|
1
13
14 package org.ejbca.core.model.ca.caadmin;
15
16 import java.io.Serializable  ;
17 import java.security.KeyPair ;
18 import java.security.PublicKey ;
19 import java.security.cert.CRL ;
20 import java.security.cert.Certificate ;
21 import java.util.ArrayList ;
22 import java.util.Collection ;
23 import java.util.Date ;
24 import java.util.HashMap ;
25 import java.util.Iterator ;
26 import java.util.Vector ;
27
28 import javax.ejb.EJBException ;
29
30 import org.apache.log4j.Logger;
31 import org.bouncycastle.cms.CMSException;
32 import org.ejbca.core.model.UpgradeableDataHashMap;
33 import org.ejbca.core.model.ca.SignRequestSignatureException;
34 import org.ejbca.core.model.ca.caadmin.extendedcaservices.CmsCAService;
35 import org.ejbca.core.model.ca.caadmin.extendedcaservices.CmsCAServiceInfo;
36 import org.ejbca.core.model.ca.caadmin.extendedcaservices.CmsCAServiceRequest;
37 import org.ejbca.core.model.ca.caadmin.extendedcaservices.ExtendedCAService;
38 import org.ejbca.core.model.ca.caadmin.extendedcaservices.ExtendedCAServiceInfo;
39 import org.ejbca.core.model.ca.caadmin.extendedcaservices.ExtendedCAServiceNotActiveException;
40 import org.ejbca.core.model.ca.caadmin.extendedcaservices.ExtendedCAServiceRequest;
41 import org.ejbca.core.model.ca.caadmin.extendedcaservices.ExtendedCAServiceRequestException;
42 import org.ejbca.core.model.ca.caadmin.extendedcaservices.ExtendedCAServiceResponse;
43 import org.ejbca.core.model.ca.caadmin.extendedcaservices.IllegalExtendedCAServiceRequestException;
44 import org.ejbca.core.model.ca.caadmin.extendedcaservices.KeyRecoveryCAServiceRequest;
45 import org.ejbca.core.model.ca.caadmin.extendedcaservices.KeyRecoveryCAServiceResponse;
46 import org.ejbca.core.model.ca.caadmin.extendedcaservices.OCSPCAService;
47 import org.ejbca.core.model.ca.caadmin.extendedcaservices.OCSPCAServiceInfo;
48 import org.ejbca.core.model.ca.caadmin.extendedcaservices.OCSPCAServiceRequest;
49 import org.ejbca.core.model.ca.caadmin.extendedcaservices.XKMSCAService;
50 import org.ejbca.core.model.ca.caadmin.extendedcaservices.XKMSCAServiceInfo;
51 import org.ejbca.core.model.ca.caadmin.extendedcaservices.XKMSCAServiceRequest;
52 import org.ejbca.core.model.ca.catoken.CAToken;
53 import org.ejbca.core.model.ca.catoken.CATokenInfo;
54 import org.ejbca.core.model.ca.catoken.HardCATokenContainer;
55 import org.ejbca.core.model.ca.catoken.HardCATokenManager;
56 import org.ejbca.core.model.ca.catoken.NullCAToken;
57 import org.ejbca.core.model.ca.catoken.SoftCAToken;
58 import org.ejbca.core.model.ca.certificateprofiles.CertificateProfile;
59 import org.ejbca.core.model.ra.UserDataVO;
60 import org.ejbca.util.Base64;
61 import org.ejbca.util.CertTools;
62
63
64
65
66
71 public abstract class CA extends UpgradeableDataHashMap implements Serializable {
72
73
74 private static Logger log = Logger.getLogger(CA.class);
75
76 public static final String TRUE = "true";
77 public static final String FALSE = "false";
78
79 public static final String CATYPE = "catype";
81 protected static final String SUBJECTDN = "subjectdn";
82 protected static final String CAID = "caid";
83 protected static final String NAME = "name";
84 protected static final String STATUS = "status";
85 protected static final String VALIDITY = "validity";
86 protected static final String EXPIRETIME = "expiretime";
87 protected static final String CERTIFICATECHAIN = "certificatechain";
88 protected static final String CATOKENDATA = "catoken";
