -crldays 7000 \
|
||||
-crl_reason superseded -keyfile subca/subca_crlissuer_key.pem \
|
||||
-cert subca/subca_crlissuer_cert.pem -out subca/subca_crl.pem \
|
||||
-passin pass:passphrase
|
||||
|
|
@ -0,0 +1,203 @@
|
|||
#
|
||||
# Copyright (c) 2009, Oracle and/or its affiliates. All rights reserved.
|
||||
# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
#
|
||||
# This code is free software; you can redistribute it and/or modify it
|
||||
# under the terms of the GNU General Public License version 2 only, as
|
||||
# published by the Free Software Foundation.
|
||||
#
|
||||
# This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
# FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
# version 2 for more details (a copy is included in the LICENSE file that
|
||||
# accompanied this code).
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License version
|
||||
# 2 along with this work; if not, write to the Free Software Foundation,
|
||||
# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
#
|
||||
# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
# or visit www.oracle.com if you need additional information or have any
|
||||
# questions.
|
||||
#
|
||||
|
||||
#
|
||||
# OpenSSL configuration file.
|
||||
#
|
||||
|
||||
HOME = .
|
||||
RANDFILE = $ENV::HOME/.rnd
|
||||
|
||||
[ ca ]
|
||||
default_ca = CA_default
|
||||
|
||||
[ CA_default ]
|
||||
dir = ./top
|
||||
certs = $dir/certs
|
||||
crl_dir = $dir/crl
|
||||
database = $dir/index.txt
|
||||
unique_subject = no
|
||||
new_certs_dir = $dir/newcerts
|
||||
certificate = $dir/cacert.pem
|
||||
serial = $dir/serial
|
||||
crlnumber = $dir/crlnumber
|
||||
crl = $dir/crl.pem
|
||||
private_key = $dir/private/cakey.pem
|
||||
RANDFILE = $dir/private/.rand
|
||||
x509_extensions = v3_ca
|
||||
|
||||
name_opt = ca_default
|
||||
cert_opt = ca_default
|
||||
|
||||
default_days = 7650
|
||||
default_crl_days = 30
|
||||
default_md = sha1
|
||||
preserve = no
|
||||
|
||||
policy = policy_anything
|
||||
|
||||
[ ca_top ]
|
||||
dir = ./root
|
||||
certs = $dir/certs
|
||||
crl_dir = $dir/crl
|
||||
database = $dir/index.txt
|
||||
unique_subject = no
|
||||
new_certs_dir = $dir/newcerts
|
||||
certificate = $dir/cacert.pem
|
||||
serial = $dir/serial
|
||||
crlnumber = $dir/crlnumber
|
||||
crl = $dir/crl.pem
|
||||
private_key = $dir/private/cakey.pem
|
||||
RANDFILE = $dir/private/.rand
|
||||
|
||||
x509_extensions = v3_ca
|
||||
|
||||
name_opt = ca_default
|
||||
cert_opt = ca_default
|
||||
|
||||
default_days = 7650
|
||||
default_crl_days = 30
|
||||
default_md = sha1
|
||||
preserve = no
|
||||
|
||||
policy = policy_anything
|
||||
|
||||
[ ca_subca ]
|
||||
dir = ./subca
|
||||
certs = $dir/certs
|
||||
crl_dir = $dir/crl
|
||||
database = $dir/index.txt
|
||||
unique_subject = no
|
||||
new_certs_dir = $dir/newcerts
|
||||
|
||||
certificate = $dir/cacert.pem
|
||||
serial = $dir/serial
|
||||
crlnumber = $dir/crlnumber
|
||||
crl = $dir/crl.pem
|
||||
private_key = $dir/private/cakey.pem
|
||||
RANDFILE = $dir/private/.rand
|
||||
|
||||
x509_extensions = usr_cert
|
||||
|
||||
name_opt = ca_default
|
||||
cert_opt = ca_default
|
||||
|
||||
default_days = 7650
|
||||
default_crl_days = 30
|
||||
default_md = sha1
|
||||
preserve = no
|
||||
|
||||
policy = policy_anything
|
||||
|
||||
[ policy_match ]
|
||||
countryName = match
|
||||
stateOrProvinceName = match
|
||||
organizationName = match
|
||||
organizationalUnitName = optional
|
||||
commonName = supplied
|
||||
emailAddress = optional
|
||||
|
||||
[ policy_anything ]
|
||||
countryName = optional
|
||||
stateOrProvinceName = optional
|
||||
localityName = optional
|
||||
organizationName = optional
|
||||
organizationalUnitName = optional
|
||||
commonName = supplied
|
||||
emailAddress = optional
|
||||
|
||||
[ req ]
|
||||
default_bits = 1024
|
||||
