1253N/A/*
2362N/A * Copyright (c) 2009, Oracle and/or its affiliates. All rights reserved.
1253N/A * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
1253N/A *
1253N/A * This code is free software; you can redistribute it and/or modify it
1253N/A * under the terms of the GNU General Public License version 2 only, as
1253N/A * published by the Free Software Foundation.
1253N/A *
1253N/A * This code is distributed in the hope that it will be useful, but WITHOUT
1253N/A * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
1253N/A * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
1253N/A * version 2 for more details (a copy is included in the LICENSE file that
1253N/A * accompanied this code).
1253N/A *
1253N/A * You should have received a copy of the GNU General Public License version
1253N/A * 2 along with this work; if not, write to the Free Software Foundation,
1253N/A * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
1253N/A *
2362N/A * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
2362N/A * or visit www.oracle.com if you need additional information or have any
2362N/A * questions.
1253N/A */
1253N/A
1253N/A/**
1253N/A * @test
1253N/A *
1253N/A * @bug 6845286
1253N/A * @summary Add regression test for name constraints
1253N/A * @author Xuelei Fan
1253N/A */
1253N/A
1253N/Aimport java.io.*;
1253N/Aimport java.net.SocketException;
1253N/Aimport java.util.*;
1253N/Aimport java.security.Security;
1253N/Aimport java.security.cert.*;
1253N/Aimport java.security.cert.CertPathValidatorException.BasicReason;
1253N/A
1253N/Apublic class NameConstraintsWithoutRID {
1253N/A
1253N/A static String selfSignedCertStr =
1253N/A "-----BEGIN CERTIFICATE-----\n" +
1253N/A "MIICTjCCAbegAwIBAgIJAIoSzC1A/k4vMA0GCSqGSIb3DQEBBQUAMB8xCzAJBgNV\n" +
1253N/A "BAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMB4XDTA5MDUwNzA5MjcxMloXDTMwMDQx\n" +
1253N/A "NzA5MjcxMlowHzELMAkGA1UEBhMCVVMxEDAOBgNVBAoTB0V4YW1wbGUwgZ8wDQYJ\n" +
1253N/A "KoZIhvcNAQEBBQADgY0AMIGJAoGBANXzlv5Fn2cdgBRdEK/37/o8rqQXIRIMZqX6\n" +
1253N/A "BPuo46Cdhctv+n3hu5bj/PwgJVbAJcqcQfDudSSF5gwGlRqDX9vekPSS47XZXjOZ\n" +
1253N/A "qFcnDoWP0gSQXLYVVtjuItkecTrPyUE5v2lRIAh13MGKOSh3ZsrtFvj7Y5d9EqIP\n" +
1253N/A "SLxWWPuHAgMBAAGjgZEwgY4wHQYDVR0OBBYEFFydJvQMB2j4EDHW2bQabNsPUvDt\n" +
1253N/A "ME8GA1UdIwRIMEaAFFydJvQMB2j4EDHW2bQabNsPUvDtoSOkITAfMQswCQYDVQQG\n" +
1253N/A "EwJVUzEQMA4GA1UEChMHRXhhbXBsZYIJAIoSzC1A/k4vMA8GA1UdEwEB/wQFMAMB\n" +
1253N/A "Af8wCwYDVR0PBAQDAgIEMA0GCSqGSIb3DQEBBQUAA4GBAHgoopmZ1Q4qXhMDbbYQ\n" +
1253N/A "YCi4Cg6cXPFblx5gzhWu/6l9SkvZbAZiLszgyMq5dGj9WyTtibNEp232dQsKTFu7\n" +
1253N/A "3ag0DiFqoQ8btgvbwBlzhnRagoeVFjhuBBQutOScw7x8NCSBkZQow+31127mwu3y\n" +
1253N/A "YGYhEmI2dNmgbv1hVYTGmLXW\n" +
1253N/A "-----END CERTIFICATE-----";
1253N/A
1253N/A static String subCaCertStr =
1253N/A "-----BEGIN CERTIFICATE-----\n" +
1253N/A "MIICdTCCAd6gAwIBAgIJAL+MYVyy7k5YMA0GCSqGSIb3DQEBBQUAMB8xCzAJBgNV\n" +
1253N/A "BAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMB4XDTA5MDUwNzA5MjcxNFoXDTI5MDEy\n" +
1253N/A "MjA5MjcxNFowMTELMAkGA1UEBhMCVVMxEDAOBgNVBAoTB0V4YW1wbGUxEDAOBgNV\n" +
1253N/A "BAsTB0NsYXNzLTEwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAM2mwX8dhP3M\n" +
1253N/A "i6ATRsd0wco+c7rsyEbP0CRQunVIP8/kOL8+zyQix+QZquY23tvBCbia424GXDkT\n" +
1253N/A "irvK/M4yGzrdS51hA5dlH3SHY3CWOAqEPqKtNLn1My4MWtTiUWbHi0YjFuOv0BXz\n" +
1253N/A "x9lTEfMf+3QcOgO5FitcqHIMP4jIlT+lAgMBAAGjgaYwgaMwHQYDVR0OBBYEFJHg\n" +
1253N/A "eyEWcjxcAwc01BPQrau/4HJaME8GA1UdIwRIMEaAFFydJvQMB2j4EDHW2bQabNsP\n" +
1253N/A "UvDtoSOkITAfMQswCQYDVQQGEwJVUzEQMA4GA1UEChMHRXhhbXBsZYIJAIoSzC1A\n" +
1253N/A "/k4vMA8GA1UdEwEB/wQFMAMBAf8wCwYDVR0PBAQDAgIEMBMGA1UdHgQMMAqhCDAG\n" +
1253N/A "iAQqAwQFMA0GCSqGSIb3DQEBBQUAA4GBAI3CDQWZiTlVVVqfCiZwc/yIL7G5bu2g\n" +
