undefect. CWE-407 — 63 sites patched across 27 ecosystems
Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com Patches, unit tests, benchmarks, whitepaper, and outreach briefs. Public domain — no copyright claimed. Use freely.
This commit is contained in:
commit
0a580b313d
70422 changed files with 17213626 additions and 0 deletions
|
|
@ -0,0 +1,17 @@
|
|||
-----BEGIN CERTIFICATE-----
|
||||
MIICuDCCAiGgAwIBAgIBBzANBgkqhkiG9w0BAQQFADAtMQswCQYDVQQGEwJVUzEM
|
||||
MAoGA1UEChMDU3VuMRAwDgYDVQQDEwdSb290IENBMB4XDTA3MDMyMzE3MTUzNloX
|
||||
DTM0MDgwODE3MTUzNlowLjELMAkGA1UEBhMCVVMxDDAKBgNVBAoTA1N1bjERMA8G
|
||||
A1UEAxMIUm9iIEZvbGswgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAJ+BDk0i
|
||||
pXPQrwt7THIXD0sdbJLaMjsSynGheimobX0NAtYOKllWBmBC5bkHCkvjekbprSyV
|
||||
GnwBeEwrJRwfdnfmTyibyinFeB723lN/NQ8LbPSoZTo8Gdkp5193H4SFqfrWCRZ9
|
||||
4RYnmmqS7Ut5PWR5vlsMqktwx0qXlD0kq9TNAgMBAAGjgeYwgeMwCQYDVR0TBAIw
|
||||
ADAsBglghkgBhvhCAQ0EHxYdT3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUw
|
||||
HQYDVR0OBBYEFJn9r1+sySfqvyggruKsdeeaF6qsMFUGA1UdIwROMEyAFB1J2ChQ
|
||||
l8QDIVxcr/9Eio/dNxUkoTGkLzAtMQswCQYDVQQGEwJVUzEMMAoGA1UEChMDU3Vu
|
||||
MRAwDgYDVQQDEwdSb290IENBggEAMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcw
|
||||
AYYWaHR0cDovL2xvY2FsaG9zdDo4ODg4LzANBgkqhkiG9w0BAQQFAAOBgQCOflBZ
|
||||
wXCydtjJ0TGT6/8cZxOYAK0Gy8Nz2GLtYm6N+Dip1HZei+8SOY8VsitURdAb6d60
|
||||
PbJiHHcACdVaK2JLdijTr6xKi2AS6/qtjlxwLV5goX4mRl8W/xQhEf2KkT6cuUP0
|
||||
rM6Lq/qODnJfkhT8s/kUsFDUzNenK0QcCiC6og==
|
||||
-----END CERTIFICATE-----
|
||||
109
test/jdk/java/security/cert/CertPathValidator/OCSP/AIACheck.java
Normal file
109
test/jdk/java/security/cert/CertPathValidator/OCSP/AIACheck.java
Normal file
|
|
@ -0,0 +1,109 @@
|
|||
/*
|
||||
* Copyright (c) 2004, 2015, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
//
|
||||
// Security properties, once set, cannot revert to unset. To avoid
|
||||
// conflicts with tests running in the same VM isolate this test by
|
||||
// running it in otherVM mode.
|
||||
//
|
||||
|
||||
/**
|
||||
* @test
|
||||
* @bug 5072953
|
||||
* @summary Verify that the URL for an OCSP responder can be extracted from a
|
||||
* certificate's AuthorityInfoAccess extension when OCSP certifiate
|
||||
* validation has been enabled.
|
||||
* @run main/othervm AIACheck
|
||||
*/
|
||||
|
||||
import java.io.*;
|
||||
import java.net.*;
|
||||
import java.util.*;
|
||||
import java.security.Security;
|
||||
import java.security.cert.*;
|
||||
|
||||
public class AIACheck {
|
||||
|
||||
private final static File baseDir =
|
||||
new File(System.getProperty("test.src", "."));
|
||||
|
||||
private static X509Certificate loadCertificate(String name)
|
||||
throws Exception
|
||||
{
|
||||
File certFile = new File(baseDir, name);
|
||||
InputStream in = new FileInputStream(certFile);
|
||||
CertificateFactory cf = CertificateFactory.getInstance("X.509");
|
||||
X509Certificate cert = (X509Certificate)cf.generateCertificate(in);
|
||||
return cert;
|
||||
}
|
||||
|
||||
public static void main(String args[]) throws Exception {
|
||||
// MD5 is used in this test case, don't disable MD5 algorithm.
|
||||
Security.setProperty(
|
||||
"jdk.certpath.disabledAlgorithms", "MD2, RSA keySize < 1024");
|
||||
|
||||
X509Certificate aiaCert = loadCertificate("AIACert.pem");
|
||||
X509Certificate rootCert = loadCertificate("RootCert.pem");
|
||||
|
||||
List<X509Certificate> list =
|
||||
//Arrays.asList(new X509Certificate[] {aiaCert, rootCert});
|
||||
Arrays.asList(new X509Certificate[] {aiaCert});
|
||||
CertificateFactory cf = CertificateFactory.getInstance("X.509");
|
||||
CertPath path = cf.generateCertPath(list);
|
||||
|
||||
TrustAnchor anchor = new TrustAnchor(rootCert, null);
|
||||
Set<TrustAnchor> anchors = Collections.singleton(anchor);
|
||||
|
||||
PKIXParameters params = new PKIXParameters(anchors);
|
||||
// Activate certificate revocation checking
|
||||
params.setRevocationEnabled(true);
|
||||
|
||||
// Activate OCSP
|
||||
Security.setProperty("ocsp.enable", "true");
|
||||
|
||||
// Ensure that the ocsp.responderURL property is not set.
|
||||
if (Security.getProperty("ocsp.responderURL") != null) {
|
||||
throw new
|
||||
Exception("The ocsp.responderURL property must not be set");
|
||||
}
|
||||
|
||||
CertPathValidator validator = CertPathValidator.getInstance("PKIX");
|
||||
|
||||
try {
|
||||
validator.validate(path, params);
|
||||
throw new Exception("Successfully validated an invalid path");
|
||||
|
||||
} catch (CertPathValidatorException e ) {
|
||||
Throwable rootCause = e.getCause();
|
||||
if (!(rootCause instanceof SocketException ||
|
||||
rootCause instanceof SocketTimeoutException)) {
|
||||
throw e;
|
||||
}
|
||||
|
||||
// Success - client located OCSP responder in AIA extension
|
||||
// and attempted to connect.