default_keyfile = privkey.pem
|
||||
distinguished_name = req_distinguished_name
|
||||
attributes = req_attributes
|
||||
x509_extensions = v3_ca
|
||||
|
||||
string_mask = nombstr
|
||||
|
||||
[ req_distinguished_name ]
|
||||
countryName = Country Name (2 letter code)
|
||||
countryName_default = NO
|
||||
countryName_min = 2
|
||||
countryName_max = 2
|
||||
|
||||
stateOrProvinceName = State or Province Name (full name)
|
||||
stateOrProvinceName_default = A-State
|
||||
|
||||
localityName = Locality Name (eg, city)
|
||||
|
||||
0.organizationName = Organization Name (eg, company)
|
||||
0.organizationName_default = Internet Widgits Pty Ltd
|
||||
|
||||
organizationalUnitName = Organizational Unit Name (eg, section)
|
||||
|
||||
commonName = Common Name (eg, YOUR name)
|
||||
commonName_max = 64
|
||||
|
||||
emailAddress = Email Address
|
||||
emailAddress_max = 64
|
||||
|
||||
[ req_attributes ]
|
||||
challengePassword = A challenge password
|
||||
challengePassword_min = 4
|
||||
challengePassword_max = 20
|
||||
unstructuredName = An optional company name
|
||||
|
||||
[ usr_cert ]
|
||||
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
||||
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid,issuer
|
||||
|
||||
[ v3_req ]
|
||||
basicConstraints = CA:FALSE
|
||||
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
||||
subjectAltName = email:example@openjdk.net, RID:1.2.3.4:true
|
||||
|
||||
[ v3_ca ]
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid:always,issuer:always
|
||||
basicConstraints = critical,CA:true
|
||||
keyUsage = keyCertSign, cRLSign
|
||||
|
||||
[ cert_issuer ]
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid:always,issuer:always
|
||||
basicConstraints = critical,CA:true
|
||||
keyUsage = keyCertSign, cRLSign
|
||||
|
||||
[ crl_issuer ]
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid:always,issuer:always
|
||||
basicConstraints = critical,CA:true
|
||||
keyUsage = keyCertSign, cRLSign
|
||||
|
||||
|
||||
[ crl_ext ]
|
||||
authorityKeyIdentifier = keyid:always,issuer:always
|
||||
|
||||
[ ee_of_subca ]
|
||||
keyUsage = nonRepudiation, digitalSignature, keyEncipherment, keyAgreement
|
||||
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid,issuer
|
||||
|
|
@ -0,0 +1,94 @@
|
|||
/*
|
||||
* Copyright (c) 2008, 2022, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
// This test case relies on updated static security property, no way to re-use
|
||||
// security property in samevm/agentvm mode.
|
||||
|
||||
/**
|
||||
* @test
|
||||
* @bug 6714842
|
||||
* @library /test/lib
|
||||
* @run main/othervm BuildEEBasicConstraints
|
||||
* @summary make sure a PKIX CertPathBuilder builds a path to an
|
||||
* end entity certificate when the setBasicConstraints method of the
|
||||
* X509CertSelector of the targetConstraints PKIXBuilderParameters
|
||||
* parameter is set to -2.
|
||||
*/
|
||||
|
||||
import java.security.Security;
|
||||
import java.security.cert.Certificate;
|
||||
import java.security.cert.CertPath;
|
||||
import java.security.cert.CertStore;
|
||||
import java.security.cert.CollectionCertStoreParameters;
|
||||
import java.security.cert.PKIXBuilderParameters;
|
||||
import java.security.cert.PKIXCertPathBuilderResult;
|
||||
import java.security.cert.TrustAnchor;
|
||||
import java.security.cert.X509Certificate;
|
||||
import java.security.cert.X509CertSelector;
|
||||
import java.text.DateFormat;
|
||||
import java.util.ArrayList;
|
||||
import java.util.Collections;
|
||||
import java.util.List;
|
||||
import java.util.Locale;
|
||||
|
||||
import jdk.test.lib.security.CertUtils;
|
||||
|
||||
public final class BuildEEBasicConstraints {
|
||||
|
||||
public static void main(String[] args) throws Exception {
|
||||
// reset the security property to make sure that the algorithms
|
||||
// and keys used in this test are not disabled.
