1391N/A/*
2362N/A * Copyright (c) 2009, Oracle and/or its affiliates. All rights reserved.
1391N/A * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
1391N/A *
1391N/A * This code is free software; you can redistribute it and/or modify it
1391N/A * under the terms of the GNU General Public License version 2 only, as
1391N/A * published by the Free Software Foundation.
1391N/A *
1391N/A * This code is distributed in the hope that it will be useful, but WITHOUT
1391N/A * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
1391N/A * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
1391N/A * version 2 for more details (a copy is included in the LICENSE file that
1391N/A * accompanied this code).
1391N/A *
1391N/A * You should have received a copy of the GNU General Public License version
1391N/A * 2 along with this work; if not, write to the Free Software Foundation,
1391N/A * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
1391N/A *
2362N/A * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
2362N/A * or visit www.oracle.com if you need additional information or have any
2362N/A * questions.
1391N/A */
1391N/A
1391N/A/**
1391N/A * @test
1391N/A * @bug 6852744
1391N/A * @summary PIT b61: PKI test suite fails because self signed certificates
1391N/A * are being rejected
1391N/A * @run main/othervm DisableRevocation subca
1391N/A * @run main/othervm DisableRevocation subci
1391N/A * @run main/othervm DisableRevocation alice
1391N/A * @author Xuelei Fan
1391N/A */
1391N/A
1391N/Aimport java.io.*;
1391N/Aimport java.net.SocketException;
1391N/Aimport java.util.*;
1391N/Aimport java.security.Security;
1391N/Aimport java.security.cert.*;
1391N/Aimport java.security.cert.CertPathValidatorException.BasicReason;
1391N/Aimport sun.security.util.DerInputStream;
1391N/A
1391N/A/**
1391N/A * A test case helps to ensure that a certification path building process is
1391N/A * able to identify a self-issued certificate from its issuer when disable
1391N/A * revocation checking.
1391N/A */
1391N/Apublic final class DisableRevocation {
1391N/A
1391N/A // the trust anchor
1391N/A static String selfSignedCertStr =
1391N/A "-----BEGIN CERTIFICATE-----\n" +
1391N/A "MIICPjCCAaegAwIBAgIBADANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ\n" +
1391N/A "MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA2MjgxMzMyMThaFw0zMDA2MDgxMzMyMTha\n" +
1391N/A "MB8xCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMIGfMA0GCSqGSIb3DQEB\n" +
1391N/A "AQUAA4GNADCBiQKBgQDInJhXi0655bPXAVkz1n5I6fAcZejzPnOPuwq3hU3OxFw8\n" +
1391N/A "81Uf6o9oKI1h4w4XAD8u1cUNOgiX+wPwojronlp68bIfO6FVhNf287pLtLhNJo+7\n" +
1391N/A "m6Qxw3ymFvEKy+PVj20CHSggdKHxUa4MBZBmHMFNBuxfYmjwzn+yTMmCCXOvSwID\n" +
1391N/A "AQABo4GJMIGGMB0GA1UdDgQWBBSQ52Dpau+gtL+Kc31dusYnKj16ZTBHBgNVHSME\n" +
1391N/A "QDA+gBSQ52Dpau+gtL+Kc31dusYnKj16ZaEjpCEwHzELMAkGA1UEBhMCVVMxEDAO\n" +
1391N/A "BgNVBAoTB0V4YW1wbGWCAQAwDwYDVR0TAQH/BAUwAwEB/zALBgNVHQ8EBAMCAQYw\n" +
1391N/A "DQYJKoZIhvcNAQEEBQADgYEAjBt6ea65HCqbGsS2rs/HhlGusYXtThRVC5vwXSey\n" +
1391N/A "ZFYwSgukuq1KDzckqZFu1meNImEwdZjwxdN0e2p/nVREPC42rZliSj6V1ThayKXj\n" +
1391N/A "DWEZW1U5aR8T+3NYfDrdKcJGx4Hzfz0qKz1j4ssV1M9ptJxYYv4y2Da+592IN1S9\n" +
