undefect. CWE-407 — 63 sites patched across 27 ecosystems
Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com Patches, unit tests, benchmarks, whitepaper, and outreach briefs. Public domain — no copyright claimed. Use freely.
This commit is contained in:
commit
0a580b313d
70422 changed files with 17213626 additions and 0 deletions
|
|
@ -0,0 +1,17 @@
|
|||
-----BEGIN CERTIFICATE-----
|
||||
MIICuDCCAiGgAwIBAgIBBzANBgkqhkiG9w0BAQQFADAtMQswCQYDVQQGEwJVUzEM
|
||||
MAoGA1UEChMDU3VuMRAwDgYDVQQDEwdSb290IENBMB4XDTA3MDMyMzE3MTUzNloX
|
||||
DTM0MDgwODE3MTUzNlowLjELMAkGA1UEBhMCVVMxDDAKBgNVBAoTA1N1bjERMA8G
|
||||
A1UEAxMIUm9iIEZvbGswgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAJ+BDk0i
|
||||
pXPQrwt7THIXD0sdbJLaMjsSynGheimobX0NAtYOKllWBmBC5bkHCkvjekbprSyV
|
||||
GnwBeEwrJRwfdnfmTyibyinFeB723lN/NQ8LbPSoZTo8Gdkp5193H4SFqfrWCRZ9
|
||||
4RYnmmqS7Ut5PWR5vlsMqktwx0qXlD0kq9TNAgMBAAGjgeYwgeMwCQYDVR0TBAIw
|
||||
ADAsBglghkgBhvhCAQ0EHxYdT3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUw
|
||||
HQYDVR0OBBYEFJn9r1+sySfqvyggruKsdeeaF6qsMFUGA1UdIwROMEyAFB1J2ChQ
|
||||
l8QDIVxcr/9Eio/dNxUkoTGkLzAtMQswCQYDVQQGEwJVUzEMMAoGA1UEChMDU3Vu
|
||||
MRAwDgYDVQQDEwdSb290IENBggEAMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcw
|
||||
AYYWaHR0cDovL2xvY2FsaG9zdDo4ODg4LzANBgkqhkiG9w0BAQQFAAOBgQCOflBZ
|
||||
wXCydtjJ0TGT6/8cZxOYAK0Gy8Nz2GLtYm6N+Dip1HZei+8SOY8VsitURdAb6d60
|
||||
PbJiHHcACdVaK2JLdijTr6xKi2AS6/qtjlxwLV5goX4mRl8W/xQhEf2KkT6cuUP0
|
||||
rM6Lq/qODnJfkhT8s/kUsFDUzNenK0QcCiC6og==
|
||||
-----END CERTIFICATE-----
|
||||
109
test/jdk/java/security/cert/CertPathValidator/OCSP/AIACheck.java
Normal file
109
test/jdk/java/security/cert/CertPathValidator/OCSP/AIACheck.java
Normal file
|
|
@ -0,0 +1,109 @@
|
|||
/*
|
||||
* Copyright (c) 2004, 2015, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
//
|
||||
// Security properties, once set, cannot revert to unset. To avoid
|
||||
// conflicts with tests running in the same VM isolate this test by
|
||||
// running it in otherVM mode.
|
||||
//
|
||||
|
||||
/**
|
||||
* @test
|
||||
* @bug 5072953
|
||||
* @summary Verify that the URL for an OCSP responder can be extracted from a
|
||||
* certificate's AuthorityInfoAccess extension when OCSP certifiate
|
||||
* validation has been enabled.
|
||||
* @run main/othervm AIACheck
|
||||
*/
|
||||
|
||||
import java.io.*;
|
||||
import java.net.*;
|
||||
import java.util.*;
|
||||
import java.security.Security;
|
||||
import java.security.cert.*;
|
||||
|
||||
public class AIACheck {
|
||||
|
||||
private final static File baseDir =
|
||||
new File(System.getProperty("test.src", "."));
|
||||
|
||||
private static X509Certificate loadCertificate(String name)
|
||||
throws Exception
|
||||
{
|
||||
File certFile = new File(baseDir, name);
|
||||
InputStream in = new FileInputStream(certFile);
|
||||
CertificateFactory cf = CertificateFactory.getInstance("X.509");
|
||||
X509Certificate cert = (X509Certificate)cf.generateCertificate(in);
|
||||
return cert;
|
||||
}
|
||||
|
||||
public static void main(String args[]) throws Exception {
|
||||
// MD5 is used in this test case, don't disable MD5 algorithm.
|
||||
Security.setProperty(
|
||||
"jdk.certpath.disabledAlgorithms", "MD2, RSA keySize < 1024");
|
||||
|
||||
X509Certificate aiaCert = loadCertificate("AIACert.pem");
|
||||
X509Certificate rootCert = loadCertificate("RootCert.pem");
|
||||
|
||||
List<X509Certificate> list =
|
||||
//Arrays.asList(new X509Certificate[] {aiaCert, rootCert});
|
||||
Arrays.asList(new X509Certificate[] {aiaCert});
|
||||
CertificateFactory cf = CertificateFactory.getInstance("X.509");
|
||||
CertPath path = cf.generateCertPath(list);
|
||||
|
||||
TrustAnchor anchor = new TrustAnchor(rootCert, null);
|
||||
Set<TrustAnchor> anchors = Collections.singleton(anchor);
|
||||
|
||||
PKIXParameters params = new PKIXParameters(anchors);
|
||||
// Activate certificate revocation checking
|
||||
params.setRevocationEnabled(true);
|
||||
|
||||
// Activate OCSP
|
||||
Security.setProperty("ocsp.enable", "true");
|
||||
|
||||
// Ensure that the ocsp.responderURL property is not set.
|
||||
if (Security.getProperty("ocsp.responderURL") != null) {
|
||||
throw new
|
||||
Exception("The ocsp.responderURL property must not be set");
|
||||
}
|
||||
|
||||
CertPathValidator validator = CertPathValidator.getInstance("PKIX");
|
||||
|
||||
try {
|
||||
validator.validate(path, params);
|
||||
throw new Exception("Successfully validated an invalid path");
|
||||
|
||||
} catch (CertPathValidatorException e ) {
|
||||
Throwable rootCause = e.getCause();
|
||||
if (!(rootCause instanceof SocketException ||
|
||||
rootCause instanceof SocketTimeoutException)) {
|
||||
throw e;
|
||||
}
|
||||
|
||||
// Success - client located OCSP responder in AIA extension
|
||||
// and attempted to connect.
|
||||
System.out.println("Extracted the URL of the OCSP responder from " +
|
||||
"the certificate's AuthorityInfoAccess extension.");
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,281 @@
|
|||
/*
|
||||
* Copyright (c) 2009, 2025, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
//
|
||||
// Security properties, once set, cannot revert to unset. To avoid
|
||||
// conflicts with tests running in the same VM isolate this test by
|
||||
// running it in otherVM mode.
|
||||
//
|
||||
|
||||
/**
|
||||
* @test
|
||||
* @bug 6383095
|
||||
* @summary CRL revoked certificate failures masked by OCSP failures
|
||||
* @run main/othervm FailoverToCRL
|
||||
* @enablePreview
|
||||
* @author Xuelei Fan
|
||||
*/
|
||||
|
||||
/*
|
||||
* Note that the certificate validity is from Mar 16 14:55:35 2009 GMT to
|
||||
* Dec 1 14:55:35 2028 GMT, please update it with newer certificate if
|
||||
* expires.
|
||||
*/
|
||||
|
||||
/*
|
||||
* Certificates used in the test.
|
||||
*
|
||||
* end entity certificate:
|
||||
* Data:
|
||||
* Version: 3 (0x2)
|
||||
* Serial Number: 25 (0x19)
|
||||
* Signature Algorithm: md5WithRSAEncryption
|
||||
* Issuer: C=US, ST=Some-State, L=Some-City, O=Some-Org
|
||||
* Validity
|
||||
* Not Before: Mar 16 14:55:35 2009 GMT
|
||||
* Not After : Dec 1 14:55:35 2028 GMT
|
||||
* Subject: C=US, ST=Some-State, L=Some-City, O=Some-Org, OU=SSL-Client,
|
||||
* CN=localhost
|
||||
* Subject Public Key Info:
|
||||
* Public Key Algorithm: rsaEncryption
|
||||
* RSA Public Key: (1024 bit)
|
||||
* Modulus (1024 bit):
|
||||
* 00:bb:f0:40:36:ac:26:54:4e:f4:a3:5a:00:2f:69:
|
||||
* 21:6f:b9:7a:3a:93:ec:a2:f6:e1:8e:c7:63:d8:2f:
|
||||
* 12:30:99:2e:b0:f2:8f:f8:27:2d:24:78:28:84:f7:
|
||||
* 01:bf:8d:44:79:dd:3b:d2:55:f3:ce:3c:b2:5b:21:
|
||||
* 7d:ef:fd:33:4a:b1:a3:ff:c6:c8:9b:b9:0f:7c:41:
|
||||
* 35:97:f9:db:3a:05:60:05:15:af:59:17:92:a3:10:
|
||||
* ad:16:1c:e4:07:53:af:a8:76:a2:56:2a:92:d3:f9:
|
||||
* 28:e0:78:cf:5e:1f:48:ab:5c:19:dd:e1:67:43:ba:
|
||||
* 75:8d:f5:82:ac:43:92:44:1b
|
||||
* Exponent: 65537 (0x10001)
|
||||
* X509v3 extensions:
|
||||
* X509v3 Basic Constraints:
|
||||
* CA:FALSE
|
||||
* X509v3 Key Usage:
|
||||
* Digital Signature, Non Repudiation, Key Encipherment
|
||||
* X509v3 Subject Key Identifier:
|
||||
* CD:BB:C8:85:AA:91:BD:FD:1D:BE:CD:67:7C:FF:B3:E9:4C:A8:22:E6
|
||||
* X509v3 Authority Key Identifier:
|
||||
* keyid:FA:B9:51:BF:4C:E7:D9:86:98:33:F9:E7:CB:1E:F1:33:49:F7:A8:14
|
||||
* Signature Algorithm: md5WithRSAEncryption
|
||||
*
|
||||
*
|
||||
* trusted certificate authority:
|
||||
* Data:
|
||||
* Version: 3 (0x2)
|
||||
* Serial Number: 0 (0x0)
|
||||
* Signature Algorithm: md5WithRSAEncryption
|
||||
* Issuer: C=US, ST=Some-State, L=Some-City, O=Some-Org
|
||||
* Validity
|
||||
* Not Before: Dec 8 02:43:36 2008 GMT
|
||||
* Not After : Aug 25 02:43:36 2028 GMT
|
||||
* Subject: C=US, ST=Some-State, L=Some-City, O=Some-Org
|
||||
* Subject Public Key Info:
|
||||
* Public Key Algorithm: rsaEncryption
|
||||
* RSA Public Key: (1024 bit)
|
||||
* Modulus (1024 bit):
|
||||
* 00:cb:c4:38:20:07:be:88:a7:93:b0:a1:43:51:2d:
|
||||
* d7:8e:85:af:54:dd:ad:a2:7b:23:5b:cf:99:13:53:
|
||||
* 99:45:7d:ee:6d:ba:2d:bf:e3:ad:6e:3d:9f:1a:f9:
|
||||
* 03:97:e0:17:55:ae:11:26:57:de:01:29:8e:05:3f:
|
||||
* 21:f7:e7:36:e8:2e:37:d7:48:ac:53:d6:60:0e:c7:
|
||||
* 50:6d:f6:c5:85:f7:8b:a6:c5:91:35:72:3c:94:ee:
|
||||
* f1:17:f0:71:e3:ec:1b:ce:ca:4e:40:42:b0:6d:ee:
|
||||
* 6a:0e:d6:e5:ad:3c:0f:c9:ba:82:4f:78:f8:89:97:
|
||||
* 89:2a:95:12:4c:d8:09:2a:e9
|
||||
* Exponent: 65537 (0x10001)
|
||||
* X509v3 extensions:
|
||||
* X509v3 Subject Key Identifier:
|
||||
* FA:B9:51:BF:4C:E7:D9:86:98:33:F9:E7:CB:1E:F1:33:49:F7:A8:14
|
||||
* X509v3 Authority Key Identifier:
|
||||
* keyid:FA:B9:51:BF:4C:E7:D9:86:98:33:F9:E7:CB:1E:F1:33:49:F7:A8:14
|
||||
* DirName:/C=US/ST=Some-State/L=Some-City/O=Some-Org
|
||||
* X509v3 Basic Constraints:
|
||||
* CA:TRUE
|
||||
* Signature Algorithm: md5WithRSAEncryption
|
||||
*
|
||||
* CRL:
|
||||
* Certificate Revocation List (CRL):
|
||||
* Version 2 (0x1)
|
||||
* Signature Algorithm: md5WithRSAEncryption
|
||||
* Issuer: /C=US/ST=Some-State/L=Some-City/O=Some-Org
|
||||
* Last Update: Mar 16 16:27:14 2009 GMT
|
||||
* Next Update: May 15 16:27:14 2028 GMT
|
||||
* CRL extensions:
|
||||
* X509v3 CRL Number:
|
||||
* 2
|
||||
* Revoked Certificates:
|
||||
* Serial Number: 19
|
||||
* Revocation Date: Mar 16 16:22:08 2009 GMT
|
||||
* CRL entry extensions:
|
||||
* X509v3 CRL Reason Code:
|
||||
* Superseded
|
||||
* Signature Algorithm: md5WithRSAEncryption
|
||||
*/
|
||||
|
||||
import java.io.*;
|
||||
import java.net.SocketException;
|
||||
import java.security.DEREncodable;
|
||||
import java.security.PEMDecoder;
|
||||
import java.util.*;
|
||||
import java.security.Security;
|
||||
import java.security.cert.*;
|
||||
import java.security.InvalidAlgorithmParameterException;
|
||||
import java.security.cert.CertPathValidatorException.BasicReason;
|
||||
import java.util.Collections;
|
||||
|
||||
public class FailoverToCRL {
|
||||
|
||||
static String trusedCertStr =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIICrDCCAhWgAwIBAgIBADANBgkqhkiG9w0BAQQFADBJMQswCQYDVQQGEwJVUzET\n" +
|
||||
"MBEGA1UECBMKU29tZS1TdGF0ZTESMBAGA1UEBxMJU29tZS1DaXR5MREwDwYDVQQK\n" +
|
||||
"EwhTb21lLU9yZzAeFw0wODEyMDgwMjQzMzZaFw0yODA4MjUwMjQzMzZaMEkxCzAJ\n" +
|
||||
"BgNVBAYTAlVTMRMwEQYDVQQIEwpTb21lLVN0YXRlMRIwEAYDVQQHEwlTb21lLUNp\n" +
|
||||
"dHkxETAPBgNVBAoTCFNvbWUtT3JnMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB\n" +
|
||||
"gQDLxDggB76Ip5OwoUNRLdeOha9U3a2ieyNbz5kTU5lFfe5tui2/461uPZ8a+QOX\n" +
|
||||
"4BdVrhEmV94BKY4FPyH35zboLjfXSKxT1mAOx1Bt9sWF94umxZE1cjyU7vEX8HHj\n" +
|
||||
"7BvOyk5AQrBt7moO1uWtPA/JuoJPePiJl4kqlRJM2Akq6QIDAQABo4GjMIGgMB0G\n" +
|
||||
"A1UdDgQWBBT6uVG/TOfZhpgz+efLHvEzSfeoFDBxBgNVHSMEajBogBT6uVG/TOfZ\n" +
|
||||
"hpgz+efLHvEzSfeoFKFNpEswSTELMAkGA1UEBhMCVVMxEzARBgNVBAgTClNvbWUt\n" +
|
||||
"U3RhdGUxEjAQBgNVBAcTCVNvbWUtQ2l0eTERMA8GA1UEChMIU29tZS1PcmeCAQAw\n" +
|
||||
"DAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQQFAAOBgQBcIm534U123Hz+rtyYO5uA\n" +
|
||||
"ofd81G6FnTfEAV8Kw9fGyyEbQZclBv34A9JsFKeMvU4OFIaixD7nLZ/NZ+IWbhmZ\n" +
|
||||
"LovmJXyCkOufea73pNiZ+f/4/ScZaIlM/PRycQSqbFNd4j9Wott+08qxHPLpsf3P\n" +
|
||||
"6Mvf0r1PNTY2hwTJLJmKtg==\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
static String targetCertStr =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIICizCCAfSgAwIBAgIBGTANBgkqhkiG9w0BAQQFADBJMQswCQYDVQQGEwJVUzET\n" +
|
||||
"MBEGA1UECBMKU29tZS1TdGF0ZTESMBAGA1UEBxMJU29tZS1DaXR5MREwDwYDVQQK\n" +
|
||||
"EwhTb21lLU9yZzAeFw0wOTAzMTYxNDU1MzVaFw0yODEyMDExNDU1MzVaMHIxCzAJ\n" +
|
||||
"BgNVBAYTAlVTMRMwEQYDVQQIEwpTb21lLVN0YXRlMRIwEAYDVQQHEwlTb21lLUNp\n" +
|
||||
"dHkxETAPBgNVBAoTCFNvbWUtT3JnMRMwEQYDVQQLEwpTU0wtQ2xpZW50MRIwEAYD\n" +
|
||||
"VQQDEwlsb2NhbGhvc3QwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALvwQDas\n" +
|
||||
"JlRO9KNaAC9pIW+5ejqT7KL24Y7HY9gvEjCZLrDyj/gnLSR4KIT3Ab+NRHndO9JV\n" +
|
||||
"8848slshfe/9M0qxo//GyJu5D3xBNZf52zoFYAUVr1kXkqMQrRYc5AdTr6h2olYq\n" +
|
||||
"ktP5KOB4z14fSKtcGd3hZ0O6dY31gqxDkkQbAgMBAAGjWjBYMAkGA1UdEwQCMAAw\n" +
|
||||
"CwYDVR0PBAQDAgXgMB0GA1UdDgQWBBTNu8iFqpG9/R2+zWd8/7PpTKgi5jAfBgNV\n" +
|
||||
"HSMEGDAWgBT6uVG/TOfZhpgz+efLHvEzSfeoFDANBgkqhkiG9w0BAQQFAAOBgQBv\n" +
|
||||
"p7JjCDOrMBNun46xs4Gz7Y4ygM5VHaFP0oO7369twvRSu0pCuIdZd5OIMPFeRqQw\n" +
|
||||
"PA68ZdhYVR0pG5W7isV+jB+Dfge/IOgOA85sZ/6FlP3PBRW+YMQKKdRr5So3ook9\n" +
|
||||
"PimQ7rbxRAofPECv20IUKFBbOUkU+gFcn+WbTKYxBw==\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
static String crlStr =
|
||||
"-----BEGIN X509 CRL-----\n" +
|
||||
"MIIBRTCBrwIBATANBgkqhkiG9w0BAQQFADBJMQswCQYDVQQGEwJVUzETMBEGA1UE\n" +
|
||||
"CBMKU29tZS1TdGF0ZTESMBAGA1UEBxMJU29tZS1DaXR5MREwDwYDVQQKEwhTb21l\n" +
|
||||
"LU9yZxcNMDkwMzE2MTYyNzE0WhcNMjgwNTE1MTYyNzE0WjAiMCACARkXDTA5MDMx\n" +
|
||||
"NjE2MjIwOFowDDAKBgNVHRUEAwoBBKAOMAwwCgYDVR0UBAMCAQIwDQYJKoZIhvcN\n" +
|
||||
"AQEEBQADgYEAMixJI9vBwYpOGosn46+T/MTEtlm2S5pIVT/xPDrHkCPfw8l4Zrgp\n" +
|
||||
"dGPuUkglWdrGdxY9MNRUj2YFNfdZi6zZ7JF6XbkDHYOAKYgPDJRjS/0VcBntn5RJ\n" +
|
||||
"sQfZsBqc9fFSP8gknRRn3LT41kr9xNRxTT1t3YYjv7J3zkMYyInqeUA=\n" +
|
||||
"-----END X509 CRL-----";
|
||||
|
||||
|
||||
private static final PEMDecoder PEM_DECODER = PEMDecoder.of();
|
||||
|
||||
private static CertPath generateCertificatePath()
|
||||
throws CertificateException, IOException {
|
||||
// generate certificate from cert strings
|
||||
CertificateFactory cf = CertificateFactory.getInstance("X.509");
|
||||
|
||||
ByteArrayInputStream is =
|
||||
new ByteArrayInputStream(targetCertStr.getBytes());
|
||||
|
||||
// generate certification path
|
||||
List<Certificate> list = Collections.singletonList(PEM_DECODER.decode
|
||||
(is, X509Certificate.class));
|
||||
|
||||
return cf.generateCertPath(list);
|
||||
}
|
||||
|
||||
private static Set<TrustAnchor> generateTrustAnchors() {
|
||||
// generate certificate from cert string
|
||||
X509Certificate trustedCert = PEM_DECODER.decode(trusedCertStr, X509Certificate.class);
|
||||
|
||||
// generate a trust anchor
|
||||
TrustAnchor anchor = new TrustAnchor(trustedCert, null);
|
||||
|
||||
return Collections.singleton(anchor);
|
||||
}
|
||||
|
||||
private static CertStore generateCertificateStore() throws Exception {
|
||||
// generate CRL from CRL string
|
||||
CertificateFactory cf = CertificateFactory.getInstance("X.509");
|
||||
|
||||
ByteArrayInputStream is =
|
||||
new ByteArrayInputStream(crlStr.getBytes());
|
||||
|
||||
// generate a cert store
|
||||
Collection<DEREncodable> crls = new HashSet<>();
|
||||
|
||||
crls.add(PEM_DECODER.decode(crlStr, X509CRL.class));
|
||||
|
||||
return CertStore.getInstance("Collection",
|
||||
new CollectionCertStoreParameters(crls));
|
||||
}
|
||||
|
||||
public static void main(String args[]) throws Exception {
|
||||
// MD5 is used in this test case, don't disable MD5 algorithm.
|
||||
Security.setProperty(
|
||||
"jdk.certpath.disabledAlgorithms", "MD2, RSA keySize < 1024");
|
||||
|
||||
CertPath path = generateCertificatePath();
|
||||
Set<TrustAnchor> anchors = generateTrustAnchors();
|
||||
CertStore crls = generateCertificateStore();
|
||||
|
||||
PKIXParameters params = new PKIXParameters(anchors);
|
||||
|
||||
// add the CRL store
|
||||
params.addCertStore(crls);
|
||||
|
||||
// Activate certificate revocation checking
|
||||
params.setRevocationEnabled(true);
|
||||
|
||||
// Activate OCSP
|
||||
Security.setProperty("ocsp.enable", "true");
|
||||
System.setProperty("com.sun.security.enableCRLDP", "true");
|
||||
|
||||
// Ensure that the ocsp.responderURL property is not set.
|
||||
if (Security.getProperty("ocsp.responderURL") != null) {
|
||||
throw new
|
||||
Exception("The ocsp.responderURL property must not be set");
|
||||
}
|
||||
|
||||
CertPathValidator validator = CertPathValidator.getInstance("PKIX");
|
||||
|
||||
try {
|
||||
validator.validate(path, params);
|
||||
} catch (CertPathValidatorException cpve) {
|
||||
if (cpve.getReason() != BasicReason.REVOKED) {
|
||||
throw new Exception(
|
||||
"unexpected exception, should be a REVOKED CPVE", cpve);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,267 @@
|
|||
/*
|
||||
* Copyright (c) 2020, 2025, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
/**
|
||||
* @test
|
||||
* @bug 8179503 8328638
|
||||
* @summary Java should support GET OCSP calls
|
||||
* @library /javax/net/ssl/templates /test/lib
|
||||
* @modules java.base/sun.security.util
|
||||
* java.base/sun.security.provider.certpath
|
||||
* java.base/sun.security.x509
|
||||
* @run main/othervm GetAndPostTests
|
||||
* @run main/othervm -Dcom.sun.security.ocsp.useget=false GetAndPostTests
|
||||
* @run main/othervm -Dcom.sun.security.ocsp.useget=foo GetAndPostTests
|
||||
*/
|
||||
|
||||
import java.io.ByteArrayInputStream;
|
||||
import java.io.IOException;
|
||||
import java.io.OutputStream;
|
||||
import java.net.URI;
|
||||
import java.security.GeneralSecurityException;
|
||||
import java.security.KeyFactory;
|
||||
import java.security.KeyStore;
|
||||
import java.security.PrivateKey;
|
||||
import java.security.SecureRandom;
|
||||
import java.security.cert.CertPath;
|
||||
import java.security.cert.CertPathValidator;
|
||||
import java.security.cert.Certificate;
|
||||
import java.security.cert.CertificateException;
|
||||
import java.security.cert.CertificateFactory;
|
||||
import java.security.cert.Extension;
|
||||
import java.security.cert.PKIXCertPathChecker;
|
||||
import java.security.cert.PKIXParameters;
|
||||
import java.security.cert.PKIXRevocationChecker;
|
||||
import java.security.cert.TrustAnchor;
|
||||
import java.security.cert.X509Certificate;
|
||||
import java.security.spec.PKCS8EncodedKeySpec;
|
||||
import java.util.Base64;
|
||||
import java.util.Date;
|
||||
import java.util.List;
|
||||
import java.util.Map;
|
||||
import java.util.Objects;
|
||||
import java.util.Set;
|
||||
import java.util.concurrent.TimeUnit;
|
||||
|
||||
import jdk.test.lib.security.SimpleOCSPServer;
|
||||
import sun.security.util.DerOutputStream;
|
||||
import sun.security.util.DerValue;
|
||||
import sun.security.util.ObjectIdentifier;
|
||||
|
||||
public class GetAndPostTests {
|
||||
private static final String PASS = "passphrase";
|
||||
private static final int SERVER_WAIT_SECS = 60;
|
||||
private static CertificateFactory certFac;
|
||||
|
||||
public static void main(String args[]) throws Exception {
|
||||
SimpleOCSPServer ocspResponder = null;
|
||||
|
||||
try {
|
||||
certFac = CertificateFactory.getInstance("X.509");
|
||||
|
||||
// Read in the certificates and keys needed for this test and
|
||||
// create the keystore for the SimpleOCSPServer. For the purposes
|
||||
// of this test, the CA certificate will also be the OCSP responder
|
||||
// signing certificate.
|
||||
SSLSocketTemplate.Cert certAuth =
|
||||
SSLSocketTemplate.Cert.CA_ECDSA_SECP256R1;
|
||||
X509Certificate caCert = pem2Cert(certAuth.certStr);
|
||||
PrivateKey caKey = pem2Key(certAuth.privKeyStr, certAuth.keyAlgo);
|
||||
X509Certificate endEntCert =
|
||||
pem2Cert(SSLSocketTemplate.Cert.EE_ECDSA_SECP256R1.certStr);
|
||||
|
||||
KeyStore.Builder keyStoreBuilder =
|
||||
KeyStore.Builder.newInstance("PKCS12", null,
|
||||
new KeyStore.PasswordProtection(PASS.toCharArray()));
|
||||
KeyStore ocspStore = keyStoreBuilder.getKeyStore();
|
||||
Certificate[] ocspChain = {caCert};
|
||||
ocspStore.setKeyEntry("ocspsigner", caKey, PASS.toCharArray(),
|
||||
ocspChain);
|
||||
|
||||
// Create the certificate path we'll use for cert path validation.
|
||||
CertPath path = certFac.generateCertPath(List.of(endEntCert));
|
||||
|
||||
// Next, create and start the OCSP responder. Obtain the socket
|
||||
// address so we can set that in the PKIXRevocationChecker since
|
||||
// these certificates do not have AIA extensions on them.
|
||||
ocspResponder = new SimpleOCSPServer(ocspStore, PASS,
|
||||
"ocspsigner", null);
|
||||
ocspResponder.setSignatureAlgorithm("SHA256WithECDSA");
|
||||
ocspResponder.enableLog(true);
|
||||
ocspResponder.setNextUpdateInterval(3600);
|
||||
ocspResponder.updateStatusDb(Map.of(
|
||||
endEntCert.getSerialNumber(),
|
||||
new SimpleOCSPServer.CertStatusInfo(
|
||||
SimpleOCSPServer.CertStatus.CERT_STATUS_GOOD)));
|
||||
|
||||
startOcspServer(ocspResponder);
|
||||
|
||||
int ocspPort = ocspResponder.getPort();
|
||||
URI ocspURI = new URI("http://localhost:" + ocspPort);
|
||||
System.out.println("Configured CPV to connect to " + ocspURI);
|
||||
|
||||
// Create the PKIXParameters needed for path validation and
|
||||
// configure any necessary OCSP parameters to control the OCSP
|
||||
// request size.
|
||||
Set<TrustAnchor> anchors = Set.of(new TrustAnchor(caCert, null));
|
||||
|
||||
CertPathValidator validator = CertPathValidator.getInstance("PKIX");
|
||||
PKIXRevocationChecker revChkr =
|
||||
(PKIXRevocationChecker)validator.getRevocationChecker();
|
||||
revChkr.setOcspResponder(ocspURI);
|
||||
revChkr.setOptions(Set.of(
|
||||
PKIXRevocationChecker.Option.ONLY_END_ENTITY,
|
||||
PKIXRevocationChecker.Option.NO_FALLBACK));
|
||||
|
||||
PKIXParameters params = new PKIXParameters(anchors);
|
||||
params.setRevocationEnabled(true);
|
||||
params.setDate(new Date(1590926400000L)); // 05/31/2020 @ 12:00:00Z
|
||||
params.addCertPathChecker(revChkr);
|
||||
|
||||
System.out.println("Test 1: Request < 255 bytes, HTTP GET");
|
||||
validator.validate(path, params);
|
||||
|
||||
System.out.println("Test 2: Request > 255 bytes, HTTP POST");
|
||||
// Modify the PKIXRevocationChecker to include a bogus non-critical
|
||||
// request extension that makes the request large enough to be
|
||||
// issued as an HTTP POST.
|
||||
List<PKIXCertPathChecker> chkrList = params.getCertPathCheckers();
|
||||
for (PKIXCertPathChecker chkr : chkrList) {
|
||||
if (chkr instanceof PKIXRevocationChecker) {
|
||||
((PKIXRevocationChecker)chkr).setOcspExtensions(
|
||||
List.of(new BogusExtension("1.2.3.4.5.6.7.8.9",
|
||||
false, 256)));
|
||||
}
|
||||
}
|
||||
params.setCertPathCheckers(chkrList);
|
||||
validator.validate(path, params);
|
||||
|
||||
} finally {
|
||||
if (ocspResponder != null) {
|
||||
ocspResponder.stop();
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
private static void startOcspServer(SimpleOCSPServer ocspResponder) throws InterruptedException, IOException {
|
||||
ocspResponder.start();
|
||||
if (!ocspResponder.awaitServerReady(SERVER_WAIT_SECS, TimeUnit.SECONDS)) {
|
||||
throw new RuntimeException("Server not ready after " + SERVER_WAIT_SECS
|
||||
+ " seconds.");
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Create an X509Certificate object from its PEM encoding
|
||||
*
|
||||
* @param pemCert the base64 encoded certificate
|
||||
*
|
||||
* @return the corresponding X509Certificate object from the PEM encoding.
|
||||
*
|
||||
* @throws IOException if any InputStream or Base64 decoding failures occur.
|
||||
* @throws CertificateException if any certificate parsing errors occur.
|
||||
*/
|
||||
private static X509Certificate pem2Cert(String pemCert)
|
||||
throws IOException, CertificateException {
|
||||
return (X509Certificate)certFac.generateCertificate(
|
||||
new ByteArrayInputStream(pemCert.getBytes()));
|
||||
}
|
||||
|
||||
/**
|
||||
* Create a private key from its PEM-encoded PKCS#8 representation.
|
||||
*
|
||||
* @param pemKey the private key in PEM-encoded PKCS#8 unencrypted format
|
||||
* @param algorithm the private key algorithm
|
||||
*
|
||||
* @return the PrivateKey extracted from the PKCS#8 encoding.
|
||||
*
|
||||
* @throws GeneralSecurityException if any errors take place during
|
||||
* decoding or parsing.
|
||||
*/
|
||||
private static PrivateKey pem2Key(String pemKey, String algorithm)
|
||||
throws GeneralSecurityException {
|
||||
byte[] p8Der = Base64.getMimeDecoder().decode(pemKey);
|
||||
PKCS8EncodedKeySpec spec = new PKCS8EncodedKeySpec(p8Der, algorithm);
|
||||
KeyFactory kf = KeyFactory.getInstance(algorithm);
|
||||
return kf.generatePrivate(spec);
|
||||
}
|
||||
|
||||
/**
|
||||
* The BogusOcspExtension is an extension with random data in the
|
||||
* extension value field. It is used in this test to expand the size
|
||||
* of the OCSP request so it crosses the boundary that forces an HTTP
|
||||
* POST operation instead of a GET.
