import java.io.IOException;
import java.io.PrintWriter;
-import java.math.BigInteger;
import java.net.URLEncoder;
import java.security.GeneralSecurityException;
-import java.security.cert.CRLException;
-import java.security.cert.CertificateEncodingException;
-import java.security.cert.CertificateException;
-import java.security.cert.X509CRL;
-import java.security.cert.X509Certificate;
import java.util.HashMap;
-import java.util.HashSet;
-import java.util.LinkedList;
import java.util.Map;
-import java.util.Set;
import javax.servlet.ServletOutputStream;
import javax.servlet.http.HttpServletRequest;
import org.cacert.gigi.pages.HandlesMixedRequest;
import org.cacert.gigi.pages.LoginPage;
import org.cacert.gigi.pages.Page;
+import org.cacert.gigi.util.CertExporter;
import org.cacert.gigi.util.PEM;
-import sun.security.pkcs.ContentInfo;
-import sun.security.pkcs.PKCS7;
-import sun.security.pkcs.SignerInfo;
-import sun.security.util.DerOutputStream;
-import sun.security.util.DerValue;
-import sun.security.x509.AlgorithmId;
-import sun.security.x509.X509CRLImpl;
-import sun.security.x509.X509CertImpl;
-
public class Certificates extends Page implements HandlesMixedRequest {
private Template certDisplay = new Template(Certificates.class.getResource("CertificateDisplay.templ"));
} else if (pi.endsWith(".cer")) {
cer = true;
pi = pi.substring(0, pi.length() - 4);
- } else if (pi.endsWith(".cer")) {
- cer = true;
- pi = pi.substring(0, pi.length() - 4);
}
String serial = pi;
try {
resp.sendError(404);
return true;
}
- X509Certificate cert = c.cert();
if ( !crt && !cer) {
return false;
}
ServletOutputStream out = resp.getOutputStream();
+ boolean doChain = req.getParameter("chain") != null;
+ boolean includeAnchor = req.getParameter("noAnchor") == null;
if (crt) {
- out.println(PEM.encode("CERTIFICATE", cert.getEncoded()));
- if (req.getParameter("chain") != null) {
- CACertificate ca = c.getParent();
- while ( !ca.isSelfsigned()) {
- out.println(PEM.encode("CERTIFICATE", ca.getCertificate().getEncoded()));
- ca = ca.getParent();
- }
- if (req.getParameter("noAnchor") == null) {
- out.println(PEM.encode("CERTIFICATE", ca.getCertificate().getEncoded()));
- }
- }
+ CertExporter.writeCertCrt(c, out, doChain, includeAnchor);
} else if (cer) {
- if (req.getParameter("chain") != null) {
- PKCS7 p7 = toP7Chain(c);
- p7.encodeSignedData(out);
- /*
- * ContentInfo ci = toCIChain(c); try (DerOutputStream dos =
- * new DerOutputStream()) { ci.encode(dos);
- * out.write(dos.toByteArray()); }
- */
- } else {
- out.write(cert.getEncoded());
- }
+ CertExporter.writeCertCer(c, out, doChain, includeAnchor);
}
} catch (IllegalArgumentException e) {
resp.sendError(404);
return true;
}
- private static PKCS7 toP7Chain(Certificate c) throws IOException, GeneralSecurityException {
- LinkedList<X509Certificate> ll = getChain(c);
- PKCS7 p7 = new PKCS7(new AlgorithmId[0], new ContentInfo(ContentInfo.DATA_OID, null), ll.toArray(new X509Certificate[ll.size()]), new SignerInfo[0]) {
-
- @Override
- public void encodeSignedData(DerOutputStream out) throws IOException {
- DerOutputStream signedData = new DerOutputStream();
- BigInteger version = getVersion();
- AlgorithmId[] digestAlgorithmIds = getDigestAlgorithmIds();
- ContentInfo contentInfo = getContentInfo();
- X509Certificate[] certificates = getCertificates();
- X509CRL[] crls = getCRLs();
- SignerInfo[] signerInfos = getSignerInfos();
-
- // version
- signedData.putInteger(version);
-
- // digestAlgorithmIds
- signedData.putOrderedSetOf(DerValue.tag_Set, digestAlgorithmIds);
-
- // contentInfo
- contentInfo.encode(signedData);
-
- // certificates (optional)
- if (certificates != null && certificates.length != 0) {
- DerOutputStream sub = new DerOutputStream();
- // cast to X509CertImpl[] since X509CertImpl implements