|
||||
Security.setProperty("jdk.certpath.disabledAlgorithms", "MD2");
|
||||
|
||||
X509Certificate rootCert = CertUtils.getCertFromFile("anchor.cer");
|
||||
TrustAnchor anchor = new TrustAnchor
|
||||
(rootCert.getSubjectX500Principal(), rootCert.getPublicKey(), null);
|
||||
X509CertSelector sel = new X509CertSelector();
|
||||
sel.setBasicConstraints(-2);
|
||||
PKIXBuilderParameters params = new PKIXBuilderParameters
|
||||
(Collections.singleton(anchor), sel);
|
||||
params.setRevocationEnabled(false);
|
||||
|
||||
// Certs expired on 7th Nov 2022
|
||||
params.setDate(DateFormat.getDateInstance(DateFormat.MEDIUM,
|
||||
Locale.US).parse("June 01, 2022"));
|
||||
|
||||
X509Certificate eeCert = CertUtils.getCertFromFile("ee.cer");
|
||||
X509Certificate caCert = CertUtils.getCertFromFile("ca.cer");
|
||||
ArrayList<X509Certificate> certs = new ArrayList<X509Certificate>();
|
||||
certs.add(caCert);
|
||||
certs.add(eeCert);
|
||||
CollectionCertStoreParameters ccsp =
|
||||
new CollectionCertStoreParameters(certs);
|
||||
CertStore cs = CertStore.getInstance("Collection", ccsp);
|
||||
params.addCertStore(cs);
|
||||
PKIXCertPathBuilderResult res = CertUtils.build(params);
|
||||
CertPath cp = res.getCertPath();
|
||||
// check that first certificate is an EE cert
|
||||
List<? extends Certificate> certList = cp.getCertificates();
|
||||
X509Certificate cert = (X509Certificate) certList.get(0);
|
||||
if (cert.getBasicConstraints() != -1) {
|
||||
throw new Exception("Target certificate is not an EE certificate");
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,139 @@
|
|||
/*
|
||||
* Copyright (c) 2001, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
/**
|
||||
* @test
|
||||
* @bug 4459538
|
||||
* @summary make sure a PKIX CertPathBuilder throws an
|
||||
* InvalidAlgorithmParameterException if the target constraints
|
||||
* specified in the PKIXBuilderParameters is not an instance of
|
||||
* X509CertSelector.
|
||||
*/
|
||||
|
||||
import java.io.File;
|
||||
import java.io.FileInputStream;
|
||||
import java.io.IOException;
|
||||
|
||||
import java.security.InvalidAlgorithmParameterException;
|
||||
import java.security.cert.Certificate;
|
||||
import java.security.cert.CertificateFactory;
|
||||
import java.security.cert.CertPathBuilder;
|
||||
import java.security.cert.CertPathBuilderResult;
|
||||
import java.security.cert.PKIXBuilderParameters;
|
||||
import java.security.cert.TrustAnchor;
|
||||
import java.security.cert.X509Certificate;
|
||||
import java.security.cert.CertSelector;
|
||||
|
||||
import java.util.Collections;
|
||||
import java.util.Set;
|
||||
|
||||
/**
|
||||
* BuildOddSel tries to perform a simple build of a certification path
|
||||
* using the PKIX algorithm and a bogus target constraints CertSelector
|
||||
* (one that is not an instance of X509CertSelector). On success, it should
|
||||
* throw an InvalidAlgorithmParameterException.
|
||||
*
|
||||
* @author Steve Hanna
|
||||
* @author Sean Mullan
|
||||
*/
|
||||
public final class BuildOddSel {
|
||||
|
||||
private static PKIXBuilderParameters params;
|
||||
private static CertSelector sel;
|
||||
|
||||
public static void main(String[] args) throws Exception {
|
||||
|
||||
try {
|
||||
createParams();
|
||||
build(params);
|
||||
throw new Exception
|
||||
("CertPath should not have been built successfully");
|
||||
} catch (InvalidAlgorithmParameterException iape) {
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* CertSelector class that should cause SunCertPathBuilder to
|
||||
* throw an InvalidAlgorithmParameterException.