|
||||
*/
|
||||
private static class BogusExtension implements Extension {
|
||||
private final ObjectIdentifier oid;
|
||||
private final boolean critical;
|
||||
private final byte[] data;
|
||||
|
||||
public BogusExtension(String oidStr, boolean isCrit, int size)
|
||||
throws IOException {
|
||||
// For this test we don't need anything larger than 10K
|
||||
if (size > 0 && size <= 10240) {
|
||||
data = new byte[size];
|
||||
} else {
|
||||
throw new IllegalArgumentException(
|
||||
"Size must be 0 < X <= 10240");
|
||||
}
|
||||
oid = ObjectIdentifier.of(oidStr);
|
||||
SecureRandom sr = new SecureRandom();
|
||||
sr.nextBytes(data);
|
||||
critical = isCrit;
|
||||
}
|
||||
|
||||
@Override
|
||||
public String getId() {
|
||||
return oid.toString();
|
||||
}
|
||||
|
||||
@Override
|
||||
public boolean isCritical() {
|
||||
return critical;
|
||||
}
|
||||
|
||||
@Override
|
||||
public byte[] getValue() {
|
||||
return data.clone();
|
||||
}
|
||||
|
||||
@Override
|
||||
public void encode(OutputStream out) throws IOException {
|
||||
Objects.requireNonNull(out, "Non-null OutputStream required");
|
||||
|
||||
DerOutputStream dos1 = new DerOutputStream();
|
||||
DerOutputStream dos2 = new DerOutputStream();
|
||||
|
||||
dos1.putOID(oid);
|
||||
if (critical) {
|
||||
dos1.putBoolean(critical);
|
||||
}
|
||||
dos1.putOctetString(data);
|
||||
|
||||
dos2.write(DerValue.tag_Sequence, dos1);
|
||||
out.write(dos2.toByteArray());
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,300 @@
|
|||
/*
|
||||
* Copyright (c) 2023, 2025, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
//
|
||||
// Security properties, once set, cannot revert to unset. To avoid
|
||||
// conflicts with tests running in the same VM isolate this test by
|
||||
// running it in otherVM mode.
|
||||
//
|
||||
|
||||
/**
|
||||
* @test
|
||||
* @bug 8179502
|
||||
* @summary Enhance OCSP, CRL and Certificate Fetch Timeouts
|
||||
* @modules java.base/sun.security.x509
|
||||
* java.base/sun.security.provider.certpath
|
||||
* java.base/sun.security.util
|
||||
* @library /test/lib
|
||||
* @run main/othervm -Djava.security.debug=certpath OCSPTimeout 1000 true
|
||||
* @run main/othervm -Djava.security.debug=certpath
|
||||
* -Dcom.sun.security.ocsp.readtimeout=5 OCSPTimeout 1000 true
|
||||
* @run main/othervm -Djava.security.debug=certpath
|
||||
* -Dcom.sun.security.ocsp.readtimeout=1 OCSPTimeout 5000 false
|
||||
* @run main/othervm -Djava.security.debug=certpath
|
||||
* -Dcom.sun.security.ocsp.readtimeout=1s OCSPTimeout 5000 false
|
||||
* @run main/othervm -Djava.security.debug=certpath
|
||||
* -Dcom.sun.security.ocsp.readtimeout=1500ms OCSPTimeout 5000 false
|
||||
* @run main/othervm -Djava.security.debug=certpath
|
||||
* -Dcom.sun.security.ocsp.readtimeout=4500ms OCSPTimeout 1000 true
|
||||
*/
|
||||
|
||||
import java.io.*;
|
||||
import java.math.BigInteger;
|
||||
import java.net.*;
|
||||
import java.security.*;
|
||||
import java.security.cert.Certificate;
|
||||
import java.security.spec.ECGenParameterSpec;
|
||||
import java.util.*;
|
||||
import java.security.cert.*;
|
||||
import java.util.concurrent.TimeUnit;
|
||||
|
||||
import jdk.test.lib.security.SimpleOCSPServer;
|
||||
import jdk.test.lib.security.CertificateBuilder;
|
||||
|
||||
import static java.security.cert.PKIXRevocationChecker.Option.*;
|
||||
|
||||
public class OCSPTimeout {
|
||||
|
||||
static String passwd = "passphrase";
|
||||
static String ROOT_ALIAS = "root";
|
||||
static String EE_ALIAS = "endentity";
|
||||
|
||||
// Enable debugging for additional output
|
||||
static final boolean debug = true;
|
||||
|
||||
// PKI components we will need for this test
|
||||
static X509Certificate rootCert; // The root CA certificate
|
||||
static X509Certificate eeCert; // The end entity certificate
|
||||
static KeyStore rootKeystore; // Root CA Keystore
|
||||
static KeyStore eeKeystore; // End Entity Keystore
|
||||
static KeyStore trustStore; // SSL Client trust store
|
||||
static SimpleOCSPServer rootOcsp; // Root CA OCSP Responder
|
||||
static int rootOcspPort; // Port number for root OCSP
|
||||
|
||||
public static void main(String[] args) throws Exception {
|
||||
int ocspTimeout = 15000;
|
||||
boolean expected;
|
||||
|
||||
createPKI();
|
||||
|
||||
try {
|
||||
if (args[0] != null) {
|
||||
ocspTimeout = Integer.parseInt(args[0]);
|
||||
}
|
||||
rootOcsp.setDelay(ocspTimeout);
|
||||
|
||||
expected = (args[1] != null && Boolean.parseBoolean(args[1]));
|
||||
log("Test case expects to " + (expected ? "pass" : "fail"));
|
||||
|
||||
// validate chain
|
||||
CertPathValidator cpv = CertPathValidator.getInstance("PKIX");
|
||||
PKIXRevocationChecker prc =
|
||||
(PKIXRevocationChecker) cpv.getRevocationChecker();
|
||||
prc.setOptions(EnumSet.of(NO_FALLBACK, SOFT_FAIL));
|
||||
PKIXParameters params =
|
||||
new PKIXParameters(Set.of(new TrustAnchor(rootCert, null)));
|
||||
params.addCertPathChecker(prc);
|
||||
CertificateFactory cf = CertificateFactory.getInstance("X.509");
|
||||
CertPath cp = cf.generateCertPath(List.of(eeCert));
|
||||
cpv.validate(cp, params);
|
||||
|
||||
// unwrap soft fail exceptions and check for SocketTimeoutException
|
||||
List<CertPathValidatorException> softExc = prc.getSoftFailExceptions();
|
||||
if (expected) {
|
||||
if (!softExc.isEmpty()) {
|
||||
log("Expected to pass, found " + softExc.size() +
|
||||
" soft fail exceptions");
|
||||
for (CertPathValidatorException cpve : softExc) {
|
||||
log("Exception: " + cpve);
|
||||
}
|
||||
throw new RuntimeException("Expected to pass, found " +
|
||||
softExc.size() + " soft fail exceptions");
|
||||
}
|
||||
} else {
|
||||
// If we expect to fail the validation then there should be a
|
||||
// SocketTimeoutException
|
||||
boolean found = false;
|
||||
for (CertPathValidatorException softFail : softExc) {
|
||||
log("CPVE: " + softFail);
|
||||
Throwable cause = softFail.getCause();
|
||||
log("Cause: " + cause);
|
||||
while (cause != null) {
|
||||
if (cause instanceof SocketTimeoutException) {
|
||||
found = true;
|
||||
break;
|
||||
}
|
||||
cause = cause.getCause();
|
||||
}
|
||||
if (found) {
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
if (!found) {
|
||||
throw new RuntimeException("SocketTimeoutException not thrown");
|
||||
}
|
||||
}
|
||||
} finally {
|
||||
rootOcsp.stop();
|
||||
rootOcsp.shutdownNow();
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Creates the PKI components necessary for this test, including
|
||||
* Root CA, Intermediate CA and SSL server certificates, the keystores
|
||||
* for each entity, a client trust store, and starts the OCSP responders.
|
||||
*/
|
||||
private static void createPKI() throws Exception {
|
||||
CertificateBuilder cbld = new CertificateBuilder();
|
||||
KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC");
|
||||
keyGen.initialize(new ECGenParameterSpec("secp256r1"));
|
||||
KeyStore.Builder keyStoreBuilder =
|
||||
KeyStore.Builder.newInstance("PKCS12", null,
|
||||
new KeyStore.PasswordProtection(passwd.toCharArray()));
|
||||
|
||||
// Generate Root and EE keys
|
||||
KeyPair rootCaKP = keyGen.genKeyPair();
|
||||
log("Generated Root CA KeyPair");
|
||||
KeyPair eeKP = keyGen.genKeyPair();
|
||||
log("Generated End Entity KeyPair");
|
||||
|
||||
// Set up the Root CA Cert
|
||||
cbld.setSubjectName("CN=Root CA Cert, O=SomeCompany");
|
||||
cbld.setPublicKey(rootCaKP.getPublic());
|
||||
cbld.setSerialNumber(new BigInteger("1"));
|
||||
// Make a 3 year validity starting from 60 days ago
|
||||
long start = System.currentTimeMillis() - TimeUnit.DAYS.toMillis(60);
|
||||
long end = start + TimeUnit.DAYS.toMillis(1085);
|
||||
cbld.setValidity(new Date(start), new Date(end));
|
||||
addCommonExts(cbld, rootCaKP.getPublic(), rootCaKP.getPublic());
|
||||
addCommonCAExts(cbld);
|
||||
// Make our Root CA Cert!
|
||||
rootCert = cbld.build(null, rootCaKP.getPrivate(),
|
||||
"SHA256withECDSA");
|
||||
log("Root CA Created:\n%s", certInfo(rootCert));
|
||||
|
||||
// Now build a keystore and add the keys and cert
|
||||
rootKeystore = keyStoreBuilder.getKeyStore();
|
||||
Certificate[] rootChain = {rootCert};
|
||||
rootKeystore.setKeyEntry(ROOT_ALIAS, rootCaKP.getPrivate(),
|
||||
passwd.toCharArray(), rootChain);
|
||||
|
||||
// Now fire up the OCSP responder
|
||||
rootOcsp = new SimpleOCSPServer(rootKeystore, passwd, ROOT_ALIAS, null);
|
||||
rootOcsp.enableLog(debug);
|
||||
rootOcsp.setNextUpdateInterval(3600);
|
||||
rootOcsp.start();
|
||||
|
||||
// Wait 60 seconds for server ready
|
||||
boolean readyStatus = rootOcsp.awaitServerReady(60, TimeUnit.SECONDS);
|
||||
if (!readyStatus) {
|
||||
throw new RuntimeException("Server not ready");
|
||||
}
|
||||
|
||||
rootOcspPort = rootOcsp.getPort();
|
||||
String rootRespURI = "http://localhost:" + rootOcspPort;
|
||||
log("Root OCSP Responder URI is %s", rootRespURI);
|
||||
|
||||
// Now that we have the root keystore and OCSP responder we can
|
||||
// create our end entity certificate
|
||||
cbld.reset();
|
||||
cbld.setSubjectName("CN=SSLCertificate, O=SomeCompany");
|
||||
cbld.setPublicKey(eeKP.getPublic());
|
||||
cbld.setSerialNumber(new BigInteger("4096"));
|
||||
// Make a 1 year validity starting from 7 days ago
|
||||
start = System.currentTimeMillis() - TimeUnit.DAYS.toMillis(7);
|
||||
end = start + TimeUnit.DAYS.toMillis(365);
|
||||
cbld.setValidity(new Date(start), new Date(end));
|
||||
|
||||
// Add extensions
|
||||
addCommonExts(cbld, eeKP.getPublic(), rootCaKP.getPublic());
|
||||
boolean[] kuBits = {true, false, false, false, false, false,
|
||||
false, false, false};
|
||||
cbld.addKeyUsageExt(kuBits);
|
||||
List<String> ekuOids = new ArrayList<>();
|
||||
ekuOids.add("1.3.6.1.5.5.7.3.1");
|
||||
ekuOids.add("1.3.6.1.5.5.7.3.2");
|
||||
cbld.addExtendedKeyUsageExt(ekuOids);
|
||||
cbld.addSubjectAltNameDNSExt(Collections.singletonList("localhost"));
|
||||
cbld.addAIAExt(Collections.singletonList(rootRespURI));
|
||||
// Make our End Entity Cert!
|
||||
eeCert = cbld.build(rootCert, rootCaKP.getPrivate(),
|
||||
"SHA256withECDSA");
|
||||
log("SSL Certificate Created:\n%s", certInfo(eeCert));
|
||||
|
||||
// Provide end entity cert revocation info to the Root CA
|
||||
// OCSP responder.
|
||||
Map<BigInteger, SimpleOCSPServer.CertStatusInfo> revInfo =
|
||||
new HashMap<>();
|
||||
revInfo.put(eeCert.getSerialNumber(),
|
||||
new SimpleOCSPServer.CertStatusInfo(
|
||||
SimpleOCSPServer.CertStatus.CERT_STATUS_GOOD));
|
||||
rootOcsp.updateStatusDb(revInfo);
|
||||
|
||||
// Now build a keystore and add the keys, chain and root cert as a TA
|
||||
eeKeystore = keyStoreBuilder.getKeyStore();
|
||||
Certificate[] eeChain = {eeCert, rootCert};
|
||||
eeKeystore.setKeyEntry(EE_ALIAS, eeKP.getPrivate(),
|
||||
passwd.toCharArray(), eeChain);
|
||||
eeKeystore.setCertificateEntry(ROOT_ALIAS, rootCert);
|
||||
|
||||
// And finally a Trust Store for the client
|
||||
trustStore = keyStoreBuilder.getKeyStore();
|
||||
trustStore.setCertificateEntry(ROOT_ALIAS, rootCert);
|
||||
}
|
||||
|
||||
private static void addCommonExts(CertificateBuilder cbld,
|
||||
PublicKey subjKey, PublicKey authKey) throws IOException {
|
||||
cbld.addSubjectKeyIdExt(subjKey);
|
||||
cbld.addAuthorityKeyIdExt(authKey);
|
||||
}
|
||||
|
||||
private static void addCommonCAExts(CertificateBuilder cbld)
|
||||
throws IOException {
|
||||
cbld.addBasicConstraintsExt(true, true, -1);
|
||||
// Set key usage bits for digitalSignature, keyCertSign and cRLSign
|
||||
boolean[] kuBitSettings = {true, false, false, false, false, true,
|
||||
true, false, false};
|
||||
cbld.addKeyUsageExt(kuBitSettings);
|
||||
}
|
||||
|
||||
/**
|
||||
* Helper routine that dumps only a few cert fields rather than
|
||||
* the whole toString() output.
|
||||
*
|
||||
* @param cert an X509Certificate to be displayed
|
||||
*
|
||||
* @return the String output of the issuer, subject and
|
||||
* serial number
|
||||
*/
|
||||
private static String certInfo(X509Certificate cert) {
|
||||
StringBuilder sb = new StringBuilder();
|
||||
sb.append("Issuer: ").append(cert.getIssuerX500Principal()).
|
||||
append("\n");
|
||||
sb.append("Subject: ").append(cert.getSubjectX500Principal()).
|
||||
append("\n");
|
||||
sb.append("Serial: ").append(cert.getSerialNumber()).append("\n");
|
||||
return sb.toString();
|
||||
}
|
||||
|
||||
/**
|
||||
* Log a message on stdout
|
||||
*
|
||||
* @param format the format string for the log entry
|
||||
* @param args zero or more arguments corresponding to the format string
|
||||
*/
|
||||
private static void log(String format, Object ... args) {
|
||||
System.out.format(format + "\n", args);
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
-----BEGIN CERTIFICATE-----
|
||||
MIICZTCCAc6gAwIBAgIBADANBgkqhkiG9w0BAQQFADAtMQswCQYDVQQGEwJVUzEM
|
||||
MAoGA1UEChMDU3VuMRAwDgYDVQQDEwdSb290IENBMB4XDTA1MTEyNDIzMDU0N1oX
|
||||
DTE1MTEyMjIzMDU0N1owLTELMAkGA1UEBhMCVVMxDDAKBgNVBAoTA1N1bjEQMA4G
|
||||
A1UEAxMHUm9vdCBDQTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA1BHB3n1Q
|
||||
G/U/r+MvsKAzKUeDSSTAFzC6+a393zzrGSU3/OIlQjWAWVsoPQOiHilgfhhaox+C
|
||||
DWdV+qwWEPYA3QMyeiZDOQu/Xs1LoKrbfi+zNFqnZyXkqSjzJMP0G1LEI13sUTXz
|
||||
0AHoIdpZWqECXfP74L5reBrQ2Cv1k/zuUaECAwEAAaOBlDCBkTAdBgNVHQ4EFgQU
|
||||
HUnYKFCXxAMhXFyv/0SKj903FSQwVQYDVR0jBE4wTIAUHUnYKFCXxAMhXFyv/0SK
|
||||
j903FSShMaQvMC0xCzAJBgNVBAYTAlVTMQwwCgYDVQQKEwNTdW4xEDAOBgNVBAMT
|
||||
B1Jvb3QgQ0GCAQAwDAYDVR0TBAUwAwEB/zALBgNVHQ8EBAMCAQYwDQYJKoZIhvcN
|
||||
AQEEBQADgYEAO9yV6aPi3yj96Qq4laZ4Sq0FDmHWXUX0iF0ygSUHu/p8LK2iDKd0
|
||||
BoSqyrpz+SLLoWRn4tbbFaqJpsYGI7wEGdAjJJgKtMZOEH1sSuTnwsjaIxaLF9A4
|
||||
44Ki2Y5vbDcY8us2/92qiawGnKEFgDZn2M7OBYleV3PZJmPUQVX5Ffk=
|
||||
-----END CERTIFICATE-----
|
||||
|
|
@ -0,0 +1,229 @@
|
|||
/*
|
||||
* Copyright (c) 2024, 2025, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
import java.nio.file.Files;
|
||||
import java.nio.file.Path;
|
||||
import java.math.BigInteger;
|
||||
import java.security.KeyPair;
|
||||
import java.security.KeyPairGenerator;
|
||||
import java.security.cert.CertificateFactory;
|
||||
import java.security.cert.CertPath;
|
||||
import java.security.cert.CertPathValidator;
|
||||
import java.security.cert.CertPathValidatorException;
|
||||
import java.security.cert.CertPathValidatorException.BasicReason;
|
||||
import java.security.cert.PKIXParameters;
|
||||
import java.security.cert.TrustAnchor;
|
||||
import java.security.cert.X509Certificate;
|
||||
import java.security.cert.X509CRL;
|
||||
import java.util.Date;
|
||||
import java.util.List;
|
||||
import java.util.Set;
|
||||
import java.util.concurrent.TimeUnit;
|
||||
import sun.security.x509.AuthorityKeyIdentifierExtension;
|
||||
import sun.security.x509.CRLDistributionPointsExtension;
|
||||
import sun.security.x509.CRLExtensions;
|
||||
import sun.security.x509.CRLNumberExtension;
|
||||
import sun.security.x509.DistributionPoint;
|
||||
import sun.security.x509.Extension;
|
||||
import sun.security.x509.GeneralName;
|
||||
import sun.security.x509.GeneralNames;
|
||||
import sun.security.x509.KeyIdentifier;
|
||||
import sun.security.x509.URIName;
|
||||
import sun.security.x509.X500Name;
|
||||
import sun.security.x509.X509CRLEntryImpl;
|
||||
import sun.security.x509.X509CRLImpl;
|
||||
import static sun.security.x509.X509CRLImpl.TBSCertList;
|
||||
import jdk.test.lib.security.CertificateBuilder;
|
||||
|
||||
/*
|
||||
* @test
|
||||
* @bug 8200566
|
||||
* @summary Check that CRL validation continues to check other CRLs in
|
||||
* CRLDP extension after CRL fetching errors and exhibits same
|
||||
* behavior (fails because cert is revoked) whether CRL cache is
|
||||
* fresh or stale.
|
||||
* @modules java.base/sun.security.x509
|
||||
* java.base/sun.security.util
|
||||
* @library /test/lib
|
||||
* @run main/othervm -Dcom.sun.security.enableCRLDP=true CheckAllCRLs
|
||||
*/
|
||||
public class CheckAllCRLs {
|
||||
|
||||
public static void main(String[] args) throws Exception {
|
||||
|
||||
CertificateBuilder cb = new CertificateBuilder();
|
||||
|
||||
// Create CA cert
|
||||
KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA");
|
||||
KeyPair rootKeyPair = kpg.genKeyPair();
|
||||
X509Certificate rootCert = createCert(cb, "CN=Root CA",
|
||||
rootKeyPair, rootKeyPair, null, "SHA384withRSA", true, false);
|
||||
|
||||
// Create EE cert. This EE cert will contain a CRL Distribution
|
||||
// Points extension with two DistributionPoints - one will be a HTTP
|
||||
// URL to a non-existant HTTP server, and the other will be a File
|
||||
// URL to a file containing the CRL.
|
||||
KeyPair eeKeyPair = kpg.genKeyPair();
|
||||
X509Certificate eeCert1 = createCert(cb, "CN=End Entity",
|
||||
rootKeyPair, eeKeyPair, rootCert, "SHA384withRSA", false, true);
|
||||
|
||||
// Create another EE cert. This EE cert is similar in that it contains
|
||||
// a CRL Distribution Points extension but with one DistributionPoint
|
||||
// containing 2 GeneralName URLs as above.
|
||||
X509Certificate eeCert2 = createCert(cb, "CN=End Entity",
|
||||
rootKeyPair, eeKeyPair, rootCert, "SHA384withRSA", false, false);
|
||||
|
||||
// Create a CRL with no revoked certificates and store it in a file
|
||||
X509CRL crl = createCRL(new X500Name("CN=Root CA"), rootKeyPair,
|
||||
"SHA384withRSA");
|
||||
Files.write(Path.of("root.crl"), crl.getEncoded());
|
||||
|
||||
// Validate path containing eeCert1
|
||||
System.out.println("Validating cert with CRLDP containing one "
|
||||
+ "DistributionPoint with 2 entries, the first non-existent");
|
||||
validatePath(eeCert1, rootCert);
|
||||
|
||||
// Validate path containing eeCert2
|
||||
System.out.println("Validating cert with CRLDP containing two "
|
||||
+ "DistributionPoints with 1 entry each, the first non-existent");
|
||||
validatePath(eeCert2, rootCert);
|
||||
}
|
||||
|
||||
private static X509Certificate createCert(CertificateBuilder cb,
|
||||
String subjectDN, KeyPair issuerKeyPair, KeyPair subjectKeyPair,
|
||||
X509Certificate issuerCert, String sigAlg, boolean isCA,
|
||||
boolean twoDPs) throws Exception {
|
||||
cb.setSubjectName(subjectDN);
|
||||
cb.setPublicKey(subjectKeyPair.getPublic());
|
||||
cb.setSerialNumber(new BigInteger("1"));
|
||||
|
||||
if (isCA) {
|
||||
// Make a 3 year validity starting from 60 days ago
|
||||
long start = System.currentTimeMillis() - TimeUnit.DAYS.toMillis(60);
|
||||
long end = start + TimeUnit.DAYS.toMillis(1085);
|
||||
cb.setValidity(new Date(start), new Date(end));
|
||||
cb.addBasicConstraintsExt(true, true, -1);
|
||||
cb.addKeyUsageExt(new boolean[]
|
||||
{false, false, false, false, false, true, true, false, false});
|
||||
} else {
|
||||
// Make a 1 year validity starting from 7 days ago
|
||||
long start = System.currentTimeMillis() - TimeUnit.DAYS.toMillis(7);
|
||||
long end = start + TimeUnit.DAYS.toMillis(365);
|
||||
cb.setValidity(new Date(start), new Date(end));
|
||||
cb.addAuthorityKeyIdExt(issuerKeyPair.getPublic());
|
||||
cb.addKeyUsageExt(new boolean[]
|
||||
{true, false, false, false, false, false, false, false, false});
|
||||
cb.addExtendedKeyUsageExt(List.of("1.3.6.1.5.5.7.3.1"));
|
||||
GeneralName first = new GeneralName(new URIName(
|
||||
"http://127.0.0.1:48180/crl/will/always/fail/root.crl"));
|
||||
GeneralName second = new GeneralName(new URIName("file:./root.crl"));
|
||||
if (twoDPs) {
|
||||
GeneralNames gn1 = new GeneralNames().add(first);
|
||||
DistributionPoint dp1 = new DistributionPoint(gn1, null, null);
|
||||
GeneralNames gn2 = new GeneralNames().add(second);
|
||||
DistributionPoint dp2 = new DistributionPoint(gn2, null, null);
|
||||
cb.addExtension(new CRLDistributionPointsExtension(List.of(dp1, dp2)));
|
||||
} else {
|
||||
GeneralNames gn = new GeneralNames().add(first).add(second);
|
||||
DistributionPoint dp = new DistributionPoint(gn, null, null);
|
||||
cb.addExtension(new CRLDistributionPointsExtension(List.of(dp)));
|
||||
}
|
||||
}
|
||||
cb.addSubjectKeyIdExt(subjectKeyPair.getPublic());
|
||||
|
||||
// return signed cert
|
||||
return cb.build(issuerCert, issuerKeyPair.getPrivate(), sigAlg);
|
||||
}
|
||||
|
||||
private static X509CRL createCRL(X500Name caIssuer, KeyPair caKeyPair,
|
||||
String sigAlg) throws Exception {
|
||||
|
||||
CRLExtensions crlExts = new CRLExtensions();
|
||||
|
||||
// add AuthorityKeyIdentifier extension
|
||||
KeyIdentifier kid = new KeyIdentifier(caKeyPair.getPublic());
|
||||
Extension ext = new AuthorityKeyIdentifierExtension(kid, null, null);
|
||||
crlExts.setExtension(ext.getId(),
|
||||
new AuthorityKeyIdentifierExtension(kid, null, null));
|
||||
|
||||
// add CRLNumber extension
|
||||
ext = new CRLNumberExtension(1);
|
||||
crlExts.setExtension(ext.getId(), ext);
|
||||
|
||||
// revoke cert
|
||||
X509CRLEntryImpl crlEntry =
|
||||
new X509CRLEntryImpl(new BigInteger("1"), new Date());
|
||||
|
||||
// Create a 1 year validity CRL starting from 7 days ago
|
||||
long start = System.currentTimeMillis() - TimeUnit.DAYS.toMillis(7);
|
||||
long end = start + TimeUnit.DAYS.toMillis(365);
|
||||
TBSCertList tcl = new TBSCertList(caIssuer, new Date(start),
|
||||
new Date(end), new X509CRLEntryImpl[]{ crlEntry }, crlExts);
|
||||
|
||||
// return signed CRL
|
||||
return X509CRLImpl.newSigned(tcl, caKeyPair.getPrivate(), sigAlg);
|
||||
}
|
||||
|
||||
private static void validatePath(X509Certificate eeCert,
|
||||
X509Certificate rootCert) throws Exception {
|
||||
|
||||
// Create certification path and set up PKIXParameters.
|
||||
CertificateFactory cf = CertificateFactory.getInstance("X.509");
|
||||
CertPath cp = cf.generateCertPath(List.of(eeCert));
|
||||
PKIXParameters pp =
|
||||
new PKIXParameters(Set.of(new TrustAnchor(rootCert, null)));
|
||||
pp.setRevocationEnabled(true);
|
||||
|
||||
CertPathValidator cpv = CertPathValidator.getInstance("PKIX");
|
||||
|
||||
// Validate path twice in succession, making sure we get consistent
|
||||
// results the second time when the CRL cache is fresh.
|
||||
System.out.println("First time validating path");
|
||||
validate(cpv, cp, pp);
|
||||
System.out.println("Second time validating path");
|
||||
validate(cpv, cp, pp);
|
||||
|
||||
// CRL lookup cache time is 30s. Sleep for 35 seconds to ensure
|
||||
// cache is stale, and validate one more time to ensure we get
|
||||
// consistent results.
|
||||
System.out.println("Waiting for CRL cache to be cleared");
|
||||
Thread.sleep(30500);
|
||||
|
||||
System.out.println("Third time validating path");
|
||||
validate(cpv, cp, pp);
|
||||
}
|
||||
|
||||
private static void validate(CertPathValidator cpv, CertPath cp,
|
||||
PKIXParameters pp) throws Exception {
|
||||
|
||||
try {
|
||||
cpv.validate(cp, pp);
|
||||
throw new Exception("Validation passed unexpectedly");
|
||||
} catch (CertPathValidatorException cpve) {
|
||||
if (cpve.getReason() != BasicReason.REVOKED) {
|
||||
throw new Exception("Validation failed with unexpected reason", cpve);
|
||||
}
|
||||
System.out.println("Validation failed as expected: " + cpve);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,190 @@
|
|||
/*
|
||||
* Copyright (c) 2009, 2025, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
//
|
||||
// Security properties, once set, cannot revert to unset. To avoid
|
||||
// conflicts with tests running in the same VM isolate this test by
|
||||
// running it in otherVM mode.