1391N/A "v/E=\n" +
1391N/A "-----END CERTIFICATE-----";
1391N/A
1391N/A // the sub-ca
1391N/A static String subCaCertStr =
1391N/A "-----BEGIN CERTIFICATE-----\n" +
1391N/A "MIICUDCCAbmgAwIBAgIBAzANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ\n" +
1391N/A "MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA2MjgxMzMyMjRaFw0yOTAzMTUxMzMyMjRa\n" +
1391N/A "MDExCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMRAwDgYDVQQLEwdDbGFz\n" +
1391N/A "cy0xMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPFv24SK78VI0gWlyIrq/X\n" +
1391N/A "srl1431K5hJJxMYZtaQunyPmrYg3oI9KvKFykxnR0N4XDPaIi75p9dXGppVu80BA\n" +
1391N/A "+csvIPBwlBQoNmKDQWTziDOqfK4tE+IMuL/Y7pxnH6CDMY7VGpvatty2zcmH+m/v\n" +
1391N/A "E/n+HPyeELJQT2rT/3T+7wIDAQABo4GJMIGGMB0GA1UdDgQWBBRidC8Dt3dBzYES\n" +
1391N/A "KpR2tR560sZ0+zBHBgNVHSMEQDA+gBSQ52Dpau+gtL+Kc31dusYnKj16ZaEjpCEw\n" +
1391N/A "HzELMAkGA1UEBhMCVVMxEDAOBgNVBAoTB0V4YW1wbGWCAQAwDwYDVR0TAQH/BAUw\n" +
1391N/A "AwEB/zALBgNVHQ8EBAMCAQYwDQYJKoZIhvcNAQEEBQADgYEAMeMKqrMr5d3eTQsv\n" +
1391N/A "MYOD15Dl3THQGLAa4ad5Eyq5/1eUeEOpztzCgDfi0iPD8YCubIEVasBTSqTiGXqb\n" +
1391N/A "RpGuPHOwwfWvHrTeHSludiFBAUiKj7aEV+oQa0FBn4U4TT8HA62HQ93FhzTDI3jP\n" +
1391N/A "iil34GktVl6gfMKGzUEW/Dh8OM4=\n" +
1391N/A "-----END CERTIFICATE-----";
1391N/A
1391N/A // a delegated CRL issuer, it's a self-issued certificate of trust anchor
1391N/A static String topCrlIssuerCertStr =
1391N/A "-----BEGIN CERTIFICATE-----\n" +
1391N/A "MIICPjCCAaegAwIBAgIBAjANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ\n" +
1391N/A "MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA2MjgxMzMyMjNaFw0yOTAzMTUxMzMyMjNa\n" +
1391N/A "MB8xCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMIGfMA0GCSqGSIb3DQEB\n" +
1391N/A "AQUAA4GNADCBiQKBgQC99u93trf+WmpfiqunJy/P31ej1l4rESxft2JSGNjKuLFN\n" +
1391N/A "/BO3SAugGJSkCARAwXjB0c8eeXhXWhVVWdNpbKepRJTxrjDfnFIavLgtUvmFwn/3\n" +
1391N/A "hPXe+RQeA8+AJ99Y+o+10kY8JAZLa2j93C2FdmwOjUbo8aIz85yhbiV1tEDjLwID\n" +
1391N/A "AQABo4GJMIGGMB0GA1UdDgQWBBSyFyA3XWLbdL6W6hksmBn7RKsQmDBHBgNVHSME\n" +
1391N/A "QDA+gBSQ52Dpau+gtL+Kc31dusYnKj16ZaEjpCEwHzELMAkGA1UEBhMCVVMxEDAO\n" +
1391N/A "BgNVBAoTB0V4YW1wbGWCAQAwDwYDVR0TAQH/BAUwAwEB/zALBgNVHQ8EBAMCAQYw\n" +
1391N/A "DQYJKoZIhvcNAQEEBQADgYEAHTm8aRTeakgCfEBCgSWK9wvMW1c18ANGMm8OFDBk\n" +
1391N/A "xabVy9BT0MVFHlaneh89oIxTZN0FMTpg21GZMAvIzhEt7DGdO7HLsW7JniN7/OZ0\n" +
1391N/A "rACmpK5frmZrLS03zUm8c+rTbazNfYLoZVG3/mDZbKIi+4y8IGnFcgLVsHsYoBNP\n" +
1391N/A "G0c=\n" +
1391N/A "-----END CERTIFICATE-----";
1391N/A
1391N/A // a delegated CRL issuer, it's a self-issued certificate of sub-ca
1391N/A static String subCrlIssuerCertStr =
1391N/A "-----BEGIN CERTIFICATE-----\n" +
1391N/A "MIICUDCCAbmgAwIBAgIBBDANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ\n" +
1391N/A "MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA2MjgxMzMyMjdaFw0yOTAzMTUxMzMyMjda\n" +
1391N/A "MDExCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMRAwDgYDVQQLEwdDbGFz\n" +
1391N/A "cy0xMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC+8AcLJtGAVUWvv3ifcyQw\n" +
1391N/A "OGqwzcPrBw/XCs6vTMlcdtFzcH1M+Z3/QHN9+5VT1gqeTIZ+b8g9005Og3XKy/HX\n" +
1391N/A "obXZeLv20VZsr+jm52ySghEYOVCTJ9OyFOAp5adp6nf0cA66Feh3LsmVhpTEcDOG\n" +
