hostname: cahostname
container_name: mycontainer
ports:
- - "80:8080"
- - "443:8443"
+ - "80:8080"
+ - "443:8443"
volumes:
- - ./src/main/resources/scripts/:/opt/primekey/scripts
+ - ./src/main/resources/scripts/:/opt/primekey/scripts
command: bash -c "
./scripts/ejbca-configuration.sh &
/opt/primekey/bin/start.sh
interval: 10s
timeout: 3s
retries: 9
+ networks:
+ - certservice
certservice:
image: onap/org.onap.aaf.certservice.aaf-certservice-api:latest
depends_on:
ejbca:
condition: service_healthy
+ networks:
+ - certservice
+
+networks:
+ certservice:
+ driver: bridge
{
"cmpv2Servers": [
{
- "caName": "TEST",
- "url": "http://127.0.0.1/ejbca/publicweb/cmp/cmp",
+ "caName": "Client",
+ "url": "http://mycontainer:8080/ejbca/publicweb/cmp/cmp",
"issuerDN": "CN=ManagementCA",
"caMode": "CLIENT",
"authentication": {
- "iak": "xxx",
- "rv": "yyy"
+ "iak": "mypassword",
+ "rv": "mypassword"
}
},
{
- "caName": "TEST2",
- "url": "http://127.0.0.1/ejbca/publicweb/cmp/cmpRA",
- "issuerDN": "CN=ManagementCA2",
+ "caName": "RA",
+ "url": "http://mycontainer:8080/ejbca/publicweb/cmp/cmpRA",
+ "issuerDN": "CN=ManagementCA",
"caMode": "RA",
"authentication": {
- "iak": "xxx",
- "rv": "yyy"
+ "iak": "mypassword",
+ "rv": "mypassword"
}
}
]
import org.onap.aaf.certservice.certification.CertificationModelFactory;
import org.onap.aaf.certservice.certification.CsrModelFactory;
import org.onap.aaf.certservice.certification.CsrModelFactory.StringBase64;
+import org.onap.aaf.certservice.certification.configuration.Cmpv2ServerProvider;
+import org.onap.aaf.certservice.certification.configuration.model.Cmpv2Server;
+import org.onap.aaf.certservice.certification.exception.Cmpv2ClientAdapterException;
import org.onap.aaf.certservice.certification.exception.DecryptionException;
import org.onap.aaf.certservice.certification.model.CertificationModel;
import org.onap.aaf.certservice.certification.model.CsrModel;
+import org.onap.aaf.certservice.cmpv2client.exceptions.CmpClientException;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
private static final Logger LOGGER = LoggerFactory.getLogger(CertificationController.class);
- private final CsrModelFactory csrModelFactory;
private final CertificationModelFactory certificationModelFactory;
@Autowired
- CertificationController(CsrModelFactory csrModelFactory, CertificationModelFactory certificationModelFactory) {
- this.csrModelFactory = csrModelFactory;
+ CertificationController(CertificationModelFactory certificationModelFactory) {
this.certificationModelFactory = certificationModelFactory;
}
@PathVariable String caName,
@RequestHeader("CSR") String encodedCsr,
@RequestHeader("PK") String encodedPrivateKey
- ) throws DecryptionException {
-
+ ) throws DecryptionException, CmpClientException, Cmpv2ClientAdapterException {
caName = caName.replaceAll("[\n|\r|\t]", "_");
LOGGER.info("Received certificate signing request for CA named: {}", caName);
- CsrModel csrModel = csrModelFactory.createCsrModel(
- new StringBase64(encodedCsr),
- new StringBase64(encodedPrivateKey)
- );
- LOGGER.debug("Received CSR meta data: \n{}", csrModel);
CertificationModel certificationModel = certificationModelFactory
- .createCertificationModel(csrModel, caName);
+ .createCertificationModel(encodedCsr, encodedPrivateKey, caName);
return new ResponseEntity<>(new Gson().toJson(certificationModel), HttpStatus.OK);
}
package org.onap.aaf.certservice.certification;
import com.google.gson.Gson;
+import org.onap.aaf.certservice.certification.exception.Cmpv2ClientAdapterException;
import org.onap.aaf.certservice.certification.exception.Cmpv2ServerNotFoundException;
import org.onap.aaf.certservice.certification.exception.CsrDecryptionException;
import org.onap.aaf.certservice.certification.exception.ErrorResponseModel;
import org.onap.aaf.certservice.certification.exception.KeyDecryptionException;
+import org.onap.aaf.certservice.cmpv2client.exceptions.CmpClientException;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.http.HttpStatus;
@ExceptionHandler(value = CsrDecryptionException.class)
public ResponseEntity<String> handle(CsrDecryptionException exception) {
LOGGER.error("Exception occurred during decoding certificate sign request:", exception);
- return getErrorResponseEntity("Wrong certificate signing request (CSR) format", HttpStatus.BAD_REQUEST);
+ return getErrorResponseEntity(
+ "Wrong certificate signing request (CSR) format",
+ HttpStatus.BAD_REQUEST
+ );
}
@ExceptionHandler(value = KeyDecryptionException.class)
public ResponseEntity<String> handle(KeyDecryptionException exception) {
LOGGER.error("Exception occurred during decoding key:", exception);
- return getErrorResponseEntity("Wrong key (PK) format", HttpStatus.BAD_REQUEST);
+ return getErrorResponseEntity(
+ "Wrong key (PK) format",
+ HttpStatus.BAD_REQUEST
+ );
}
@ExceptionHandler(value = Cmpv2ServerNotFoundException.class)
public ResponseEntity<String> handle(Cmpv2ServerNotFoundException exception) {
LOGGER.error("Exception occurred selecting CMPv2 server:", exception);
- return getErrorResponseEntity("Certification authority not found for given CAName", HttpStatus.NOT_FOUND);
+ return getErrorResponseEntity(
+ "Certification authority not found for given CAName",
+ HttpStatus.NOT_FOUND
+ );
+ }
+
+ @ExceptionHandler(value = CmpClientException.class)
+ public ResponseEntity<String> handle(CmpClientException exception) {
+ LOGGER.error("Exception occurred calling cmp client:", exception);
+ return getErrorResponseEntity(
+ "Exception occurred during call to cmp client",
+ HttpStatus.INTERNAL_SERVER_ERROR
+ );
+ }
+
+ @ExceptionHandler(value = RuntimeException.class)
+ public ResponseEntity<String> handle(RuntimeException exception) throws CmpClientException {
+ throw new CmpClientException("Runtime exception occurred calling cmp client business logic", exception);
+ }
+
+ @ExceptionHandler(value = Cmpv2ClientAdapterException.class)
+ public ResponseEntity<String> handle(Cmpv2ClientAdapterException exception) {
+ LOGGER.error("Exception occurred parsing cmp client response:", exception);
+ return getErrorResponseEntity(
+ "Exception occurred parsing cmp client response",
+ HttpStatus.INTERNAL_SERVER_ERROR
+ );
}
private ResponseEntity<String> getErrorResponseEntity(String errorMessage, HttpStatus status) {
import org.onap.aaf.certservice.certification.configuration.Cmpv2ServerProvider;
import org.onap.aaf.certservice.certification.configuration.model.Cmpv2Server;
+import org.onap.aaf.certservice.certification.exception.Cmpv2ClientAdapterException;
import org.onap.aaf.certservice.certification.exception.Cmpv2ServerNotFoundException;
+import org.onap.aaf.certservice.certification.exception.DecryptionException;
import org.onap.aaf.certservice.certification.model.CertificationModel;
import org.onap.aaf.certservice.certification.model.CsrModel;
+import org.onap.aaf.certservice.cmpv2client.exceptions.CmpClientException;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
private static final Logger LOGGER = LoggerFactory.getLogger(CertificationModelFactory.class);
+ private final CsrModelFactory csrModelFactory;
private final Cmpv2ServerProvider cmpv2ServerProvider;
+ private final CertificationProvider certificationProvider;
@Autowired
- CertificationModelFactory(Cmpv2ServerProvider cmpv2ServerProvider) {
+ CertificationModelFactory(
+ CsrModelFactory csrModelFactory,
+ Cmpv2ServerProvider cmpv2ServerProvider,
+ CertificationProvider certificationProvider
+ ) {
this.cmpv2ServerProvider = cmpv2ServerProvider;
+ this.csrModelFactory = csrModelFactory;
+ this.certificationProvider = certificationProvider;
}
- public CertificationModel createCertificationModel(CsrModel csr, String caName) {
- LOGGER.info("Generating certification model for CA named: {}, and certificate signing request:\n{}",
- caName, csr);
-
- return cmpv2ServerProvider
- .getCmpv2Server(caName)
- .map(this::generateCertificationModel)
- .orElseThrow(() -> new Cmpv2ServerNotFoundException("No server found for given CA name"));
- }
+ public CertificationModel createCertificationModel(String encodedCsr, String encodedPrivateKey, String caName)
+ throws DecryptionException, CmpClientException, Cmpv2ClientAdapterException {
+ CsrModel csrModel = csrModelFactory.createCsrModel(
+ new CsrModelFactory.StringBase64(encodedCsr),
+ new CsrModelFactory.StringBase64(encodedPrivateKey)
+ );
+ LOGGER.debug("Received CSR meta data: \n{}", csrModel);
- private CertificationModel generateCertificationModel(Cmpv2Server cmpv2Server) {
+ Cmpv2Server cmpv2Server = cmpv2ServerProvider.getCmpv2Server(caName);
LOGGER.debug("Found server for given CA name: \n{}", cmpv2Server);
- return new CertificationModel(
- Arrays.asList(ENTITY_CERT, INTERMEDIATE_CERT),
- Arrays.asList(CA_CERT, EXTRA_CA_CERT)
- );
+
+ LOGGER.info("Sending sign request for certification model for CA named: {}, and certificate signing request:\n{}",
+ caName, csrModel);
+ return certificationProvider.signCsr(csrModel, cmpv2Server);
}
+
}
--- /dev/null
+/*
+ * ============LICENSE_START=======================================================
+ * Cert Service
+ * ================================================================================
+ * Copyright (C) 2020 Nokia. All rights reserved.