89 protected static final String SIGNEDBY = "signedby";
90 protected static final String DESCRIPTION = "description";
91 protected static final String REVOKATIONREASON = "revokationreason";
92 protected static final String REVOKATIONDATE = "revokationdate";
93 protected static final String CERTIFICATEPROFILEID = "certificateprofileid";
94 protected static final String CRLPERIOD = "crlperiod";
95 protected static final String CRLISSUEINTERVAL = "crlIssueInterval";
96 protected static final String CRLOVERLAPTIME = "crlOverlapTime";
97 protected static final String CRLPUBLISHERS = "crlpublishers";
98 protected static final String FINISHUSER = "finishuser";
99 protected static final String REQUESTCERTCHAIN = "requestcertchain";
100 protected static final String EXTENDEDCASERVICES = "extendedcaservices";
101 protected static final String EXTENDEDCASERVICE = "extendedcaservice";
102 protected static final String APPROVALSETTINGS = "approvalsettings";
103 protected static final String NUMBEROFREQAPPROVALS = "numberofreqapprovals";
104
105
107 public CA(CAInfo cainfo){
108 data = new HashMap ();
109
110 this.cainfo = cainfo;
111
112 data.put(VALIDITY, new Integer (cainfo.getValidity()));
113 data.put(SIGNEDBY, new Integer (cainfo.getSignedBy()));
114 data.put(DESCRIPTION, cainfo.getDescription());
115 data.put(REVOKATIONREASON, new Integer (-1));
116 data.put(CERTIFICATEPROFILEID, new Integer (cainfo.getCertificateProfileId()));
117 setCRLPeriod(cainfo.getCRLPeriod());
118 setCRLIssueInterval(cainfo.getCRLIssueInterval());
119 setCRLOverlapTime(cainfo.getCRLOverlapTime());
120 setCRLPublishers(cainfo.getCRLPublishers());
121 setFinishUser(cainfo.getFinishUser());
122
123
124 Iterator iter = cainfo.getExtendedCAServiceInfos().iterator();
125 ArrayList extendedservicetypes = new ArrayList ();
126 while(iter.hasNext()){
127 ExtendedCAServiceInfo next = (ExtendedCAServiceInfo) iter.next();
128 if(next instanceof OCSPCAServiceInfo){
129 setExtendedCAService(new OCSPCAService(next));
130 extendedservicetypes.add(new Integer (ExtendedCAServiceInfo.TYPE_OCSPEXTENDEDSERVICE));
131 }
132 if(next instanceof XKMSCAServiceInfo){
133 setExtendedCAService(new XKMSCAService(next));
134 extendedservicetypes.add(new Integer (ExtendedCAServiceInfo.TYPE_XKMSEXTENDEDSERVICE));
135 }
136 if(next instanceof CmsCAServiceInfo){
137 setExtendedCAService(new CmsCAService(next));
138 extendedservicetypes.add(new Integer (ExtendedCAServiceInfo.TYPE_CMSEXTENDEDSERVICE));
139 }
140 }
141 data.put(EXTENDEDCASERVICES, extendedservicetypes);
142 setApprovalSettings(cainfo.getApprovalSettings());
143 setNumOfRequiredApprovals(cainfo.getNumOfReqApprovals());
144 }
145
146
147 public CA(HashMap data){
148 loadData(data);
149 extendedcaservicemap = new HashMap ();
150 }
151 public void setCAInfo(CAInfo cainfo) {
152 this.cainfo = cainfo;
153 }
154 public CAInfo getCAInfo() {
155 return this.cainfo;
156 }
157
158 public String getSubjectDN(){
160 return cainfo.getSubjectDN();
161 }
162 public void setSubjectDN(String subjectdn){
163 cainfo.subjectdn = subjectdn;
164 }
165
166 public int getCAId(){
167 return cainfo.getCAId();
168 }
169 public void setCAId(int caid){
170 cainfo.caid = caid;
171 }
172
173 public String getName(){
174 return cainfo.getName();
175 }
176 public void setName(String caname){
177 cainfo.name = caname;
178 }
179
180 public int getStatus(){
181 return cainfo.getStatus();
182 }
183 public void setStatus(int status){
