}
Date thisUpdate = new Date();
Date nextUpdate = new Date();
nextUpdate.setTime(nextUpdate.getTime() + crlPeriod);
X509V2CRLGenerator crlgen = new X509V2CRLGenerator();
crlgen.setThisUpdate(thisUpdate);
crlgen.setNextUpdate(nextUpdate);
crlgen.setSignatureAlgorithm(sigAlg);
// Make DNs
X509Certificate cacert = (X509Certificate)getCACertificate();
if (cacert == null) {
// This is an initial root CA, since no CA-certificate exists
// (I don't think we can ever get here!!!)
X509NameEntryConverter converter = null;
if (getUsePrintableStringSubjectDN()) {
converter = new PrintableStringEntryConverter();
} else {
converter = new X509DefaultEntryConverter();
}
X509Name caname = CertTools.stringToBcX509Name(getSubjectDN(), converter, getUseLdapDNOrder());
crlgen.setIssuerDN(caname);
} else {
crlgen.setIssuerDN(cacert.getSubjectX500Principal());
}
if (certs != null) {
Iterator<RevokedCertInfo> it = certs.iterator();
while( it.hasNext() ) {
RevokedCertInfo certinfo = (RevokedCertInfo)it.next();
crlgen.addCRLEntry(certinfo.getUserCertificate(), certinfo.getRevocationDate(), certinfo.getReason());
}
}
// Authority key identifier
if (getUseAuthorityKeyIdentifier() == true) {
SubjectPublicKeyInfo apki = new SubjectPublicKeyInfo((ASN1Sequence)new ASN1InputStream(
new ByteArrayInputStream(getCAToken().getPublicKey(SecConst.CAKEYPURPOSE_CRLSIGN).getEncoded())).readObject());
AuthorityKeyIdentifier aki = new AuthorityKeyIdentifier(apki);
crlgen.addExtension(X509Extensions.AuthorityKeyIdentifier.getId(), getAuthorityKeyIdentifierCritical(), aki);
}
// CRLNumber extension
if (getUseCRLNumber() == true) {
CRLNumber crlnum = new CRLNumber(BigInteger.valueOf(crlnumber));
crlgen.addExtension(X509Extensions.CRLNumber.getId(), this.getCRLNumberCritical(), crlnum);
}
if (isDeltaCRL) {
// DeltaCRLIndicator extension
CRLNumber basecrlnum = new CRLNumber(BigInteger.valueOf(basecrlnumber));
crlgen.addExtension(X509Extensions.DeltaCRLIndicator.getId(), true, basecrlnum);
}
// CRL Distribution point URI and Freshest CRL DP
if(getUseCrlDistributionPointOnCrl()) {
String crldistpoint = getDefaultCRLDistPoint();
List<DistributionPoint> distpoints = generateDistributionPoints(crldistpoint);
if (distpoints.size() > 0) {
IssuingDistributionPoint idp =
new IssuingDistributionPoint(distpoints.get(0).getDistributionPoint(),
false, false, null, false, false);
// According to the RFC, IDP must be a critical extension.
// Nonetheless, at the moment, Mozilla is not able to correctly
// handle the IDP extension and discards the CRL if it is critical.
crlgen.addExtension(X509Extensions.IssuingDistributionPoint.getId(),
getCrlDistributionPointOnCrlCritical(), idp);
}
if (!isDeltaCRL) {
String crlFreshestDP = getCADefinedFreshestCRL();
List<DistributionPoint> freshestDistPoints = generateDistributionPoints(crlFreshestDP);
if (freshestDistPoints.size() > 0) {
CRLDistPoint ext = new CRLDistPoint((DistributionPoint[])freshestDistPoints.toArray(new DistributionPoint[freshestDistPoints.size()]));
// According to the RFC, the Freshest CRL extension on a
// CRL must not be marked as critical. Therefore it is
// hardcoded as not critical and is independent of
// getCrlDistributionPointOnCrlCritical().
crlgen.addExtension(X509Extensions.FreshestCRL.getId(),
false, ext);
}
}
}
X509CRL crl;
crl = crlgen.generate(getCAToken().getPrivateKey(SecConst.CAKEYPURPOSE_CRLSIGN),getCAToken().getProvider());
// Verify before sending back
crl.verify(getCAToken().getPublicKey(SecConst.CAKEYPURPOSE_CRLSIGN));
return crl;
}