authz-certman/src/main/java/com/att/authz/cm/ca/DevlCA.java

   1 /*******************************************************************************\r
   2  * ============LICENSE_START====================================================\r
   3  * * org.onap.aaf\r
   4  * * ===========================================================================\r
   5  * * Copyright © 2017 AT&T Intellectual Property. All rights reserved.\r
   6  * * ===========================================================================\r
   7  * * Licensed under the Apache License, Version 2.0 (the "License");\r
   8  * * you may not use this file except in compliance with the License.\r
   9  * * You may obtain a copy of the License at\r
  10  * * \r
  11  *  *      http://www.apache.org/licenses/LICENSE-2.0\r
  12  * * \r
  13  *  * Unless required by applicable law or agreed to in writing, software\r
  14  * * distributed under the License is distributed on an "AS IS" BASIS,\r
  15  * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\r
  16  * * See the License for the specific language governing permissions and\r
  17  * * limitations under the License.\r
  18  * * ============LICENSE_END====================================================\r
  19  * *\r
  20  * * ECOMP is a trademark and service mark of AT&T Intellectual Property.\r
  21  * *\r
  22  ******************************************************************************/\r
  23 package com.att.authz.cm.ca;\r
  24 \r
  25 import java.io.File;\r
  26 import java.io.IOException;\r
  27 import java.math.BigInteger;\r
  28 import java.security.GeneralSecurityException;\r
  29 import java.security.KeyFactory;\r
  30 import java.security.cert.Certificate;\r
  31 import java.security.cert.CertificateException;\r
  32 import java.security.cert.X509Certificate;\r
  33 import java.security.interfaces.RSAPrivateKey;\r
  34 import java.security.spec.PKCS8EncodedKeySpec;\r
  35 import java.util.ArrayList;\r
  36 import java.util.Collection;\r
  37 import java.util.Date;\r
  38 import java.util.GregorianCalendar;\r
  39 import java.util.List;\r
  40 import java.security.SecureRandom;\r
  41 \r
  42 import org.bouncycastle.asn1.ASN1Sequence;\r
  43 import org.bouncycastle.asn1.x500.X500Name;\r
  44 import org.bouncycastle.asn1.x500.X500NameBuilder;\r
  45 import org.bouncycastle.asn1.x500.style.BCStyle;\r
  46 import org.bouncycastle.asn1.x509.BasicConstraints;\r
  47 import org.bouncycastle.asn1.x509.ExtendedKeyUsage;\r
  48 import org.bouncycastle.asn1.x509.Extension;\r
  49 import org.bouncycastle.asn1.x509.GeneralName;\r
  50 import org.bouncycastle.asn1.x509.GeneralNames;\r
  51 import org.bouncycastle.asn1.x509.KeyPurposeId;\r
  52 import org.bouncycastle.asn1.x509.KeyUsage;\r
  53 import org.bouncycastle.asn1.x509.SubjectPublicKeyInfo;\r
  54 import org.bouncycastle.cert.X509v3CertificateBuilder;\r
  55 import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;\r
  56 import org.bouncycastle.cert.jcajce.JcaX509ExtensionUtils;\r
  57 import org.bouncycastle.operator.OperatorCreationException;\r
  58 \r
  59 import com.att.authz.cm.cert.BCFactory;\r
  60 import com.att.authz.cm.cert.CSRMeta;\r
  61 import com.att.authz.cm.cert.StandardFields;\r
  62 import com.att.authz.common.Define;\r
  63 import com.att.cadi.cm.CertException;\r
  64 import com.att.cadi.cm.Factory;\r
  65 import com.att.inno.env.Env;\r
  66 import com.att.inno.env.TimeTaken;\r
  67 import com.att.inno.env.Trans;\r
  68 \r
  69 public class DevlCA extends CA {\r
  70         \r
  71         // Extensions\r
  72         private static final KeyPurposeId[] ASN_WebUsage = new KeyPurposeId[] {\r
  73                                 KeyPurposeId.id_kp_serverAuth, // WebServer\r
  74                                 KeyPurposeId.id_kp_clientAuth};// WebClient\r
  75                                 \r
  76         private X509Certificate caCert;\r
  77         private final RSAPrivateKey caKey;\r
  78         private final X500Name issuer;\r
  79         private final SecureRandom random = new SecureRandom();\r
  80         private byte[] serialish = new byte[24];\r
  81 \r
  82         public DevlCA(Trans trans, String name, String dirString) throws IOException, CertException {\r
  83                 super(name, new StandardFields() {\r
  84                         @Override\r
  85                         public void set(CSRMeta csr) {\r
  86                                 // Standard Fields\r
  87                                 csr.o("ATT Services, Inc.");\r
  88                                 csr.l("St Louis");\r
  89                                 csr.st("Missouri");\r
  90                                 csr.c("US");\r
  91                         }\r
  92                 }, Define.ROOT_NS+".ca" // Permission Type for validation\r
  93                 );\r
  94                 File dir = new File(dirString);\r
  95                 if(!dir.exists()) {\r
  96                         throw new CertException(dirString + " does not exist");\r
  97                 }\r
  98                 \r
  99                 File ca = new File(dir,"ca.crt");\r
 100                 if(ca.exists()) {\r
 101                         byte[] bytes = Factory.decode(ca);\r
 102                         Collection<? extends Certificate> certs;\r
 103                         try {\r
 104                                 certs = Factory.toX509Certificate(bytes);\r
 105                         } catch (CertificateException e) {\r
 106                                 throw new CertException(e);\r
 107                         }\r
 108                         List<String> lTrust = new ArrayList<String>();\r
 109                         caCert=null;\r
 110                         for(Certificate c : certs) {\r
 111                                 if(caCert==null) {\r
 112                                         caCert = (X509Certificate)c;\r
 113                                 } else {\r
 114                                         lTrust.add(Factory.toString(trans,c));\r
 115                                 }\r
 116                                 break;\r
 117                         }\r
 118                 }\r
 119                 \r
 120                 this.setTrustChain(new String[]{Factory.toString(trans,caCert)});\r
 121                                 \r
 122                         /*\r
 123                          * Private key needs to be converted to "DER" format, with no password.  \r
 124                          *      Use chmod 400 on key\r
 125                          * \r
 126                          *  openssl pkcs8 -topk8 -outform DER -nocrypt -in ca.key -out ca.der\r
 127                          *\r
 128                          */\r
 129                         ca = new File(dir,"ca.der");\r
 130                         if(ca.exists()) {\r
 131                                 byte[] bytes = Factory.binary(ca);\r
 132                                 \r
 133 //                                      EncryptedPrivateKeyInfo ekey=new EncryptedPrivateKeyInfo(bytes);\r
 134 //                                  Cipher cip=Cipher.getInstance(ekey.getAlgName());\r
 135 //                                  PBEKeySpec pspec=new PBEKeySpec("password".toCharArray());\r
 136 //                                  SecretKeyFactory skfac=SecretKeyFactory.getInstance(ekey.getAlgName());\r
 137 //                                  Key pbeKey=skfac.generateSecret(pspec);\r
 138 //                                  AlgorithmParameters algParams=ekey.getAlgParameters();\r
 139 //                                  cip.init(Cipher.DECRYPT_MODE,pbeKey,algParams);\r
 140                                         \r
 141                                 KeyFactory keyFactory;\r
 142                                 try {\r
 143                                         keyFactory = KeyFactory.getInstance("RSA");\r
 144                                         PKCS8EncodedKeySpec privSpec = new PKCS8EncodedKeySpec(bytes);\r
 145                                                 \r
 146                             caKey = (RSAPrivateKey) keyFactory.generatePrivate(privSpec);\r
 147                                 } catch (GeneralSecurityException e) {\r
 148                                         throw new CertException(e);\r
 149                                 }\r
 150                                 \r
 151                                 X500NameBuilder xnb = new X500NameBuilder();\r
 152                                 xnb.addRDN(BCStyle.C,"US");\r
 153                                 xnb.addRDN(BCStyle.ST,"Missouri");\r
 154                                 xnb.addRDN(BCStyle.L,"Arnold");\r
 155                                 xnb.addRDN(BCStyle.O,"ATT Services, Inc.");\r
 156                                 xnb.addRDN(BCStyle.OU,"AAF");\r
 157                                 xnb.addRDN(BCStyle.CN,"aaf.att.com");\r
 158                                 xnb.addRDN(BCStyle.EmailAddress,"DL-aaf-support@att.com");\r
 159                                 issuer = xnb.build();\r
 160                 } else {\r
 161                         throw new CertException(ca.getPath() + " does not exist");\r
 162                 }\r
 163         }\r
 164 \r
 165         /* (non-Javadoc)\r
 166          * @see com.att.authz.cm.service.CA#sign(org.bouncycastle.pkcs.PKCS10CertificationRequest)\r
 167          */\r
 168         @Override\r
 169         public X509Certificate sign(Trans trans, CSRMeta csrmeta) throws IOException, CertException {\r
 170                 GregorianCalendar gc = new GregorianCalendar();\r
 171                 Date start = gc.getTime();\r
 172                 gc.add(GregorianCalendar.DAY_OF_MONTH, 1);\r
 173                 Date end = gc.getTime();\r
 174                 X509Certificate x509;\r
 175                 TimeTaken tt = trans.start("Create/Sign Cert",Env.SUB);\r
 176                 try {\r
 177                         BigInteger bi;\r
 178                         synchronized(serialish) {\r
 179                                 random.nextBytes(serialish);\r
 180                                 bi = new BigInteger(serialish);\r
 181                         }\r
 182                                 \r
 183                         X509v3CertificateBuilder xcb = new X509v3CertificateBuilder(\r
 184                                         issuer,\r
 185                                         bi, // replace with Serialnumber scheme\r
 186                                         start,\r
 187                                         end,\r
 188                                         csrmeta.x500Name(),\r
 189 //                                      SubjectPublicKeyInfoFactory.createSubjectPublicKeyInfo(caCert.getPublicKey().getEn)\r
 190                                         new SubjectPublicKeyInfo(ASN1Sequence.getInstance(caCert.getPublicKey().getEncoded()))\r
 191                                         );\r
 192                         List<GeneralName> lsan = new ArrayList<GeneralName>();\r
 193                         for(String s : csrmeta.sans()) {\r
 194                                 lsan.add(new GeneralName(GeneralName.dNSName,s));\r
 195                         }\r
 196                         GeneralName[] sans = new GeneralName[lsan.size()];\r
 197                         lsan.toArray(sans);\r
 198 \r
 199                     JcaX509ExtensionUtils extUtils = new JcaX509ExtensionUtils();\r
 200                     xcb         .addExtension(Extension.basicConstraints,\r
 201                         false, new BasicConstraints(false))\r
 202                             .addExtension(Extension.keyUsage,\r
 203                                 true, new KeyUsage(KeyUsage.digitalSignature\r
 204                                                  | KeyUsage.keyEncipherment))\r
 205                             .addExtension(Extension.extendedKeyUsage,\r
 206                                           true, new ExtendedKeyUsage(ASN_WebUsage))\r
 207 \r
 208                     .addExtension(Extension.authorityKeyIdentifier,\r
 209                                           false, extUtils.createAuthorityKeyIdentifier(caCert))\r
 210                             .addExtension(Extension.subjectKeyIdentifier,\r
 211                                           false, extUtils.createSubjectKeyIdentifier(caCert.getPublicKey()))\r
 212                             .addExtension(Extension.subjectAlternativeName,\r
 213                                         false, new GeneralNames(sans))\r
 214                                                            ;\r
 215         \r
 216                         x509 = new JcaX509CertificateConverter().getCertificate(\r
 217                                         xcb.build(BCFactory.contentSigner(caKey)));\r
 218                 } catch (GeneralSecurityException|OperatorCreationException e) {\r
 219                         throw new CertException(e);\r
 220                 } finally {\r
 221                         tt.done();\r
 222                 }\r
 223                 return x509;\r
 224         }\r
 225 \r
 226 }\r