- // DerEncoder
- X509CertImpl implCerts[] = new X509CertImpl[certificates.length];
- for (int i = 0; i < certificates.length; i++) {
- try {
- sub.write(certificates[i].getEncoded());
- } catch (CertificateEncodingException e) {
- sub.close();
- throw new IOException(e);
- }
- if (certificates[i] instanceof X509CertImpl) {
- implCerts[i] = (X509CertImpl) certificates[i];
- } else {
- try {
- byte[] encoded = certificates[i].getEncoded();
- implCerts[i] = new X509CertImpl(encoded);
- } catch (CertificateException ce) {
- sub.close();
- throw new IOException(ce);
- }
- }
- }
-
- // Add the certificate set (tagged with [0] IMPLICIT)
- // to the signed data
- signedData.write((byte) 0xA0, sub);
- sub.close();
- }
-
- // CRLs (optional)
- if (crls != null && crls.length != 0) {
- // cast to X509CRLImpl[] since X509CRLImpl implements
- // DerEncoder
- Set<X509CRLImpl> implCRLs = new HashSet<X509CRLImpl>(crls.length);
- for (X509CRL crl : crls) {
- if (crl instanceof X509CRLImpl) {
- implCRLs.add((X509CRLImpl) crl);
- } else {
- try {
- byte[] encoded = crl.getEncoded();
- implCRLs.add(new X509CRLImpl(encoded));
- } catch (CRLException ce) {
- throw new IOException(ce);
- }
- }
- }
-
- // Add the CRL set (tagged with [1] IMPLICIT)
- // to the signed data
- signedData.putOrderedSetOf((byte) 0xA1, implCRLs.toArray(new X509CRLImpl[implCRLs.size()]));
- }
-
- // signerInfos
- signedData.putOrderedSetOf(DerValue.tag_Set, signerInfos);
-
- // making it a signed data block
- DerValue signedDataSeq = new DerValue(DerValue.tag_Sequence, signedData.toByteArray());
-
- // making it a content info sequence
- ContentInfo block = new ContentInfo(ContentInfo.SIGNED_DATA_OID, signedDataSeq);
-
- // writing out the contentInfo sequence
- block.encode(out);
- }
-
- };
- return p7;
- }
-
- private static LinkedList<X509Certificate> getChain(Certificate c) throws IOException, GeneralSecurityException {
- LinkedList<X509Certificate> ll = new LinkedList<>();
- ll.add(c.cert());
- CACertificate ca = c.getParent();
- while ( !ca.isSelfsigned()) {
- ll.add(ca.getCertificate());
- ca = ca.getParent();
- }
- ll.add(ca.getCertificate());
- return ll;
- }
-
@Override
public void doPost(HttpServletRequest req, HttpServletResponse resp) throws IOException {
if (req.getQueryString() != null && !req.getQueryString().equals("") && !req.getQueryString().equals("withRevoked")) {
--- /dev/null
+package org.cacert.gigi.util;
+
+import java.io.IOException;
+import java.math.BigInteger;
+import java.security.GeneralSecurityException;
+import java.security.cert.CRLException;
+import java.security.cert.CertificateEncodingException;
+import java.security.cert.CertificateException;
+import java.security.cert.X509CRL;
+import java.security.cert.X509Certificate;
+import java.util.HashSet;
+import java.util.LinkedList;
+import java.util.Set;
+
+import javax.servlet.ServletOutputStream;
+
+import org.cacert.gigi.dbObjects.CACertificate;
+import org.cacert.gigi.dbObjects.Certificate;
+
+import sun.security.pkcs.ContentInfo;
+import sun.security.pkcs.PKCS7;
+import sun.security.pkcs.SignerInfo;
+import sun.security.util.DerOutputStream;
+import sun.security.util.DerValue;
+import sun.security.x509.AlgorithmId;
+import sun.security.x509.X509CRLImpl;
+import sun.security.x509.X509CertImpl;
+
+public class CertExporter {
+
+ private CertExporter() {}
+
+ public static void writeCertCrt(Certificate c, ServletOutputStream out, boolean doChain, boolean includeAnchor) throws IOException, GeneralSecurityException {
+ X509Certificate cert = c.cert();
+ out.println(PEM.encode("CERTIFICATE", cert.getEncoded()));
+ if (doChain) {
+ CACertificate ca = c.getParent();
+ while ( !ca.isSelfsigned()) {
+ out.println(PEM.encode("CERTIFICATE", ca.getCertificate().getEncoded()));
