March 2, 2020

Creating X509 Certificate with Bouncy Castle

Bouncy Castle has X509 Certificate builder but in my opinion it is still quite low tech.


package se.magnuskkarlsson.example.bouncycastle;

import java.io.IOException;
import java.io.OutputStream;
import java.math.BigInteger;
import java.security.NoSuchAlgorithmException;
import java.security.PrivateKey;
import java.security.PublicKey;
import java.security.cert.CertificateException;
import java.util.Calendar;
import java.util.Date;

import org.bouncycastle.asn1.ASN1Encodable;
import org.bouncycastle.asn1.ASN1EncodableVector;
import org.bouncycastle.asn1.ASN1Encoding;
import org.bouncycastle.asn1.ASN1Integer;
import org.bouncycastle.asn1.ASN1Object;
import org.bouncycastle.asn1.ASN1ObjectIdentifier;
import org.bouncycastle.asn1.DERBitString;
import org.bouncycastle.asn1.DERSequence;
import org.bouncycastle.asn1.DERTaggedObject;
import org.bouncycastle.asn1.DERUTF8String;
import org.bouncycastle.asn1.x500.X500Name;
import org.bouncycastle.asn1.x509.AccessDescription;
import org.bouncycastle.asn1.x509.AlgorithmIdentifier;
import org.bouncycastle.asn1.x509.AuthorityInformationAccess;
import org.bouncycastle.asn1.x509.BasicConstraints;
import org.bouncycastle.asn1.x509.CRLDistPoint;
import org.bouncycastle.asn1.x509.Certificate;
import org.bouncycastle.asn1.x509.CertificatePolicies;
import org.bouncycastle.asn1.x509.DistributionPoint;
import org.bouncycastle.asn1.x509.DistributionPointName;
import org.bouncycastle.asn1.x509.ExtendedKeyUsage;
import org.bouncycastle.asn1.x509.Extension;
import org.bouncycastle.asn1.x509.ExtensionsGenerator;
import org.bouncycastle.asn1.x509.GeneralName;
import org.bouncycastle.asn1.x509.GeneralNames;
import org.bouncycastle.asn1.x509.KeyPurposeId;
import org.bouncycastle.asn1.x509.PolicyInformation;
import org.bouncycastle.asn1.x509.SubjectPublicKeyInfo;
import org.bouncycastle.asn1.x509.TBSCertificate;
import org.bouncycastle.asn1.x509.Time;
import org.bouncycastle.asn1.x509.V3TBSCertificateGenerator;
import org.bouncycastle.cert.X509CertificateHolder;
import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;
import org.bouncycastle.cert.jcajce.JcaX509ExtensionUtils;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
import org.bouncycastle.operator.ContentSigner;
import org.bouncycastle.operator.OperatorCreationException;
import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;

// org.bouncycastle.cert.X509v3CertificateBuilder
public class X509CertificateBuilder {

    public static final ASN1ObjectIdentifier MSUPN_OID = new ASN1ObjectIdentifier("1.3.6.1.4.1.311.20.2.3");

    private V3TBSCertificateGenerator tbsGen;
    private ExtensionsGenerator extGenerator;

    public X509CertificateBuilder() {
        this.tbsGen = new V3TBSCertificateGenerator();
        this.extGenerator = new ExtensionsGenerator();
    }

    // ----------------------- Logic Methods -----------------------

    //
    // Mandatory Fields
    //

    public X509CertificateBuilder setSerialNumber(BigInteger serialNumber) {
        tbsGen.setSerialNumber(new ASN1Integer(serialNumber));
        return this;
    }

    public X509CertificateBuilder setIssuerDN(X500Name issuerDN) {
        this.tbsGen.setIssuer(issuerDN);
        return this;
    }

    public X509CertificateBuilder setValidity(int numberOfYears) {
        Date validityNotBefore = new Date(System.currentTimeMillis());
        Calendar calendar = Calendar.getInstance();
        calendar.setTime(validityNotBefore);
        // calendar.add(Calendar.DAY_OF_YEAR, numberOfYears);
        calendar.add(Calendar.YEAR, numberOfYears);
        Date validityNotAfter = calendar.getTime();
        this.tbsGen.setStartDate(new Time(validityNotBefore));
        this.tbsGen.setEndDate(new Time(validityNotAfter));
        return this;
    }

    public X509CertificateBuilder setSubjectDN(X500Name subjectDN) {
        this.tbsGen.setSubject(subjectDN);
        return this;
    }

    public X509CertificateBuilder setSubjectPublicKeyInfo(PublicKey publicKey) {
        SubjectPublicKeyInfo subjectPublicKeyInfo = SubjectPublicKeyInfo.getInstance(publicKey.getEncoded());
        this.tbsGen.setSubjectPublicKeyInfo(subjectPublicKeyInfo);
        return this;
    }

    //
    // Certificate Extensions
    //

    public X509CertificateBuilder setBasicContraints(boolean ca, boolean critical) throws IOException {
        this.extGenerator.addExtension(Extension.basicConstraints, critical, new BasicConstraints(ca));
        return this;
    }

    public X509CertificateBuilder setAuthorityKeyIdentifier(PublicKey caPublicKey, boolean critical)
            throws NoSuchAlgorithmException, IOException {

        this.extGenerator.addExtension(Extension.authorityKeyIdentifier, critical,
                new JcaX509ExtensionUtils().createAuthorityKeyIdentifier(caPublicKey));
        return this;
    }

    public X509CertificateBuilder setSubjectKeyIdentifier(PublicKey publicKey, boolean critical)
            throws NoSuchAlgorithmException, IOException {

        this.extGenerator.addExtension(Extension.subjectKeyIdentifier, critical,
                new JcaX509ExtensionUtils().createSubjectKeyIdentifier(publicKey));
        return this;
    }

    public X509CertificateBuilder setAuthorityInformationAccess(String ocspUri, String caIssuersUri, boolean critical)
            throws IOException {

