sun.security.x509.DNSName Java Examples

@Test(dataProvider = "goodNames")
public void testGoodDNSName(String dnsNameString) {
    try {
        DNSName dn = new DNSName(dnsNameString);
    } catch (IOException e) {
        fail("Unexpected IOException");
    }
}
 

@Test(dataProvider = "badNames")
public void testBadDNSName(String dnsNameString) {
    try {
        DNSName dn = new DNSName(dnsNameString);
        fail("IOException expected");
    } catch (IOException e) {
        if (!e.getMessage().contains("DNSName"))
            fail("Unexpeceted message: " + e);
    }
}
 

@Test(dataProvider = "goodNames")
public void testGoodDNSName(String dnsNameString) {
    try {
        DNSName dn = new DNSName(dnsNameString);
    } catch (IOException e) {
        fail("Unexpected IOException");
    }
}
 

private void testSubjectAltName() throws IOException {
    System.out.println("X.509 Certificate Match on subjectAltName");
    // bad match
    X509CertSelector selector = new X509CertSelector();
    GeneralNameInterface dnsName = new DNSName("foo.com");
    DerOutputStream tmp = new DerOutputStream();
    dnsName.encode(tmp);
    selector.addSubjectAlternativeName(2, tmp.toByteArray());
    checkMatch(selector, cert, false);

    // good match
    DerInputStream in = new DerInputStream(cert.getExtensionValue("2.5.29.17"));
    byte[] encoded = in.getOctetString();
    SubjectAlternativeNameExtension ext = new SubjectAlternativeNameExtension(false, encoded);
    GeneralNames names = (GeneralNames) ext.get(SubjectAlternativeNameExtension.SUBJECT_NAME);
    GeneralName name = (GeneralName) names.get(0);
    selector.setSubjectAlternativeNames(null);
    DerOutputStream tmp2 = new DerOutputStream();
    name.getName().encode(tmp2);
    selector.addSubjectAlternativeName(name.getType(), tmp2.toByteArray());
    checkMatch(selector, cert, true);

    // good match 2 (matches at least one)
    selector.setMatchAllSubjectAltNames(false);
    selector.addSubjectAlternativeName(2, "foo.com");
    checkMatch(selector, cert, true);
}
 

private void testSubjectAltName() throws IOException {
    System.out.println("X.509 Certificate Match on subjectAltName");
    // bad match
    X509CertSelector selector = new X509CertSelector();
    GeneralNameInterface dnsName = new DNSName("foo.com");
    DerOutputStream tmp = new DerOutputStream();
    dnsName.encode(tmp);
    selector.addSubjectAlternativeName(2, tmp.toByteArray());
    checkMatch(selector, cert, false);

    // good match
    DerInputStream in = new DerInputStream(cert.getExtensionValue("2.5.29.17"));
    byte[] encoded = in.getOctetString();
    SubjectAlternativeNameExtension ext = new SubjectAlternativeNameExtension(false, encoded);
    GeneralNames names = (GeneralNames) ext.get(SubjectAlternativeNameExtension.SUBJECT_NAME);
    GeneralName name = (GeneralName) names.get(0);
    selector.setSubjectAlternativeNames(null);
    DerOutputStream tmp2 = new DerOutputStream();
    name.getName().encode(tmp2);
    selector.addSubjectAlternativeName(name.getType(), tmp2.toByteArray());
    checkMatch(selector, cert, true);

    // good match 2 (matches at least one)
    selector.setMatchAllSubjectAltNames(false);
    selector.addSubjectAlternativeName(2, "foo.com");
    checkMatch(selector, cert, true);
}
 

/**
 * Helper method to add DNSName types for the SAN extension
 *
 * @param dnsNames A {@code List} of names to add as DNSName types
 *
 * @throws IOException if an encoding error occurs.
 */
public void addSubjectAltNameDNSExt(List<String> dnsNames) throws IOException {
    if (!dnsNames.isEmpty()) {
        GeneralNames gNames = new GeneralNames();
        for (String name : dnsNames) {
            gNames.add(new GeneralName(new DNSName(name)));
        }
        addExtension(new SubjectAlternativeNameExtension(false,
                gNames));
    }
}
 

private void testSubjectAltName() throws IOException {
    System.out.println("X.509 Certificate Match on subjectAltName");
    // bad match
    X509CertSelector selector = new X509CertSelector();
    GeneralNameInterface dnsName = new DNSName("foo.com");
    DerOutputStream tmp = new DerOutputStream();
    dnsName.encode(tmp);
    selector.addSubjectAlternativeName(2, tmp.toByteArray());
    checkMatch(selector, cert, false);

