[Pki-devel] [PATCH] 681 Added CLIs to inspect PKCS #12 file.
Endi Sukma Dewata
edewata at redhat.com
Fri Feb 12 17:26:14 UTC 2016
The pki pkcs12-cert-find and pki pkcs12-key-find commands have
been added to list the certificates and keys in a PKCS #12 file.
https://fedorahosted.org/pki/ticket/1742
--
Endi S. Dewata
-------------- next part --------------
From 3529f2601a0020e781582b6f2382c4798c967687 Mon Sep 17 00:00:00 2001
From: "Endi S. Dewata" <edewata at redhat.com>
Date: Tue, 9 Feb 2016 18:41:40 +0100
Subject: [PATCH] Added CLIs to inspect PKCS #12 file.
The pki pkcs12-cert-find and pki pkcs12-key-find commands have
been added to list the certificates and keys in a PKCS #12 file.
https://fedorahosted.org/pki/ticket/1742
---
base/java-tools/bin/pki | 9 +-
.../src/com/netscape/cmstools/cli/MainCLI.java | 3 +
.../com/netscape/cmstools/pkcs12/PKCS12CLI.java | 45 ++++++
.../netscape/cmstools/pkcs12/PKCS12CertCLI.java | 41 +++++
.../cmstools/pkcs12/PKCS12CertFindCLI.java | 124 +++++++++++++++
.../com/netscape/cmstools/pkcs12/PKCS12KeyCLI.java | 43 +++++
.../netscape/cmstools/pkcs12/PKCS12KeyFindCLI.java | 157 ++++++++++++++++++
.../src/netscape/security/pkcs/PKCS12Util.java | 176 +++++++++++++++++++++
8 files changed, 597 insertions(+), 1 deletion(-)
create mode 100644 base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CLI.java
create mode 100644 base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertCLI.java
create mode 100644 base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertFindCLI.java
create mode 100644 base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12KeyCLI.java
create mode 100644 base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12KeyFindCLI.java
diff --git a/base/java-tools/bin/pki b/base/java-tools/bin/pki
index 4b8e69a55f38fa9a6e5272520b585e9ed7d23be1..ce322a2ec7b853e6beacc28c26bfe39e0875571a 100644
--- a/base/java-tools/bin/pki
+++ b/base/java-tools/bin/pki
@@ -29,10 +29,16 @@ def run_java_cli(args):
# read RESTEasy library path
value = subprocess.check_output(
- '. /etc/pki/pki.conf && echo $RESTEASY_LIB',
+ '. /usr/share/pki/etc/pki.conf && . /etc/pki/pki.conf && echo $RESTEASY_LIB',
shell=True)
resteasy_lib = value.decode(sys.getfilesystemencoding()).strip()
+ # read logging configuration path
+ value = subprocess.check_output(
+ '. /usr/share/pki/etc/pki.conf && . /etc/pki/pki.conf && echo $LOGGING_CONFIG',
+ shell=True)
+ logging_config = value.decode(sys.getfilesystemencoding()).strip()
+
# construct classpath
classpath = [
'/usr/share/java/commons-cli.jar',
@@ -71,6 +77,7 @@ def run_java_cli(args):
'java',
'-cp',
':'.join(classpath),
+ '-Djava.util.logging.config.file=' + logging_config,
'com.netscape.cmstools.cli.MainCLI'
]
diff --git a/base/java-tools/src/com/netscape/cmstools/cli/MainCLI.java b/base/java-tools/src/com/netscape/cmstools/cli/MainCLI.java
index 159e4ac5a21e741ef7ee15b313a91f8e389dd941..797f3cb03300daa721b66f21d6939c039c9c4e06 100644
--- a/base/java-tools/src/com/netscape/cmstools/cli/MainCLI.java
+++ b/base/java-tools/src/com/netscape/cmstools/cli/MainCLI.java
@@ -49,6 +49,7 @@ import com.netscape.cmstools.cert.CertCLI;
import com.netscape.cmstools.client.ClientCLI;
import com.netscape.cmstools.group.GroupCLI;
import com.netscape.cmstools.key.KeyCLI;
+import com.netscape.cmstools.pkcs12.PKCS12CLI;
