X509Certificate cacert = CertTools.genSelfCertForPurpose("CN=dummy2", 100, null, keys.getPrivate(), keys.getPublic(),
AlgorithmConstants.SIGALG_SHA1_WITH_RSA, true, X509KeyUsage.cRLSign|X509KeyUsage.keyCertSign);
UserDataVO subject = new UserDataVO();
final CertificateProfile cp = new EndUserCertificateProfile();
cp.setValidity(encodedValidity);
cp.setAllowValidityOverride(false);
// First see that when we don't have a specified time requested and validity override is not allowed, the end time shouldbe ruled by the certificate profile.
CertificateValidity cv = new CertificateValidity(subject, cp, null, null, cacert, false);
Date notBefore = cv.getNotBefore();
Date notAfter = cv.getNotAfter();
Date now = new Date();
Calendar cal1 = Calendar.getInstance();
cal1.add(Calendar.DAY_OF_MONTH, 49);
Calendar cal2 = Calendar.getInstance();
cal2.add(Calendar.DAY_OF_MONTH, 51);
assertTrue(notBefore.before(now));
assertTrue(notAfter.after(cal1.getTime()));
assertTrue(notAfter.before(cal2.getTime()));
// See that a requested validity does not affect it
Calendar requestNotBefore = Calendar.getInstance();
requestNotBefore.add(Calendar.DAY_OF_MONTH, 2);
Calendar requestNotAfter = Calendar.getInstance();
requestNotAfter.add(Calendar.DAY_OF_MONTH, 25);
cv = new CertificateValidity(subject, cp, requestNotBefore.getTime(), requestNotAfter.getTime(), cacert, false);
notBefore = cv.getNotBefore();
notAfter = cv.getNotAfter();
assertTrue(notBefore.before(now));
assertTrue(notAfter.after(cal1.getTime()));
assertTrue(notAfter.before(cal2.getTime()));
// Add extended information for the user and see that it does not affect it either
ExtendedInformation ei = new ExtendedInformation();
ei.setCustomData(EndEntityProfile.STARTTIME, "10:0:0");
ei.setCustomData(EndEntityProfile.ENDTIME, "30:0:0");
subject.setExtendedinformation(ei);
cv = new CertificateValidity(subject, cp, requestNotBefore.getTime(), requestNotAfter.getTime(), cacert, false);
notBefore = cv.getNotBefore();
notAfter = cv.getNotAfter();
assertTrue(notBefore.before(now));
assertTrue(notAfter.after(cal1.getTime()));
assertTrue(notAfter.before(cal2.getTime()));
// Now allow validity override
cp.setAllowValidityOverride(true);
// Now we should get what's in the UserDataVO extended information
cv = new CertificateValidity(subject, cp, requestNotBefore.getTime(), requestNotAfter.getTime(), cacert, false);
notBefore = cv.getNotBefore();
notAfter = cv.getNotAfter();
cal1 = Calendar.getInstance();
cal1.add(Calendar.DAY_OF_MONTH, 9);
cal2 = Calendar.getInstance();
cal2.add(Calendar.DAY_OF_MONTH, 11);
assertTrue(notBefore.after(cal1.getTime()));
assertTrue(notBefore.before(cal2.getTime()));
cal1 = Calendar.getInstance();
cal1.add(Calendar.DAY_OF_MONTH, 29);
cal2 = Calendar.getInstance();
cal2.add(Calendar.DAY_OF_MONTH, 31);
assertTrue(notAfter.after(cal1.getTime()));
assertTrue(notAfter.before(cal2.getTime()));
// Remove extended information from UserDataVO and we should get what we pass as parameters to CertificateValidity
subject.setExtendedinformation(null);
cv = new CertificateValidity(subject, cp, requestNotBefore.getTime(), requestNotAfter.getTime(), cacert, false);
notBefore = cv.getNotBefore();
notAfter = cv.getNotAfter();
cal1 = Calendar.getInstance();
cal1.add(Calendar.DAY_OF_MONTH, 1);
cal2 = Calendar.getInstance();
cal2.add(Calendar.DAY_OF_MONTH, 3);
assertTrue(notBefore.after(cal1.getTime()));
assertTrue(notBefore.before(cal2.getTime()));
cal1 = Calendar.getInstance();
cal1.add(Calendar.DAY_OF_MONTH, 23);
cal2 = Calendar.getInstance();
cal2.add(Calendar.DAY_OF_MONTH, 26);
assertTrue(notAfter.after(cal1.getTime()));
assertTrue(notAfter.before(cal2.getTime()));
// Check that we can not supersede the certificate profile end time
requestNotAfter = Calendar.getInstance();
requestNotAfter.add(Calendar.DAY_OF_MONTH, 200);
cv = new CertificateValidity(subject, cp, requestNotBefore.getTime(), requestNotAfter.getTime(), cacert, false);
notBefore = cv.getNotBefore();
notAfter = cv.getNotAfter();
cal1 = Calendar.getInstance();
cal2 = Calendar.getInstance();
// This will be counted in number of days since notBefore, and notBefore here is taken from requestNotBefore which is two,
// so we have to add 2 to certificate profile validity to get the resulting notAfter but not if certificate end is an
// absolute end date.
if ( encodedValidity > Integer.MAX_VALUE) {
cal1.add(Calendar.DAY_OF_MONTH, 49);
cal2.add(Calendar.DAY_OF_MONTH, 51);
} else {
cal1.add(Calendar.DAY_OF_MONTH, 51);
cal2.add(Calendar.DAY_OF_MONTH, 53);
}
assertTrue(notAfter.after(cal1.getTime()));
assertTrue(notAfter.before(cal2.getTime()));
// Check that we can not supersede the CA end time
cp.setValidity(400);
cv = new CertificateValidity(subject, cp, requestNotBefore.getTime(), requestNotAfter.getTime(), cacert, false);
notBefore = cv.getNotBefore();
notAfter = cv.getNotAfter();
// This will be the CA certificate's notAfter
cal1 = Calendar.getInstance();