    // good match
    DerInputStream in = new DerInputStream(cert.getExtensionValue("2.5.29.17"));
    byte[] encoded = in.getOctetString();
    SubjectAlternativeNameExtension ext = new SubjectAlternativeNameExtension(false, encoded);
    GeneralNames names = (GeneralNames) ext.get(SubjectAlternativeNameExtension.SUBJECT_NAME);
    GeneralName name = (GeneralName) names.get(0);
    selector.setSubjectAlternativeNames(null);
    DerOutputStream tmp2 = new DerOutputStream();
    name.getName().encode(tmp2);
    selector.addSubjectAlternativeName(name.getType(), tmp2.toByteArray());
    checkMatch(selector, cert, true);

    // good match 2 (matches at least one)
    selector.setMatchAllSubjectAltNames(false);
    selector.addSubjectAlternativeName(2, "foo.com");
    checkMatch(selector, cert, true);
}
 

private void testSubjectAltName() throws IOException {
    System.out.println("X.509 Certificate Match on subjectAltName");
    // bad match
    X509CertSelector selector = new X509CertSelector();
    GeneralNameInterface dnsName = new DNSName("foo.com");
    DerOutputStream tmp = new DerOutputStream();
    dnsName.encode(tmp);
    selector.addSubjectAlternativeName(2, tmp.toByteArray());
    checkMatch(selector, cert, false);

    // good match
    DerInputStream in = new DerInputStream(cert.getExtensionValue("2.5.29.17"));
    byte[] encoded = in.getOctetString();
    SubjectAlternativeNameExtension ext = new SubjectAlternativeNameExtension(false, encoded);
    GeneralNames names = (GeneralNames) ext.get(SubjectAlternativeNameExtension.SUBJECT_NAME);
    GeneralName name = (GeneralName) names.get(0);
    selector.setSubjectAlternativeNames(null);
    DerOutputStream tmp2 = new DerOutputStream();
    name.getName().encode(tmp2);
    selector.addSubjectAlternativeName(name.getType(), tmp2.toByteArray());
    checkMatch(selector, cert, true);

    // good match 2 (matches at least one)
    selector.setMatchAllSubjectAltNames(false);
    selector.addSubjectAlternativeName(2, "foo.com");
    checkMatch(selector, cert, true);
}
 

@Test(dataProvider = "badNames")
public void testBadDNSName(String dnsNameString) {
    try {
        DNSName dn = new DNSName(dnsNameString);
        fail("IOException expected");
    } catch (IOException e) {
        if (!e.getMessage().contains("DNSName"))
            fail("Unexpeceted message: " + e);
    }
}
 

@Test(dataProvider = "goodNames")
public void testGoodDNSName(String dnsNameString) {
    try {
        DNSName dn = new DNSName(dnsNameString);
    } catch (IOException e) {
        fail("Unexpected IOException");
    }
}
 

private void testSubjectAltName() throws IOException {
    System.out.println("X.509 Certificate Match on subjectAltName");
    // bad match
    X509CertSelector selector = new X509CertSelector();
    GeneralNameInterface dnsName = new DNSName("foo.com");
    DerOutputStream tmp = new DerOutputStream();
    dnsName.encode(tmp);
    selector.addSubjectAlternativeName(2, tmp.toByteArray());
    checkMatch(selector, cert, false);

    // good match
    DerInputStream in = new DerInputStream(cert.getExtensionValue("2.5.29.17"));
    byte[] encoded = in.getOctetString();
    SubjectAlternativeNameExtension ext = new SubjectAlternativeNameExtension(false, encoded);
    GeneralNames names = (GeneralNames) ext.get(SubjectAlternativeNameExtension.SUBJECT_NAME);
    GeneralName name = (GeneralName) names.get(0);
    selector.setSubjectAlternativeNames(null);
    DerOutputStream tmp2 = new DerOutputStream();
    name.getName().encode(tmp2);
    selector.addSubjectAlternativeName(name.getType(), tmp2.toByteArray());
    checkMatch(selector, cert, true);