184 cainfo.status = status;
185 }
186
187 public int getCAType(){ return ((Integer )data.get(CATYPE)).intValue();}
188
189 public int getValidity(){ return ((Integer ) data.get(VALIDITY)).intValue();}
190 public void setValidity(int validity){ data.put(VALIDITY, new Integer (validity));}
191
192 public Date getExpireTime(){return ((Date )data.get(EXPIRETIME));}
193 public void setExpireTime(Date expiretime) { data.put(EXPIRETIME,expiretime);}
194
195 public int getSignedBy(){ return ((Integer ) data.get(SIGNEDBY)).intValue();}
196
197 public String getDescription(){return ((String )data.get(DESCRIPTION));}
198 public void setDescription(String description) { data.put(DESCRIPTION,description);}
199
200 public int getRevokationReason(){return ((Integer ) data.get(REVOKATIONREASON)).intValue();}
201 public void setRevokationReason(int reason){ data.put(REVOKATIONREASON,new Integer (reason));}
202
203 public Date getRevokationDate(){return (Date ) data.get(REVOKATIONDATE);}
204 public void setRevokationDate(Date date){ data.put(REVOKATIONDATE,date);}
205
206 public int getCRLPeriod(){return ((Integer )data.get(CRLPERIOD)).intValue();}
207 public void setCRLPeriod(int crlperiod) {data.put(CRLPERIOD, new Integer (crlperiod));}
208
209 public int getCRLIssueInterval(){return ((Integer )data.get(CRLISSUEINTERVAL)).intValue();}
210 public void setCRLIssueInterval(int crlIssueInterval) {data.put(CRLISSUEINTERVAL, new Integer (crlIssueInterval));}
211
212 public int getCRLOverlapTime(){return ((Integer )data.get(CRLOVERLAPTIME)).intValue();}
213 public void setCRLOverlapTime(int crlOverlapTime) {data.put(CRLOVERLAPTIME, new Integer (crlOverlapTime));}
214
215 public Collection getCRLPublishers(){return ((Collection )data.get(CRLPUBLISHERS));}
216 public void setCRLPublishers(Collection crlpublishers) {data.put(CRLPUBLISHERS, crlpublishers);}
217
218
219 public int getCertificateProfileId() {return ((Integer ) data.get(CERTIFICATEPROFILEID)).intValue();}
220
221
226 public CAToken getCAToken(int caid) throws IllegalKeyStoreException {
227 CAToken ret = HardCATokenManager.instance().getCAToken(caid);
228 if (ret == null) {
229 Integer tokentype = (Integer ) ((HashMap )data.get(CATOKENDATA)).get(CAToken.CATOKENTYPE);
230 switch(tokentype.intValue()) {
231 case CATokenInfo.CATOKENTYPE_P12:
232 ret = new SoftCAToken((HashMap )data.get(CATOKENDATA));
233 break;
234 case CATokenInfo.CATOKENTYPE_HSM:
235 ret = new HardCATokenContainer((HashMap )data.get(CATOKENDATA));
236 break;
237 case CATokenInfo.CATOKENTYPE_NULL:
238 ret = new NullCAToken();
239 break;
240 default:
241 throw new IllegalKeyStoreException("No CA Token type defined: "+tokentype.intValue());
242 }
243 HardCATokenManager.instance().addCAToken(caid, ret);
244 }
245 return ret;
246 }
247
252 public CAToken getCAToken() throws IllegalKeyStoreException {
253 return getCAToken(getCAId());
254 }
255
256
260 public void setCAToken(CAToken catoken){
261 data.put(CATOKENDATA, catoken.saveData());
262 HardCATokenManager.instance().addCAToken(getCAId(), catoken);
263 }
264
265 public Collection getRequestCertificateChain(){
266 if(requestcertchain == null){
267 Collection storechain = (Collection ) data.get(REQUESTCERTCHAIN);
268 Iterator iter = storechain.iterator();
269 this.requestcertchain = new ArrayList ();
270 while(iter.hasNext()){
271 String b64Cert = (String ) iter.next();
272 try{
273 this.requestcertchain.add(CertTools.getCertfromByteArray(Base64.decode(b64Cert.getBytes())));