import com.netscape.cmstools.system.SecurityDomainCLI;
import com.netscape.cmstools.user.UserCLI;
@@ -85,6 +86,8 @@ public class MainCLI extends CLI {
addModule(new TKSCLI(this));
addModule(new TPSCLI(this));
+ addModule(new PKCS12CLI(this));
+
createOptions();
}
diff --git a/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CLI.java b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CLI.java
new file mode 100644
index 0000000000000000000000000000000000000000..f69fcac53bb8afef502e8b3656fd02731892b43b
--- /dev/null
+++ b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CLI.java
@@ -0,0 +1,45 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2016 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+
+package com.netscape.cmstools.pkcs12;
+
+import com.netscape.cmstools.cli.CLI;
+import com.netscape.cmstools.cli.MainCLI;
+
+/**
+ * @author Endi S. Dewata
+ */
+public class PKCS12CLI extends CLI {
+
+ public PKCS12CLI(CLI parent) {
+ super("pkcs12", "PKCS #12 utilities", parent);
+
+ addModule(new PKCS12CertCLI(this));
+ addModule(new PKCS12KeyCLI(this));
+ }
+
+ public String getFullName() {
+ if (parent instanceof MainCLI) {
+ // do not include MainCLI's name
+ return name;
+ } else {
+ return parent.getFullName() + "-" + name;
+ }
+ }
+
+}
diff --git a/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertCLI.java b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertCLI.java
new file mode 100644
index 0000000000000000000000000000000000000000..2179c186c37ed324933f8f5867d954cc67a158ee
--- /dev/null
+++ b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertCLI.java
@@ -0,0 +1,41 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2016 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+
+package com.netscape.cmstools.pkcs12;
+
+import com.netscape.cmstools.cli.CLI;
+
+import netscape.security.pkcs.PKCS12Util.PKCS12CertInfo;
+
+/**
+ * @author Endi S. Dewata
+ */
+public class PKCS12CertCLI extends CLI {
+
+ public PKCS12CertCLI(PKCS12CLI parent) {
+ super("cert", "PKCS #12 certificate management commands", parent);
+
+ addModule(new PKCS12CertFindCLI(this));
+ }
+
+ public static void printCertInfo(PKCS12CertInfo certInfo) throws Exception {
+ System.out.println(" Nickname: " + certInfo.nickname);
+ System.out.println(" Subject: " + certInfo.cert.getSubjectDN());
+ System.out.println(" Issuer: " + certInfo.cert.getIssuerDN());
+ }
+}
diff --git a/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertFindCLI.java b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertFindCLI.java
new file mode 100644
index 0000000000000000000000000000000000000000..4cbfee5183d0c1a59140e0b560a2d2859adadcd8
--- /dev/null
+++ b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertFindCLI.java
@@ -0,0 +1,124 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2016 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+
+package com.netscape.cmstools.pkcs12;
+
+import java.util.List;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+
+import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.Option;
+import org.apache.commons.cli.ParseException;
+
+import com.netscape.cmstools.cli.CLI;
+import com.netscape.cmstools.cli.MainCLI;
+
+import netscape.security.pkcs.PKCS12Util;
+import netscape.security.pkcs.PKCS12Util.PKCS12CertInfo;
+
+/**
+ * @author Endi S. Dewata
+ */
+public class PKCS12CertFindCLI extends CLI {