|
||||
//
|
||||
|
||||
/**
|
||||
* @test
|
||||
*
|
||||
* @bug 6720721
|
||||
* @summary CRL check with circular depency support needed
|
||||
* @run main/othervm CircularCRLOneLevel
|
||||
* @enablePreview
|
||||
* @author Xuelei Fan
|
||||
*/
|
||||
|
||||
import java.io.*;
|
||||
import java.net.SocketException;
|
||||
import java.security.DEREncodable;
|
||||
import java.security.PEMDecoder;
|
||||
import java.util.*;
|
||||
import java.security.Security;
|
||||
import java.security.cert.*;
|
||||
import java.security.cert.CertPathValidatorException.BasicReason;
|
||||
|
||||
public class CircularCRLOneLevel {
|
||||
|
||||
static String selfSignedCertStr =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIICPjCCAaegAwIBAgIBADANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ\n" +
|
||||
"MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA0MjcwMjI0MzJaFw0zMDA0MDcwMjI0MzJa\n" +
|
||||
"MB8xCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMIGfMA0GCSqGSIb3DQEB\n" +
|
||||
"AQUAA4GNADCBiQKBgQC4OTag24sTxL2tXTNuvpmUEtdxrYAZoFsslFQ60T+WD9wQ\n" +
|
||||
"Jeiw87FSPsR2vxRuv0j8DNm2a4h7LNNIFcLurfNldbz5pvgZ7VqdbbUMPE9qP85n\n" +
|
||||
"jgDl4woyRTSUeRI4A7O0CO6NpES21dtbdhroWQrEkHxpnrDPxsxrz5gf2m3gqwID\n" +
|
||||
"AQABo4GJMIGGMB0GA1UdDgQWBBSCJd0hpl5PdAD9IZS+Hzng4lXLGzBHBgNVHSME\n" +
|
||||
"QDA+gBSCJd0hpl5PdAD9IZS+Hzng4lXLG6EjpCEwHzELMAkGA1UEBhMCVVMxEDAO\n" +
|
||||
"BgNVBAoTB0V4YW1wbGWCAQAwDwYDVR0TAQH/BAUwAwEB/zALBgNVHQ8EBAMCAgQw\n" +
|
||||
"DQYJKoZIhvcNAQEEBQADgYEAluy6HIjWcq009lTLmhp+Np6dxU78pInBK8RZkza0\n" +
|
||||
"484qGaxFGD3UGyZkI5uWmsH2XuMbuox5khfIq6781gmkPBHXBIEtJN8eLusOHEye\n" +
|
||||
"iE8h7WI+N3qa6Pj56WionMrioqC/3X+b06o147bbhx8U0vkYv/HyPaITOFfMXTdz\n" +
|
||||
"Vjw=\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
static String subCaCertStr =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIICUDCCAbmgAwIBAgIBAzANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ\n" +
|
||||
"MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA0MjcwMjI0MzRaFw0yOTAxMTIwMjI0MzRa\n" +
|
||||
"MDExCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMRAwDgYDVQQLEwdDbGFz\n" +
|
||||
"cy0xMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCiAJnAQW2ad3ZMKUhSJVZj\n" +
|
||||
"8pBqxTcHSTwAVguQkDglsN/OIwUpvR5Jgp3lpRWUEt6idEp0FZzORpvtjt3pr5MG\n" +
|
||||
"Eg2CDptekC5BSPS+fIAIKlncB3HwOiFFhH6b3wTydDCdEd2fvsi4QMOSVrIYMeA8\n" +
|
||||
"P/mCz6kRhfUQPE0CMmOUewIDAQABo4GJMIGGMB0GA1UdDgQWBBT0/nNP8WpyxmYr\n" +
|
||||
"IBp4tN8y08jw2jBHBgNVHSMEQDA+gBSCJd0hpl5PdAD9IZS+Hzng4lXLG6EjpCEw\n" +
|
||||
"HzELMAkGA1UEBhMCVVMxEDAOBgNVBAoTB0V4YW1wbGWCAQAwDwYDVR0TAQH/BAUw\n" +
|
||||
"AwEB/zALBgNVHQ8EBAMCAgQwDQYJKoZIhvcNAQEEBQADgYEAS9PzI6B39R/U9fRj\n" +
|
||||
"UExzN1FXNP5awnAPtiv34kSCL6n6MryqkfG+8aaAOdZsSjmTylNFaF7cW/Xp1VBF\n" +
|
||||
"hq0bg/SbEAbK7+UwL8GSC3crhULHLbh+1iFdVTEwxCw5YmB8ji3BaZ/WKW/PkjCZ\n" +
|
||||
"7cXP6VDeZMG6oRQ4hbOcixoFPXo=\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
static String targetCertStr = subCaCertStr;
|
||||
|
||||
static String crlIssuerCertStr =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIICKzCCAZSgAwIBAgIBAjANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ\n" +
|
||||
"MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA0MjcwMjI0MzNaFw0yOTAxMTIwMjI0MzNa\n" +
|
||||
"MB8xCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMIGfMA0GCSqGSIb3DQEB\n" +
|
||||
"AQUAA4GNADCBiQKBgQDMJeBMBybHykI/YpwUJ4O9euqDSLb1kpWpceBS8TVqvgBC\n" +
|
||||
"SgUJWtFZL0i6bdvF6mMdlbuBkGzhXqHiVAi96/zRLbUC9F8SMEJ6MuD+YhQ0ZFTQ\n" +
|
||||
"atKy8zf8O9XzztelLJ26Gqb7QPV133WY3haAqHtCXOhEKkCN16NOYNC37DTaJwID\n" +
|
||||
"AQABo3cwdTAdBgNVHQ4EFgQULXSWzXzUOIpOJpzbSCpW42IJUugwRwYDVR0jBEAw\n" +
|
||||
"PoAUgiXdIaZeT3QA/SGUvh854OJVyxuhI6QhMB8xCzAJBgNVBAYTAlVTMRAwDgYD\n" +
|
||||
"VQQKEwdFeGFtcGxlggEAMAsGA1UdDwQEAwIBAjANBgkqhkiG9w0BAQQFAAOBgQAY\n" +
|
||||
"eMnf5AHSNlyUlzXk8o2S0h4gCuvKX6C3kFfKuZcWvFAbx4yQOWLS2s15/nzR4+AP\n" +
|
||||
"FGX3lgJjROyAh7fGedTQK+NFWwkM2ag1g3hXktnlnT1qHohi0w31nVBJxXEDO/Ck\n" +
|
||||
"uJTpJGt8XxxbFaw5v7cHy7XuTAeU/sekvjEiNHW00Q==\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
static String crlStr =
|
||||
"-----BEGIN X509 CRL-----\n" +
|
||||
"MIIBGzCBhQIBATANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQMA4GA1UE\n" +
|
||||
"ChMHRXhhbXBsZRcNMDkwNDI3MDIzODA0WhcNMjgwNjI2MDIzODA0WjAiMCACAQUX\n" +
|
||||
"DTA5MDQyNzAyMzgwMFowDDAKBgNVHRUEAwoBBKAOMAwwCgYDVR0UBAMCAQIwDQYJ\n" +
|
||||
"KoZIhvcNAQEEBQADgYEAoarfzXEtw3ZDi4f9U8eSvRIipHSyxOrJC7HR/hM5VhmY\n" +
|
||||
"CErChny6x9lBVg9s57tfD/P9PSzBLusCcHwHMAbMOEcTltVVKUWZnnbumpywlYyg\n" +
|
||||
"oKLrE9+yCOkYUOpiRlz43/3vkEL5hjIKMcDSZnPKBZi1h16Yj2hPe9GMibNip54=\n" +
|
||||
"-----END X509 CRL-----";
|
||||
|
||||
private static final PEMDecoder PEM_DECODER = PEMDecoder.of();
|
||||
|
||||
private static CertPath generateCertificatePath()
|
||||
throws CertificateException {
|
||||
// generate certificate from cert strings
|
||||
CertificateFactory cf = CertificateFactory.getInstance("X.509");
|
||||
|
||||
Certificate targetCert = PEM_DECODER.decode(targetCertStr, X509Certificate.class);
|
||||
|
||||
Certificate selfSignedCert = PEM_DECODER.decode(selfSignedCertStr, X509Certificate.class);
|
||||
|
||||
// generate certification path
|
||||
List<Certificate> list = Arrays.asList(targetCert, selfSignedCert);
|
||||
|
||||
return cf.generateCertPath(list);
|
||||
}
|
||||
|
||||
private static Set<TrustAnchor> generateTrustAnchors()
|
||||
throws CertificateException {
|
||||
// generate certificate from cert string
|
||||
X509Certificate selfSignedCert = PEM_DECODER.decode(selfSignedCertStr, X509Certificate.class);
|
||||
|
||||
// generate a trust anchor
|
||||
TrustAnchor anchor =
|
||||
new TrustAnchor(selfSignedCert, null);
|
||||
|
||||
return Collections.singleton(anchor);
|
||||
}
|
||||
|
||||
private static CertStore generateCertificateStore() throws Exception {
|
||||
|
||||
// generate a cert store
|
||||
Collection<DEREncodable> entries = new HashSet<>();
|
||||
entries.add(PEM_DECODER.decode(crlStr, X509CRL.class));
|
||||
entries.add(PEM_DECODER.decode(crlIssuerCertStr, X509Certificate.class));
|
||||
|
||||
return CertStore.getInstance("Collection",
|
||||
new CollectionCertStoreParameters(entries));
|
||||
}
|
||||
|
||||
public static void main(String args[]) throws Exception {
|
||||
// MD5 is used in this test case, don't disable MD5 algorithm.
|
||||
Security.setProperty(
|
||||
"jdk.certpath.disabledAlgorithms", "MD2, RSA keySize < 1024");
|
||||
|
||||
CertPath path = generateCertificatePath();
|
||||
Set<TrustAnchor> anchors = generateTrustAnchors();
|
||||
CertStore crls = generateCertificateStore();
|
||||
|
||||
PKIXParameters params = new PKIXParameters(anchors);
|
||||
|
||||
// add the CRL store
|
||||
params.addCertStore(crls);
|
||||
|
||||
// Activate certificate revocation checking
|
||||
params.setRevocationEnabled(true);
|
||||
|
||||
// set the validation time
|
||||
params.setDate(new Date(109, 5, 1)); // 2009-05-01
|
||||
|
||||
// disable OCSP checker
|
||||
Security.setProperty("ocsp.enable", "false");
|
||||
|
||||
// enable CRL checker
|
||||
System.setProperty("com.sun.security.enableCRLDP", "true");
|
||||
|
||||
CertPathValidator validator = CertPathValidator.getInstance("PKIX");
|
||||
|
||||
try {
|
||||
validator.validate(path, params);
|
||||
} catch (CertPathValidatorException cpve) {
|
||||
if (cpve.getReason() != BasicReason.REVOKED) {
|
||||
throw new Exception(
|
||||
"unexpect exception, should be a REVOKED CPVE", cpve);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,192 @@
|
|||
/*
|
||||
* Copyright (c) 2009, 2025, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
//
|
||||
// Security properties, once set, cannot revert to unset. To avoid
|
||||
// conflicts with tests running in the same VM isolate this test by
|
||||
// running it in otherVM mode.
|
||||
//
|
||||
|
||||
/**
|
||||
* @test
|
||||
*
|
||||
* @bug 6720721
|
||||
* @summary CRL check with circular depency support needed
|
||||
* @run main/othervm CircularCRLOneLevelRevoked
|
||||
* @enablePreview
|
||||
* @author Xuelei Fan
|
||||
*/
|
||||
|
||||
import java.io.*;
|
||||
import java.net.SocketException;
|
||||
import java.security.DEREncodable;
|
||||
import java.security.PEMDecoder;
|
||||
import java.util.*;
|
||||
import java.security.Security;
|
||||
import java.security.cert.*;
|
||||
import java.security.cert.CertPathValidatorException.BasicReason;
|
||||
|
||||
public class CircularCRLOneLevelRevoked {
|
||||
|
||||
static String selfSignedCertStr =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIICPjCCAaegAwIBAgIBADANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ\n" +
|
||||
"MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA0MjcwMjI0MzJaFw0zMDA0MDcwMjI0MzJa\n" +
|
||||
"MB8xCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMIGfMA0GCSqGSIb3DQEB\n" +
|
||||
"AQUAA4GNADCBiQKBgQC4OTag24sTxL2tXTNuvpmUEtdxrYAZoFsslFQ60T+WD9wQ\n" +
|
||||
"Jeiw87FSPsR2vxRuv0j8DNm2a4h7LNNIFcLurfNldbz5pvgZ7VqdbbUMPE9qP85n\n" +
|
||||
"jgDl4woyRTSUeRI4A7O0CO6NpES21dtbdhroWQrEkHxpnrDPxsxrz5gf2m3gqwID\n" +
|
||||
"AQABo4GJMIGGMB0GA1UdDgQWBBSCJd0hpl5PdAD9IZS+Hzng4lXLGzBHBgNVHSME\n" +
|
||||
"QDA+gBSCJd0hpl5PdAD9IZS+Hzng4lXLG6EjpCEwHzELMAkGA1UEBhMCVVMxEDAO\n" +
|
||||
"BgNVBAoTB0V4YW1wbGWCAQAwDwYDVR0TAQH/BAUwAwEB/zALBgNVHQ8EBAMCAgQw\n" +
|
||||
"DQYJKoZIhvcNAQEEBQADgYEAluy6HIjWcq009lTLmhp+Np6dxU78pInBK8RZkza0\n" +
|
||||
"484qGaxFGD3UGyZkI5uWmsH2XuMbuox5khfIq6781gmkPBHXBIEtJN8eLusOHEye\n" +
|
||||
"iE8h7WI+N3qa6Pj56WionMrioqC/3X+b06o147bbhx8U0vkYv/HyPaITOFfMXTdz\n" +
|
||||
"Vjw=\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
static String dumCaCertStr =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIICUDCCAbmgAwIBAgIBBTANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ\n" +
|
||||
"MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA0MjcwMjI0MzVaFw0yOTAxMTIwMjI0MzVa\n" +
|
||||
"MDExCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMRAwDgYDVQQLEwdDbGFz\n" +
|
||||
"cy1EMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDAwfZ3wIYzdCkiFIKjrUKc\n" +
|
||||
"0B32HaRkUeVJthadinLmoAVruCi3GRkLZUIPXDD9b7dFBbdeT1+8qDHV5wu/ES8W\n" +
|
||||
"bgfirO8ng8h2hRuJbZgtfljNnVc3fptjxo7x73aP++w2oIcmjzVwaV08sgahoaY4\n" +
|
||||
"f249t4EXbvjJQ8kuj1I8qQIDAQABo4GJMIGGMB0GA1UdDgQWBBR3fwdjpP4WiuyL\n" +
|
||||
"/MDVrXUORrarXDBHBgNVHSMEQDA+gBSCJd0hpl5PdAD9IZS+Hzng4lXLG6EjpCEw\n" +
|
||||
"HzELMAkGA1UEBhMCVVMxEDAOBgNVBAoTB0V4YW1wbGWCAQAwDwYDVR0TAQH/BAUw\n" +
|
||||
"AwEB/zALBgNVHQ8EBAMCAgQwDQYJKoZIhvcNAQEEBQADgYEAp/2sXI/XLtXu+X05\n" +
|
||||
"EISyBPQqdE3kgN3dmXOuoK9J7Io8jhgetdbr9S1WTSGBonaXZgc52FNsaaDU+VIp\n" +
|
||||
"TGTYU5SFloUyOu/e095eAf9Q867pAPcE5zArfKpXEBLbJwhLFwrsKPk/WZM7Yaxs\n" +
|
||||
"mihnXyZWWTA1sPZlVJu7/abJ2v0=\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
// a revoked certificate
|
||||
static String targetCertStr = dumCaCertStr;
|
||||
|
||||
static String crlIssuerCertStr =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIICKzCCAZSgAwIBAgIBAjANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ\n" +
|
||||
"MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA0MjcwMjI0MzNaFw0yOTAxMTIwMjI0MzNa\n" +
|
||||
"MB8xCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMIGfMA0GCSqGSIb3DQEB\n" +
|
||||
"AQUAA4GNADCBiQKBgQDMJeBMBybHykI/YpwUJ4O9euqDSLb1kpWpceBS8TVqvgBC\n" +
|
||||
"SgUJWtFZL0i6bdvF6mMdlbuBkGzhXqHiVAi96/zRLbUC9F8SMEJ6MuD+YhQ0ZFTQ\n" +
|
||||
"atKy8zf8O9XzztelLJ26Gqb7QPV133WY3haAqHtCXOhEKkCN16NOYNC37DTaJwID\n" +
|
||||
"AQABo3cwdTAdBgNVHQ4EFgQULXSWzXzUOIpOJpzbSCpW42IJUugwRwYDVR0jBEAw\n" +
|
||||
"PoAUgiXdIaZeT3QA/SGUvh854OJVyxuhI6QhMB8xCzAJBgNVBAYTAlVTMRAwDgYD\n" +
|
||||
"VQQKEwdFeGFtcGxlggEAMAsGA1UdDwQEAwIBAjANBgkqhkiG9w0BAQQFAAOBgQAY\n" +
|
||||
"eMnf5AHSNlyUlzXk8o2S0h4gCuvKX6C3kFfKuZcWvFAbx4yQOWLS2s15/nzR4+AP\n" +
|
||||
"FGX3lgJjROyAh7fGedTQK+NFWwkM2ag1g3hXktnlnT1qHohi0w31nVBJxXEDO/Ck\n" +
|
||||
"uJTpJGt8XxxbFaw5v7cHy7XuTAeU/sekvjEiNHW00Q==\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
static String crlStr =
|
||||
"-----BEGIN X509 CRL-----\n" +
|
||||
"MIIBGzCBhQIBATANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQMA4GA1UE\n" +
|
||||
"ChMHRXhhbXBsZRcNMDkwNDI3MDIzODA0WhcNMjgwNjI2MDIzODA0WjAiMCACAQUX\n" +
|
||||
"DTA5MDQyNzAyMzgwMFowDDAKBgNVHRUEAwoBBKAOMAwwCgYDVR0UBAMCAQIwDQYJ\n" +
|
||||
"KoZIhvcNAQEEBQADgYEAoarfzXEtw3ZDi4f9U8eSvRIipHSyxOrJC7HR/hM5VhmY\n" +
|
||||
"CErChny6x9lBVg9s57tfD/P9PSzBLusCcHwHMAbMOEcTltVVKUWZnnbumpywlYyg\n" +
|
||||
"oKLrE9+yCOkYUOpiRlz43/3vkEL5hjIKMcDSZnPKBZi1h16Yj2hPe9GMibNip54=\n" +
|
||||
"-----END X509 CRL-----";
|
||||
|
||||
private static final PEMDecoder PEM_DECODER = PEMDecoder.of();
|
||||
|
||||
private static CertPath generateCertificatePath()
|
||||
throws CertificateException {
|
||||
// generate certificate from cert strings
|
||||
CertificateFactory cf = CertificateFactory.getInstance("X.509");
|
||||
|
||||
Certificate targetCert = PEM_DECODER.decode(targetCertStr, X509Certificate.class);
|
||||
|
||||
Certificate selfSignedCert = PEM_DECODER.decode(selfSignedCertStr, X509Certificate.class);
|
||||
|
||||
// generate certification path
|
||||
List<Certificate> list = Arrays.asList(targetCert, selfSignedCert);
|
||||
|
||||
return cf.generateCertPath(list);
|
||||
}
|
||||
|
||||
private static Set<TrustAnchor> generateTrustAnchors()
|
||||
throws CertificateException {
|
||||
// generate certificate from cert string
|
||||
X509Certificate selfSignedCert = PEM_DECODER.decode(selfSignedCertStr, X509Certificate.class);
|
||||
|
||||
// generate a trust anchor
|
||||
TrustAnchor anchor =
|
||||
new TrustAnchor(selfSignedCert, null);
|
||||
|
||||
return Collections.singleton(anchor);
|
||||
}
|
||||
|
||||
private static CertStore generateCertificateStore() throws Exception {
|
||||
// generate CRL from CRL string
|
||||
Collection<DEREncodable> entries = new HashSet<>();
|
||||
entries.add(PEM_DECODER.decode(crlStr, X509CRL.class));
|
||||
entries.add(PEM_DECODER.decode(crlIssuerCertStr, X509Certificate.class));
|
||||
|
||||
return CertStore.getInstance("Collection",
|
||||
new CollectionCertStoreParameters(entries));
|
||||
}
|
||||
|
||||
public static void main(String args[]) throws Exception {
|
||||
// MD5 is used in this test case, don't disable MD5 algorithm.
|
||||
Security.setProperty(
|
||||
"jdk.certpath.disabledAlgorithms", "MD2, RSA keySize < 1024");
|
||||
|
||||
CertPath path = generateCertificatePath();
|
||||
Set<TrustAnchor> anchors = generateTrustAnchors();
|
||||
CertStore crls = generateCertificateStore();
|
||||
|
||||
PKIXParameters params = new PKIXParameters(anchors);
|
||||
|
||||
// add the CRL store
|
||||
params.addCertStore(crls);
|
||||
|
||||
// Activate certificate revocation checking
|
||||
params.setRevocationEnabled(true);
|
||||
|
||||
// set the validation time
|
||||
params.setDate(new Date(109, 5, 1)); // 2009-05-01
|
||||
|
||||
// disable OCSP checker
|
||||
Security.setProperty("ocsp.enable", "false");
|
||||
|
||||
// enable CRL checker
|
||||
System.setProperty("com.sun.security.enableCRLDP", "true");
|
||||
|
||||
CertPathValidator validator = CertPathValidator.getInstance("PKIX");
|
||||
|
||||
try {
|
||||
validator.validate(path, params);
|
||||
throw new Exception("unexpected status, should be REVOKED");
|
||||
} catch (CertPathValidatorException cpve) {
|
||||
if (cpve.getReason() != BasicReason.REVOKED) {
|
||||
throw new Exception(
|
||||
"unexpected exception, should be a REVOKED CPVE", cpve);
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,259 @@
|
|||
/*
|
||||
* Copyright (c) 2009, 2025, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
//
|
||||
// Security properties, once set, cannot revert to unset. To avoid
|
||||
// conflicts with tests running in the same VM isolate this test by
|
||||
// running it in otherVM mode.
|
||||
//
|
||||
|
||||
/**
|
||||
* @test
|
||||
*
|
||||
* @bug 6720721
|
||||
* @summary CRL check with circular depency support needed
|
||||
* @enablePreview
|
||||
* @run main/othervm CircularCRLTwoLevel
|
||||
* @author Xuelei Fan
|
||||
*/
|
||||
|
||||
import java.security.DEREncodable;
|
||||
import java.security.PEMDecoder;
|
||||
import java.security.Security;
|
||||
import java.security.cert.CertPath;
|
||||
import java.security.cert.CertPathValidator;
|
||||
import java.security.cert.CertPathValidatorException;
|
||||
import java.security.cert.CertPathValidatorException.BasicReason;
|
||||
import java.security.cert.CertStore;
|
||||
import java.security.cert.Certificate;
|
||||
import java.security.cert.CertificateException;
|
||||
import java.security.cert.CertificateFactory;
|
||||
import java.security.cert.CollectionCertStoreParameters;
|
||||
import java.security.cert.PKIXParameters;
|
||||
import java.security.cert.TrustAnchor;
|
||||
import java.security.cert.X509CRL;
|
||||
import java.security.cert.X509Certificate;
|
||||
import java.util.Arrays;
|
||||
import java.util.Collection;
|
||||
import java.util.Collections;
|
||||
import java.util.Date;
|
||||
import java.util.HashSet;
|
||||
import java.util.List;
|
||||
import java.util.Set;
|
||||
|
||||
public class CircularCRLTwoLevel {
|
||||
|
||||
static String selfSignedCertStr =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIICPjCCAaegAwIBAgIBADANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ\n" +
|
||||
"MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA0MjcwMjI0MzJaFw0zMDA0MDcwMjI0MzJa\n" +
|
||||
"MB8xCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMIGfMA0GCSqGSIb3DQEB\n" +
|
||||
"AQUAA4GNADCBiQKBgQC4OTag24sTxL2tXTNuvpmUEtdxrYAZoFsslFQ60T+WD9wQ\n" +
|
||||
"Jeiw87FSPsR2vxRuv0j8DNm2a4h7LNNIFcLurfNldbz5pvgZ7VqdbbUMPE9qP85n\n" +
|
||||
"jgDl4woyRTSUeRI4A7O0CO6NpES21dtbdhroWQrEkHxpnrDPxsxrz5gf2m3gqwID\n" +
|
||||
"AQABo4GJMIGGMB0GA1UdDgQWBBSCJd0hpl5PdAD9IZS+Hzng4lXLGzBHBgNVHSME\n" +
|
||||
"QDA+gBSCJd0hpl5PdAD9IZS+Hzng4lXLG6EjpCEwHzELMAkGA1UEBhMCVVMxEDAO\n" +
|
||||
"BgNVBAoTB0V4YW1wbGWCAQAwDwYDVR0TAQH/BAUwAwEB/zALBgNVHQ8EBAMCAgQw\n" +
|
||||
"DQYJKoZIhvcNAQEEBQADgYEAluy6HIjWcq009lTLmhp+Np6dxU78pInBK8RZkza0\n" +
|
||||
"484qGaxFGD3UGyZkI5uWmsH2XuMbuox5khfIq6781gmkPBHXBIEtJN8eLusOHEye\n" +
|
||||
"iE8h7WI+N3qa6Pj56WionMrioqC/3X+b06o147bbhx8U0vkYv/HyPaITOFfMXTdz\n" +
|
||||
"Vjw=\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
static String subCaCertStr =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIICUDCCAbmgAwIBAgIBAzANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ\n" +
|
||||
"MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA0MjcwMjI0MzRaFw0yOTAxMTIwMjI0MzRa\n" +
|
||||
"MDExCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMRAwDgYDVQQLEwdDbGFz\n" +
|
||||
"cy0xMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCiAJnAQW2ad3ZMKUhSJVZj\n" +
|
||||
"8pBqxTcHSTwAVguQkDglsN/OIwUpvR5Jgp3lpRWUEt6idEp0FZzORpvtjt3pr5MG\n" +
|
||||
"Eg2CDptekC5BSPS+fIAIKlncB3HwOiFFhH6b3wTydDCdEd2fvsi4QMOSVrIYMeA8\n" +
|
||||
"P/mCz6kRhfUQPE0CMmOUewIDAQABo4GJMIGGMB0GA1UdDgQWBBT0/nNP8WpyxmYr\n" +
|
||||
"IBp4tN8y08jw2jBHBgNVHSMEQDA+gBSCJd0hpl5PdAD9IZS+Hzng4lXLG6EjpCEw\n" +
|
||||
"HzELMAkGA1UEBhMCVVMxEDAOBgNVBAoTB0V4YW1wbGWCAQAwDwYDVR0TAQH/BAUw\n" +
|
||||
"AwEB/zALBgNVHQ8EBAMCAgQwDQYJKoZIhvcNAQEEBQADgYEAS9PzI6B39R/U9fRj\n" +
|
||||
"UExzN1FXNP5awnAPtiv34kSCL6n6MryqkfG+8aaAOdZsSjmTylNFaF7cW/Xp1VBF\n" +
|
||||
"hq0bg/SbEAbK7+UwL8GSC3crhULHLbh+1iFdVTEwxCw5YmB8ji3BaZ/WKW/PkjCZ\n" +
|
||||
"7cXP6VDeZMG6oRQ4hbOcixoFPXo=\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
static String targetCertStr =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIICNzCCAaCgAwIBAgIBAjANBgkqhkiG9w0BAQQFADAxMQswCQYDVQQGEwJVUzEQ\n" +
|
||||
"MA4GA1UEChMHRXhhbXBsZTEQMA4GA1UECxMHQ2xhc3MtMTAeFw0wOTA0MjcwMjI0\n" +
|
||||
"MzZaFw0yOTAxMTIwMjI0MzZaMEExCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFt\n" +
|
||||
"cGxlMRAwDgYDVQQLEwdDbGFzcy0xMQ4wDAYDVQQDEwVBbGljZTCBnzANBgkqhkiG\n" +
|
||||
"9w0BAQEFAAOBjQAwgYkCgYEAvYSaU3oiE4Pxp/aUIXwMqOwSiWkZ+O3aTu13hRtK\n" +
|
||||
"ZyR+Wtj63IuvaigAC4uC+zBypF93ThjwCzVR2qKDQaQzV8CLleO96gStt7Y+i3G2\n" +
|
||||
"V3IUGgrVCqeK7N6nNYu0wW84sibcPqG/TIy0UoaQMqgB21xtRF+1DUVlFh4Z89X/\n" +
|
||||
"pskCAwEAAaNPME0wCwYDVR0PBAQDAgPoMB0GA1UdDgQWBBSynMEdcal/e9TmvlNE\n" +
|
||||
"4suXGA4+hjAfBgNVHSMEGDAWgBT0/nNP8WpyxmYrIBp4tN8y08jw2jANBgkqhkiG\n" +
|
||||
"9w0BAQQFAAOBgQB/jru7E/+piSmUwByw5qbZsoQZVcgR97pd2TErNJpJMAX2oIHR\n" +
|
||||
"wJH6w4NuYs27+fEAX7wK4whc6EUH/w1SI6o28F2rG6HqYQPPZ2E2WqwbBQL9nYE3\n" +
|
||||
"Vfzu/G9axTUQXFbf90h80UErA+mZVxqc2xtymLuH0YEaMZImtRZ2MXHfXg==\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
static String topCrlIssuerCertStr =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIICKzCCAZSgAwIBAgIBAjANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ\n" +
|
||||
"MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA0MjcwMjI0MzNaFw0yOTAxMTIwMjI0MzNa\n" +
|
||||
"MB8xCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMIGfMA0GCSqGSIb3DQEB\n" +
|
||||
"AQUAA4GNADCBiQKBgQDMJeBMBybHykI/YpwUJ4O9euqDSLb1kpWpceBS8TVqvgBC\n" +
|
||||
"SgUJWtFZL0i6bdvF6mMdlbuBkGzhXqHiVAi96/zRLbUC9F8SMEJ6MuD+YhQ0ZFTQ\n" +
|
||||
"atKy8zf8O9XzztelLJ26Gqb7QPV133WY3haAqHtCXOhEKkCN16NOYNC37DTaJwID\n" +
|
||||
"AQABo3cwdTAdBgNVHQ4EFgQULXSWzXzUOIpOJpzbSCpW42IJUugwRwYDVR0jBEAw\n" +
|
||||
"PoAUgiXdIaZeT3QA/SGUvh854OJVyxuhI6QhMB8xCzAJBgNVBAYTAlVTMRAwDgYD\n" +
|
||||
"VQQKEwdFeGFtcGxlggEAMAsGA1UdDwQEAwIBAjANBgkqhkiG9w0BAQQFAAOBgQAY\n" +
|
||||
"eMnf5AHSNlyUlzXk8o2S0h4gCuvKX6C3kFfKuZcWvFAbx4yQOWLS2s15/nzR4+AP\n" +
|
||||
"FGX3lgJjROyAh7fGedTQK+NFWwkM2ag1g3hXktnlnT1qHohi0w31nVBJxXEDO/Ck\n" +
|
||||
"uJTpJGt8XxxbFaw5v7cHy7XuTAeU/sekvjEiNHW00Q==\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
static String subCrlIssuerCertStr =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIICPTCCAaagAwIBAgIBBDANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ\n" +
|
||||
"MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA0MjcwMjI0MzRaFw0yOTAxMTIwMjI0MzRa\n" +
|
||||
"MDExCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMRAwDgYDVQQLEwdDbGFz\n" +
|
||||
"cy0xMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDWUtDQx2MB/7arDiquMJyd\n" +
|
||||
"LWwSg6p8sg5z6wKrC1v47MT4DBhFX+0RUgTMUdQgYpgxGpczn+6y4zfV76064S0N\n" +
|
||||
"4L/IQ+SunTW1w4yRGjB+xkyyJmWAqijG1nr+Dgkv5nxPI+9Er5lHcoVWVMEcvvRm\n" +
|
||||
"6jIBQdldVlSgv+VgUnFm5wIDAQABo3cwdTAdBgNVHQ4EFgQUkV3Qqtk7gIot9n60\n" +
|
||||
"jX6dloxrfMEwRwYDVR0jBEAwPoAUgiXdIaZeT3QA/SGUvh854OJVyxuhI6QhMB8x\n" +
|
||||
"CzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlggEAMAsGA1UdDwQEAwIBAjAN\n" +
|
||||
"BgkqhkiG9w0BAQQFAAOBgQADu4GM8EdmIKhC7FRvk5jF90zfvZ38wbXBzCjKI4jX\n" +
|
||||
"QJrhne1bfyeNNm5c1w+VKidT+XzBzBGH7ZqYzoZmzRIfcbLKX2brEBKiukeeAyL3\n" +
|
||||
"bctQtbp19tX+uu2dQberD188AAysKTkHcJUV+rRsTwVJ9vcYKxoRxKk8DhH7ZS3M\n" +
|
||||
"rg==\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
static String topCrlStr =
|
||||
"-----BEGIN X509 CRL-----\n" +
|
||||
"MIIBGzCBhQIBATANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQMA4GA1UE\n" +
|
||||
"ChMHRXhhbXBsZRcNMDkwNDI3MDIzODA0WhcNMjgwNjI2MDIzODA0WjAiMCACAQUX\n" +
|
||||
"DTA5MDQyNzAyMzgwMFowDDAKBgNVHRUEAwoBBKAOMAwwCgYDVR0UBAMCAQIwDQYJ\n" +
|
||||
"KoZIhvcNAQEEBQADgYEAoarfzXEtw3ZDi4f9U8eSvRIipHSyxOrJC7HR/hM5VhmY\n" +
|
||||
"CErChny6x9lBVg9s57tfD/P9PSzBLusCcHwHMAbMOEcTltVVKUWZnnbumpywlYyg\n" +
|
||||
"oKLrE9+yCOkYUOpiRlz43/3vkEL5hjIKMcDSZnPKBZi1h16Yj2hPe9GMibNip54=\n" +
|
||||
"-----END X509 CRL-----";
|
||||
|
||||
static String subCrlStr =
|
||||
"-----BEGIN X509 CRL-----\n" +
|
||||
"MIIBLTCBlwIBATANBgkqhkiG9w0BAQQFADAxMQswCQYDVQQGEwJVUzEQMA4GA1UE\n" +
|
||||
"ChMHRXhhbXBsZTEQMA4GA1UECxMHQ2xhc3MtMRcNMDkwNDI3MDIzODA0WhcNMjgw\n" +
|
||||
"NjI2MDIzODA0WjAiMCACAQQXDTA5MDQyNzAyMzgwMVowDDAKBgNVHRUEAwoBBKAO\n" +
|
||||
"MAwwCgYDVR0UBAMCAQIwDQYJKoZIhvcNAQEEBQADgYEAeS+POqYEIHIIJcsLxuUr\n" +
|
||||
"aJFzQ/ujH0QmnyMNEL3Uavyq4VQuAahF+w6aTPb5UBzms0uX8NAvD2vNoUJvmJOX\n" +
|
||||
"nGKuq4Q1DFj82E7/9d25nXdWGOmFvFCRVO+St2Xe5n8CJuZNBiz388FDSIOiFSCa\n" +
|
||||
"ARGr6Qu68MYGtLMC6ZqP3u0=\n" +
|
||||
"-----END X509 CRL-----";
|
||||
|
||||
private static final PEMDecoder pemDecoder = PEMDecoder.of();
|
||||
|
||||
private static CertPath generateCertificatePath()
|
||||
throws CertificateException {
|
||||
// generate certificate from cert strings
|
||||
CertificateFactory cf = CertificateFactory.getInstance("X.509");
|
||||
|
||||
Certificate targetCert = pemDecoder.decode(targetCertStr, X509Certificate.class);
|
||||
Certificate subCaCert = pemDecoder.decode(subCaCertStr, X509Certificate.class);
|
||||
Certificate selfSignedCert = pemDecoder.decode(selfSignedCertStr, X509Certificate.class);
|
||||
|
||||
// generate certification path
|
||||
List<Certificate> list = Arrays.asList(targetCert, subCaCert, selfSignedCert);
|
||||
|
||||
return cf.generateCertPath(list);
|
||||
}
|
||||
|
||||
private static Set<TrustAnchor> generateTrustAnchors()
|
||||
throws CertificateException {
|
||||
// generate certificate from cert string
|
||||
|
||||
final X509Certificate selfSignedCert = pemDecoder.decode(selfSignedCertStr, X509Certificate.class);
|
||||
|
||||
// generate a trust anchor
|
||||
TrustAnchor anchor =
|
||||
new TrustAnchor(selfSignedCert, null);
|
||||
|
||||
return Collections.singleton(anchor);
|
||||
}
|
||||
|
||||
private static CertStore generateCertificateStore() throws Exception {
|
||||
Collection<DEREncodable> entries = new HashSet<>();
|
||||
|
||||
// generate CRL from CRL string
|
||||
|
||||
DEREncodable mixes = pemDecoder.decode(topCrlStr, X509CRL.class);
|
||||
entries.add(mixes);
|
||||
|
||||
mixes = pemDecoder.decode(subCrlStr, X509CRL.class);
|
||||
entries.add(mixes);
|
||||
|
||||
// intermediate certs
|
||||
mixes = pemDecoder.decode(topCrlIssuerCertStr, X509Certificate.class);
|
||||
entries.add(mixes);
|
||||
|
||||
mixes = pemDecoder.decode(subCrlIssuerCertStr, X509Certificate.class);
|
||||
entries.add(mixes);
|
||||
|
||||
return CertStore.getInstance("Collection",
|
||||
new CollectionCertStoreParameters(entries));
|
||||
}
|
||||
|
||||
public static void main(String args[]) throws Exception {
|
||||
// MD5 is used in this test case, don't disable MD5 algorithm.
|
||||
Security.setProperty(
|
||||
"jdk.certpath.disabledAlgorithms", "MD2, RSA keySize < 1024");
|
||||
|
||||
CertPath path = generateCertificatePath();
|
||||
Set<TrustAnchor> anchors = generateTrustAnchors();
|
||||
CertStore crls = generateCertificateStore();
|
||||
|
||||
PKIXParameters params = new PKIXParameters(anchors);
|
||||
|
||||
// add the CRL store
|
||||
params.addCertStore(crls);
|
||||
|
||||
// Activate certificate revocation checking
|
||||
params.setRevocationEnabled(true);
|
||||
|
||||
// set the validation time
|
||||
params.setDate(new Date(109, 5, 1)); // 2009-05-01
|
||||
|
||||
// disable OCSP checker
|
||||
Security.setProperty("ocsp.enable", "false");
|
||||
|
||||
// enable CRL checker
|
||||
System.setProperty("com.sun.security.enableCRLDP", "true");
|
||||
|
||||
CertPathValidator validator = CertPathValidator.getInstance("PKIX");
|
||||
|
||||
try {
|
||||
validator.validate(path, params);
|
||||
} catch (CertPathValidatorException cpve) {
|
||||
if (cpve.getReason() != BasicReason.REVOKED) {
|
||||
throw new Exception(
|
||||
"unexpect exception, should be a REVOKED CPVE", cpve);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,261 @@
|
|||
/*
|
||||
* Copyright (c) 2009, 2025, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
//
|
||||
// Security properties, once set, cannot revert to unset. To avoid
|
||||
// conflicts with tests running in the same VM isolate this test by
|
||||
// running it in otherVM mode.
|
||||
//
|
||||
|
||||
/**
|
||||
* @test
|
||||
*
|
||||
* @bug 6720721
|
||||
* @summary CRL check with circular depency support needed
|
||||
* @enablePreview
|
||||
* @run main/othervm CircularCRLTwoLevelRevoked
|
||||
* @author Xuelei Fan
|
||||
*/
|
||||
|
||||
import java.security.DEREncodable;
|
||||
import java.security.PEMDecoder;
|
||||
import java.security.Security;
|
||||
import java.security.cert.CertPath;
|
||||
import java.security.cert.CertPathValidator;
|
||||
import java.security.cert.CertPathValidatorException;
|
||||
import java.security.cert.CertPathValidatorException.BasicReason;
|
||||
import java.security.cert.CertStore;
|
||||
import java.security.cert.Certificate;
|
||||
import java.security.cert.CertificateException;
|
||||
import java.security.cert.CertificateFactory;
|
||||
import java.security.cert.CollectionCertStoreParameters;
|
||||
import java.security.cert.PKIXParameters;
|
||||
import java.security.cert.TrustAnchor;
|
||||
import java.security.cert.X509CRL;
|
||||
import java.security.cert.X509Certificate;
|
||||
import java.util.Arrays;
|
||||
import java.util.Collection;
|
||||
import java.util.Collections;
|
||||
import java.util.Date;
|
||||
import java.util.HashSet;
|
||||
import java.util.List;
|
||||
import java.util.Set;
|
||||
|
||||
public class CircularCRLTwoLevelRevoked {
|
||||
|
||||
static String selfSignedCertStr =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIICPjCCAaegAwIBAgIBADANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ\n" +
|
||||
"MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA0MjcwMjI0MzJaFw0zMDA0MDcwMjI0MzJa\n" +
|
||||
"MB8xCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMIGfMA0GCSqGSIb3DQEB\n" +
|
||||
"AQUAA4GNADCBiQKBgQC4OTag24sTxL2tXTNuvpmUEtdxrYAZoFsslFQ60T+WD9wQ\n" +
|
||||
"Jeiw87FSPsR2vxRuv0j8DNm2a4h7LNNIFcLurfNldbz5pvgZ7VqdbbUMPE9qP85n\n" +
|
||||
"jgDl4woyRTSUeRI4A7O0CO6NpES21dtbdhroWQrEkHxpnrDPxsxrz5gf2m3gqwID\n" +
|
||||
"AQABo4GJMIGGMB0GA1UdDgQWBBSCJd0hpl5PdAD9IZS+Hzng4lXLGzBHBgNVHSME\n" +
|
||||
"QDA+gBSCJd0hpl5PdAD9IZS+Hzng4lXLG6EjpCEwHzELMAkGA1UEBhMCVVMxEDAO\n" +
|
||||
"BgNVBAoTB0V4YW1wbGWCAQAwDwYDVR0TAQH/BAUwAwEB/zALBgNVHQ8EBAMCAgQw\n" +
|
||||
"DQYJKoZIhvcNAQEEBQADgYEAluy6HIjWcq009lTLmhp+Np6dxU78pInBK8RZkza0\n" +
|
||||
"484qGaxFGD3UGyZkI5uWmsH2XuMbuox5khfIq6781gmkPBHXBIEtJN8eLusOHEye\n" +
|
||||
"iE8h7WI+N3qa6Pj56WionMrioqC/3X+b06o147bbhx8U0vkYv/HyPaITOFfMXTdz\n" +
|
||||
"Vjw=\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
static String subCaCertStr =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIICUDCCAbmgAwIBAgIBAzANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ\n" +
|
||||
"MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA0MjcwMjI0MzRaFw0yOTAxMTIwMjI0MzRa\n" +
|
||||
"MDExCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMRAwDgYDVQQLEwdDbGFz\n" +
|
||||
"cy0xMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCiAJnAQW2ad3ZMKUhSJVZj\n" +
|
||||
"8pBqxTcHSTwAVguQkDglsN/OIwUpvR5Jgp3lpRWUEt6idEp0FZzORpvtjt3pr5MG\n" +
|
||||
"Eg2CDptekC5BSPS+fIAIKlncB3HwOiFFhH6b3wTydDCdEd2fvsi4QMOSVrIYMeA8\n" +
|
||||
"P/mCz6kRhfUQPE0CMmOUewIDAQABo4GJMIGGMB0GA1UdDgQWBBT0/nNP8WpyxmYr\n" +
|
||||
"IBp4tN8y08jw2jBHBgNVHSMEQDA+gBSCJd0hpl5PdAD9IZS+Hzng4lXLG6EjpCEw\n" +
|
||||
"HzELMAkGA1UEBhMCVVMxEDAOBgNVBAoTB0V4YW1wbGWCAQAwDwYDVR0TAQH/BAUw\n" +
|
||||
"AwEB/zALBgNVHQ8EBAMCAgQwDQYJKoZIhvcNAQEEBQADgYEAS9PzI6B39R/U9fRj\n" +
|
||||
"UExzN1FXNP5awnAPtiv34kSCL6n6MryqkfG+8aaAOdZsSjmTylNFaF7cW/Xp1VBF\n" +
|
||||
"hq0bg/SbEAbK7+UwL8GSC3crhULHLbh+1iFdVTEwxCw5YmB8ji3BaZ/WKW/PkjCZ\n" +
|
||||
"7cXP6VDeZMG6oRQ4hbOcixoFPXo=\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
// a revoked certificate
|
||||
static String targetCertStr =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIICNzCCAaCgAwIBAgIBBDANBgkqhkiG9w0BAQQFADAxMQswCQYDVQQGEwJVUzEQ\n" +
|
||||
"MA4GA1UEChMHRXhhbXBsZTEQMA4GA1UECxMHQ2xhc3MtMTAeFw0wOTA0MjcwMjI0\n" +
|
||||
"MzhaFw0yOTAxMTIwMjI0MzhaMEExCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFt\n" +
|
||||
"cGxlMRAwDgYDVQQLEwdDbGFzcy0xMQ4wDAYDVQQDEwVTdXNhbjCBnzANBgkqhkiG\n" +
|
||||
"9w0BAQEFAAOBjQAwgYkCgYEAyPKlfep+EIIUOpZF3xtYUhAx79qEqe2RPRcH2YeR\n" +
|
||||
"1ogM8+AZMdcXoiuDl4CFLzQwRv1DSKUZAPdPbROLVDsUn+IGvgn2jnE7ZQEUtQQJ\n" +
|
||||
"+rorcasE7bo5MBPuno/0oQRi/4MZn6lX3qB13ZUHAvZH96oCF6C3Ro19LAwav1Lo\n" +
|
||||
"FRcCAwEAAaNPME0wCwYDVR0PBAQDAgPoMB0GA1UdDgQWBBTCUH1tqQk96Pocr8Is\n" +
|
||||
"tDKMoIRQljAfBgNVHSMEGDAWgBT0/nNP8WpyxmYrIBp4tN8y08jw2jANBgkqhkiG\n" +
|
||||
"9w0BAQQFAAOBgQB3YXuTA+QfaImQ2aN/e27Nv5a/FMml6y6t0+pzt5hUYG2W0C2f\n" +
|
||||
"5Hdmf3whNCA7zE5RVDQP0iuGBPgjvrABuN98Vimv2eTV+N5aYTak0Aav/OuR5Lpi\n" +
|
||||
"tYhXMMg5gSmT+JDARba4CX+Ap1oAaNe9Mtv8L6FWdvBqfzzifDHWavdIWA==\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
static String topCrlIssuerCertStr =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIICKzCCAZSgAwIBAgIBAjANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ\n" +
|
||||
"MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA0MjcwMjI0MzNaFw0yOTAxMTIwMjI0MzNa\n" +
|
||||
"MB8xCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMIGfMA0GCSqGSIb3DQEB\n" +
|
||||
"AQUAA4GNADCBiQKBgQDMJeBMBybHykI/YpwUJ4O9euqDSLb1kpWpceBS8TVqvgBC\n" +
|
||||
"SgUJWtFZL0i6bdvF6mMdlbuBkGzhXqHiVAi96/zRLbUC9F8SMEJ6MuD+YhQ0ZFTQ\n" +
|
||||
"atKy8zf8O9XzztelLJ26Gqb7QPV133WY3haAqHtCXOhEKkCN16NOYNC37DTaJwID\n" +
|
||||
"AQABo3cwdTAdBgNVHQ4EFgQULXSWzXzUOIpOJpzbSCpW42IJUugwRwYDVR0jBEAw\n" +
|
||||
"PoAUgiXdIaZeT3QA/SGUvh854OJVyxuhI6QhMB8xCzAJBgNVBAYTAlVTMRAwDgYD\n" +
|
||||
"VQQKEwdFeGFtcGxlggEAMAsGA1UdDwQEAwIBAjANBgkqhkiG9w0BAQQFAAOBgQAY\n" +
|
||||
"eMnf5AHSNlyUlzXk8o2S0h4gCuvKX6C3kFfKuZcWvFAbx4yQOWLS2s15/nzR4+AP\n" +
|
||||
"FGX3lgJjROyAh7fGedTQK+NFWwkM2ag1g3hXktnlnT1qHohi0w31nVBJxXEDO/Ck\n" +
|
||||
"uJTpJGt8XxxbFaw5v7cHy7XuTAeU/sekvjEiNHW00Q==\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
static String subCrlIssuerCertStr =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIICPTCCAaagAwIBAgIBBDANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ\n" +
|
||||
"MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA0MjcwMjI0MzRaFw0yOTAxMTIwMjI0MzRa\n" +
|
||||
"MDExCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMRAwDgYDVQQLEwdDbGFz\n" +
|
||||
"cy0xMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDWUtDQx2MB/7arDiquMJyd\n" +
|
||||
"LWwSg6p8sg5z6wKrC1v47MT4DBhFX+0RUgTMUdQgYpgxGpczn+6y4zfV76064S0N\n" +
|
||||
"4L/IQ+SunTW1w4yRGjB+xkyyJmWAqijG1nr+Dgkv5nxPI+9Er5lHcoVWVMEcvvRm\n" +
|
||||
"6jIBQdldVlSgv+VgUnFm5wIDAQABo3cwdTAdBgNVHQ4EFgQUkV3Qqtk7gIot9n60\n" +
|
||||
"jX6dloxrfMEwRwYDVR0jBEAwPoAUgiXdIaZeT3QA/SGUvh854OJVyxuhI6QhMB8x\n" +
|
||||
"CzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlggEAMAsGA1UdDwQEAwIBAjAN\n" +
|
||||
"BgkqhkiG9w0BAQQFAAOBgQADu4GM8EdmIKhC7FRvk5jF90zfvZ38wbXBzCjKI4jX\n" +
|
||||
"QJrhne1bfyeNNm5c1w+VKidT+XzBzBGH7ZqYzoZmzRIfcbLKX2brEBKiukeeAyL3\n" +
|
||||
"bctQtbp19tX+uu2dQberD188AAysKTkHcJUV+rRsTwVJ9vcYKxoRxKk8DhH7ZS3M\n" +
|
||||
"rg==\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
static String topCrlStr =
|
||||
"-----BEGIN X509 CRL-----\n" +
|
||||
"MIIBGzCBhQIBATANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQMA4GA1UE\n" +
|
||||
"ChMHRXhhbXBsZRcNMDkwNDI3MDIzODA0WhcNMjgwNjI2MDIzODA0WjAiMCACAQUX\n" +
|
||||
"DTA5MDQyNzAyMzgwMFowDDAKBgNVHRUEAwoBBKAOMAwwCgYDVR0UBAMCAQIwDQYJ\n" +
|
||||
"KoZIhvcNAQEEBQADgYEAoarfzXEtw3ZDi4f9U8eSvRIipHSyxOrJC7HR/hM5VhmY\n" +
|
||||
"CErChny6x9lBVg9s57tfD/P9PSzBLusCcHwHMAbMOEcTltVVKUWZnnbumpywlYyg\n" +
|
||||
"oKLrE9+yCOkYUOpiRlz43/3vkEL5hjIKMcDSZnPKBZi1h16Yj2hPe9GMibNip54=\n" +
|
||||
"-----END X509 CRL-----";
|
||||
|
||||
static String subCrlStr =
|
||||
"-----BEGIN X509 CRL-----\n" +
|
||||
"MIIBLTCBlwIBATANBgkqhkiG9w0BAQQFADAxMQswCQYDVQQGEwJVUzEQMA4GA1UE\n" +
|
||||
"ChMHRXhhbXBsZTEQMA4GA1UECxMHQ2xhc3MtMRcNMDkwNDI3MDIzODA0WhcNMjgw\n" +
|
||||
"NjI2MDIzODA0WjAiMCACAQQXDTA5MDQyNzAyMzgwMVowDDAKBgNVHRUEAwoBBKAO\n" +
|
||||
"MAwwCgYDVR0UBAMCAQIwDQYJKoZIhvcNAQEEBQADgYEAeS+POqYEIHIIJcsLxuUr\n" +
|
||||
"aJFzQ/ujH0QmnyMNEL3Uavyq4VQuAahF+w6aTPb5UBzms0uX8NAvD2vNoUJvmJOX\n" +
|
||||
"nGKuq4Q1DFj82E7/9d25nXdWGOmFvFCRVO+St2Xe5n8CJuZNBiz388FDSIOiFSCa\n" +
|
||||
"ARGr6Qu68MYGtLMC6ZqP3u0=\n" +
|
||||
"-----END X509 CRL-----";
|
||||
|
||||
private static final PEMDecoder pemDecoder = PEMDecoder.of();
|
||||
|
||||
private static CertPath generateCertificatePath()
|
||||
throws CertificateException {
|
||||
// generate certificate from cert strings
|
||||
CertificateFactory cf = CertificateFactory.getInstance("X.509");
|
||||
|
||||
Certificate targetCert = pemDecoder.decode(targetCertStr, X509Certificate.class);
|
||||
Certificate subCaCert = pemDecoder.decode(subCaCertStr, X509Certificate.class);
|
||||
Certificate selfSignedCert = pemDecoder.decode(selfSignedCertStr, X509Certificate.class);
|
||||
|
||||
// generate certification path
|
||||
List<Certificate> list = Arrays.asList(targetCert, subCaCert, selfSignedCert);
|
||||
|
||||
return cf.generateCertPath(list);
|
||||
}
|
||||
|
||||
private static Set<TrustAnchor> generateTrustAnchors()
|
||||
throws CertificateException {
|
||||
// generate certificate from cert string
|
||||
final X509Certificate selfSignedCert = pemDecoder.decode(selfSignedCertStr, X509Certificate.class);
|
||||
|
||||
// generate a trust anchor
|
||||
TrustAnchor anchor =
|
||||
new TrustAnchor(selfSignedCert, null);
|
||||
|
||||
return Collections.singleton(anchor);
|
||||
}
|
||||
|
||||
private static CertStore generateCertificateStore() throws Exception {
|
||||
Collection<DEREncodable> entries = new HashSet<>();
|
||||
|
||||
// generate CRL from CRL string
|
||||
CertificateFactory cf = CertificateFactory.getInstance("X.509");
|
||||
|
||||
DEREncodable mixes = pemDecoder.decode(topCrlStr, X509CRL.class);
|
||||
entries.add(mixes);
|
||||
|
||||
mixes = pemDecoder.decode(subCrlStr, X509CRL.class);
|
||||
entries.add(mixes);
|
||||
|
||||
// intermediate certs
|
||||
mixes = pemDecoder.decode(topCrlIssuerCertStr, X509Certificate.class);
|
||||
entries.add(mixes);
|
||||
|
||||
mixes = pemDecoder.decode(subCrlIssuerCertStr, X509Certificate.class);
|
||||
entries.add(mixes);
|
||||
|
||||
return CertStore.getInstance("Collection",
|
||||
new CollectionCertStoreParameters(entries));
|
||||
}
|
||||
|
||||
public static void main(String args[]) throws Exception {
|
||||
// MD5 is used in this test case, don't disable MD5 algorithm.
|
||||
Security.setProperty(
|
||||
"jdk.certpath.disabledAlgorithms", "MD2, RSA keySize < 1024");
|
||||
|
||||
CertPath path = generateCertificatePath();
|
||||
Set<TrustAnchor> anchors = generateTrustAnchors();
|
||||
CertStore crls = generateCertificateStore();
|
||||
|
||||
PKIXParameters params = new PKIXParameters(anchors);
|
||||
|
||||
// add the CRL store
|
||||
params.addCertStore(crls);
|
||||
|
||||
// Activate certificate revocation checking
|
||||
params.setRevocationEnabled(true);
|
||||
|
||||
// set the validation time
|
||||
params.setDate(new Date(109, 5, 1)); // 2009-05-01
|
||||
|
||||
// disable OCSP checker
|
||||
Security.setProperty("ocsp.enable", "false");
|
||||
|
||||
// enable CRL checker
|
||||
System.setProperty("com.sun.security.enableCRLDP", "true");
|
||||
|
||||
CertPathValidator validator = CertPathValidator.getInstance("PKIX");
|
||||
|
||||
try {
|
||||
validator.validate(path, params);
|
||||
throw new Exception("unexpected status, should be REVOKED");
|
||||
} catch (CertPathValidatorException cpve) {
|
||||
if (cpve.getReason() != BasicReason.REVOKED) {
|
||||
throw new Exception(
|
||||
"unexpect exception, should be a REVOKED CPVE", cpve);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
373
test/jdk/java/security/cert/CertPathValidator/indirectCRL/README
Normal file
373
test/jdk/java/security/cert/CertPathValidator/indirectCRL/README
Normal file
|
|
@ -0,0 +1,373 @@
|
|||
/*
|
||||
* Copyright (c) 2009, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
Certificates and CRLs
|
||||
|
||||
Here lists the Certificates and CRLs, which was generated by generate.sh,
|
||||
used in the test cases.
|
||||
|
||||
The generate.sh depends on openssl, and it should be run under ksh. The
|
||||
script will create many directories and files, please run it in a
|
||||
directory outside of JDK workspace.
|
||||
|
||||
1. root certifiate and key
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIICPjCCAaegAwIBAgIBADANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ
|
||||
MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA0MjcwMjI0MzJaFw0zMDA0MDcwMjI0MzJa
|
||||
MB8xCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMIGfMA0GCSqGSIb3DQEB
|
||||
AQUAA4GNADCBiQKBgQC4OTag24sTxL2tXTNuvpmUEtdxrYAZoFsslFQ60T+WD9wQ
|
||||
Jeiw87FSPsR2vxRuv0j8DNm2a4h7LNNIFcLurfNldbz5pvgZ7VqdbbUMPE9qP85n
|
||||
jgDl4woyRTSUeRI4A7O0CO6NpES21dtbdhroWQrEkHxpnrDPxsxrz5gf2m3gqwID
|
||||
AQABo4GJMIGGMB0GA1UdDgQWBBSCJd0hpl5PdAD9IZS+Hzng4lXLGzBHBgNVHSME
|
||||
QDA+gBSCJd0hpl5PdAD9IZS+Hzng4lXLG6EjpCEwHzELMAkGA1UEBhMCVVMxEDAO
|
||||
BgNVBAoTB0V4YW1wbGWCAQAwDwYDVR0TAQH/BAUwAwEB/zALBgNVHQ8EBAMCAgQw
|
||||
DQYJKoZIhvcNAQEEBQADgYEAluy6HIjWcq009lTLmhp+Np6dxU78pInBK8RZkza0
|
||||
484qGaxFGD3UGyZkI5uWmsH2XuMbuox5khfIq6781gmkPBHXBIEtJN8eLusOHEye
|
||||
iE8h7WI+N3qa6Pj56WionMrioqC/3X+b06o147bbhx8U0vkYv/HyPaITOFfMXTdz
|
||||
Vjw=
|
||||
-----END CERTIFICATE-----
|
||||
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
Proc-Type: 4,ENCRYPTED
|
||||
DEK-Info: DES-EDE3-CBC,407A749DF8F6338E
|
||||
|
||||
4ukHU4tkRAh2w17NEjPTICMbVtoS24bNk11Ywd7OzLV0aXnes2nSAV0KnXqnPTP8
|
||||
0VdoMVpp7r/jdaJvd3oL7MF5WcURzcOx2rirg+HeD5lHv0Blrh1FADcI1CQNsi8b
|
||||
WZHVuCc1+feOKxixPB8Fge5lKeeU554iTTk5XjOxAKO6GFn8FInj7b3+Zse4A/1E
|
||||
AOSKVSIWbx71owQyzjrYfoGE/oJVaSRraUbJL4xKcSUYdK+7Qp6h/HI1Cne2DZKu
|
||||
UmApdQnZbxa8hjuLqOiQFu6TVpzJh2UOqu1PEmjJgEM4DQQ9C8AgHdkVYitcLjiI
|
||||
b90H7JFl3EekMbjKEX/w2Z6y4RzFC9oGpJL/QpKvlq6sY7htPd1MK2UbWVE7/yq/
|
||||
holkrvySI1S7BFqKEdIY8Oe0tCNlmELdmL1+yVnQT0LnAX/bkzLNDw1n5J4WpLSX
|
||||
JdsgAXmw1hTh24tnT1E6IUd8HM4QyVrvsqCuEHTSMix1u6QCLvdlw4P6yA39ruiY
|
||||
xbBIcb5PHic0UrcdElRCzXLtW6tRe/98ET7WDEJOLudSUOSG3CKwrEX/kekBqJ11
|
||||
pAO34wLW5gsPwk2AQ1fAaNwHtGBlvKXnmbyuNitytA3/oSENSXnDHD2tIe1Jtep6
|
||||
yrfB9IqYEhINRi9BRR4rCkUwkBSRi4bRI7AzRP8pImG+iCDN6sT7T/mUmTTgFVLX
|
||||
NxPSGxbLxbidxnBU0B2JA3PfXqtt7J2Q5n0t3R3SC3iUxURGOvvccA3TcIWd4H75
|
||||
yQZNzvSIfTG3RhIM0as8/Ahad8hsdE/MqgW50yhzyjNF/UkvFLV8mw==
|
||||
-----END RSA PRIVATE KEY-----
|
||||
|
||||
2. root crl issuer and key
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIICKzCCAZSgAwIBAgIBAjANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ
|
||||
MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA0MjcwMjI0MzNaFw0yOTAxMTIwMjI0MzNa
|
||||
MB8xCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMIGfMA0GCSqGSIb3DQEB
|
||||
AQUAA4GNADCBiQKBgQDMJeBMBybHykI/YpwUJ4O9euqDSLb1kpWpceBS8TVqvgBC
|
||||
SgUJWtFZL0i6bdvF6mMdlbuBkGzhXqHiVAi96/zRLbUC9F8SMEJ6MuD+YhQ0ZFTQ
|
||||
atKy8zf8O9XzztelLJ26Gqb7QPV133WY3haAqHtCXOhEKkCN16NOYNC37DTaJwID
|
||||
AQABo3cwdTAdBgNVHQ4EFgQULXSWzXzUOIpOJpzbSCpW42IJUugwRwYDVR0jBEAw
|
||||
PoAUgiXdIaZeT3QA/SGUvh854OJVyxuhI6QhMB8xCzAJBgNVBAYTAlVTMRAwDgYD
|
||||
VQQKEwdFeGFtcGxlggEAMAsGA1UdDwQEAwIBAjANBgkqhkiG9w0BAQQFAAOBgQAY
|
||||
eMnf5AHSNlyUlzXk8o2S0h4gCuvKX6C3kFfKuZcWvFAbx4yQOWLS2s15/nzR4+AP
|
||||
FGX3lgJjROyAh7fGedTQK+NFWwkM2ag1g3hXktnlnT1qHohi0w31nVBJxXEDO/Ck
|
||||
uJTpJGt8XxxbFaw5v7cHy7XuTAeU/sekvjEiNHW00Q==
|
||||
-----END CERTIFICATE-----
|
||||
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
Proc-Type: 4,ENCRYPTED
|
||||
DEK-Info: DES-EDE3-CBC,96FBBE554515B5A4
|
||||
|
||||
cDfhsWvWCNruFN+9gSWSEz8kffFrqnvp9sxQx2/EwBrC8HNdQQqQqhkcb5moALz0
|
||||
KxAFQMmUG476v1zRv4ZRIpmT9gYhuqSpqKVQLRzFhe9wUDsCOcNCSfqK4I4blt+R
|
||||
gqRF+o97iNun+T2QXvku6B72CgQhJQHrEifoSTSGYpKGIVnhBmBPgadKn864zrv0
|
||||
ZvwjjRtgyC6/QTfKcXTW+8TIa8Bg/821ZJ0FcNsJs+2tQnki/KubRBIo7rGXGcxO
|
||||
f5PtO8BTjsw6G9TMuHKPlozOgGBgkQzf3gNXOLhdjwSDJUlTLLx5ugal+q0VVK7a
|
||||
Np8rK1SLrbC9ReI/VGD8BBW8qHRYhJny2JQ0ub8rXIptILNxH4d8r5ye3NaoskVN
|
||||
S4i5Jr5bgr0ijZ6kdECDiAoUo6UtTX1O9nbZA2AyJLch8gfNs+WeJLDmG9JPGVsW
|
||||
moGPGev1ykTc11Hn8K6S0errWD778B+k0ODLWg3EP8E1GFgdChTdMz2fT+YNrvQ/
|
||||
0iJATduzl4BN9eVB2qnadDAXfWm9kwkaX915ePKU1RpEnU3WygSnze8MfWshVJTn
|
||||
2F/meijLWgqrb4fmyd6KoDeqP5a+ByAPAiw/oAtemWSDviDc6VpXcXCL8dYoIBOV
|
||||
ehg/3Z/DmjfVFHdl5PWQfHiuVbIJbr/soQiTvDsjypYDi/aiY729ils2IxmzIQR8
|
||||
iLhOtBr6yd9qfqQ0761cYrdW5HlsTHOyZFctKxIf98ybzp+bJlskH8ifA1kgNLs3
|
||||
18T2gS+SkKqITi6TmD4Fkob+UtXPyzsb/8g7cNSv82k=
|
||||
-----END RSA PRIVATE KEY-----
|
||||
|
||||
3. root CRL issued by root crl issuer.