274 }catch(Exception e){
275 throw new EJBException (e);
276 }
277 }
278 }
279
280 return requestcertchain;
281 }
282
283 public void setRequestCertificateChain(Collection requestcertificatechain){
284 Iterator iter = requestcertificatechain.iterator();
285 ArrayList storechain = new ArrayList ();
286 while(iter.hasNext()){
287 Certificate cert = (Certificate ) iter.next();
288 try{
289 String b64Cert = new String (Base64.encode(cert.getEncoded()));
290 storechain.add(b64Cert);
291 }catch(Exception e){
292 throw new EJBException (e);
293 }
294 }
295 data.put(REQUESTCERTCHAIN,storechain);
296
297 this.requestcertchain = new ArrayList ();
298 this.requestcertchain.addAll(requestcertificatechain);
299 }
300
301
304 public Collection getCertificateChain(){
305 if(certificatechain == null){
306 Collection storechain = (Collection ) data.get(CERTIFICATECHAIN);
307 if (storechain == null) {
308 return null;
309 }
310 Iterator iter = storechain.iterator();
311 this.certificatechain = new ArrayList ();
312 while(iter.hasNext()){
313 String b64Cert = (String ) iter.next();
314 try{
315 this.certificatechain.add(CertTools.getCertfromByteArray(Base64.decode(b64Cert.getBytes())));
316 }catch(Exception e){
317 throw new EJBException (e);
318 }
319 }
320 }
321 return certificatechain;
322 }
323
324 public void setCertificateChain(Collection certificatechain){
325 Iterator iter = certificatechain.iterator();
326 ArrayList storechain = new ArrayList ();
327 while(iter.hasNext()){
328 Certificate cert = (Certificate ) iter.next();
329 try{
330 String b64Cert = new String (Base64.encode(cert.getEncoded()));
331 storechain.add(b64Cert);
332 }catch(Exception e){
333 throw new EJBException (e);
334 }
335 }
336 data.put(CERTIFICATECHAIN,storechain);
337
338 this.certificatechain = new ArrayList ();
339 this.certificatechain.addAll(certificatechain);
340 }
341
342
343
345 public Certificate getCACertificate(){
346 if(certificatechain == null) {
347 getCertificateChain();
348 if (certificatechain == null) {
350 return null;
351 }
352 }
353 return (Certificate ) this.certificatechain.get(0);
354 }
355
356 public boolean getFinishUser(){return ((Boolean )data.get(FINISHUSER)).booleanValue();}
357
358 public void setFinishUser(boolean finishuser) {data.put(FINISHUSER, new Boolean (finishuser));}
359
360
367 public Collection getApprovalSettings(){
368 if(data.get(APPROVALSETTINGS) == null){
369 return new ArrayList ();
370 }
371
372 return (Collection ) data.get(APPROVALSETTINGS);
373 }
374
375
379 public void setApprovalSettings(Collection approvalSettings){
380 data.put(APPROVALSETTINGS,approvalSettings);
381 }
382
383
387 public int getNumOfRequiredApprovals(){
388 if(data.get(NUMBEROFREQAPPROVALS) == null){
389 return 1;
390 }
391 return ((Integer ) data.get(NUMBEROFREQAPPROVALS)).intValue();
392 }
393
394
397 public void setNumOfRequiredApprovals(int numOfReqApprovals){
398 data.put(NUMBEROFREQAPPROVALS,new Integer (numOfReqApprovals));
399 }
400
401 public void updateCA(CAInfo cainfo) throws Exception {
402 data.put(VALIDITY, new Integer (cainfo.getValidity()));
403 data.put(DESCRIPTION, cainfo.getDescription());
404 data.put(CRLPERIOD, new Integer (cainfo.getCRLPeriod()));
405 data.put(CRLISSUEINTERVAL, new Integer (cainfo.getCRLIssueInterval()));
406 data.put(CRLOVERLAPTIME, new Integer (cainfo.getCRLOverlapTime()));
407 data.put(CRLPUBLISHERS, cainfo.getCRLPublishers());
408 data.put(APPROVALSETTINGS,cainfo.getApprovalSettings());