|
||||
System.out.println("Extracted the URL of the OCSP responder from " +
|
||||
"the certificate's AuthorityInfoAccess extension.");
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,281 @@
|
|||
/*
|
||||
* Copyright (c) 2009, 2025, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
//
|
||||
// Security properties, once set, cannot revert to unset. To avoid
|
||||
// conflicts with tests running in the same VM isolate this test by
|
||||
// running it in otherVM mode.
|
||||
//
|
||||
|
||||
/**
|
||||
* @test
|
||||
* @bug 6383095
|
||||
* @summary CRL revoked certificate failures masked by OCSP failures
|
||||
* @run main/othervm FailoverToCRL
|
||||
* @enablePreview
|
||||
* @author Xuelei Fan
|
||||
*/
|
||||
|
||||
/*
|
||||
* Note that the certificate validity is from Mar 16 14:55:35 2009 GMT to
|
||||
* Dec 1 14:55:35 2028 GMT, please update it with newer certificate if
|
||||
* expires.
|
||||
*/
|
||||
|
||||
/*
|
||||
* Certificates used in the test.
|
||||
*
|
||||
* end entity certificate:
|
||||
* Data:
|
||||
* Version: 3 (0x2)
|
||||
* Serial Number: 25 (0x19)
|
||||
* Signature Algorithm: md5WithRSAEncryption
|
||||
* Issuer: C=US, ST=Some-State, L=Some-City, O=Some-Org
|
||||
* Validity
|
||||
* Not Before: Mar 16 14:55:35 2009 GMT
|
||||
* Not After : Dec 1 14:55:35 2028 GMT
|
||||
* Subject: C=US, ST=Some-State, L=Some-City, O=Some-Org, OU=SSL-Client,
|
||||
* CN=localhost
|
||||
* Subject Public Key Info:
|
||||
* Public Key Algorithm: rsaEncryption
|
||||
* RSA Public Key: (1024 bit)
|
||||
* Modulus (1024 bit):
|
||||
* 00:bb:f0:40:36:ac:26:54:4e:f4:a3:5a:00:2f:69:
|
||||
* 21:6f:b9:7a:3a:93:ec:a2:f6:e1:8e:c7:63:d8:2f:
|
||||
* 12:30:99:2e:b0:f2:8f:f8:27:2d:24:78:28:84:f7:
|
||||
* 01:bf:8d:44:79:dd:3b:d2:55:f3:ce:3c:b2:5b:21:
|
||||
* 7d:ef:fd:33:4a:b1:a3:ff:c6:c8:9b:b9:0f:7c:41:
|
||||
* 35:97:f9:db:3a:05:60:05:15:af:59:17:92:a3:10:
|
||||
* ad:16:1c:e4:07:53:af:a8:76:a2:56:2a:92:d3:f9:
|
||||
* 28:e0:78:cf:5e:1f:48:ab:5c:19:dd:e1:67:43:ba:
|
||||
* 75:8d:f5:82:ac:43:92:44:1b
|
||||
* Exponent: 65537 (0x10001)
|
||||
* X509v3 extensions:
|
||||
* X509v3 Basic Constraints:
|
||||
* CA:FALSE
|
||||
* X509v3 Key Usage:
|
||||
* Digital Signature, Non Repudiation, Key Encipherment
|
||||
* X509v3 Subject Key Identifier:
|
||||
* CD:BB:C8:85:AA:91:BD:FD:1D:BE:CD:67:7C:FF:B3:E9:4C:A8:22:E6
|
||||
* X509v3 Authority Key Identifier:
|
||||
* keyid:FA:B9:51:BF:4C:E7:D9:86:98:33:F9:E7:CB:1E:F1:33:49:F7:A8:14
|
||||
* Signature Algorithm: md5WithRSAEncryption
|
||||
*
|
||||
*
|
||||
* trusted certificate authority:
|
||||
* Data:
|
||||
* Version: 3 (0x2)
|
||||
* Serial Number: 0 (0x0)
|
||||
* Signature Algorithm: md5WithRSAEncryption
|
||||
* Issuer: C=US, ST=Some-State, L=Some-City, O=Some-Org
|
||||
* Validity
|
||||
* Not Before: Dec 8 02:43:36 2008 GMT
|
||||
* Not After : Aug 25 02:43:36 2028 GMT
|
||||
* Subject: C=US, ST=Some-State, L=Some-City, O=Some-Org
|
||||
* Subject Public Key Info:
|
||||
* Public Key Algorithm: rsaEncryption
|
||||
* RSA Public Key: (1024 bit)
|
||||
* Modulus (1024 bit):
|
||||
* 00:cb:c4:38:20:07:be:88:a7:93:b0:a1:43:51:2d:
|
||||
* d7:8e:85:af:54:dd:ad:a2:7b:23:5b:cf:99:13:53:
|
||||
* 99:45:7d:ee:6d:ba:2d:bf:e3:ad:6e:3d:9f:1a:f9:
|
||||
* 03:97:e0:17:55:ae:11:26:57:de:01:29:8e:05:3f:
|
||||
* 21:f7:e7:36:e8:2e:37:d7:48:ac:53:d6:60:0e:c7:
|
||||
* 50:6d:f6:c5:85:f7:8b:a6:c5:91:35:72:3c:94:ee:
|
||||
* f1:17:f0:71:e3:ec:1b:ce:ca:4e:40:42:b0:6d:ee:
|
||||
* 6a:0e:d6:e5:ad:3c:0f:c9:ba:82:4f:78:f8:89:97:
|
||||
* 89:2a:95:12:4c:d8:09:2a:e9
|
||||
* Exponent: 65537 (0x10001)
|
||||
* X509v3 extensions:
|
||||
* X509v3 Subject Key Identifier:
|
||||
* FA:B9:51:BF:4C:E7:D9:86:98:33:F9:E7:CB:1E:F1:33:49:F7:A8:14
|
||||
* X509v3 Authority Key Identifier:
|
||||
* keyid:FA:B9:51:BF:4C:E7:D9:86:98:33:F9:E7:CB:1E:F1:33:49:F7:A8:14
|
||||
* DirName:/C=US/ST=Some-State/L=Some-City/O=Some-Org
|
||||
* X509v3 Basic Constraints:
|
||||
* CA:TRUE
|
||||
* Signature Algorithm: md5WithRSAEncryption
|
||||
*
|
||||
* CRL:
|
||||
* Certificate Revocation List (CRL):
|
||||
* Version 2 (0x1)
|
||||
* Signature Algorithm: md5WithRSAEncryption
|
||||
* Issuer: /C=US/ST=Some-State/L=Some-City/O=Some-Org
|
||||
* Last Update: Mar 16 16:27:14 2009 GMT
|
||||
* Next Update: May 15 16:27:14 2028 GMT
|
||||
* CRL extensions:
|
||||
* X509v3 CRL Number:
|
||||
* 2
|
||||
* Revoked Certificates:
|
||||
* Serial Number: 19
|
||||
* Revocation Date: Mar 16 16:22:08 2009 GMT
|
||||
* CRL entry extensions:
|
||||
* X509v3 CRL Reason Code:
|
||||
* Superseded
|
||||
* Signature Algorithm: md5WithRSAEncryption
|
||||
*/
|
