--- /dev/null
+package org.cacert.gigi;
+
+import java.io.IOException;
+import java.net.HttpURLConnection;
+import java.net.Socket;
+import java.net.URL;
+import java.security.GeneralSecurityException;
+import java.security.Principal;
+import java.security.PrivateKey;
+import java.security.cert.X509Certificate;
+import java.sql.SQLException;
+
+import javax.net.ssl.HttpsURLConnection;
+import javax.net.ssl.KeyManager;
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.X509KeyManager;
+
+import org.cacert.gigi.Certificate.CertificateStatus;
+import org.cacert.gigi.testUtils.ManagedTest;
+import org.cacert.gigi.testUtils.PemKey;
+import org.junit.Test;
+
+import static org.junit.Assert.*;
+
+public class TestCertificate extends ManagedTest {
+ @Test
+ public void testClientCertLoginStates() throws IOException, GeneralSecurityException, SQLException,
+ InterruptedException {
+ String[] key1 = generateCSR("/CN=testmail@example.com");
+ Certificate c = new Certificate(1, "/CN=testmail@example.com", "sha256", key1[1]);
+ final PrivateKey pk = PemKey.parsePEMPrivateKey(key1[0]);
+ c.issue();
+ c.waitFor(60000);
+ final X509Certificate ce = c.cert();
+ KeyManager km = new X509KeyManager() {
+
+ @Override
+ public String chooseClientAlias(String[] arg0, Principal[] arg1, Socket arg2) {
+ return "client";
+ }
+
+ @Override
+ public String chooseServerAlias(String arg0, Principal[] arg1, Socket arg2) {
+ return null;
+ }
+
+ @Override
+ public X509Certificate[] getCertificateChain(String arg0) {
+ return new X509Certificate[] { ce };
+ }
+
+ @Override
+ public String[] getClientAliases(String arg0, Principal[] arg1) {
+ return new String[] { "client" };
+ }
+
+ @Override
+ public PrivateKey getPrivateKey(String arg0) {
+ if (arg0.equals("client")) {
+ return pk;
+ }
+ return null;
+ }
+
+ @Override
+ public String[] getServerAliases(String arg0, Principal[] arg1) {
+ return new String[] { "client" };
+ }
+ };
+ SSLContext sc = SSLContext.getInstance("TLS");
+ sc.init(new KeyManager[] { km }, null, null);
+
+ HttpURLConnection connection = (HttpURLConnection) new URL("https://"
+ + getServerName().replaceFirst("^www.", "secure.") + "/login").openConnection();
+ if (connection instanceof HttpsURLConnection) {
+ ((HttpsURLConnection) connection).setSSLSocketFactory(sc.getSocketFactory());
+ }
+ assertEquals(302, connection.getResponseCode());
+ assertEquals("https://" + getServerName().replaceFirst("^www.", "secure.") + "/",
+ connection.getHeaderField("Location"));
+ }
+
+ @Test
+ public void testCertLifeCycle() throws IOException, GeneralSecurityException, SQLException, InterruptedException {
+ String[] key1 = generateCSR("/CN=testmail@example.com");
+ Certificate c = new Certificate(1, "/CN=testmail@example.com", "sha256", key1[1]);
+ testFails(CertificateStatus.DRAFT, c);
+ c.issue();
+
+ testFails(CertificateStatus.SIGNING, c);
+ c.waitFor(60000);
+
+ testFails(CertificateStatus.ISSUED, c);
+ c.revoke();
+
+ testFails(CertificateStatus.BEING_REVOKED, c);
+ c.waitFor(60000);
+
+ testFails(CertificateStatus.REVOKED, c);
+
+ }
+
+ private void testFails(CertificateStatus status, Certificate c) throws IOException, GeneralSecurityException,
+ SQLException {
+ if (status != CertificateStatus.ISSUED) {
+ try {
+ c.revoke();
+ fail("is in invalid state");
+ } catch (IllegalStateException ise) {
+
+ }
+ }
+ if (status != CertificateStatus.DRAFT) {
+ try {
+ c.issue();
+ fail("is in invalid state");
+ } catch (IllegalStateException ise) {
+
+ }
+ }
+ if (status != CertificateStatus.ISSUED) {
+ try {
+ c.cert();
+ fail("is in invalid state");
+ } catch (IllegalStateException ise) {
+
+ }
+ }
+ }
+}
--- /dev/null
+package org.cacert.gigi.testUtils;
+
+import java.security.KeyFactory;
+import java.security.NoSuchAlgorithmException;
+import java.security.PrivateKey;
+import java.security.spec.InvalidKeySpecException;
+import java.security.spec.PKCS8EncodedKeySpec;
+import java.util.Base64;
+
+public class PemKey {
+ public static PrivateKey parsePEMPrivateKey(String privKeyPEM) throws NoSuchAlgorithmException,
+ InvalidKeySpecException {
+ privKeyPEM = privKeyPEM.replace("-----BEGIN PRIVATE KEY-----", "").replace("\n", "");
+ // Remove the first and last lines
+ privKeyPEM = privKeyPEM.replace("-----END PRIVATE KEY-----", "");
+
+ // Base64 decode the data
+ byte[] encoded = Base64.getDecoder().decode(privKeyPEM);
+
+ // PKCS8 decode the encoded RSA private key
+ PKCS8EncodedKeySpec keySpec = new PKCS8EncodedKeySpec(encoded);
+ KeyFactory kf = KeyFactory.getInstance("RSA");
+ PrivateKey privKey = kf.generatePrivate(keySpec);
+ return privKey;
+ }
+}
runner = new Thread() {
@Override
public void run() {
- try {
- gencrl();
- } catch (IOException e2) {
- e2.printStackTrace();
- } catch (InterruptedException e2) {
- e2.printStackTrace();
- }
- while (running) {
- try {
- signCertificates();
- revokeCertificates();
- Thread.sleep(5000);
- } catch (IOException e) {
- e.printStackTrace();
- } catch (SQLException e) {
- e.printStackTrace();
- } catch (InterruptedException e1) {
- }
- }
+ work();
}
+
};
runner.start();
}
+ private static void work() {
+ try {
+ gencrl();
+ } catch (IOException e2) {
+ e2.printStackTrace();
+ } catch (InterruptedException e2) {
+ e2.printStackTrace();
+ }
+ while (running) {
+ try {
+ signCertificates();
+ revokeCertificates();
+ Thread.sleep(5000);
+ } catch (IOException e) {
+ e.printStackTrace();
+ } catch (SQLException e) {
+ e.printStackTrace();
+ } catch (InterruptedException e1) {
+ }
+ }
+ }
+
private static void revokeCertificates() throws SQLException, IOException, InterruptedException {
ResultSet rs = revoke.executeQuery();
boolean worked = false;
X509Certificate crtp = (X509Certificate) cf.generateCertificate(is);
BigInteger serial = crtp.getSerialNumber();
updateMail.setString(1, crt.getPath());
- updateMail.setString(2, serial.toString());
+ updateMail.setString(2, serial.toString(16));
updateMail.setInt(3, id);
updateMail.execute();
System.out.println("sign: " + id);
projects / gigi.git / commitdiff