getLogger().info("Certificate profile: "+profileName);
//getLogger().info("Certificate profile id: "+profileId);
getLogger().info("CA token properties: "+catokenproperties);
getLogger().info("Signed by: "+(signedByCAId == CAInfo.SELFSIGNED ? "self signed " : signedByCAId));
if (signedByCAId != CAInfo.SELFSIGNED) {
CAInfo signedBy = ejb.getCAAdminSession().getCAInfo(getAdmin(), signedByCAId);
if (signedBy == null) {
throw new IllegalArgumentException("CA with id "+signedByCAId+" does not exist.");
}
}
initAuthorizationModule(dn.hashCode(), superAdminCN);
// Define CAToken type (soft token or hsm).
CATokenInfo catokeninfo = null;
if ( catokentype.equals("soft")) {
SoftCATokenInfo softcatokeninfo = new SoftCATokenInfo();
if (!catokenpassword.equalsIgnoreCase("null")) {
softcatokeninfo.setAuthenticationCode(catokenpassword);
}
softcatokeninfo.setSignKeySpec(keyspec);
softcatokeninfo.setSignKeyAlgorithm(keytype);
softcatokeninfo.setSignatureAlgorithm(signAlg);
softcatokeninfo.setEncKeySpec("2048");
softcatokeninfo.setEncKeyAlgorithm(AlgorithmConstants.KEYALGORITHM_RSA);
softcatokeninfo.setEncryptionAlgorithm(AlgorithmConstants.SIGALG_SHA1_WITH_RSA);
catokeninfo = softcatokeninfo;
} else {
HardCATokenInfo hardcatokeninfo = new HardCATokenInfo();
hardcatokeninfo.setAuthenticationCode(catokenpassword);
hardcatokeninfo.setCATokenStatus(ICAToken.STATUS_ACTIVE);
hardcatokeninfo.setClassPath(catokentype);
hardcatokeninfo.setEncryptionAlgorithm(AlgorithmConstants.SIGALG_SHA1_WITH_RSA);
hardcatokeninfo.setProperties(catokenproperties);
hardcatokeninfo.setSignatureAlgorithm(signAlg);
catokeninfo = hardcatokeninfo;
}
// Create and active OSCP CA Service.
ArrayList extendedcaservices = new ArrayList();
String keySpec = keyspec;
if (keytype.equals(AlgorithmConstants.KEYALGORITHM_RSA)) {
// Never use larger keys than 2048 bit RSA for OCSP signing
int len = Integer.parseInt(keySpec);
if (len > 2048) {
keySpec = "2048";
}
}
extendedcaservices.add(new OCSPCAServiceInfo(ExtendedCAServiceInfo.STATUS_ACTIVE));
extendedcaservices.add(
new XKMSCAServiceInfo(ExtendedCAServiceInfo.STATUS_INACTIVE,
"CN=XKMSCertificate, " + dn,
"",
keySpec,
keytype));
extendedcaservices.add(
new CmsCAServiceInfo(ExtendedCAServiceInfo.STATUS_INACTIVE,
"CN=CmsCertificate, " + dn,
"",
keySpec,
keytype));
X509CAInfo cainfo = new X509CAInfo(dn,
caname, SecConst.CA_ACTIVE, new Date(),
"", profileId,
validity,
null, // Expiretime
CAInfo.CATYPE_X509,
signedByCAId,
(Collection) null,
catokeninfo,
"Initial CA",
-1, null,
policies, // PolicyId
24 * SimpleTime.MILLISECONDS_PER_HOUR, // CRLPeriod
0 * SimpleTime.MILLISECONDS_PER_HOUR, // CRLIssueInterval
10 * SimpleTime.MILLISECONDS_PER_HOUR, // CRLOverlapTime
0 * SimpleTime.MILLISECONDS_PER_HOUR, // DeltaCRLPeriod
new ArrayList(),
true, // Authority Key Identifier
false, // Authority Key Identifier Critical
true, // CRL Number
false, // CRL Number Critical
"", // Default CRL Dist Point
"", // Default CRL Issuer
"", // Default OCSP Service Locator
"", // CA defined freshest CRL
true, // Finish User
extendedcaservices,
false, // use default utf8 settings
new ArrayList(), // Approvals Settings
1, // Number of Req approvals
false, // Use UTF8 subject DN by default
true, // Use LDAP DN order by default
false, // Use CRL Distribution Point on CRL
false, // CRL Distribution Point on CRL critical
true, // include in health check
true, // isDoEnforceUniquePublicKeys
true, // isDoEnforceUniqueDistinguishedName
false, // isDoEnforceUniqueSubjectDNSerialnumber
true, // useCertReqHistory
true, // useUserStorage
true, // useCertificateStorage
null //cmpRaAuthSecret
);
getLogger().info("Creating CA...");
ejb.getCAAdminSession().createCA(getAdmin(), cainfo);
CAInfo newInfo = ejb.getCAAdminSession().getCAInfo(getAdmin(), caname);
int caid = newInfo.getCAId();
getLogger().info("CAId for created CA: " + caid);
getLogger().info("-Created and published initial CRL.");
getLogger().info("CA initialized");
} catch (Exception e) {
getLogger().debug("An error occured: ", e);