+ * ================================================================================
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * ============LICENSE_END=========================================================
+ */
+
+package org.onap.aaf.certservice.certification;
+
+import org.onap.aaf.certservice.certification.adapter.Cmpv2ClientAdapter;
+import org.onap.aaf.certservice.certification.configuration.model.Cmpv2Server;
+import org.onap.aaf.certservice.certification.exception.Cmpv2ClientAdapterException;
+import org.onap.aaf.certservice.certification.model.CertificationModel;
+import org.onap.aaf.certservice.certification.model.CsrModel;
+import org.onap.aaf.certservice.cmpv2client.exceptions.CmpClientException;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Service;
+
+@Service
+public class CertificationProvider {
+
+ private final Cmpv2ClientAdapter cmpv2ClientAdapter;
+
+ @Autowired
+ public CertificationProvider(Cmpv2ClientAdapter cmpv2ClientAdapter) {
+ this.cmpv2ClientAdapter = cmpv2ClientAdapter;
+ }
+
+ CertificationModel signCsr(CsrModel csrModel, Cmpv2Server server)
+ throws CmpClientException, Cmpv2ClientAdapterException {
+ return cmpv2ClientAdapter.callCmpClient(csrModel, server);
+ }
+
+}
package org.onap.aaf.certservice.certification;
import java.util.Base64;
+import java.util.Objects;
import java.util.Optional;
import org.bouncycastle.pkcs.PKCS10CertificationRequest;
return Optional.empty();
}
}
+
+ @Override
+ public boolean equals(Object o) {
+ if (this == o) return true;
+ if (o == null || getClass() != o.getClass()) return false;
+ StringBase64 that = (StringBase64) o;
+ return Objects.equals(value, that.value);
+ }
+
}
}
--- /dev/null
+/*
+ * ============LICENSE_START=======================================================
+ * Cert Service
+ * ================================================================================
+ * Copyright (C) 2020 Nokia. All rights reserved.
+ * ================================================================================
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * ============LICENSE_END=========================================================
+ */
+
+package org.onap.aaf.certservice.certification.adapter;
+
+import java.security.KeyPair;
+import java.util.Arrays;
+import java.util.Objects;
+import java.util.Optional;
+import java.util.stream.Collectors;
+import org.bouncycastle.asn1.x500.style.BCStyle;
+import org.bouncycastle.asn1.x500.style.IETFUtils;
+import org.bouncycastle.cert.CertException;
+import org.onap.aaf.certservice.certification.configuration.model.Cmpv2Server;
+import org.onap.aaf.certservice.certification.model.CsrModel;
+import org.onap.aaf.certservice.cmpv2client.external.CSRMeta;
+import org.onap.aaf.certservice.cmpv2client.external.RDN;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.stereotype.Component;
+
+@Component
+class CSRMetaBuilder {
+
+ private static final Logger LOGGER = LoggerFactory.getLogger(CSRMetaBuilder.class);
+
+ /**
+ * Creates CSRMeta from CsrModel and Cmpv2Server
+ *
+ * @param csrModel Certificate Signing Request from Service external API
+ * @param server Cmp Server configuration from cmpServers.json
+ * @return AAF native model for CSR metadata
+ */
+ CSRMeta build(CsrModel csrModel, Cmpv2Server server) {
+ CSRMeta csrMeta = createCsrMeta(csrModel);
+ addSans(csrModel, csrMeta);
+ csrMeta.keyPair(new KeyPair(csrModel.getPublicKey(), csrModel.getPrivateKey()));
+ csrMeta.password(server.getAuthentication().getIak());
+ csrMeta.setIssuerName(server.getIssuerDN());
+ csrMeta.caUrl(server.getUrl());
+ csrMeta.setName(csrModel.getSubjectData());
+ csrMeta.senderKid(server.getAuthentication().getRv());
+ return csrMeta;
+ }
+
+ private CSRMeta createCsrMeta(CsrModel csrModel) {
+ return new CSRMeta((Arrays.stream(csrModel.getSubjectData().getRDNs()).map(this::convertFromBcRDN)
+ .filter(Optional::isPresent).map(Optional::get).collect(Collectors.toList())));
+ }
+
+ private void addSans(CsrModel csrModel, CSRMeta csrMeta) {
+ csrModel.getSans().forEach(csrMeta::san);
+ }
+
+ private String convertRDNToString(org.bouncycastle.asn1.x500.RDN rdn) {
+ return BCStyle.INSTANCE.oidToDisplayName(rdn.getFirst().getType()) + "=" + IETFUtils.valueToString(
+ rdn.getFirst().getValue());
+ }
+
+ private Optional<RDN> convertFromBcRDN(org.bouncycastle.asn1.x500.RDN rdn) {
+ RDN result = null;
+ try {
+ result = new RDN(convertRDNToString(rdn));
+ } catch (CertException e) {
+ LOGGER.error("Exception occurred during convert of RDN", e);
+ }
+ return Optional.ofNullable(result);
+ }
+
+}
--- /dev/null
+/*
+ * ============LICENSE_START=======================================================
+ * Cert Service
+ * ================================================================================
+ * Copyright (C) 2020 Nokia. All rights reserved.
+ * ================================================================================
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * ============LICENSE_END=========================================================
+ */
+
+package org.onap.aaf.certservice.certification.adapter;
+
+import java.io.InputStream;
+import java.security.NoSuchProviderException;
+import java.security.Security;
+import java.security.cert.CertificateException;
+import java.security.cert.CertificateFactory;
+import java.security.cert.X509Certificate;
+import org.bouncycastle.jce.provider.BouncyCastleProvider;
+import org.springframework.stereotype.Component;
+
+@Component
+public class CertificateFactoryProvider {
+
+ static {
+ Security.addProvider(new BouncyCastleProvider());
+ }
+
+ X509Certificate generateCertificate(InputStream inStream) throws CertificateException, NoSuchProviderException {
+ return (X509Certificate) CertificateFactory.getInstance("X.509", "BC").generateCertificate(inStream);
+ }
+}
--- /dev/null
+/*
+ * ============LICENSE_START=======================================================
+ * Cert Service
+ * ================================================================================
+ * Copyright (C) 2020 Nokia. All rights reserved.
+ * ================================================================================
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * ============LICENSE_END=========================================================
+ */
+
+package org.onap.aaf.certservice.certification.adapter;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.io.StringWriter;
+import java.security.NoSuchProviderException;
+import java.security.PrivateKey;
+import java.security.cert.CertificateException;
+import java.security.cert.X509Certificate;
+import java.util.List;
+import java.util.stream.Collectors;
+import org.bouncycastle.cert.X509CertificateHolder;
+import org.bouncycastle.cert.X509v3CertificateBuilder;
+import org.bouncycastle.openssl.jcajce.JcaMiscPEMGenerator;
+import org.bouncycastle.operator.ContentSigner;
+import org.bouncycastle.operator.OperatorCreationException;
+import org.bouncycastle.pkcs.PKCS10CertificationRequest;
+import org.bouncycastle.util.io.pem.PemObjectGenerator;
+import org.bouncycastle.util.io.pem.PemWriter;
+import org.onap.aaf.certservice.certification.configuration.model.Cmpv2Server;
+import org.onap.aaf.certservice.certification.exception.Cmpv2ClientAdapterException;
+import org.onap.aaf.certservice.certification.model.CertificationModel;
+import org.onap.aaf.certservice.certification.model.CsrModel;
+import org.onap.aaf.certservice.cmpv2client.api.CmpClient;
+import org.onap.aaf.certservice.cmpv2client.exceptions.CmpClientException;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Component;
+
+@Component
+public class Cmpv2ClientAdapter {
+
+ private static final Logger LOGGER = LoggerFactory.getLogger(Cmpv2ClientAdapter.class);
+
+ private final CmpClient cmpClient;
+ private final CSRMetaBuilder csrMetaBuilder;
+ private final RSAContentSignerBuilder rsaContentSignerBuilder;
+ private final X509CertificateBuilder x509CertificateBuilder;
+ private final CertificateFactoryProvider certificateFactoryProvider;
+
+ @Autowired
+ public Cmpv2ClientAdapter(CmpClient cmpClient, CSRMetaBuilder csrMetaBuilder,
+ RSAContentSignerBuilder rsaContentSignerBuilder, X509CertificateBuilder x509CertificateBuilder,
+ CertificateFactoryProvider certificateFactoryProvider) {
+ this.cmpClient = cmpClient;
+ this.csrMetaBuilder = csrMetaBuilder;
+ this.rsaContentSignerBuilder = rsaContentSignerBuilder;
+ this.x509CertificateBuilder = x509CertificateBuilder;
+ this.certificateFactoryProvider = certificateFactoryProvider;
+ }
+
+ /**
+ * Uses CmpClient to call to Cmp Server and gather certificates data
+ *
+ * @param csrModel Certificate Signing Request from Service external API
+ * @param server Cmp Server configuration from cmpServers.json
+ * @return container for returned certificates
+ * @throws CmpClientException Exceptions which comes from Cmp Client
+ * @throws Cmpv2ClientAdapterException Exceptions which comes from Adapter itself
+ */
+ public CertificationModel callCmpClient(CsrModel csrModel, Cmpv2Server server)
+ throws CmpClientException, Cmpv2ClientAdapterException {
+ List<List<X509Certificate>> certificates = cmpClient.createCertificate(server.getCaName(),
+ server.getCaMode().getProfile(), csrMetaBuilder.build(csrModel, server),
+ convertCSRToX509Certificate(csrModel.getCsr(), csrModel.getPrivateKey()));
+ return new CertificationModel(convertFromX509CertificateListToPEMList(certificates.get(0)),
+ convertFromX509CertificateListToPEMList(certificates.get(1)));
+ }
+
+ private String convertFromX509CertificateToPEM(X509Certificate certificate) {
+ StringWriter sw = new StringWriter();
+ try (PemWriter pw = new PemWriter(sw)) {
+ PemObjectGenerator gen = new JcaMiscPEMGenerator(certificate);
+ pw.writeObject(gen);
+ } catch (IOException e) {
+ LOGGER.error("Exception occurred during convert of X509 certificate", e);
+ }
+ return sw.toString();
+ }
+
+ private X509Certificate convertCSRToX509Certificate(PKCS10CertificationRequest csr, PrivateKey privateKey)
+ throws Cmpv2ClientAdapterException {
+ try {
+ X509v3CertificateBuilder certificateGenerator = x509CertificateBuilder.build(csr);
+ ContentSigner signer = rsaContentSignerBuilder.build(csr, privateKey);
+ X509CertificateHolder holder = certificateGenerator.build(signer);
+ return certificateFactoryProvider
+ .generateCertificate(new ByteArrayInputStream(holder.toASN1Structure().getEncoded()));
+ } catch (IOException | CertificateException | OperatorCreationException | NoSuchProviderException e) {
+ throw new Cmpv2ClientAdapterException(e);
+ }
+ }
+
+ private List<String> convertFromX509CertificateListToPEMList(List<X509Certificate> certificates) {
+ return certificates.stream().map(this::convertFromX509CertificateToPEM).filter(cert -> !cert.isEmpty())
+ .collect(Collectors.toList());
+ }
+
+}
--- /dev/null
+/*
+ * ============LICENSE_START=======================================================
+ * Cert Service
+ * ================================================================================
+ * Copyright (C) 2020 Nokia. All rights reserved.
