subject.addRDN(ObjectID.commonName ,(String) h.get("commonname"));
subject.addRDN(ObjectID.emailAddress ,(String) h.get("email"));
subject.addRDN(ObjectID.stateOrProvince,(String) h.get("state"));
subject.addRDN(ObjectID.locality,(String) h.get("locality"));
X509Certificate cert = new X509Certificate();
if (h.containsKey("serial")) {
cert.setSerialNumber(new BigInteger((String) h.get("serial")));
} else {
cert.setSerialNumber(new BigInteger("" + serialNo++));
}
cert.setSubjectDN(subject);
cert.setIssuerDN(serverChain[0].getIssuerDN());
System.out.println("User cert request generated");
// System.out.println("Dummy cert request " + cert.toString());
/*
* Get the signed public key from the user.
* This is the base64 decoded string that came back from
* netscape's KEYGEN param, the SignedPublicKeyAndChallenge.
*/
String key = (String) h.get("key");
byte bytes[] = Util.Base64Decode(key.getBytes());
NetscapeCertRequest nc = null;
try {
nc = new NetscapeCertRequest(bytes);
} catch (CodingException e) {
System.out.println("OOPS " + e);
e.printStackTrace();
}
try {
nc.verify();
} catch (java.security.SignatureException e) {
System.out.println("OOPS " + e);
e.printStackTrace();
}
System.out.println("Got cert req: " + nc);
try {
cert.setPublicKey(nc.getPublicKey());
} catch (java.security.InvalidKeyException e) {
System.out.println("OOPS " + e);
e.printStackTrace();
}
/*
* set up the validity dates
*/
GregorianCalendar date = new GregorianCalendar();
date.add(Calendar.DATE, -1);
cert.setValidNotBefore(date.getTime());
date.add(Calendar.MONTH,
Integer.parseInt((String) h.get("expires")));
cert.setValidNotAfter(date.getTime());
/*
* Add in any cert options. If none are specified, then the default,
* which is everything but object signing is used.
*/
int options = 0;
if (h.get("can_sign") != null) {
options |= NetscapeCertType.OBJECT_SIGNING;
}
if (h.get("can_email") != null) {
options |= NetscapeCertType.S_MIME;
}
if (h.get("can_ssl") != null) {
options |= NetscapeCertType.SSL_CLIENT;
}
if (options != 0) {
cert.addExtension(new NetscapeCertType(options));
}
/*
* This is the private key out of the server's certificate,
*/
System.out.println("About to sign cert");
try {
cert.sign(AlgorithmID.md5WithRSAEncryption, serverKey);
} catch (InvalidKeyException e) {
System.out.println("OOPS " + e);
e.printStackTrace();
} catch (NoSuchAlgorithmException e) {
System.out.println("OOPS " + e);
e.printStackTrace();
} catch (CertificateException e) {
System.out.println("OOPS " + e);
e.printStackTrace();
}
System.out.println("Generated CERT:" + cert.toString(true));
/*
* Construct a chain by adding on the server chain
*/