WolfSSL
/
wolfssljni
mirror of https://github.com/wolfSSL/wolfssljni.git
1
0
Fork 0
Code Issues Releases Wiki Activity
wolfssljni/src/java/com/wolfssl/WolfSSLCertRequest.java

865 lines
31 KiB
Java
Raw Blame History

/* WolfSSLCertRequest.java
*
* Copyright (C) 2006-2026 wolfSSL Inc.
*
* This file is part of wolfSSL.
*
* wolfSSL is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* wolfSSL is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
*/
package com.wolfssl;
import java.io.File;
import java.io.IOException;
import java.nio.charset.Charset;
import java.security.PublicKey;
import java.security.PrivateKey;
import java.security.interfaces.RSAPublicKey;
import java.security.interfaces.RSAPrivateKey;
import java.security.interfaces.ECPublicKey;
import java.security.interfaces.ECPrivateKey;
/**
* WolfSSLCertRequest class, wraps native X509_REQ functionality.
*/
public class WolfSSLCertRequest {
private boolean active = false;
/* native X509_REQ pointer */
private long x509ReqPtr = 0;
/* lock around active state */
private final Object stateLock = new Object();
/* lock around native X509_REQ pointer use */
private final Object x509ReqLock = new Object();
/* Public key types used for CSR, mirrored from
* native enum in wolfssl/openssl/evp.h */
private static final int EVP_PKEY_RSA = 16;
private static final int EVP_PKEY_EC = 18;
/* Define from <wolfssl/openssl/asn1.h> */
private static final int MBSTRING_ASC = 0x1001;
/* Native JNI methods */
static native long X509_REQ_new();
static native void X509_REQ_free(long x509ReqPtr);
static native int X509_REQ_set_subject_name(long x509ReqPtr,
long x509NamePtr);
static native int X509_REQ_add1_attr_by_NID(long x509ReqPtr, int nid,
int type, byte[] bytes);
static native int X509_REQ_set_version(long x509ReqPtr, long ver);
static native byte[] X509_REQ_print(long x509ReqPtr);
static native int X509_REQ_sign(long x509ReqPtr, int evpKeyType,
byte[] keyBytes, int format, String digestAlg);
static native int X509_REQ_set_pubkey_native_open(long x509ReqPtr,
int keyType, byte[] fileBytes, int format);
static native byte[] X509_REQ_get_der(long x509);
static native byte[] X509_REQ_get_pem(long x509);
static native int X509_add_ext_via_nconf_nid(long x509Ptr, int nid,
String extValue, boolean isCritical);
static native int X509_add_ext_via_set_object_boolean(long x509Ptr,
int nid, boolean extValue, boolean isCritical, int pathLen);
/**
* Create new empty WolfSSLCertRequest object, for use with CSR generation
*
* @throws WolfSSLException if native API call fails.
*/
public WolfSSLCertRequest() throws WolfSSLException {
x509ReqPtr = X509_REQ_new();
if (x509ReqPtr == 0) {
throw new WolfSSLException("Failed to create WolfSSLCertRequest");
}
WolfSSLDebug.log(getClass(), WolfSSLDebug.Component.JNI,
WolfSSLDebug.INFO, x509ReqPtr,
() -> "creating new WolfSSLCertRequest");
synchronized (stateLock) {
this.active = true;
}
}
/**
* Verifies that the current WolfSSLCertRequest object is active.
*
* @throws IllegalStateException if object has been freed
*/
private void confirmObjectIsActive()
throws IllegalStateException {
synchronized (stateLock) {
if (this.active == false) {
throw new IllegalStateException(
"WolfSSLCertRequest object has been freed");
}
}
}
/**
* Set the Subject Name to be used with this WolfSSLCertRequest.
* Note that the WolfSSLX509Name object should be completely set up
* before calling this method. This method copies/duplicates the contents
* of the WOLFSSL_X509_NAME (WolfSSLX509Name) into the native
* WOLFSSL_X509 structure.
*
* @param name Initialized and populated WolfSSLX509 name to be set into
* Subject Name of WolfSSLCertRequest for cert generation.