+ * ================================================================================
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * ============LICENSE_END=========================================================
+ */
+package org.onap.aaf.certservice.certification.adapter;
+
+import java.io.IOException;
+import java.security.PrivateKey;
+import org.bouncycastle.asn1.x509.AlgorithmIdentifier;
+import org.bouncycastle.crypto.util.PrivateKeyFactory;
+import org.bouncycastle.operator.ContentSigner;
+import org.bouncycastle.operator.DefaultDigestAlgorithmIdentifierFinder;
+import org.bouncycastle.operator.OperatorCreationException;
+import org.bouncycastle.operator.bc.BcRSAContentSignerBuilder;
+import org.bouncycastle.pkcs.PKCS10CertificationRequest;
+import org.springframework.stereotype.Component;
+
+@Component
+public class RSAContentSignerBuilder {
+
+ ContentSigner build(PKCS10CertificationRequest csr, PrivateKey privateKey)
+ throws IOException, OperatorCreationException {
+ AlgorithmIdentifier sigAlgId = csr.getSignatureAlgorithm();
+ AlgorithmIdentifier digAlgId = new DefaultDigestAlgorithmIdentifierFinder().find(sigAlgId);
+
+ return new BcRSAContentSignerBuilder(sigAlgId, digAlgId)
+ .build(PrivateKeyFactory.createKey(privateKey.getEncoded()));
+ }
+
+}
--- /dev/null
+/*
+ * ============LICENSE_START=======================================================
+ * Cert Service
+ * ================================================================================
+ * Copyright (C) 2020 Nokia. All rights reserved.
+ * ================================================================================
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * ============LICENSE_END=========================================================
+ */
+
+package org.onap.aaf.certservice.certification.adapter;
+
+import java.io.IOException;
+import java.math.BigInteger;
+import java.security.SecureRandom;
+import java.time.LocalDateTime;
+import java.time.ZoneOffset;
+import java.util.Date;
+import org.bouncycastle.asn1.ASN1Sequence;
+import org.bouncycastle.asn1.x509.SubjectPublicKeyInfo;
+import org.bouncycastle.cert.X509v3CertificateBuilder;
+import org.bouncycastle.pkcs.PKCS10CertificationRequest;
+import org.springframework.stereotype.Component;
+
+@Component
+public class X509CertificateBuilder {
+
+ private static final int SECURE_NEXT_BYTES = 16;
+ private static final int VALID_PERIOD_IN_DAYS = 365;
+
+ X509v3CertificateBuilder build(PKCS10CertificationRequest csr) throws IOException {
+ return new X509v3CertificateBuilder(csr.getSubject(), createSerial(),
+ Date.from(LocalDateTime.now().toInstant(ZoneOffset.UTC)),
+ Date.from(LocalDateTime.now().plusDays(VALID_PERIOD_IN_DAYS).toInstant(ZoneOffset.UTC)),
+ new PKCS10CertificationRequest(csr.getEncoded()).getSubject(),
+ SubjectPublicKeyInfo.getInstance(ASN1Sequence.getInstance(csr.getSubjectPublicKeyInfo().getEncoded())));
+
+ }
+
+ private BigInteger createSerial() {
+ byte[] serial = new byte[SECURE_NEXT_BYTES];
+ new SecureRandom().nextBytes(serial);
+ return new BigInteger(serial).abs();
+ }
+
+}
--- /dev/null
+/*
+ * ============LICENSE_START=======================================================
+ * Cert Service
+ * ================================================================================
+ * Copyright (C) 2020 Nokia. All rights reserved.
+ * ================================================================================
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * ============LICENSE_END=========================================================
+ */
+package org.onap.aaf.certservice.certification.configuration;
+
+import org.apache.http.impl.client.CloseableHttpClient;
+import org.apache.http.impl.client.HttpClientBuilder;
+import org.onap.aaf.certservice.cmpv2client.api.CmpClient;
+import org.onap.aaf.certservice.cmpv2client.impl.CmpClientImpl;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.web.context.annotation.RequestScope;
+
+@Configuration
+public class CmpClientConfig {
+
+ @Bean
+ CmpClient cmpClient(CloseableHttpClient closeableHttpClient){
+ return new CmpClientImpl(closeableHttpClient);
+ }
+
+ @Bean
+ @RequestScope
+ CloseableHttpClient closeableHttpClient(HttpClientBuilder httpClientBuilder){
+ return httpClientBuilder.build();
+ }
+
+ @Bean
+ HttpClientBuilder httpClientBuilder(){
+ return HttpClientBuilder.create();
+ }
+
+}
package org.onap.aaf.certservice.certification.configuration;
import org.onap.aaf.certservice.certification.configuration.model.Cmpv2Server;
+import org.onap.aaf.certservice.certification.exception.Cmpv2ServerNotFoundException;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Component;
-import java.util.Optional;
-
@Component
public class Cmpv2ServerProvider {
this.cmpServersConfig = cmpServersConfig;
}
- public Optional<Cmpv2Server> getCmpv2Server(String caName) {
- return cmpServersConfig.getCmpServers()
- .stream()
- .filter(server -> server.getCaName().equals(caName))
- .findFirst();
+ public Cmpv2Server getCmpv2Server(String caName) {
+ return cmpServersConfig.getCmpServers().stream().filter(server -> server.getCaName().equals(caName)).findFirst()
+ .orElseThrow(() -> new Cmpv2ServerNotFoundException("No server found for given CA name"));
}
}
package org.onap.aaf.certservice.certification.configuration.model;
public enum CaMode {
- RA, CLIENT
+ RA("RA"), CLIENT("Client");
+
+ private String profile;
+
+ CaMode(String profile) {
+ this.profile = profile;
+ }
+
+ public String getProfile(){
+ return profile;
+ }
}
--- /dev/null
+/*
+ * ============LICENSE_START=======================================================
+ * Cert Service
+ * ================================================================================
+ * Copyright (C) 2020 Nokia. All rights reserved.
