1 package org.cacert.gigi.pages.account;
3 import java.io.IOException;
4 import java.io.PrintWriter;
5 import java.security.GeneralSecurityException;
6 import java.security.PublicKey;
7 import java.security.interfaces.DSAPublicKey;
8 import java.security.interfaces.ECPublicKey;
9 import java.security.interfaces.RSAPublicKey;
10 import java.sql.SQLException;
11 import java.util.Base64;
12 import java.util.HashMap;
13 import java.util.LinkedHashSet;
16 import java.util.TreeSet;
18 import javax.servlet.http.HttpServletRequest;
20 import org.cacert.gigi.Certificate;
21 import org.cacert.gigi.Certificate.CSRType;
22 import org.cacert.gigi.Certificate.SANType;
23 import org.cacert.gigi.Certificate.SubjectAlternateName;
24 import org.cacert.gigi.CertificateProfile;
25 import org.cacert.gigi.Digest;
26 import org.cacert.gigi.GigiApiException;
27 import org.cacert.gigi.User;
28 import org.cacert.gigi.crypto.SPKAC;
29 import org.cacert.gigi.localisation.Language;
30 import org.cacert.gigi.output.Form;
31 import org.cacert.gigi.output.template.HashAlgorithms;
32 import org.cacert.gigi.output.template.IterableDataset;
33 import org.cacert.gigi.output.template.Template;
34 import org.cacert.gigi.pages.LoginPage;
35 import org.cacert.gigi.pages.Page;
36 import org.cacert.gigi.util.PEM;
37 import org.cacert.gigi.util.RandomToken;
39 import sun.security.pkcs.PKCS9Attribute;
40 import sun.security.pkcs10.PKCS10;
41 import sun.security.pkcs10.PKCS10Attribute;
42 import sun.security.pkcs10.PKCS10Attributes;
43 import sun.security.util.DerInputStream;
44 import sun.security.util.DerValue;
45 import sun.security.x509.AVA;
46 import sun.security.x509.AlgorithmId;
47 import sun.security.x509.CertificateExtensions;
48 import sun.security.x509.DNSName;
49 import sun.security.x509.ExtendedKeyUsageExtension;
50 import sun.security.x509.Extension;
51 import sun.security.x509.GeneralName;
52 import sun.security.x509.GeneralNameInterface;
53 import sun.security.x509.GeneralNames;
54 import sun.security.x509.RDN;
55 import sun.security.x509.RFC822Name;
56 import sun.security.x509.SubjectAlternativeNameExtension;
57 import sun.security.x509.X500Name;
60 * This class represents a form that is used for issuing certificates. This
61 * class uses "sun.security" and therefore needs "-XDignore.symbol.file"
63 public class CertificateIssueForm extends Form {
65 private final static Template t = new Template(CertificateIssueForm.class.getResource("CertificateIssueForm.templ"));
67 private final static Template tIni = new Template(CertificateAdd.class.getResource("RequestCertificate.templ"));
71 private CSRType csrType;
75 String spkacChallenge;
79 Set<SubjectAlternateName> SANs = new LinkedHashSet<>();
81 Digest selectedDigest = Digest.getDefault();
85 public CertificateIssueForm(HttpServletRequest hsr) {
87 u = Page.getUser(hsr);
88 spkacChallenge = RandomToken.generateToken(16);
93 public Certificate getResult() {
98 public boolean submit(PrintWriter out, HttpServletRequest req) {
99 String csr = req.getParameter("CSR");
100 String spkac = req.getParameter("SPKAC");
104 byte[] data = PEM.decode("(NEW )?CERTIFICATE REQUEST", csr);
105 PKCS10 parsed = new PKCS10(data);
106 PKCS10Attributes atts = parsed.getAttributes();
108 for (PKCS10Attribute b : atts.getAttributes()) {
110 if ( !b.getAttributeId().equals((Object) PKCS9Attribute.EXTENSION_REQUEST_OID)) {
115 for (RDN r : parsed.getSubjectName().rdns()) {
116 for (AVA a : r.avas()) {
117 if (a.getObjectIdentifier().equals((Object) PKCS9Attribute.EMAIL_ADDRESS_OID)) {
118 SANs.add(new SubjectAlternateName(SANType.EMAIL, a.getValueString()));
119 } else if (a.getObjectIdentifier().equals((Object) X500Name.commonName_oid)) {
120 CN = a.getValueString();
125 for (Extension c : ((CertificateExtensions) b.getAttributeValue()).getAllExtensions()) {
126 if (c instanceof SubjectAlternativeNameExtension) {
128 SubjectAlternativeNameExtension san = (SubjectAlternativeNameExtension) c;
129 GeneralNames obj = san.get(SubjectAlternativeNameExtension.SUBJECT_NAME);
130 for (int i = 0; i < obj.size(); i++) {
131 GeneralName generalName = obj.get(i);
132 GeneralNameInterface peeled = generalName.getName();
133 if (peeled instanceof DNSName) {
134 SANs.add(new SubjectAlternateName(SANType.DNS, ((DNSName) peeled).getName()));
135 } else if (peeled instanceof RFC822Name) {
136 SANs.add(new SubjectAlternateName(SANType.EMAIL, ((RFC822Name) peeled).getName()));
139 } else if (c instanceof ExtendedKeyUsageExtension) {
140 ExtendedKeyUsageExtension ekue = (ExtendedKeyUsageExtension) c;
141 for (String s : ekue.getExtendedKeyUsage()) {
142 if (s.equals("1.3.6.1.5.5.7.3.1")) {
144 } else if (s.equals("1.3.6.1.5.5.7.3.2")) {
146 } else if (s.equals("1.3.6.1.5.5.7.3.3")) {
148 } else if (s.equals("1.3.6.1.5.5.7.3.4")) {
