// First test that we register a new user (like in admin GUI) and gets a
// certificate for that. This should work fine.
//
// Edit our favorite test user
UserDataVOWS user1 = new UserDataVOWS();
user1.setUsername(username);
user1.setPassword("foo123");
user1.setClearPwd(true);
user1.setSubjectDN("CN=" + username + ",C=SE");
user1.setCaName(subcaname);
user1.setStatus(UserDataVOWS.STATUS_NEW);
user1.setTokenType(UserDataVOWS.TOKEN_TYPE_USERGENERATED);
user1.setEndEntityProfileName("EMPTY");
user1.setCertificateProfileName("ENDUSER");
// editUser and set status to new
ejbcaraws.editUser(user1);
List<Certificate> certenv = ejbcaraws.cvcRequest(user1.getUsername(), user1.getPassword(), new String(Base64.encode(request.getDEREncoded())));
assertNotNull(certenv);
Certificate wscert = certenv.get(0);
byte[] b64cert = wscert.getCertificateData();
CVCObject parsedObject = CertificateParser.parseCertificate(Base64.decode(b64cert));
CVCertificate cert = (CVCertificate) parsedObject;
CardVerifiableCertificate cvcert = new CardVerifiableCertificate(cert);
assertNotNull(cert);
assertEquals("CN=" + username + ",C=SE", CertTools.getSubjectDN(cvcert));
assertEquals("00111", CertTools.getSerialNumberAsString(cvcert));
PublicKey pk = cvcert.getPublicKey();
assertEquals("CVC", pk.getFormat());
// Verify that we have the complete chain
assertEquals(3, certenv.size());
Certificate wsdvcert = certenv.get(1);
Certificate wscvcacert = certenv.get(2);
b64cert = wsdvcert.getCertificateData();
parsedObject = CertificateParser.parseCertificate(Base64.decode(b64cert));
CVCertificate dvcert = (CVCertificate) parsedObject;
b64cert = wscvcacert.getCertificateData();
assertTrue ("CVCA", Arrays.equals(wscvcacert.getRawCertificateData(), ca_path.get(1).getRawCertificateData()));
assertTrue ("DVCA", Arrays.equals(wsdvcert.getRawCertificateData(), ca_path.get(0).getRawCertificateData()));
parsedObject = CertificateParser.parseCertificate(Base64.decode(b64cert));
CVCertificate cvcacert = (CVCertificate) parsedObject;
assertEquals(AuthorizationRoleEnum.DV_D, dvcert.getCertificateBody().getAuthorizationTemplate().getAuthorizationField().getRole());
assertEquals(AuthorizationRoleEnum.CVCA, cvcacert.getCertificateBody().getAuthorizationTemplate().getAuthorizationField().getRole());
PublicKey cvcapubk = cvcacert.getCertificateBody().getPublicKey();
PublicKey dvpubk = dvcert.getCertificateBody().getPublicKey();
dvpubk = KeyTools.getECPublicKeyWithParams(dvpubk, cvcapubk);
cvcert.verify(dvpubk);
CardVerifiableCertificate dvjavacert = new CardVerifiableCertificate(dvcert);
dvjavacert.verify(cvcapubk);
//
// Second test that we try to get a new certificate for this user
// without outer (renewal) signature. This should fail.
//
boolean thrown = false;
try {
certenv = ejbcaraws.cvcRequest(user1.getUsername(), user1.getPassword(), new String(Base64.encode(request.getDEREncoded())));
} catch (EjbcaException_Exception e) {
thrown = true;
String msg = e.getMessage();
assertTrue(msg.contains("NEW, FAILED or INPROCESS required"));
}
assertTrue(thrown);
//
// Third test that we can not renew a certificate with the same keys as
// the old request. This should fail.
//
thrown = false;
try {
certenv = ejbcaraws.cvcRequest(user1.getUsername(), user1.getPassword(), new String(Base64.encode(authRequestSameKeys.getDEREncoded())));
} catch (AuthorizationDeniedException_Exception e) {
thrown = true;
String msg = e.getMessage();
assertTrue(msg.contains("Trying to renew a certificate using the same key"));
}
assertTrue(thrown);
//
// Fourth test that we can renew a certificate using an outer signature
// made with the old keys. This should succeed.
//
certenv = ejbcaraws.cvcRequest(user1.getUsername(), user1.getPassword(), new String(Base64.encode(authRequestRenew.getDEREncoded())));
assertNotNull(certenv);
wscert = certenv.get(0);
b64cert = wscert.getCertificateData();
parsedObject = CertificateParser.parseCertificate(Base64.decode(b64cert));
cert = (CVCertificate) parsedObject;
cvcert = new CardVerifiableCertificate(cert);
assertNotNull(cert);
assertEquals("CN=" + username + ",C=SE", CertTools.getSubjectDN(cvcert));
assertEquals("00111", CertTools.getSerialNumberAsString(cvcert));
//
// Fifth test try to renew with an outer signature which is not by the
// last issued cert (false renew request). This should fail.
//
thrown = false;
try {
certenv = ejbcaraws.cvcRequest(user1.getUsername(), user1.getPassword(), new String(Base64.encode(authRequestRenewFalse.getDEREncoded())));
} catch (AuthorizationDeniedException_Exception e) {
thrown = true;
String msg = e.getMessage();
assertTrue(msg.contains("No certificate found that could authenticate request"));
}