+ * ================================================================================
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * ============LICENSE_END=========================================================
+ */
+
+package org.onap.aaf.certservice.certification.exception;
+
+public class Cmpv2ClientAdapterException extends Exception {
+
+ public Cmpv2ClientAdapterException(Throwable cause) {
+ super(cause);
+ }
+}
import java.security.spec.PKCS8EncodedKeySpec;
import java.security.spec.X509EncodedKeySpec;
import java.util.Arrays;
+import java.util.Collections;
import java.util.List;
import java.util.Objects;
import java.util.stream.Collectors;
private final PublicKey publicKey;
private final List<String> sans;
- CsrModel(
- PKCS10CertificationRequest csr, X500Name subjectData,
- PrivateKey privateKey, PublicKey publicKey, List<String> sans) {
+ CsrModel(PKCS10CertificationRequest csr, X500Name subjectData, PrivateKey privateKey, PublicKey publicKey,
+ List<String> sans) {
this.csr = csr;
this.subjectData = subjectData;
this.privateKey = privateKey;
@Override
public String toString() {
- return "Subject: { " + subjectData
- + " ,SANs: " + sans + " }";
+ return "Subject: { " + subjectData + " ,SANs: " + sans + " }";
}
public static class CsrModelBuilder {
private final PKCS10CertificationRequest csr;
private final PemObject privateKey;
- public CsrModel build()
- throws DecryptionException
- {
+ public CsrModel build() throws DecryptionException {
X500Name subjectData = getSubjectData();
PrivateKey javaPrivateKey = convertingPemPrivateKeyToJavaSecurityPrivateKey(getPrivateKey());
}
private List<String> getSansData() {
- Extensions extensions =
- Extensions.getInstance(csr.getAttributes()[0].getAttrValues().getObjectAt(0));
- GeneralName[] arrayOfAlternativeNames =
- GeneralNames.fromExtensions(extensions, Extension.subjectAlternativeName).getNames();
-
- return Arrays.stream(arrayOfAlternativeNames)
- .map(GeneralName::getName)
- .map(Objects::toString)
- .collect(Collectors.toList());
+ if (!isAttrsEmpty() && !isAttrsValuesEmpty()) {
+ Extensions extensions = Extensions.getInstance(csr.getAttributes()[0].getAttrValues().getObjectAt(0));
+ GeneralName[] arrayOfAlternativeNames =
+ GeneralNames.fromExtensions(extensions, Extension.subjectAlternativeName).getNames();
+ return Arrays.stream(arrayOfAlternativeNames).map(GeneralName::getName).map(Objects::toString)
+ .collect(Collectors.toList());
+ }
+ return Collections.emptyList();
+ }
+
+ private boolean isAttrsValuesEmpty() {
+ return csr.getAttributes()[0].getAttrValues().size() == 0;
+ }
+
+ private boolean isAttrsEmpty() {
+ return csr.getAttributes().length == 0;
}
private PrivateKey convertingPemPrivateKeyToJavaSecurityPrivateKey(PemObject privateKey)
- throws KeyDecryptionException
- {
+ throws KeyDecryptionException {
try {
KeyFactory factory = KeyFactory.getInstance("RSA");
PKCS8EncodedKeySpec keySpec = new PKCS8EncodedKeySpec(privateKey.getContent());
}
private PublicKey convertingPemPublicKeyToJavaSecurityPublicKey(PemObject publicKey)
- throws KeyDecryptionException
- {
+ throws KeyDecryptionException {
try {
KeyFactory factory = KeyFactory.getInstance("RSA");
X509EncodedKeySpec keySpec = new X509EncodedKeySpec(publicKey.getContent());
public void issuerEmail(String issuerEmail) {
this.issuerEmail = issuerEmail;
}
+
+ public void setIssuerName(X500Name issuerName) {
+ this.issuerName = issuerName;
+ }
+
+ public void setName(X500Name name) {
+ this.name = name;
+ }
}
break; // surname
case "email":
case "EMAIL":
+ case "E":
case "emailaddress":
case "EMAILADDRESS":
aoi = BCStyle.EmailAddress;
ejbca.sh config cmp addalias --alias cmpRA
ejbca.sh config cmp updatealias --alias cmpRA --key operationmode --value ra
ejbca.sh ca editca --caname ManagementCA --field cmpRaAuthSecret --value mypassword
+ ejbca.sh config cmp updatealias --alias cmpRA --key responseprotection --value pbe
ejbca.sh config cmp dumpalias --alias cmpRA
ejbca.sh config cmp addalias --alias cmp
ejbca.sh config cmp updatealias --alias cmp --key allowautomatickeyupdate --value true
+ ejbca.sh config cmp updatealias --alias cmp --key responseprotection --value pbe
ejbca.sh ra addendentity --username Node123 --dn "CN=Node123" --caname ManagementCA --password mypassword --type 1 --token USERGENERATED
ejbca.sh ra setclearpwd --username Node123 --password mypassword
ejbca.sh config cmp updatealias --alias cmp --key extractusernamecomponent --value CN
import static org.assertj.core.api.Assertions.assertThat;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertThrows;
-import static org.mockito.ArgumentMatchers.any;
-import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.when;
import com.google.gson.Gson;
-import java.io.IOException;
import java.util.Arrays;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
import org.mockito.Mock;
import org.mockito.junit.jupiter.MockitoExtension;
import org.onap.aaf.certservice.certification.CertificationModelFactory;
-import org.onap.aaf.certservice.certification.CsrModelFactory;
-import org.onap.aaf.certservice.certification.CsrModelFactory.StringBase64;
+import org.onap.aaf.certservice.certification.exception.Cmpv2ClientAdapterException;
+import org.onap.aaf.certservice.certification.exception.Cmpv2ServerNotFoundException;
import org.onap.aaf.certservice.certification.exception.CsrDecryptionException;
import org.onap.aaf.certservice.certification.exception.DecryptionException;
import org.onap.aaf.certservice.certification.exception.KeyDecryptionException;
import org.onap.aaf.certservice.certification.model.CertificationModel;
-import org.onap.aaf.certservice.certification.model.CsrModel;
+import org.onap.aaf.certservice.cmpv2client.exceptions.CmpClientException;
import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;
-
@ExtendWith(MockitoExtension.class)
class CertificationControllerTest {
- private CertificationController certificationController;
+ private static final String TEST_CA_NAME = "TestCa";
+ private static final String TEST_ENCODED_CSR = "encodedCSR";
+ private static final String TEST_ENCODED_PK = "encodedPK";
+ private static final String TEST_WRONG_ENCODED_CSR = "wrongEncodedCSR";
+ private static final String TEST_WRONG_ENCODED_PK = "wrongEncodedPK";
+ private static final String TEST_WRONG_CA_NAME = "wrongTestCa";
- @Mock
- private CsrModelFactory csrModelFactory;
+ private CertificationController certificationController;
@Mock
private CertificationModelFactory certificationModelFactory;
@BeforeEach
- void setUp() {
- certificationController = new CertificationController(csrModelFactory, certificationModelFactory);
+ void serUp() {
+ certificationController = new CertificationController(certificationModelFactory);
}
@Test
- void shouldReturnDataAboutCsrBaseOnEncodedParameters() throws DecryptionException {
- // given
- final String testStringCsr = "testData";
- final String testCaName = "TestCa";
- CsrModel mockedCsrModel = mock(CsrModel.class);
+ void shouldReturnDataAboutCsrBaseOnEncodedParameters()
+ throws DecryptionException, CmpClientException, Cmpv2ClientAdapterException {
+ // Given
CertificationModel testCertificationModel = new CertificationModel(
Arrays.asList("ENTITY_CERT", "INTERMEDIATE_CERT"),
Arrays.asList("CA_CERT", "EXTRA_CA_CERT")
);
- when(mockedCsrModel.toString()).thenReturn(testStringCsr);
- when(csrModelFactory.createCsrModel(any(StringBase64.class), any(StringBase64.class)))
- .thenReturn(mockedCsrModel);
- when(certificationModelFactory.createCertificationModel(mockedCsrModel, testCaName))
+ when(certificationModelFactory.createCertificationModel(TEST_ENCODED_CSR, TEST_ENCODED_PK, TEST_CA_NAME))
.thenReturn(testCertificationModel);
- // when
+ // When
ResponseEntity<String> testResponse =
- certificationController.signCertificate(testCaName, "encryptedCSR", "encryptedPK");
+ certificationController.signCertificate(TEST_CA_NAME, TEST_ENCODED_CSR, TEST_ENCODED_PK);
CertificationModel responseCertificationModel = new Gson().fromJson(testResponse.getBody(), CertificationModel.class);
- // then
+ // Then
assertEquals(HttpStatus.OK, testResponse.getStatusCode());
assertThat(responseCertificationModel
).isEqualToComparingFieldByField(testCertificationModel);
}
@Test
- void shouldThrowCsrDecryptionExceptionWhenCreatingCsrModelFails() throws DecryptionException {
- // given
+ void shouldThrowCsrDecryptionExceptionWhenCreatingCsrModelFails()
+ throws DecryptionException, CmpClientException, Cmpv2ClientAdapterException {
+ // Given
String expectedMessage = "Incorrect CSR, decryption failed";
- when(csrModelFactory.createCsrModel(any(StringBase64.class), any(StringBase64.class)))
- .thenThrow(new CsrDecryptionException(expectedMessage,new IOException()));
+ when(certificationModelFactory.createCertificationModel(TEST_WRONG_ENCODED_CSR, TEST_ENCODED_PK, TEST_CA_NAME))
+ .thenThrow(new CsrDecryptionException(expectedMessage));
- // when
+ // When
Exception exception = assertThrows(
- CsrDecryptionException.class, () -> certificationController.
- signCertificate("TestCa", "encryptedCSR", "encryptedPK")
+ CsrDecryptionException.class, () ->
+ certificationController.signCertificate(TEST_CA_NAME, TEST_WRONG_ENCODED_CSR, TEST_ENCODED_PK)
);
String actualMessage = exception.getMessage();
- // then
+ // Then
assertEquals(expectedMessage, actualMessage);
}
@Test
- void shouldThrowPemDecryptionExceptionWhenCreatingPemModelFails() throws DecryptionException {
- // given
+ void shouldThrowPemDecryptionExceptionWhenCreatingPemModelFails()
+ throws DecryptionException, CmpClientException, Cmpv2ClientAdapterException {
+ // Given
String expectedMessage = "Incorrect PEM, decryption failed";
- when(csrModelFactory.createCsrModel(any(StringBase64.class), any(StringBase64.class)))
- .thenThrow(new KeyDecryptionException(expectedMessage,new IOException()));
+ when(certificationModelFactory.createCertificationModel(TEST_ENCODED_CSR, TEST_WRONG_ENCODED_PK, TEST_CA_NAME))
+ .thenThrow(new KeyDecryptionException(expectedMessage));
- // when
+ // When
Exception exception = assertThrows(
- KeyDecryptionException.class, () -> certificationController.