|
||||
*/
|
||||
static class OddSel implements CertSelector {
|
||||
public Object clone() {
|
||||
try {
|
||||
return super.clone();
|
||||
} catch (CloneNotSupportedException e) {
|
||||
throw new UnknownError();
|
||||
}
|
||||
}
|
||||
public boolean match(Certificate cert) {
|
||||
return(false);
|
||||
}
|
||||
}
|
||||
|
||||
public static void createParams() throws Exception {
|
||||
TrustAnchor anchor = new TrustAnchor(getCertFromFile("sun.cer"), null);
|
||||
Set anchors = Collections.singleton(anchor);
|
||||
// Create odd CertSelector
|
||||
sel = new OddSel();
|
||||
params = new PKIXBuilderParameters(anchors, sel);
|
||||
params.setRevocationEnabled(false);
|
||||
}
|
||||
|
||||
/**
|
||||
* Get a DER-encoded X.509 certificate from a file.
|
||||
*
|
||||
* @param certFilePath path to file containing DER-encoded certificate
|
||||
* @return X509Certificate
|
||||
* @throws IOException on error
|
||||
*/
|
||||
public static X509Certificate getCertFromFile(String certFilePath)
|
||||
throws IOException {
|
||||
X509Certificate cert = null;
|
||||
try {
|
||||
File certFile = new File(System.getProperty("test.src", "."),
|
||||
certFilePath);
|
||||
FileInputStream certFileInputStream =
|
||||
new FileInputStream(certFile);
|
||||
CertificateFactory cf = CertificateFactory.getInstance("X509");
|
||||
cert = (X509Certificate)
|
||||
cf.generateCertificate(certFileInputStream);
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
throw new IOException("Can't construct X509Certificate: " +
|
||||
e.getMessage());
|
||||
}
|
||||
return cert;
|
||||
}
|
||||
|
||||
/**
|
||||
* Perform a PKIX build.
|
||||
*
|
||||
* @param params PKIXBuilderParameters to use in building
|
||||
* @throws Exception on error
|
||||
*/
|
||||
public static void build(PKIXBuilderParameters params)
|
||||
throws Exception {
|
||||
CertPathBuilder builder =
|
||||
CertPathBuilder.getInstance("PKIX");
|
||||
CertPathBuilderResult cpbr = builder.build(params);
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
-----BEGIN CERTIFICATE-----
|
||||
MIIBFzCBwgIBATANBgkqhkiG9w0BAQQFADAXMRUwEwYDVQQDEwxUcnVzdCBBbmNo
|
||||
b3IwHhcNMDIxMTA3MTE1NzAzWhcNMjIxMTA3MTE1NzAzWjAXMRUwEwYDVQQDEwxU
|
||||
cnVzdCBBbmNob3IwXDANBgkqhkiG9w0BAQEFAANLADBIAkEA9uCj12hwDgC1n9go
|
||||
0ozQAVMM+DfX0vpKOemyGNp+ycSLfAq3pxBcUKbQhjSRL7YjPkEL8XC6pRLwyEoF
|
||||
osWweQIDAQABMA0GCSqGSIb3DQEBBAUAA0EAzZta5M1qbbozj7jWnNyTgB4HUpzv
|
||||
4eP0VYQb1pQY1/xEMczaRt+RuoIDnHCq5a1vOiwk6ZbdG6GlJKx9lj0oMQ==
|
||||
-----END CERTIFICATE-----
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
-----BEGIN CERTIFICATE-----
|
||||
MIIBSjCB9aADAgECAgECMA0GCSqGSIb3DQEBBAUAMBcxFTATBgNVBAMTDFRydXN0
|
||||
IEFuY2hvcjAeFw0wMjExMDcxMTU3MDNaFw0yMjExMDcxMTU3MDNaMA0xCzAJBgNV
|
||||
BAMTAkNBMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJ8mP3x37PablDfwldGL5G0+
|
||||
l9NgMJSdxVNWBg+ySzQNsZklEFCxGfxPQW+EFYfafHbTbmnni2gsgU1mgPBTQDsC
|
||||
AwEAAaM2MDQwCwYDVR0PBAQDAgIEMBcGA1UdIAQQMA4wBgYEVR0gADAEBgIqADAM
|
||||
BgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBAUAA0EA9oCyzh0UKmNsKb+KpppbKYs8
|
||||
iA8sDm9oDCwyVSXBM46zrP38nRcx3EdKFvGTwbb/Np+lcZALUsKVYQy3rlU+cQ==
|
||||
-----END CERTIFICATE-----
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
-----BEGIN CERTIFICATE-----
|
||||
MIIBLTCB2KADAgECAgEDMA0GCSqGSIb3DQEBBAUAMA0xCzAJBgNVBAMTAkNBMB4X
|
||||
DTAyMTEwNzExNTcwM1oXDTIyMTEwNzExNTcwM1owFTETMBEGA1UEAxMKRW5kIEVu
|
||||
dGl0eTBcMA0GCSqGSIb3DQEBAQUAA0sAMEgCQQDVBDfF+uBr5s5jzzDs1njKlZNt
|
||||
h8hHzEt3ASh67Peos+QrDzgpUyFXT6fdW2h7iPf0ifjM8eW2xa+3EnPjjU5jAgMB
|
||||
AAGjGzAZMBcGA1UdIAQQMA4wBgYEVR0gADAEBgIqADANBgkqhkiG9w0BAQQFAANB
|
||||
AFo//WOboCNOCcA1fvcWW9oc4MvV8ZPvFIAbyEbgyFd4id5lGDTRbRPvvNZRvdsN
|
||||
NM2gXYr+f87NHIXc9EF3pzw=
|
||||
-----END CERTIFICATE-----
|
||||
Binary file not shown.