||||
|
||||
import java.io.*;
|
||||
import java.net.SocketException;
|
||||
import java.security.DEREncodable;
|
||||
import java.security.PEMDecoder;
|
||||
import java.util.*;
|
||||
import java.security.Security;
|
||||
import java.security.cert.*;
|
||||
import java.security.InvalidAlgorithmParameterException;
|
||||
import java.security.cert.CertPathValidatorException.BasicReason;
|
||||
import java.util.Collections;
|
||||
|
||||
public class FailoverToCRL {
|
||||
|
||||
static String trusedCertStr =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIICrDCCAhWgAwIBAgIBADANBgkqhkiG9w0BAQQFADBJMQswCQYDVQQGEwJVUzET\n" +
|
||||
"MBEGA1UECBMKU29tZS1TdGF0ZTESMBAGA1UEBxMJU29tZS1DaXR5MREwDwYDVQQK\n" +
|
||||
"EwhTb21lLU9yZzAeFw0wODEyMDgwMjQzMzZaFw0yODA4MjUwMjQzMzZaMEkxCzAJ\n" +
|
||||
"BgNVBAYTAlVTMRMwEQYDVQQIEwpTb21lLVN0YXRlMRIwEAYDVQQHEwlTb21lLUNp\n" +
|
||||
"dHkxETAPBgNVBAoTCFNvbWUtT3JnMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB\n" +
|
||||
"gQDLxDggB76Ip5OwoUNRLdeOha9U3a2ieyNbz5kTU5lFfe5tui2/461uPZ8a+QOX\n" +
|
||||
"4BdVrhEmV94BKY4FPyH35zboLjfXSKxT1mAOx1Bt9sWF94umxZE1cjyU7vEX8HHj\n" +
|
||||
"7BvOyk5AQrBt7moO1uWtPA/JuoJPePiJl4kqlRJM2Akq6QIDAQABo4GjMIGgMB0G\n" +
|
||||
"A1UdDgQWBBT6uVG/TOfZhpgz+efLHvEzSfeoFDBxBgNVHSMEajBogBT6uVG/TOfZ\n" +
|
||||
"hpgz+efLHvEzSfeoFKFNpEswSTELMAkGA1UEBhMCVVMxEzARBgNVBAgTClNvbWUt\n" +
|
||||
"U3RhdGUxEjAQBgNVBAcTCVNvbWUtQ2l0eTERMA8GA1UEChMIU29tZS1PcmeCAQAw\n" +
|
||||
"DAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQQFAAOBgQBcIm534U123Hz+rtyYO5uA\n" +
|
||||
"ofd81G6FnTfEAV8Kw9fGyyEbQZclBv34A9JsFKeMvU4OFIaixD7nLZ/NZ+IWbhmZ\n" +
|
||||
"LovmJXyCkOufea73pNiZ+f/4/ScZaIlM/PRycQSqbFNd4j9Wott+08qxHPLpsf3P\n" +
|
||||
"6Mvf0r1PNTY2hwTJLJmKtg==\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
static String targetCertStr =
|
||||
"-----BEGIN CERTIFICATE-----\n" +
|
||||
"MIICizCCAfSgAwIBAgIBGTANBgkqhkiG9w0BAQQFADBJMQswCQYDVQQGEwJVUzET\n" +
|
||||
"MBEGA1UECBMKU29tZS1TdGF0ZTESMBAGA1UEBxMJU29tZS1DaXR5MREwDwYDVQQK\n" +
|
||||
"EwhTb21lLU9yZzAeFw0wOTAzMTYxNDU1MzVaFw0yODEyMDExNDU1MzVaMHIxCzAJ\n" +
|
||||
"BgNVBAYTAlVTMRMwEQYDVQQIEwpTb21lLVN0YXRlMRIwEAYDVQQHEwlTb21lLUNp\n" +
|
||||
"dHkxETAPBgNVBAoTCFNvbWUtT3JnMRMwEQYDVQQLEwpTU0wtQ2xpZW50MRIwEAYD\n" +
|
||||
"VQQDEwlsb2NhbGhvc3QwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALvwQDas\n" +
|
||||
"JlRO9KNaAC9pIW+5ejqT7KL24Y7HY9gvEjCZLrDyj/gnLSR4KIT3Ab+NRHndO9JV\n" +
|
||||
"8848slshfe/9M0qxo//GyJu5D3xBNZf52zoFYAUVr1kXkqMQrRYc5AdTr6h2olYq\n" +
|
||||
"ktP5KOB4z14fSKtcGd3hZ0O6dY31gqxDkkQbAgMBAAGjWjBYMAkGA1UdEwQCMAAw\n" +
|
||||
"CwYDVR0PBAQDAgXgMB0GA1UdDgQWBBTNu8iFqpG9/R2+zWd8/7PpTKgi5jAfBgNV\n" +
|
||||
"HSMEGDAWgBT6uVG/TOfZhpgz+efLHvEzSfeoFDANBgkqhkiG9w0BAQQFAAOBgQBv\n" +
|
||||
"p7JjCDOrMBNun46xs4Gz7Y4ygM5VHaFP0oO7369twvRSu0pCuIdZd5OIMPFeRqQw\n" +
|
||||
"PA68ZdhYVR0pG5W7isV+jB+Dfge/IOgOA85sZ/6FlP3PBRW+YMQKKdRr5So3ook9\n" +
|
||||
"PimQ7rbxRAofPECv20IUKFBbOUkU+gFcn+WbTKYxBw==\n" +
|
||||
"-----END CERTIFICATE-----";
|
||||
|
||||
static String crlStr =
|
||||
"-----BEGIN X509 CRL-----\n" +
|
||||
"MIIBRTCBrwIBATANBgkqhkiG9w0BAQQFADBJMQswCQYDVQQGEwJVUzETMBEGA1UE\n" +
|
||||
"CBMKU29tZS1TdGF0ZTESMBAGA1UEBxMJU29tZS1DaXR5MREwDwYDVQQKEwhTb21l\n" +
|
||||
"LU9yZxcNMDkwMzE2MTYyNzE0WhcNMjgwNTE1MTYyNzE0WjAiMCACARkXDTA5MDMx\n" +
|
||||
"NjE2MjIwOFowDDAKBgNVHRUEAwoBBKAOMAwwCgYDVR0UBAMCAQIwDQYJKoZIhvcN\n" +
|
||||
"AQEEBQADgYEAMixJI9vBwYpOGosn46+T/MTEtlm2S5pIVT/xPDrHkCPfw8l4Zrgp\n" +
|
||||
"dGPuUkglWdrGdxY9MNRUj2YFNfdZi6zZ7JF6XbkDHYOAKYgPDJRjS/0VcBntn5RJ\n" +
|
||||
"sQfZsBqc9fFSP8gknRRn3LT41kr9xNRxTT1t3YYjv7J3zkMYyInqeUA=\n" +
|
||||
"-----END X509 CRL-----";
|
||||
|
||||
|
||||
private static final PEMDecoder PEM_DECODER = PEMDecoder.of();
|
||||
|
||||
private static CertPath generateCertificatePath()
|
||||
throws CertificateException, IOException {
|
||||
// generate certificate from cert strings
|
||||
CertificateFactory cf = CertificateFactory.getInstance("X.509");
|
||||
|
||||
ByteArrayInputStream is =
|
||||
new ByteArrayInputStream(targetCertStr.getBytes());
|
||||
|
||||
// generate certification path
|
||||
List<Certificate> list = Collections.singletonList(PEM_DECODER.decode
|
||||
(is, X509Certificate.class));
|
||||
|
||||
return cf.generateCertPath(list);
|
||||
}
|
||||
|
||||
private static Set<TrustAnchor> generateTrustAnchors() {
|
||||
// generate certificate from cert string
|
||||
X509Certificate trustedCert = PEM_DECODER.decode(trusedCertStr, X509Certificate.class);
|
||||
|
||||
// generate a trust anchor
|
||||
TrustAnchor anchor = new TrustAnchor(trustedCert, null);
|
||||
|
||||
return Collections.singleton(anchor);
|
||||
}
|
