*                                                                       *

*  EJBCA: The OpenSource Certificate Authority                          *

*                                                                       *

*  This software is free software; you can redistribute it and/or       *

*  modify it under the terms of the GNU Lesser General Public           *

*  License as published by the Free Software Foundation; either         *

*  version 2.1 of the License, or any later version.                    *

*                                                                       *

*  See terms of license at gnu.org.                                     *

*                                                                       *

*************************************************************************/

* Implementor of the IEjbcaWS interface.

* Keep this class free of other helper methods, and implement them in the helper classes instead.

*

* @author Philip Vendil

* @version $Id: EjbcaWS.java 12065 2011-05-23 08:24:31Z anatom $

*/

@WebService(name="EjbcaWS", serviceName="EjbcaWSService", targetNamespace="http://ws.protocol.core.ejbca.org/", portName="EjbcaWSPort")  //portName="EjbcaWSPort" default

  @Resource

  private WebServiceContext wsContext; 

    @EJB

    private ApprovalSessionLocal approvalSession;

    @EJB

    private AuthenticationSessionLocal authenticationSession;

    @EJB

    private AuthorizationSessionLocal authorizationSession;

    @EJB

    private CAAdminSessionLocal caAdminSession;

    @EJB

    private CaSessionLocal caSession;

    @EJB

    private CertificateRequestSessionLocal certificateRequestSession;

    @EJB

    private CertificateStoreSessionLocal certificateStoreSession;

    @EJB

    private CertificateProfileSessionLocal certificateProfileSession;

    @EJB

    private CrlCreateSessionLocal crlStoreSession;

    @EJB

    private EndEntityProfileSessionLocal endEntityProfileSession;

    @EJB

    private HardTokenSessionLocal hardTokenSession;

    @EJB

    private KeyRecoverySessionLocal keyRecoverySession;

    @EJB

    private LogSessionLocal logSession;

    @EJB

    private PublisherQueueSessionLocal publisherQueueSession;

    @EJB

    private PublisherSessionLocal publisherSession;

    @EJB

    private GlobalConfigurationSessionLocal globalConfigurationSession;

    @EJB

    private SignSessionLocal signSession;

    @EJB

    private UserAdminSessionLocal userAdminSession;

    @EJB

    private UserDataSourceSessionLocal userDataSourceSession;

  /** The maximum number of rows returned in array responses. */

  private static final int MAXNUMBEROFROWS = 100;

 

  private static final int REQTYPE_PKCS10 = 1;

  private static final int REQTYPE_CRMF = 2;

  private static final int REQTYPE_SPKAC = 3;

  private static final int REQTYPE_CVC = 4;

 

  private static final Logger log = Logger.getLogger(EjbcaWS.class); 

    /** Internal localization of logs and errors */

    private static final InternalResources intres = InternalResources.getInstance();

    private void logAdminName(Admin admin, IPatternLogger logger) {

        final X509Certificate cert = (X509Certificate)admin.getAdminInformation().getX509Certificate();

        logger.paramPut(TransactionTags.ADMIN_DN.toString(), cert.getSubjectDN().toString());

        logger.paramPut(TransactionTags.ADMIN_ISSUER_DN.toString(), cert.getIssuerDN().toString());

    }

    /**

   * @throws IllegalQueryException

     * @see org.ejbca.core.protocol.ws.common.IEjbcaWS#editUser(org.ejbca.core.protocol.ws.objects.UserDataVOWS)

   */ 

  public void editUser(final UserDataVOWS userdata)

      throws CADoesntExistsException, AuthorizationDeniedException, UserDoesntFullfillEndEntityProfile, EjbcaException, ApprovalException, WaitingForApprovalException {

        final IPatternLogger logger = TransactionLogger.getPatternLogger();

        try {

          final EjbcaWSHelper ejbhelper = new EjbcaWSHelper(wsContext, authorizationSession, caAdminSession, certificateProfileSession, certificateStoreSession, endEntityProfileSession, hardTokenSession, userAdminSession);

          final Admin admin = ejbhelper.getAdmin();

          logAdminName(admin,logger);

          final UserDataVO userdatavo = ejbhelper.convertUserDataVOWS(admin, userdata);

            if (userAdminSession.existsUser(admin, userdatavo.getUsername())) {

              if (log.isDebugEnabled()) {

                log.debug("User " + userdata.getUsername() + " exists, update the userdata. New status of user '"+userdata.getStatus()+"'." );         

