1 /*******************************************************************************
\r
2 * ============LICENSE_START====================================================
\r
4 * * ===========================================================================
\r
5 * * Copyright © 2017 AT&T Intellectual Property. All rights reserved.
\r
6 * * ===========================================================================
\r
7 * * Licensed under the Apache License, Version 2.0 (the "License");
\r
8 * * you may not use this file except in compliance with the License.
\r
9 * * You may obtain a copy of the License at
\r
11 * * http://www.apache.org/licenses/LICENSE-2.0
\r
13 * * Unless required by applicable law or agreed to in writing, software
\r
14 * * distributed under the License is distributed on an "AS IS" BASIS,
\r
15 * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
\r
16 * * See the License for the specific language governing permissions and
\r
17 * * limitations under the License.
\r
18 * * ============LICENSE_END====================================================
\r
20 * * ECOMP is a trademark and service mark of AT&T Intellectual Property.
\r
22 ******************************************************************************/
\r
23 package org.onap.aaf.authz.cm.ca;
\r
25 import java.io.File;
\r
26 import java.io.IOException;
\r
27 import java.math.BigInteger;
\r
28 import java.security.GeneralSecurityException;
\r
29 import java.security.KeyFactory;
\r
30 import java.security.cert.Certificate;
\r
31 import java.security.cert.CertificateException;
\r
32 import java.security.cert.X509Certificate;
\r
33 import java.security.interfaces.RSAPrivateKey;
\r
34 import java.security.spec.PKCS8EncodedKeySpec;
\r
35 import java.util.ArrayList;
\r
36 import java.util.Collection;
\r
37 import java.util.Date;
\r
38 import java.util.GregorianCalendar;
\r
39 import java.util.List;
\r
40 import java.security.SecureRandom;
\r
42 import org.bouncycastle.asn1.ASN1Sequence;
\r
43 import org.bouncycastle.asn1.x500.X500Name;
\r
44 import org.bouncycastle.asn1.x500.X500NameBuilder;
\r
45 import org.bouncycastle.asn1.x500.style.BCStyle;
\r
46 import org.bouncycastle.asn1.x509.BasicConstraints;
\r
47 import org.bouncycastle.asn1.x509.ExtendedKeyUsage;
\r
48 import org.bouncycastle.asn1.x509.Extension;
\r
49 import org.bouncycastle.asn1.x509.GeneralName;
\r
50 import org.bouncycastle.asn1.x509.GeneralNames;
\r
51 import org.bouncycastle.asn1.x509.KeyPurposeId;
\r
52 import org.bouncycastle.asn1.x509.KeyUsage;
\r
53 import org.bouncycastle.asn1.x509.SubjectPublicKeyInfo;
\r
54 import org.bouncycastle.cert.X509v3CertificateBuilder;
\r
55 import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;
\r
56 import org.bouncycastle.cert.jcajce.JcaX509ExtensionUtils;
\r
57 import org.bouncycastle.operator.OperatorCreationException;
\r
58 import org.onap.aaf.authz.cm.cert.BCFactory;
\r
59 import org.onap.aaf.authz.cm.cert.CSRMeta;
\r
60 import org.onap.aaf.authz.cm.cert.StandardFields;
\r
61 import org.onap.aaf.authz.common.Define;
\r
63 import org.onap.aaf.cadi.cm.CertException;
\r
64 import org.onap.aaf.cadi.cm.Factory;
\r
65 import org.onap.aaf.inno.env.Env;
\r
66 import org.onap.aaf.inno.env.TimeTaken;
\r
67 import org.onap.aaf.inno.env.Trans;
\r
69 public class DevlCA extends CA {
\r
72 private static final KeyPurposeId[] ASN_WebUsage = new KeyPurposeId[] {
\r
73 KeyPurposeId.id_kp_serverAuth, // WebServer
\r
74 KeyPurposeId.id_kp_clientAuth};// WebClient
\r
76 private X509Certificate caCert;
\r
77 private final RSAPrivateKey caKey;
\r
78 private final X500Name issuer;
\r
79 private final SecureRandom random = new SecureRandom();
\r
80 private byte[] serialish = new byte[24];
\r
82 public DevlCA(Trans trans, String name, String dirString) throws IOException, CertException {
\r
83 super(name, new StandardFields() {
\r
85 public void set(CSRMeta csr) {
\r
87 csr.o("ATT Services, Inc.");
\r
92 }, Define.ROOT_NS+".ca" // Permission Type for validation
\r
94 File dir = new File(dirString);
\r
96 throw new CertException(dirString + " does not exist");
\r
99 File ca = new File(dir,"ca.crt");
\r
101 byte[] bytes = Factory.decode(ca);
\r
102 Collection<? extends Certificate> certs;
\r
104 certs = Factory.toX509Certificate(bytes);
\r
105 } catch (CertificateException e) {
\r
106 throw new CertException(e);
\r
108 List<String> lTrust = new ArrayList<String>();
\r
110 for(Certificate c : certs) {
\r
112 caCert = (X509Certificate)c;
\r
114 lTrust.add(Factory.toString(trans,c));
\r
120 this.setTrustChain(new String[]{Factory.toString(trans,caCert)});
\r
123 * Private key needs to be converted to "DER" format, with no password.