||||
|
||||
private static CertStore generateCertificateStore() throws Exception {
|
||||
// generate CRL from CRL string
|
||||
CertificateFactory cf = CertificateFactory.getInstance("X.509");
|
||||
|
||||
ByteArrayInputStream is =
|
||||
new ByteArrayInputStream(crlStr.getBytes());
|
||||
|
||||
// generate a cert store
|
||||
Collection<DEREncodable> crls = new HashSet<>();
|
||||
|
||||
crls.add(PEM_DECODER.decode(crlStr, X509CRL.class));
|
||||
|
||||
return CertStore.getInstance("Collection",
|
||||
new CollectionCertStoreParameters(crls));
|
||||
}
|
||||
|
||||
public static void main(String args[]) throws Exception {
|
||||
// MD5 is used in this test case, don't disable MD5 algorithm.
|
||||
Security.setProperty(
|
||||
"jdk.certpath.disabledAlgorithms", "MD2, RSA keySize < 1024");
|
||||
|
||||
CertPath path = generateCertificatePath();
|
||||
Set<TrustAnchor> anchors = generateTrustAnchors();
|
||||
CertStore crls = generateCertificateStore();
|
||||
|
||||
PKIXParameters params = new PKIXParameters(anchors);
|
||||
|
||||
// add the CRL store
|
||||
params.addCertStore(crls);
|
||||
|
||||
// Activate certificate revocation checking
|
||||
params.setRevocationEnabled(true);
|
||||
|
||||
// Activate OCSP
|
||||
Security.setProperty("ocsp.enable", "true");
|
||||
System.setProperty("com.sun.security.enableCRLDP", "true");
|
||||
|
||||
// Ensure that the ocsp.responderURL property is not set.
|
||||
if (Security.getProperty("ocsp.responderURL") != null) {
|
||||
throw new
|
||||
Exception("The ocsp.responderURL property must not be set");
|
||||
}
|
||||
|
||||
CertPathValidator validator = CertPathValidator.getInstance("PKIX");
|
||||
|
||||
try {
|
||||
validator.validate(path, params);
|
||||
} catch (CertPathValidatorException cpve) {
|
||||
if (cpve.getReason() != BasicReason.REVOKED) {
|
||||
throw new Exception(
|
||||
"unexpected exception, should be a REVOKED CPVE", cpve);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,267 @@
|
|||
/*
|
||||
* Copyright (c) 2020, 2025, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
/**
|
||||
* @test
|
||||
* @bug 8179503 8328638
|
||||
* @summary Java should support GET OCSP calls
|
||||
* @library /javax/net/ssl/templates /test/lib
|
||||
* @modules java.base/sun.security.util
|
||||
* java.base/sun.security.provider.certpath
|
||||
* java.base/sun.security.x509
|
||||
* @run main/othervm GetAndPostTests
|
||||
* @run main/othervm -Dcom.sun.security.ocsp.useget=false GetAndPostTests
|
||||
* @run main/othervm -Dcom.sun.security.ocsp.useget=foo GetAndPostTests
|
||||
*/
|
||||
|
||||
import java.io.ByteArrayInputStream;
|
||||
import java.io.IOException;
|
||||
import java.io.OutputStream;
|
||||
import java.net.URI;
|
||||
import java.security.GeneralSecurityException;
|
||||
import java.security.KeyFactory;
|
||||
import java.security.KeyStore;
|
||||
import java.security.PrivateKey;
|
||||
import java.security.SecureRandom;
|
||||
import java.security.cert.CertPath;
|
||||
import java.security.cert.CertPathValidator;
|
||||
import java.security.cert.Certificate;
|
||||
import java.security.cert.CertificateException;
|
||||
import java.security.cert.CertificateFactory;
|
||||
import java.security.cert.Extension;
|
||||
import java.security.cert.PKIXCertPathChecker;
|
||||
import java.security.cert.PKIXParameters;
|
||||
import java.security.cert.PKIXRevocationChecker;
|
||||
import java.security.cert.TrustAnchor;
|
||||
import java.security.cert.X509Certificate;
|
||||
import java.security.spec.PKCS8EncodedKeySpec;
|
||||
import java.util.Base64;
|
||||
import java.util.Date;
|
||||
import java.util.List;
|
||||
import java.util.Map;
|
||||
import java.util.Objects;
|
||||
import java.util.Set;
|
||||
import java.util.concurrent.TimeUnit;
|
||||
|
||||
import jdk.test.lib.security.SimpleOCSPServer;
|
||||
import sun.security.util.DerOutputStream;
|
||||
import sun.security.util.DerValue;
|
||||
import sun.security.util.ObjectIdentifier;
|
||||
|
||||
public class GetAndPostTests {
|
||||
private static final String PASS = "passphrase";
|
||||
private static final int SERVER_WAIT_SECS = 60;
|
||||
private static CertificateFactory certFac;
|
||||
|
||||
public static void main(String args[]) throws Exception {
|
||||
SimpleOCSPServer ocspResponder = null;
|
||||
|
||||
try {
|
||||
certFac = CertificateFactory.getInstance("X.509");
|
||||
|
||||
// Read in the certificates and keys needed for this test and
|
||||
// create the keystore for the SimpleOCSPServer. For the purposes
|
||||
// of this test, the CA certificate will also be the OCSP responder
|
||||
// signing certificate.