*
* @throws IllegalStateException if WolfSSLCertRequest has been freed.
* @throws WolfSSLException if native JNI error occurs.
*/
public void setSubjectName(WolfSSLX509Name name)
throws IllegalStateException, WolfSSLException {
int ret;
confirmObjectIsActive();
synchronized (x509ReqLock) {
WolfSSLDebug.log(getClass(), WolfSSLDebug.Component.JNI,
WolfSSLDebug.INFO, this.x509ReqPtr,
() -> "entered setSubjectName(" + name + ")");
/* TODO somehow lock WolfSSLX509Name object while using pointer? */
ret = X509_REQ_set_subject_name(this.x509ReqPtr,
name.getNativeX509NamePtr());
}
if (ret != WolfSSL.SSL_SUCCESS) {
throw new WolfSSLException(
"Error setting subject name (ret: " + ret + ")");
}
}
/**
* Add a CSR attribute to this WolfSSLCertRequest
*
* @param nid NID of an attribute to add. Must be one of:
* WolfSSL.NID_pkcs9_challengePassword
* WolfSSL.NID_serialNumber
* WolfSSL.NID_pkcs9_unstructuredName
* WolfSSL.NID_pkcs9_contentType
* WolfSSL.NID_surname
* WolfSSL.NID_initials
* WolfSSL.NID_givenName
* WolfSSL.NID_dnQualifier
* @param value value of attribute to set, if passing in String, use
* String.getBytes()
*
* @throws IllegalStateException if WolfSSLCertRequest has been freed.
* @throws WolfSSLException if native JNI error occurs.
*/
public void addAttribute(int nid, byte[] value)
throws IllegalStateException, WolfSSLException {
int ret;
confirmObjectIsActive();
synchronized (x509ReqLock) {
WolfSSLDebug.log(getClass(), WolfSSLDebug.Component.JNI,
WolfSSLDebug.INFO, this.x509ReqPtr,
() -> "entered addAttribute(nid: " + nid + ", byte[])");
}
if (nid != WolfSSL.NID_pkcs9_challengePassword &&
nid != WolfSSL.NID_serialNumber &&
nid != WolfSSL.NID_pkcs9_unstructuredName &&
nid != WolfSSL.NID_pkcs9_contentType &&
nid != WolfSSL.NID_surname &&
nid != WolfSSL.NID_initials &&
nid != WolfSSL.NID_givenName &&
nid != WolfSSL.NID_dnQualifier) {
throw new WolfSSLException(
"Unsupported CSR attribute NID: " + nid);
}
if (value == null || value.length == 0) {
throw new WolfSSLException(
"CSR attribute value may not be null or zero length");
}
synchronized (x509ReqLock) {
ret = X509_REQ_add1_attr_by_NID(this.x509ReqPtr, nid,
MBSTRING_ASC, value);
}
if (ret != WolfSSL.SSL_SUCCESS) {
throw new WolfSSLException(
"Error setting CSR attribute (ret: " + ret + ")");
}
}
/**
* Set CSR version for this WolfSSLCertRequest object.
*
* Calling this method is optional when generating a CSR. By default,
* a value of 0 (zero) is used for the CSR version. This is currently
* the version used by all CSR RFCs/specs.
*
* @param version version to set for CSR
*
* @throws IllegalStateException if WolfSSLCertRequest has been freed.
* @throws WolfSSLException if native JNI error occurs.
*/
public void setVersion(long version)
throws IllegalStateException, WolfSSLException {
int ret;
confirmObjectIsActive();
synchronized (x509ReqLock) {
WolfSSLDebug.log(getClass(), WolfSSLDebug.Component.JNI,
WolfSSLDebug.INFO, this.x509ReqPtr,
() -> "entered setVersion(" + version + ")");
ret = X509_REQ_set_version(this.x509ReqPtr, version);
}
if (ret != WolfSSL.SSL_SUCCESS) {
throw new WolfSSLException(
"Error setting CSR version (ret: " + ret + ")");
}
}
/**
* Set public key for this WolfSSLCertRequest, used when generating
* Certificate Signing Requests
*
* @param filePath Path to public key file
* @param keyType Type of public key algorithm, options are:
* WolfSSL.RSAk
* WolfSSL.ECDSAk
* @param format Format of public key file, options are:
* WolfSSL.SSL_FILETYPE_ASN1 (DER formatted)
* WolfSSL.SSL_FILETYPE_PEM (PEM formatted)
*
* @throws IllegalStateException if WolfSSLCertRequest has been freed.