|
||||
-----BEGIN X509 CRL-----
|
||||
MIIBGzCBhQIBATANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQMA4GA1UE
|
||||
ChMHRXhhbXBsZRcNMDkwNDI3MDIzODA0WhcNMjgwNjI2MDIzODA0WjAiMCACAQUX
|
||||
DTA5MDQyNzAyMzgwMFowDDAKBgNVHRUEAwoBBKAOMAwwCgYDVR0UBAMCAQIwDQYJ
|
||||
KoZIhvcNAQEEBQADgYEAoarfzXEtw3ZDi4f9U8eSvRIipHSyxOrJC7HR/hM5VhmY
|
||||
CErChny6x9lBVg9s57tfD/P9PSzBLusCcHwHMAbMOEcTltVVKUWZnnbumpywlYyg
|
||||
oKLrE9+yCOkYUOpiRlz43/3vkEL5hjIKMcDSZnPKBZi1h16Yj2hPe9GMibNip54=
|
||||
-----END X509 CRL-----
|
||||
|
||||
4. subca certificate and key
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIICUDCCAbmgAwIBAgIBAzANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ
|
||||
MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA0MjcwMjI0MzRaFw0yOTAxMTIwMjI0MzRa
|
||||
MDExCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMRAwDgYDVQQLEwdDbGFz
|
||||
cy0xMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCiAJnAQW2ad3ZMKUhSJVZj
|
||||
8pBqxTcHSTwAVguQkDglsN/OIwUpvR5Jgp3lpRWUEt6idEp0FZzORpvtjt3pr5MG
|
||||
Eg2CDptekC5BSPS+fIAIKlncB3HwOiFFhH6b3wTydDCdEd2fvsi4QMOSVrIYMeA8
|
||||
P/mCz6kRhfUQPE0CMmOUewIDAQABo4GJMIGGMB0GA1UdDgQWBBT0/nNP8WpyxmYr
|
||||
IBp4tN8y08jw2jBHBgNVHSMEQDA+gBSCJd0hpl5PdAD9IZS+Hzng4lXLG6EjpCEw
|
||||
HzELMAkGA1UEBhMCVVMxEDAOBgNVBAoTB0V4YW1wbGWCAQAwDwYDVR0TAQH/BAUw
|
||||
AwEB/zALBgNVHQ8EBAMCAgQwDQYJKoZIhvcNAQEEBQADgYEAS9PzI6B39R/U9fRj
|
||||
UExzN1FXNP5awnAPtiv34kSCL6n6MryqkfG+8aaAOdZsSjmTylNFaF7cW/Xp1VBF
|
||||
hq0bg/SbEAbK7+UwL8GSC3crhULHLbh+1iFdVTEwxCw5YmB8ji3BaZ/WKW/PkjCZ
|
||||
7cXP6VDeZMG6oRQ4hbOcixoFPXo=
|
||||
-----END CERTIFICATE-----
|
||||
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
Proc-Type: 4,ENCRYPTED
|
||||
DEK-Info: DES-EDE3-CBC,AB196C2474B93EE0
|
||||
|
||||
8S3B4hsTW2OI6CA7bgoou4nt8VQckaRKvC6v+J/gHhnjd9aWnv3wKHhZsQl42+dY
|
||||
HB8DImLTU02gnf3tEGJrTIyrIGrrAjwvio8yzxVqOnNuB6CamlCYx6Td7L09+Wlp
|
||||
8qV1dj+czHhkoH/r0oRHU8NKQMphLQ0kcq3n+hM1UcSzdPxStyIBSRn34dKkuA+t
|
||||
UjKfxbaPMN0dABPesN5emyAUYvVu4qSgDaw4pkqJKk/3+DL6lP3Ih93vTnyx7KU5
|
||||
UexoA9apTDGQuiNbhoKJwOlrG2E7Y57eVOW52b7QPHH8miNCJ5UJALBymPkBc76s
|
||||
D1ioMSdPWfy5C70Hh219oWync3UTToL/Jh1jc0ir5XI5l9lFz/IEA9uhxg137ixB
|
||||
Gj1f2S+eSgnQ3SADVrA5wwX88nrjDufrFpH7ofq947IbI9F6iTMOSqR1uIy0SryW
|
||||
jhB6t/fB0alZceqn8dLAFMV2WvVCGsWx53zcGg09q29FkjpLJpZiI6Bc6EYdk+nn
|
||||
aeGbHLxwKf/vLcD0Oyx4FiJS1vMAEex41eblcwqjiU6vql9LbIFX4hVjGoQ/cL0U
|
||||
bjEZjWlNPAvbBVAlStEXOyZzrrDJUags5gqhdv6VKvzQouwH3+Ivbx7UiSTpJ3If
|
||||
A9txNSVsqc5MTy4hA30RSdMwoP4lK2PrHvivNnZi/kD7Knxn9OuEVBL3KXTmYduQ
|
||||
kDmJzsKWOPvXHEgAZkfXIPKYNT2Z5LuS3yPSlGUcInImBawOkqgs5NJvUTrkbDMk
|
||||
uSrOUFUBdBczU4I5oD1vs9yNhLtaK0S6w3gfiHNpIfg4FIFbdqmnAA==
|
||||
-----END RSA PRIVATE KEY-----
|
||||
|
||||
5. crl issuer of subca, the certificate and key
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIICPTCCAaagAwIBAgIBBDANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ
|
||||
MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA0MjcwMjI0MzRaFw0yOTAxMTIwMjI0MzRa
|
||||
MDExCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMRAwDgYDVQQLEwdDbGFz
|
||||
cy0xMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDWUtDQx2MB/7arDiquMJyd
|
||||
LWwSg6p8sg5z6wKrC1v47MT4DBhFX+0RUgTMUdQgYpgxGpczn+6y4zfV76064S0N
|
||||
4L/IQ+SunTW1w4yRGjB+xkyyJmWAqijG1nr+Dgkv5nxPI+9Er5lHcoVWVMEcvvRm
|
||||
6jIBQdldVlSgv+VgUnFm5wIDAQABo3cwdTAdBgNVHQ4EFgQUkV3Qqtk7gIot9n60
|
||||
jX6dloxrfMEwRwYDVR0jBEAwPoAUgiXdIaZeT3QA/SGUvh854OJVyxuhI6QhMB8x
|
||||
CzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlggEAMAsGA1UdDwQEAwIBAjAN
|
||||
BgkqhkiG9w0BAQQFAAOBgQADu4GM8EdmIKhC7FRvk5jF90zfvZ38wbXBzCjKI4jX
|
||||
QJrhne1bfyeNNm5c1w+VKidT+XzBzBGH7ZqYzoZmzRIfcbLKX2brEBKiukeeAyL3
|
||||
bctQtbp19tX+uu2dQberD188AAysKTkHcJUV+rRsTwVJ9vcYKxoRxKk8DhH7ZS3M
|
||||
rg==
|
||||
-----END CERTIFICATE-----
|
||||
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
Proc-Type: 4,ENCRYPTED
|
||||
DEK-Info: DES-EDE3-CBC,8C523D20E1687EC3
|
||||
|
||||
KdLa0JlKnRDBf/bwtpvmcerBOzJNPidRoIrqDt8fZ5r4WyUWhmBzkNgmBu6KFFPQ
|
||||
4IKK4GW7Oo/D7x1w4hIyDt+JaMSdWWgSyvlIWZ6gSDEsqhzMHQpFNxDet8oD3B6H
|
||||
CMdfXuQ7VHWcYhjX078FNxSRqTQvKR1eAv3AdnXAkuH6Z8V/if1dlQ/yFteSKzCZ
|
||||
Y468leZR14Fl0J8au8LOHxZ6tUBvVXUTo0/FutsfOs9BfLTLkKvLS2pEjMdwnfvS
|
||||
4utV/keK7edAXALfnclAshjYShxgwcyAWszJs9M16k/jqAGdDLAfluoZaznfZ1sc
|
||||
KhAyIKYRo1XivjmTQxvQRwdG+X/w8CYUzawybt8TtXyLyu4cRdEHsEDyjJ5eG9ap
|
||||
+ZDP+djWmrjUPKN5Ahc+Fjtsi6i8PcVFnYTnMAwfjiBd4iU+zJEhne0YUB4QRZee
|
||||
5jdLC8OUfqU0tByj7kDxn6shU2F3r7gIjPqx9DEWGWSf5XDlfk880GGIR67cNEqo
|
||||
lMLP/9/KUEeCwgrvqKdoD/O7qbNlmX7JyGcl/eU2Zsq5P5xkLWenuRHwpJlmV19m
|
||||
2Ovg2gK24okl7FiUgP3vNAzDznqHfyoyoR4noKPwtRANOI3otJxokMFGlgzQAXZB
|
||||
4Eg6M+VLuTxoV14tsSqtkBGNFOUE06n3G5CKuXbh3gXQs0gc8BvzuRMawVSHC144
|
||||
UJM3X73aqSM42lwO2pBjMfxyPdFNkxf3lDuyfMOhGlpDwsny4N4EAOS5ctKNl3Ua
|
||||
oP0BiqyKSuzreg1Ouwq1XxxnWec6XqlHm9482I/vautunqLYQDcfQQ==
|
||||
-----END RSA PRIVATE KEY-----
|
||||
|
||||
6. CLR issued by subca CRL issuer
|
||||
-----BEGIN X509 CRL-----
|
||||
MIIBLTCBlwIBATANBgkqhkiG9w0BAQQFADAxMQswCQYDVQQGEwJVUzEQMA4GA1UE
|
||||
ChMHRXhhbXBsZTEQMA4GA1UECxMHQ2xhc3MtMRcNMDkwNDI3MDIzODA0WhcNMjgw
|
||||
NjI2MDIzODA0WjAiMCACAQQXDTA5MDQyNzAyMzgwMVowDDAKBgNVHRUEAwoBBKAO
|
||||
MAwwCgYDVR0UBAMCAQIwDQYJKoZIhvcNAQEEBQADgYEAeS+POqYEIHIIJcsLxuUr
|
||||
aJFzQ/ujH0QmnyMNEL3Uavyq4VQuAahF+w6aTPb5UBzms0uX8NAvD2vNoUJvmJOX
|
||||
nGKuq4Q1DFj82E7/9d25nXdWGOmFvFCRVO+St2Xe5n8CJuZNBiz388FDSIOiFSCa
|
||||
ARGr6Qu68MYGtLMC6ZqP3u0=
|
||||
-----END X509 CRL-----
|
||||
|
||||
7. dumca certificate and key
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIICUDCCAbmgAwIBAgIBBTANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ
|
||||
MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA0MjcwMjI0MzVaFw0yOTAxMTIwMjI0MzVa
|
||||
MDExCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMRAwDgYDVQQLEwdDbGFz
|
||||
cy1EMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDAwfZ3wIYzdCkiFIKjrUKc
|
||||
0B32HaRkUeVJthadinLmoAVruCi3GRkLZUIPXDD9b7dFBbdeT1+8qDHV5wu/ES8W
|
||||
bgfirO8ng8h2hRuJbZgtfljNnVc3fptjxo7x73aP++w2oIcmjzVwaV08sgahoaY4
|
||||
f249t4EXbvjJQ8kuj1I8qQIDAQABo4GJMIGGMB0GA1UdDgQWBBR3fwdjpP4WiuyL
|
||||
/MDVrXUORrarXDBHBgNVHSMEQDA+gBSCJd0hpl5PdAD9IZS+Hzng4lXLG6EjpCEw
|
||||
HzELMAkGA1UEBhMCVVMxEDAOBgNVBAoTB0V4YW1wbGWCAQAwDwYDVR0TAQH/BAUw
|
||||
AwEB/zALBgNVHQ8EBAMCAgQwDQYJKoZIhvcNAQEEBQADgYEAp/2sXI/XLtXu+X05
|
||||
EISyBPQqdE3kgN3dmXOuoK9J7Io8jhgetdbr9S1WTSGBonaXZgc52FNsaaDU+VIp
|
||||
TGTYU5SFloUyOu/e095eAf9Q867pAPcE5zArfKpXEBLbJwhLFwrsKPk/WZM7Yaxs
|
||||
mihnXyZWWTA1sPZlVJu7/abJ2v0=
|
||||
-----END CERTIFICATE-----
|
||||
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
Proc-Type: 4,ENCRYPTED
|
||||
DEK-Info: DES-EDE3-CBC,8CE4AB01D39EC5B3
|
||||
|
||||
KUkwAyP6ba59QAdDbaXGLmtxtrAilKjFVB+2eawq2Arpumu4cl1joeLtMANF9f1f
|
||||
afG5FDATYke6C0FMD/bfF4VkUcVUq+Daw8uS5LkDTYjRqrxE4nCLBhxDJdNiIhUi
|
||||
VNuTMITqcpOOU77nUu2O5LW9Z40F6H9x86SeHOeY0IrmhlFVgHuxr81jdrd8OLYK
|
||||
7DkKPUa5F331fAkknOQIYnhmCXeHtlTv8ozU5bfBc6TePAL6Y1jn7Hv7EB9C2yYU
|
||||
6qejxzKBgxWWWuYU21K0gayPmq8gAKyfi21xSxFR+a9GxRlf+K/x07i7w7oT6QLh
|
||||
Qft76I+UER2jYYeQm3sxEeLBq9nDb2HfSjOnLjh3J2c5Tp9B2dmLxPk2hHim4cUn
|
||||
nyE8lGDwt/+t6lM8GWfAPn92r2/YOQWr+MXcwE7hi8NZp4cjRR+UqXc0p4+3rKzQ
|
||||
IuD5CGgtx78sxMrAxfwvkedmYpjf9L8nGWdbivOI25mNKSXhEjMNzv+lC6nLQE7o
|
||||
6LLA3voN+SiVh7wu45FMJHsz1JOjUjwYXS931GsHyd/sy9q7wUkzokKc1WHML2vl
|
||||
NglC/4w3NOuEYm5ZDlu6QYQh2uIg/pHPO3am2NTjffjFV0uXEZGd0Qw3gPv9gPNv
|
||||
iMRa+6vQfl97xOYOtep4yp5L7XatoLMrVmboykdrojUuAQSiZgfwIR/f/NPbVvHp
|
||||
q3/fadE2hLpkkSJjPm5ensFXoLn14QTdVpKl3mjnAa0rb8q5edz4d8r644NHaYH0
|
||||
nxToTdZpSH7uGAuOMZwvUaKT//hojKBj6hjlDuVJWs/kwRHbWJEd4A==
|
||||
-----END RSA PRIVATE KEY-----
|
||||
|
||||
8. crl issuer for dumca, the certificate and key
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIICPTCCAaagAwIBAgIBBjANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ
|
||||
MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA0MjcwMjI0MzVaFw0yOTAxMTIwMjI0MzVa
|
||||
MDExCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMRAwDgYDVQQLEwdDbGFz
|
||||
cy1EMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCcDDBVR9IPJq6ND9z3Wpsv
|
||||
s0VfJief2QW6U7fNYAnpD4eXNXdwWtZvybMI12crUp31AWzjIaffsBzlFjBO3vKn
|
||||
edJ+Om2nhqPPT31nDIWIx1VdS7jL+XoFpo8QgzJQpX0rDZNhaTbQcgnuRhzOZ+x2
|
||||
AzxxQf7aMI6YQ5xklO1ftQIDAQABo3cwdTAdBgNVHQ4EFgQUYqt5Hbekj/p4UkfY
|
||||
sP4Ma5HdTpkwRwYDVR0jBEAwPoAUgiXdIaZeT3QA/SGUvh854OJVyxuhI6QhMB8x
|
||||
CzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlggEAMAsGA1UdDwQEAwIBAjAN
|
||||
BgkqhkiG9w0BAQQFAAOBgQAMBqjEfALPFj+asQfTjSqXZimybm5WCYJcv92WAaFm
|
||||
2aJe08jUKCwCVo29CFMMgVG5X0UhEP+ude9RyonYNrMg84hFrQdZSto4Co5yfCGi
|
||||
SMaa91gkN8/W4VKFjDoooOQ/9o6i22OC7av6+r+qhGMsop5mqRMumAM+C00dy1m6
|
||||
5g==
|
||||
-----END CERTIFICATE-----
|
||||
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
Proc-Type: 4,ENCRYPTED
|
||||
DEK-Info: DES-EDE3-CBC,FE34D030ADCF25E5
|
||||
|
||||
V+hWLshb8wbqv8MqBFVZUBK3T995hc6xxWt9wn1aFVcvoxSmWQ20/9LdYDFNhf5j
|
||||
3grRdy6sBmQY1Ch73Q1N8egl0FlqqttBY62ulpVQFCYcYhCSMJKSDJyw5pYlQjd4
|
||||
LpVXhqsTCB1KdeOVkdB45Ljg7wy+idWfo6U0pAPjhnbPysZWuPrIGVIrVfDMz1tw
|
||||
ohuh/NOsF8r2w/U3zBaGKoeW/TGkxXBCKhMU78fve5ytEwv9Gp5m1O5yHJDqNC1M
|
||||
gtAQvvXifeLaCRfOpQtCHGuoR0fhdOnQPJQ/4Nre/dRG8zDVa3FKvWjMPbse4cxJ
|
||||
OljgVyd7UWrnUvnlNufI3T069b6aAfk16eLz9RAJZNZfpXflboRcaHW9VmjU8m7Y
|
||||
ir353hxKQk+P+lU2Ysmu7hx/QKmfG8aKI+r7tXnm1J0dmbeOZE69i4lhvXNvx1N2
|
||||
kPNKXsQ3kMKdJNVg5TQrUaqa7GtdQlg3Nr+FpaZ5aZJhTNFejQZrTV9bnQHob0q2
|
||||
1KCveDPOy2qtRY/mK+BnlNwGx1Ti87iGHv0Om8tXI53G0UkJs3LMI5JPcmHXVC1c
|
||||
skU6nAxhdNPSDN7EBMF80xte99qQTTtDbYQbIqMtd8lCP4HaYhTtlBeaROuntEjx
|
||||
3XDXVIHKHxSsrrKn/dE8Ls7tv1j0XxarzGekhQWZ6xbxxursiMstZUfDeQR7SlwC
|
||||
a3Lem76iGo2BqZd6wbv0i45P2hVQ8DuNhmOphC7DTFQmudOnFJKHPp8pmca+LGfV
|
||||
dgFmct3vSnWjnTvRDktFblfYa0r0QZDSKZt7TiI4QjR5iqP8WEziKA==
|
||||
-----END RSA PRIVATE KEY-----
|
||||
|
||||
9. end entity certificate issued by subca, Alice
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIICNzCCAaCgAwIBAgIBAjANBgkqhkiG9w0BAQQFADAxMQswCQYDVQQGEwJVUzEQ
|
||||
MA4GA1UEChMHRXhhbXBsZTEQMA4GA1UECxMHQ2xhc3MtMTAeFw0wOTA0MjcwMjI0
|
||||
MzZaFw0yOTAxMTIwMjI0MzZaMEExCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFt
|
||||
cGxlMRAwDgYDVQQLEwdDbGFzcy0xMQ4wDAYDVQQDEwVBbGljZTCBnzANBgkqhkiG
|
||||
9w0BAQEFAAOBjQAwgYkCgYEAvYSaU3oiE4Pxp/aUIXwMqOwSiWkZ+O3aTu13hRtK
|
||||
ZyR+Wtj63IuvaigAC4uC+zBypF93ThjwCzVR2qKDQaQzV8CLleO96gStt7Y+i3G2
|
||||
V3IUGgrVCqeK7N6nNYu0wW84sibcPqG/TIy0UoaQMqgB21xtRF+1DUVlFh4Z89X/
|
||||
pskCAwEAAaNPME0wCwYDVR0PBAQDAgPoMB0GA1UdDgQWBBSynMEdcal/e9TmvlNE
|
||||
4suXGA4+hjAfBgNVHSMEGDAWgBT0/nNP8WpyxmYrIBp4tN8y08jw2jANBgkqhkiG
|
||||
9w0BAQQFAAOBgQB/jru7E/+piSmUwByw5qbZsoQZVcgR97pd2TErNJpJMAX2oIHR
|
||||
wJH6w4NuYs27+fEAX7wK4whc6EUH/w1SI6o28F2rG6HqYQPPZ2E2WqwbBQL9nYE3
|
||||
Vfzu/G9axTUQXFbf90h80UErA+mZVxqc2xtymLuH0YEaMZImtRZ2MXHfXg==
|
||||
-----END CERTIFICATE-----
|
||||
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
Proc-Type: 4,ENCRYPTED
|
||||
DEK-Info: DES-EDE3-CBC,3616B3F098ED6707
|
||||
|
||||
uXoAPYIUINSr8Cc67K1XdLPO/toBasXYJAYYodq+qMsqYVhjgUgzJWYBwayav04Y
|
||||
tPgID3f4olLMQP77h5nHLArQCdgI3ZmKDZ6tYR7c2YglTqO1h4pzptv3Csc6lsnr
|
||||
zYS43Wg5YK8lAVxAbaDqG/xRiJhEG6+Xqno/lyDSUcDjcsyULWCf1mUZUR66fpnO
|
||||
Kcvmec3RFS6PPpYKJ/3Hl6Px5TsnSMEgb8OIrLik4Tj08XhdBEZxTJcyA1JPeAUP
|
||||
PH9hm+TWb3E+kDywpItMlTFIhS6b41JGo6Rq6HwVYquCoE4NO32vovd57u5R20yy
|
||||
3mfzc0udAYDD8drnzp2XPridqy47m/zFpVgfYU+irH3uW/n1QSB0w3fdCRXNEl6c
|
||||
5dAAwwIR1Pn+RAVUvZ7sQ/qReSOHg85uH7FjY9+m4d4vtf8aV410pyDbaNnevvfK
|
||||
fTiwmopWujL9sJoZZYP04QZ1f+8aGA41dWS837d9e2F/9BtI5zlymEhLs8UFHziJ
|
||||
Cw41xnOHHaoxtDFSvSmc2G6o0jfwJ0AZf8toyB5kj+rd5iu2Z1Kmk8vd4bK5SCwT
|
||||
dZRLri75Hyns7fLMXuzOrJXLaYkLp7gk2YaN368M7mj2Z7yLBV0CoVopS2tfRVJn
|
||||
fzaxyrkzmZKPKq+m8+UjnlwRW7yR+2RYlFNP3/KemB2i+nXd35f1QCZqb20Lmbbx
|
||||
jDc1CxESY1wzY5oqUGXeFapbM4YKhQQ5BK90AjVfss1ymBT5vhSjoJSIW2yeklcI
|
||||
F/WuQ/CrBlmODbiM2LsQMTSoYcAIOUaRcVh/7kvlOlQ=
|
||||
-----END RSA PRIVATE KEY-----
|
||||
|
||||
10. end entity certificate issued by subca, Bob
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIICNTCCAZ6gAwIBAgIBAzANBgkqhkiG9w0BAQQFADAxMQswCQYDVQQGEwJVUzEQ
|
||||
MA4GA1UEChMHRXhhbXBsZTEQMA4GA1UECxMHQ2xhc3MtMTAeFw0wOTA0MjcwMjI0
|
||||
MzdaFw0yOTAxMTIwMjI0MzdaMD8xCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFt
|
||||
cGxlMRAwDgYDVQQLEwdDbGFzcy0xMQwwCgYDVQQDEwNCb2IwgZ8wDQYJKoZIhvcN
|
||||
AQEBBQADgY0AMIGJAoGBANHxsJI6N5CawwUWJ63i2bvgdHzrsKUeBs7CXEIovPll
|
||||
+utfqwJGGkkiW9FVxQ2NQfMoHKdSrbLQaZ4I6U75yh40ZiSgSCELzlW8JC48kX7u
|
||||
txYJzszjT6lATW+mRdMoO0guxAS4NcldoFHZ0nLkAvhRRpZgdS+wdc0LODxeplqT
|
||||
AgMBAAGjTzBNMAsGA1UdDwQEAwID6DAdBgNVHQ4EFgQU2yqQyfYTig4K30lCbEsR
|
||||
rSrhM6UwHwYDVR0jBBgwFoAU9P5zT/FqcsZmKyAaeLTfMtPI8NowDQYJKoZIhvcN
|
||||
AQEEBQADgYEAn6j1wY0G5dieYdwUBAJuh6zP1Cu+J12NgdetHAaN6Q3tP339ToCi
|
||||
C2NQYvFSwOZ7CKf2ofQq5qWA4EFd7PNxpYaVjhhxzkeQRuv/r/sA3rH+01MPx5ob
|
||||
N1wXY5QmBOuHJIKroNH60u9GzOIGIANZuYWsluw4spWRpvOdqudJWlg=
|
||||
-----END CERTIFICATE-----
|
||||
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
Proc-Type: 4,ENCRYPTED
|
||||
DEK-Info: DES-EDE3-CBC,3DD8B45BA8A57B72
|
||||
|
||||
cC15d0phhzxu+Y3FMLu22WejN0JEVGCD0Qbwz73+ahVCqivd7aaipXfnuyuIJW12
|
||||
ZHKR0ixZUwezRqqM0/D4vKyFR9giJ14A5Tk7RFzimm0JqdJYRXrmVEp+QdVYbJFC
|
||||
5ncmU/KCAJcHwewixbjo5pkrWNDpIWeIqI8F6rvY1MLSMCCwYfr+1SP5U6AB3+1T
|
||||
yySvWwK+TIAgVMNjhDKlJ78BxQ3C/AMw5grAU0t2jmuuuXJPML72mQ95ZBgcJsRF
|
||||
S0walZGZlK+p9S/b4EVzO+oaR1icazH1WJTyuzKOOurlFjFk3tmsnhNuWQTkNjgV
|
||||
wKODHLA8E8tBajYAYmkQX+uQOmol9LXSOrQFrxvHF3dWC5giOtPYeh9ibEFx+RMu
|
||||
2EmkF/9VFxzh+kK9KL2qplm4K3HoL/v9g/LlKowjQlr7LoJRCRDOmESCUWX0JPPB
|
||||
nD01HvyRjgpUAeKtxR3hjH3CrUM1rdLAJaFi1RzgjvXeXhX5stD3X6UCWFbeBBh1
|
||||
yic4RIGYWjqE7RJRd/Q+/11rCkONg9stYcpe1PL5fJWSC8Sixo6XQTQDbxOJBQbr
|
||||
gCoUFfCcN8nOYdSe2wWrE/l7r/mRFYbwlErlpomSaxye5yzXhombnZ2k4jNKylEp
|
||||
TMsvFtVXFyoLWFqhtrv/Sg+0zDox1HMx+qzePYsz9+/rrS7ej6b5c8r6yqmg7nHn
|
||||
XM4REA46bWcAVjkLNpNZU4i0iURrkjuK0uVFYfnFIxrvGLys8dzH+xAfAHcP0zZ3
|
||||
/K54gAGk4ZVVXOt8JKOVxAOj2+8f0Gbf28leRx/VOJlEZBpU6UVg4g==
|
||||
-----END RSA PRIVATE KEY-----
|
||||
|
||||
10. end entity certificate issued by subca, Susan
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIICNzCCAaCgAwIBAgIBBDANBgkqhkiG9w0BAQQFADAxMQswCQYDVQQGEwJVUzEQ
|
||||
MA4GA1UEChMHRXhhbXBsZTEQMA4GA1UECxMHQ2xhc3MtMTAeFw0wOTA0MjcwMjI0
|
||||
MzhaFw0yOTAxMTIwMjI0MzhaMEExCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFt
|
||||
cGxlMRAwDgYDVQQLEwdDbGFzcy0xMQ4wDAYDVQQDEwVTdXNhbjCBnzANBgkqhkiG
|
||||
9w0BAQEFAAOBjQAwgYkCgYEAyPKlfep+EIIUOpZF3xtYUhAx79qEqe2RPRcH2YeR
|
||||
1ogM8+AZMdcXoiuDl4CFLzQwRv1DSKUZAPdPbROLVDsUn+IGvgn2jnE7ZQEUtQQJ
|
||||
+rorcasE7bo5MBPuno/0oQRi/4MZn6lX3qB13ZUHAvZH96oCF6C3Ro19LAwav1Lo
|
||||
FRcCAwEAAaNPME0wCwYDVR0PBAQDAgPoMB0GA1UdDgQWBBTCUH1tqQk96Pocr8Is
|
||||
tDKMoIRQljAfBgNVHSMEGDAWgBT0/nNP8WpyxmYrIBp4tN8y08jw2jANBgkqhkiG
|
||||
9w0BAQQFAAOBgQB3YXuTA+QfaImQ2aN/e27Nv5a/FMml6y6t0+pzt5hUYG2W0C2f
|
||||
5Hdmf3whNCA7zE5RVDQP0iuGBPgjvrABuN98Vimv2eTV+N5aYTak0Aav/OuR5Lpi
|
||||
tYhXMMg5gSmT+JDARba4CX+Ap1oAaNe9Mtv8L6FWdvBqfzzifDHWavdIWA==
|
||||
-----END CERTIFICATE-----
|
||||
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
Proc-Type: 4,ENCRYPTED
|
||||
DEK-Info: DES-EDE3-CBC,A03CB9ABBA747E7A
|
||||
|
||||
YhChWe6DOA1Ck5BAjWrHmPkHcS9x5pDw81p31gSf7SE9MCwfsvAIq9jZ7xol3cIJ
|
||||
5dhbXtBaJIRghke11McQ6zM2DE+9izCO4itedw94i95jSzgpEHTk6gwp9MuomSsm
|
||||
ytrqIhwEtVC8PaQmywqshKWnpDn3tZESwySNZjUjzHhyzn2Vuyrb0WaHmw3uk33O
|
||||
7muGNkmn/1yP1qRyJ3YSGcMNpk2zvJDZS5CfJH9sb00+LL4PTKg4dymw4Vjk7b5f
|
||||
P5JGLbFCBbQ73CwSNLsQGV4qGz7AnRhsmPmNughshOoLKSEAxUsRHE67qyl+Flx0
|
||||
KZEGeKZUJD9fzgMMdNoYk0Pg9zxzM1oNewxsFk2tTrtMfGq+XFokWKfJoQWguStY
|
||||
BJWETGrSbXiDMIE93gX40C2zlT06ziOYfFCXeVRcBarolonTrOXt3RZzsQpY4lTz
|
||||
AAGrb2I9ZByL59ujfniTqljtBpuCKAm+jS0ofcGlQQ0MawtSOeSbQkFKHcKpcK0V
|
||||
cKMFL3sEzeJf+1LCt7Xnt4gaoXtTpVoWVWFZkghDSmIAHzKaWHAHn5PcUjwAAZHb
|
||||
47IRq+pe1WLc+tb61+E2jkhFC06QOSxmWSV3CHfMZTxkXX7B7RCiqs+tVH5Vlj/C
|
||||
ZhkSfmANUVPW1H0KXsDq6lzrEnvaZXZIzTLvj+OsLcG1anXdwPn0NPikfRU0GTvA
|
||||
fCzg7ZWlexJgl5I48X7AzpHpTPGAHGeNpYjzGWbxmC0KREcAM0yD15uFVac/ZIVI
|
||||
TO0icmSiRoshC70zo9/u2hUP1e4+s1vl0laq0WjGfFORE1JZ1Cs2Dg==
|
||||
-----END RSA PRIVATE KEY-----
|
||||
|
||||
|
|
@ -0,0 +1,219 @@
|
|||
#
|
||||
# Copyright (c) 2009, 2013, Oracle and/or its affiliates. All rights reserved.
|
||||
# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
#
|
||||
# This code is free software; you can redistribute it and/or modify it
|
||||
# under the terms of the GNU General Public License version 2 only, as
|
||||
# published by the Free Software Foundation.
|
||||
#
|
||||
# This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
# FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
# version 2 for more details (a copy is included in the LICENSE file that
|
||||
# accompanied this code).
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License version
|
||||
# 2 along with this work; if not, write to the Free Software Foundation,
|
||||
# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
#
|
||||
# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
# or visit www.oracle.com if you need additional information or have any
|
||||
# questions.
|
||||
#
|
||||
|
||||
#!/bin/ksh
|
||||
#
|
||||
# needs ksh to run the script.
|
||||
|
||||
# generate a self-signed root certificate
|
||||
if [ ! -f root/root_cert.pem ]; then
|
||||
if [ ! -d root ]; then
|
||||
mkdir root
|
||||
fi
|
||||
|
||||
openssl req -x509 -newkey rsa:1024 -keyout root/root_key.pem \
|
||||
-out root/root_cert.pem -subj "/C=US/O=Example" \
|
||||
-config openssl.cnf -reqexts cert_issuer -days 7650 \
|
||||
-passin pass:passphrase -passout pass:passphrase
|
||||
fi
|
||||
|
||||
# generate a sele-issued root crl issuer certificate
|
||||
if [ ! -f root/top_crlissuer_cert.pem ]; then
|
||||
if [ ! -d root ]; then
|
||||
mkdir root
|
||||
fi
|
||||
|
||||
openssl req -newkey rsa:1024 -keyout root/top_crlissuer_key.pem \
|
||||
-out root/top_crlissuer_req.pem -subj "/C=US/O=Example" -days 7650 \
|
||||
-passin pass:passphrase -passout pass:passphrase
|
||||
|
||||
openssl x509 -req -in root/top_crlissuer_req.pem -extfile openssl.cnf \
|
||||
-extensions crl_issuer -CA root/root_cert.pem \
|
||||
-CAkey root/root_key.pem -out root/top_crlissuer_cert.pem \
|
||||
-CAcreateserial -CAserial root/root_cert.srl -days 7200 \
|
||||
-passin pass:passphrase
|
||||
fi
|
||||
|
||||
# generate subca cert issuer and crl iuuser certificates
|
||||
if [ ! -f subca/subca_cert.pem ]; then
|
||||
if [ ! -d subca ]; then
|
||||
mkdir subca
|
||||
fi
|
||||
|
||||
openssl req -newkey rsa:1024 -keyout subca/subca_key.pem \
|
||||
-out subca/subca_req.pem -subj "/C=US/O=Example/OU=Class-1" \
|
||||
-days 7650 -passin pass:passphrase -passout pass:passphrase
|
||||
|
||||
openssl x509 -req -in subca/subca_req.pem -extfile openssl.cnf \
|
||||
-extensions cert_issuer -CA root/root_cert.pem \
|
||||
-CAkey root/root_key.pem -out subca/subca_cert.pem -CAcreateserial \
|
||||
-CAserial root/root_cert.srl -days 7200 -passin pass:passphrase
|
||||
|
||||
openssl req -newkey rsa:1024 -keyout subca/subca_crlissuer_key.pem \
|
||||
-out subca/subca_crlissuer_req.pem -subj "/C=US/O=Example/OU=Class-1" \
|
||||
-days 7650 -passin pass:passphrase -passout pass:passphrase
|
||||
|
||||
openssl x509 -req -in subca/subca_crlissuer_req.pem -extfile openssl.cnf \
|
||||
-extensions crl_issuer -CA root/root_cert.pem \
|
||||
-CAkey root/root_key.pem -out subca/subca_crlissuer_cert.pem \
|
||||
-CAcreateserial -CAserial root/root_cert.srl -days 7200 \
|
||||
-passin pass:passphrase
|
||||
fi
|
||||
|
||||
# generate dumca cert issuer and crl iuuser certificates
|
||||
if [ ! -f dumca/dumca_cert.pem ]; then
|
||||
if [ ! -d sumca ]; then
|
||||
mkdir dumca
|
||||
fi
|
||||
|
||||
openssl req -newkey rsa:1024 -keyout dumca/dumca_key.pem \
|
||||
-out dumca/dumca_req.pem -subj "/C=US/O=Example/OU=Class-D" \
|
||||
-days 7650 -passin pass:passphrase -passout pass:passphrase
|
||||
|
||||
openssl x509 -req -in dumca/dumca_req.pem -extfile openssl.cnf \
|
||||
-extensions cert_issuer -CA root/root_cert.pem \
|
||||
-CAkey root/root_key.pem -out dumca/dumca_cert.pem \
|
||||
-CAcreateserial -CAserial root/root_cert.srl -days 7200 \
|
||||
-passin pass:passphrase
|
||||
|
||||
openssl req -newkey rsa:1024 -keyout dumca/dumca_crlissuer_key.pem \
|
||||
-out dumca/dumca_crlissuer_req.pem -subj "/C=US/O=Example/OU=Class-D" \
|
||||
-days 7650 -passin pass:passphrase -passout pass:passphrase
|
||||
|
||||
openssl x509 -req -in dumca/dumca_crlissuer_req.pem \
|
||||
-extfile openssl.cnf -extensions crl_issuer -CA root/root_cert.pem \
|
||||
-CAkey root/root_key.pem -out dumca/dumca_crlissuer_cert.pem \
|
||||
-CAcreateserial -CAserial root/root_cert.srl -days 7200 \
|
||||
-passin pass:passphrase
|
||||
fi
|
||||
|
||||
# generate certifiacte for Alice
|
||||
if [ ! -f subca/alice/alice_cert.pem ]; then
|
||||
if [ ! -d subca/alice ]; then
|
||||
mkdir -p subca/alice
|
||||
fi
|
||||
|
||||
openssl req -newkey rsa:1024 -keyout subca/alice/alice_key.pem \
|
||||
-out subca/alice/alice_req.pem \
|
||||
-subj "/C=US/O=Example/OU=Class-1/CN=Alice" -days 7650 \
|
||||
-passin pass:passphrase -passout pass:passphrase
|
||||
|
||||
openssl x509 -req -in subca/alice/alice_req.pem \
|
||||
-extfile openssl.cnf -extensions ee_of_subca \
|
||||
-CA subca/subca_cert.pem -CAkey subca/subca_key.pem \
|
||||
-out subca/alice/alice_cert.pem -CAcreateserial \
|
||||
-CAserial subca/subca_cert.srl -days 7200 -passin pass:passphrase
|
||||
fi
|
||||
|
||||
# generate certifiacte for Bob
|
||||
if [ ! -f subca/bob/bob_cert.pem ]; then
|
||||
if [ ! -d subca/bob ]; then
|
||||
mkdir -p subca/bob
|
||||
fi
|
||||
|
||||
openssl req -newkey rsa:1024 -keyout subca/bob/bob_key.pem \
|
||||
-out subca/bob/bob_req.pem \
|
||||
-subj "/C=US/O=Example/OU=Class-1/CN=Bob" -days 7650 \
|
||||
-passin pass:passphrase -passout pass:passphrase
|
||||
|
||||
openssl x509 -req -in subca/bob/bob_req.pem \
|
||||
-extfile openssl.cnf -extensions ee_of_subca \
|
||||
-CA subca/subca_cert.pem -CAkey subca/subca_key.pem \
|
||||
-out subca/bob/bob_cert.pem -CAcreateserial \
|
||||
-CAserial subca/subca_cert.srl -days 7200 -passin pass:passphrase
|
||||
fi
|
||||
|
||||
# generate certifiacte for Susan
|
||||
if [ ! -f subca/susan/susan_cert.pem ]; then
|
||||
if [ ! -d subca/susan ]; then
|
||||
mkdir -p subca/susan
|
||||
fi
|
||||
|
||||
openssl req -newkey rsa:1024 -keyout subca/susan/susan_key.pem \
|
||||
-out subca/susan/susan_req.pem \
|
||||
-subj "/C=US/O=Example/OU=Class-1/CN=Susan" -days 7650 \
|
||||
-passin pass:passphrase -passout pass:passphrase
|
||||
|
||||
openssl x509 -req -in subca/susan/susan_req.pem -extfile openssl.cnf \
|
||||
-extensions ee_of_subca -CA subca/subca_cert.pem \
|
||||
-CAkey subca/subca_key.pem -out subca/susan/susan_cert.pem \
|
||||
-CAcreateserial -CAserial subca/subca_cert.srl -days 7200 \
|
||||
-passin pass:passphrase
|
||||
fi
|
||||
|
||||
|
||||
# generate the top CRL
|
||||
if [ ! -f root/top_crl.pem ]; then
|
||||
if [ ! -d root ]; then
|
||||
mkdir root
|
||||
fi
|
||||
|
||||
if [ ! -f root/index.txt ]; then
|
||||
touch root/index.txt
|
||||
echo 00 > root/crlnumber
|
||||
fi
|
||||
|
||||
openssl ca -gencrl -config openssl.cnf -name ca_top -crldays 7000 \
|
||||
-crl_reason superseded -keyfile root/top_crlissuer_key.pem \
|
||||
-cert root/top_crlissuer_cert.pem -out root/top_crl.pem \
|
||||
-passin pass:passphrase
|
||||
fi
|
||||
|
||||
# revoke dumca
|
||||
openssl ca -revoke dumca/dumca_cert.pem -config openssl.cnf \
|
||||
-name ca_top -crl_reason superseded \
|
||||
-keyfile root/top_crlissuer_key.pem -cert root/top_crlissuer_cert.pem \
|
||||
-passin pass:passphrase
|
||||
|
||||
openssl ca -gencrl -config openssl.cnf -name ca_top -crldays 7000 \
|
||||
-crl_reason superseded -keyfile root/top_crlissuer_key.pem \
|
||||
-cert root/top_crlissuer_cert.pem -out root/top_crl.pem \
|
||||
-passin pass:passphrase
|
||||
|
||||
# revoke for subca
|
||||
if [ ! -f subca/subca_crl.pem ]; then
|
||||
if [ ! -d subca ]; then
|
||||
mkdir subca
|
||||
fi
|
||||
|
||||
if [ ! -f subca/index.txt ]; then
|
||||
touch subca/index.txt
|
||||
echo 00 > subca/crlnumber
|
||||
fi
|
||||
|
||||
openssl ca -gencrl -config openssl.cnf -name ca_subca -crldays 7000 \
|
||||
-crl_reason superseded -keyfile subca/subca_crlissuer_key.pem \
|
||||
-cert subca/subca_crlissuer_cert.pem -out subca/subca_crl.pem \
|
||||
-passin pass:passphrase
|
||||
fi
|
||||
|
||||
# revoke susan
|
||||
openssl ca -revoke subca/susan/susan_cert.pem -config openssl.cnf \
|
||||
-name ca_subca -crl_reason superseded \
|
||||
-keyfile subca/subca_crlissuer_key.pem \
|
||||
-cert subca/subca_crlissuer_cert.pem -passin pass:passphrase
|
||||
|
||||
openssl ca -gencrl -config openssl.cnf -name ca_subca -crldays 7000 \
|
||||
-crl_reason superseded -keyfile subca/subca_crlissuer_key.pem \
|
||||
-cert subca/subca_crlissuer_cert.pem -out subca/subca_crl.pem \
|
||||
-passin pass:passphrase
|
||||
|
|
@ -0,0 +1,204 @@
|
|||
#
|
||||
# Copyright (c) 2009, Oracle and/or its affiliates. All rights reserved.
|
||||
# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
#
|
||||
# This code is free software; you can redistribute it and/or modify it
|
||||
# under the terms of the GNU General Public License version 2 only, as
|
||||
# published by the Free Software Foundation.
|
||||
#
|
||||
# This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
# FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
# version 2 for more details (a copy is included in the LICENSE file that
|
||||
# accompanied this code).
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License version
|
||||
# 2 along with this work; if not, write to the Free Software Foundation,
|
||||
# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
#
|
||||
# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
# or visit www.oracle.com if you need additional information or have any
|
||||
# questions.
|
||||
#
|
||||
|
||||
#
|
||||
# OpenSSL configuration file.
|
||||
#
|
||||
|
||||
HOME = .
|
||||
RANDFILE = $ENV::HOME/.rnd
|
||||
|
||||
[ ca ]
|
||||
default_ca = CA_default
|
||||
|
||||
[ CA_default ]
|
||||
dir = ./top
|
||||
certs = $dir/certs
|
||||
crl_dir = $dir/crl
|
||||
database = $dir/index.txt
|
||||
unique_subject = no
|
||||
new_certs_dir = $dir/newcerts
|
||||
certificate = $dir/cacert.pem
|
||||
serial = $dir/serial
|
||||
crlnumber = $dir/crlnumber
|
||||
crl = $dir/crl.pem
|
||||
private_key = $dir/private/cakey.pem
|
||||
RANDFILE = $dir/private/.rand
|
||||
x509_extensions = v3_ca
|
||||
|
||||
name_opt = ca_default
|
||||
cert_opt = ca_default
|
||||
|
||||
default_days = 7650
|
||||
default_crl_days = 30
|
||||
default_md = sha1
|
||||
preserve = no
|
||||
|
||||
policy = policy_anything
|
||||
|
||||
[ ca_top ]
|
||||
dir = ./root
|
||||
certs = $dir/certs
|
||||
crl_dir = $dir/crl
|
||||
database = $dir/index.txt
|
||||
unique_subject = no
|
||||
new_certs_dir = $dir/newcerts
|
||||
certificate = $dir/cacert.pem
|
||||
serial = $dir/serial
|
||||
crlnumber = $dir/crlnumber
|
||||
crl = $dir/crl.pem
|
||||
private_key = $dir/private/cakey.pem
|
||||
RANDFILE = $dir/private/.rand
|
||||
|
||||
x509_extensions = v3_ca
|
||||
|
||||
name_opt = ca_default
|
||||
cert_opt = ca_default
|
||||
|
||||
default_days = 7650
|
||||
default_crl_days = 30
|
||||
default_md = sha1
|
||||
preserve = no
|
||||
|
||||
policy = policy_anything
|
||||
|
||||
[ ca_subca ]
|
||||
dir = ./subca
|
||||
certs = $dir/certs
|
||||
crl_dir = $dir/crl
|
||||
database = $dir/index.txt
|
||||
unique_subject = no
|
||||
new_certs_dir = $dir/newcerts
|
||||
|
||||
certificate = $dir/cacert.pem
|
||||
serial = $dir/serial
|
||||
crlnumber = $dir/crlnumber
|
||||
crl = $dir/crl.pem
|
||||
private_key = $dir/private/cakey.pem
|
||||
RANDFILE = $dir/private/.rand
|
||||
|
||||
x509_extensions = usr_cert
|
||||
|
||||
name_opt = ca_default
|
||||
cert_opt = ca_default
|
||||
|
||||
default_days = 7650
|
||||
default_crl_days = 30
|
||||
default_md = sha1
|
||||
preserve = no
|
||||
|
||||
policy = policy_anything
|
||||
|
||||
[ policy_match ]
|
||||
countryName = match
|
||||
stateOrProvinceName = match
|
||||
organizationName = match
|
||||
organizationalUnitName = optional
|
||||
commonName = supplied
|
||||
emailAddress = optional
|
||||
|
||||
[ policy_anything ]
|
||||
countryName = optional
|
||||
stateOrProvinceName = optional
|
||||
localityName = optional
|
||||
organizationName = optional
|
||||
organizationalUnitName = optional
|
||||
commonName = supplied
|
||||
emailAddress = optional
|
||||
|
||||
[ req ]
|
||||
default_bits = 1024
|
||||
default_keyfile = privkey.pem
|
||||
distinguished_name = req_distinguished_name
|
||||
attributes = req_attributes
|
||||
x509_extensions = v3_ca
|
||||
|
||||
string_mask = nombstr
|
||||
|
||||
[ req_distinguished_name ]
|
||||
countryName = Country Name (2 letter code)
|
||||
countryName_default = NO
|
||||
countryName_min = 2
|
||||
countryName_max = 2
|
||||
|
||||
stateOrProvinceName = State or Province Name (full name)
|
||||
stateOrProvinceName_default = A-State
|
||||
|
||||
localityName = Locality Name (eg, city)
|
||||
|
||||
0.organizationName = Organization Name (eg, company)
|
||||
0.organizationName_default = Internet Widgits Pty Ltd
|
||||
|
||||
organizationalUnitName = Organizational Unit Name (eg, section)
|
||||
|
||||
commonName = Common Name (eg, YOUR name)
|
||||
commonName_max = 64
|
||||
|
||||
emailAddress = Email Address
|
||||
emailAddress_max = 64
|
||||
|
||||
[ req_attributes ]
|
||||
challengePassword = A challenge password
|
||||
challengePassword_min = 4
|
||||
challengePassword_max = 20
|
||||
unstructuredName = An optional company name
|
||||
|
||||
|
||||
[ usr_cert ]
|
||||
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
||||
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid,issuer
|
||||
|
||||
[ v3_req ]
|
||||
basicConstraints = CA:FALSE
|
||||
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
||||
subjectAltName = email:example@openjdk.net, RID:1.2.3.4:true
|
||||
|
||||
[ v3_ca ]
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid:always,issuer:always
|
||||
basicConstraints = critical,CA:true
|
||||
keyUsage = keyCertSign
|
||||
|
||||
[ cert_issuer ]
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid:always,issuer:always
|
||||
basicConstraints = critical,CA:true
|
||||
keyUsage = keyCertSign
|
||||
|
||||
|
||||
[ crl_issuer ]
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid:always,issuer:always
|
||||
keyUsage = cRLSign
|
||||
|
||||
|
||||
[ crl_ext ]
|
||||
authorityKeyIdentifier = keyid:always,issuer:always
|
||||
|
||||
[ ee_of_subca ]
|
||||
keyUsage = nonRepudiation, digitalSignature, keyEncipherment, keyAgreement
|
||||
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid,issuer
|
||||
|
|
@ -0,0 +1,155 @@
|
|||
/*
|
||||
* Copyright (c) 2009, 2025, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
/**
|
||||
* @test
|
||||
*
|
||||
* @bug 6845286
|
||||
* @summary Add regression test for name constraints
|
||||
* @enablePreview
|
||||
* @author Xuelei Fan
|
||||
*/
|
||||
|
||||
import java.io.*;
|
||||
import java.net.SocketException;
|
||||
import java.security.PEMDecoder;
|
||||
import java.util.*;
|
||||
import java.security.Security;
|
||||
import java.security.cert.*;
|
||||
import java.security.cert.CertPathValidatorException.BasicReason;
|
||||
|
||||
public class NameConstraintsWithRID {
|
||||
|
||||
static String selfSignedCertStr =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIICTjCCAbegAwIBAgIJAIoSzC1A/k4vMA0GCSqGSIb3DQEBBQUAMB8xCzAJBgNV\n" +
|
||||
"BAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMB4XDTA5MDUwNzA5MjcxMloXDTMwMDQx\n" +
|
||||
"NzA5MjcxMlowHzELMAkGA1UEBhMCVVMxEDAOBgNVBAoTB0V4YW1wbGUwgZ8wDQYJ\n" +
|
||||
"KoZIhvcNAQEBBQADgY0AMIGJAoGBANXzlv5Fn2cdgBRdEK/37/o8rqQXIRIMZqX6\n" +
|
||||
"BPuo46Cdhctv+n3hu5bj/PwgJVbAJcqcQfDudSSF5gwGlRqDX9vekPSS47XZXjOZ\n" +
|
||||
"qFcnDoWP0gSQXLYVVtjuItkecTrPyUE5v2lRIAh13MGKOSh3ZsrtFvj7Y5d9EqIP\n" +
|
||||
"SLxWWPuHAgMBAAGjgZEwgY4wHQYDVR0OBBYEFFydJvQMB2j4EDHW2bQabNsPUvDt\n" +
|
||||
"ME8GA1UdIwRIMEaAFFydJvQMB2j4EDHW2bQabNsPUvDtoSOkITAfMQswCQYDVQQG\n" +
|
||||
"EwJVUzEQMA4GA1UEChMHRXhhbXBsZYIJAIoSzC1A/k4vMA8GA1UdEwEB/wQFMAMB\n" +
|
||||
"Af8wCwYDVR0PBAQDAgIEMA0GCSqGSIb3DQEBBQUAA4GBAHgoopmZ1Q4qXhMDbbYQ\n" +
|
||||
"YCi4Cg6cXPFblx5gzhWu/6l9SkvZbAZiLszgyMq5dGj9WyTtibNEp232dQsKTFu7\n" +
|
||||
"3ag0DiFqoQ8btgvbwBlzhnRagoeVFjhuBBQutOScw7x8NCSBkZQow+31127mwu3y\n" +
|
||||
"YGYhEmI2dNmgbv1hVYTGmLXW\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
static String subCaCertStr =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIICdTCCAd6gAwIBAgIJAL+MYVyy7k5YMA0GCSqGSIb3DQEBBQUAMB8xCzAJBgNV\n" +
|
||||
"BAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMB4XDTA5MDUwNzA5MjcxNFoXDTI5MDEy\n" +
|
||||
"MjA5MjcxNFowMTELMAkGA1UEBhMCVVMxEDAOBgNVBAoTB0V4YW1wbGUxEDAOBgNV\n" +
|
||||
"BAsTB0NsYXNzLTEwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAM2mwX8dhP3M\n" +
|
||||
"i6ATRsd0wco+c7rsyEbP0CRQunVIP8/kOL8+zyQix+QZquY23tvBCbia424GXDkT\n" +
|
||||
"irvK/M4yGzrdS51hA5dlH3SHY3CWOAqEPqKtNLn1My4MWtTiUWbHi0YjFuOv0BXz\n" +
|
||||
"x9lTEfMf+3QcOgO5FitcqHIMP4jIlT+lAgMBAAGjgaYwgaMwHQYDVR0OBBYEFJHg\n" +
|
||||
"eyEWcjxcAwc01BPQrau/4HJaME8GA1UdIwRIMEaAFFydJvQMB2j4EDHW2bQabNsP\n" +
|
||||
"UvDtoSOkITAfMQswCQYDVQQGEwJVUzEQMA4GA1UEChMHRXhhbXBsZYIJAIoSzC1A\n" +
|
||||
"/k4vMA8GA1UdEwEB/wQFMAMBAf8wCwYDVR0PBAQDAgIEMBMGA1UdHgQMMAqhCDAG\n" +
|
||||
"iAQqAwQFMA0GCSqGSIb3DQEBBQUAA4GBAI3CDQWZiTlVVVqfCiZwc/yIL7G5bu2g\n" +
|
||||
"ccgVz9PyKfTpq8vk59S23TvPwdPt4ZVx4RSoar9ONtbrcLxfP3X6WQ7e9popWNZV\n" +
|
||||
"q49YfyU1tD5HFuxj7CAsvfykuRo4ovXaTCVWlTMi7fJJdzU0Eb4xkXXhiWT/RbHG\n" +
|
||||
"R7J+8ROMZ+nR\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
static String targetCertStr =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIICUDCCAbmgAwIBAgIJAOA8c10w019XMA0GCSqGSIb3DQEBBQUAMDExCzAJBgNV\n" +
|
||||
"BAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMRAwDgYDVQQLEwdDbGFzcy0xMB4XDTA5\n" +
|
||||
"MDUwNzEwMjY0M1oXDTI5MDEyMjEwMjY0M1owQTELMAkGA1UEBhMCVVMxEDAOBgNV\n" +
|
||||
"BAoTB0V4YW1wbGUxEDAOBgNVBAsTB0NsYXNzLTExDjAMBgNVBAMTBVN1c2FuMIGf\n" +
|
||||
"MA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDlmyS8SskMX3mreD95oBaXUGNvPTK0\n" +
|
||||
"39IBdxle2TpJEBL/BcS4QUb2+67WjrXhUZWFtpc4RzywfvSSxZH2wbwDDJPs56OC\n" +
|
||||
"Eczsdnqe7gOroYm2TMfY0/pItgP3mRkhJpxAWFc/y7Qr8jJbPmKfiYbYROp1eR2t\n" +
|
||||
"BrjUiUTrAtM7GwIDAQABo2AwXjALBgNVHQ8EBAMCA+gwDwYDVR0RBAgwBogEKgME\n" +
|
||||
"BTAdBgNVHQ4EFgQUyqtfkWtPah5J658LHN8CEGIgAbgwHwYDVR0jBBgwFoAUkeB7\n" +
|
||||
"IRZyPFwDBzTUE9Ctq7/gclowDQYJKoZIhvcNAQEFBQADgYEAnwaLBteuJhXF56Rg\n" +
|
||||
"l8FIEzgJtT4yu/8WsYjhN6/aLGkgJ37VavWdhjwXIb1RVJE/ab3hTbWF5ht7jMcQ\n" +
|
||||
"/WnD8R8CpwEEX/n2wpb3zMHZ8zT7k0mWYm10mPHw1psjOUvJd/zB4gT4tc2A2soM\n" +
|
||||
"FbcNIaCtg8blO5ImdOz5hAi+NuY=\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
private static final PEMDecoder PEM_DECODER = PEMDecoder.of();
|
||||
|
||||
private static CertPath generateCertificatePath()
|
||||
throws CertificateException {
|
||||
// generate certificate from cert strings
|
||||
CertificateFactory cf = CertificateFactory.getInstance("X.509");
|
||||
|
||||
Certificate targetCert = PEM_DECODER.decode(targetCertStr, X509Certificate.class);
|
||||
|
||||
Certificate subCaCert = PEM_DECODER.decode(subCaCertStr, X509Certificate.class);
|
||||
|
||||
Certificate selfSignedCert = PEM_DECODER.decode(selfSignedCertStr, X509Certificate.class);
|
||||
|
||||
// generate certification path
|
||||
List<Certificate> list = Arrays.asList(targetCert, subCaCert, selfSignedCert);
|
||||
|
||||
return cf.generateCertPath(list);
|
||||
}
|
||||
|
||||
private static Set<TrustAnchor> generateTrustAnchors()
|
||||
throws CertificateException {
|
||||
// generate certificate from cert string
|
||||
X509Certificate selfSignedCert = PEM_DECODER.decode(selfSignedCertStr, X509Certificate.class);
|
||||
|
||||
// generate a trust anchor
|
||||
TrustAnchor anchor =
|
||||
new TrustAnchor(selfSignedCert, null);
|
||||
|
||||
return Collections.singleton(anchor);
|
||||
}
|
||||
|
||||
public static void main(String args[]) throws Exception {
|
||||
CertPath path = generateCertificatePath();
|
||||
Set<TrustAnchor> anchors = generateTrustAnchors();
|
||||
|
||||
PKIXParameters params = new PKIXParameters(anchors);
|
||||
|
||||
// disable certificate revocation checking
|
||||
params.setRevocationEnabled(false);
|
||||
|
||||
// set the validation time
|
||||
params.setDate(new Date(109, 5, 8)); // 2009-05-01
|
||||
|
||||
// disable OCSP checker
|
||||
Security.setProperty("ocsp.enable", "false");
|
||||
|
||||
// disable CRL checker
|
||||
System.setProperty("com.sun.security.enableCRLDP", "false");
|
||||
|
||||
CertPathValidator validator = CertPathValidator.getInstance("PKIX");
|
||||
|
||||
try {
|
||||
validator.validate(path, params);
|
||||
throw new Exception(
|
||||
"the subjectAltName is excluded by NameConstraints, " +
|
||||
"should thrown CertPathValidatorException");
|
||||
} catch (CertPathValidatorException uoe) {
|
||||
// that is the expected exception.
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,160 @@
|
|||
/*
|
||||
* Copyright (c) 2009, 2025, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
/**
|
||||
* @test
|
||||
*
|
||||
* @bug 6845286
|
||||
* @summary Add regression test for name constraints
|
||||
* @enablePreview
|
||||
* @author Xuelei Fan
|
||||
*/
|
||||
|
||||
import java.io.*;
|
||||
import java.net.SocketException;
|
||||
import java.security.PEMDecoder;
|
||||
import java.util.*;
|
||||
import java.security.Security;
|
||||
import java.security.cert.*;
|
||||
import java.security.cert.CertPathValidatorException.BasicReason;
|
||||
|
||||
public class NameConstraintsWithUnexpectedRID {
|
||||
|
||||
static String selfSignedCertStr =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIICTjCCAbegAwIBAgIJAIoSzC1A/k4vMA0GCSqGSIb3DQEBBQUAMB8xCzAJBgNV\n" +
|
||||
"BAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMB4XDTA5MDUwNzA5MjcxMloXDTMwMDQx\n" +
|
||||
"NzA5MjcxMlowHzELMAkGA1UEBhMCVVMxEDAOBgNVBAoTB0V4YW1wbGUwgZ8wDQYJ\n" +
|
||||
"KoZIhvcNAQEBBQADgY0AMIGJAoGBANXzlv5Fn2cdgBRdEK/37/o8rqQXIRIMZqX6\n" +
|
||||
"BPuo46Cdhctv+n3hu5bj/PwgJVbAJcqcQfDudSSF5gwGlRqDX9vekPSS47XZXjOZ\n" +
|
||||
"qFcnDoWP0gSQXLYVVtjuItkecTrPyUE5v2lRIAh13MGKOSh3ZsrtFvj7Y5d9EqIP\n" +
|
||||
"SLxWWPuHAgMBAAGjgZEwgY4wHQYDVR0OBBYEFFydJvQMB2j4EDHW2bQabNsPUvDt\n" +
|
||||
"ME8GA1UdIwRIMEaAFFydJvQMB2j4EDHW2bQabNsPUvDtoSOkITAfMQswCQYDVQQG\n" +
|
||||
"EwJVUzEQMA4GA1UEChMHRXhhbXBsZYIJAIoSzC1A/k4vMA8GA1UdEwEB/wQFMAMB\n" +
|
||||
"Af8wCwYDVR0PBAQDAgIEMA0GCSqGSIb3DQEBBQUAA4GBAHgoopmZ1Q4qXhMDbbYQ\n" +
|
||||
"YCi4Cg6cXPFblx5gzhWu/6l9SkvZbAZiLszgyMq5dGj9WyTtibNEp232dQsKTFu7\n" +
|
||||
"3ag0DiFqoQ8btgvbwBlzhnRagoeVFjhuBBQutOScw7x8NCSBkZQow+31127mwu3y\n" +
|
||||
"YGYhEmI2dNmgbv1hVYTGmLXW\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
static String subCaCertStr =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIICdTCCAd6gAwIBAgIJAL+MYVyy7k5YMA0GCSqGSIb3DQEBBQUAMB8xCzAJBgNV\n" +
|
||||
"BAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMB4XDTA5MDUwNzA5MjcxNFoXDTI5MDEy\n" +
|
||||
"MjA5MjcxNFowMTELMAkGA1UEBhMCVVMxEDAOBgNVBAoTB0V4YW1wbGUxEDAOBgNV\n" +
|
||||
"BAsTB0NsYXNzLTEwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAM2mwX8dhP3M\n" +
|
||||
"i6ATRsd0wco+c7rsyEbP0CRQunVIP8/kOL8+zyQix+QZquY23tvBCbia424GXDkT\n" +
|
||||
"irvK/M4yGzrdS51hA5dlH3SHY3CWOAqEPqKtNLn1My4MWtTiUWbHi0YjFuOv0BXz\n" +
|
||||
"x9lTEfMf+3QcOgO5FitcqHIMP4jIlT+lAgMBAAGjgaYwgaMwHQYDVR0OBBYEFJHg\n" +
|
||||
"eyEWcjxcAwc01BPQrau/4HJaME8GA1UdIwRIMEaAFFydJvQMB2j4EDHW2bQabNsP\n" +
|
||||
"UvDtoSOkITAfMQswCQYDVQQGEwJVUzEQMA4GA1UEChMHRXhhbXBsZYIJAIoSzC1A\n" +
|
||||
"/k4vMA8GA1UdEwEB/wQFMAMBAf8wCwYDVR0PBAQDAgIEMBMGA1UdHgQMMAqhCDAG\n" +
|
||||
"iAQqAwQFMA0GCSqGSIb3DQEBBQUAA4GBAI3CDQWZiTlVVVqfCiZwc/yIL7G5bu2g\n" +
|
||||
"ccgVz9PyKfTpq8vk59S23TvPwdPt4ZVx4RSoar9ONtbrcLxfP3X6WQ7e9popWNZV\n" +
|
||||
"q49YfyU1tD5HFuxj7CAsvfykuRo4ovXaTCVWlTMi7fJJdzU0Eb4xkXXhiWT/RbHG\n" +
|
||||
"R7J+8ROMZ+nR\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
static String targetCertStr =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIICTzCCAbigAwIBAgIJAOA8c10w019UMA0GCSqGSIb3DQEBBQUAMDExCzAJBgNV\n" +
|
||||
"BAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMRAwDgYDVQQLEwdDbGFzcy0xMB4XDTA5\n" +
|
||||
"MDUwNzA5NTg0OVoXDTI5MDEyMjA5NTg0OVowQTELMAkGA1UEBhMCVVMxEDAOBgNV\n" +
|
||||
"BAoTB0V4YW1wbGUxEDAOBgNVBAsTB0NsYXNzLTExDjAMBgNVBAMTBUFsaWNlMIGf\n" +
|
||||
"MA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDfekJF8IZeOe3Ff1rexVyx9yTmPSKh\n" +
|
||||
"itEW7tW9m8DgqLGDptJLmbexvUCWNkFquQW1J8sjzjqrkIk8amA2SlHQ6Z15RoxC\n" +
|
||||
"E19qi5V5ms97X3lyuJcwwtT24J5PBk9ic/V6zclsNXSj/NoqlciKMxyvRy9zWk6Z\n" +
|
||||
"W5cVDf7DTzN2cwIDAQABo18wXTALBgNVHQ8EBAMCA+gwDgYDVR0RBAcwBYgDKgME\n" +
|
||||
"MB0GA1UdDgQWBBRh8rvMhT17VI+S3pCVzTwQzVMjOTAfBgNVHSMEGDAWgBSR4Hsh\n" +
|
||||
"FnI8XAMHNNQT0K2rv+ByWjANBgkqhkiG9w0BAQUFAAOBgQCNDnJ0Jz37+SmO9uRJ\n" +
|
||||
"z5Rr15oJAKsde5LGhghHZwTTYInOwGOYAABkWRB7JhUHNjIoQg9veqObSHEgcYMh\n" +
|
||||
"ZmO3rklIxyTeoyn86KR49cdvQUoqEhx1jKrEbFBsAwSbJDw//S+wNYgMHYtcynf4\n" +
|
||||
"dcVScVdLUDeqE/3f+5yt1JPRuA==\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
private static final PEMDecoder PEM_DECODER = PEMDecoder.of()
|
||||
;
|
||||
private static CertPath generateCertificatePath()
|
||||
throws CertificateException, IOException {
|
||||
// generate certificate from cert strings
|
||||
CertificateFactory cf = CertificateFactory.getInstance("X.509");
|
||||
|
||||
ByteArrayInputStream is;
|
||||
|
||||
is = new ByteArrayInputStream(targetCertStr.getBytes());
|
||||
Certificate targetCert = PEM_DECODER.decode(is, X509Certificate.class);
|
||||
|
||||
is = new ByteArrayInputStream(subCaCertStr.getBytes());
|
||||
Certificate subCaCert = PEM_DECODER.decode(is, X509Certificate.class);
|
||||
|
||||
is = new ByteArrayInputStream(selfSignedCertStr.getBytes());
|
||||
Certificate selfSignedCert = PEM_DECODER.decode(is, X509Certificate.class);
|
||||
|
||||
// generate certification path
|
||||
List<Certificate> list = Arrays.asList(targetCert, subCaCert, selfSignedCert);
|
||||
|
||||
return cf.generateCertPath(list);
|
||||
}
|
||||
|
||||
private static Set<TrustAnchor> generateTrustAnchors()
|
||||
throws IOException {
|
||||
// generate certificate from cert string
|
||||
ByteArrayInputStream is =
|
||||
new ByteArrayInputStream(selfSignedCertStr.getBytes());
|
||||
X509Certificate selfSignedCert = PEM_DECODER.decode(is, X509Certificate.class);;
|
||||
|
||||
// generate a trust anchor
|
||||
TrustAnchor anchor =
|
||||
new TrustAnchor(selfSignedCert, null);
|
||||
|
||||
return Collections.singleton(anchor);
|
||||
}
|
||||
|
||||
public static void main(String args[]) throws Exception {
|
||||
CertPath path = generateCertificatePath();
|
||||
Set<TrustAnchor> anchors = generateTrustAnchors();
|
||||
|
||||
PKIXParameters params = new PKIXParameters(anchors);
|
||||
|
||||
// disable certificate revocation checking
|
||||
params.setRevocationEnabled(false);
|
||||
|
||||
// set the validation time
|
||||
params.setDate(new Date(109, 5, 8)); // 2009-05-01
|
||||
|
||||
// disable OCSP checker
|
||||
Security.setProperty("ocsp.enable", "false");
|
||||
|
||||
// disable CRL checker
|
||||
System.setProperty("com.sun.security.enableCRLDP", "false");
|
||||
|
||||
CertPathValidator validator = CertPathValidator.getInstance("PKIX");
|
||||
|
||||
try {
|
||||
validator.validate(path, params);
|
||||
throw new Exception("Should thrown UnsupportedOperationException");
|
||||
} catch (UnsupportedOperationException uoe) {
|
||||
// that is the expected exception.