409 data.put(NUMBEROFREQAPPROVALS,new Integer (cainfo.getNumOfReqApprovals()));
410 CAToken token = getCAToken();
411 if (token != null) {
412 token.updateCATokenInfo(cainfo.getCATokenInfo());
413 setCAToken(token);
414 }
415 setFinishUser(cainfo.getFinishUser());
416
417 Iterator iter = cainfo.getExtendedCAServiceInfos().iterator();
418 while(iter.hasNext()){
419 ExtendedCAServiceInfo info = (ExtendedCAServiceInfo) iter.next();
420 if(info instanceof OCSPCAServiceInfo){
421 this.getExtendedCAService(ExtendedCAServiceInfo.TYPE_OCSPEXTENDEDSERVICE).update(info, this);
422 }
423 if(info instanceof XKMSCAServiceInfo){
424 this.getExtendedCAService(ExtendedCAServiceInfo.TYPE_XKMSEXTENDEDSERVICE).update(info, this);
425 }
426 if(info instanceof CmsCAServiceInfo){
427 this.getExtendedCAService(ExtendedCAServiceInfo.TYPE_CMSEXTENDEDSERVICE).update(info, this);
428 }
429 }
430 this.cainfo = cainfo;
431 }
432
433
434 public Certificate generateCertificate(UserDataVO subject,
435 PublicKey publicKey,
436 int keyusage,
437 long validity,
438 CertificateProfile certProfile) throws Exception {
439 Date notAfter = null;
441 if(validity != -1) {
442 notAfter = new Date ();
443 notAfter.setTime(notAfter.getTime() + ( validity * 24 * 60 * 60 * 1000));
444 }
445 Date notBefore = new Date ();
446 return generateCertificate(subject, publicKey, keyusage, notBefore, notAfter, certProfile);
447 }
448
449 public abstract Certificate generateCertificate(UserDataVO subject,
450 PublicKey publicKey,
451 int keyusage,
452 Date notBefore,
453 Date notAfter,
454 CertificateProfile certProfile) throws Exception ;
455
456 public abstract CRL generateCRL(Vector certs, int crlnumber) throws Exception ;
457
458 public abstract byte[] createPKCS7(Certificate cert, boolean includeChain) throws SignRequestSignatureException;
459
460
461 public abstract byte[] encryptKeys(KeyPair keypair) throws Exception ;
462
463 public abstract KeyPair decryptKeys(byte[] data) throws Exception ;
464
465
466
472 public void initExternalService(int type, CA ca) throws Exception {
473 ExtendedCAService service = getExtendedCAService(type);
474 if (service != null) {
475 service.init(ca);
476 }
477 }
478
479
480
483
484 public ExtendedCAServiceInfo getExtendedCAServiceInfo(int type){
485 ExtendedCAServiceInfo ret = null;
486 ExtendedCAService service = getExtendedCAService(type);
487 if (service != null) {
488 ret = service.getExtendedCAServiceInfo();
489 }
490 return ret;
491 }
492
493
496 public ExtendedCAServiceResponse extendedService(ExtendedCAServiceRequest request)
497 throws ExtendedCAServiceRequestException, IllegalExtendedCAServiceRequestException, ExtendedCAServiceNotActiveException{
498 ExtendedCAServiceResponse returnval = null;
499 if(request instanceof OCSPCAServiceRequest) {
500 returnval = getExtendedCAService(ExtendedCAServiceInfo.TYPE_OCSPEXTENDEDSERVICE).extendedService(request);
501 }
502 if(request instanceof XKMSCAServiceRequest) {
503 returnval = getExtendedCAService(ExtendedCAServiceInfo.TYPE_XKMSEXTENDEDSERVICE).extendedService(request);
504 }
505 if(request instanceof CmsCAServiceRequest) {
506 returnval = getExtendedCAService(ExtendedCAServiceInfo.TYPE_CMSEXTENDEDSERVICE).extendedService(request);
507 }
508
509 if(request instanceof KeyRecoveryCAServiceRequest){
510 KeyRecoveryCAServiceRequest keyrecoveryrequest = (KeyRecoveryCAServiceRequest) request;
511 if(keyrecoveryrequest.getCommand() == KeyRecoveryCAServiceRequest.COMMAND_ENCRYPTKEYS){
