# ExportCert.java

    /*
    ** Module   : ExportCert.java
    ** Abstract : export a certificate and its private key into a JKS store.
    **
    ** Copyright (c) 2021, Golden Code Development Corporation.
    **
    ** -#- -I- --Date-- ---------------------------------------Description----------------------------------------
    ** 001 CA  20211012 Created the initial version.
    */

    /*
    ** This program is free software: you can redistribute it and/or modify
    ** it under the terms of the GNU Affero General Public License as
    ** published by the Free Software Foundation, either version 3 of the
    ** License, or (at your option) any later version.
    **
    ** This program is distributed in the hope that it will be useful,
    ** but WITHOUT ANY WARRANTY; without even the implied warranty of
    ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    ** GNU Affero General Public License for more details.
    **
    ** You may find a copy of the GNU Affero GPL version 3 at the following
    ** location: https://www.gnu.org/licenses/agpl-3.0.en.html
    **
    ** Additional terms under GNU Affero GPL version 3 section 7:
    **
    **   Under Section 7 of the GNU Affero GPL version 3, the following additional
    **   terms apply to the works covered under the License.  These additional terms
    **   are non-permissive additional terms allowed under Section 7 of the GNU
    **   Affero GPL version 3 and may not be removed by you.
    **
    **   0. Attribution Requirement.
    **
    **     You must preserve all legal notices or author attributions in the covered
    **     work or Appropriate Legal Notices displayed by works containing the covered
    **     work.  You may not remove from the covered work any author or developer
    **     credit already included within the covered work.
    **
    **   1. No License To Use Trademarks.
    **
    **     This license does not grant any license or rights to use the trademarks
    **     Golden Code, FWD, any Golden Code or FWD logo, or any other trademarks
    **     of Golden Code Development Corporation. You are not authorized to use the
    **     name Golden Code, FWD, or the names of any author or contributor, for
    **     publicity purposes without written authorization.
    **
    **   2. No Misrepresentation of Affiliation.
    **
    **     You may not represent yourself as Golden Code Development Corporation or FWD.
    **
    **     You may not represent yourself for publicity purposes as associated with
    **     Golden Code Development Corporation, FWD, or any author or contributor to
    **     the covered work, without written authorization.
    **
    **   3. No Misrepresentation of Source or Origin.
    **
    **     You may not represent the covered work as solely your work.  All modified
    **     versions of the covered work must be marked in a reasonable way to make it
    **     clear that the modified work is not originating from Golden Code Development
    **     Corporation or FWD.  All modified versions must contain the notices of
    **     attribution required in this license.
    */

    package com.goldencode.p2j.util;

    import java.io.*;
    import java.security.*;
    import java.security.cert.*;

    import com.goldencode.p2j.cfg.*;
    import com.goldencode.p2j.directory.*;
    import com.goldencode.p2j.security.*;

    /**
     * Export the certificate and its private key from the directory.
     * <p>
     * This tool requires that the private key is saved in the directory, with its encryption password.
     * <p>
     * The store name will be <code>alias-private-key.store</code>, where <code>alias</code> is the certificate
     * alias to be exported.
     */
    public class ExportCert
    {
       /**
        * Export the certificate and its private key.
        *
        * @param    dir
        *           The instance of directory to read from.
        * @param    alias
        *           The certificate alias.
        * @param    storePassword
        *           The password to use for the created store.
        * @param    keyEntryPassword
        *           The password to use for the key-entry in the store.
        *
        * @throws   Exception
        *           In case of errors.
        */
       private static void exportCertificate(DirectoryService dir,
                                             String           alias,
                                             String           storePassword,
                                             String           keyEntryPassword)
       throws Exception
       {
          CertificateFactory cf = CertificateFactory.getInstance("X.509");
          SSLCertFactory factory = SSLCertGenUtil.getFactory();

          String filename = alias + "-private-key.store";

          String[] rootCAs = dir.enumerateNodes("/security/certificates/cas");
          X509Certificate[] chain = new X509Certificate[rootCAs.length + 1];

          // alias
          byte[] data = dir.getNodeByteArray("/security/certificates/peers/" + alias, "value");
          ByteArrayInputStream bis = new ByteArrayInputStream(data);
          chain[0] = (X509Certificate) cf.generateCertificate(bis);

          // root CA chain
          for (int i = 0; i < rootCAs.length; i++)
          {
             data = dir.getNodeByteArray("/security/certificates/cas/" + rootCAs[i], "value");
             bis = new ByteArrayInputStream(data);
             chain[i + 1] = (X509Certificate) cf.generateCertificate(bis);
          }

          String path = "/security/certificates/private-keys/";
          byte[] dataPK = dir.getNodeByteArray(path + alias + "/key-entry", "value");
          byte[] dataPW = dir.getNodeByteArray(path + alias + "/key-password", "value");
          PrivateKey privateKey = factory.decryptPrivateKey(dataPK, new String(dataPW));

          KeyStore ks = KeyStore.getInstance("JKS");
          ks.load(null, null);
          ks.setKeyEntry(alias, privateKey, keyEntryPassword.toCharArray(), chain);
          ks.store(new FileOutputStream(new File(filename)), storePassword.toCharArray());
       }

       /**
        * Command line driver.
        *
        * @param    args
        *           Application command line parameters.
        *
        * @throws   Exception
        *           In case of errors.
        */
       public static void main(String[] args)
       throws Exception
       {
          if (!(args.length == 5 || args.length == 3))
          {
             System.out.println("usage: java ExportCert [<config.xml> { <password> | - } ] " +
                                "alias store-password entry-password");
             return;
          }

          BootstrapConfig bc = null;
          char[] pass  = null;
          String conf  = null;
          int start = 0;

          if (args[0].endsWith(".xml"))
          {
             conf = args[0];
             start = 2;

             if (!args[1].equals("-"))
             {
                pass = args[1].toCharArray();
             }
          }
          else
          {
             conf = "standard_server.xml";
          }

          bc = new BootstrapConfig(conf, pass, null, null);
          System.out.println("Instantiating DirectoryService");
          DirectoryService dir = DirectoryService.createInstance(bc);
          System.out.println("DirectoryService is up");

          System.out.println("Binding to directory.");
          if (!dir.bind())
          {
             throw new RuntimeException("bind() failed");
          }

          System.out.println("Bound to directory.");

          String alias = args[start++];
          String storePassword = args[start++];
          String keyEntryPassword = args[start++];

          exportCertificate(dir, alias, storePassword, keyEntryPassword);

          System.out.println("Unbinding from directory...");
          if (!dir.unbind())
          {
             throw new RuntimeException("unbind() failed");
          }
          System.out.println("Unbound.");

          System.out.println("Done.");
       }
    }