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,153 @@
|
|||
/*
|
||||
* Copyright (c) 2009, 2025, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
/**
|
||||
* @test
|
||||
*
|
||||
* @bug 6845286
|
||||
* @summary Add regression test for name constraints
|
||||
* @enablePreview
|
||||
* @author Xuelei Fan
|
||||
*/
|
||||
|
||||
import java.io.*;
|
||||
import java.net.SocketException;
|
||||
import java.security.PEMDecoder;
|
||||
import java.util.*;
|
||||
import java.security.Security;
|
||||
import java.security.cert.*;
|
||||
import java.security.cert.CertPathValidatorException.BasicReason;
|
||||
|
||||
public class NameConstraintsWithoutRID {
|
||||
|
||||
static String selfSignedCertStr =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIICTjCCAbegAwIBAgIJAIoSzC1A/k4vMA0GCSqGSIb3DQEBBQUAMB8xCzAJBgNV\n" +
|
||||
"BAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMB4XDTA5MDUwNzA5MjcxMloXDTMwMDQx\n" +
|
||||
"NzA5MjcxMlowHzELMAkGA1UEBhMCVVMxEDAOBgNVBAoTB0V4YW1wbGUwgZ8wDQYJ\n" +
|
||||
"KoZIhvcNAQEBBQADgY0AMIGJAoGBANXzlv5Fn2cdgBRdEK/37/o8rqQXIRIMZqX6\n" +
|
||||
"BPuo46Cdhctv+n3hu5bj/PwgJVbAJcqcQfDudSSF5gwGlRqDX9vekPSS47XZXjOZ\n" +
|
||||
"qFcnDoWP0gSQXLYVVtjuItkecTrPyUE5v2lRIAh13MGKOSh3ZsrtFvj7Y5d9EqIP\n" +
|
||||
"SLxWWPuHAgMBAAGjgZEwgY4wHQYDVR0OBBYEFFydJvQMB2j4EDHW2bQabNsPUvDt\n" +
|
||||
"ME8GA1UdIwRIMEaAFFydJvQMB2j4EDHW2bQabNsPUvDtoSOkITAfMQswCQYDVQQG\n" +
|
||||
"EwJVUzEQMA4GA1UEChMHRXhhbXBsZYIJAIoSzC1A/k4vMA8GA1UdEwEB/wQFMAMB\n" +
|
||||
"Af8wCwYDVR0PBAQDAgIEMA0GCSqGSIb3DQEBBQUAA4GBAHgoopmZ1Q4qXhMDbbYQ\n" +
|
||||
"YCi4Cg6cXPFblx5gzhWu/6l9SkvZbAZiLszgyMq5dGj9WyTtibNEp232dQsKTFu7\n" +
|
||||
"3ag0DiFqoQ8btgvbwBlzhnRagoeVFjhuBBQutOScw7x8NCSBkZQow+31127mwu3y\n" +
|
||||
"YGYhEmI2dNmgbv1hVYTGmLXW\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
static String subCaCertStr =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIICdTCCAd6gAwIBAgIJAL+MYVyy7k5YMA0GCSqGSIb3DQEBBQUAMB8xCzAJBgNV\n" +
|
||||
"BAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMB4XDTA5MDUwNzA5MjcxNFoXDTI5MDEy\n" +
|
||||
"MjA5MjcxNFowMTELMAkGA1UEBhMCVVMxEDAOBgNVBAoTB0V4YW1wbGUxEDAOBgNV\n" +
|
||||
"BAsTB0NsYXNzLTEwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAM2mwX8dhP3M\n" +
|
||||
"i6ATRsd0wco+c7rsyEbP0CRQunVIP8/kOL8+zyQix+QZquY23tvBCbia424GXDkT\n" +
|
||||
"irvK/M4yGzrdS51hA5dlH3SHY3CWOAqEPqKtNLn1My4MWtTiUWbHi0YjFuOv0BXz\n" +
|
||||
"x9lTEfMf+3QcOgO5FitcqHIMP4jIlT+lAgMBAAGjgaYwgaMwHQYDVR0OBBYEFJHg\n" +
|
||||
"eyEWcjxcAwc01BPQrau/4HJaME8GA1UdIwRIMEaAFFydJvQMB2j4EDHW2bQabNsP\n" +
|
||||
"UvDtoSOkITAfMQswCQYDVQQGEwJVUzEQMA4GA1UEChMHRXhhbXBsZYIJAIoSzC1A\n" +
|
||||
"/k4vMA8GA1UdEwEB/wQFMAMBAf8wCwYDVR0PBAQDAgIEMBMGA1UdHgQMMAqhCDAG\n" +
|
||||
"iAQqAwQFMA0GCSqGSIb3DQEBBQUAA4GBAI3CDQWZiTlVVVqfCiZwc/yIL7G5bu2g\n" +
|
||||
"ccgVz9PyKfTpq8vk59S23TvPwdPt4ZVx4RSoar9ONtbrcLxfP3X6WQ7e9popWNZV\n" +
|
||||
"q49YfyU1tD5HFuxj7CAsvfykuRo4ovXaTCVWlTMi7fJJdzU0Eb4xkXXhiWT/RbHG\n" +
|
||||
"R7J+8ROMZ+nR\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
static String targetCertStr =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIICPTCCAaagAwIBAgIJAOA8c10w019WMA0GCSqGSIb3DQEBBQUAMDExCzAJBgNV\n" +
|
||||
"BAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMRAwDgYDVQQLEwdDbGFzcy0xMB4XDTA5\n" +
|
||||
"MDUwNzEwMjY0MloXDTI5MDEyMjEwMjY0MlowPzELMAkGA1UEBhMCVVMxEDAOBgNV\n" +
|
||||
"BAoTB0V4YW1wbGUxEDAOBgNVBAsTB0NsYXNzLTExDDAKBgNVBAMTA0JvYjCBnzAN\n" +
|
||||
"BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAx4N+y29y5mAGnVQHA3x3fQehxm3nFohQ\n" +
|
||||
"gKV10bZ24/hwZn6rZXG6VsBaqkrgw7ipRZzk99etihAomAFL9k0q/0nxFP/Ovwio\n" +
|
||||
"NzacF3vpv85FF6ATwY1Zs+p4hfxU3WnnyyS9la9Z3o5QBhQbV/WjA/JSG5+ImQFp\n" +
|
||||
"nLkPfzU4wXECAwEAAaNPME0wCwYDVR0PBAQDAgPoMB0GA1UdDgQWBBTxUJG+QewS\n" +
|
||||
"rSGcuiJy+K4gb1g/BzAfBgNVHSMEGDAWgBSR4HshFnI8XAMHNNQT0K2rv+ByWjAN\n" +
|
||||
"BgkqhkiG9w0BAQUFAAOBgQA9fDeTtSXmP/MEni0vtAmgTPd6R31NcPWKibDizwYS\n" +
|
||||
"BWjUMcbTN8xeXjm4uQLMK8ZQy2+cmNrTvQ59BZ8Y97y7SJUcBLOW5eivO/mKuBsC\n" +
|
||||
"ACB9IxBUGVEwNup7KJ5ixox5jKt+qPwzCheyQQb9NEDJdB0YaHRhFpCcpCFak8yK\n" +
|
||||
"/A==\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
private static final PEMDecoder PEM_DECODER = PEMDecoder.of();
|
||||
|
||||
private static CertPath generateCertificatePath()
|
||||
throws CertificateException {
|
||||
// generate certificate from cert strings
|
||||
CertificateFactory cf = CertificateFactory.getInstance("X.509");
|
||||
|
||||
Certificate targetCert = PEM_DECODER.decode(targetCertStr, X509Certificate.class);
|
||||
|
||||
Certificate subCaCert = PEM_DECODER.decode(subCaCertStr, X509Certificate.class);
|
||||
|
||||
Certificate selfSignedCert = PEM_DECODER.decode(selfSignedCertStr, X509Certificate.class);
|
||||
|
||||
// generate certification path
|
||||
List<Certificate> list = Arrays.asList(targetCert, subCaCert, selfSignedCert);
|
||||
|
||||
return cf.generateCertPath(list);
|
||||
}
|
||||
|
||||
private static Set<TrustAnchor> generateTrustAnchors()
|
||||
throws CertificateException {
|
||||
// generate certificate from cert string
|
||||
X509Certificate selfSignedCert = PEM_DECODER.decode(selfSignedCertStr, X509Certificate.class);
|
||||
|
||||
// generate a trust anchor
|
||||
TrustAnchor anchor =
|
||||
new TrustAnchor(selfSignedCert, null);
|
||||
|
||||
return Collections.singleton(anchor);
|
||||
}
|
||||
|
||||
public static void main(String args[]) throws Exception {
|
||||
CertPath path = generateCertificatePath();
|
||||
Set<TrustAnchor> anchors = generateTrustAnchors();
|
||||
|
||||
PKIXParameters params = new PKIXParameters(anchors);
|
||||
|
||||
// disable certificate revocation checking
|
||||
params.setRevocationEnabled(false);
|
||||
|
||||
// set the validation time
|
||||
params.setDate(new Date(109, 5, 8)); // 2009-05-01
|
||||
|
||||
// disable OCSP checker
|
||||
Security.setProperty("ocsp.enable", "false");
|
||||
|
||||
// disable CRL checker
|
||||
System.setProperty("com.sun.security.enableCRLDP", "false");
|
||||
|
||||
CertPathValidator validator = CertPathValidator.getInstance("PKIX");
|
||||
|
||||
try {
|
||||
validator.validate(path, params);
|
||||
} catch (CertPathValidatorException uoe) {
|
||||
// unexpected exception, rethrow it.
|
||||
throw uoe;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,110 @@
|
|||
#
|
||||
# Copyright (c) 2009, 2013, Oracle and/or its affiliates. All rights reserved.
|
||||
# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
#
|
||||
# This code is free software; you can redistribute it and/or modify it
|
||||
# under the terms of the GNU General Public License version 2 only, as
|
||||
# published by the Free Software Foundation.
|
||||
#
|
||||
# This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
# FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
# version 2 for more details (a copy is included in the LICENSE file that
|
||||
# accompanied this code).
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License version
|
||||
# 2 along with this work; if not, write to the Free Software Foundation,
|
||||
# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
#
|
||||
# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
# or visit www.oracle.com if you need additional information or have any
|
||||
# questions.
|
||||
#
|
||||
|
||||
#!/bin/ksh
|
||||
#
|
||||
# needs ksh to run the script.
|
||||
OPENSSL=openssl
|
||||
|
||||
# generate a self-signed root certificate
|
||||
if [ ! -f root/root_cert.pem ]; then
|
||||
if [ ! -d root ]; then
|
||||
mkdir root
|
||||
fi
|
||||
|
||||
${OPENSSL} req -x509 -newkey rsa:1024 -keyout root/root_key.pem \
|
||||
-out root/root_cert.pem -subj "/C=US/O=Example" \
|
||||
-config openssl.cnf -reqexts cert_issuer -days 7650 \
|
||||
-passin pass:passphrase -passout pass:passphrase
|
||||
fi
|
||||
|
||||
# generate subca cert issuer
|
||||
if [ ! -f subca/subca_cert.pem ]; then
|
||||
if [ ! -d subca ]; then
|
||||
mkdir subca
|
||||
fi
|
||||
|
||||
${OPENSSL} req -newkey rsa:1024 -keyout subca/subca_key.pem \
|
||||
-out subca/subca_req.pem -subj "/C=US/O=Example/OU=Class-1" \
|
||||
-days 7650 -passin pass:passphrase -passout pass:passphrase
|
||||
|
||||
${OPENSSL} x509 -req -in subca/subca_req.pem -extfile openssl.cnf \
|
||||
-extensions cert_issuer -CA root/root_cert.pem \
|
||||
-CAkey root/root_key.pem -out subca/subca_cert.pem -CAcreateserial \
|
||||
-CAserial root/root_cert.srl -days 7200 -passin pass:passphrase
|
||||
fi
|
||||
|
||||
# generate certifiacte for Alice
|
||||
if [ ! -f subca/alice/alice_cert.pem ]; then
|
||||
if [ ! -d subca/alice ]; then
|
||||
mkdir -p subca/alice
|
||||
fi
|
||||
|
||||
${OPENSSL} req -newkey rsa:1024 -keyout subca/alice/alice_key.pem \
|
||||
-out subca/alice/alice_req.pem \
|
||||
-subj "/C=US/O=Example/OU=Class-1/CN=Alice" -days 7650 \
|
||||
-passin pass:passphrase -passout pass:passphrase
|
||||
|
||||
${OPENSSL} x509 -req -in subca/alice/alice_req.pem \
|
||||
-extfile openssl.cnf -extensions alice_of_subca \
|
||||
-CA subca/subca_cert.pem -CAkey subca/subca_key.pem \
|
||||
-out subca/alice/alice_cert.pem -CAcreateserial \
|
||||
-CAserial subca/subca_cert.srl -days 7200 -passin pass:passphrase
|
||||
fi
|
||||
|
||||
# generate certifiacte for Bob
|
||||
if [ ! -f subca/bob/bob.pem ]; then
|
||||
if [ ! -d subca/bob ]; then
|
||||
mkdir -p subca/bob
|
||||
fi
|
||||
|
||||
${OPENSSL} req -newkey rsa:1024 -keyout subca/bob/bob_key.pem \
|
||||
-out subca/bob/bob_req.pem \
|
||||
-subj "/C=US/O=Example/OU=Class-1/CN=Bob" -days 7650 \
|
||||
-passin pass:passphrase -passout pass:passphrase
|
||||
|
||||
${OPENSSL} x509 -req -in subca/bob/bob_req.pem \
|
||||
-extfile openssl.cnf -extensions ee_of_subca \
|
||||
-CA subca/subca_cert.pem -CAkey subca/subca_key.pem \
|
||||
-out subca/bob/bob_cert.pem -CAcreateserial \
|
||||
-CAserial subca/subca_cert.srl -days 7200 -passin pass:passphrase
|
||||
fi
|
||||
|
||||
# generate certifiacte for Susan
|
||||
if [ ! -f subca/susan/susan_cert.pem ]; then
|
||||
if [ ! -d subca/susan ]; then
|
||||
mkdir -p subca/susan
|
||||
fi
|
||||
|
||||
${OPENSSL} req -newkey rsa:1024 -keyout subca/susan/susan_key.pem \
|
||||
-out subca/susan/susan_req.pem \
|
||||
-subj "/C=US/O=Example/OU=Class-1/CN=Susan" -days 7650 \
|
||||
-passin pass:passphrase -passout pass:passphrase
|
||||
|
||||
${OPENSSL} x509 -req -in subca/susan/susan_req.pem \
|
||||
-extfile openssl.cnf -extensions susan_of_subca \
|
||||
-CA subca/subca_cert.pem -CAkey subca/subca_key.pem \
|
||||
-out subca/susan/susan_cert.pem -CAcreateserial \
|
||||
-CAserial subca/subca_cert.srl -days 7200 -passin pass:passphrase
|
||||
fi
|
||||
|
||||
|
|
@ -0,0 +1,218 @@
|
|||
#
|
||||
# Copyright (c) 2009, Oracle and/or its affiliates. All rights reserved.
|
||||
# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
#
|
||||
# This code is free software; you can redistribute it and/or modify it
|
||||
# under the terms of the GNU General Public License version 2 only, as
|
||||
# published by the Free Software Foundation.
|
||||
#
|
||||
# This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
# FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
# version 2 for more details (a copy is included in the LICENSE file that
|
||||
# accompanied this code).
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License version
|
||||
# 2 along with this work; if not, write to the Free Software Foundation,
|
||||
# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
#
|
||||
# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
# or visit www.oracle.com if you need additional information or have any
|
||||
# questions.
|
||||
#
|
||||
|
||||
#
|
||||
# OpenSSL configuration file.
|
||||
#
|
||||
|
||||
HOME = .
|
||||
RANDFILE = $ENV::HOME/.rnd
|
||||
|
||||
[ ca ]
|
||||
default_ca = CA_default
|
||||
|
||||
[ CA_default ]
|
||||
dir = ./top
|
||||
certs = $dir/certs
|
||||
crl_dir = $dir/crl
|
||||
database = $dir/index.txt
|
||||
unique_subject = no
|
||||
new_certs_dir = $dir/newcerts
|
||||
certificate = $dir/cacert.pem
|
||||
serial = $dir/serial
|
||||
crlnumber = $dir/crlnumber
|
||||
crl = $dir/crl.pem
|
||||
private_key = $dir/private/cakey.pem
|
||||
RANDFILE = $dir/private/.rand
|
||||
x509_extensions = v3_ca
|
||||
|
||||
name_opt = ca_default
|
||||
cert_opt = ca_default
|
||||
|
||||
default_days = 7650
|
||||
default_crl_days = 30
|
||||
default_md = sha1
|
||||
preserve = no
|
||||
|
||||
policy = policy_anything
|
||||
|
||||
[ ca_top ]
|
||||
dir = ./root
|
||||
certs = $dir/certs
|
||||
crl_dir = $dir/crl
|
||||
database = $dir/index.txt
|
||||
unique_subject = no
|
||||
new_certs_dir = $dir/newcerts
|
||||
certificate = $dir/cacert.pem
|
||||
serial = $dir/serial
|
||||
crlnumber = $dir/crlnumber
|
||||
crl = $dir/crl.pem
|
||||
private_key = $dir/private/cakey.pem
|
||||
RANDFILE = $dir/private/.rand
|
||||
|
||||
x509_extensions = v3_ca
|
||||
|
||||
name_opt = ca_default
|
||||
cert_opt = ca_default
|
||||
|
||||
default_days = 7650
|
||||
default_crl_days = 30
|
||||
default_md = sha1
|
||||
preserve = no
|
||||
|
||||
policy = policy_anything
|
||||
|
||||
[ ca_subca ]
|
||||
dir = ./subca
|
||||
certs = $dir/certs
|
||||
crl_dir = $dir/crl
|
||||
database = $dir/index.txt
|
||||
unique_subject = no
|
||||
new_certs_dir = $dir/newcerts
|
||||
|
||||
certificate = $dir/cacert.pem
|
||||
serial = $dir/serial
|
||||
crlnumber = $dir/crlnumber
|
||||
crl = $dir/crl.pem
|
||||
private_key = $dir/private/cakey.pem
|
||||
RANDFILE = $dir/private/.rand
|
||||
|
||||
x509_extensions = usr_cert
|
||||
|
||||
name_opt = ca_default
|
||||
cert_opt = ca_default
|
||||
|
||||
default_days = 7650
|
||||
default_crl_days = 30
|
||||
default_md = sha1
|
||||
preserve = no
|
||||
|
||||
policy = policy_anything
|
||||
|
||||
[ policy_match ]
|
||||
countryName = match
|
||||
stateOrProvinceName = match
|
||||
organizationName = match
|
||||
organizationalUnitName = optional
|
||||
commonName = supplied
|
||||
emailAddress = optional
|
||||
|
||||
[ policy_anything ]
|
||||
countryName = optional
|
||||
stateOrProvinceName = optional
|
||||
localityName = optional
|
||||
organizationName = optional
|
||||
organizationalUnitName = optional
|
||||
commonName = supplied
|
||||
emailAddress = optional
|
||||
|
||||
[ req ]
|
||||
default_bits = 1024
|
||||
default_keyfile = privkey.pem
|
||||
distinguished_name = req_distinguished_name
|
||||
attributes = req_attributes
|
||||
x509_extensions = v3_ca
|
||||
|
||||
string_mask = nombstr
|
||||
|
||||
[ req_distinguished_name ]
|
||||
countryName = Country Name (2 letter code)
|
||||
countryName_default = NO
|
||||
countryName_min = 2
|
||||
countryName_max = 2
|
||||
|
||||
stateOrProvinceName = State or Province Name (full name)
|
||||
stateOrProvinceName_default = A-State
|
||||
|
||||
localityName = Locality Name (eg, city)
|
||||
|
||||
0.organizationName = Organization Name (eg, company)
|
||||
0.organizationName_default = Internet Widgits Pty Ltd
|
||||
|
||||
organizationalUnitName = Organizational Unit Name (eg, section)
|
||||
|
||||
commonName = Common Name (eg, YOUR name)
|
||||
commonName_max = 64
|
||||
|
||||
emailAddress = Email Address
|
||||
emailAddress_max = 64
|
||||
|
||||
[ req_attributes ]
|
||||
challengePassword = A challenge password
|
||||
challengePassword_min = 4
|
||||
challengePassword_max = 20
|
||||
unstructuredName = An optional company name
|
||||
|
||||
|
||||
[ usr_cert ]
|
||||
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
||||
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid,issuer
|
||||
|
||||
[ v3_req ]
|
||||
basicConstraints = CA:FALSE
|
||||
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
||||
subjectAltName = email:example@openjdk.net, RID:1.2.3.4:true
|
||||
|
||||
[ v3_ca ]
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid:always,issuer:always
|
||||
basicConstraints = critical,CA:true
|
||||
keyUsage = keyCertSign
|
||||
|
||||
[ cert_issuer ]
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid:always,issuer:always
|
||||
basicConstraints = critical,CA:true
|
||||
keyUsage = keyCertSign
|
||||
nameConstraints = excluded;RID:1.2.3.4.5
|
||||
|
||||
[ crl_issuer ]
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid:always,issuer:always
|
||||
keyUsage = cRLSign
|
||||
|
||||
|
||||
[ crl_ext ]
|
||||
authorityKeyIdentifier = keyid:always,issuer:always
|
||||
|
||||
[ ee_of_subca ]
|
||||
keyUsage = nonRepudiation, digitalSignature, keyEncipherment, keyAgreement
|
||||
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid,issuer
|
||||
|
||||
[ alice_of_subca ]
|
||||
keyUsage = nonRepudiation, digitalSignature, keyEncipherment, keyAgreement
|
||||
subjectAltName = RID:1.2.3.4
|
||||
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid,issuer
|
||||
|
||||
[ susan_of_subca ]
|
||||
keyUsage = nonRepudiation, digitalSignature, keyEncipherment, keyAgreement
|
||||
subjectAltName = RID:1.2.3.4.5
|
||||
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid,issuer
|
||||
|
|
@ -0,0 +1,168 @@
|
|||
/*
|
||||
* Copyright (c) 2002, 2010, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
/*
|
||||
* @test
|
||||
* @bug 4684810 6994717
|
||||
* @summary Verify that RFC822 name constraints are checked correctly
|
||||
*/
|
||||
|
||||
import java.io.ByteArrayOutputStream;
|
||||
import java.io.File;
|
||||
import java.io.FileInputStream;
|
||||
import java.io.InputStream;
|
||||
import java.io.IOException;
|
||||
|
||||
import java.security.cert.*;
|
||||
import java.security.cert.PKIXReason;
|
||||
|
||||
import java.util.ArrayList;
|
||||
import java.util.Collections;
|
||||
import java.util.Date;
|
||||
import java.util.List;
|
||||
import java.util.Set;
|
||||
|
||||
/**
|
||||
* ValidateCertPath performs a simple validation of a certification path.
|
||||
* On success, it prints the CertPathValidatorResult. On failure, it
|
||||
* prints the error.
|
||||
*
|
||||
* Synopsis:
|
||||
* <pre>
|
||||
* ValidateCertPath trustAnchor [certFile ...]
|
||||
* where each argument is the path to a file that contains a
|
||||
* certificate. Each certificate should have an issuer equal to
|
||||
* the subject of the preceding certificate.
|
||||
*</pre>
|
||||
*
|
||||
* @author Steve Hanna
|
||||
*/
|
||||
public final class ValidateCertPath {
|
||||
|
||||
private final static String BASE = System.getProperty("test.src", "./");
|
||||
|
||||
private static CertPath path;
|
||||
private static PKIXParameters params;
|
||||
|
||||
public static void main(String[] args) throws Exception {
|
||||
|
||||
try {
|
||||
parseArgs(args);
|
||||
validate(path, params);
|
||||
throw new Exception("Successfully validated invalid path.");
|
||||
} catch (CertPathValidatorException e) {
|
||||
if (e.getReason() != PKIXReason.INVALID_NAME) {
|
||||
throw new Exception("unexpected reason: " + e.getReason());
|
||||
}
|
||||
System.out.println("Path rejected as expected: " + e);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Parse the command line arguments. Populate the static
|
||||
* class fields based on the values of the arugments. In
|
||||
* case of bad arguments, print usage and exit. In case of
|
||||
* other error, throw an exception.
|
||||
*
|
||||
* @param args command line arguments
|
||||
* @throws Exception on error
|
||||
*/
|
||||
public static void parseArgs(String[] args) throws Exception {
|
||||
args = new String[] {"jane2jane.cer", "jane2steve.cer", "steve2tom.cer"};
|
||||
|
||||
TrustAnchor anchor = new TrustAnchor(getCertFromFile(args[0]), null);
|
||||
List<X509Certificate> list = new ArrayList<X509Certificate>();
|
||||
for (int i = 1; i < args.length; i++) {
|
||||
list.add(0, getCertFromFile(args[i]));
|
||||
}
|
||||
CertificateFactory cf = CertificateFactory.getInstance("X509");
|
||||
path = cf.generateCertPath(list);
|
||||
|
||||
Set<TrustAnchor> anchors = Collections.singleton(anchor);
|
||||
params = new PKIXParameters(anchors);
|
||||
params.setRevocationEnabled(false);
|
||||
// The certificates expired on 10/22/10, so set the validity date to
|
||||
// 05/01/2009 to avoid expiration failures
|
||||
params.setDate(new Date(1243828800000l));
|
||||
}
|
||||
|
||||
/*
|
||||
* Reads the entire input stream into a byte array.
|
||||
*/
|
||||
private static byte[] getTotalBytes(InputStream is) throws IOException {
|
||||
byte[] buffer = new byte[8192];
|
||||
ByteArrayOutputStream baos = new ByteArrayOutputStream(2048);
|
||||
int n;
|
||||
baos.reset();
|
||||
while ((n = is.read(buffer, 0, buffer.length)) != -1) {
|
||||
baos.write(buffer, 0, n);
|
||||
}
|
||||
return baos.toByteArray();
|
||||
}
|
||||
|
||||
/**
|
||||
* Get a DER-encoded X.509 certificate from a file.
|
||||
*
|
||||
* @param certFilePath path to file containing DER-encoded certificate
|
||||
* @return X509Certificate
|
||||
* @throws IOException on error
|
||||
*/
|
||||
public static X509Certificate getCertFromFile(String certFilePath)
|
||||
throws IOException {
|
||||
X509Certificate cert = null;
|
||||
try {
|
||||
File certFile = new File(BASE, certFilePath);
|
||||
if (!certFile.canRead())
|
||||
throw new IOException("File " +
|
||||
certFile.toString() +
|
||||
" is not a readable file.");
|
||||
FileInputStream certFileInputStream =
|
||||
new FileInputStream(certFile);
|
||||
CertificateFactory cf = CertificateFactory.getInstance("X509");
|
||||
cert = (X509Certificate)
|
||||
cf.generateCertificate(certFileInputStream);
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
throw new IOException("Can't construct X509Certificate: " +
|
||||
e.getMessage());
|
||||
}
|
||||
return cert;
|
||||
}
|
||||
|
||||
/**
|
||||
* Perform a PKIX validation. On success, print the
|
||||
* CertPathValidatorResult on System.out. On failure,
|
||||
* throw an exception.
|
||||
*
|
||||
* @param path CertPath to validate
|
||||
* @param params PKIXParameters to use in validation
|
||||
* @throws Exception on error
|
||||
*/
|
||||
public static void validate(CertPath path, PKIXParameters params)
|
||||
throws Exception {
|
||||
CertPathValidator validator =
|
||||
CertPathValidator.getInstance("PKIX");
|
||||
CertPathValidatorResult cpvr = validator.validate(path, params);
|
||||
System.out.println("ValidateCertPath successful.");
|
||||
}
|
||||
}
|
||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
|
|
@ -0,0 +1,136 @@
|
|||
/*
|
||||
* Copyright (c) 2001, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
/**
|
||||
* @test
|
||||
* @bug 4459538
|
||||
* @summary make sure that target constraints are processed correctly
|
||||
* by a PKIX CertPathValidator
|
||||
*/
|
||||
|
||||
import java.io.File;
|
||||
import java.io.FileInputStream;
|
||||
import java.io.IOException;
|
||||
|
||||
import java.math.BigInteger;
|
||||
|
||||
import java.security.cert.CertificateFactory;
|
||||
import java.security.cert.CertPath;
|
||||
import java.security.cert.CertPathValidator;
|
||||
import java.security.cert.CertPathValidatorException;
|
||||
import java.security.cert.CertPathValidatorResult;
|
||||
import java.security.cert.PKIXParameters;
|
||||
import java.security.cert.TrustAnchor;
|
||||
import java.security.cert.X509Certificate;
|
||||
import java.security.cert.X509CertSelector;
|
||||
|
||||
import java.util.ArrayList;
|
||||
import java.util.Collections;
|
||||
import java.util.List;
|
||||
import java.util.Set;
|
||||
|
||||
/**
|
||||
* ValidateTargetConstraints performs a simple validation of a certification
|
||||
* path, but adds a requirement that the serial number of the last
|
||||
* certificate match an arbitrarily chosen number. This should cause the
|
||||
* validation to fail.
|
||||
*
|
||||
* @author Steve Hanna
|
||||
* @author Sean Mullan
|
||||
*/
|
||||
public final class ValidateTargetConstraints {
|
||||
|
||||
private static CertPath path;
|
||||
private static PKIXParameters params;
|
||||
|
||||
public static void main(String[] args) throws Exception {
|
||||
|
||||
String[] certs = { "sun.cer", "sun2labs1.cer" };
|
||||
|
||||
try {
|
||||
createPath(certs);
|
||||
validate(path, params);
|
||||
throw new Exception
|
||||
("CertPath should not have been validated succesfully");
|
||||
} catch (CertPathValidatorException cpve) {
|
||||
System.out.println("Test failed as expected: " + cpve);
|
||||
}
|
||||
}
|
||||
|
||||
public static void createPath(String[] certs) throws Exception {
|
||||
TrustAnchor anchor = new TrustAnchor(getCertFromFile(certs[0]), null);
|
||||
List list = new ArrayList();
|
||||
for (int i = 1; i < certs.length; i++) {
|
||||
list.add(0, getCertFromFile(certs[i]));
|
||||
}
|
||||
CertificateFactory cf = CertificateFactory.getInstance("X509");
|
||||
path = cf.generateCertPath(list);
|
||||
|
||||
Set anchors = Collections.singleton(anchor);
|
||||
params = new PKIXParameters(anchors);
|
||||
params.setRevocationEnabled(false);
|
||||
X509CertSelector sel = new X509CertSelector();
|
||||
sel.setSerialNumber(new BigInteger("1427"));
|
||||
params.setTargetCertConstraints(sel);
|
||||
}
|
||||
|
||||
/**
|
||||
* Get a DER-encoded X.509 certificate from a file.
|
||||
*
|
||||
* @param certFilePath path to file containing DER-encoded certificate
|
||||
* @return X509Certificate
|
||||
* @throws IOException on error
|
||||
*/
|
||||
public static X509Certificate getCertFromFile(String certFilePath)
|
||||
throws IOException {
|
||||
X509Certificate cert = null;
|
||||
try {
|
||||
File certFile = new File(System.getProperty("test.src", "."),
|
||||
certFilePath);
|
||||
FileInputStream certFileInputStream =
|
||||
new FileInputStream(certFile);
|
||||
CertificateFactory cf = CertificateFactory.getInstance("X509");
|
||||
cert = (X509Certificate)
|
||||
cf.generateCertificate(certFileInputStream);
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
throw new IOException("Can't construct X509Certificate: " +
|
||||
e.getMessage());
|
||||
}
|
||||
return cert;
|
||||
}
|
||||
|
||||
/**
|
||||
* Perform a PKIX validation.
|
||||
*
|
||||
* @param path CertPath to validate
|
||||
* @param params PKIXParameters to use in validation
|
||||
* @throws Exception on error
|
||||
*/
|
||||
public static void validate(CertPath path, PKIXParameters params)
|
||||
throws Exception {
|
||||
CertPathValidator validator =
|
||||
CertPathValidator.getInstance("PKIX");
|
||||
CertPathValidatorResult cpvr = validator.validate(path, params);
|
||||
}
|
||||
}
|
||||
Binary file not shown.
