package dk.cryptography;
import java.io.FileInputStream;
import java.math.BigInteger;
import java.security.Principal;
import java.security.PrivateKey;
import java.security.PublicKey;
import java.security.cert.Certificate;
import java.security.cert.CertificateFactory;
import java.security.cert.X509CRL;
import java.security.cert.X509CRLEntry;
import java.util.Date;
import java.util.HashSet;
import java.util.Iterator;
import java.util.Set;
/**
* About: general managemnt of PKCS#12 certificate format.<br><br>
*
* @author dk.cryptography (http://www.cryptography.dk)
*
* Copyright dk.cryptography /2004
* Revision 1.0, stigv@hotmail.com
*
* Web reference: http://www.cryptography.dk
* http://www.topsecurity.dk
* http://www.compression.dk
*
* Open source software under the terms of the
* GNU Lesser General Public License as published by the
* Free Software Foundation. Please observe:
* http://www.gnu.org/licenses/lgpl.txt.
*
* Permission to use, copy, modify, and distribute this software
* for any purpose and without fee is hereby granted, provided
* that the above copyright notices appear in all copies and that
* both the copyright notice and this permission notice appear in
* supporting documentation.
*
* This code is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Lesser General Public License for more details.
*
*/
public class TestCRLandPKCS12
{
public static void main(String [] argv)
{
try {
/*
* First part - analyzing the CRL
* Looping through the entries and retrieving information about the contents
*
*/
if(argv.length<4) {
System.out.println("Parameter usage: <crl filename> <pkcs12 filename> <password> <CA certificate filename>");
System.exit(1);
}
String crlFileName = argv[0];
String pkcs12FileName = argv[1];
String pkcs12Password = argv[2];
String certCAFileName = argv[3];
// Analyzing the CRL - using appropriate certificate factory...
CertificateFactory certificatefactory = CertificateFactory.getInstance("X.509");
// File specified on the command line must contain a single DER-encoded X.509 CRL.
FileInputStream fileinputstream = new FileInputStream(crlFileName); // Open file
// Generate a certificate from the data in the file.
X509CRL x509crl = (X509CRL)certificatefactory.generateCRL(fileinputstream);
System.out.println(">>CRL info<<"); // Request information about the crl.
System.out.println("type = " + x509crl.getType());
System.out.println("version = " + x509crl.getVersion());
System.out.println("issuer = " + x509crl.getIssuerDN().getName());
System.out.println("signing algorithm = " + x509crl.getSigAlgName());
System.out.println("signing OID = " + x509crl.getSigAlgOID());
System.out.println("this update = " + x509crl.getThisUpdate());
System.out.println("next update = " + x509crl.getNextUpdate());
Set serialSet = new HashSet(); //keep track of the serials encountered in the CRL
Set setEntries = x509crl.getRevokedCertificates();
Date startDate=null, endDate=null;
int hasExtentions =0;
if (setEntries != null && setEntries.isEmpty() == false)
{
for (Iterator iterator = setEntries.iterator();
iterator.hasNext(); ) {
X509CRLEntry x509crlentry = (X509CRLEntry)iterator.next();
BigInteger bi = x509crlentry.getSerialNumber();
serialSet.add(bi); //serial number
Date revokeDate = x509crlentry.getRevocationDate();
if(startDate==null || revokeDate.before(startDate))
startDate = revokeDate;
if(endDate==null || revokeDate.after(endDate))
endDate = revokeDate;
if(x509crlentry.hasExtensions())
hasExtentions++;
}
}
fileinputstream.close();
System.out.println("Number in total="+setEntries.size());
System.out.println("Number having extensions="+setEntries.size());
System.out.println("Revokation dates in range="+startDate+" to "+endDate);
System.out.println();
/*
* Second part - applying the CRL information
*
*/
System.out.println(">>PKCS#12 info<<"); // Request information about the crl.
char[] passwordCharArray = pkcs12Password.toCharArray();
Pkcs12CertificateManager pkcs12 = new Pkcs12CertificateManager(new java.io.File(pkcs12FileName),passwordCharArray);
System.out.println("Checking PKCS#12 for revoked, the X509CRL class says: "
+ x509crl.isRevoked(pkcs12.getOwnerCertificate(passwordCharArray))
+"\n and the ID list number compare says: "
+serialSet.contains(pkcs12.getSerialNumber(passwordCharArray)) );
System.out.println();
/*
* Third part - retrieve general information from the PKCS#12 file
*
*/
System.out.println("PKCS#12 certificate valid from="+pkcs12.getNotBefore(passwordCharArray)+" to "+pkcs12.getNotAfter(passwordCharArray));
Principal p = pkcs12.getSubjectDN(passwordCharArray);
String subjectDN = p!=null ? p.toString() : null;
System.out.println("Certificate holder in keystore "
+(subjectDN!=null ? "is really known as="+ subjectDN :
"has no associated X.509 certificate subject DN"));
String verifier = pkcs12.getCertificateVerifier(passwordCharArray);
System.out.println("Certificate issuer/verification part "
+(verifier!=null ? "is "+ verifier :
"isn't recognized as a X.509 certificate holder"));
Certificate ownerCert = pkcs12.getOwnerCertificate(passwordCharArray);
PrivateKey privKey = pkcs12.getPrivateKey(passwordCharArray);
PublicKey pubKey = pkcs12.getPublicKey(passwordCharArray);
System.out.println("Holders private key uses algorithm: "+ privKey.getAlgorithm());
System.out.println("Holders public key uses algorithm: "+ pubKey.getAlgorithm());
System.out.println("Usage types="+pkcs12.getKeyUsage(passwordCharArray)); System.out.flush();
System.out.println("Holders certificate may be exported as=\n"+pkcs12.exportCert(ownerCert)+"\n");
System.out.println();
/*
* Fourth part - verifying PKCS#12 contents using CA certificate
*
*/
System.out.println(">>CA verification info<<"); // Request information about the crl.
FileInputStream isCA = new FileInputStream(certCAFileName); //get the CA certificate..
CertificateFactory cf = CertificateFactory.getInstance("X.509");
java.security.cert.Certificate certCA = cf.generateCertificate(isCA);
isCA.close();
PublicKey pubKeyCA = certCA.getPublicKey(); //get the public key used to verify the PKCS#12
try {
pkcs12.validateCA(passwordCharArray, pubKeyCA);
System.out.println("CA validation successfull");
}
catch(Exception ex) {
System.out.println("CA validation failed");
ex.printStackTrace();
}
}
catch (Exception exception)
{
exception.printStackTrace();
}
}
}