Přeskočit na hlavní obsah

Jak na CRL a jejich URL

Občas se stane, že si při práci s X509 certifikáty nevystačíte jen s možnostmi, které nabízí balík java.security.cert a rádi byste vydolovali více informací. Já jsem například řešil požadavek na získání CRL (Certificate Revocation List) souboru pro zadaný certifikát. V takovýchto případech se hodí využít kryptografickou knihovnu Bouncy Castle a pomocí ní vypreparovat třeba i střeva z vašich certifikátů.

Jak tedy implementace vypadá? Nejdříve zjistíme, zda certifikát vůbec podporuje rozšíření CRLDistributionPoints a jesliže ano, máme vyhráno. Knihovna Bouncy Castle obsahuje už připravené třídy přímo pro toto rozšíření. Stačí se tedy ponořit do stromových struktur distribučních bodů a získat tak seznam URL, na kterých by měly být připraveny ke stažení CRL soubory. 

import java.io.IOException;
import java.security.KeyStore;
import java.security.cert.X509Certificate;
import java.util.HashSet;
import java.util.Set;

import org.bouncycastle.asn1.DERString;
import org.bouncycastle.asn1.x509.CRLDistPoint;
import org.bouncycastle.asn1.x509.DistributionPoint;
import org.bouncycastle.asn1.x509.DistributionPointName;
import org.bouncycastle.asn1.x509.GeneralName;
import org.bouncycastle.asn1.x509.GeneralNames;
import org.bouncycastle.asn1.x509.X509Extensions;
import org.bouncycastle.x509.extension.X509ExtensionUtil;

/**
 * Returns (initialized, but maybe empty) set of URLs of CRLs for given
 * certificate.
 * 
 * @param aCert
 *            X509 certificate.
 * @return
 */
public static Set<String> getCrlUrls(final X509Certificate aCert) {
 final Set<String> tmpResult = new HashSet<String>();
 //get CRLDistributionPoints extension from X509 certificate
 final byte[] crlDPExtension = aCert.getExtensionValue(X509Extensions.CRLDistributionPoints.getId());
 if (crlDPExtension != null) {
  CRLDistPoint crlDistPoints = null;
  try {
   //decode instance of CRLDistPoint
   crlDistPoints = CRLDistPoint.getInstance(X509ExtensionUtil.fromExtensionValue(crlDPExtension));
  } catch (IOException e) {
   e.printStackTrace();
  }
  if (crlDistPoints != null) {
   final DistributionPoint[] distPoints = crlDistPoints.getDistributionPoints();
   distPoint: for (DistributionPoint dp : distPoints) {
    final DistributionPointName dpName = dp.getDistributionPoint();
    final GeneralNames generalNames = (GeneralNames) dpName.getName();
    if (generalNames != null) {
     final GeneralName[] generalNameArr = generalNames.getNames();
     if (generalNameArr != null) {
      for (final GeneralName generalName : generalNameArr) {
       if (generalName.getTagNo() == GeneralName.uniformResourceIdentifier) {
        final DERString derString = (DERString) generalName.getName();
        final String uri = derString.getString();
        if (uri != null && uri.startsWith("http")) {
         // ||uri.startsWith("ftp")
         tmpResult.add(uri);
         continue distPoint;
        }
       }
      }
     }
    }
   }
  }
 } else {
  System.out.println("CRLDistributionPoints extension not supported by the certificate.");
 }
 return tmpResult;
}

Úžasná posloupnost zavíracích závorek, co říkáte? To jsou ty zmiňované stromové struktúry. :-)

A jak to vlastně použít? S rozumem, pánové, s rozumem. :-) Malý příklad, jak to může fungovat, je zde: 

/**
 * Sample usage of {@link #getCrlUrls(X509Certificate)}.
 * 
 * @param args
 */
public static void main(String[] args) {
 try {
  // this works only on Windows with 32-bit Sun Java 6
  final KeyStore ks = KeyStore.getInstance("WINDOWS-MY");
  if (ks != null) {
   ks.load(null, null);
   // suppose, we have at least one certificate in the keystore
   final X509Certificate certificate = (X509Certificate) ks.getCertificate(ks.aliases().nextElement());
   System.out.println("Certificate: " + certificate.getSubjectDN());
   final Set<String> crlUrlSet = getCrlUrls(certificate);
   System.out.println("Set of CRL URLs: " + crlUrlSet);
  }
 } catch (Exception e) {
  e.printStackTrace();
 }
}

Což může vypsat například toto: 

Certificate: SERIALNUMBER=PXXX, CN=Josef Cacek, OU=PZZZ, L=YYY, C=CZ
Set of CRL URLs: [http://postsignum.ttc.cz/crl/psqualifiedca2.crl, http://www.postsignum.cz/crl/psqualifiedca2.crl, http://www2.postsignum.cz/crl/psqualifiedca2.crl]

Štítky:

Komentáře

Okomentovat

Populární příspěvky z tohoto blogu

Three ways to redirect HTTP requests to HTTPs in WildFly and JBoss EAP

WildFly application server (and JBoss EAP) supports several simple ways how to redirect the communication from plain HTTP to TLS protected HTTPs. This article presents 3 ways. Two are on the application level and the last one is on the server level valid for requests to all deployments. 1. Request confidentiality in the deployment descriptor The first way is based on the Servlet specification. You need to specify which URLs should be protected in the web.xml deployment descriptor. It's the same approach as the one used for specifying which URLs require authentication/authorization. Just instead of requesting an assigned role, you request a transport-guarantee . Sample content of the WEB-INF/web.xml <web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd" version="3.1...
Okomentovat
Další informace

Simple TLS certificates in WildFly 18

It's just 2 weeks when WildFly 18 was released. It includes nice improvements in TLS certificates handling through ACME protocol (Automatic Certificate Management Environment), it greatly simplifies obtaining valid HTTPS certificates. There was already a support for the Let's Encrypt CA in WildFly 14 as Farah Juma described in her blog post last year. New WildFly version allows using other CA-s with ACME protocol support. It also adds new switch --lets-encrypt to interactive mode of security enable-ssl-http-server JBoss CLI commands. Let's try it. Before we jump on WildFly configuration, let's just mention the HTTPs can be used even in the default configuration and a self-signed certificate is generated on the fly. Nevertheless, it's not secure and you should not use it for any other purpose than testing. Use Let's Encrypt signed certificate for HTTPs application interface Start WildFly on a machine with the public IP address. Run it on the defaul...
Okomentovat
Další informace

Enable Elytron in WildFly

Steps to enable Elytron in WildFly nightly builds. There is an ongoing effort to bring a new security subsystem Elytron to WildFly and JBoss EAP. For some time a custom server profile named standalone-elytron.xml  existed beside other profiles in standalone/configuration directory. It was possible to use it for playing with Elytron. The custom Elytron profile was removed now.  The Elytron subsystem is newly introduced to all standard server profiles. The thing is, the Elytron is not used by default and users have to enable it in the subsystems themselves. Let's look into how you can enable it. Get WildFly nightly build # Download WildFly nightly build wget --user=guest --password=guest https://ci.wildfly.org/httpAuth/repository/downloadAll/WF_Nightly/.lastSuccessful/artifacts.zip # unzip build artifacts zip. It contains WildFly distribution ZIP unzip artifacts.zip # get the WildFly distribution ZIP name as property WILDFLY_DIST_ZIP=$(ls wildfly-*-SNAPSHOT.zip)...
Okomentovat
Další informace