512 try{
513 returnval = new KeyRecoveryCAServiceResponse(KeyRecoveryCAServiceResponse.TYPE_ENCRYPTKEYSRESPONSE,
514 encryptKeys(keyrecoveryrequest.getKeyPair()));
515 }catch(CMSException e){
516 log.error("encrypt:", e.getUnderlyingException());
517 throw new IllegalExtendedCAServiceRequestException(e);
518 }catch(Exception e){
519 throw new IllegalExtendedCAServiceRequestException(e);
520 }
521 }else{
522 if(keyrecoveryrequest.getCommand() == KeyRecoveryCAServiceRequest.COMMAND_DECRYPTKEYS){
523 try{
524 returnval = new KeyRecoveryCAServiceResponse(KeyRecoveryCAServiceResponse.TYPE_DECRYPTKEYSRESPONSE,
525 this.decryptKeys(keyrecoveryrequest.getKeyData()));
526 }catch(CMSException e){
527 log.error("decrypt:", e.getUnderlyingException());
528 throw new IllegalExtendedCAServiceRequestException(e);
529 }catch(Exception e){
530 throw new IllegalExtendedCAServiceRequestException(e);
531 }
532 }else{
533 throw new IllegalExtendedCAServiceRequestException("Illegal Command");
534 }
535 }
536 }
537
538 return returnval;
539 }
540
541 protected ExtendedCAService getExtendedCAService(int type){
542 ExtendedCAService returnval = null;
543 try{
544 returnval = (ExtendedCAService) extendedcaservicemap.get(new Integer (type));
545 if(returnval == null) {
546 switch(((Integer ) ((HashMap )data.get(EXTENDEDCASERVICE+type)).get(ExtendedCAService.EXTENDEDCASERVICETYPE)).intValue()) {
547 case ExtendedCAServiceInfo.TYPE_OCSPEXTENDEDSERVICE:
548 returnval = new OCSPCAService((HashMap )data.get(EXTENDEDCASERVICE+type));
549 break;
550 case ExtendedCAServiceInfo.TYPE_XKMSEXTENDEDSERVICE:
551 returnval = new XKMSCAService((HashMap )data.get(EXTENDEDCASERVICE+type));
552 break;
553 case ExtendedCAServiceInfo.TYPE_CMSEXTENDEDSERVICE:
554 returnval = new CmsCAService((HashMap )data.get(EXTENDEDCASERVICE+type));
555 break;
556 }
557 extendedcaservicemap.put(new Integer (type), returnval);
558 }
559 }catch(Exception e){
560 throw new EJBException (e);
561 }
562
563 return returnval;
564 }
565
566 protected void setExtendedCAService(ExtendedCAService extendedcaservice) {
567 if(extendedcaservice instanceof OCSPCAService){
568 data.put(EXTENDEDCASERVICE+ExtendedCAServiceInfo.TYPE_OCSPEXTENDEDSERVICE, extendedcaservice.saveData());
569 extendedcaservicemap.put(new Integer (ExtendedCAServiceInfo.TYPE_OCSPEXTENDEDSERVICE), extendedcaservice);
570 }
571 if(extendedcaservice instanceof XKMSCAService){
572 data.put(EXTENDEDCASERVICE+ExtendedCAServiceInfo.TYPE_XKMSEXTENDEDSERVICE, extendedcaservice.saveData());
573 extendedcaservicemap.put(new Integer (ExtendedCAServiceInfo.TYPE_XKMSEXTENDEDSERVICE), extendedcaservice);
574 }
575 if(extendedcaservice instanceof CmsCAService){
576 data.put(EXTENDEDCASERVICE+ExtendedCAServiceInfo.TYPE_CMSEXTENDEDSERVICE, extendedcaservice.saveData());
577 extendedcaservicemap.put(new Integer (ExtendedCAServiceInfo.TYPE_CMSEXTENDEDSERVICE), extendedcaservice);
578 }
579 }
580
584
585 public Collection getExternalCAServiceTypes(){
586 if(data.get(EXTENDEDCASERVICES) == null)
587 return new ArrayList ();
588
589 return (Collection ) data.get(EXTENDEDCASERVICES);
590 }
591
592 private HashMap extendedcaservicemap = new HashMap ();
593
594 private ArrayList certificatechain = null;
595 private ArrayList requestcertchain = null;
596
597 private CAInfo cainfo = null;
598
599
605 public abstract boolean upgradeExtendedCAServices() ;
606 } |
Popular Tags |
Java API By Example, From Geeks To Geeks.