    // good match 2 (matches at least one)
    selector.setMatchAllSubjectAltNames(false);
    selector.addSubjectAlternativeName(2, "foo.com");
    checkMatch(selector, cert, true);
}
 

@Test(dataProvider = "badNames")
public void testBadDNSName(String dnsNameString) {
    try {
        DNSName dn = new DNSName(dnsNameString);
        fail("IOException expected");
    } catch (IOException e) {
        if (!e.getMessage().contains("DNSName"))
            fail("Unexpeceted message: " + e);
    }
}
 

@Test(dataProvider = "goodNames")
public void testGoodDNSName(String dnsNameString) {
    try {
        DNSName dn = new DNSName(dnsNameString);
    } catch (IOException e) {
        fail("Unexpected IOException");
    }
}
 

private void testSubjectAltName() throws IOException {
    System.out.println("X.509 Certificate Match on subjectAltName");
    // bad match
    X509CertSelector selector = new X509CertSelector();
    GeneralNameInterface dnsName = new DNSName("foo.com");
    DerOutputStream tmp = new DerOutputStream();
    dnsName.encode(tmp);
    selector.addSubjectAlternativeName(2, tmp.toByteArray());
    checkMatch(selector, cert, false);

    // good match
    DerInputStream in = new DerInputStream(cert.getExtensionValue("2.5.29.17"));
    byte[] encoded = in.getOctetString();
    SubjectAlternativeNameExtension ext = new SubjectAlternativeNameExtension(false, encoded);
    GeneralNames names = (GeneralNames) ext.get(SubjectAlternativeNameExtension.SUBJECT_NAME);
    GeneralName name = (GeneralName) names.get(0);
    selector.setSubjectAlternativeNames(null);
    DerOutputStream tmp2 = new DerOutputStream();
    name.getName().encode(tmp2);
    selector.addSubjectAlternativeName(name.getType(), tmp2.toByteArray());
    checkMatch(selector, cert, true);

    // good match 2 (matches at least one)
    selector.setMatchAllSubjectAltNames(false);
    selector.addSubjectAlternativeName(2, "foo.com");
    checkMatch(selector, cert, true);
}
 

@Test(dataProvider = "badNames")
public void testBadDNSName(String dnsNameString) {
    try {
        DNSName dn = new DNSName(dnsNameString);
        fail("IOException expected");
    } catch (IOException e) {
        if (!e.getMessage().contains("DNSName"))
            fail("Unexpeceted message: " + e);
    }
}
 

private void testSubjectAltName() throws IOException {
    System.out.println("X.509 Certificate Match on subjectAltName");
    // bad match
    X509CertSelector selector = new X509CertSelector();
    GeneralNameInterface dnsName = new DNSName("foo.com");
    DerOutputStream tmp = new DerOutputStream();
    dnsName.encode(tmp);
    selector.addSubjectAlternativeName(2, tmp.toByteArray());
    checkMatch(selector, cert, false);

    // good match
    DerInputStream in = new DerInputStream(cert.getExtensionValue("2.5.29.17"));
    byte[] encoded = in.getOctetString();
    SubjectAlternativeNameExtension ext = new SubjectAlternativeNameExtension(false, encoded);
    GeneralNames names = (GeneralNames) ext.get(SubjectAlternativeNameExtension.SUBJECT_NAME);
    GeneralName name = (GeneralName) names.get(0);
    selector.setSubjectAlternativeNames(null);
    DerOutputStream tmp2 = new DerOutputStream();
    name.getName().encode(tmp2);
    selector.addSubjectAlternativeName(name.getType(), tmp2.toByteArray());
    checkMatch(selector, cert, true);