1253N/A "ccgVz9PyKfTpq8vk59S23TvPwdPt4ZVx4RSoar9ONtbrcLxfP3X6WQ7e9popWNZV\n" +
1253N/A "q49YfyU1tD5HFuxj7CAsvfykuRo4ovXaTCVWlTMi7fJJdzU0Eb4xkXXhiWT/RbHG\n" +
1253N/A "R7J+8ROMZ+nR\n" +
1253N/A "-----END CERTIFICATE-----";
1253N/A
1253N/A static String targetCertStr =
1253N/A "-----BEGIN CERTIFICATE-----\n" +
1253N/A "MIICPTCCAaagAwIBAgIJAOA8c10w019WMA0GCSqGSIb3DQEBBQUAMDExCzAJBgNV\n" +
1253N/A "BAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMRAwDgYDVQQLEwdDbGFzcy0xMB4XDTA5\n" +
1253N/A "MDUwNzEwMjY0MloXDTI5MDEyMjEwMjY0MlowPzELMAkGA1UEBhMCVVMxEDAOBgNV\n" +
1253N/A "BAoTB0V4YW1wbGUxEDAOBgNVBAsTB0NsYXNzLTExDDAKBgNVBAMTA0JvYjCBnzAN\n" +
1253N/A "BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAx4N+y29y5mAGnVQHA3x3fQehxm3nFohQ\n" +
1253N/A "gKV10bZ24/hwZn6rZXG6VsBaqkrgw7ipRZzk99etihAomAFL9k0q/0nxFP/Ovwio\n" +
1253N/A "NzacF3vpv85FF6ATwY1Zs+p4hfxU3WnnyyS9la9Z3o5QBhQbV/WjA/JSG5+ImQFp\n" +
1253N/A "nLkPfzU4wXECAwEAAaNPME0wCwYDVR0PBAQDAgPoMB0GA1UdDgQWBBTxUJG+QewS\n" +
1253N/A "rSGcuiJy+K4gb1g/BzAfBgNVHSMEGDAWgBSR4HshFnI8XAMHNNQT0K2rv+ByWjAN\n" +
1253N/A "BgkqhkiG9w0BAQUFAAOBgQA9fDeTtSXmP/MEni0vtAmgTPd6R31NcPWKibDizwYS\n" +
1253N/A "BWjUMcbTN8xeXjm4uQLMK8ZQy2+cmNrTvQ59BZ8Y97y7SJUcBLOW5eivO/mKuBsC\n" +
1253N/A "ACB9IxBUGVEwNup7KJ5ixox5jKt+qPwzCheyQQb9NEDJdB0YaHRhFpCcpCFak8yK\n" +
1253N/A "/A==\n" +
1253N/A "-----END CERTIFICATE-----";
1253N/A
1253N/A private static CertPath generateCertificatePath()
1253N/A throws CertificateException {
1253N/A // generate certificate from cert strings
1253N/A CertificateFactory cf = CertificateFactory.getInstance("X.509");
1253N/A
1253N/A ByteArrayInputStream is;
1253N/A
1253N/A is = new ByteArrayInputStream(targetCertStr.getBytes());
1253N/A Certificate targetCert = cf.generateCertificate(is);
1253N/A
1253N/A is = new ByteArrayInputStream(subCaCertStr.getBytes());
1253N/A Certificate subCaCert = cf.generateCertificate(is);
1253N/A
1253N/A is = new ByteArrayInputStream(selfSignedCertStr.getBytes());
1253N/A Certificate selfSignedCert = cf.generateCertificate(is);
1253N/A
1253N/A // generate certification path
1253N/A List<Certificate> list = Arrays.asList(new Certificate[] {
1253N/A targetCert, subCaCert, selfSignedCert});
1253N/A
1253N/A return cf.generateCertPath(list);
1253N/A }
1253N/A
1253N/A private static Set<TrustAnchor> generateTrustAnchors()
1253N/A throws CertificateException {
1253N/A // generate certificate from cert string
1253N/A CertificateFactory cf = CertificateFactory.getInstance("X.509");
1253N/A
1253N/A ByteArrayInputStream is =
1253N/A new ByteArrayInputStream(selfSignedCertStr.getBytes());
1253N/A Certificate selfSignedCert = cf.generateCertificate(is);
1253N/A
1253N/A // generate a trust anchor
1253N/A TrustAnchor anchor =
1253N/A new TrustAnchor((X509Certificate)selfSignedCert, null);
1253N/A
1253N/A return Collections.singleton(anchor);
1253N/A }
1253N/A
1253N/A public static void main(String args[]) throws Exception {
1253N/A CertPath path = generateCertificatePath();
1253N/A Set<TrustAnchor> anchors = generateTrustAnchors();
1253N/A
1253N/A PKIXParameters params = new PKIXParameters(anchors);
1253N/A
1253N/A // disable certificate revocation checking
1253N/A params.setRevocationEnabled(false);
1253N/A
1253N/A // set the validation time
1253N/A params.setDate(new Date(109, 5, 8)); // 2009-05-01
1253N/A
1253N/A // disable OCSP checker
1253N/A Security.setProperty("ocsp.enable", "false");
1253N/A
1253N/A // disable CRL checker
1253N/A System.setProperty("com.sun.security.enableCRLDP", "false");
1253N/A
1253N/A CertPathValidator validator = CertPathValidator.getInstance("PKIX");
1253N/A
1253N/A try {
1253N/A validator.validate(path, params);
1253N/A } catch (CertPathValidatorException uoe) {
1253N/A // unexpected exception, rethrow it.
1253N/A throw uoe;
1253N/A }
1253N/A }
1253N/A}