\r
124 * Use chmod 400 on key
\r
126 * openssl pkcs8 -topk8 -outform DER -nocrypt -in ca.key -out ca.der
\r
129 ca = new File(dir,"ca.der");
\r
131 byte[] bytes = Factory.binary(ca);
\r
133 // EncryptedPrivateKeyInfo ekey=new EncryptedPrivateKeyInfo(bytes);
\r
134 // Cipher cip=Cipher.getInstance(ekey.getAlgName());
\r
135 // PBEKeySpec pspec=new PBEKeySpec("password".toCharArray());
\r
136 // SecretKeyFactory skfac=SecretKeyFactory.getInstance(ekey.getAlgName());
\r
137 // Key pbeKey=skfac.generateSecret(pspec);
\r
138 // AlgorithmParameters algParams=ekey.getAlgParameters();
\r
139 // cip.init(Cipher.DECRYPT_MODE,pbeKey,algParams);
\r
141 KeyFactory keyFactory;
\r
143 keyFactory = KeyFactory.getInstance("RSA");
\r
144 PKCS8EncodedKeySpec privSpec = new PKCS8EncodedKeySpec(bytes);
\r
146 caKey = (RSAPrivateKey) keyFactory.generatePrivate(privSpec);
\r
147 } catch (GeneralSecurityException e) {
\r
148 throw new CertException(e);
\r
151 X500NameBuilder xnb = new X500NameBuilder();
\r
152 xnb.addRDN(BCStyle.C,"US");
\r
153 xnb.addRDN(BCStyle.ST,"Missouri");
\r
154 xnb.addRDN(BCStyle.L,"Arnold");
\r
155 xnb.addRDN(BCStyle.O,"ATT Services, Inc.");
\r
156 xnb.addRDN(BCStyle.OU,"AAF");
\r
157 xnb.addRDN(BCStyle.CN,"aaf.att.com");
\r
158 xnb.addRDN(BCStyle.EmailAddress,"DL-aaf-support@att.com");
\r
159 issuer = xnb.build();
\r
161 throw new CertException(ca.getPath() + " does not exist");
\r
166 * @see org.onap.aaf.authz.cm.service.CA#sign(org.bouncycastle.pkcs.PKCS10CertificationRequest)
\r
169 public X509Certificate sign(Trans trans, CSRMeta csrmeta) throws IOException, CertException {
\r
170 GregorianCalendar gc = new GregorianCalendar();
\r
171 Date start = gc.getTime();
\r
172 gc.add(GregorianCalendar.DAY_OF_MONTH, 1);
\r
173 Date end = gc.getTime();
\r
174 X509Certificate x509;
\r
175 TimeTaken tt = trans.start("Create/Sign Cert",Env.SUB);
\r
178 synchronized(serialish) {
\r
179 random.nextBytes(serialish);
\r
180 bi = new BigInteger(serialish);
\r
183 X509v3CertificateBuilder xcb = new X509v3CertificateBuilder(
\r
185 bi, // replace with Serialnumber scheme
\r
188 csrmeta.x500Name(),
\r
189 // SubjectPublicKeyInfoFactory.createSubjectPublicKeyInfo(caCert.getPublicKey().getEn)
\r
190 new SubjectPublicKeyInfo(ASN1Sequence.getInstance(caCert.getPublicKey().getEncoded()))
\r
192 List<GeneralName> lsan = new ArrayList<GeneralName>();
\r
193 for(String s : csrmeta.sans()) {
\r
194 lsan.add(new GeneralName(GeneralName.dNSName,s));
\r
196 GeneralName[] sans = new GeneralName[lsan.size()];
\r
197 lsan.toArray(sans);
\r
199 JcaX509ExtensionUtils extUtils = new JcaX509ExtensionUtils();
\r
200 xcb .addExtension(Extension.basicConstraints,
\r
201 false, new BasicConstraints(false))
\r
202 .addExtension(Extension.keyUsage,
\r
203 true, new KeyUsage(KeyUsage.digitalSignature
\r
204 | KeyUsage.keyEncipherment))
\r
205 .addExtension(Extension.extendedKeyUsage,
\r
206 true, new ExtendedKeyUsage(ASN_WebUsage))
\r
208 .addExtension(Extension.authorityKeyIdentifier,
\r
209 false, extUtils.createAuthorityKeyIdentifier(caCert))
\r
210 .addExtension(Extension.subjectKeyIdentifier,
\r
211 false, extUtils.createSubjectKeyIdentifier(caCert.getPublicKey()))
\r
212 .addExtension(Extension.subjectAlternativeName,
\r
213 false, new GeneralNames(sans))
\r
216 x509 = new JcaX509CertificateConverter().getCertificate(
\r
217 xcb.build(BCFactory.contentSigner(caKey)));
\r
218 } catch (GeneralSecurityException|OperatorCreationException e) {
\r
219 throw new CertException(e);
\r