+
+ public PKCS12CertFindCLI(PKCS12CertCLI certCLI) {
+ super("find", "Find certificates in PKCS #12 file", certCLI);
+
+ createOptions();
+ }
+
+ public void printHelp() {
+ formatter.printHelp(getFullName() + " [OPTIONS...]", options);
+ }
+
+ public void createOptions() {
+ Option option = new Option(null, "pkcs12", true, "PKCS #12 file");
+ option.setArgName("path");
+ options.addOption(option);
+
+ options.addOption("v", "verbose", false, "Run in verbose mode.");
+ options.addOption(null, "debug", false, "Run in debug mode.");
+ options.addOption(null, "help", false, "Show help message.");
+ }
+
+ public void execute(String[] args) throws Exception {
+
+ CommandLine cmd = null;
+
+ try {
+ cmd = parser.parse(options, args);
+ } catch (ParseException e) {
+ System.err.println("Error: " + e.getMessage());
+ printHelp();
+ System.exit(-1);
+ }
+
+ if (cmd.hasOption("help")) {
+ printHelp();
+ System.exit(0);
+ }
+
+ if (cmd.hasOption("verbose")) {
+ Logger.getLogger("org.dogtagpki").setLevel(Level.INFO);
+ Logger.getLogger("com.netscape").setLevel(Level.INFO);
+ Logger.getLogger("netscape").setLevel(Level.INFO);
+
+ } else if (cmd.hasOption("debug")) {
+ Logger.getLogger("org.dogtagpki").setLevel(Level.FINE);
+ Logger.getLogger("com.netscape").setLevel(Level.FINE);
+ Logger.getLogger("netscape").setLevel(Level.FINE);
+ }
+
+ String[] cmdArgs = cmd.getArgs();
+
+ if (cmdArgs.length != 0) {
+ System.err.println("Error: Too many arguments specified.");
+ printHelp();
+ System.exit(-1);
+ }
+
+ String filename = cmd.getOptionValue("pkcs12");
+
+ if (filename == null) {
+ System.err.println("Error: Missing PKCS #12 file.");
+ printHelp();
+ System.exit(-1);
+ }
+
+ PKCS12Util util = new PKCS12Util();
+ util.loadFromPKCS12(filename);
+
+ List<PKCS12CertInfo> certInfos = util.getCertInfos();
+
+ MainCLI.printMessage(certInfos.size() + " entries found");
+ if (certInfos.size() == 0) return;
+
+ boolean first = true;
+
+ for (PKCS12CertInfo certInfo : certInfos) {
+ if (first) {
+ first = false;
+ } else {
+ System.out.println();
+ }
+
+ PKCS12CertCLI.printCertInfo(certInfo);
+ }
+ }
+}
diff --git a/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12KeyCLI.java b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12KeyCLI.java
new file mode 100644
index 0000000000000000000000000000000000000000..9612e2f4ace7e04ccbaa5e40d068aee1b0df6c9f
--- /dev/null
+++ b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12KeyCLI.java
@@ -0,0 +1,43 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2016 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+
+package com.netscape.cmstools.pkcs12;
+
+import com.netscape.cmstools.cli.CLI;
+
+import netscape.security.pkcs.PKCS12Util.PKCS12KeyInfo;
+
+/**
+ * @author Endi S. Dewata
+ */
+public class PKCS12KeyCLI extends CLI {
+
+ public PKCS12KeyCLI(PKCS12CLI parent) {
+ super("key", "PKCS# 12 key management commands", parent);
+
+ addModule(new PKCS12KeyFindCLI(this));
+ }
+
+ public static void printKeyInfo(PKCS12KeyInfo keyInfo) throws Exception {
+ System.out.println(" Subject: " + keyInfo.subjectDN);
+
+ if (keyInfo.privateKeyInfo != null) {
+ System.out.println(" Algorithm: " + keyInfo.privateKeyInfo.getAlgorithm());
+ }
+ }
+}
diff --git a/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12KeyFindCLI.java b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12KeyFindCLI.java