- signCertificate("TestCa", "encryptedCSR", "encryptedPK")
+ KeyDecryptionException.class, () ->
+ certificationController.signCertificate(TEST_CA_NAME, TEST_ENCODED_CSR, TEST_WRONG_ENCODED_PK)
);
String actualMessage = exception.getMessage();
- // then
+ // Then
assertEquals(expectedMessage, actualMessage);
}
+ @Test
+ void shouldThrowCmpv2ServerNotFoundWhenGivenWrongCaName()
+ throws DecryptionException, CmpClientException, Cmpv2ClientAdapterException {
+ // Given
+ String expectedMessage = "No server found for given CA name";
+ when(certificationModelFactory.createCertificationModel(TEST_ENCODED_CSR, TEST_ENCODED_PK, TEST_WRONG_CA_NAME))
+ .thenThrow(new Cmpv2ServerNotFoundException(expectedMessage));
+
+ // When
+ Exception exception = assertThrows(
+ Cmpv2ServerNotFoundException.class, () ->
+ certificationController.signCertificate(TEST_WRONG_CA_NAME, TEST_ENCODED_CSR, TEST_ENCODED_PK)
+ );
+
+ String actualMessage = exception.getMessage();
+
+ // Then
+ assertEquals(expectedMessage, actualMessage);
+ }
}
import com.google.gson.Gson;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
+import org.onap.aaf.certservice.certification.exception.Cmpv2ClientAdapterException;
import org.onap.aaf.certservice.certification.exception.Cmpv2ServerNotFoundException;
import org.onap.aaf.certservice.certification.exception.CsrDecryptionException;
import org.onap.aaf.certservice.certification.exception.ErrorResponseModel;
import org.onap.aaf.certservice.certification.exception.KeyDecryptionException;
+import org.onap.aaf.certservice.cmpv2client.exceptions.CmpClientException;
+import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;
import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
class CertificationExceptionControllerTest {
@Test
void shouldReturnResponseEntityWithAppropriateErrorMessageWhenGivenCsrDecryptionException() {
- // given
+ // Given
String expectedMessage = "Wrong certificate signing request (CSR) format";
CsrDecryptionException csrDecryptionException = new CsrDecryptionException("test csr exception");
- // when
+ // When
ResponseEntity<String> responseEntity = certificationExceptionController.handle(csrDecryptionException);
ErrorResponseModel response = new Gson().fromJson(responseEntity.getBody(), ErrorResponseModel.class);
- // then
+ // Then
+ assertEquals(HttpStatus.BAD_REQUEST, responseEntity.getStatusCode());
assertEquals(expectedMessage, response.getErrorMessage());
}
@Test
void shouldReturnResponseEntityWithAppropriateErrorMessageWhenGivenKeyDecryptionException() {
- // given
+ // Given
String expectedMessage = "Wrong key (PK) format";
KeyDecryptionException csrDecryptionException = new KeyDecryptionException("test pk exception");
- // when
+ // When
ResponseEntity<String> responseEntity = certificationExceptionController.handle(csrDecryptionException);
ErrorResponseModel response = new Gson().fromJson(responseEntity.getBody(), ErrorResponseModel.class);
- // then
+ // Then
+ assertEquals(HttpStatus.BAD_REQUEST, responseEntity.getStatusCode());
assertEquals(expectedMessage, response.getErrorMessage());
}
@Test
void shouldReturnResponseEntityWithAppropriateErrorMessageWhenGivenCaNameIsNotPresentInConfig() {
- // given
+ // Given
String expectedMessage = "Certification authority not found for given CAName";
Cmpv2ServerNotFoundException csrDecryptionException = new Cmpv2ServerNotFoundException("test Ca exception");
- // when
+ // When
ResponseEntity<String> responseEntity = certificationExceptionController.handle(csrDecryptionException);
ErrorResponseModel response = new Gson().fromJson(responseEntity.getBody(), ErrorResponseModel.class);
- // then
+ // Then
+ assertEquals(HttpStatus.NOT_FOUND, responseEntity.getStatusCode());
assertEquals(expectedMessage, response.getErrorMessage());
}
+
+ @Test
+ void shouldReturnResponseEntityWithAppropriateErrorMessageWhenCallingCmpClientFail() {
+ // Given
+ String expectedMessage = "Exception occurred during call to cmp client";
+ CmpClientException cmpClientException = new CmpClientException("Calling CMPv2 client failed");
+
+ // When
+ ResponseEntity<String> responseEntity = certificationExceptionController.handle(cmpClientException);
+
+ ErrorResponseModel response = new Gson().fromJson(responseEntity.getBody(), ErrorResponseModel.class);
+
+ // Then
+ assertEquals(HttpStatus.INTERNAL_SERVER_ERROR, responseEntity.getStatusCode());
+ assertEquals(expectedMessage, response.getErrorMessage());
+ }
+
+ @Test
+ void shouldReturnResponseEntityWithAppropriateErrorMessageWhenModelTransformationInAdapterFail() {
+ // Given
+ String expectedMessage = "Exception occurred parsing cmp client response";
+ Cmpv2ClientAdapterException cmpv2ClientAdapterException = new Cmpv2ClientAdapterException(new Throwable());
+
+ // When
+ ResponseEntity<String> responseEntity = certificationExceptionController.handle(cmpv2ClientAdapterException);
+
+ ErrorResponseModel response = new Gson().fromJson(responseEntity.getBody(), ErrorResponseModel.class);
+
+ // Then
+ assertEquals(HttpStatus.INTERNAL_SERVER_ERROR, responseEntity.getStatusCode());
+ assertEquals(expectedMessage, response.getErrorMessage());
+ }
+
+ @Test
+ void shouldThrowCmpClientExceptionWhenNotHandledRunTimeExceptionOccur() {
+ // Given
+ String expectedMessage = "Runtime exception occurred calling cmp client business logic";
+ RuntimeException runtimeException = new RuntimeException("Unknown runtime exception");
+
+ // When
+ Exception exception = assertThrows(
+ CmpClientException.class, () ->
+ certificationExceptionController.handle(runtimeException)
+ );
+
+ // Then
+ assertEquals(expectedMessage, exception.getMessage());
+ }
+
}
import org.mockito.junit.jupiter.MockitoExtension;
import org.onap.aaf.certservice.certification.configuration.Cmpv2ServerProvider;
import org.onap.aaf.certservice.certification.configuration.model.Cmpv2Server;
+import org.onap.aaf.certservice.certification.exception.Cmpv2ClientAdapterException;
import org.onap.aaf.certservice.certification.exception.Cmpv2ServerNotFoundException;
+import org.onap.aaf.certservice.certification.exception.CsrDecryptionException;
+import org.onap.aaf.certservice.certification.exception.DecryptionException;
import org.onap.aaf.certservice.certification.model.CertificationModel;
import org.onap.aaf.certservice.certification.model.CsrModel;
+import org.onap.aaf.certservice.cmpv2client.exceptions.CmpClientException;
-import java.util.Optional;
+import java.util.Arrays;
+import java.util.Base64;
+import java.util.List;
import static org.assertj.core.api.Assertions.assertThat;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertThrows;
import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.mockito.ArgumentMatchers.eq;
import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.when;
import static org.onap.aaf.certservice.certification.CertificationData.CA_CERT;
import static org.onap.aaf.certservice.certification.CertificationData.ENTITY_CERT;
import static org.onap.aaf.certservice.certification.CertificationData.INTERMEDIATE_CERT;
import static org.onap.aaf.certservice.certification.CertificationData.EXTRA_CA_CERT;
+import static org.onap.aaf.certservice.certification.TestData.TEST_CSR;
+import static org.onap.aaf.certservice.certification.TestData.TEST_PK;
+import static org.onap.aaf.certservice.certification.TestData.TEST_WRONG_CSR;
+import static org.onap.aaf.certservice.certification.TestData.TEST_WRONG_PEM;
@ExtendWith(MockitoExtension.class)
class CertificationModelFactoryTest {
private static final String TEST_CA = "testCA";
+ private static final String ENCODED_CSR = getEncodedString(TEST_CSR);
+ private static final String ENCODED_PK = getEncodedString(TEST_PK);
+ private static final String ENCODED_WRONG_CSR = getEncodedString(TEST_WRONG_CSR);
+ private static final String ENCODED_WRONG_PK = getEncodedString(TEST_WRONG_PEM);
private CertificationModelFactory certificationModelFactory;
@Mock
- Cmpv2ServerProvider cmpv2ServerProvider;
+ private Cmpv2ServerProvider cmpv2ServerProvider;
+ @Mock
+ private CsrModelFactory csrModelFactory;
+ @Mock
+ private CertificationProvider certificationProvider;
+
+
+ private static String getEncodedString(String testCsr) {
+ return Base64.getEncoder().encodeToString(testCsr.getBytes());
+ }
@BeforeEach
void setUp() {
- certificationModelFactory = new CertificationModelFactory(cmpv2ServerProvider);
+ certificationModelFactory =
+ new CertificationModelFactory(csrModelFactory, cmpv2ServerProvider, certificationProvider);
}
@Test
- void shouldCreateProperCertificationModelWhenGivenProperCsrModelAndCaName() {
- // given
- CsrModel mockedCsrModel = mock(CsrModel.class);
- when(cmpv2ServerProvider.getCmpv2Server(TEST_CA)).thenReturn(Optional.of(createTestCmpv2Server()));
+ void shouldCreateProperCertificationModelWhenGivenProperCsrModelAndCaName()
+ throws CmpClientException, DecryptionException, Cmpv2ClientAdapterException {
- // when
+ // Given
+ CsrModel csrModel = mockCsrFactoryModelCreation();
+ Cmpv2Server testServer = mockCmpv2ProviderServerSelection();
+ mockCertificateProviderCertificateSigning(csrModel, testServer);
+
+ // When
CertificationModel certificationModel =
- certificationModelFactory.createCertificationModel(mockedCsrModel ,TEST_CA);
+ certificationModelFactory.createCertificationModel(ENCODED_CSR, ENCODED_PK,TEST_CA);
- //then
+ // Then
assertEquals(2, certificationModel.getCertificateChain().size());
assertThat(certificationModel.getCertificateChain()).contains(INTERMEDIATE_CERT, ENTITY_CERT);
assertEquals(2, certificationModel.getTrustedCertificates().size());
}
@Test
- void shouldThrowCmpv2ServerNotFoundExceptionWhenGivenWrongCaName() {
- // given
+ void shouldThrowDecryptionExceptionWhenGivenWrongEncodedCSR()
+ throws DecryptionException {
+ // Given
+ String expectedMessage = "Incorrect CSR, decryption failed";
+ when(
+ csrModelFactory.createCsrModel(
+ eq(new CsrModelFactory.StringBase64(ENCODED_WRONG_CSR)),
