[Pki-devel] [PATCH] 687 Added CLI to manage keys in PKCS #12 file.
Endi Sukma Dewata
edewata at redhat.com
Wed Feb 17 19:52:37 UTC 2016
A new CLI has been added to remove a key from a PKCS #12 file
based using the key ID. The CLIs have been modified to display
key IDs.
https://fedorahosted.org/pki/ticket/1742
This depends on patch #686.
--
Endi S. Dewata
-------------- next part --------------
From 6ed1457fe1957cc5a16f77731559b0c5da620abb Mon Sep 17 00:00:00 2001
From: "Endi S. Dewata" <edewata at redhat.com>
Date: Wed, 17 Feb 2016 18:06:55 +0100
Subject: [PATCH] Added CLI to manage keys in PKCS #12 file.
A new CLI has been added to remove a key from a PKCS #12 file
based using the key ID. The CLIs have been modified to display
key IDs.
https://fedorahosted.org/pki/ticket/1742
---
.../netscape/cmstools/pkcs12/PKCS12CertCLI.java | 2 +
.../com/netscape/cmstools/pkcs12/PKCS12KeyCLI.java | 4 +
.../cmstools/pkcs12/PKCS12KeyRemoveCLI.java | 150 +++++++++++++++++++++
3 files changed, 156 insertions(+)
create mode 100644 base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12KeyRemoveCLI.java
diff --git a/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertCLI.java b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertCLI.java
index 13595f51ad7d71ce6012b2e450c09988ad513c8e..b47cdfe3e15168f31e59c8fb7980545fb97481e2 100644
--- a/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertCLI.java
+++ b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertCLI.java
@@ -19,6 +19,7 @@
package com.netscape.cmstools.pkcs12;
import com.netscape.certsrv.dbs.certdb.CertId;
+import com.netscape.certsrv.dbs.keydb.KeyId;
import com.netscape.cmstools.cli.CLI;
import netscape.security.pkcs.PKCS12CertInfo;
@@ -41,6 +42,7 @@ public class PKCS12CertCLI extends CLI {
System.out.println(" Nickname: " + certInfo.getNickname());
System.out.println(" Subject DN: " + certInfo.getCert().getSubjectDN());
System.out.println(" Issuer DN: " + certInfo.getCert().getIssuerDN());
+ System.out.println(" Key ID: " + new KeyId(certInfo.getKeyID()).toHexString());
if (certInfo.getTrustFlags() != null) {
System.out.println(" Trust flags: " + certInfo.getTrustFlags());
diff --git a/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12KeyCLI.java b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12KeyCLI.java
index 89565778702fbdc29e94385b0d0381f09db5508d..89c0c8e2da9efe1ddbf0bc779db7fe2a73def52e 100644
--- a/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12KeyCLI.java
+++ b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12KeyCLI.java
@@ -18,6 +18,7 @@
package com.netscape.cmstools.pkcs12;
+import com.netscape.certsrv.dbs.keydb.KeyId;
import com.netscape.cmstools.cli.CLI;
import netscape.security.pkcs.PKCS12KeyInfo;
@@ -31,9 +32,12 @@ public class PKCS12KeyCLI extends CLI {
super("key", "PKCS #12 key management commands", parent);
addModule(new PKCS12KeyFindCLI(this));
+ addModule(new PKCS12KeyRemoveCLI(this));
}
public static void printKeyInfo(PKCS12KeyInfo keyInfo) throws Exception {
+
+ System.out.println(" Key ID: " + new KeyId(keyInfo.getID()).toHexString());
System.out.println(" Subject DN: " + keyInfo.getSubjectDN());
System.out.println(" Algorithm: " + keyInfo.getPrivateKeyInfo().getAlgorithm());
}
diff --git a/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12KeyRemoveCLI.java b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12KeyRemoveCLI.java
new file mode 100644
index 0000000000000000000000000000000000000000..5d9a1591e8d021dcb47248d6952e7a7b0586fc60
--- /dev/null
+++ b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12KeyRemoveCLI.java
@@ -0,0 +1,150 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2016 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+
+package com.netscape.cmstools.pkcs12;
+
+import java.io.BufferedReader;
+import java.io.FileReader;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+
+import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.Option;
+import org.apache.commons.cli.ParseException;
+import org.mozilla.jss.util.Password;
+
+import com.netscape.certsrv.dbs.keydb.KeyId;
+import com.netscape.cmstools.cli.CLI;
+import com.netscape.cmstools.cli.MainCLI;
+
+import netscape.security.pkcs.PKCS12;
+import netscape.security.pkcs.PKCS12Util;
+
+/**
+ * @author Endi S. Dewata
+ */
+public class PKCS12KeyRemoveCLI extends CLI {
+
+ public PKCS12KeyRemoveCLI(PKCS12KeyCLI certCLI) {
+ super("del", "Remove key from PKCS #12 file", certCLI);
+
+ createOptions();
+ }
+
+ public void printHelp() {
+ formatter.printHelp(getFullName() + " <key ID> [OPTIONS...]", options);
+ }
+
+ public void createOptions() {
+ Option option = new Option(null, "pkcs12", true, "PKCS #12 file");
+ option.setArgName("path");
+ options.addOption(option);
+
+ option = new Option(null, "pkcs12-password", true, "PKCS #12 password");
+ option.setArgName("password");
+ options.addOption(option);
+
+ option = new Option(null, "pkcs12-password-file", true, "PKCS #12 password file");
+ option.setArgName("path");
+ options.addOption(option);
+
+ options.addOption("v", "verbose", false, "Run in verbose mode.");
+ options.addOption(null, "debug", false, "Run in debug mode.");
+ options.addOption(null, "help", false, "Show help message.");
+ }
+
+ public void execute(String[] args) throws Exception {
+
+ CommandLine cmd = null;
+
+ try {
+ cmd = parser.parse(options, args);
+ } catch (ParseException e) {
+ System.err.println("Error: " + e.getMessage());
+ printHelp();
+ System.exit(-1);
+ }
+
+ if (cmd.hasOption("help")) {
+ printHelp();
+ System.exit(0);
+ }
+
+ if (cmd.hasOption("verbose")) {
+ Logger.getLogger("org.dogtagpki").setLevel(Level.INFO);
+ Logger.getLogger("com.netscape").setLevel(Level.INFO);
+ Logger.getLogger("netscape").setLevel(Level.INFO);
+
+ } else if (cmd.hasOption("debug")) {
+ Logger.getLogger("org.dogtagpki").setLevel(Level.FINE);
+ Logger.getLogger("com.netscape").setLevel(Level.FINE);
+ Logger.getLogger("netscape").setLevel(Level.FINE);
+ }
+
+ String[] cmdArgs = cmd.getArgs();
+
+ if (cmdArgs.length == 0) {
+ System.err.println("Error: Missing key ID.");
+ printHelp();
+ System.exit(-1);
+ }
+
+ KeyId keyID = new KeyId(cmdArgs[0]);
+
+ String filename = cmd.getOptionValue("pkcs12");
+
+ if (filename == null) {
+ System.err.println("Error: Missing PKCS #12 file.");
+ printHelp();
+ System.exit(-1);
+ }
+
+ String passwordString = cmd.getOptionValue("pkcs12-password");
+
+ if (passwordString == null) {
+
+ String passwordFile = cmd.getOptionValue("pkcs12-password-file");
+ if (passwordFile != null) {
+ try (BufferedReader in = new BufferedReader(new FileReader(passwordFile))) {
+ passwordString = in.readLine();
+ }
+ }
+ }
+
+ if (passwordString == null) {
+ System.err.println("Error: Missing PKCS #12 password.");
+ printHelp();
+ System.exit(-1);
+ }
+
+ Password password = new Password(passwordString.toCharArray());
+
+ try {
+ PKCS12Util util = new PKCS12Util();
+
+ PKCS12 pkcs12 = util.loadFromFile(filename, password);
+ pkcs12.removeKeyInfoByID(keyID.toBigInteger());
+ util.storeIntoFile(pkcs12, filename, password);
+
+ } finally {
+ password.clear();
+ }
+
+ MainCLI.printMessage("Deleted key \"" + keyID.toHexString() + "\"");
+ }
+}
--
2.4.3
More information about the Pki-devel
mailing list