new file mode 100644
index 0000000000000000000000000000000000000000..4f630b0cf20055b510c9b0578c5d2c94af31e597
--- /dev/null
+++ b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12KeyFindCLI.java
@@ -0,0 +1,157 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2016 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+
+package com.netscape.cmstools.pkcs12;
+
+import java.io.BufferedReader;
+import java.io.FileReader;
+import java.util.List;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+
+import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.Option;
+import org.apache.commons.cli.ParseException;
+import org.mozilla.jss.util.Password;
+
+import com.netscape.cmstools.cli.CLI;
+import com.netscape.cmstools.cli.MainCLI;
+
+import netscape.security.pkcs.PKCS12Util;
+import netscape.security.pkcs.PKCS12Util.PKCS12KeyInfo;
+
+/**
+ * @author Endi S. Dewata
+ */
+public class PKCS12KeyFindCLI extends CLI {
+
+ public PKCS12KeyFindCLI(PKCS12KeyCLI certCLI) {
+ super("find", "Find keys in PKCS #12 file", certCLI);
+
+ createOptions();
+ }
+
+ public void printHelp() {
+ formatter.printHelp(getFullName() + " [OPTIONS...]", options);
+ }
+
+ public void createOptions() {
+ Option option = new Option(null, "pkcs12", true, "PKCS #12 file");
+ option.setArgName("path");
+ options.addOption(option);
+
+ option = new Option(null, "pkcs12-password", true, "PKCS #12 password");
+ option.setArgName("path");
+ options.addOption(option);
+
+ option = new Option(null, "pkcs12-password-file", true, "PKCS #12 password file");
+ option.setArgName("path");
+ options.addOption(option);
+
+ options.addOption("v", "verbose", false, "Run in verbose mode.");
+ options.addOption(null, "help", false, "Show help message.");
+ }
+
+ public void execute(String[] args) throws Exception {
+
+ CommandLine cmd = null;
+
+ try {
+ cmd = parser.parse(options, args);
+ } catch (ParseException e) {
+ System.err.println("Error: " + e.getMessage());
+ printHelp();
+ System.exit(-1);
+ }
+
+ if (cmd.hasOption("help")) {
+ printHelp();
+ System.exit(0);
+ }
+
+ if (cmd.hasOption("verbose")) {
+ Logger.getLogger("org.dogtagpki").setLevel(Level.INFO);
+ Logger.getLogger("com.netscape").setLevel(Level.INFO);
+ Logger.getLogger("netscape").setLevel(Level.INFO);
+
+ } else if (cmd.hasOption("debug")) {
+ Logger.getLogger("org.dogtagpki").setLevel(Level.FINE);
+ Logger.getLogger("com.netscape").setLevel(Level.FINE);
+ Logger.getLogger("netscape").setLevel(Level.FINE);
+ }
+
+ String[] cmdArgs = cmd.getArgs();
+
+ if (cmdArgs.length != 0) {
+ System.err.println("Error: Too many arguments specified.");
+ printHelp();
+ System.exit(-1);
+ }
+
+ String filename = cmd.getOptionValue("pkcs12");
+
+ if (filename == null) {
+ System.err.println("Error: Missing PKCS #12 file.");
+ printHelp();
+ System.exit(-1);
+ }
+
+ String passwordString = cmd.getOptionValue("pkcs12-password");
+
+ if (passwordString == null) {
+
+ String passwordFile = cmd.getOptionValue("pkcs12-password-file");
+ if (passwordFile != null) {
+ try (BufferedReader in = new BufferedReader(new FileReader(passwordFile))) {
+ passwordString = in.readLine();
+ }
+ }
+ }
+
+ Password password = null;
+ if (passwordString != null) {
+ password = new Password(passwordString.toCharArray());
+ }
+
+ List<PKCS12KeyInfo> keyInfos;
+
+ try {