              }

              userAdminSession.changeUser(admin,userdatavo,userdata.isClearPwd(), true);

            } else {

              if (log.isDebugEnabled()) {

                log.debug("New User " + userdata.getUsername() + ", adding userdata. New status of user '"+userdata.getStatus()+"'." );

              }

              userAdminSession.addUserFromWS(admin,userdatavo,userdata.isClearPwd());

            }

    } catch (UserDoesntFullfillEndEntityProfile e) {

      log.debug(e.toString());

            logger.paramPut(TransactionTags.ERROR_MESSAGE.toString(), e.toString());

      throw e;

    } catch (AuthorizationDeniedException e) {

            final String errorMessage = "AuthorizationDeniedException when editing user "+userdata.getUsername()+": "+e.getMessage();

      log.info(errorMessage);

            logger.paramPut(TransactionTags.ERROR_MESSAGE.toString(), errorMessage);

      throw e;

    } catch (PersistenceException e) {

      // The most likely reason is that the user already existed.

            throw EjbcaWSHelper.getEjbcaException(e, logger, ErrorCode.USER_ALREADY_EXISTS, Level.INFO);

        } catch (RuntimeException e) {  // ClassCastException, EJBException, ...

            throw EjbcaWSHelper.getInternalException(e, logger);

    } finally {

        logger.writeln();

            logger.flush();

        }

  }

  /**

   * @see org.ejbca.core.protocol.ws.common.IEjbcaWS#findUser(org.ejbca.core.protocol.ws.objects.UserMatch)

   */

  @TransactionAttribute(TransactionAttributeType.NOT_SUPPORTED)

  public List<UserDataVOWS> findUser(UserMatch usermatch) throws AuthorizationDeniedException, IllegalQueryException, EjbcaException {   

      List<UserDataVOWS> retval = null;

      if (log.isDebugEnabled()) {

            log.debug("Find user with match '"+usermatch.getMatchvalue()+"'.");

      }

        final IPatternLogger logger = TransactionLogger.getPatternLogger();

        try {

          final EjbcaWSHelper ejbhelper = new EjbcaWSHelper(wsContext, authorizationSession, caAdminSession, certificateProfileSession, certificateStoreSession, endEntityProfileSession, hardTokenSession, userAdminSession);

          final Admin admin = ejbhelper.getAdmin();

          logAdminName(admin,logger);

          final Query query = ejbhelper.convertUserMatch(admin, usermatch);           

          final Collection<UserDataVO> result = userAdminSession.query(admin, query, null,null, MAXNUMBEROFROWS); // also checks authorization

          if (result.size() > 0) {

            retval = new ArrayList<UserDataVOWS>(result.size());

            for (final UserDataVO userdata : result) {

              retval.add(ejbhelper.convertUserDataVO(admin,userdata));

            }

          }

        } catch(AuthorizationDeniedException e) {

          logger.paramPut(TransactionTags.ERROR_MESSAGE.toString(), e.toString());

          throw e;

        } catch (RuntimeException e) {  // ClassCastException, EJBException ...

          throw EjbcaWSHelper.getInternalException(e, logger);

        } finally {

          logger.writeln();

          logger.flush();

        }

    return retval;

  }

  /**

   * @see org.ejbca.core.protocol.ws.common.IEjbcaWS#findCerts(java.lang.String, boolean)

   */

  @TransactionAttribute(TransactionAttributeType.NOT_SUPPORTED)

  public List<Certificate> findCerts(String username, boolean onlyValid) throws AuthorizationDeniedException, EjbcaException {

    if (log.isDebugEnabled()) {

          log.debug("Find certs for user '"+username+"'.");