|
|
@ -0,0 +1,79 @@
|
|||
/*
|
||||
* Copyright (c) 2012, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
/**
|
||||
* @test
|
||||
* @bug 4442566 7176326
|
||||
* @summary check that we can build and validate a zero-length
|
||||
* certpath when a trust anchor cert satisfies the target constraints
|
||||
*/
|
||||
import java.io.ByteArrayInputStream;
|
||||
import java.security.cert.*;
|
||||
import java.util.Collections;
|
||||
|
||||
public class ZeroLengthPath {
|
||||
|
||||
private static final String ANCHOR =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIIBFzCBwgIBATANBgkqhkiG9w0BAQQFADAXMRUwEwYDVQQDEwxUcnVzdCBBbmNo\n" +
|
||||
"b3IwHhcNMDIxMTA3MTE1NzAzWhcNMjIxMTA3MTE1NzAzWjAXMRUwEwYDVQQDEwxU\n" +
|
||||
"cnVzdCBBbmNob3IwXDANBgkqhkiG9w0BAQEFAANLADBIAkEA9uCj12hwDgC1n9go\n" +
|
||||
"0ozQAVMM+DfX0vpKOemyGNp+ycSLfAq3pxBcUKbQhjSRL7YjPkEL8XC6pRLwyEoF\n" +
|
||||
"osWweQIDAQABMA0GCSqGSIb3DQEBBAUAA0EAzZta5M1qbbozj7jWnNyTgB4HUpzv\n" +
|
||||
"4eP0VYQb1pQY1/xEMczaRt+RuoIDnHCq5a1vOiwk6ZbdG6GlJKx9lj0oMQ==\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
|
||||
public static void main(String[] args) throws Exception {
|
||||
|
||||
ByteArrayInputStream is = new ByteArrayInputStream(ANCHOR.getBytes());
|
||||
CertificateFactory cf = CertificateFactory.getInstance("X.509");
|
||||
X509Certificate cert = (X509Certificate)cf.generateCertificate(is);
|
||||
|
||||
X509CertSelector xcs = new X509CertSelector();
|
||||
xcs.setSubject(cert.getSubjectX500Principal().getName());
|
||||
PKIXBuilderParameters p = new PKIXBuilderParameters
|
||||
(Collections.singleton(new TrustAnchor(cert, null)), xcs);
|
||||
CertPathBuilder cpb = CertPathBuilder.getInstance("PKIX");
|
||||
CertPath cp = buildCertPath(cpb, p);
|
||||
validateCertPath(cp, p);
|
||||
}
|
||||
|
||||
private static CertPath buildCertPath(CertPathBuilder cpb,
|
||||
PKIXBuilderParameters params)
|
||||
throws Exception
|
||||
{
|
||||
CertPathBuilderResult res = cpb.build(params);
|
||||
if (res.getCertPath().getCertificates().size() != 0) {
|
||||
throw new Exception("built path is not zero-length");
|
||||
}
|
||||
return res.getCertPath();
|
||||
}
|
||||
|
||||
private static void validateCertPath(CertPath cp, PKIXParameters params)
|
||||
throws Exception
|
||||
{
|
||||
CertPathValidator cpv = CertPathValidator.getInstance("PKIX");
|
||||
CertPathValidatorResult cpvr = cpv.validate(cp, params);
|
||||
}
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue