System.err.println(rb.getString                            ("Certificate.reply.was.not.installed.in.keystore"));                    }                } else if (!keyStore.containsAlias(importAlias) ||                        keyStore.entryInstanceOf(importAlias,                            KeyStore.TrustedCertificateEntry.class)) {                    kssave = addTrustedCert(importAlias, inStream);                    if (kssave) {                        System.err.println(rb.getString                            ("Certificate.was.added.to.keystore"));                    } else {                        System.err.println(rb.getString                            ("Certificate.was.not.added.to.keystore"));                    }                }            } finally {                if (inStream != System.in) {                    inStream.close();                }            }        } else if (command == IMPORTKEYSTORE) {            doImportKeyStore();            kssave = true;        } else if (command == KEYCLONE) {            keyPassNew = newPass;             // added to make sure only key can go thru            if (alias == null) {                alias = keyAlias;            }            if (keyStore.containsAlias(alias) == false) {                MessageFormat form = new MessageFormat                    (rb.getString("Alias.alias.does.not.exist"));                Object[] source = {alias};                throw new Exception(form.format(source));            }            if (!keyStore.entryInstanceOf(alias, KeyStore.PrivateKeyEntry.class)) {                MessageFormat form = new MessageFormat(rb.getString(                        "Alias.alias.references.an.entry.type.that.is.not.a.private.key.entry.The.keyclone.command.only.supports.cloning.of.private.key"));                Object[] source = {alias};                throw new Exception(form.format(source));            }             doCloneEntry(alias, dest, true);  // Now everything can be cloned            kssave = true;        } else if (command == CHANGEALIAS) {            if (alias == null) {                alias = keyAlias;            }            doCloneEntry(alias, dest, false);            // in PKCS11, clone a PrivateKeyEntry will delete the old one            if (keyStore.containsAlias(alias)) {                doDeleteEntry(alias);            }            kssave = true;        } else if (command == KEYPASSWD) {            keyPassNew = newPass;            doChangeKeyPasswd(alias);            kssave = true;        } else if (command == LIST) {            if (alias != null) {                doPrintEntry(alias, out, true);            } else {                doPrintEntries(out);            }        } else if (command == PRINTCERT) {            doPrintCert(out);        } else if (command == SELFCERT) {            doSelfCert(alias, dname, sigAlgName);            kssave = true;        } else if (command == STOREPASSWD) {            storePassNew = newPass;            if (storePassNew == null) {                storePassNew = getNewPasswd("keystore password", storePass);            }            kssave = true;        } else if (command == GENCERT) {            if (alias == null) {                alias = keyAlias;            }            InputStream inStream = System.in;            if (infilename != null) {                inStream = new FileInputStream(infilename);            }            PrintStream ps = null;            if (outfilename != null) {                ps = new PrintStream(new FileOutputStream(outfilename));                out = ps;            }            try {                doGenCert(alias, sigAlgName, inStream, out);            } finally {                if (inStream != System.in) {                    inStream.close();                }                if (ps != null) {                    ps.close();                }            }        } else if (command == GENCRL) {            if (alias == null) {                alias = keyAlias;            }            PrintStream ps = null;            if (filename != null) {                ps = new PrintStream(new FileOutputStream(filename));                out = ps;            }            try {                doGenCRL(out);            } finally {                if (ps != null) {                    ps.close();                }            }        } else if (command == PRINTCERTREQ) {            InputStream inStream = System.in;            if (filename != null) {                inStream = new FileInputStream(filename);            }            try {                doPrintCertReq(inStream, out);            } finally {                if (inStream != System.in) {                    inStream.close();                }            }        } else if (command == PRINTCRL) {            doPrintCRL(filename, out);        }         // If we need to save the keystore, do so.        if (kssave) {            if (verbose) {                MessageFormat form = new MessageFormat                        (rb.getString(".Storing.ksfname."));                Object[] source = {nullStream ? "keystore" : ksfname};                System.err.println(form.format(source));            }             if (token) {                keyStore.store(null, null);            } else {                FileOutputStream fout = null;                try {                    fout = (nullStream ?                                        (FileOutputStream)null :                                        new FileOutputStream(ksfname));                    keyStore.store                        (fout,                        (storePassNew!=null) ? storePassNew : storePass);                } finally {                    if (fout != null) {                        fout.close();                    }                }            }        }    }     /**     * Generate a certificate: Read PKCS10 request from in, and print     * certificate to out. Use alias as CA, sigAlgName as the signature     * type.     */    private void doGenCert(String alias, String sigAlgName, InputStream in, PrintStream out)            throws Exception {          Certificate signerCert = keyStore.getCertificate(alias);        byte[] encoded = signerCert.getEncoded();        X509CertImpl signerCertImpl = new X509CertImpl(encoded);        X509CertInfo signerCertInfo = (X509CertInfo)signerCertImpl.get(                X509CertImpl.NAME + "." + X509CertImpl.INFO);        X500Name issuer = (X500Name)signerCertInfo.get(X509CertInfo.SUBJECT + "." +                                           CertificateSubjectName.DN_NAME);         Date firstDate = getStartDate(startDate);        Date lastDate = new Date();        lastDate.setTime(firstDate.getTime() + validity*1000L*24L*60L*60L);        CertificateValidity interval = new CertificateValidity(firstDate,                                                               lastDate);         PrivateKey privateKey =                (PrivateKey)recoverKey(alias, storePass, keyPass).fst;        if (sigAlgName == null) {            sigAlgName = getCompatibleSigAlgName(privateKey.getAlgorithm());        }        Signature signature = Signature.getInstance(sigAlgName);        signature.initSign(privateKey);         X509CertInfo info = new X509CertInfo();        info.set(X509CertInfo.VALIDITY, interval);        info.set(X509CertInfo.SERIAL_NUMBER, new CertificateSerialNumber(                    new java.util.Random().nextInt() & 0x7fffffff));        info.set(X509CertInfo.VERSION,                    new CertificateVersion(CertificateVersion.V3));        info.set(X509CertInfo.ALGORITHM_ID,                    new CertificateAlgorithmId(                        AlgorithmId.getAlgorithmId(sigAlgName)));        info.set(X509CertInfo.ISSUER, new CertificateIssuerName(issuer));         BufferedReader reader = new BufferedReader(new InputStreamReader(in));        boolean canRead = false;        StringBuffer sb = new StringBuffer();        while (true) {            String s = reader.readLine();            if (s == null) break;            // OpenSSL does not use NEW            //if (s.startsWith("-----BEGIN NEW CERTIFICATE REQUEST-----")) {            if (s.startsWith("-----BEGIN") && s.indexOf("REQUEST") >= 0) {                canRead = true;            //} else if (s.startsWith("-----END NEW CERTIFICATE REQUEST-----")) {            } else if (s.startsWith("-----END") && s.indexOf("REQUEST") >= 0) {                break;            } else if (canRead) {                sb.append(s);            }        }        byte[] rawReq = new BASE64Decoder().decodeBuffer(new String(sb));        PKCS10 req = new PKCS10(rawReq);         info.set(X509CertInfo.KEY, new CertificateX509Key(req.getSubjectPublicKeyInfo()));        info.set(X509CertInfo.SUBJECT, new CertificateSubjectName(                dname==null?req.getSubjectName():new X500Name(dname)));        CertificateExtensions reqex = null;        Iterator<PKCS10Attribute> attrs = req.getAttributes().getAttributes().iterator();        while (attrs.hasNext()) {            PKCS10Attribute attr = attrs.next();            if (attr.getAttributeId().equals(PKCS9Attribute.EXTENSION_REQUEST_OID)) {                reqex = (CertificateExtensions)attr.getAttributeValue();            }        }        CertificateExtensions ext = createV3Extensions(                reqex,                null,                v3ext,                req.getSubjectPublicKeyInfo(),                signerCert.getPublicKey());        info.set(X509CertInfo.EXTENSIONS, ext);        X509CertImpl cert = new X509CertImpl(info);        cert.sign(privateKey, sigAlgName);        dumpCert(cert, out);        for (Certificate ca: keyStore.getCertificateChain(alias)) {            if (ca instanceof X509Certificate) {                X509Certificate xca = (X509Certificate)ca;                if (!isSelfSigned(xca)) {                    dumpCert(xca, out);                }            }        }    }     private void doGenCRL(PrintStream out)            throws Exception {        if (ids == null) {            throw new Exception("Must provide -id when -gencrl");        }        Certificate signerCert = keyStore.getCertificate(alias);        byte[] encoded = signerCert.getEncoded();        X509CertImpl signerCertImpl = new X509CertImpl(encoded);        X509CertInfo signerCertInfo = (X509CertInfo)signerCertImpl.get(                X509CertImpl.NAME + "." + X509CertImpl.INFO);        X500Name owner = (X500Name)signerCertInfo.get(X509CertInfo.SUBJECT + "." +                                           CertificateSubjectName.DN_NAME);         Date firstDate = getStartDate(startDate);        Date lastDate = (Date) firstDate.clone();        lastDate.setTime(lastDate.getTime() + (long)validity*1000*24*60*60);        CertificateValidity interval = new CertificateValidity(firstDate,                                                               lastDate);          PrivateKey privateKey =                (PrivateKey)recoverKey(alias, storePass, keyPass).fst;        if (sigAlgName == null) {            sigAlgName = getCompatibleSigAlgName(privateKey.getAlgorithm());        }         X509CRLEntry[] badCerts = new X509CRLEntry[ids.size()];        for (int i=0; i<ids.size(); i++) {            String id = ids.get(i);            int d = id.indexOf(':');            if (d >= 0) {                CRLExtensions ext = new CRLExtensions();                ext.set("Reason", new CRLReasonCodeExtension(Integer.parseInt(id.substring(d+1))));                badCerts[i] = new X509CRLEntryImpl(new BigInteger(id.substring(0, d)),                        firstDate, ext);            } else {                badCerts[i] = new X509CRLEntryImpl(new BigInteger(ids.get(i)), firstDate);            }        }        X509CRLImpl crl = new X509CRLImpl(owner, firstDate, lastDate, badCerts);        crl.sign(privateKey, sigAlgName);        if (rfc) {            out.println("-----BEGIN X509 CRL-----");            new BASE64Encoder().encodeBuffer(crl.getEncodedInternal(), out);            out.println("-----END X509 CRL-----");        } else {            out.write(crl.getEncodedInternal());        }    }     /**     * Creates a PKCS#10 cert signing request, corresponding to the     * keys (and name) associated with a given alias.     */    private void doCertReq(String alias, String sigAlgName, PrintStream out)        throws Exception    {        if (alias == null) {            alias = keyAlias;        }         Pair<Key,char[]> objs = recoverKey(alias, storePass, keyPass);        PrivateKey privKey = (PrivateKey)objs.fst;        if (keyPass == null) {            keyPass = objs.snd;        }         Certificate cert = keyStore.getCertificate(alias);        if (cert == null) {            MessageFormat form = new MessageFormat                (rb.getString("alias.has.no.public.key.certificate."));            Object[] source = {alias};            throw new Exception(form.format(source));        }        PKCS10 request = new PKCS10(cert.getPublicKey());        CertificateExtensions ext = createV3Extensions(null, null, v3ext, cert.getPublicKey(), null);        // Attribute name is not significant        request.getAttributes().setAttribute(X509CertInfo.EXTENSIONS,                new PKCS10Attribute(PKCS9Attribute.EXTENSION_REQUEST_OID, ext));         // Construct a Signature object, so that we can sign the request        if (sigAlgName == null) {            sigAlgName = getCompatibleSigAlgName(privKey.getAlgorithm());        }         Signature signature = Signature.getInstance(sigAlgName);        signature.initSign(privKey);        X500Name subject = dname == null?                new X500Name(((X509Certificate)cert).getSubjectDN().toString()):                new X500Name(dname);         // Sign the request and base-64 encode it        request.encodeAndSign(subject, signature);        request.print(out);    }     /**     * Deletes an entry from the keystore.     */    private void doDeleteEntry(String alias) throws Exception {        if (keyStore.containsAlias(alias) == false) {            MessageFormat form = new MessageFormat                (rb.getString("Alias.alias.does.not.exist"));            Object[] source = {alias};            throw new Exception(form.format(source));        }        keyStore.deleteEntry(alias);    }     /**     * Exports a certificate from the keystore.     */    private void doExportCert(String alias, PrintStream out)        throws Exception    {        if (storePass == null                && !KeyStoreUtil.isWindowsKeyStore(storetype)) {            printWarning();        }        if (alias == null) {            alias = keyAlias;        }        if (keyStore.containsAlias(alias) == false) {            MessageFormat form = new MessageFormat                (rb.getString("Alias.alias.does.not.exist"));            Object[] source = {alias};            throw new Exception(form.format(source));        }         X509Certificate cert = (X509Certificate)keyStore.getCertificate(alias);        if (cert == null) {            MessageFormat form = new MessageFormat                (rb.getString("Alias.alias.has.no.certificate"));            Object[] source = {alias};            throw new Exception(form.format(source));        }        dumpCert(cert, out);    }     /**     * Prompt the user for a keypass when generating a key entry.     * @param alias the entry we will set password for     * @param orig the original entry of doing a dup, null if generate new     * @param origPass the password to copy from if user press ENTER     */    private char[] promptForKeyPass(String alias, String orig, char[] origPass) throws Exception{        if (P12KEYSTORE.equalsIgnoreCase(storetype)) {            return origPass;        } else if (!token) {            // Prompt for key password            int count;            for (count = 0; count < 3; count++) {                MessageFormat form = new MessageFormat(rb.getString                        ("Enter.key.password.for.alias."));                Object[] source = {alias};                System.err.println(form.format(source));                if (orig == null) {                    System.err.print(rb.getString                            (".RETURN.if.same.as.keystore.password."));                } else {                    form = new MessageFormat(rb.getString                            (".RETURN.if.same.as.for.otherAlias."));                    Object[] src = {orig};                    System.err.print(form.format(src));                }                System.err.flush();                char[] entered = Password.readPassword(System.in);                passwords.add(entered);                if (entered == null) {                    return origPass;                } else if (entered.length >= 6) {                    System.err.print(rb.getString("Re.enter.new.password."));                    char[] passAgain = Password.readPassword(System.in);                    passwords.add(passAgain);                    if (!Arrays.equals(entered, passAgain)) {                        System.err.println                            (rb.getString("They.don.t.match.Try.again"));                        continue;                    }                    return entered;                } else {                    System.err.println(rb.getString                        ("Key.password.is.too.short.must.be.at.least.6.characters"));                }            }            if (count == 3) {                if (command == KEYCLONE) {                    throw new Exception(rb.getString                        ("Too.many.failures.Key.entry.not.cloned"));                } else {                    throw new Exception(rb.getString                            ("Too.many.failures.key.not.added.to.keystore"));                }            }        }        return null;    // PKCS11    }    /**     * Creates a new secret key.     */    private void doGenSecretKey(String alias, String keyAlgName,                              int keysize)        throws Exception    {        if (alias == null) {            alias = keyAlias;        }        if (keyStore.containsAlias(alias)) {            MessageFormat form = new MessageFormat(rb.getString                ("Secret.key.not.generated.alias.alias.already.exists"));            Object[] source = {alias};            throw new Exception(form.format(source));        }         SecretKey secKey = null;        KeyGenerator keygen = KeyGenerator.getInstance(keyAlgName);        if (keysize != -1) {            keygen.init(keysize);        } else if ("DES".equalsIgnoreCase(keyAlgName)) {            keygen.init(56);        } else if ("DESede".equalsIgnoreCase(keyAlgName)) {            keygen.init(168);        } else {            throw new Exception(rb.getString                ("Please.provide.keysize.for.secret.key.generation"));        }         secKey = keygen.generateKey();        if (keyPass == null) {            keyPass = promptForKeyPass(alias, null, storePass);        }        keyStore.setKeyEntry(alias, secKey, keyPass, null);    }     /**     * If no signature algorithm was specified at the command line,     * we choose one that is compatible with the selected private key     */    private static String getCompatibleSigAlgName(String keyAlgName)            throws Exception {        if ("DSA".equalsIgnoreCase(keyAlgName)) {            return "SHA1WithDSA";        } else if ("RSA".equalsIgnoreCase(keyAlgName)) {            return "SHA256WithRSA";        } else if ("EC".equalsIgnoreCase(keyAlgName)) {            return "SHA256withECDSA";        } else {

Lines 1001–1500 of 4217. Previous lines Load more