    }

        final IPatternLogger logger = TransactionLogger.getPatternLogger();

    List<Certificate> retval = new ArrayList<Certificate>(0);

    try{

      final EjbcaWSHelper ejbhelper = new EjbcaWSHelper(wsContext, authorizationSession, caAdminSession, certificateProfileSession, certificateStoreSession, endEntityProfileSession, hardTokenSession, userAdminSession);

      final Admin admin = ejbhelper.getAdmin();

            logAdminName(admin,logger);

      if (userAdminSession.findUser(admin,username) != null) {  // checks authorization on CA and profiles and view_end_entity

        Collection<java.security.cert.Certificate> certs;

        if (onlyValid) {

          certs = certificateStoreSession.findCertificatesByUsernameAndStatus(admin, username, SecConst.CERT_ACTIVE);

        } else {

          certs = certificateStoreSession.findCertificatesByUsername(admin, username);

        }

        retval = ejbhelper.returnAuthorizedCertificates(admin, certs, onlyValid);

      } else {

        if (log.isDebugEnabled()) {

          log.debug(intres.getLocalizedMessage("ra.errorentitynotexist", username));       

        }

      }

        } catch (RuntimeException e) {  // EJBException ...

            throw EjbcaWSHelper.getInternalException(e, logger);

    } finally {

            logger.writeln();

            logger.flush();

        }

    return retval;

  }

  /**

   * @see org.ejbca.core.protocol.ws.common.IEjbcaWS#getLastCertChain(java.lang.String)

   */

  public List<Certificate> getLastCertChain(String username) throws AuthorizationDeniedException, EjbcaException {

    if (log.isTraceEnabled()) {

      log.trace(">getLastCertChain: "+username);

    }

    final List<Certificate> retval = new ArrayList<Certificate>();

    EjbcaWSHelper ejbhelper = new EjbcaWSHelper(wsContext, authorizationSession, caAdminSession, certificateProfileSession, certificateStoreSession, endEntityProfileSession, hardTokenSession, userAdminSession);

    Admin admin = ejbhelper.getAdmin();

        final IPatternLogger logger = TransactionLogger.getPatternLogger();

        logAdminName(admin,logger);

    try {

      if (userAdminSession.findUser(admin, username) != null) { // checks authorization on CA and profiles and view_end_entity

        Collection<java.security.cert.Certificate> certs = certificateStoreSession.findCertificatesByUsername(admin,username);

        if (certs.size() > 0) {

          // The latest certificate will be first

          java.security.cert.Certificate lastcert = certs.iterator().next();

          if (lastcert != null) {

            log.debug("Found certificate for user with subjectDN: "+CertTools.getSubjectDN(lastcert)+" and serialNo: "+CertTools.getSerialNumberAsString(lastcert));

            retval.add(new Certificate(lastcert));

            // If we added a certificate, we will also append the CA certificate chain

            boolean selfSigned = false;

            int bar = 0; // to control so we don't enter an infinite loop. Max chain length is 10

            while ( (!selfSigned) && (bar < 10) ) {

              bar++;

              String issuerDN = CertTools.getIssuerDN(lastcert);

              Collection<java.security.cert.Certificate> cacerts = certificateStoreSession.findCertificatesBySubject(admin, issuerDN);

              if ( (cacerts == null) || (cacerts.size() == 0) ) {            

                log.info("No certificate found for CA with subjectDN: "+issuerDN);

                break;

              }

              Iterator<java.security.cert.Certificate> iter = cacerts.iterator();

              while (iter.hasNext()) {

                java.security.cert.Certificate cert = (java.security.cert.Certificate)iter.next();

                try {

                  lastcert.verify(cert.getPublicKey());

                  // this was the right certificate

                  retval.add(new Certificate(cert));

                  // To determine if we have found the last certificate or not

                  selfSigned = CertTools.isSelfSigned(cert);