+ PKCS12Util util = new PKCS12Util();
+ util.loadFromPKCS12(filename);
+
+ keyInfos = util.getKeyInfos(password);
+ } finally {
+ if (password != null) password.clear();
+ }
+
+ MainCLI.printMessage(keyInfos.size() + " entries found");
+ if (keyInfos.size() == 0) return;
+
+ boolean first = true;
+
+ for (PKCS12KeyInfo keyInfo : keyInfos) {
+ if (first) {
+ first = false;
+ } else {
+ System.out.println();
+ }
+
+ PKCS12KeyCLI.printKeyInfo(keyInfo);
+ }
+ }
+}
diff --git a/base/util/src/netscape/security/pkcs/PKCS12Util.java b/base/util/src/netscape/security/pkcs/PKCS12Util.java
index 63051858e05a23e2f8b39503e2eaad07ad7dae1a..9d66ac6fb035ac5c11aeb71b086be41838d86c6d 100644
--- a/base/util/src/netscape/security/pkcs/PKCS12Util.java
+++ b/base/util/src/netscape/security/pkcs/PKCS12Util.java
@@ -17,15 +17,23 @@
// --- END COPYRIGHT BLOCK ---
package netscape.security.pkcs;
+import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.FileOutputStream;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
import java.security.MessageDigest;
+import java.util.ArrayList;
+import java.util.List;
import java.util.logging.Logger;
import org.mozilla.jss.CryptoManager;
+import org.mozilla.jss.asn1.ANY;
import org.mozilla.jss.asn1.ASN1Util;
import org.mozilla.jss.asn1.ASN1Value;
import org.mozilla.jss.asn1.BMPString;
+import org.mozilla.jss.asn1.OBJECT_IDENTIFIER;
import org.mozilla.jss.asn1.OCTET_STRING;
import org.mozilla.jss.asn1.SEQUENCE;
import org.mozilla.jss.asn1.SET;
@@ -48,16 +56,30 @@ import org.mozilla.jss.pkcs12.CertBag;
import org.mozilla.jss.pkcs12.PFX;
import org.mozilla.jss.pkcs12.PasswordConverter;
import org.mozilla.jss.pkcs12.SafeBag;
+import org.mozilla.jss.pkix.primitive.Attribute;
import org.mozilla.jss.pkix.primitive.EncryptedPrivateKeyInfo;
import org.mozilla.jss.pkix.primitive.PrivateKeyInfo;
import org.mozilla.jss.util.Password;
+import netscape.security.x509.X509CertImpl;
+
public class PKCS12Util {
private static Logger logger = Logger.getLogger(PKCS12Util.class.getName());
PFX pfx;
+ public static class PKCS12KeyInfo {
+ public EncryptedPrivateKeyInfo encPrivateKeyInfo;
+ public PrivateKeyInfo privateKeyInfo;
+ public String subjectDN;
+ }
+
+ public static class PKCS12CertInfo {
+ public X509CertImpl cert;
+ public String nickname;
+ }
+
byte[] getEncodedKey(PrivateKey privateKey) throws Exception {
CryptoManager cm = CryptoManager.getInstance();
@@ -211,4 +233,158 @@ public class PKCS12Util {
loadFromNSS(password);
storeIntoPKCS12(filename, password);
}
+
+ public PKCS12KeyInfo getKeyInfo(SafeBag bag, Password password) throws Exception {
+
+ // get private key info
+ EncryptedPrivateKeyInfo encPrivateKeyInfo = (EncryptedPrivateKeyInfo) bag.getInterpretedBagContent();
+
+ PrivateKeyInfo privateKeyInfo = null;
+ if (password != null) {
+ privateKeyInfo = encPrivateKeyInfo.decrypt(password, new PasswordConverter());
+ }
+
+ // find private key's subject DN
+ SET bagAttrs = bag.getBagAttributes();
+ String subjectDN = null;
+
+ for (int i = 0; i < bagAttrs.size(); i++) {
+
+ Attribute attr = (Attribute) bagAttrs.elementAt(i);
+ OBJECT_IDENTIFIER oid = attr.getType();
+
+ if (!oid.equals(SafeBag.FRIENDLY_NAME)) continue;
+
+ SET values = attr.getValues();
+ ANY value = (ANY) values.elementAt(0);
+
+ ByteArrayInputStream bbis = new ByteArrayInputStream(value.getEncoded());
+ BMPString sss = (BMPString) new BMPString.Template().decode(bbis);
+ subjectDN = sss.toString();
+
+ break;
+ }
+
+ logger.fine("Found private key " + subjectDN);
+
+ PKCS12KeyInfo keyInfo = new PKCS12KeyInfo();
+ keyInfo.encPrivateKeyInfo = encPrivateKeyInfo;
+ keyInfo.privateKeyInfo = privateKeyInfo;
+ keyInfo.subjectDN = subjectDN;
+
+ return keyInfo;
+ }
+
+ public PKCS12KeyInfo getKeyInfo(SafeBag bag) throws Exception {
+ return getKeyInfo(bag, null);
+ }
+
+ public PKCS12CertInfo getCertInfo(SafeBag bag) throws Exception {
+
+ CertBag certBag = (CertBag) bag.getInterpretedBagContent();
+
+ OCTET_STRING str = (OCTET_STRING) certBag.getInterpretedCert();
+ byte[] x509cert = str.toByteArray();
+
+ // find cert's nickname
+ SET bagAttrs = bag.getBagAttributes();
+ String nickname = null;
+
+ if (bagAttrs != null) {
+
+ for (int k = 0; k < bagAttrs.size(); k++) {
+
+ Attribute attr = (Attribute) bagAttrs.elementAt(k);
+ OBJECT_IDENTIFIER oid = attr.getType();
+
+ if (!oid.equals(SafeBag.FRIENDLY_NAME)) continue;
+ SET values = attr.getValues();
+ ANY value = (ANY) values.elementAt(0);
+
+ ByteArrayInputStream bbis = new ByteArrayInputStream(value.getEncoded());
+ BMPString sss = (BMPString) (new BMPString.Template()).decode(bbis);
+ nickname = sss.toString();
+
+ break;
+ }
+ }
+
+ X509CertImpl certImpl = new X509CertImpl(x509cert);
+
+ logger.fine("Found certificate " + certImpl.getSubjectDN() + (nickname == null ? "" : " (" + nickname + ")"));
+
+ PKCS12CertInfo certInfo = new PKCS12CertInfo();
+ certInfo.cert = certImpl;
+ certInfo.nickname = nickname;
+
+ return certInfo;
+ }
+
+ public List<PKCS12KeyInfo> getKeyInfos(Password password) throws Exception {
+
+ logger.fine("Getting private keys");
+
+ List<PKCS12KeyInfo> keyInfos = new ArrayList<PKCS12KeyInfo>();
+ AuthenticatedSafes safes = pfx.getAuthSafes();
+
+ for (int i = 0; i < safes.getSize(); i++) {
+
+ SEQUENCE contents = safes.getSafeContentsAt(null, i);
+
+ for (int j = 0; j < contents.size(); j++) {
+
+ SafeBag bag = (SafeBag) contents.elementAt(j);
+ OBJECT_IDENTIFIER oid = bag.getBagType();
+
+ if (!oid.equals(SafeBag.PKCS8_SHROUDED_KEY_BAG)) continue;
+
+ PKCS12KeyInfo keyInfo = getKeyInfo(bag, password);
+ keyInfos.add(keyInfo);
+ }
+ }
+
+ return keyInfos;
+ }
+
+ public List<PKCS12KeyInfo> getKeyInfos() throws Exception {
+ return getKeyInfos(null);
+ }
+
+ public List<PKCS12CertInfo> getCertInfos() throws Exception {
+
+ logger.fine("Getting certificates");
+
+ List<PKCS12CertInfo> certInfos = new ArrayList<PKCS12CertInfo>();
+ AuthenticatedSafes safes = pfx.getAuthSafes();
+
+ for (int i = 0; i < safes.getSize(); i++) {
+
+ SEQUENCE contents = safes.getSafeContentsAt(null, i);
+
+ for (int j = 0; j < contents.size(); j++) {
+
+ SafeBag bag = (SafeBag) contents.elementAt(j);
+ OBJECT_IDENTIFIER oid = bag.getBagType();
+
+ if (!oid.equals(SafeBag.CERT_BAG)) continue;
+
+ PKCS12CertInfo certInfo = getCertInfo(bag);
+ certInfos.add(certInfo);
+ }
+ }
+
+ return certInfos;
+ }
+
+ public void loadFromPKCS12(String filename) throws Exception {
+
+ logger.info("Loading PKCS #12 file");
+
+ Path path = Paths.get(filename);
+ byte[] b = Files.readAllBytes(path);
+
+ ByteArrayInputStream bis = new ByteArrayInputStream(b);
+
+ pfx = (PFX) (new PFX.Template()).decode(bis);
+ }
}
--
2.4.3
More information about the Pki-devel
mailing list