com.goldencode.p2j.security

Class SSLCertFactory

java.lang.Object

com.goldencode.p2j.security.SSLCertFactory

Direct Known Subclasses:

BCCertFactory

public abstract class SSLCertFactory
extends java.lang.Object

Define APIs to generate SSL certificates and their private keys.

Before starting to generate certificates, a root CA needs to be generated. This will be used for signing all the issued certificates.

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	SSLCertFactory.CertificateSuite Holds public and private certificates with trusted certificate chain up to a well-known CA.

Field Summary

Fields

Modifier and Type	Field and Description
protected java.math.BigInteger	exponent The public key exponent.
protected int	keyStrength The private key size: MIN_RSA_KEY_STRENGTH bits or better.
static int	MIN_RSA_KEY_STRENGTH The minimum length (in bits) of a RSA key.

Constructor Summary

Constructors

Constructor and Description
SSLCertFactory()

Method Summary

Modifier and Type	Method and Description
abstract java.security.PrivateKey	decryptPrivateKey(byte[] encrypted, java.lang.String password) Decrypt a private key which was previously encrypted with the given password.
abstract byte[]	encryptPrivateKey(java.security.Key key, java.lang.String password) Encrypt the given key using the provided password.
abstract java.lang.String	generateCertificate(java.lang.String alias, int validity, java.lang.String commonName, java.util.Map<java.lang.String,java.lang.String> fieldMap, java.security.KeyStore certStore, java.security.KeyStore certKeyStore) Generate a certificate and sign it with the already generated root CA.
abstract java.lang.String	generateRootCA(java.lang.String alias, int validity, java.lang.String commonName, java.util.Map<java.lang.String,java.lang.String> fieldMap, java.security.KeyStore certStore, java.security.KeyStore certKeyStore) Generate a root CA certificate, which will be used to sign all the issues certificates.
abstract java.lang.String	generateSelfSignedCertificate(java.lang.String alias, boolean certificateAuthority, int validity, java.lang.String commonName, java.util.Map<java.lang.String,java.lang.String> fieldMap, java.security.KeyStore certStore, java.security.KeyStore certKeyStore) Generate a self-signed certificate.
abstract java.security.cert.Certificate[]	getFullChainFromRoot() Build a full chain from the root certificate up to the well-known authority.
abstract java.util.Map<java.lang.String,java.lang.String>	getMandatorySubjectFields() Get the map with the mandatory subject attributes.
void	init(java.lang.Integer keyStrength, java.math.BigInteger exponent) Initialize this SSL certificate factory.
abstract SSLCertFactory.CertificateSuite	loadCertificateSuite(java.lang.String certPemFile, java.lang.String privateKeyPemFile, java.lang.String certChainPemFile) Loads externally generated certificate suite of public and private certificates with trusted certificate chain if this PEM file is provided.
abstract java.lang.String	saveRootCA(java.lang.String alias, java.security.KeyStore certStore, java.security.KeyStore certKeyStore) Save the root CA into the provided certificate and private key stores to be accessed by the given alias.
abstract void	setCertificateChain(java.security.cert.Certificate[] chain) Sets the trusted certificate chain.
abstract void	setRootCA(java.security.cert.X509Certificate cert, java.security.PrivateKey pk) Set the details for the root CA certificate.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

MIN_RSA_KEY_STRENGTH

public static final int MIN_RSA_KEY_STRENGTH

The minimum length (in bits) of a RSA key.

See Also:

Constant Field Values

exponent

protected java.math.BigInteger exponent

The public key exponent.

keyStrength

protected int keyStrength

The private key size: MIN_RSA_KEY_STRENGTH bits or better.

Constructor Detail

SSLCertFactory

public SSLCertFactory()

Method Detail

decryptPrivateKey

public abstract java.security.PrivateKey decryptPrivateKey(byte[] encrypted,
                                                           java.lang.String password)
                                                    throws SSLCertGenException

Decrypt a private key which was previously encrypted with the given password.

Parameters:

encrypted - The bytes representing the encrypted private key.

password - The encryption password.

Returns:

The decrypted private key.

Throws:

SSLCertGenException - If the private key could not be decrypted.

encryptPrivateKey

public abstract byte[] encryptPrivateKey(java.security.Key key,
                                         java.lang.String password)
                                  throws SSLCertGenException

Encrypt the given key using the provided password.

Parameters:

key - The key to be encrypted.

password - The encryption password.

Returns:

A byte array with the encrypted key.

Throws:

SSLCertGenException - If the key could not be encrypted.

generateCertificate

public abstract java.lang.String generateCertificate(java.lang.String alias,
                                                     int validity,
                                                     java.lang.String commonName,
                                                     java.util.Map<java.lang.String,java.lang.String> fieldMap,
                                                     java.security.KeyStore certStore,
                                                     java.security.KeyStore certKeyStore)
                                              throws SSLCertGenException

Generate a certificate and sign it with the already generated root CA.

The encrypted private key will be saved in the specified certKeyStore; the encrypt password will be returned by this API.

The public certificate will be saved in the specified certStore.