                  // Find the next certificate in the chain now

                  lastcert = cert;

                  break; // Break of iteration over this CAs certs

                } catch (Exception e) {

                  log.debug("Failed verification when looking for CA certificate, this was not the correct CA certificate. IssuerDN: "+issuerDN+", serno: "+CertTools.getSerialNumberAsString(cert));

                }

              }             

            }

           

          } else {

            log.debug("Found no certificate (in non null list??) for user "+username);

          }

        } else {

          log.debug("Found no certificate for user "+username);

        }

      } else {

        String msg = intres.getLocalizedMessage("ra.errorentitynotexist", username);

        log.debug(msg);

      }

    } catch (CertificateEncodingException e) {

            throw EjbcaWSHelper.getInternalException(e, logger);

        } catch (RuntimeException e) {  // EJBException ...

            throw EjbcaWSHelper.getInternalException(e, logger);

        } finally {

            logger.writeln();

            logger.flush();

        }

    if (log.isTraceEnabled()) {

      log.trace("<getLastCertChain: "+username);

    }

    return retval;

  }

  /**

   * @see org.ejbca.core.protocol.ws.common.IEjbcaWS#crmfRequest(java.lang.String, java.lang.String, java.lang.String, java.lang.String, java.lang.String)

   */

  public CertificateResponse crmfRequest(String username, String password,

      String crmf, String hardTokenSN, String responseType)

  throws CADoesntExistsException, AuthorizationDeniedException, NotFoundException, EjbcaException {

      final IPatternLogger logger = TransactionLogger.getPatternLogger();

      try {

          return new CertificateResponse(responseType, processCertReq(username, password,

                                                                      crmf, REQTYPE_CRMF, hardTokenSN, responseType, logger));

        } catch( CADoesntExistsException t ) {

            logger.paramPut(TransactionTags.ERROR_MESSAGE.toString(), t.toString());

            throw t;

        } catch( AuthorizationDeniedException t ) {

            logger.paramPut(TransactionTags.ERROR_MESSAGE.toString(), t.toString());

            throw t;

        } catch( NotFoundException t ) {

            logger.paramPut(TransactionTags.ERROR_MESSAGE.toString(), t.toString());

            throw t;

        } catch (RuntimeException e) {  // ClassCastException, EJBException ...

            throw EjbcaWSHelper.getInternalException(e, logger);

      } finally {

          logger.writeln();

          logger.flush();

      }

  }

 

  /**

   * @see org.ejbca.core.protocol.ws.common.IEjbcaWS#spkacRequest(java.lang.String, java.lang.String, java.lang.String, java.lang.String, java.lang.String)

   */

  public CertificateResponse spkacRequest(String username, String password,

      String spkac, String hardTokenSN, String responseType)

  throws CADoesntExistsException, AuthorizationDeniedException, NotFoundException, EjbcaException {

      final IPatternLogger logger = TransactionLogger.getPatternLogger();

      try {

          return new CertificateResponse(responseType, processCertReq(username, password,

                                                                      spkac, REQTYPE_SPKAC, hardTokenSN, responseType, logger));

        } catch( CADoesntExistsException t ) {

            logger.paramPut(TransactionTags.ERROR_MESSAGE.toString(), t.toString());

            throw t;

        } catch( AuthorizationDeniedException t ) {

            logger.paramPut(TransactionTags.ERROR_MESSAGE.toString(), t.toString());

            throw t;

        } catch( NotFoundException t ) {

            logger.paramPut(TransactionTags.ERROR_MESSAGE.toString(), t.toString());

            throw t;

        } catch (RuntimeException e) {  // EJBException ...

            throw EjbcaWSHelper.getInternalException(e, logger);

        } finally {

            logger.writeln();

            logger.flush();

        }

  }

  /** Method called from cvcRequest that simply verifies a CVCertificate with a public key and throws AuthorizationDeniedException

   * if verification works. Used to check if a request is sent containing the same public key.

   * this could be replaced by enforcing unique public key on the CA (from EJBCA 3.10) actually...