+ eq(new CsrModelFactory.StringBase64(ENCODED_WRONG_PK))
+ )
+ ).thenThrow(
+ new CsrDecryptionException(expectedMessage)
+ );
+
+ // When
+ Exception exception = assertThrows(
+ DecryptionException.class, () ->
+ certificationModelFactory.createCertificationModel(ENCODED_WRONG_CSR, ENCODED_WRONG_PK, TEST_CA)
+ );
+
+ // Then
+ assertTrue(exception.getMessage().contains(expectedMessage));
+ }
+
+ @Test
+ void shouldThrowCmpv2ServerNotFoundExceptionWhenGivenWrongCaName()
+ throws DecryptionException {
+ // Given
String expectedMessage = "CA not found";
- CsrModel mockedCsrModel = mock(CsrModel.class);
- when(cmpv2ServerProvider.getCmpv2Server(TEST_CA)).thenThrow(new Cmpv2ServerNotFoundException(expectedMessage));
+ mockCsrFactoryModelCreation();
+ when(
+ cmpv2ServerProvider.getCmpv2Server(TEST_CA)
+ ).thenThrow(
+ new Cmpv2ServerNotFoundException(expectedMessage)
+ );
- // when
+ // When
Exception exception = assertThrows(
Cmpv2ServerNotFoundException.class, () ->
- certificationModelFactory.createCertificationModel(mockedCsrModel ,TEST_CA)
+ certificationModelFactory.createCertificationModel(ENCODED_CSR, ENCODED_PK, TEST_CA)
+ );
+
+ // Then
+ assertTrue(exception.getMessage().contains(expectedMessage));
+ }
+
+ @Test
+ void shouldThrowCmpClientExceptionWhenSigningCsrFailed()
+ throws DecryptionException, CmpClientException, Cmpv2ClientAdapterException {
+ // Given
+ String expectedMessage = "failed to sign certificate";
+ CsrModel csrModel = mockCsrFactoryModelCreation();
+ Cmpv2Server testServer = mockCmpv2ProviderServerSelection();
+ when(
+ certificationProvider.signCsr(eq(csrModel), eq(testServer))
+ ).thenThrow(
+ new CmpClientException(expectedMessage)
+ );
+
+ // When
+ Exception exception = assertThrows(
+ CmpClientException.class, () ->
+ certificationModelFactory.createCertificationModel(ENCODED_CSR, ENCODED_PK, TEST_CA)
);
- // then
+ // Then
assertTrue(exception.getMessage().contains(expectedMessage));
}
- private Cmpv2Server createTestCmpv2Server() {
+
+ private void mockCertificateProviderCertificateSigning(CsrModel csrModel, Cmpv2Server testServer)
+ throws CmpClientException, Cmpv2ClientAdapterException {
+ CertificationModel expectedCertificationModel = getCertificationModel();
+ when(
+ certificationProvider.signCsr(eq(csrModel), eq(testServer))
+ ).thenReturn(expectedCertificationModel);
+ }
+
+ private Cmpv2Server mockCmpv2ProviderServerSelection() {
+ Cmpv2Server testServer = getCmpv2Server();
+ when(
+ cmpv2ServerProvider.getCmpv2Server(eq(TEST_CA))
+ ).thenReturn(testServer);
+ return testServer;
+ }
+
+ private CsrModel mockCsrFactoryModelCreation()
+ throws DecryptionException {
+ CsrModel csrModel = getCsrModel();
+ when(
+ csrModelFactory.createCsrModel(
+ eq(new CsrModelFactory.StringBase64(ENCODED_CSR)),
+ eq(new CsrModelFactory.StringBase64(ENCODED_PK))
+ )
+ ).thenReturn(csrModel);
+ return csrModel;
+ }
+
+ private Cmpv2Server getCmpv2Server() {
return new Cmpv2Server();
}
+
+ private CsrModel getCsrModel() {
+ return mock(CsrModel.class);
+ }
+
+ private CertificationModel getCertificationModel() {
+ List<String> testTrustedCertificates = Arrays.asList(CA_CERT, EXTRA_CA_CERT);
+ List<String> testCertificationChain = Arrays.asList(INTERMEDIATE_CERT, ENTITY_CERT);
+ return new CertificationModel(testCertificationChain, testTrustedCertificates);
+ }
+
+
}
--- /dev/null
+/*
+ * ============LICENSE_START=======================================================
+ * AAF Certification Service
+ * ================================================================================
+ * Copyright (C) 2020 Nokia. All rights reserved.
+ * ================================================================================
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * ============LICENSE_END=========================================================
+ */
+package org.onap.aaf.certservice.certification;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.onap.aaf.certservice.certification.adapter.Cmpv2ClientAdapter;
+import org.onap.aaf.certservice.certification.configuration.model.Cmpv2Server;
+import org.onap.aaf.certservice.certification.exception.Cmpv2ClientAdapterException;
+import org.onap.aaf.certservice.certification.exception.DecryptionException;
+import org.onap.aaf.certservice.certification.model.CertificationModel;
+import org.onap.aaf.certservice.certification.model.CsrModel;
+import org.onap.aaf.certservice.cmpv2client.exceptions.CmpClientException;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+@ExtendWith(MockitoExtension.class)
+class CertificationProviderTest {
+
+ private CertificationProvider certificationProvider;
+
+ @Mock
+ private Cmpv2ClientAdapter cmpv2ClientAdapter;
+
+ @BeforeEach
+ void setUp() {
+ certificationProvider = new CertificationProvider(cmpv2ClientAdapter);
+ }
+
+ @Test
+ void certificationProviderShouldReturnCertificationModelWhenProvidedProperCsrModelAndCmpv2Server()
+ throws CmpClientException, Cmpv2ClientAdapterException {
+ // Given
+ CsrModel testCsrModel = mock(CsrModel.class);
+ Cmpv2Server testServer = mock(Cmpv2Server.class);
+ CertificationModel expectedCertificationModel = mock(CertificationModel.class);
+ when(
+ cmpv2ClientAdapter.callCmpClient(eq(testCsrModel), eq(testServer))
+ ).thenReturn(expectedCertificationModel);
+
+ // When
+ CertificationModel receivedCertificationModel = certificationProvider.signCsr(testCsrModel, testServer);
+
+ // Then
+ assertThat(receivedCertificationModel).isEqualTo(expectedCertificationModel);
+ }
+
+ @Test
+ void certificationProviderThrowCmpClientWhenCallingClientFails()
+ throws CmpClientException, Cmpv2ClientAdapterException {
+ // Given
+ CsrModel testCsrModel = mock(CsrModel.class);
+ Cmpv2Server testServer = mock(Cmpv2Server.class);
+ String expectedErrorMessage = "connecting to CMP client failed";
+ when(
+ cmpv2ClientAdapter.callCmpClient(eq(testCsrModel), eq(testServer))
+ ).thenThrow(new CmpClientException(expectedErrorMessage));
+
+ // When
+ Exception exception = assertThrows(
+ CmpClientException.class, () ->
+ certificationProvider.signCsr(testCsrModel, testServer)
+ );
+
+ // Then
+ assertThat(exception.getMessage()).isEqualTo(expectedErrorMessage);
+ }
+
+}
--- /dev/null
+/*
+ * ============LICENSE_START=======================================================
+ * AAF Certification Service
+ * ================================================================================
+ * Copyright (C) 2020 Nokia. All rights reserved.
+ * ================================================================================
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * ============LICENSE_END=========================================================
+ */
+
+package org.onap.aaf.certservice.certification.adapter;
+
+import org.bouncycastle.asn1.x500.X500Name;
+import org.bouncycastle.pkcs.PKCS10CertificationRequest;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.onap.aaf.certservice.certification.configuration.model.Authentication;
+import org.onap.aaf.certservice.certification.configuration.model.CaMode;
+import org.onap.aaf.certservice.certification.configuration.model.Cmpv2Server;
+import org.onap.aaf.certservice.certification.model.CsrModel;
+import org.onap.aaf.certservice.cmpv2client.external.CSRMeta;
+
+import java.security.PrivateKey;
+import java.security.PublicKey;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.List;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+public class CSRMetaBuilderTest {
+
+ private CSRMetaBuilder csrMetaBuilder;
+
+ private static final String TEST_CA = "testCA";
+ private static final X500Name TEST_SUBJECT_DATA = new X500Name("CN=testIssuer");
+
+ @BeforeEach
+ void setUp() {
+ csrMetaBuilder = new CSRMetaBuilder();
+ }
+
+ @Test
+ void shouldBuildCsrMetaWhenGivenCsrModelAndCmpv2ServerAreCorrect() {
+ // Given
+ CsrModel testCsrModel = mock(CsrModel.class);
+ Cmpv2Server testServer = createTestServer();
+
+ PKCS10CertificationRequest certificationRequest = mock(PKCS10CertificationRequest.class);
+ when(testCsrModel.getCsr()).thenReturn(certificationRequest);
+ PrivateKey mockPrivateKey = mock(PrivateKey.class);
+ when(testCsrModel.getPrivateKey()).thenReturn(mockPrivateKey);
+ PublicKey mockPublicKey = mock(PublicKey.class);
+ when(testCsrModel.getPublicKey()).thenReturn(mockPublicKey);
+ List<String> testSans = Arrays.asList("SAN01","SAN02");
+ when(testCsrModel.getSans()).thenReturn(testSans);
+
+ when(testCsrModel.getSubjectData()).thenReturn(TEST_SUBJECT_DATA);
+
+ // When
+ CSRMeta createdCSRMeta = csrMetaBuilder.build(testCsrModel, testServer);
+
+ // Then
+ assertThat(createdCSRMeta.password()).isEqualTo(testServer.getAuthentication().getIak());
+ assertThat(createdCSRMeta.senderKid()).isEqualTo(testServer.getAuthentication().getRv());
+ assertThat(createdCSRMeta.caUrl()).isEqualTo(testServer.getUrl());
+ assertThat(createdCSRMeta.sans()).containsAll(testSans);
+ assertThat(createdCSRMeta.keyPair().getPrivate()).isEqualTo(mockPrivateKey);
+ assertThat(createdCSRMeta.keyPair().getPublic()).isEqualTo(mockPublicKey);
+ assertThat(createdCSRMeta.x500Name()).isEqualTo(TEST_SUBJECT_DATA);
+ assertThat(createdCSRMeta.issuerx500Name()).isEqualTo(TEST_SUBJECT_DATA);
+ }
+
+ private Cmpv2Server createTestServer() {
+ Cmpv2Server testServer = new Cmpv2Server();
+ testServer.setCaName(TEST_CA);
+ testServer.setIssuerDN(TEST_SUBJECT_DATA);
+ testServer.setUrl("http://test.ca.server");
+ Authentication testAuthentication = new Authentication();
+ testAuthentication.setIak("testIak");
+ testAuthentication.setRv("testRv");
+ testServer.setAuthentication(testAuthentication);
+ testServer.setCaMode(CaMode.RA);
+
+ return testServer;
+ }
+
+}
--- /dev/null
+/*
+ * ============LICENSE_START=======================================================
+ * Cert Service
+ * ================================================================================
+ * Copyright (C) 2020 Nokia. All rights reserved.