Binary file not shown.
|
|
@ -0,0 +1,290 @@
|
|||
/*
|
||||
* Copyright (c) 2004, 2025, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
/*
|
||||
* @test
|
||||
* @bug 8132926
|
||||
* @summary PKIXParameters built with public key form of TrustAnchor causes
|
||||
* NPE during cert path building/validation
|
||||
* @enablePreview
|
||||
* @run main ValWithAnchorByName
|
||||
*/
|
||||
|
||||
import java.io.ByteArrayInputStream;
|
||||
import java.io.IOException;
|
||||
import java.security.PEMDecoder;
|
||||
import java.security.cert.CertificateException;
|
||||
import java.security.cert.CertificateFactory;
|
||||
import java.security.cert.CertPath;
|
||||
import java.security.cert.CertPathValidator;
|
||||
import java.security.cert.PKIXParameters;
|
||||
import java.security.cert.PKIXRevocationChecker;
|
||||
import java.security.cert.TrustAnchor;
|
||||
import java.security.cert.X509Certificate;
|
||||
import java.util.ArrayList;
|
||||
import java.util.Base64;
|
||||
import java.util.Collections;
|
||||
import java.util.Date;
|
||||
import java.util.List;
|
||||
import java.util.Map;
|
||||
import java.util.HashMap;
|
||||
|
||||
// To get certpath debugging, add -Djava.security.debug=certpath
|
||||
|
||||
public class ValWithAnchorByName {
|
||||
|
||||
// The following certificates and OCSP responses were captured from
|
||||
// a test run that used certificates and responses generated by
|
||||
// jdk.test.lib.security.CertificateBuilder and
|
||||
// jdk.test.lib.security.SimpleOCSPServer.
|
||||
|
||||
// Subject: CN=SSLCertificate, O=SomeCompany
|
||||
// Issuer: CN=Intermediate CA Cert, O=SomeCompany
|
||||
// Validity: Tue Aug 30 14:37:19 PDT 2016 to Wed Aug 30 14:37:19 PDT 2017
|
||||
private static final String EE_CERT =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIIDnTCCAoWgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwNTEUMBIGA1UEChMLU29t\n" +
|
||||
"ZUNvbXBhbnkxHTAbBgNVBAMTFEludGVybWVkaWF0ZSBDQSBDZXJ0MB4XDTE2MDgz\n" +
|
||||
"MDIxMzcxOVoXDTE3MDgzMDIxMzcxOVowLzEUMBIGA1UEChMLU29tZUNvbXBhbnkx\n" +
|
||||
"FzAVBgNVBAMTDlNTTENlcnRpZmljYXRlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A\n" +
|
||||
"MIIBCgKCAQEAjgv8KKE4CO0rbCjRLA1hXjRiSq30jeusCJ8frbRG+QOBgQ3j6jgc\n" +
|
||||
"vk5wG1aTu7R4AFn0/HRDMzP9ZbRlZVIbJUTd8YiaNyZeyWapPnxHWrPCd5e1xopk\n" +
|
||||
"ElieDdEH5FiLGtIrWy56CGA1hfQb1vUVYegyeY+TTtMFVHt0PrmMk4ZRgj/GtVNp\n" +
|
||||
"BQQYIzaYAcrcWMeCn30ZrhaGAL1hsdgmEVV1wsTD4JeNMSwLwMYem7fg8ondGZIR\n" +
|
||||
"kZuGtuSdOHu4Xz+mgDNXTeX/Bp/dQFucxCG+FOOM9Hoz72RY2W8YqgL38RlnwYWp\n" +
|
||||
"nUNxhXWFH6vyINRQVEu3IgahR6HXjxM7LwIDAQABo4G8MIG5MBQGA1UdEQQNMAuC\n" +
|
||||
"CWxvY2FsaG9zdDAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly9s\n" +
|
||||
"b2NhbGhvc3Q6NDIzMzMwHwYDVR0jBBgwFoAUYT525lwHCI4CmuWs8a7poaeKRJ4w\n" +
|
||||
"HQYDVR0OBBYEFCaQnOX4L1ovqyfeKuoay+kI+lXgMA4GA1UdDwEB/wQEAwIFoDAd\n" +
|
||||
"BgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDQYJKoZIhvcNAQELBQADggEB\n" +
|
||||
"AD8dqQIqFasJcL8lm4mPTsBl0JgNiN8tQcXM7VCvcH+yDvEyh9vudDjuhpSORqPq\n" +
|
||||
"f1o/EvJ+gfs269mBnYQujYRvmSd6EAcBntv5zn6amOh03o6PqTY9KaUC/mL9hB84\n" +
|
||||
"Y5/LYioP16sME7egKnlrGUgKh0ZvGzm7c3SYx3Z5YoeFBOkZajc7Jm+cBw/uBQkF\n" +
|
||||
"a9mLEczIvOgkq1wto8vr2ptH1gEuvFRcorN3muvq34bk40G08+AHlP3fCLFpI3FA\n" +
|
||||
"IStJLJZRcO+Ib4sOcKuaBGnuMo/QVOCEMDUs6RgiWtSd93OZKFIUOASVp6YIkcSs\n" +
|
||||
"5/rmc06sICqBjLfPEB68Jjw=\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
// Subject: CN=Intermediate CA Cert, O=SomeCompany
|
||||
// Issuer: CN=Root CA Cert, O=SomeCompany
|
||||
// Validity: Sun Aug 07 14:37:19 PDT 2016 to Tue Aug 07 14:37:19 PDT 2018
|
||||
private static final String INT_CA_CERT =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIIDdjCCAl6gAwIBAgIBZDANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtTb21l\n" +
|
||||
"Q29tcGFueTEVMBMGA1UEAxMMUm9vdCBDQSBDZXJ0MB4XDTE2MDgwNzIxMzcxOVoX\n" +
|
||||
"DTE4MDgwNzIxMzcxOVowNTEUMBIGA1UEChMLU29tZUNvbXBhbnkxHTAbBgNVBAMT\n" +
|
||||
"FEludGVybWVkaWF0ZSBDQSBDZXJ0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\n" +
|
||||
"CgKCAQEAnJR5CnE7GKlQjigExSJ6hHu302mc0PcA6TDgsIitPYD/r8RBbBuE51OQ\n" +
|
||||
"7IP7AXmfPUV3/+pO/uxx6mgY5O6XeUl7KadhVPtPcL0BVVevCSOdTMVa3iV4zRpa\n" +
|
||||
"C6Uy2ouUFnafKnDtlbieggyETUoNgVNJYA9L0XNhtSnENoLHC4Pq0v8OsNtsOWFR\n" +
|
||||
"NiMTOA49NNDBw85WgPyFAxjqO4z0J0zxdWq3W4rSMB8xrkulv2Rvj3GcfYJK/ab8\n" +
|
||||
"V1IJ6PMWCpujASY3BzvYPnN7BKuBjbWJPgZdPYfX1cxeG80u0tOuMfWWiNONSMSA\n" +
|
||||
"7m9y304QA0gKqlrFFn9U4hU89kv1IwIDAQABo4GYMIGVMA8GA1UdEwEB/wQFMAMB\n" +
|
||||
"Af8wMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzABhhZodHRwOi8vbG9jYWxob3N0\n" +
|
||||
"OjM5MTM0MB8GA1UdIwQYMBaAFJNMsejEyJUB9tiWycVczvpiMVQZMB0GA1UdDgQW\n" +
|
||||
"BBRhPnbmXAcIjgKa5azxrumhp4pEnjAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcN\n" +
|
||||
"AQELBQADggEBAE4nOFdW9OirPnRvxihQXYL9CXLuGQz5tr0XgN8wSY6Un9b6CRiK\n" +
|
||||
"7obgIGimVdhvUC1qdRcwJqgOfJ2/jR5/5Qo0TVp+ww4dHNdUoj73tagJ7jTu0ZMz\n" +
|
||||
"5Zdp0uwd4RD/syvTeVcbPc3m4awtgEvRgzpDMcSeKPZWInlo7fbnowKSAUAfO8de\n" +
|
||||
"0cDkxEBkzPIzGNu256cdLZOqOK9wLJ9mQ0zKgi/2NsldNc2pl/6jkGpA6uL5lJsm\n" +
|
||||
"fo9sDusWNHV1YggqjDQ19hrf40VuuC9GFl/qAW3marMuEzY/NiKVUxty1q1s48SO\n" +
|
||||
"g5LoEPDDkbygOt7ICL3HYG1VufhC1Q2YY9c=\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
// Subject: CN=Root CA Cert, O=SomeCompany
|
||||
// Issuer: CN=Root CA Cert, O=SomeCompany
|
||||
// Validity: Fri Jul 08 14:37:18 PDT 2016 to Fri Jun 28 14:37:18 PDT 2019
|
||||
private static final String ROOT_CA_CERT =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIIDODCCAiCgAwIBAgIBATANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtTb21l\n" +
|
||||
"Q29tcGFueTEVMBMGA1UEAxMMUm9vdCBDQSBDZXJ0MB4XDTE2MDcwODIxMzcxOFoX\n" +
|
||||
"DTE5MDYyODIxMzcxOFowLTEUMBIGA1UEChMLU29tZUNvbXBhbnkxFTATBgNVBAMT\n" +
|
||||
"DFJvb3QgQ0EgQ2VydDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAIlN\n" +
|
||||
"M3WYEqkU2elXEZrV9QSDbDKwyaLEHafLFciH8Edoag3q/7jEzFJxI7JZ831tdbWQ\n" +
|
||||
"Bm6Hgo+8pvetOFW1BckL8eIjyOONP2CKfFaeMaozsWi1cgxa+rjpU/Rekc+zBqvv\n" +
|
||||
"y4Sr97TwT6nQiLlgjC1nCfR1SVpO51qoDChS7n785rsKEZxw/p+kkVWSZffU7zN9\n" +
|
||||
"c645cPg//L/kjiyeKMkaquGQOYS68gQgy8YZXQv1E3l/8e8Ci1s1DYA5wpCbaBqg\n" +
|
||||
"Tw84Rr4zlUEQBgXzQlRt+mPzeaDpdG1EeGkXrcdkZ+0EMELoOVXOEn6VNsz6vT3I\n" +
|
||||
"KrnvQBSnN06xq/iWwC0CAwEAAaNjMGEwDwYDVR0TAQH/BAUwAwEB/zAfBgNVHSME\n" +
|
||||
"GDAWgBSTTLHoxMiVAfbYlsnFXM76YjFUGTAdBgNVHQ4EFgQUk0yx6MTIlQH22JbJ\n" +
|
||||
"xVzO+mIxVBkwDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEBCwUAA4IBAQAAi+Nl\n" +
|
||||
"sxP9t2IhiZIHRJGSBZuQlXIjwYIwbq3ZWc/ApZ+0oxtl7DYQi5uRNt8/opcGNCHc\n" +
|
||||
"IY0fG93SbkDubXbxPYBW6D/RUjbz59ZryaP5ym55p1MjHTOqy+AM8g41xNTJikc3\n" +
|
||||
"UUFXXnckeFbawijCsb7vf71owzKuxgBXi9n1rmXXtncKoA/LrUVXoUlKefdgDnsU\n" +
|
||||
"sl3Q29eibE3HSqziMMoAOLm0jjekFGWIgLeTtyRYR1d0dNaUwsHTrQpPjxxUTn1x\n" +
|
||||
"sAPpXKfzPnsYAZeeiaaE75GwbWlHzrNinvxdZQd0zctpfBJfVqD/+lWANlw+rOaK\n" +
|
||||
"J2GyCaJINsyaI/I2\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
// OCSP Response Status: successful (0x0)
|
||||
// Response Type: Basic OCSP Response
|
||||
// Version: 1 (0x0)
|
||||
// Responder Id: CN=Intermediate CA Cert, O=SomeCompany
|
||||
// Produced At: Sep 6 21:37:20 2016 GMT
|
||||
// Responses:
|
||||
// Certificate ID:
|
||||
// Hash Algorithm: sha1
|
||||
// Issuer Name Hash: 7ED23D4396152EAB7D0C4AD8C1CA1418AA05DD54
|
||||
// Issuer Key Hash: 613E76E65C07088E029AE5ACF1AEE9A1A78A449E
|
||||
// Serial Number: 1000
|
||||
// Cert Status: good
|
||||
// This Update: Sep 6 21:37:20 2016 GMT
|
||||
// Next Update: Sep 6 22:37:19 2016 GMT
|
||||
private static final String EE_OCSP_RESP =
|
||||
"MIIFbAoBAKCCBWUwggVhBgkrBgEFBQcwAQEEggVSMIIFTjCBtaE3MDUxFDASBgNV\n" +
|
||||
"BAoTC1NvbWVDb21wYW55MR0wGwYDVQQDExRJbnRlcm1lZGlhdGUgQ0EgQ2VydBgP\n" +
|
||||
"MjAxNjA5MDYyMTM3MjBaMGUwYzA7MAkGBSsOAwIaBQAEFH7SPUOWFS6rfQxK2MHK\n" +
|
||||
"FBiqBd1UBBRhPnbmXAcIjgKa5azxrumhp4pEngICEACAABgPMjAxNjA5MDYyMTM3\n" +
|
||||
"MjBaoBEYDzIwMTYwOTA2MjIzNzE5WqECMAAwDQYJKoZIhvcNAQELBQADggEBAF13\n" +
|
||||
"cLwxDG8UYPIbzID86vZGOWUuv5c35VnvebMk/ajAUdpItDYshIQVi90Z8BB2TEi/\n" +
|
||||
"wtx1aNkIv7db0uQ0NnRfvME8vG2PWbty36CNAYr/M5UVzUmELH2sGTyf2fKfNIUK\n" +
|
||||
"Iya/NRxCqxLAc34NYH0YyGJ9VcDjbEMNSBAHIqDdBNqKUPnjn454yoivU2oEs294\n" +
|
||||
"cGePMx3QLyPepMwUss8nW74yIF7vxfJ+KFDBGWNuZDRfXScsGIoeM0Vt9B+4fmnV\n" +
|
||||
"nP4Dw6l3IwmQH4ppjg08qTKvyrXcF2dPDWa98Xw6bA5G085Z/b/6/6GpkvKx/q6i\n" +
|
||||
"UqKwF7q5hkDcB+N4/5SgggN+MIIDejCCA3YwggJeoAMCAQICAWQwDQYJKoZIhvcN\n" +
|
||||
"AQELBQAwLTEUMBIGA1UEChMLU29tZUNvbXBhbnkxFTATBgNVBAMTDFJvb3QgQ0Eg\n" +
|
||||
"Q2VydDAeFw0xNjA4MDcyMTM3MTlaFw0xODA4MDcyMTM3MTlaMDUxFDASBgNVBAoT\n" +
|
||||
"C1NvbWVDb21wYW55MR0wGwYDVQQDExRJbnRlcm1lZGlhdGUgQ0EgQ2VydDCCASIw\n" +
|
||||
"DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJyUeQpxOxipUI4oBMUieoR7t9Np\n" +
|
||||
"nND3AOkw4LCIrT2A/6/EQWwbhOdTkOyD+wF5nz1Fd//qTv7scepoGOTul3lJeymn\n" +
|
||||
"YVT7T3C9AVVXrwkjnUzFWt4leM0aWgulMtqLlBZ2nypw7ZW4noIMhE1KDYFTSWAP\n" +
|
||||
"S9FzYbUpxDaCxwuD6tL/DrDbbDlhUTYjEzgOPTTQwcPOVoD8hQMY6juM9CdM8XVq\n" +
|
||||
"t1uK0jAfMa5Lpb9kb49xnH2CSv2m/FdSCejzFgqbowEmNwc72D5zewSrgY21iT4G\n" +
|
||||
"XT2H19XMXhvNLtLTrjH1lojTjUjEgO5vct9OEANICqpaxRZ/VOIVPPZL9SMCAwEA\n" +
|
||||
"AaOBmDCBlTAPBgNVHRMBAf8EBTADAQH/MDIGCCsGAQUFBwEBBCYwJDAiBggrBgEF\n" +
|
||||
"BQcwAYYWaHR0cDovL2xvY2FsaG9zdDozOTEzNDAfBgNVHSMEGDAWgBSTTLHoxMiV\n" +
|
||||
"AfbYlsnFXM76YjFUGTAdBgNVHQ4EFgQUYT525lwHCI4CmuWs8a7poaeKRJ4wDgYD\n" +
|
||||
"VR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEBCwUAA4IBAQBOJzhXVvToqz50b8YoUF2C\n" +
|
||||
"/Qly7hkM+ba9F4DfMEmOlJ/W+gkYiu6G4CBoplXYb1AtanUXMCaoDnydv40ef+UK\n" +
|
||||
"NE1afsMOHRzXVKI+97WoCe407tGTM+WXadLsHeEQ/7Mr03lXGz3N5uGsLYBL0YM6\n" +
|
||||
"QzHEnij2ViJ5aO3256MCkgFAHzvHXtHA5MRAZMzyMxjbtuenHS2TqjivcCyfZkNM\n" +
|
||||
"yoIv9jbJXTXNqZf+o5BqQOri+ZSbJn6PbA7rFjR1dWIIKow0NfYa3+NFbrgvRhZf\n" +
|
||||
"6gFt5mqzLhM2PzYilVMbctatbOPEjoOS6BDww5G8oDreyAi9x2BtVbn4QtUNmGPX";
|
||||
|
||||
// OCSP Response Status: successful (0x0)
|
||||
// Response Type: Basic OCSP Response
|
||||
// Version: 1 (0x0)
|
||||
// Responder Id: O = SomeCompany, CN = Root CA Cert
|
||||
// Produced At: Sep 6 21:37:20 2016 GMT
|
||||
// Responses:
|
||||
// Certificate ID:
|
||||
// Hash Algorithm: sha1
|
||||
// Issuer Name Hash: C8ED9F4E9AC0052A978257C569E6A7C9C45F5CB5
|
||||
// Issuer Key Hash: 934CB1E8C4C89501F6D896C9C55CCEFA62315419
|
||||
// Serial Number: 64
|
||||
// Cert Status: good
|
||||
// This Update: Sep 6 21:37:20 2016 GMT
|
||||
// Next Update: Sep 6 22:37:19 2016 GMT
|
||||
private static final String INT_CA_OCSP_RESP =
|
||||
"MIIFJQoBAKCCBR4wggUaBgkrBgEFBQcwAQEEggULMIIFBzCBrKEvMC0xFDASBgNV\n" +
|
||||
"BAoTC1NvbWVDb21wYW55MRUwEwYDVQQDEwxSb290IENBIENlcnQYDzIwMTYwOTA2\n" +
|
||||
"MjEzNzIwWjBkMGIwOjAJBgUrDgMCGgUABBTI7Z9OmsAFKpeCV8Vp5qfJxF9ctQQU\n" +
|
||||
"k0yx6MTIlQH22JbJxVzO+mIxVBkCAWSAABgPMjAxNjA5MDYyMTM3MjBaoBEYDzIw\n" +
|
||||
"MTYwOTA2MjIzNzE5WqECMAAwDQYJKoZIhvcNAQELBQADggEBAAgs8jpuEejPD8qO\n" +
|
||||
"+xckvqMz/5pItOHaSB0xyPNpIapqjcDkLktJdBVq5XJWernO9DU+P7yr7TDbvo6h\n" +
|
||||
"P5jBZklLz16Z1aRlEyow2jhelVjNl6nxoiij/6LOGK4tLHa8fK7hTB4Ykw22Bxzt\n" +
|
||||
"LcbrU5jgUDhdZkTrs+rWM8nw7mVWIQYQfwzCMDZ5a02MxzhdwggJGRzqMrbhY/Q7\n" +
|
||||
"RRUK3ohSgzHmLjVkvA0KeM/Px7EefzbEbww08fSsLybmBoIEbcckWSHkkXx4cuIR\n" +
|
||||
"T9FiTz4Ms4r8qzPCo61qeklE2I5lfnfieROADV6sfwbul/0U1HqKhHVaxJ8yYw+T\n" +
|
||||
"/FMxrUKgggNAMIIDPDCCAzgwggIgoAMCAQICAQEwDQYJKoZIhvcNAQELBQAwLTEU\n" +
|
||||
"MBIGA1UEChMLU29tZUNvbXBhbnkxFTATBgNVBAMTDFJvb3QgQ0EgQ2VydDAeFw0x\n" +
|
||||
"NjA3MDgyMTM3MThaFw0xOTA2MjgyMTM3MThaMC0xFDASBgNVBAoTC1NvbWVDb21w\n" +
|
||||
"YW55MRUwEwYDVQQDEwxSb290IENBIENlcnQwggEiMA0GCSqGSIb3DQEBAQUAA4IB\n" +
|
||||
"DwAwggEKAoIBAQCJTTN1mBKpFNnpVxGa1fUEg2wysMmixB2nyxXIh/BHaGoN6v+4\n" +
|
||||
"xMxScSOyWfN9bXW1kAZuh4KPvKb3rThVtQXJC/HiI8jjjT9ginxWnjGqM7FotXIM\n" +
|
||||
"Wvq46VP0XpHPswar78uEq/e08E+p0Ii5YIwtZwn0dUlaTudaqAwoUu5+/Oa7ChGc\n" +
|
||||
"cP6fpJFVkmX31O8zfXOuOXD4P/y/5I4snijJGqrhkDmEuvIEIMvGGV0L9RN5f/Hv\n" +
|
||||
"AotbNQ2AOcKQm2gaoE8POEa+M5VBEAYF80JUbfpj83mg6XRtRHhpF63HZGftBDBC\n" +
|
||||
"6DlVzhJ+lTbM+r09yCq570AUpzdOsav4lsAtAgMBAAGjYzBhMA8GA1UdEwEB/wQF\n" +
|
||||
"MAMBAf8wHwYDVR0jBBgwFoAUk0yx6MTIlQH22JbJxVzO+mIxVBkwHQYDVR0OBBYE\n" +
|
||||
"FJNMsejEyJUB9tiWycVczvpiMVQZMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG9w0B\n" +
|
||||
"AQsFAAOCAQEAAIvjZbMT/bdiIYmSB0SRkgWbkJVyI8GCMG6t2VnPwKWftKMbZew2\n" +
|
||||
"EIubkTbfP6KXBjQh3CGNHxvd0m5A7m128T2AVug/0VI28+fWa8mj+cpueadTIx0z\n" +
|
||||
"qsvgDPIONcTUyYpHN1FBV153JHhW2sIowrG+73+9aMMyrsYAV4vZ9a5l17Z3CqAP\n" +
|
||||
"y61FV6FJSnn3YA57FLJd0NvXomxNx0qs4jDKADi5tI43pBRliIC3k7ckWEdXdHTW\n" +
|
||||
"lMLB060KT48cVE59cbAD6Vyn8z57GAGXnommhO+RsG1pR86zYp78XWUHdM3LaXwS\n" +
|
||||
"X1ag//pVgDZcPqzmiidhsgmiSDbMmiPyNg==";
|
||||
|
||||
// Do path validation as if it is always Tue, 06 Sep 2016 22:12:21 GMT
|
||||
// This value is within the lifetimes of all certificates and both OCSP
|
||||
// responses.
|
||||
private static final Date EVAL_DATE = new Date(1473199941000L);
|
||||
|
||||
private static final Base64.Decoder DECODER = Base64.getMimeDecoder();
|
||||
|
||||
public static void main(String[] args) throws Exception {
|
||||
TrustAnchor anchor;
|
||||
CertificateFactory cf = CertificateFactory.getInstance("X.509");
|
||||
PEMDecoder pemDecoder = PEMDecoder.of();
|
||||
X509Certificate rootCert = pemDecoder.decode(ROOT_CA_CERT, X509Certificate.class);
|
||||
X509Certificate eeCert = pemDecoder.decode(EE_CERT, X509Certificate.class);
|
||||
X509Certificate intCaCert = pemDecoder.decode(INT_CA_CERT, X509Certificate.class);
|
||||
List<X509Certificate> certList = new ArrayList<X509Certificate>() {{
|
||||
add(eeCert);
|
||||
add(intCaCert);
|
||||
}};
|
||||
|
||||
System.out.println("==== Certificate Path =====");
|
||||
for (X509Certificate c : certList) {
|
||||
System.out.println(c + "\n");
|
||||
}
|
||||
System.out.println("===========================");
|
||||
|
||||
System.out.println("===== Test 1: TA(X509Certificate) =====");
|
||||
anchor = new TrustAnchor(rootCert, null);
|
||||
runTest(cf, certList, anchor);
|
||||
|
||||
System.out.println("===== Test 2: TA(X500Principal, PublicKey =====");
|
||||
anchor = new TrustAnchor(rootCert.getSubjectX500Principal(),
|
||||
rootCert.getPublicKey(), null);
|
||||
runTest(cf, certList, anchor);
|
||||
|
||||
System.out.println("===== Test 3: TA(String, PublicKey =====");
|
||||
anchor = new TrustAnchor(rootCert.getSubjectX500Principal().getName(),
|
||||
rootCert.getPublicKey(), null);
|
||||
runTest(cf, certList, anchor);
|
||||
}
|
||||
|
||||
private static void runTest(CertificateFactory cf,
|
||||
List<X509Certificate> certList, TrustAnchor anchor)
|
||||
throws Exception {
|
||||
CertPath path = cf.generateCertPath(certList);
|
||||
CertPathValidator validator = CertPathValidator.getInstance("PKIX");
|
||||
|
||||
System.out.println(anchor);
|
||||
|
||||
// Attach the OCSP responses to a PKIXParameters object
|
||||
PKIXRevocationChecker pkrev =
|
||||
(PKIXRevocationChecker)validator.getRevocationChecker();
|
||||
Map<X509Certificate, byte[]> responseMap = new HashMap<>();
|
||||
responseMap.put(certList.get(0), DECODER.decode(EE_OCSP_RESP));
|
||||
responseMap.put(certList.get(1), DECODER.decode(INT_CA_OCSP_RESP));
|
||||
pkrev.setOcspResponses(responseMap);
|
||||
PKIXParameters params =
|
||||
new PKIXParameters(Collections.singleton(anchor));
|
||||
params.addCertPathChecker(pkrev);
|
||||
params.setDate(EVAL_DATE);
|
||||
|
||||
validator.validate(path, params);
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,171 @@
|
|||
/*
|
||||
* Copyright (c) 2001, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
/**
|
||||
* @test
|
||||
* @bug 4458951
|
||||
* @summary Check that Sun's PKIX implementation of
|
||||
* CertPathValidator.validate() and CertPathBuilder.build() throw an
|
||||
* InvalidAlgorithmParameterException if any of the TrustAnchors specified
|
||||
* contain nameConstraints
|
||||
* @modules java.base/sun.security.util
|
||||
*/
|
||||
import java.io.File;
|
||||
import java.io.FileInputStream;
|
||||
import java.io.IOException;
|
||||
|
||||
import java.security.InvalidAlgorithmParameterException;
|
||||
import java.security.cert.CertificateFactory;
|
||||
import java.security.cert.CertPath;
|
||||
import java.security.cert.CertPathBuilder;
|
||||
import java.security.cert.CertPathBuilderResult;
|
||||
import java.security.cert.CertPathValidator;
|
||||
import java.security.cert.CertPathValidatorResult;
|
||||
import java.security.cert.PKIXParameters;
|
||||
import java.security.cert.PKIXBuilderParameters;
|
||||
import java.security.cert.TrustAnchor;
|
||||
import java.security.cert.X509Certificate;
|
||||
import java.security.cert.X509CertSelector;
|
||||
|
||||
import java.util.ArrayList;
|
||||
import java.util.Collections;
|
||||
import java.util.List;
|
||||
import java.util.Set;
|
||||
|
||||
import sun.security.util.DerInputStream;
|
||||
|
||||
/**
|
||||
* ValidateNC performs a validation and build of a certification path, using any
|
||||
* name constraints provided in the trust anchor's certificate. Using
|
||||
* Sun's provider, the validation and build should fail because name constraints
|
||||
* on trust anchors are not supported.
|
||||
*
|
||||
* @author Steve Hanna
|
||||
* @author Sean Mullan
|
||||
*/
|
||||
public final class ValidateNC {
|
||||
|
||||
private static CertPath path;
|
||||
private static PKIXParameters params;
|
||||
private static Set anchors;
|
||||
|
||||
public static void main(String[] args) throws Exception {
|
||||
|
||||
String[] certs = { "sun2labs2.cer", "labs2isrg2.cer" };
|
||||
|
||||
createPath(certs);
|
||||
try {
|
||||
validate(path, params);
|
||||
throw new Exception("CertPathValidator should have thrown an " +
|
||||
"InvalidAlgorithmParameterException");
|
||||
} catch (InvalidAlgorithmParameterException iape) {
|
||||
// success!
|
||||
}
|
||||
|
||||
try {
|
||||
X509CertSelector sel = new X509CertSelector();
|
||||
sel.setSubject("cn=sean");
|
||||
PKIXBuilderParameters bparams =
|
||||
new PKIXBuilderParameters(anchors, sel);
|
||||
build(bparams);
|
||||
throw new Exception("CertPathBuilder should have thrown an " +
|
||||
"InvalidAlgorithmParameterException");
|
||||
} catch (InvalidAlgorithmParameterException iape) {
|
||||
// success!
|
||||
}
|
||||
}
|
||||
|
||||
public static void createPath(String[] certs) throws Exception {
|
||||
|
||||
X509Certificate anchorCert = getCertFromFile(certs[0]);
|
||||
byte [] nameConstraints = anchorCert.getExtensionValue("2.5.29.30");
|
||||
if (nameConstraints != null) {
|
||||
DerInputStream in = new DerInputStream(nameConstraints);
|
||||
nameConstraints = in.getOctetString();
|
||||
}
|
||||
TrustAnchor anchor = new TrustAnchor(anchorCert, nameConstraints);
|
||||
List list = new ArrayList();
|
||||
for (int i = 1; i < certs.length; i++) {
|
||||
list.add(0, getCertFromFile(certs[i]));
|
||||
}
|
||||
CertificateFactory cf = CertificateFactory.getInstance("X509");
|
||||
path = cf.generateCertPath(list);
|
||||
|
||||
anchors = Collections.singleton(anchor);
|
||||
params = new PKIXParameters(anchors);
|
||||
params.setRevocationEnabled(false);
|
||||
}
|
||||
|
||||
/**
|
||||
* Get a DER-encoded X.509 certificate from a file.
|
||||
*
|
||||
* @param certFilePath path to file containing DER-encoded certificate
|
||||
* @return X509Certificate
|
||||
* @throws IOException on error
|
||||
*/
|
||||
public static X509Certificate getCertFromFile(String certFilePath)
|
||||
throws IOException {
|
||||
X509Certificate cert = null;
|
||||
try {
|
||||
File certFile = new File(System.getProperty("test.src", "."),
|
||||
certFilePath);
|
||||
FileInputStream certFileInputStream =
|
||||
new FileInputStream(certFile);
|
||||
CertificateFactory cf = CertificateFactory.getInstance("X509");
|
||||
cert = (X509Certificate)
|
||||
cf.generateCertificate(certFileInputStream);
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
throw new IOException("Can't construct X509Certificate: " +
|
||||
e.getMessage());
|
||||
}
|
||||
return cert;
|
||||
}
|
||||
|
||||
/**
|
||||
* Perform a PKIX validation.
|
||||
*
|
||||
* @param path CertPath to validate
|
||||
* @param params PKIXParameters to use in validation
|
||||
* @throws Exception on error
|
||||
*/
|
||||
public static void validate(CertPath path, PKIXParameters params)
|
||||
throws Exception {
|
||||
CertPathValidator validator =
|
||||
CertPathValidator.getInstance("PKIX", "SUN");
|
||||
CertPathValidatorResult cpvr = validator.validate(path, params);
|
||||
}
|
||||
|
||||
/**
|
||||
* Perform a PKIX build.
|
||||
*
|
||||
* @param params PKIXBuilderParameters to use in the build
|
||||
* @throws Exception on error
|
||||
*/
|
||||
public static void build(PKIXBuilderParameters params)
|
||||
throws Exception {
|
||||
CertPathBuilder builder =
|
||||
CertPathBuilder.getInstance("PKIX", "SUN");
|
||||
CertPathBuilderResult cpbr = builder.build(params);
|
||||
}
|
||||
}
|
||||
Binary file not shown.
Binary file not shown.
Loading…
Add table
Add a link
Reference in a new issue