* @throws IOException on error opening input file
* @throws WolfSSLException if invalid arguments or native JNI error occurs.
*/
public void setPublicKey(String filePath, int keyType, int format)
throws IllegalStateException, IOException, WolfSSLException {
File keyFile = null;
byte[] fileBytes = null;
confirmObjectIsActive();
synchronized (x509ReqLock) {
WolfSSLDebug.log(getClass(), WolfSSLDebug.Component.JNI,
WolfSSLDebug.INFO, this.x509ReqPtr,
() -> "entered setPublicKey(" + filePath + ", type: " +
keyType + ", format: " + format + ")");
}
if (filePath == null || filePath.isEmpty()) {
throw new WolfSSLException("File path is null or empty");
}
keyFile = new File(filePath);
if (!keyFile.exists()) {
throw new WolfSSLException(
"Input file does not exist: " + filePath);
}
fileBytes = WolfSSL.fileToBytes(keyFile);
if (fileBytes == null) {
throw new WolfSSLException(
"Failed to read bytes from file: " + filePath);
}
setPublicKey(fileBytes, keyType, format);
}
/**
* Set public key for this WolfSSLCertRequest, used when generating
* Certificate Signing Requests
*
* @param key Byte array containing public key
* @param keyType Type of public key algorithm, options are:
* WolfSSL.RSAk
* WolfSSL.ECDSAk
* @param format Format of public key file, options are:
* WolfSSL.SSL_FILETYPE_ASN1 (DER formatted)
* WolfSSL.SSL_FILETYPE_PEM (PEM formatted)
*
* @throws IllegalStateException if WolfSSLCertRequest has been freed.
* @throws IOException on error opening input file
* @throws WolfSSLException if invalid arguments or native JNI error occurs.
*/
public void setPublicKey(byte[] key, int keyType, int format)
throws IllegalStateException, IOException, WolfSSLException {
int ret = 0;
int evpKeyType;
confirmObjectIsActive();
synchronized (x509ReqLock) {
WolfSSLDebug.log(getClass(), WolfSSLDebug.Component.JNI,
WolfSSLDebug.INFO, this.x509ReqPtr,
() -> "entered setPublicKey(byte[], type: " + keyType +
", format: " + format + ")");
}
if (key == null || key.length == 0) {
throw new WolfSSLException("Key array is null or empty");
}
if (format != WolfSSL.SSL_FILETYPE_ASN1 &&
format != WolfSSL.SSL_FILETYPE_PEM) {
throw new WolfSSLException(
"Invalid key format, must be PEM or DER");
}
if (keyType == WolfSSL.RSAk) {
evpKeyType = EVP_PKEY_RSA;
} else if (keyType == WolfSSL.ECDSAk) {
evpKeyType = EVP_PKEY_EC;
} else {
throw new WolfSSLException("Unsupported public key type");
}
synchronized (x509ReqLock) {
ret = X509_REQ_set_pubkey_native_open(this.x509ReqPtr, evpKeyType,
key, format);
}
if (ret != WolfSSL.SSL_SUCCESS) {
throw new WolfSSLException(
"Error setting public key into native WOLFSSL_X509_REQ " +
"(ret: " + ret + ")");
}
}
/**
* Set public key for this WolfSSLCertRequest, used when generating
* Certificate Signing Requests
*
* @param key PublicKey object containing public key to be used when
* generating CSR.
*
* @throws IllegalStateException if WolfSSLCertRequest has been freed.
* @throws WolfSSLException if invalid arguments or native JNI error occurs.