+ * ================================================================================
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * ============LICENSE_END=========================================================
+ */
+
+package org.onap.aaf.certservice.certification.adapter;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.StringWriter;
+import java.nio.charset.StandardCharsets;
+import java.security.NoSuchProviderException;
+import java.security.PrivateKey;
+import java.security.cert.CertificateException;
+import java.security.cert.X509Certificate;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.List;
+import java.util.Objects;
+import org.apache.commons.io.IOUtils;
+import org.bouncycastle.asn1.x509.Certificate;
+import org.bouncycastle.cert.X509CertificateHolder;
+import org.bouncycastle.cert.X509v3CertificateBuilder;
+import org.bouncycastle.operator.ContentSigner;
+import org.bouncycastle.operator.OperatorCreationException;
+import org.bouncycastle.pkcs.PKCS10CertificationRequest;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.Mockito;
+import org.onap.aaf.certservice.certification.configuration.model.CaMode;
+import org.onap.aaf.certservice.certification.configuration.model.Cmpv2Server;
+import org.onap.aaf.certservice.certification.exception.Cmpv2ClientAdapterException;
+import org.onap.aaf.certservice.certification.model.CertificationModel;
+import org.onap.aaf.certservice.certification.model.CsrModel;
+import org.onap.aaf.certservice.cmpv2client.api.CmpClient;
+import org.onap.aaf.certservice.cmpv2client.exceptions.CmpClientException;
+import org.onap.aaf.certservice.cmpv2client.external.CSRMeta;
+import org.springframework.boot.test.context.SpringBootTest;
+
+@SpringBootTest
+class Cmpv2ClientAdapterTest {
+
+ @Mock
+ private CmpClient cmpClient;
+ @Mock
+ private CsrModel csrModel;
+ @Mock
+ private Cmpv2Server server;
+ @Mock
+ private RSAContentSignerBuilder rsaContentSignerBuilder;
+ @Mock
+ private X509CertificateBuilder x509CertificateBuilder;
+ @Mock
+ private PKCS10CertificationRequest csr;
+ @Mock
+ private PrivateKey privateKey;
+ @Mock
+ private X509v3CertificateBuilder x509V3CertificateBuilder;
+ @Mock
+ private ContentSigner contentSigner;
+ @Mock
+ private X509CertificateHolder holder;
+ @Mock
+ private Certificate asn1Certificate;
+ @Mock
+ private X509Certificate certificate;
+ @Mock
+ private CertificateFactoryProvider certificateFactoryProvider;
+ @Mock
+ private CSRMetaBuilder csrMetaBuilder;
+ @Mock
+ private CSRMeta csrMeta;
+
+ @InjectMocks
+ private Cmpv2ClientAdapter adapter;
+
+ private static final CaMode CA_MODEL = CaMode.CLIENT;
+ private static final String TEST_MSG = "Test";
+
+ @Test
+ void adapterShouldRethrowClientExceptionOnFailure()
+ throws CmpClientException, IOException, OperatorCreationException, CertificateException,
+ NoSuchProviderException {
+ // Given
+ stubInternalProperties();
+
+ // When
+ Mockito.when(cmpClient.createCertificate(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any()))
+ .thenThrow(new CmpClientException(TEST_MSG));
+
+ // Then
+ Assertions.assertThrows(CmpClientException.class, () -> adapter.callCmpClient(csrModel, server));
+ }
+
+ @Test
+ void shouldConvertToCertificationModel()
+ throws OperatorCreationException, CertificateException, NoSuchProviderException, IOException,
+ CmpClientException, Cmpv2ClientAdapterException {
+ // Given
+ stubInternalProperties();
+
+ // When
+ Mockito.when(cmpClient.createCertificate(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any()))
+ .thenReturn(createCorrectClientResponse());
+ CertificationModel certificationModel = adapter.callCmpClient(csrModel, server);
+
+ // Then
+ InputStream certificate = getClass().getClassLoader().getResourceAsStream("certificateModelChain.first");
+ InputStream trustedCertificate =
+ getClass().getClassLoader().getResourceAsStream("trustedCertificatesModel.first");
+ String certificateModel = removeLineEndings(certificationModel.getCertificateChain().get(0));
+ String expectedCertificate =
+ removeLineEndings(IOUtils.toString(Objects.requireNonNull(certificate), StandardCharsets.UTF_8));
+ String trustedCertificateModel = removeLineEndings(certificationModel.getTrustedCertificates().get(0));
+ String expectedTrustedCertificate =
+ removeLineEndings(IOUtils.toString(Objects.requireNonNull(trustedCertificate), StandardCharsets.UTF_8));
+
+ Assertions.assertEquals(certificateModel, expectedCertificate);
+ Assertions.assertEquals(trustedCertificateModel, expectedTrustedCertificate);
+ }
+
+ @Test
+ void adapterShouldThrowClientAdapterExceptionOnFailure()
+ throws OperatorCreationException, CertificateException, NoSuchProviderException, IOException,
+ CmpClientException {
+ // Given
+ stubInternalProperties();
+
+ // When
+ Mockito.when(cmpClient.createCertificate(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any()))
+ .thenReturn(createCorrectClientResponse());
+ Mockito.when(certificateFactoryProvider.generateCertificate(Mockito.any()))
+ .thenThrow(new CertificateException(TEST_MSG));
+
+ // Then
+ Assertions.assertThrows(Cmpv2ClientAdapterException.class, () -> adapter.callCmpClient(csrModel, server));
+ }
+
+ private List<List<X509Certificate>> createCorrectClientResponse()
+ throws CertificateException, NoSuchProviderException {
+ InputStream certificateChain = getClass().getClassLoader().getResourceAsStream("certificateChain.first");
+ InputStream trustedCertificate = getClass().getClassLoader().getResourceAsStream("trustedCertificates.first");
+ X509Certificate x509Certificate = new CertificateFactoryProvider().generateCertificate(certificateChain);
+ X509Certificate x509TrustedCertificate =
+ new CertificateFactoryProvider().generateCertificate(trustedCertificate);
+ return Arrays.asList(Collections.singletonList(x509Certificate),
+ Collections.singletonList(x509TrustedCertificate));
+ }
+
+ private String removeLineEndings(String string) {
+ return string.replace("\n", "").replace("\r", "");
+ }
+
+ private void stubInternalProperties()
+ throws IOException, OperatorCreationException, CertificateException, NoSuchProviderException {
+ Mockito.when(server.getCaMode()).thenReturn(CA_MODEL);
+ Mockito.when(csrModel.getCsr()).thenReturn(csr);
+ Mockito.when(csrModel.getPrivateKey()).thenReturn(privateKey);
+ Mockito.when(x509CertificateBuilder.build(csr)).thenReturn(x509V3CertificateBuilder);
+ Mockito.when(rsaContentSignerBuilder.build(csr, privateKey)).thenReturn(contentSigner);
+ Mockito.when(x509V3CertificateBuilder.build(contentSigner)).thenReturn(holder);
+ Mockito.when(holder.toASN1Structure()).thenReturn(asn1Certificate);
+ Mockito.when(certificateFactoryProvider.generateCertificate(Mockito.any())).thenReturn(certificate);
+ Mockito.when(holder.toASN1Structure().getEncoded()).thenReturn("".getBytes());
+ Mockito.when(csrMetaBuilder.build(csrModel, server)).thenReturn(csrMeta);
+ }
+
+}
import org.onap.aaf.certservice.certification.configuration.model.Authentication;
import org.onap.aaf.certservice.certification.configuration.model.CaMode;
import org.onap.aaf.certservice.certification.configuration.model.Cmpv2Server;
+import org.onap.aaf.certservice.certification.exception.Cmpv2ServerNotFoundException;
import java.util.Collections;
import static org.assertj.core.api.Assertions.assertThat;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