150 } else if (s.equals("1.3.6.1.5.5.7.3.8")) {
152 } else if (s.equals("1.3.6.1.5.5.7.3.9")) {
157 // Unknown requested extension
162 out.println(parsed.getSubjectName().getCommonName());
163 out.println(parsed.getSubjectName().getCountry());
165 out.println("CSR DN: " + parsed.getSubjectName() + "<br/>");
166 PublicKey pk = parsed.getSubjectPublicKeyInfo();
167 checkKeyStrength(pk, out);
168 String sign = getSignatureAlgorithm(data);
169 out.println("<br/>digest: " + sign + "<br/>");
172 this.csrType = CSRType.CSR;
173 } else if (spkac != null) {
174 String cleanedSPKAC = spkac.replaceAll("[\r\n]", "");
175 byte[] data = Base64.getDecoder().decode(cleanedSPKAC);
176 SPKAC parsed = new SPKAC(data);
177 if ( !parsed.getChallenge().equals(spkacChallenge)) {
178 throw new GigiApiException("Challenge mismatch");
180 checkKeyStrength(parsed.getPubkey(), out);
181 String sign = getSignatureAlgorithm(data);
182 out.println("<br/>digest: " + sign + "<br/>");
185 this.csr = "SPKAC=" + cleanedSPKAC;
186 this.csrType = CSRType.SPKAC;
189 login = "1".equals(req.getParameter("login"));
190 CN = req.getParameter("CN");
191 SANs = parseSANBox(req.getParameter("SANs"));
192 String hashAlg = req.getParameter("hash_alg");
193 if (hashAlg != null) {
194 selectedDigest = Digest.valueOf(hashAlg);
196 if (req.getParameter("CCA") == null) {
197 outputError(out, req, "You need to accept the CCA.");
200 CertificateProfile profile = CertificateProfile.getByName(req.getParameter("profile"));
202 result = new Certificate(LoginPage.getUser(req).getId(), "/commonName=CAcert WoT User", selectedDigest.toString(), //
203 this.csr, this.csrType, profile, SANs.toArray(new SubjectAlternateName[SANs.size()]));
204 result.issue().waitFor(60000);
207 } catch (IOException e) {
209 } catch (IllegalArgumentException e) {
210 throw new GigiApiException("Certificate Request format is invalid.");
211 } catch (GeneralSecurityException e) {
212 throw new GigiApiException("Certificate Request format is invalid.");
213 } catch (InterruptedException e) {
215 } catch (SQLException e) {
216 throw new GigiApiException(e);
218 } catch (GigiApiException e) {
219 e.format(out, Page.getLanguage(req));
224 private TreeSet<SubjectAlternateName> parseSANBox(String SANs) {
225 String[] SANparts = SANs.split("[\r\n]+");
226 TreeSet<SubjectAlternateName> parsedNames = new TreeSet<>();
227 for (String SANline : SANparts) {
228 String[] parts = SANline.split(":", 2);
229 SANType t = Certificate.SANType.valueOf(parts[0].toUpperCase());
230 if (t == null || parts.length == 1) {
233 parsedNames.add(new SubjectAlternateName(t, parts[1]));
238 private void checkKeyStrength(PublicKey pk, PrintWriter out) {
239 out.println("Type: " + pk.getAlgorithm() + "<br/>");
240 if (pk instanceof RSAPublicKey) {
241 out.println("Exponent: " + ((RSAPublicKey) pk).getPublicExponent() + "<br/>");
242 out.println("Length: " + ((RSAPublicKey) pk).getModulus().bitLength());
243 } else if (pk instanceof DSAPublicKey) {
244 DSAPublicKey dpk = (DSAPublicKey) pk;
245 out.println("Length: " + dpk.getY().bitLength() + "<br/>");
246 out.println(dpk.getParams());
247 } else if (pk instanceof ECPublicKey) {
248 ECPublicKey epk = (ECPublicKey) pk;
249 out.println("Length-x: " + epk.getW().getAffineX().bitLength() + "<br/>");
250 out.println("Length-y: " + epk.getW().getAffineY().bitLength() + "<br/>");
251 out.println(epk.getParams().getCurve());
255 private static String getSignatureAlgorithm(byte[] data) throws IOException {
256 DerInputStream in = new DerInputStream(data);
257 DerValue[] seq = in.getSequence(3);
258 return AlgorithmId.parse(seq[1]).getName();
262 public void output(PrintWriter out, Language l, Map<String, Object> vars) {
264 HashMap<String, Object> vars2 = new HashMap<String, Object>(vars);
265 vars2.put("csrf", getCSRFToken());
266 vars2.put("csrf_name", getCsrfFieldName());
267 vars2.put("spkacChallenge", spkacChallenge);
268 tIni.output(out, l, vars2);
271 super.output(out, l, vars);
276 protected void outputContent(PrintWriter out, Language l, Map<String, Object> vars) {
277 HashMap<String, Object> vars2 = new HashMap<String, Object>(vars);
278 vars2.put("CCA", "<a href='/policy/CAcertCommunityAgreement.html'>CCA</a>");
280 StringBuffer content = new StringBuffer();
281 for (SubjectAlternateName SAN : SANs) {
282 content.append(SAN.getType().toString().toLowerCase());
284 content.append(SAN.getName());
285 content.append('\n');
289 vars2.put("emails", content.toString());
290 vars2.put("hashs", new HashAlgorithms(selectedDigest));
291 vars2.put("profiles", new IterableDataset() {
296 public boolean next(Language l, Map<String, Object> vars) {
297 CertificateProfile cp = CertificateProfile.getById(i++);
301 vars.put("key", cp.getKeyName());
302 vars.put("name", cp.getVisibleName());
306 t.output(out, l, vars2);