* @throws IOException on error opening/reading public key
*/
public void setPublicKey(PublicKey key)
throws IllegalStateException, IOException, WolfSSLException {
int keyType;
byte[] encodedKey = null;
confirmObjectIsActive();
synchronized (x509ReqLock) {
WolfSSLDebug.log(getClass(), WolfSSLDebug.Component.JNI,
WolfSSLDebug.INFO, this.x509ReqPtr,
() -> "entered setPublicKey(" + key + ")");
}
if (key instanceof RSAPublicKey) {
keyType = WolfSSL.RSAk;
}
else if (key instanceof ECPublicKey) {
keyType = WolfSSL.ECDSAk;
}
else {
throw new WolfSSLException(
"PublicKey must be of type RSAPublicKey or ECPublicKey");
}
/* Get DER encoded key */
encodedKey = key.getEncoded();
if (encodedKey == null) {
throw new WolfSSLException(
"Error getting encoded (DER) format of PublicKey");
}
setPublicKey(encodedKey, keyType, WolfSSL.SSL_FILETYPE_ASN1);
}
/**
* Add an extension to a WolfSSLCertRequest given the NID and extension
* value String.
*
* This method supports the following extensions:
* - Key Usage (WolfSSL.NID_key_usage)
* - Extended Key Usage (WolfSSL.NID_ext_key_usage)
* - Subject Alt Name (WolfSSL.NED_subject_alt_name)
*
* @param nid NID of extension to add. Must be one of:
* WolfSSL.NID_key_usage
* WolfSSL.NID_ext_key_usage
* WolfSSL.NID_subject_alt_name
* @param value String value of extension to set. For keyUsage and
* extKeyUsage this should be a comma-delimited list.
* For subjectAltName, this is a single value. Possible
* values for keyUsage and extKeyUsage are:
*
* NID_key_usage:
* digitalSignature
* nonRepudiation
* contentCommitment
* keyEncipherment
* dataEncipherment
* keyAgreement
* keyCertSign
* cRLSign
* encipherOnly
* decipherOnly
*
* NID_ext_key_usage:
* serverAuth
* clientAuth
* codeSigning
* emailProtection
* timeStamping
* OCSPSigning
*
* @param isCritical Boolean flag indicating if this extension is
* critical
*
* @throws IllegalStateException if WolfSSLCertRequest has been freed.
* @throws WolfSSLException if invalid arguments or native JNI error occurs.
*/
public void addExtension(int nid, String value, boolean isCritical)
throws IllegalStateException, WolfSSLException {
int ret = 0;
confirmObjectIsActive();
synchronized (x509ReqLock) {
WolfSSLDebug.log(getClass(), WolfSSLDebug.Component.JNI,
WolfSSLDebug.INFO, this.x509ReqPtr,
() -> "entered addExtension(nid: " + nid + ", value: " + value +
", isCritical: " + isCritical + ")");
}
if (nid != WolfSSL.NID_key_usage &&
nid != WolfSSL.NID_subject_alt_name &&
nid != WolfSSL.NID_ext_key_usage) {
throw new WolfSSLException(
"Unsupported X509v3 extension NID: " + nid);
}
synchronized (x509ReqLock) {
ret = X509_add_ext_via_nconf_nid(this.x509ReqPtr, nid, value,
isCritical);
}
if (ret != WolfSSL.SSL_SUCCESS) {
if ((WolfSSL.getLibVersionHex() <= 0x05006003) &&
(nid == WolfSSL.NID_key_usage ||
nid == WolfSSL.NID_ext_key_usage)) {
/* wolfSSL versions 5.6.3 and earlier did not include code
* fixes to native wolfSSL allowing this extension support to
* work. Use a version > 5.6.3 or apply patch from wolfSSL
* PR 6585 for correct support */
throw new WolfSSLException(
"Error setting extension into native WOLFSSL_X509 " +
"(ret: " + ret + ").\nNeed to use wolfSSL version " +
"greater than 5.6.3 for extension support (PR 6585).");
}
throw new WolfSSLException(
"Error setting extension into native WOLFSSL_X509 " +
"(ret: " + ret + ")");
}
}
/**
* Add an extension to a WolfSSLCertRequest given the NID and extension
* value true/false value.