    // good match 2 (matches at least one)
    selector.setMatchAllSubjectAltNames(false);
    selector.addSubjectAlternativeName(2, "foo.com");
    checkMatch(selector, cert, true);
}
 

public static X509CertInfo createCertificateInfo(final String subjectDn, final String altNameIp,
		final String altNameHost, final PublicKey subjectPublicKey, final long validForDays, final boolean makeCa,
		final String issuerDn, final String certificateSigningAlgorithm) {

	try {

		// Look up algorithm based on CA private key
		final AlgorithmId algorithmId = AlgorithmId.get(certificateSigningAlgorithm);

		// Define validity period
		final Date notBefore = new Date(new Date().getTime() - 300); // 5 minutes prior to avoid clock skew issues
		final Date notAfter = new Date(notBefore.getTime() + (validForDays * 24 * 3600 * 1000));
		final CertificateValidity validity = new CertificateValidity(notBefore, notAfter);

		// Random serial number
		final BigInteger serialNumber = RandomNumberGenerator.generateRandomInteger(128);

		// Define information within certificate
		final X509CertInfo certificateInfo = new X509CertInfo();
		certificateInfo.set(X509CertInfo.VERSION, new CertificateVersion(CertificateVersion.V3));
		certificateInfo.set(X509CertInfo.VALIDITY, validity);
		certificateInfo.set(X509CertInfo.SERIAL_NUMBER, new CertificateSerialNumber(serialNumber));
		certificateInfo.set(X509CertInfo.SUBJECT, new X500Name(subjectDn));
		certificateInfo.set(X509CertInfo.ISSUER, new X500Name(issuerDn));
		certificateInfo.set(X509CertInfo.KEY, new CertificateX509Key(subjectPublicKey));
		certificateInfo.set(X509CertInfo.ALGORITHM_ID, new CertificateAlgorithmId(algorithmId));

		// Process extensions
		final CertificateExtensions extensions = new CertificateExtensions();

		// Make the issued certificate a sub-CA of this one (or self-signed)
		final BasicConstraintsExtension bce = new BasicConstraintsExtension(makeCa, 0);
		extensions.set(BasicConstraintsExtension.NAME,
				new BasicConstraintsExtension(true, bce.getExtensionValue()));

		// Add a subject alternative name (if not null)
		if (altNameIp != null) {
			final GeneralNames generalNames = new GeneralNames();
			generalNames.add(new GeneralName(new IPAddressName(altNameIp)));
			generalNames.add(new GeneralName(new DNSName(altNameHost)));
			final SubjectAlternativeNameExtension san = new SubjectAlternativeNameExtension(false, generalNames);
			extensions.set(SubjectAlternativeNameExtension.NAME, san);
		}

		certificateInfo.set(X509CertInfo.EXTENSIONS, extensions);

		return certificateInfo;

	} catch (GeneralSecurityException | IOException e) {
		throw new RuntimeException(e);
	}
}
 

protected static X509CertInfo createCertificateInfo(final String subjectDn, final String altNameIp,
		final String altNameHost, final PublicKey subjectPublicKey, final long validForDays, final boolean makeCa,
		final String issuerDn) {

	try {

		// Look up algorithm based on CA private key
		final AlgorithmId algorithmId = AlgorithmId.get(CERTIFICATE_SIGNING_ALGORITHM);

		// Define validity period
		final Date notBefore = new Date(new Date().getTime() - 300); // 5 minutes prior to avoid clock skew issues
		final Date notAfter = new Date(notBefore.getTime() + (validForDays * 24 * 3600 * 1000));
		final CertificateValidity validity = new CertificateValidity(notBefore, notAfter);

		// Random serial number
		final BigInteger serialNumber = RandomNumberGenerator.generateRandomInteger(128);

		// Define information within certificate
		final X509CertInfo certificateInfo = new X509CertInfo();
		certificateInfo.set(X509CertInfo.VERSION, new CertificateVersion(CertificateVersion.V3));
		certificateInfo.set(X509CertInfo.VALIDITY, validity);
		certificateInfo.set(X509CertInfo.SERIAL_NUMBER, new CertificateSerialNumber(serialNumber));
		certificateInfo.set(X509CertInfo.SUBJECT, new X500Name(subjectDn));
		certificateInfo.set(X509CertInfo.ISSUER, new X500Name(issuerDn));
		certificateInfo.set(X509CertInfo.KEY, new CertificateX509Key(subjectPublicKey));
		certificateInfo.set(X509CertInfo.ALGORITHM_ID, new CertificateAlgorithmId(algorithmId));