+ ca = ca.getParent();
+ }
+ if (includeAnchor) {
+ out.println(PEM.encode("CERTIFICATE", ca.getCertificate().getEncoded()));
+ }
+ }
+ }
+
+ public static void writeCertCer(Certificate c, ServletOutputStream out, boolean doChain, boolean includeAnchor) throws IOException, GeneralSecurityException {
+ X509Certificate cert = c.cert();
+ if (doChain) {
+ PKCS7 p7 = toP7Chain(c);
+ p7.encodeSignedData(out);
+ } else {
+ out.write(cert.getEncoded());
+ }
+ }
+
+ private static PKCS7 toP7Chain(Certificate c) throws IOException, GeneralSecurityException {
+ LinkedList<X509Certificate> ll = getChain(c);
+ PKCS7 p7 = new PKCS7(new AlgorithmId[0], new ContentInfo(ContentInfo.DATA_OID, null), ll.toArray(new X509Certificate[ll.size()]), new SignerInfo[0]) {
+
+ @Override
+ public void encodeSignedData(DerOutputStream out) throws IOException {
+ DerOutputStream signedData = new DerOutputStream();
+ BigInteger version = getVersion();
+ AlgorithmId[] digestAlgorithmIds = getDigestAlgorithmIds();
+ ContentInfo contentInfo = getContentInfo();
+ X509Certificate[] certificates = getCertificates();
+ X509CRL[] crls = getCRLs();
+ SignerInfo[] signerInfos = getSignerInfos();
+
+ // version
+ signedData.putInteger(version);
+
+ // digestAlgorithmIds
+ signedData.putOrderedSetOf(DerValue.tag_Set, digestAlgorithmIds);
+
+ // contentInfo
+ contentInfo.encode(signedData);
+
+ // certificates (optional)
+ if (certificates != null && certificates.length != 0) {
+ DerOutputStream sub = new DerOutputStream();
+ // cast to X509CertImpl[] since X509CertImpl implements
+ // DerEncoder
+ X509CertImpl implCerts[] = new X509CertImpl[certificates.length];
+ for (int i = 0; i < certificates.length; i++) {
+ try {
+ sub.write(certificates[i].getEncoded());
+ } catch (CertificateEncodingException e) {
+ sub.close();
+ throw new IOException(e);
+ }
+ if (certificates[i] instanceof X509CertImpl) {
+ implCerts[i] = (X509CertImpl) certificates[i];
+ } else {
+ try {
+ byte[] encoded = certificates[i].getEncoded();
+ implCerts[i] = new X509CertImpl(encoded);
+ } catch (CertificateException ce) {
+ sub.close();
+ throw new IOException(ce);
+ }
+ }
+ }
+
+ // Add the certificate set (tagged with [0] IMPLICIT)
+ // to the signed data
+ signedData.write((byte) 0xA0, sub);
+ sub.close();
+ }
+
+ // CRLs (optional)
+ if (crls != null && crls.length != 0) {
+ // cast to X509CRLImpl[] since X509CRLImpl implements
+ // DerEncoder
+ Set<X509CRLImpl> implCRLs = new HashSet<X509CRLImpl>(crls.length);
+ for (X509CRL crl : crls) {
+ if (crl instanceof X509CRLImpl) {
+ implCRLs.add((X509CRLImpl) crl);
+ } else {
+ try {
+ byte[] encoded = crl.getEncoded();
+ implCRLs.add(new X509CRLImpl(encoded));
+ } catch (CRLException ce) {
+ throw new IOException(ce);
+ }
+ }
+ }
+
+ // Add the CRL set (tagged with [1] IMPLICIT)
+ // to the signed data
+ signedData.putOrderedSetOf((byte) 0xA1, implCRLs.toArray(new X509CRLImpl[implCRLs.size()]));
+ }
+
+ // signerInfos
+ signedData.putOrderedSetOf(DerValue.tag_Set, signerInfos);
+
+ // making it a signed data block
+ DerValue signedDataSeq = new DerValue(DerValue.tag_Sequence, signedData.toByteArray());
+
+ // making it a content info sequence
+ ContentInfo block = new ContentInfo(ContentInfo.SIGNED_DATA_OID, signedDataSeq);
+
+ // writing out the contentInfo sequence
+ block.encode(out);
+ }
+
+ };
+ return p7;
+ }
+
+ private static LinkedList<X509Certificate> getChain(Certificate c) throws IOException, GeneralSecurityException {
+ LinkedList<X509Certificate> ll = new LinkedList<>();
+ ll.add(c.cert());
+ CACertificate ca = c.getParent();
+ while ( !ca.isSelfsigned()) {
+ ll.add(ca.getCertificate());
+ ca = ca.getParent();
+ }
+ ll.add(ca.getCertificate());
+ return ll;
+ }
+
+}
projects / gigi.git / commitdiff