*
* This method supports the following extensions:
* - Basic Constraints (WolfSSL.NID_basic_constraints)
*
* @param nid NID of extension to add. Must be one of:
* WolfSSL.NID_basic_constraints
* @param value Boolean value of extension (true/false)
* @param isCritical Boolean flag indicating if this extension is
* critical
*
* @throws IllegalStateException if WolfSSLCertRequest has been freed.
* @throws WolfSSLException if invalid arguments or native JNI error occurs.
*/
public void addExtension(int nid, boolean value, boolean isCritical)
throws IllegalStateException, WolfSSLException {
addExtension(nid, value, -1, isCritical);
}
/**
* Add Basic Constraints extension with CA flag and path length constraint
* to a WolfSSLCertRequest.
*
* This method allows setting the Basic Constraints extension with both the
* CA boolean and an optional path length constraint. The path length limits
* the number of intermediate CA certificates that may follow this
* certificate in a valid certification path.
*
* To set Basic Constraints without a path length constraint, use
* {@link #addExtension(int, boolean, boolean)} with
* {@code WolfSSL.NID_basic_constraints} instead.
*
* @param nid NID of extension to add. Must be:
* WolfSSL.NID_basic_constraints
* @param value Boolean value of CA flag (true for CA, false for end entity)
* @param pathLen Maximum number of intermediate CA certificates allowed
* below this CA. Must be &gt;= 0, or -1 to not set a path length
* constraint. Only meaningful when value is true.
* @param isCritical Boolean flag indicating if this extension is critical
*
* @throws IllegalStateException if WolfSSLCertRequest has been freed
* @throws WolfSSLException if invalid arguments or on native JNI error
*/
public void addExtension(int nid, boolean value, int pathLen,
boolean isCritical) throws IllegalStateException, WolfSSLException {
int ret = 0;
confirmObjectIsActive();
synchronized (x509ReqLock) {
WolfSSLDebug.log(getClass(), WolfSSLDebug.Component.JNI,
WolfSSLDebug.INFO, this.x509ReqPtr,
() -> "entered addExtension(nid: " + nid + ", value: " + value +
", pathLen: " + pathLen + ", isCritical: " + isCritical + ")");
}
if (nid != WolfSSL.NID_basic_constraints) {
throw new WolfSSLException(
"Unsupported X509v3 extension NID: " + nid);
}
if (pathLen < -1) {
throw new WolfSSLException(
"Path length must be >= 0 or -1, got: " + pathLen);
}
if (!value && pathLen >= 0) {
throw new WolfSSLException(
"pathLen must not be set when isCA is FALSE (RFC 5280), " +
"got pathLen: " + pathLen);
}
synchronized (x509ReqLock) {
ret = X509_add_ext_via_set_object_boolean(this.x509ReqPtr, nid,
value, isCritical, pathLen);
}
if (ret == WolfSSL.NOT_COMPILED_IN) {
throw new WolfSSLException(
"addExtension NOT_COMPILED_IN, pathLen " +
"support requires wolfSSL > 5.8.4 or " +
"PR 9940 patch (ret: " + ret + ")");
}
else if (ret != WolfSSL.SSL_SUCCESS) {
throw new WolfSSLException(
"Error setting extension into native WOLFSSL_X509 " +
"(ret: " + ret + ")");
}
}
/**
* Sign certificate request with private key from file.
*
* @param filePath Path to private key file
* @param keyType Type of public key algorithm, options are:
* WolfSSL.RSAk
* WolfSSL.ECDSAk
* @param format Format of private key file, options are:
* WolfSSL.SSL_FILETYPE_ASN1 (DER formatted)
* WolfSSL.SSL_FILETYPE_PEM (PEM formatted)
* @param digestAlg Message digest algorithm to use for signature
* generation. Options include the following, but native algorithm
* must be compiled into wolfSSL to be available:
* "MD4", "MD5", "SHA1", "SHA224", "SHA256", "SHA384",
* "SHA512", "SHA3_224", "SHA3_256", "SHA3_384", "SHA3_512"
*
* @throws IllegalStateException if WolfSSLCertRequest has been freed.
