import java.io.PrintWriter;
import java.net.URLEncoder;
import java.security.GeneralSecurityException;
-import java.security.cert.X509Certificate;
import java.util.HashMap;
-import java.util.LinkedList;
import java.util.Map;
import javax.servlet.ServletOutputStream;
import org.cacert.gigi.pages.HandlesMixedRequest;
import org.cacert.gigi.pages.LoginPage;
import org.cacert.gigi.pages.Page;
+import org.cacert.gigi.util.CertExporter;
import org.cacert.gigi.util.PEM;
-import sun.security.pkcs.ContentInfo;
-import sun.security.pkcs.PKCS7;
-import sun.security.pkcs.SignerInfo;
-import sun.security.x509.AlgorithmId;
-
public class Certificates extends Page implements HandlesMixedRequest {
- private Template certDisplay = new Template(Certificates.class.getResource("CertificateDisplay.templ"));
+ private static final Template certDisplay = new Template(Certificates.class.getResource("CertificateDisplay.templ"));
public static final String PATH = "/account/certs";
} else if (pi.endsWith(".cer")) {
cer = true;
pi = pi.substring(0, pi.length() - 4);
- } else if (pi.endsWith(".cer")) {
- cer = true;
- pi = pi.substring(0, pi.length() - 4);
}
String serial = pi;
try {
resp.sendError(404);
return true;
}
- X509Certificate cert = c.cert();
if ( !crt && !cer) {
return false;
}
ServletOutputStream out = resp.getOutputStream();
+ boolean doChain = req.getParameter("chain") != null;
+ boolean includeAnchor = req.getParameter("noAnchor") == null;
if (crt) {
- out.println(PEM.encode("CERTIFICATE", cert.getEncoded()));
- if (req.getParameter("chain") != null) {
- CACertificate ca = c.getParent();
- while ( !ca.isSelfsigned()) {
- out.println(PEM.encode("CERTIFICATE", ca.getCertificate().getEncoded()));
- ca = ca.getParent();
- }
- if (req.getParameter("noAnchor") == null) {
- out.println(PEM.encode("CERTIFICATE", ca.getCertificate().getEncoded()));
- }
- }
+ CertExporter.writeCertCrt(c, out, doChain, includeAnchor);
} else if (cer) {
- if (req.getParameter("install") != null) {
- PKCS7 p7 = toP7Chain(c);
- p7.encodeSignedData(out);
- /*
- * ContentInfo ci = toCIChain(c); try (DerOutputStream dos =
- * new DerOutputStream()) { ci.encode(dos);
- * out.write(dos.toByteArray()); }
- */
- } else {
- out.write(cert.getEncoded());
- }
+ CertExporter.writeCertCer(c, out, doChain, includeAnchor);
}
} catch (IllegalArgumentException e) {
resp.sendError(404);
return true;
}
- private static PKCS7 toP7Chain(Certificate c) throws IOException, GeneralSecurityException {
- LinkedList<X509Certificate> ll = getChain(c);
- PKCS7 p7 = new PKCS7(new AlgorithmId[0], new ContentInfo(ContentInfo.DATA_OID, null), ll.toArray(new X509Certificate[ll.size()]), new SignerInfo[0]);
- return p7;
- }
-
- private static LinkedList<X509Certificate> getChain(Certificate c) throws IOException, GeneralSecurityException {
- LinkedList<X509Certificate> ll = new LinkedList<>();
- ll.add(c.cert());
- CACertificate ca = c.getParent();
- while ( !ca.isSelfsigned()) {
- ll.add(ca.getCertificate());
- ca = ca.getParent();
- }
- ll.add(ca.getCertificate());
- return ll;
- }
-
@Override
public void doPost(HttpServletRequest req, HttpServletResponse resp) throws IOException {
if (req.getQueryString() != null && !req.getQueryString().equals("") && !req.getQueryString().equals("withRevoked")) {
vars.put("serial", URLEncoder.encode(serial, "UTF-8"));
vars.put("trustchain", new TrustchainIterable(c.getParent()));
try {
- vars.put("cert", c.cert());
+ vars.put("cert", PEM.encode("CERTIFICATE", c.cert().getEncoded()));
} catch (GeneralSecurityException e) {
e.printStackTrace();
}