|
||||
SSLSocketTemplate.Cert certAuth =
|
||||
SSLSocketTemplate.Cert.CA_ECDSA_SECP256R1;
|
||||
X509Certificate caCert = pem2Cert(certAuth.certStr);
|
||||
PrivateKey caKey = pem2Key(certAuth.privKeyStr, certAuth.keyAlgo);
|
||||
X509Certificate endEntCert =
|
||||
pem2Cert(SSLSocketTemplate.Cert.EE_ECDSA_SECP256R1.certStr);
|
||||
|
||||
KeyStore.Builder keyStoreBuilder =
|
||||
KeyStore.Builder.newInstance("PKCS12", null,
|
||||
new KeyStore.PasswordProtection(PASS.toCharArray()));
|
||||
KeyStore ocspStore = keyStoreBuilder.getKeyStore();
|
||||
Certificate[] ocspChain = {caCert};
|
||||
ocspStore.setKeyEntry("ocspsigner", caKey, PASS.toCharArray(),
|
||||
ocspChain);
|
||||
|
||||
// Create the certificate path we'll use for cert path validation.
|
||||
CertPath path = certFac.generateCertPath(List.of(endEntCert));
|
||||
|
||||
// Next, create and start the OCSP responder. Obtain the socket
|
||||
// address so we can set that in the PKIXRevocationChecker since
|
||||
// these certificates do not have AIA extensions on them.
|
||||
ocspResponder = new SimpleOCSPServer(ocspStore, PASS,
|
||||
"ocspsigner", null);
|
||||
ocspResponder.setSignatureAlgorithm("SHA256WithECDSA");
|
||||
ocspResponder.enableLog(true);
|
||||
ocspResponder.setNextUpdateInterval(3600);
|
||||
ocspResponder.updateStatusDb(Map.of(
|
||||
endEntCert.getSerialNumber(),
|
||||
new SimpleOCSPServer.CertStatusInfo(
|
||||
SimpleOCSPServer.CertStatus.CERT_STATUS_GOOD)));
|
||||
|
||||
startOcspServer(ocspResponder);
|
||||
|
||||
int ocspPort = ocspResponder.getPort();
|
||||
URI ocspURI = new URI("http://localhost:" + ocspPort);
|
||||
System.out.println("Configured CPV to connect to " + ocspURI);
|
||||
|
||||
// Create the PKIXParameters needed for path validation and
|
||||
// configure any necessary OCSP parameters to control the OCSP
|
||||
// request size.
|
||||
Set<TrustAnchor> anchors = Set.of(new TrustAnchor(caCert, null));
|
||||
|
||||
CertPathValidator validator = CertPathValidator.getInstance("PKIX");
|
||||
PKIXRevocationChecker revChkr =
|
||||
(PKIXRevocationChecker)validator.getRevocationChecker();
|
||||
revChkr.setOcspResponder(ocspURI);
|
||||
revChkr.setOptions(Set.of(
|
||||
PKIXRevocationChecker.Option.ONLY_END_ENTITY,
|
||||
PKIXRevocationChecker.Option.NO_FALLBACK));
|
||||
|
||||
PKIXParameters params = new PKIXParameters(anchors);
|
||||
params.setRevocationEnabled(true);
|
||||
params.setDate(new Date(1590926400000L)); // 05/31/2020 @ 12:00:00Z
|
||||
params.addCertPathChecker(revChkr);
|
||||
|
||||
System.out.println("Test 1: Request < 255 bytes, HTTP GET");
|
||||
validator.validate(path, params);
|
||||
|
||||
System.out.println("Test 2: Request > 255 bytes, HTTP POST");
|
||||
// Modify the PKIXRevocationChecker to include a bogus non-critical
|
||||
// request extension that makes the request large enough to be
|
||||
// issued as an HTTP POST.
|
||||
List<PKIXCertPathChecker> chkrList = params.getCertPathCheckers();
|
||||
for (PKIXCertPathChecker chkr : chkrList) {
|
||||
if (chkr instanceof PKIXRevocationChecker) {
|
||||
((PKIXRevocationChecker)chkr).setOcspExtensions(
|
||||
List.of(new BogusExtension("1.2.3.4.5.6.7.8.9",
|
||||
false, 256)));
|
||||
}
|
||||
}
|
||||
params.setCertPathCheckers(chkrList);
|
||||
validator.validate(path, params);
|
||||
|
||||
} finally {
|
||||
if (ocspResponder != null) {
|
||||
ocspResponder.stop();
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
private static void startOcspServer(SimpleOCSPServer ocspResponder) throws InterruptedException, IOException {
|
||||
ocspResponder.start();
|
||||
if (!ocspResponder.awaitServerReady(SERVER_WAIT_SECS, TimeUnit.SECONDS)) {
|
||||
throw new RuntimeException("Server not ready after " + SERVER_WAIT_SECS
|
||||
+ " seconds.");
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Create an X509Certificate object from its PEM encoding
|
||||
*
|
||||
* @param pemCert the base64 encoded certificate
|
||||
*
|
||||
* @return the corresponding X509Certificate object from the PEM encoding.
|
||||
*
|
||||
* @throws IOException if any InputStream or Base64 decoding failures occur.
|
||||
* @throws CertificateException if any certificate parsing errors occur.