1391N/A "GnyntQm0DBYxRoOT/GBlvQIDAQABo4GJMIGGMB0GA1UdDgQWBBSRWhMuZLQoHSDN\n" +
1391N/A "xhxr+vdDmfAY8jBHBgNVHSMEQDA+gBSQ52Dpau+gtL+Kc31dusYnKj16ZaEjpCEw\n" +
1391N/A "HzELMAkGA1UEBhMCVVMxEDAOBgNVBAoTB0V4YW1wbGWCAQAwDwYDVR0TAQH/BAUw\n" +
1391N/A "AwEB/zALBgNVHQ8EBAMCAQYwDQYJKoZIhvcNAQEEBQADgYEAMIDZLdOLFiPyS1bh\n" +
1391N/A "Ch4eUYHT+K1WG93skbga3kVYg3GSe+gctwkKwKK13bwfi8zc7wwz6MtmQwEYhppc\n" +
1391N/A "pKKKEwi5QirBCP54rihLCvRQaj6ZqUJ6VP+zPAqHYMDbzlBbHtVF/1lQUP30I6SV\n" +
1391N/A "Fu987DvLmZ2GuQA9FKJsnlD9pbU=\n" +
1391N/A "-----END CERTIFICATE-----";
1391N/A
1391N/A // the target EE certificate
1391N/A static String targetCertStr =
1391N/A "-----BEGIN CERTIFICATE-----\n" +
1391N/A "MIICNzCCAaCgAwIBAgIBAjANBgkqhkiG9w0BAQQFADAxMQswCQYDVQQGEwJVUzEQ\n" +
1391N/A "MA4GA1UEChMHRXhhbXBsZTEQMA4GA1UECxMHQ2xhc3MtMTAeFw0wOTA2MjgxMzMy\n" +
1391N/A "MzBaFw0yOTAzMTUxMzMyMzBaMEExCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFt\n" +
1391N/A "cGxlMRAwDgYDVQQLEwdDbGFzcy0xMQ4wDAYDVQQDEwVBbGljZTCBnzANBgkqhkiG\n" +
1391N/A "9w0BAQEFAAOBjQAwgYkCgYEA7wnsvR4XEOfVznf40l8ClLod+7L0y2/+smVV+GM/\n" +
1391N/A "T1/QF/stajAJxXNy08gK00WKZ6ruTHhR9vh/Z6+EQM2RZDCpU0A7LPa3kLE/XTmS\n" +
1391N/A "1MLDu8ntkdlpURpvhdDWem+rl2HU5oZgzV8Jkcov9vXuSjqEDfr45FlPuV40T8+7\n" +
1391N/A "cxsCAwEAAaNPME0wCwYDVR0PBAQDAgPoMB0GA1UdDgQWBBSBwsAhi6Z1kriOs3ty\n" +
1391N/A "uSIujv9a3DAfBgNVHSMEGDAWgBRidC8Dt3dBzYESKpR2tR560sZ0+zANBgkqhkiG\n" +
1391N/A "9w0BAQQFAAOBgQDEiBqd5AMy2SQopFaS3dYkzj8MHlwtbCSoNVYkOfDnewcatrbk\n" +
1391N/A "yFcp6FX++PMdOQFHWvvnDdkCUAzZQp8kCkF9tGLVLBtOK7XxQ1us1LZym7kOPzsd\n" +
1391N/A "G93Dcf0U1JRO77juc61Br5paAy8Bok18Y/MeG7uKgB2MAEJYKhGKbCrfMw==\n" +
1391N/A "-----END CERTIFICATE-----";
1391N/A
1391N/A private static Set<TrustAnchor> generateTrustAnchors()
1391N/A throws CertificateException {
1391N/A // generate certificate from cert string
1391N/A CertificateFactory cf = CertificateFactory.getInstance("X.509");
1391N/A
1391N/A ByteArrayInputStream is =
1391N/A new ByteArrayInputStream(selfSignedCertStr.getBytes());
1391N/A Certificate selfSignedCert = cf.generateCertificate(is);
1391N/A
1391N/A // generate a trust anchor
1391N/A TrustAnchor anchor =
1391N/A new TrustAnchor((X509Certificate)selfSignedCert, null);
1391N/A
1391N/A return Collections.singleton(anchor);
1391N/A }
1391N/A
1391N/A private static CertStore generateCertificateStore() throws Exception {
1391N/A Collection entries = new HashSet();
1391N/A
1391N/A // generate certificate from certificate string
1391N/A CertificateFactory cf = CertificateFactory.getInstance("X.509");
1391N/A
1391N/A ByteArrayInputStream is;
1391N/A
1391N/A is = new ByteArrayInputStream(targetCertStr.getBytes());
1391N/A Certificate cert = cf.generateCertificate(is);
1391N/A entries.add(cert);
1391N/A
1391N/A is = new ByteArrayInputStream(subCaCertStr.getBytes());
1391N/A cert = cf.generateCertificate(is);
1391N/A entries.add(cert);
1391N/A
1391N/A is = new ByteArrayInputStream(selfSignedCertStr.getBytes());
1391N/A cert = cf.generateCertificate(is);
1391N/A entries.add(cert);
1391N/A
1391N/A is = new ByteArrayInputStream(topCrlIssuerCertStr.getBytes());
1391N/A cert = cf.generateCertificate(is);
1391N/A entries.add(cert);
1391N/A