* @throws IOException on error opening input file
* @throws WolfSSLException if invalid arguments or native JNI error occurs.
*/
public void signRequest(String filePath, int keyType, int format,
String digestAlg) throws IllegalStateException, IOException,
WolfSSLException {
File keyFile = null;
byte[] fileBytes = null;
confirmObjectIsActive();
synchronized (x509ReqLock) {
WolfSSLDebug.log(getClass(), WolfSSLDebug.Component.JNI,
WolfSSLDebug.INFO, this.x509ReqPtr,
() -> "entered signRequest(" + filePath + ", keyType: " +
keyType + ", format: " + format + ", digestAlg: " +
digestAlg + ")");
}
if (filePath == null || filePath.isEmpty()) {
throw new WolfSSLException("File path is null or empty");
}
keyFile = new File(filePath);
if (!keyFile.exists()) {
throw new WolfSSLException(
"Input file does not exist: " + filePath);
}
fileBytes = WolfSSL.fileToBytes(keyFile);
if (fileBytes == null) {
throw new WolfSSLException(
"Failed to read bytes from file: " + filePath);
}
signRequest(fileBytes, keyType, format, digestAlg);
}
/**
* Sign certificate request with private key from buffer.
*
* @param key Byte array containing private key
* @param keyType Type of public key algorithm, options are:
* WolfSSL.RSAk
* WolfSSL.ECDSAk
* @param format Format of private key file, options are:
* WolfSSL.SSL_FILETYPE_ASN1 (DER formatted)
* WolfSSL.SSL_FILETYPE_PEM (PEM formatted)
* @param digestAlg Message digest algorithm to use for signature
* generation. Options include the following, but native algorithm
* must be compiled into wolfSSL to be available:
* "MD4", "MD5", "SHA1", "SHA224", "SHA256", "SHA384",
* "SHA512", "SHA3_224", "SHA3_256", "SHA3_384", "SHA3_512"
*
* @throws IllegalStateException if WolfSSLCertRequest has been freed.
* @throws WolfSSLException if invalid arguments or native JNI error occurs.
*/
public void signRequest(byte[] key, int keyType, int format,
String digestAlg) throws IllegalStateException, WolfSSLException {
int ret = 0;
int evpKeyType;
confirmObjectIsActive();
synchronized (x509ReqLock) {
WolfSSLDebug.log(getClass(), WolfSSLDebug.Component.JNI,
WolfSSLDebug.INFO, this.x509ReqPtr,
() -> "entered signRequest(byte[], keyType: " + keyType +
", format: " + format + ", digestAlg: " + digestAlg + ")");
}
if (key == null || key.length == 0) {
throw new WolfSSLException("Key array is null or empty");
}
if (format != WolfSSL.SSL_FILETYPE_ASN1 &&
format != WolfSSL.SSL_FILETYPE_PEM) {
throw new WolfSSLException(
"Invalid key format, must be PEM or DER");
}
if (keyType == WolfSSL.RSAk) {
evpKeyType = EVP_PKEY_RSA;
} else if (keyType == WolfSSL.ECDSAk) {
evpKeyType = EVP_PKEY_EC;
} else {
throw new WolfSSLException("Unsupported private key type");
}
synchronized (x509ReqLock) {
ret = X509_REQ_sign(this.x509ReqPtr, evpKeyType, key, format,
digestAlg);
}
if (ret != WolfSSL.SSL_SUCCESS) {
throw new WolfSSLException(
"Error signing native X509_REQ (ret: " + ret + ")");
}
}
/**
* Sign certificate request with private key from PrivateKey object.
*
* @param key java.security.PrivateKey object containing private key,
* must be of type RSAPrivateKey or ECPrivateKey
* @param digestAlg Message digest algorithm to use for signature
* generation. Options include the following, but native algorithm
* must be compiled into wolfSSL to be available:
* "MD4", "MD5", "SHA1", "SHA224", "SHA256", "SHA384",
* "SHA512", "SHA3_224", "SHA3_256", "SHA3_384", "SHA3_512"
*
* @throws IllegalStateException if WolfSSLCertRequest has been freed.
* @throws WolfSSLException if invalid arguments or native JNI error occurs.