   *

   * @param pk

   * @param innerreq

   * @param holderref

   * @throws AuthorizationDeniedException

   */

  private void checkInnerCollision(PublicKey pk, CVCertificate innerreq, String holderref) throws AuthorizationDeniedException {

    // Check to see that the inner signature does not verify using an old certificate (public key)

    // because that means the same keys were used, and that is not allowed according to the EU policy

    CardVerifiableCertificate innercert = new CardVerifiableCertificate(innerreq);

    try {

      innercert.verify(pk);                   

      String msg = intres.getLocalizedMessage("cvc.error.renewsamekeys", holderref);             

      log.info(msg);

      throw new AuthorizationDeniedException(msg);

    } catch (SignatureException e) {

      // It was good if the verification failed

    } catch (NoSuchProviderException e) {

      String msg = intres.getLocalizedMessage("cvc.error.outersignature", holderref, e.getMessage());             

      log.warn(msg, e);

      throw new AuthorizationDeniedException(msg);

    } catch (InvalidKeyException e) {

      String msg = intres.getLocalizedMessage("cvc.error.outersignature", holderref, e.getMessage());             

      log.warn(msg, e);

      throw new AuthorizationDeniedException(msg);

    } catch (NoSuchAlgorithmException e) {

      String msg = intres.getLocalizedMessage("cvc.error.outersignature", holderref, e.getMessage());             

      log.info(msg, e);

      throw new AuthorizationDeniedException(msg);

    } catch (CertificateException e) {

      String msg = intres.getLocalizedMessage("cvc.error.outersignature", holderref, e.getMessage());             

      log.warn(msg, e);

      throw new AuthorizationDeniedException(msg);

    }

  }

  /** Method that gets the public key from a CV certificate, possibly enriching it with domain parameters from the CVCA certificate if it is an EC public key.

   * @param ejbhelper

   * @param admin

   * @param cert

   * @return

   * @throws CADoesntExistsException

   * @throws NoSuchAlgorithmException

   * @throws NoSuchProviderException

   * @throws InvalidKeySpecException

   */

  private PublicKey getCVPublicKey(Admin admin, java.security.cert.Certificate cert) throws CADoesntExistsException {

    PublicKey pk = cert.getPublicKey();

    if (pk instanceof PublicKeyEC) {

      // The public key of IS and DV certificate do not have any EC parameters so we have to do some magic to get a complete EC public key

      // First get to the CVCA certificate that has the parameters

      CAInfo info = caAdminSession.getCAInfoOrThrowException(admin, CertTools.getIssuerDN(cert).hashCode());

      Collection<java.security.cert.Certificate> cacerts = info.getCertificateChain();

      if (cacerts != null) {

        log.debug("Found CA certificate chain of length: "+cacerts.size());

        // Get the last cert in the chain, it is the CVCA cert

        Iterator<java.security.cert.Certificate> i = cacerts.iterator();

        java.security.cert.Certificate cvcacert = null;

        while (i.hasNext()) {

          cvcacert = i.next();

        }

        if (cvcacert != null) {

          // Do the magic adding of parameters, if they don't exist in the pk

          try {

            pk = KeyTools.getECPublicKeyWithParams(pk, cvcacert.getPublicKey());

          } catch (InvalidKeySpecException e) {

            String msg = intres.getLocalizedMessage("cvc.error.outersignature", CertTools.getSubjectDN(cert), e.getMessage());             

            log.warn(msg, e);

          } catch (NoSuchProviderException e) {

            String msg = intres.getLocalizedMessage("cvc.error.outersignature", CertTools.getSubjectDN(cert), e.getMessage());             

            log.warn(msg, e);

          } catch (NoSuchAlgorithmException e) {

            String msg = intres.getLocalizedMessage("cvc.error.outersignature", CertTools.getSubjectDN(cert), e.getMessage());             

            log.info(msg, e);

          }

        }

      }                     

    }

    return pk;

  }

  /**

   * @see org.ejbca.core.protocol.ws.common.IEjbcaWS#cvcRequest

   */

  public List<Certificate> cvcRequest(String username, String password, String cvcreq)

      throws CADoesntExistsException, AuthorizationDeniedException, UserDoesntFullfillEndEntityProfile, NotFoundException,