Parameters:

alias - The certificate alias, used to store the private key and certificate.

validity - The certificate validity, in years.

commonName - The certificate's common name (CN).

fieldMap - A map with additional subject attributes.

certStore - The store where to save the certificate.

certKeyStore - The store where to save the private key.

Returns:

The password used to encrypt the private key in the store.

Throws:

SSLCertGenException - If the root CA is not yet generated or the certificate could not be generated.

setRootCA

public abstract void setRootCA(java.security.cert.X509Certificate cert,
                               java.security.PrivateKey pk)
                        throws SSLCertGenException

Set the details for the root CA certificate.

Parameters:

cert - The certificate.

pk - The private key.

Throws:

SSLCertGenException

generateRootCA

public abstract java.lang.String generateRootCA(java.lang.String alias,
                                                int validity,
                                                java.lang.String commonName,
                                                java.util.Map<java.lang.String,java.lang.String> fieldMap,
                                                java.security.KeyStore certStore,
                                                java.security.KeyStore certKeyStore)
                                         throws SSLCertGenException

Generate a root CA certificate, which will be used to sign all the issues certificates.

The encrypted private key will be saved in the specified certKeyStore; the encrypt password will be returned by this API.

The public root CA certificate will be saved in the specified certStore.

Parameters:

alias - The certificate alias, used to store the private key and certificate.

validity - The certificate validity, in years.

commonName - The certificate's common name (CN).

fieldMap - A map with additional subject attributes.

certStore - The store where to save the certificate.

certKeyStore - The store where to save the private key.

Returns:

The password used to encrypt the private key in the store.

Throws:

SSLCertGenException - If the root CA is not yet generated or the certificate could not be generated.

generateSelfSignedCertificate

public abstract java.lang.String generateSelfSignedCertificate(java.lang.String alias,
                                                               boolean certificateAuthority,
                                                               int validity,
                                                               java.lang.String commonName,
                                                               java.util.Map<java.lang.String,java.lang.String> fieldMap,
                                                               java.security.KeyStore certStore,
                                                               java.security.KeyStore certKeyStore)
                                                        throws SSLCertGenException

Generate a self-signed certificate. This may be used as a root CA.

The encrypted private key will be saved in the specified certKeyStore; the encrypt password will be returned by this API.

The public certificate will be saved in the specified certStore.

Parameters:

alias - The certificate alias, used to store the private key and certificate.

certificateAuthority - Flag indicating if the generated self-signed certificate will be used as the root CA.

validity - The certificate validity, in years.

commonName - The certificate's common name (CN).

fieldMap - A map with additional subject attributes.

certStore - The store where to save the certificate.

certKeyStore - The store where to save the private key.

Returns:

The password used to encrypt the private key in the store.

Throws:

SSLCertGenException - If the root CA is not yet generated or the certificate could not be generated.

loadCertificateSuite

public abstract SSLCertFactory.CertificateSuite loadCertificateSuite(java.lang.String certPemFile,
                                                                     java.lang.String privateKeyPemFile,
                                                                     java.lang.String certChainPemFile)
                                                              throws SSLCertGenException

Loads externally generated certificate suite of public and private certificates with trusted certificate chain if this PEM file is provided.

Parameters:

certPemFile - The PEM file that contains the public certificate signed by well-known authorities or self-signed.

privateKeyPemFile - The PEM file that contains the private certificate signed by well-known authorities or self-signed.

certChainPemFile - The PEM file that contains the intermediate certificates up to the well-known authority CA certificate.

Returns:

The certificate suite

Throws:

SSLCertGenException - If IO or parse exceptions are thrown

saveRootCA

public abstract java.lang.String saveRootCA(java.lang.String alias,
                                            java.security.KeyStore certStore,
                                            java.security.KeyStore certKeyStore)
                                     throws SSLCertGenException

Save the root CA into the provided certificate and private key stores to be accessed by the given alias.

Parameters:

alias - The certificate alias

certStore - The certificate store

certKeyStore - The certificate private key store

Returns:

The protected private key password.

Throws:

SSLCertGenException

getMandatorySubjectFields

public abstract java.util.Map<java.lang.String,java.lang.String> getMandatorySubjectFields()

Get the map with the mandatory subject attributes. The key is the string representation of this attribute, while the value will be the associated description.

Returns:

See above.

init

public void init(java.lang.Integer keyStrength,
                 java.math.BigInteger exponent)
          throws SSLCertGenException

Initialize this SSL certificate factory.

Parameters:

keyStrength - The private key size: MIN_RSA_KEY_STRENGTH bits or better. If null, defaults to MIN_RSA_KEY_STRENGTH.

exponent - The public key exponent. If null, defaults to 65537. WARNING: a wrong value may result in vulnerable SSL private keys and also 3rd party software might not accept them. Use with care.

Throws:

SSLCertGenException - If the factory could not be instantiated.

getFullChainFromRoot

public abstract java.security.cert.Certificate[] getFullChainFromRoot()

Build a full chain from the root certificate up to the well-known authority.

Returns:

Certificate chain

setCertificateChain

public abstract void setCertificateChain(java.security.cert.Certificate[] chain)

Sets the trusted certificate chain.

Parameters:

chain - The root certificate chain up to the well-known authority