*/
public void signRequest(PrivateKey key, String digestAlg)
throws IllegalStateException, WolfSSLException {
int ret = 0;
int evpKeyType;
byte[] encodedKey = null;
confirmObjectIsActive();
synchronized (x509ReqLock) {
WolfSSLDebug.log(getClass(), WolfSSLDebug.Component.JNI,
WolfSSLDebug.INFO, this.x509ReqPtr,
() -> "entered signRequest(key: " + key + ", digestAlg: " +
digestAlg + ")");
}
if (key == null) {
throw new WolfSSLException("Key object is null");
}
if (key instanceof RSAPrivateKey) {
evpKeyType = EVP_PKEY_RSA;
}
else if (key instanceof ECPrivateKey) {
evpKeyType = EVP_PKEY_EC;
}
else {
throw new WolfSSLException(
"PrivateKey must be of type RSAPrivateKey or ECPrivateKey");
}
/* Get DER encoded key */
encodedKey = key.getEncoded();
if (encodedKey == null) {
throw new WolfSSLException("PrivateKey does not support encoding");
}
synchronized (x509ReqLock) {
ret = X509_REQ_sign(this.x509ReqPtr, evpKeyType, encodedKey,
WolfSSL.SSL_FILETYPE_ASN1, digestAlg);
}
if (ret != WolfSSL.SSL_SUCCESS) {
throw new WolfSSLException(
"Error signing native X509_REQ (ret: " + ret + ")");
}
}
/**
* Get ASN.1/DER encoding of this CSR, after signRequest() has been called.
*
* @return DER encoded array of CSR or null if not available.
*
* @throws IllegalStateException if WolfSSLCertRequest has been freed.
* @throws WolfSSLJNIException if native JNI operation fails
*/
public byte[] getDer() throws IllegalStateException, WolfSSLJNIException {
confirmObjectIsActive();
synchronized (x509ReqLock) {
WolfSSLDebug.log(getClass(), WolfSSLDebug.Component.JNI,
WolfSSLDebug.INFO, this.x509ReqPtr, () -> "entered getDer()");
return X509_REQ_get_der(this.x509ReqPtr);
}
}
/**
* Get PEM encoding of this CSR, after signRequest() has been called.
*
* @return PEM encoded array of CSR or null if not available.
*
* @throws IllegalStateException if WolfSSLCertRequest has been freed.
* @throws WolfSSLJNIException if native JNI operation fails
*/
public byte[] getPem() throws IllegalStateException, WolfSSLJNIException {
confirmObjectIsActive();
synchronized (x509ReqLock) {
WolfSSLDebug.log(getClass(), WolfSSLDebug.Component.JNI,
WolfSSLDebug.INFO, this.x509ReqPtr, () -> "entered getPem()");
return X509_REQ_get_pem(this.x509ReqPtr);
}
}
@Override
public String toString() {
byte[] x509ReqText = null;
synchronized (stateLock) {
if (this.active == false) {
return super.toString();
}
synchronized (x509ReqLock) {
x509ReqText = X509_REQ_print(this.x509ReqPtr);
}
if (x509ReqText != null) {
/* let Java do the modified UTF-8 conversion */
return new String(x509ReqText, Charset.forName("UTF-8"));
} else {
System.out.println("toString: x509ReqTest == null");
}
}
return super.toString();
}
/**
* Frees WolfSSLCertRequest native resources.
*/
public synchronized void free() {
synchronized (stateLock) {
if (this.active == false) {
/* already freed, just return */
return;
}
synchronized (x509ReqLock) {
WolfSSLDebug.log(getClass(), WolfSSLDebug.Component.JNI,
WolfSSLDebug.INFO, this.x509ReqPtr, () -> "entered free()");
/* free native resources */
X509_REQ_free(this.x509ReqPtr);
/* free Java resources */
this.active = false;
this.x509ReqPtr = 0;
}
}
}
@SuppressWarnings("deprecation")
@Override
protected void finalize() throws Throwable
{
this.free();
super.finalize();
}
}
Reference in New Issue View Git Blame Copy Permalink