import static org.mockito.Mockito.when;
@ExtendWith(MockitoExtension.class)
@Test
void shouldReturnOptionalWithServerWhenServerWithGivenCaNameIsPresentInConfig() {
- // given
+ // Given
Cmpv2Server testServer = createTestServer();
when(cmpServersConfig.getCmpServers()).thenReturn(Collections.singletonList(testServer));
- // when
+ // When
Cmpv2Server receivedServer = cmpv2ServerProvider
- .getCmpv2Server(TEST_CA)
- .get();
+ .getCmpv2Server(TEST_CA);
- // then
+ // Then
assertThat(receivedServer).isEqualToComparingFieldByField(testServer);
}
-
@Test
void shouldReturnEmptyOptionalWhenServerWithGivenCaNameIsNotPresentInConfig() {
- // given
+ // Given
+ String expectedMessage = "No server found for given CA name";
when(cmpServersConfig.getCmpServers()).thenReturn(Collections.emptyList());
- // when
- Boolean isEmpty = cmpv2ServerProvider
- .getCmpv2Server(TEST_CA)
- .isEmpty();
+ // When
+ Exception exception = assertThrows(
+ Cmpv2ServerNotFoundException.class, () ->
+ cmpv2ServerProvider.getCmpv2Server(TEST_CA)
+ );
- // then
- assertThat(isEmpty).isTrue();
+ // Then
+ assertTrue(exception.getMessage().contains(expectedMessage));
}
private Cmpv2Server createTestServer() {
= new PemObjectFactory();
@Test
void shouldByConstructedAndReturnProperFields() throws DecryptionException, IOException {
- // given
+ // Given
PemObject testPrivateKey = getPemPrivateKey();
PemObject testPublicKey = generateTestPublicKey();
PKCS10CertificationRequest testCsr = generateTestCertificationRequest();
- // when
+ // When
CsrModel csrModel = generateTestCsrModel(testCsr);
- // then
+ // Then
assertThat(csrModel.getCsr())
.isEqualTo(testCsr);
assertThat(csrModel.getPrivateKey().getEncoded())
@Test
void shouldThrowExceptionWhenPublicKeyIsNotCorrect() throws DecryptionException, IOException {
- // given
+ // Given
PemObject testPrivateKey = getPemPrivateKey();
PKCS10CertificationRequest testCsr = mock(PKCS10CertificationRequest.class);
SubjectPublicKeyInfo wrongKryInfo = mock(SubjectPublicKeyInfo.class);
when(wrongKryInfo.getEncoded())
.thenThrow(new IOException());
- // when
+ // When
Exception exception = assertThrows(
CsrDecryptionException.class,
() -> new CsrModel.CsrModelBuilder(testCsr, testPrivateKey).build()
String expectedMessage = "Reading Public Key from CSR failed";
String actualMessage = exception.getMessage();
- // then
+ // Then
assertTrue(actualMessage.contains(expectedMessage));
}
@Test
void shouldThrowExceptionWhenPrivateKeyPemIsNotProperPrivateKey() throws KeyDecryptionException, IOException {
- // given
+ // Given
PemObject testPrivateKey = getPemWrongKey();
PKCS10CertificationRequest testCsr = mock(PKCS10CertificationRequest.class);
SubjectPublicKeyInfo wrongKryInfo = mock(SubjectPublicKeyInfo.class);
when(wrongKryInfo.getEncoded())
.thenThrow(new IOException());
- // when
+ // When
Exception exception = assertThrows(
KeyDecryptionException.class,
() -> new CsrModel.CsrModelBuilder(testCsr, testPrivateKey).build()
String expectedMessage = "Converting Private Key failed";
String actualMessage = exception.getMessage();
- // then
+ // Then
assertTrue(actualMessage.contains(expectedMessage));
}
@Test
void shouldThrowExceptionWhenPublicKeyPemIsNotProperPublicKey() throws KeyDecryptionException, IOException {
- // given
+ // Given
PemObject testPrivateKey = getPemPrivateKey();
PemObject testPublicKey = getPemWrongKey();
PKCS10CertificationRequest testCsr = mock(PKCS10CertificationRequest.class);
when(wrongKryInfo.getEncoded())
.thenReturn(testPublicKey.getContent());
- // when
+ // When
Exception exception = assertThrows(
KeyDecryptionException.class,
() -> new CsrModel.CsrModelBuilder(testCsr, testPrivateKey).build()
String expectedMessage = "Converting Public Key from CSR failed";
String actualMessage = exception.getMessage();
- // then
+ // Then
assertTrue(actualMessage.contains(expectedMessage));
}
--- /dev/null
+-----BEGIN CERTIFICATE-----\rMIIEXTCCAsWgAwIBAgIUMI4X5/zCpkgY/NIx287DT/T1zEQwDQYJKoZIhvcNAQEL\rBQAwYTEjMCEGCgmSJomT8ixkAQEME2MtMDE5MmY0N2VkY2NjZjg5NzYxFTATBgNV\rBAMMDE1hbmFnZW1lbnRDQTEjMCEGA1UECgwaRUpCQ0EgQ29udGFpbmVyIFF1aWNr\rc3RhcnQwHhcNMTkxMjEyMTEwMDUxWhcNMjExMjExMTA1OTI1WjBSMSAwHgYJKoZI\rhvcNAQkBFhFDb21tb25OYW1lQGNuLmNvbTEWMBQGA1UEAwwNQ049Q29tbW9uTmFt\rZTEWMBQGA1UECgwNQ29tbW9uQ29tcGFueTCCASIwDQYJKoZIhvcNAQEBBQADggEP\rADCCAQoCggEBAJtc1vAn9F166nHED5D2E/xoMMFkCJ0RhpXqn9A9RArB20U54TSf\rnEDuayAGpWIypAnGc1wXCj2ZTWFj48oIRGNy6b2uJ7qHlg7FGwdIGfTP151P0O6W\rzcb9kFj/KwRkyKu7Z9m7BR3G0MBhGaN4DFAVlAFNqmvIip4PW9cO4zCFGABGQcPx\rPhWtBt1Dp3wewp38yXN0evMjOTS7naogPCVme7ffqrqsd8ozlcjk5zd2giJPduUO\r7puBkt6aynM1cc6kGpbQIHCf9f7L0ZGWDXSP/mr87h/WEDkhzBGa7aoME5gTLToT\ro0PPHtyfwOGi2KEBVQg0vde5BiKuisJTw2sCAwEAAaOBmzCBmDAMBgNVHRMBAf8E\rAjAAMB8GA1UdIwQYMBaAFKSoZvZ+ycvTR9MmLcG1sbVLZC19MBkGA1UdEQQSMBCC\rDkNvbW1vbk5hbWUuY29tMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAd\rBgNVHQ4EFgQUKgFUjDFajTD1leb7Q2rvvSFvJZAwDgYDVR0PAQH/BAQDAgXgMA0G\rCSqGSIb3DQEBCwUAA4IBgQBs8knYiqq9GrHG8R0Lh46XTayAddcjN+dX4DHX/Tg9\rsBkl1qUXKEUuOaK2JlW+BzLVuy5QtAAJuDc2BVq19hF2NALOiMi6cJUW/gWJi9ug\reRqMELwxf44Am/CzQoUp52MVuCj4K9sJ6KLC5jm/GgTyFG+Qy7ZoU6df5Gd1E0iU\rQf+tuF77LldMtNcYKbYbBVGDg4O/M221+D2Kq/gfTyWYiB6coiAuiXEjBfgsmCLp\rh8/JHK6zhq+wOUL0isaekPCK8LvzryHoZ5c1MdVXgDgwErWoZf+PnaUUHSH9DbTR\rLyWY++TXYLn0xUDZTqJboshDq3C4vqGsUJ4eSCfaAeiyX0RmXvE8DPiKQy7vTOGP\r5CzpqnZbHSbKf/L3nbu4q7LZMtHzNhqgnqHVPJE42okHwBEbQX4POnghdujxCuFF\rgr+8LjQpc+0tlCXqTLeapBIHQDc0ECwWB2fPU1XRVHJB7MOew0OJ2yGgCSeJXO4W\rpujWO9CVPB49h5LyMPkNdr8=\r-----END CERTIFICATE-----\r
\ No newline at end of file
--- /dev/null
+-----BEGIN CERTIFICATE-----
+MIIEszCCAxugAwIBAgIUGMTLyt0bYrNGz4KPqapEq64XmIIwDQYJKoZIhvcNAQEL
+BQAwYTEjMCEGCgmSJomT8ixkAQEME2MtMDE5MmY0N2VkY2NjZjg5NzYxFTATBgNV
+BAMMDE1hbmFnZW1lbnRDQTEjMCEGA1UECgwaRUpCQ0EgQ29udGFpbmVyIFF1aWNr
+c3RhcnQwHhcNMTkxMjEyMTEwMDUxWhcNMjkxMjExMTEwMDUxWjBhMSMwIQYKCZIm
+iZPyLGQBAQwTYy0wMTkyZjQ3ZWRjY2NmODk3NjEVMBMGA1UEAwwMTWFuYWdlbWVu
+dENBMSMwIQYDVQQKDBpFSkJDQSBDb250YWluZXIgUXVpY2tzdGFydDCCAaIwDQYJ
+KoZIhvcNAQEBBQADggGPADCCAYoCggGBAK2yz/z273gG55p4NvDfg8EZIOFkQmAV
+Vi+gfvyl3zb8KYOBWGAOM8IKMInJP1Gulz2D2qYAL7PlJi87WaMI1mTNL0ca177T
+UOz3C1vuFp5QqcQZP8fbGlQCHawcPwacLm6G4WFHi5tjtuBQS+qn1RrHdnvSMwG7
+1bZll3wLOnU3TOAvDMEbAXCXIwc7wxAluO1e+bCM2VjL8iFvNtEqQ2KY3IKO7aaE
+nEGkTniYg6lBSd/3D04CLVEqinI4sbGV/DX3cULmIsGT5E4b6KMlXrFuzbfj5VtS
+n8awf+EMWm1AHlyM05GhMD8N60nZcoF5/rzrzxPr1Jv9DTl/MRRasqwtmEddbn0e
+OVgB7c5LEbNrnJWt/4sdEBQXX3z4y2HI40iuZmTMP0zPwxWA1v/bmd9EIE2/QKGo
+kMHvvjTRTtdBYGGeeL5TRU2o1YSw6bda57Dv2I3OGA6gNxbH1juG/2W8kg01YL7S
+C49OnY9l3EP0iPHhtNnikuULG+Us1AL+HwIDAQABo2MwYTAPBgNVHRMBAf8EBTAD
+AQH/MB8GA1UdIwQYMBaAFKSoZvZ+ycvTR9MmLcG1sbVLZC19MB0GA1UdDgQWBBSk
+qGb2fsnL00fTJi3BtbG1S2QtfTAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcNAQEL
+BQADggGBAD2z2NNVF1HKei+IGBiClyuSVOIXU86p+BLk4EoIlBvWB6jwB++jBHt5
+EfQhGr8dkRqkd9EG92PDgJklHz6qeogCGdkEQikaN03SwFxk5ig5HW8Fycpffbp/
+dY+QT8IVkx7jJfpe/+unf2FZbaIGcFiL+YFa2Ii6dHKIC5ntIUiKjRsQdbs6EjWU
+sxiozLuAxeD/otReNu2VZze43cZqygEB77cbHT8DSRsAtLUdbNluyTwZOZXKiTlG
+ClBXP4NkNTG+deP1B9k8CZolTn2fyj6KmQdBQ3S1MWIF9IsMbc2vjvbJlRkdX/nl
+lQC6bsvb0VVWnBHiLGpsgsye7eyE0PJ/tAvQNsrhOSxCxaTFBhRExG3Mr9uU7iDj
+PFxnuTACAOv9aAyoBbJnLkN/Mkq3ILTChGY8cLnM3tGnb8fpbXbtMSzGAoLPmsh4
+vvJEjIgi5NTIMqaADsXSAToW61AU2otAQxLvgI03szPxUF1l4Neo1RHJDNwp5yyo
+oYIM2lYI0w==
+-----END CERTIFICATE-----
Code Review / oom / platform / cert-service.git / commitdiff