      EjbcaException, ApprovalException, WaitingForApprovalException, SignRequestException, CertificateExpiredException {

    log.trace(">cvcRequest");

    EjbcaWSHelper ejbhelper = new EjbcaWSHelper(wsContext, authorizationSession, caAdminSession, certificateProfileSession, certificateStoreSession, endEntityProfileSession, hardTokenSession, userAdminSession);

    Admin admin = ejbhelper.getAdmin();

    // If password is empty we can generate a big random one to use instead

    if (StringUtils.isEmpty(password)) {

      AllPrintableCharPasswordGenerator gen = new AllPrintableCharPasswordGenerator();

      password = gen.getNewPassword(15, 20);

      log.debug("Using a long random password");

    }

    // get and old status that we can remember so we can reset status if this fails in the last step

    int olduserStatus = UserDataConstants.STATUS_GENERATED;

        final IPatternLogger logger = TransactionLogger.getPatternLogger();

        logAdminName(admin,logger);

        try {

       UserDataVO user = userAdminSession.findUser(admin, username);

      // See if this user already exists.

      // We allow renewal of certificates for IS's that are not revoked

      // In that case look for it's last old certificate and try to authenticate the request using an outer signature.

      // If this verification is correct, set status to NEW and continue process the request.

      if (user != null) {

        olduserStatus = user.getStatus();

        // If user is revoked, we can not proceed

        if ( (olduserStatus == UserDataConstants.STATUS_REVOKED) || (olduserStatus == UserDataConstants.STATUS_HISTORICAL) ) {

          throw new AuthorizationDeniedException("User '"+username+"' is revoked.");

        }

        CVCObject parsedObject = CertificateParser.parseCVCObject(Base64.decode(cvcreq.getBytes()));

        if (parsedObject instanceof CVCAuthenticatedRequest) {

          log.debug("Received an authenticated request, could be an initial DV request signed by CVCA or a renewal for DV or IS.");

          CVCAuthenticatedRequest authreq = (CVCAuthenticatedRequest)parsedObject;

          CVCPublicKey cvcKey = authreq.getRequest().getCertificateBody().getPublicKey();

          String algorithm = AlgorithmUtil.getAlgorithmName(cvcKey.getObjectIdentifier());

          log.debug("Received request has a public key with algorithm: "+algorithm);

          HolderReferenceField holderRef = authreq.getRequest().getCertificateBody().getHolderReference();

          CAReferenceField caRef = authreq.getAuthorityReference();

          // Check to see that the inner signature does not also verify using an old certificate

          // because that means the same keys were used, and that is not allowed according to the EU policy

          // This must be done whether it is signed by CVCA or a renewal request

          Collection<java.security.cert.Certificate> oldcerts = certificateStoreSession.findCertificatesByUsername(admin, username);

          if (oldcerts != null) {

            log.debug("Found "+oldcerts.size()+" old certificates for user "+username);

            Iterator<java.security.cert.Certificate> iterator = oldcerts.iterator();

            while (iterator.hasNext()) {

              java.security.cert.Certificate cert = iterator.next();

              PublicKey pk = getCVPublicKey(admin, cert);

              CVCertificate innerreq = authreq.getRequest();

              checkInnerCollision(pk, innerreq, holderRef.getConcatenated()); // Throws AuthorizationDeniedException

            }

          }

          boolean verifiedOuter = false; // So we can throw an error if we could not verify

          if (StringUtils.equals(holderRef.getMnemonic(), caRef.getMnemonic()) && StringUtils.equals(holderRef.getCountry(), caRef.getCountry())) {

            log.debug("Authenticated request is self signed, we will try to verify it using user's old certificate.");

            Collection<java.security.cert.Certificate> certs = certificateStoreSession.findCertificatesByUsername(admin, username);

            // certs contains certificates ordered with last expire date first. Last expire date should be last issued cert

            // We have to iterate over available user certificates, because we don't know which on signed the old one

