src/club/wpia/gigi/ocsp/OCSPIssuer.java

   1 package club.wpia.gigi.ocsp;
   2
   3 import java.io.IOException;
   4 import java.security.GeneralSecurityException;
   5 import java.security.MessageDigest;
   6 import java.security.PrivateKey;
   7 import java.security.Signature;
   8 import java.security.cert.CRLReason;
   9 import java.security.cert.X509Certificate;
  10 import java.util.Date;
  11
  12 import club.wpia.gigi.crypto.OCSPRequest;
  13 import club.wpia.gigi.crypto.OCSPResponse;
  14 import club.wpia.gigi.crypto.OCSPResponse.SingleResponse;
  15 import club.wpia.gigi.dbObjects.CACertificate;
  16 import club.wpia.gigi.dbObjects.Certificate;
  17 import sun.security.provider.certpath.CertId;
  18
  19 /**
  20  * An instance that creates OCSP responses.
  21  */
  22 public class OCSPIssuer {
  23
  24     /**
  25      * The CA certificate to issue OCSP responses for.
  26      */
  27     private final X509Certificate target;
  28
  29     /**
  30      * The OCSP certificate for which we have the private key.
  31      */
  32     private final X509Certificate cert;
  33
  34     /**
  35      * The OCSP certificate's private key to sign the responses with.
  36      */
  37     private final PrivateKey key;
  38
  39     private final byte[] subjectKeyIdentifier;
  40
  41     public OCSPIssuer(X509Certificate target, X509Certificate x, PrivateKey key) throws IOException, GeneralSecurityException {
  42         this.target = target;
  43         this.cert = x;
  44         this.key = key;
  45         this.subjectKeyIdentifier = OCSPResponder.calcKeyHash(cert, MessageDigest.getInstance("SHA-1"));
  46     }
  47
  48     public X509Certificate getTarget() {
  49         return target;
  50     }
  51
  52     public byte[] getKeyId() {
  53         return subjectKeyIdentifier;
  54     }
  55
  56     private SingleResponse respond(CertId id, Certificate cert) {
  57         if (cert != null) {
  58             Date dt = cert.getRevocationDate();
  59             if (dt != null) {
  60                 return new OCSPResponse.SingleResponse(id, new Date(System.currentTimeMillis() - 10000), new Date(System.currentTimeMillis() + 10000), dt, CRLReason.UNSPECIFIED);
  61             } else {
  62                 return new OCSPResponse.SingleResponse(id, new Date(System.currentTimeMillis() - 10000), new Date(System.currentTimeMillis() + 10000));
  63             }
  64         } else {
  65             return new OCSPResponse.SingleResponse(id, new Date(System.currentTimeMillis() - 10000), new Date(System.currentTimeMillis() + 10000), true);
  66         }
  67     }
  68
  69     /**
  70      * Responds with the status of one certificate.
  71      *
  72      * @param req
  73      *            the {@link OCSPRequest} to take the nonce from.
  74      * @param id
  75      *            The certificate for which to look up revocation information.
  76      * @return the signed {@link OCSPResponse} in binary data.
  77      * @throws GeneralSecurityException
  78      *             if signing fails
  79      * @throws IOException
  80      *             if encoding fails
  81      */
  82     public byte[] respondBytes(OCSPRequest req, CertId id) throws GeneralSecurityException, IOException {
  83         Certificate tcert = Certificate.getBySerial(id.getSerialNumber());
  84         if (tcert == null) {
  85             return OCSPResponse.invalid();
  86         }
  87         CACertificate cc = tcert.getParent();
  88         if ( !cc.getCertificate().getSubjectDN().equals(getTarget().getSubjectDN())) {
  89             tcert = null;
  90             OCSPResponder.log.warning("OCSP request with different Issuer: Based on serial: " + cc.getCertificate().getSubjectDN() + " but based on request: " + getTarget().getSubjectDN());
  91             return OCSPResponse.invalid();
  92         }
  93
  94         SingleResponse[] responses = new OCSPResponse.SingleResponse[1];
  95         responses[0] = respond(id, tcert);
  96
  97         OCSPResponse ocspResponse = new OCSPResponse(getKeyId(), responses);
  98         if (cert != getTarget()) {
  99             ocspResponse.setSigners(new X509Certificate[] {
 100                     cert
 101             });
 102         } else {
 103             ocspResponse.setSigners(new X509Certificate[] {
 104                     // getCert()
 105             });
 106
 107         }
 108         ocspResponse.updateNonce(req);
 109         Signature s = Signature.getInstance("SHA512WithRSA");
 110         s.initSign(key);
 111         return ocspResponse.produceResponce(s);
 112     }
 113 }