		// Process extensions
		final CertificateExtensions extensions = new CertificateExtensions();

		// Make the issued certificate a sub-CA of this one (or self-signed)
		final BasicConstraintsExtension bce = new BasicConstraintsExtension(makeCa, 0);
		extensions.set(BasicConstraintsExtension.NAME,
				new BasicConstraintsExtension(true, bce.getExtensionValue()));

		// Add a subject alternative name (if not null)
		if (altNameIp != null) {
			final GeneralNames generalNames = new GeneralNames();
			generalNames.add(new GeneralName(new IPAddressName(altNameIp)));
			generalNames.add(new GeneralName(new DNSName(altNameHost)));
			final SubjectAlternativeNameExtension san = new SubjectAlternativeNameExtension(false, generalNames);
			extensions.set(SubjectAlternativeNameExtension.NAME, san);
		}

		certificateInfo.set(X509CertInfo.EXTENSIONS, extensions);

		return certificateInfo;

	} catch (GeneralSecurityException | IOException e) {
		throw new RuntimeException(e);
	}
}
 

private X509Certificate generateSelfSignedCertificate(KeyPair keyPair) throws CertificateException, IOException, NoSuchProviderException, NoSuchAlgorithmException, InvalidKeyException, SignatureException {
    X509CertInfo certInfo = new X509CertInfo();
    // Serial number and version
    certInfo.set(X509CertInfo.SERIAL_NUMBER, new CertificateSerialNumber(new BigInteger(64, new SecureRandom())));
    certInfo.set(X509CertInfo.VERSION, new CertificateVersion(CertificateVersion.V3));

    // Subject & Issuer
    X500Name owner = new X500Name(DN_NAME);
    certInfo.set(X509CertInfo.SUBJECT, owner);
    certInfo.set(X509CertInfo.ISSUER, owner);

    // Key and algorithm
    certInfo.set(X509CertInfo.KEY, new CertificateX509Key(keyPair.getPublic()));
    AlgorithmId algorithm = new AlgorithmId(AlgorithmId.sha1WithRSAEncryption_oid);
    certInfo.set(X509CertInfo.ALGORITHM_ID, new CertificateAlgorithmId(algorithm));

    // Validity
    Date validFrom = new Date();
    Date validTo = new Date(validFrom.getTime() + 50L * 365L * 24L * 60L * 60L * 1000L); //50 years
    CertificateValidity validity = new CertificateValidity(validFrom, validTo);
    certInfo.set(X509CertInfo.VALIDITY, validity);
    
    GeneralNameInterface dnsName = new DNSName("baeldung.com");
    DerOutputStream dnsNameOutputStream = new DerOutputStream();
    dnsName.encode(dnsNameOutputStream);
    
    GeneralNameInterface ipAddress = new IPAddressName("127.0.0.1");
    DerOutputStream ipAddressOutputStream = new DerOutputStream();
    ipAddress.encode(ipAddressOutputStream);
    
    GeneralNames generalNames = new GeneralNames();
    generalNames.add(new GeneralName(dnsName));
    generalNames.add(new GeneralName(ipAddress));
    
    CertificateExtensions ext = new CertificateExtensions();
    ext.set(SubjectAlternativeNameExtension.NAME, new SubjectAlternativeNameExtension(generalNames));

    certInfo.set(X509CertInfo.EXTENSIONS, ext);        

    // Create certificate and sign it
    X509CertImpl cert = new X509CertImpl(certInfo);
    cert.sign(keyPair.getPrivate(), SHA1WITHRSA);

    // Since the SHA1withRSA provider may have a different algorithm ID to what we think it should be,
    // we need to reset the algorithm ID, and resign the certificate
    AlgorithmId actualAlgorithm = (AlgorithmId) cert.get(X509CertImpl.SIG_ALG);
    certInfo.set(CertificateAlgorithmId.NAME + "." + CertificateAlgorithmId.ALGORITHM, actualAlgorithm);
    X509CertImpl newCert = new X509CertImpl(certInfo);
    newCert.sign(keyPair.getPrivate(), SHA1WITHRSA);

    return newCert;
}