|
||||
*/
|
||||
private static X509Certificate pem2Cert(String pemCert)
|
||||
throws IOException, CertificateException {
|
||||
return (X509Certificate)certFac.generateCertificate(
|
||||
new ByteArrayInputStream(pemCert.getBytes()));
|
||||
}
|
||||
|
||||
/**
|
||||
* Create a private key from its PEM-encoded PKCS#8 representation.
|
||||
*
|
||||
* @param pemKey the private key in PEM-encoded PKCS#8 unencrypted format
|
||||
* @param algorithm the private key algorithm
|
||||
*
|
||||
* @return the PrivateKey extracted from the PKCS#8 encoding.
|
||||
*
|
||||
* @throws GeneralSecurityException if any errors take place during
|
||||
* decoding or parsing.
|
||||
*/
|
||||
private static PrivateKey pem2Key(String pemKey, String algorithm)
|
||||
throws GeneralSecurityException {
|
||||
byte[] p8Der = Base64.getMimeDecoder().decode(pemKey);
|
||||
PKCS8EncodedKeySpec spec = new PKCS8EncodedKeySpec(p8Der, algorithm);
|
||||
KeyFactory kf = KeyFactory.getInstance(algorithm);
|
||||
return kf.generatePrivate(spec);
|
||||
}
|
||||
|
||||
/**
|
||||
* The BogusOcspExtension is an extension with random data in the
|
||||
* extension value field. It is used in this test to expand the size
|
||||
* of the OCSP request so it crosses the boundary that forces an HTTP
|
||||
* POST operation instead of a GET.
|
||||
*/
|
||||
private static class BogusExtension implements Extension {
|
||||
private final ObjectIdentifier oid;
|
||||
private final boolean critical;
|
||||
private final byte[] data;
|
||||
|
||||
public BogusExtension(String oidStr, boolean isCrit, int size)
|
||||
throws IOException {
|
||||
// For this test we don't need anything larger than 10K
|
||||
if (size > 0 && size <= 10240) {
|
||||
data = new byte[size];
|
||||
} else {
|
||||
throw new IllegalArgumentException(
|
||||
"Size must be 0 < X <= 10240");
|
||||
}
|
||||
oid = ObjectIdentifier.of(oidStr);
|
||||
SecureRandom sr = new SecureRandom();
|
||||
sr.nextBytes(data);
|
||||
critical = isCrit;
|
||||
}
|
||||
|
||||
@Override
|
||||
public String getId() {
|
||||
return oid.toString();
|
||||
}
|
||||
|
||||
@Override
|
||||
public boolean isCritical() {
|
||||
return critical;
|
||||
}
|
||||
|
||||
@Override
|
||||
public byte[] getValue() {
|
||||
return data.clone();
|
||||
}
|
||||
|
||||
@Override
|
||||
public void encode(OutputStream out) throws IOException {
|
||||
Objects.requireNonNull(out, "Non-null OutputStream required");
|
||||
|
||||
DerOutputStream dos1 = new DerOutputStream();
|
||||
DerOutputStream dos2 = new DerOutputStream();
|
||||
|
||||
dos1.putOID(oid);
|
||||
if (critical) {
|
||||
dos1.putBoolean(critical);
|
||||
}
|
||||
dos1.putOctetString(data);
|
||||
|
||||
dos2.write(DerValue.tag_Sequence, dos1);
|
||||
out.write(dos2.toByteArray());
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,300 @@
|
|||
/*
|
||||
* Copyright (c) 2023, 2025, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
//
|
||||
// Security properties, once set, cannot revert to unset. To avoid
|
||||
// conflicts with tests running in the same VM isolate this test by
|
||||
// running it in otherVM mode.
|
||||
//
|
||||
|
||||
/**
|
||||
* @test
|
||||
* @bug 8179502
|
||||
* @summary Enhance OCSP, CRL and Certificate Fetch Timeouts
|
||||
* @modules java.base/sun.security.x509
|
||||
* java.base/sun.security.provider.certpath
|
||||
* java.base/sun.security.util
|
||||
* @library /test/lib
|
||||
* @run main/othervm -Djava.security.debug=certpath OCSPTimeout 1000 true
|
||||
* @run main/othervm -Djava.security.debug=certpath
|
||||
* -Dcom.sun.security.ocsp.readtimeout=5 OCSPTimeout 1000 true
|
||||
* @run main/othervm -Djava.security.debug=certpath
|
||||
* -Dcom.sun.security.ocsp.readtimeout=1 OCSPTimeout 5000 false
|
||||
* @run main/othervm -Djava.security.debug=certpath
|
||||
* -Dcom.sun.security.ocsp.readtimeout=1s OCSPTimeout 5000 false
|
||||
* @run main/othervm -Djava.security.debug=certpath
|
||||
* -Dcom.sun.security.ocsp.readtimeout=1500ms OCSPTimeout 5000 false
|
||||
* @run main/othervm -Djava.security.debug=certpath
|
||||
* -Dcom.sun.security.ocsp.readtimeout=4500ms OCSPTimeout 1000 true
|
||||
*/
|
||||
|
||||
import java.io.*;
|
||||
import java.math.BigInteger;
|
||||
import java.net.*;
|
||||
import java.security.*;
|
||||
import java.security.cert.Certificate;
|
||||
import java.security.spec.ECGenParameterSpec;
|
||||
import java.util.*;
|
||||
import java.security.cert.*;
|
||||
import java.util.concurrent.TimeUnit;
|
||||
|
||||
import jdk.test.lib.security.SimpleOCSPServer;
|
||||
import jdk.test.lib.security.CertificateBuilder;
|
||||
|
||||
import static java.security.cert.PKIXRevocationChecker.Option.*;
|
||||
|
||||
public class OCSPTimeout {
|
||||
|
||||
static String passwd = "passphrase";
|
||||
static String ROOT_ALIAS = "root";
|
||||
static String EE_ALIAS = "endentity";
|
||||
|
||||
// Enable debugging for additional output
|
||||
static final boolean debug = true;
|
||||
|
||||
// PKI components we will need for this test
|
||||
static X509Certificate rootCert; // The root CA certificate
|
||||
static X509Certificate eeCert; // The end entity certificate
|
||||
static KeyStore rootKeystore; // Root CA Keystore
|
||||
static KeyStore eeKeystore; // End Entity Keystore
|
||||
static KeyStore trustStore; // SSL Client trust store
|
||||
static SimpleOCSPServer rootOcsp; // Root CA OCSP Responder
|
||||
static int rootOcspPort; // Port number for root OCSP
|
||||
|
||||
public static void main(String[] args) throws Exception {
|
||||
int ocspTimeout = 15000;
|
||||
boolean expected;
|
||||
|
||||
createPKI();
|
||||
|
||||
try {
|
||||
if (args[0] != null) {
|
||||