            // and cv certificates have very coarse grained validity periods so we can't really know which one is the latest one

            // if 2 certificates are issued the same day.

            if (certs != null) {

              log.debug("Found "+certs.size()+" old certificates for user "+username);

              Iterator<java.security.cert.Certificate> iterator = certs.iterator();

              while (iterator.hasNext()) {

                java.security.cert.Certificate cert = iterator.next();

                try {

                  // Only allow renewal if the old certificate is valid

                  PublicKey pk = getCVPublicKey(admin, cert);

                  if (log.isDebugEnabled()) {

                    log.debug("Trying to verify the outer signature with an old certificate, fp: "+CertTools.getFingerprintAsString(cert));                   

                  }

                  authreq.verify(pk);

                  log.debug("Verified outer signature");

                  // Yes we did it, we can move on to the next step because the outer signature was actually created with some old certificate

                  verifiedOuter = true;

                  if (ejbhelper.checkValidityAndSetUserPassword(admin, cert, username, password)) {

                    // If we managed to verify the certificate we will break out of the loop                 

                    break;

                  }

                 

                  // If verification of outer signature fails because the signature is invalid we will break and deny the request...with a message

                } catch (InvalidKeyException e) {

                  String msg = intres.getLocalizedMessage("cvc.error.outersignature", holderRef.getConcatenated(), e.getMessage());             

                  log.warn(msg, e);

                } catch (CertificateExpiredException e) { // thrown by checkValidityAndSetUserPassword

                  String msg = intres.getLocalizedMessage("cvc.error.outersignature", holderRef.getConcatenated(), e.getMessage());             

                  // Only log this with DEBUG since it will be a common case that happens, nothing that should cause any alerts

                  log.debug(msg);

                  // This exception we want to throw on, because we want to give this error if there was a certificate suitable for

                  // verification, but it had expired. This is thrown by checkValidityAndSetUserPassword after the request has already been

                  // verified using the public key of the certificate.

                  throw e;

                } catch (CertificateException e) {

                  String msg = intres.getLocalizedMessage("cvc.error.outersignature", holderRef.getConcatenated(), e.getMessage());             

                  log.warn(msg, e);

                } catch (NoSuchAlgorithmException e) {

                  String msg = intres.getLocalizedMessage("cvc.error.outersignature", holderRef.getConcatenated(), e.getMessage());             

                  log.info(msg, e);

                } catch (NoSuchProviderException e) {

                  String msg = intres.getLocalizedMessage("cvc.error.outersignature", holderRef.getConcatenated(), e.getMessage());             

                  log.warn(msg, e);

                } catch (SignatureException e) {

                  // Failing to verify the outer signature will be normal, since we must try all old certificates

                  if (log.isDebugEnabled()) {

                    String msg = intres.getLocalizedMessage("cvc.error.outersignature", holderRef.getConcatenated(), e.getMessage());             

                    log.debug(msg);                 

                  }

                }

              } // while (iterator.hasNext()) {

              // if verification failed because the old cert was not yet valid, continue processing as usual, using the sent in username/password hoping the

              // status is NEW and password is correct. If old certificate was expired a CertificateExpiredException is thrown above.

            } // if (certs != null) {

           

            // If there are no old certificate, continue processing as usual, using the sent in username/password hoping the

            // status is NEW and password is correct.

          } else { // if (StringUtils.equals(holderRef, caRef))

            // Subject and issuerDN is CN=Mnemonic,C=Country

            String dn = "CN="+caRef.getMnemonic()+",C="+caRef.getCountry();

            log.debug("Authenticated request is not self signed, we will try to verify it using a CVCA certificate: "+dn);

            CAInfo info = caAdminSession.getCAInfoOrThrowException(admin, CertTools.stringToBCDNString(dn).hashCode());

            if (info != null) {

              Collection<java.security.cert.Certificate> certs = info.getCertificateChain();

              if (certs != null) {

                log.debug("Found "+certs.size()+" certificates in chain for CA with DN: "+dn);