1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29 package dk.sosi.seal.pki;
30
31 import org.bouncycastle.asn1.*;
32
33 import java.io.IOException;
34 import java.net.URI;
35 import java.net.URISyntaxException;
36 import java.security.InvalidKeyException;
37 import java.security.NoSuchAlgorithmException;
38 import java.security.NoSuchProviderException;
39 import java.security.SignatureException;
40 import java.security.cert.CertificateException;
41 import java.security.cert.X509Certificate;
42 import java.util.Properties;
43
44
45
46
47
48 public class OCESUtil {
49
50 static URI retrieveIntermediateCertificateURI(X509Certificate certificate) throws PKIException {
51 try {
52 byte[] b1_3_6_1_5_5_7_1_1 = certificate.getExtensionValue("1.3.6.1.5.5.7.1.1");
53 if (b1_3_6_1_5_5_7_1_1 == null) {
54 throw new PKIException("Invalid certificate - Authority Information Access (1.3.6.1.5.5.7.1.1) not found.");
55 }
56
57 ASN1InputStream is1_3_6_1_5_5_7_1_1 = new ASN1InputStream(b1_3_6_1_5_5_7_1_1);
58
59 DEROctetString osAuthorityInformationAccess = (DEROctetString) is1_3_6_1_5_5_7_1_1.readObject();
60 ASN1InputStream osAuthorityInformationAccessValue = new ASN1InputStream(
61 osAuthorityInformationAccess.getOctets());
62 DERSequence seqAuthorityInformationAccessValue = (DERSequence) osAuthorityInformationAccessValue
63 .readObject();
64
65 if (seqAuthorityInformationAccessValue.size() < 2) {
66 throw new PKIException("Invalid certificate - CA Issuers (1.3.6.1.5.5.7.48.2) not found under Authority Information Access.");
67 }
68 DERSequence seq1_3_6_1_5_5_7_48_2 = (DERSequence) seqAuthorityInformationAccessValue.getObjectAt(1);
69 DERTaggedObject seq1_3_6_1_5_5_7_48_2Value = (DERTaggedObject) seq1_3_6_1_5_5_7_48_2.getObjectAt(1);
70 DEROctetString osAlternativeName = (DEROctetString) ASN1OctetString.getInstance(seq1_3_6_1_5_5_7_48_2Value);
71
72 return new URI(new String(osAlternativeName.getOctets()));
73 } catch (IOException ex) {
74 throw new PKIException(ex);
75 } catch (URISyntaxException ex) {
76 throw new PKIException(ex);
77 }
78 }
79
80 static boolean isOCES1Certificate(X509Certificate certificate) {
81 return certificate.getIssuerX500Principal().getName().indexOf("TDC OCES") != -1;
82 }
83
84 static boolean isOCES2Certificate(X509Certificate certificate) {
85 return certificate.getIssuerX500Principal().getName().indexOf("TRUST2408") != -1;
86 }
87
88 static boolean isIntermediateCertificate(X509Certificate certificate) {
89 return isOCES2Certificate(certificate) && certificate.getIssuerX500Principal().getName().indexOf("Primary") != -1;
90 }
91
92 static boolean isIssuerOf(X509Certificate certificate, X509Certificate verifyAgainst) throws PKIException {
93 try {
94 certificate.verify(verifyAgainst.getPublicKey());
95 return true;
96 } catch (InvalidKeyException e) {
97 return false;
98 } catch (CertificateException e) {
99 throw new PKIException("Failed to establish issuer of");
100 } catch (NoSuchAlgorithmException e) {
101 throw new PKIException("Failed to establish issuer of");
102 } catch (NoSuchProviderException e) {
103 throw new PKIException("Failed to establish issuer of");
104 } catch (SignatureException e) {
105 return false;
106 }
107 }
108
109 public static String getPropertyNotNull(String propertyName, Properties props) {
110 String value = props.getProperty(propertyName);
111 if (value == null) {
112 throw new IllegalArgumentException("Property '" + propertyName + "' is not defined.");
113 }
114 return value;
115 }
116 }