ocspTimeout = Integer.parseInt(args[0]);
|
||||
}
|
||||
rootOcsp.setDelay(ocspTimeout);
|
||||
|
||||
expected = (args[1] != null && Boolean.parseBoolean(args[1]));
|
||||
log("Test case expects to " + (expected ? "pass" : "fail"));
|
||||
|
||||
// validate chain
|
||||
CertPathValidator cpv = CertPathValidator.getInstance("PKIX");
|
||||
PKIXRevocationChecker prc =
|
||||
(PKIXRevocationChecker) cpv.getRevocationChecker();
|
||||
prc.setOptions(EnumSet.of(NO_FALLBACK, SOFT_FAIL));
|
||||
PKIXParameters params =
|
||||
new PKIXParameters(Set.of(new TrustAnchor(rootCert, null)));
|
||||
params.addCertPathChecker(prc);
|
||||
CertificateFactory cf = CertificateFactory.getInstance("X.509");
|
||||
CertPath cp = cf.generateCertPath(List.of(eeCert));
|
||||
cpv.validate(cp, params);
|
||||
|
||||
// unwrap soft fail exceptions and check for SocketTimeoutException
|
||||
List<CertPathValidatorException> softExc = prc.getSoftFailExceptions();
|
||||
if (expected) {
|
||||
if (!softExc.isEmpty()) {
|
||||
log("Expected to pass, found " + softExc.size() +
|
||||
" soft fail exceptions");
|
||||
for (CertPathValidatorException cpve : softExc) {
|
||||
log("Exception: " + cpve);
|
||||
}
|
||||
throw new RuntimeException("Expected to pass, found " +
|
||||
softExc.size() + " soft fail exceptions");
|
||||
}
|
||||
} else {
|
||||
// If we expect to fail the validation then there should be a
|
||||
// SocketTimeoutException
|
||||
boolean found = false;
|
||||
for (CertPathValidatorException softFail : softExc) {
|
||||
log("CPVE: " + softFail);
|
||||
Throwable cause = softFail.getCause();
|
||||
log("Cause: " + cause);
|
||||
while (cause != null) {
|
||||
if (cause instanceof SocketTimeoutException) {
|
||||
found = true;
|
||||
break;
|
||||
}
|
||||
cause = cause.getCause();
|
||||
}
|
||||
if (found) {
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
if (!found) {
|
||||
throw new RuntimeException("SocketTimeoutException not thrown");
|
||||
}
|
||||
}
|
||||
} finally {
|
||||
rootOcsp.stop();
|
||||
rootOcsp.shutdownNow();
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Creates the PKI components necessary for this test, including
|
||||
* Root CA, Intermediate CA and SSL server certificates, the keystores
|
||||
* for each entity, a client trust store, and starts the OCSP responders.
|
||||
*/
|
||||
private static void createPKI() throws Exception {
|
||||
CertificateBuilder cbld = new CertificateBuilder();
|
||||
KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC");
|
||||
keyGen.initialize(new ECGenParameterSpec("secp256r1"));
|
||||
KeyStore.Builder keyStoreBuilder =
|
||||
KeyStore.Builder.newInstance("PKCS12", null,
|
||||
new KeyStore.PasswordProtection(passwd.toCharArray()));
|
||||
|
||||
// Generate Root and EE keys
|
||||
KeyPair rootCaKP = keyGen.genKeyPair();
|
||||
log("Generated Root CA KeyPair");
|
||||
KeyPair eeKP = keyGen.genKeyPair();
|
||||
log("Generated End Entity KeyPair");
|
||||
|
||||
// Set up the Root CA Cert
|
||||
cbld.setSubjectName("CN=Root CA Cert, O=SomeCompany");
|
||||
cbld.setPublicKey(rootCaKP.getPublic());
|
||||
cbld.setSerialNumber(new BigInteger("1"));
|
||||
// Make a 3 year validity starting from 60 days ago
|
||||
long start = System.currentTimeMillis() - TimeUnit.DAYS.toMillis(60);
|
||||
long end = start + TimeUnit.DAYS.toMillis(1085);
|
||||
cbld.setValidity(new Date(start), new Date(end));
|
||||
addCommonExts(cbld, rootCaKP.getPublic(), rootCaKP.getPublic());
|
||||
addCommonCAExts(cbld);
|
||||
// Make our Root CA Cert!
|
||||
rootCert = cbld.build(null, rootCaKP.getPrivate(),
|
||||
"SHA256withECDSA");
|
||||
log("Root CA Created:\n%s", certInfo(rootCert));
|
||||
|
||||
// Now build a keystore and add the keys and cert
|
||||
rootKeystore = keyStoreBuilder.getKeyStore();
|
||||
Certificate[] rootChain = {rootCert};
|
||||
rootKeystore.setKeyEntry(ROOT_ALIAS, rootCaKP.getPrivate(),
|
||||
passwd.toCharArray(), rootChain);
|
||||
|
||||
// Now fire up the OCSP responder
|
||||
rootOcsp = new SimpleOCSPServer(rootKeystore, passwd, ROOT_ALIAS, null);
|
||||
rootOcsp.enableLog(debug);
|
||||
rootOcsp.setNextUpdateInterval(3600);
|
||||
rootOcsp.start();
|
||||
|
||||
// Wait 60 seconds for server ready
|
||||
boolean readyStatus = rootOcsp.awaitServerReady(60, TimeUnit.SECONDS);
|
||||
if (!readyStatus) {
|
||||
throw new RuntimeException("Server not ready");
|
||||
}
|
||||
|
||||
rootOcspPort = rootOcsp.getPort();
|
||||
String rootRespURI = "http://localhost:" + rootOcspPort;
|
||||
log("Root OCSP Responder URI is %s", rootRespURI);
|
||||
|
||||
// Now that we have the root keystore and OCSP responder we can
|
||||
// create our end entity certificate
|
||||
cbld.reset();
|
||||
cbld.setSubjectName("CN=SSLCertificate, O=SomeCompany");
|
||||
cbld.setPublicKey(eeKP.getPublic());
|
||||
cbld.setSerialNumber(new BigInteger("4096"));
|
||||
// Make a 1 year validity starting from 7 days ago
|
||||
start = System.currentTimeMillis() - TimeUnit.DAYS.toMillis(7);
|
||||
end = start + TimeUnit.DAYS.toMillis(365);
|
||||
cbld.setValidity(new Date(start), new Date(end));
|
||||
|
||||
// Add extensions
|
||||
addCommonExts(cbld, eeKP.getPublic(), rootCaKP.getPublic());
|
||||
boolean[] kuBits = {true, false, false, false, false, false,
|
||||
false, false, false};
|
||||
cbld.addKeyUsageExt(kuBits);
|
||||
List<String> ekuOids = new ArrayList<>();
|
||||
ekuOids.add("1.3.6.1.5.5.7.3.1");
|
||||
ekuOids.add("1.3.6.1.5.5.7.3.2");
|
||||
cbld.addExtendedKeyUsageExt(ekuOids);
|
||||
cbld.addSubjectAltNameDNSExt(Collections.singletonList("localhost"));
|
||||
cbld.addAIAExt(Collections.singletonList(rootRespURI));
|
||||
// Make our End Entity Cert!