1391N/A is = new ByteArrayInputStream(subCrlIssuerCertStr.getBytes());
1391N/A cert = cf.generateCertificate(is);
1391N/A entries.add(cert);
1391N/A
1391N/A return CertStore.getInstance("Collection",
1391N/A new CollectionCertStoreParameters(entries));
1391N/A }
1391N/A
1391N/A private static X509CertSelector generateSelector(String name)
1391N/A throws Exception {
1391N/A X509CertSelector selector = new X509CertSelector();
1391N/A
1391N/A // generate certificate from certificate string
1391N/A CertificateFactory cf = CertificateFactory.getInstance("X.509");
1391N/A ByteArrayInputStream is = null;
1391N/A if (name.equals("subca")) {
1391N/A is = new ByteArrayInputStream(subCaCertStr.getBytes());
1391N/A } else if (name.equals("subci")) {
1391N/A is = new ByteArrayInputStream(subCrlIssuerCertStr.getBytes());
1391N/A } else {
1391N/A is = new ByteArrayInputStream(targetCertStr.getBytes());
1391N/A }
1391N/A
1391N/A X509Certificate target = (X509Certificate)cf.generateCertificate(is);
1391N/A byte[] extVal = target.getExtensionValue("2.5.29.14");
1391N/A if (extVal != null) {
1391N/A DerInputStream in = new DerInputStream(extVal);
1391N/A byte[] subjectKID = in.getOctetString();
1391N/A selector.setSubjectKeyIdentifier(subjectKID);
1391N/A } else {
1391N/A // unlikely to happen.
1391N/A throw new Exception("unexpected certificate: no SKID extension");
1391N/A }
1391N/A
1391N/A return selector;
1391N/A }
1391N/A
1391N/A private static boolean match(String name, Certificate cert)
1391N/A throws Exception {
1391N/A X509CertSelector selector = new X509CertSelector();
1391N/A
1391N/A // generate certificate from certificate string
1391N/A CertificateFactory cf = CertificateFactory.getInstance("X.509");
1391N/A ByteArrayInputStream is = null;
1391N/A if (name.equals("subca")) {
1391N/A is = new ByteArrayInputStream(subCaCertStr.getBytes());
1391N/A } else if (name.equals("subci")) {
1391N/A is = new ByteArrayInputStream(subCrlIssuerCertStr.getBytes());
1391N/A } else {
1391N/A is = new ByteArrayInputStream(targetCertStr.getBytes());
1391N/A }
1391N/A X509Certificate target = (X509Certificate)cf.generateCertificate(is);
1391N/A
1391N/A return target.equals(cert);
1391N/A }
1391N/A
1391N/A
1391N/A public static void main(String[] args) throws Exception {
1391N/A CertPathBuilder builder = CertPathBuilder.getInstance("PKIX");
1391N/A
1391N/A X509CertSelector selector = generateSelector(args[0]);
1391N/A
1391N/A Set<TrustAnchor> anchors = generateTrustAnchors();
1391N/A CertStore certs = generateCertificateStore();
1391N/A
1391N/A
1391N/A PKIXBuilderParameters params =
1391N/A new PKIXBuilderParameters(anchors, selector);
1391N/A params.addCertStore(certs);
1391N/A params.setRevocationEnabled(false);
1391N/A params.setDate(new Date(109, 7, 1)); // 2009-07-01
1391N/A Security.setProperty("ocsp.enable", "false");
1391N/A System.setProperty("com.sun.security.enableCRLDP", "false");
1391N/A
1391N/A PKIXCertPathBuilderResult result =
1391N/A (PKIXCertPathBuilderResult)builder.build(params);
1391N/A
1391N/A if (!match(args[0], result.getCertPath().getCertificates().get(0))) {
1391N/A throw new Exception("unexpected certificate");
1391N/A }
1391N/A }
1391N/A}