|
||||
eeCert = cbld.build(rootCert, rootCaKP.getPrivate(),
|
||||
"SHA256withECDSA");
|
||||
log("SSL Certificate Created:\n%s", certInfo(eeCert));
|
||||
|
||||
// Provide end entity cert revocation info to the Root CA
|
||||
// OCSP responder.
|
||||
Map<BigInteger, SimpleOCSPServer.CertStatusInfo> revInfo =
|
||||
new HashMap<>();
|
||||
revInfo.put(eeCert.getSerialNumber(),
|
||||
new SimpleOCSPServer.CertStatusInfo(
|
||||
SimpleOCSPServer.CertStatus.CERT_STATUS_GOOD));
|
||||
rootOcsp.updateStatusDb(revInfo);
|
||||
|
||||
// Now build a keystore and add the keys, chain and root cert as a TA
|
||||
eeKeystore = keyStoreBuilder.getKeyStore();
|
||||
Certificate[] eeChain = {eeCert, rootCert};
|
||||
eeKeystore.setKeyEntry(EE_ALIAS, eeKP.getPrivate(),
|
||||
passwd.toCharArray(), eeChain);
|
||||
eeKeystore.setCertificateEntry(ROOT_ALIAS, rootCert);
|
||||
|
||||
// And finally a Trust Store for the client
|
||||
trustStore = keyStoreBuilder.getKeyStore();
|
||||
trustStore.setCertificateEntry(ROOT_ALIAS, rootCert);
|
||||
}
|
||||
|
||||
private static void addCommonExts(CertificateBuilder cbld,
|
||||
PublicKey subjKey, PublicKey authKey) throws IOException {
|
||||
cbld.addSubjectKeyIdExt(subjKey);
|
||||
cbld.addAuthorityKeyIdExt(authKey);
|
||||
}
|
||||
|
||||
private static void addCommonCAExts(CertificateBuilder cbld)
|
||||
throws IOException {
|
||||
cbld.addBasicConstraintsExt(true, true, -1);
|
||||
// Set key usage bits for digitalSignature, keyCertSign and cRLSign
|
||||
boolean[] kuBitSettings = {true, false, false, false, false, true,
|
||||
true, false, false};
|
||||
cbld.addKeyUsageExt(kuBitSettings);
|
||||
}
|
||||
|
||||
/**
|
||||
* Helper routine that dumps only a few cert fields rather than
|
||||
* the whole toString() output.
|
||||
*
|
||||
* @param cert an X509Certificate to be displayed
|
||||
*
|
||||
* @return the String output of the issuer, subject and
|
||||
* serial number
|
||||
*/
|
||||
private static String certInfo(X509Certificate cert) {
|
||||
StringBuilder sb = new StringBuilder();
|
||||
sb.append("Issuer: ").append(cert.getIssuerX500Principal()).
|
||||
append("\n");
|
||||
sb.append("Subject: ").append(cert.getSubjectX500Principal()).
|
||||
append("\n");
|
||||
sb.append("Serial: ").append(cert.getSerialNumber()).append("\n");
|
||||
return sb.toString();
|
||||
}
|
||||
|
||||
/**
|
||||
* Log a message on stdout
|
||||
*
|
||||
* @param format the format string for the log entry
|
||||
* @param args zero or more arguments corresponding to the format string
|
||||
*/
|
||||
private static void log(String format, Object ... args) {
|
||||
System.out.format(format + "\n", args);
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
-----BEGIN CERTIFICATE-----
|
||||
MIICZTCCAc6gAwIBAgIBADANBgkqhkiG9w0BAQQFADAtMQswCQYDVQQGEwJVUzEM
|
||||
MAoGA1UEChMDU3VuMRAwDgYDVQQDEwdSb290IENBMB4XDTA1MTEyNDIzMDU0N1oX
|
||||
DTE1MTEyMjIzMDU0N1owLTELMAkGA1UEBhMCVVMxDDAKBgNVBAoTA1N1bjEQMA4G
|
||||
A1UEAxMHUm9vdCBDQTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA1BHB3n1Q
|
||||
G/U/r+MvsKAzKUeDSSTAFzC6+a393zzrGSU3/OIlQjWAWVsoPQOiHilgfhhaox+C
|
||||
DWdV+qwWEPYA3QMyeiZDOQu/Xs1LoKrbfi+zNFqnZyXkqSjzJMP0G1LEI13sUTXz
|
||||
0AHoIdpZWqECXfP74L5reBrQ2Cv1k/zuUaECAwEAAaOBlDCBkTAdBgNVHQ4EFgQU
|
||||
HUnYKFCXxAMhXFyv/0SKj903FSQwVQYDVR0jBE4wTIAUHUnYKFCXxAMhXFyv/0SK
|
||||
j903FSShMaQvMC0xCzAJBgNVBAYTAlVTMQwwCgYDVQQKEwNTdW4xEDAOBgNVBAMT
|
||||
B1Jvb3QgQ0GCAQAwDAYDVR0TBAUwAwEB/zALBgNVHQ8EBAMCAQYwDQYJKoZIhvcN
|
||||
AQEEBQADgYEAO9yV6aPi3yj96Qq4laZ4Sq0FDmHWXUX0iF0ygSUHu/p8LK2iDKd0
|
||||
BoSqyrpz+SLLoWRn4tbbFaqJpsYGI7wEGdAjJJgKtMZOEH1sSuTnwsjaIxaLF9A4
|
||||
44Ki2Y5vbDcY8us2/92qiawGnKEFgDZn2M7OBYleV3PZJmPUQVX5Ffk=
|
||||
-----END CERTIFICATE-----
|
||||
Loading…
Add table
Add a link
Reference in a new issue