        GeneralName ocspName = new GeneralName(GeneralName.uniformResourceIdentifier, ocspUri);
        GeneralName caIssuersName = new GeneralName(GeneralName.uniformResourceIdentifier, caIssuersUri);

        AccessDescription ocsp = new AccessDescription(AccessDescription.id_ad_ocsp, ocspName);
        AccessDescription caIssuers = new AccessDescription(AccessDescription.id_ad_caIssuers, caIssuersName);

        AuthorityInformationAccess authorityInformationAccess = new AuthorityInformationAccess(
                new AccessDescription[] { ocsp, caIssuers });
        this.extGenerator.addExtension(Extension.authorityInfoAccess, critical, authorityInformationAccess);
        return this;
    }

    public X509CertificateBuilder setCRLDistributionPoints(String cdpUri, boolean critical) throws IOException {
        GeneralNames generalNames = new GeneralNames(new GeneralName(GeneralName.uniformResourceIdentifier, cdpUri));
        DistributionPoint[] distPoints = new DistributionPoint[] {
                new DistributionPoint(new DistributionPointName(generalNames), null, null) };
        this.extGenerator.addExtension(Extension.cRLDistributionPoints, critical, new CRLDistPoint(distPoints));
        return this;
    }

    public X509CertificateBuilder setCertificatePolicies(String[] certificatePolicyIds, boolean critical)
            throws IOException {

        PolicyInformation[] policyInfos = new PolicyInformation[certificatePolicyIds.length];
        for (int i = 0; i < certificatePolicyIds.length; ++i) {
            policyInfos[i] = new PolicyInformation(new ASN1ObjectIdentifier(certificatePolicyIds[i]));
        }
        this.extGenerator.addExtension(Extension.certificatePolicies, critical, new CertificatePolicies(policyInfos));
        return this;
    }

    public X509CertificateBuilder setKeyUsage(KeyUsage keyUsage1, boolean critical) throws IOException {
        this.extGenerator.addExtension(Extension.keyUsage, critical,
                new org.bouncycastle.asn1.x509.KeyUsage(keyUsage1.getValue()));
        return this;
    }

    public X509CertificateBuilder setKeyUsage(KeyUsage keyUsage1, KeyUsage keyUsage2, boolean critical)
            throws IOException {

        this.extGenerator.addExtension(Extension.keyUsage, critical,
                new org.bouncycastle.asn1.x509.KeyUsage(keyUsage1.getValue() | keyUsage2.getValue()));
        return this;
    }

    public X509CertificateBuilder setKeyUsage(KeyUsage keyUsage1, KeyUsage keyUsage2, KeyUsage keyUsage3,
            boolean critical) throws IOException {

        this.extGenerator.addExtension(Extension.keyUsage, critical, new org.bouncycastle.asn1.x509.KeyUsage(
                keyUsage1.getValue() | keyUsage2.getValue() | keyUsage3.getValue()));
        return this;
    }

    public X509CertificateBuilder setExtendedKeyUsage(KeyPurposeId[] keyPurposeIds, boolean critical)
            throws IOException {

        this.extGenerator.addExtension(Extension.extendedKeyUsage, critical, new ExtendedKeyUsage(keyPurposeIds));
        return this;
    }

    public X509CertificateBuilder setSubjectAlternativeNamesDNS(String[] hostnames, boolean critical)
            throws IOException {

        GeneralName[] generalNames = new GeneralName[hostnames.length];
        for (int i = 0; i < hostnames.length; ++i) {
            generalNames[i] = new GeneralName(GeneralName.dNSName, hostnames[i]);
        }
        this.extGenerator.addExtension(Extension.subjectAlternativeName, critical, new GeneralNames(generalNames));
        return this;
    }

    public X509CertificateBuilder setSubjectAlternativeNamesUPN(String upn, boolean critical) throws IOException {
        this.extGenerator.addExtension(Extension.subjectAlternativeName, critical, new GeneralNames(new GeneralName(
                GeneralName.otherName,
                new DERSequence(new ASN1Encodable[] { MSUPN_OID, new DERTaggedObject(0, new DERUTF8String(upn)) }))));
        return this;
    }

    public java.security.cert.X509Certificate build(PrivateKey caPrivateKey, String signatureAlgorithm)
            throws OperatorCreationException, CertificateException, NoSuchAlgorithmException, IOException {

        ContentSigner contentSigner = new JcaContentSignerBuilder(signatureAlgorithm)
                .setProvider(BouncyCastleProvider.PROVIDER_NAME).build(caPrivateKey);

        this.tbsGen.setSignature(contentSigner.getAlgorithmIdentifier());
        this.tbsGen.setExtensions(this.extGenerator.generate());

        TBSCertificate tbsCert = tbsGen.generateTBSCertificate();
        X509CertificateHolder X509CertificateHolder = new X509CertificateHolder(generateStructure(tbsCert,
                contentSigner.getAlgorithmIdentifier(), generateSig(contentSigner, tbsCert)));

        return new JcaX509CertificateConverter().getCertificate(X509CertificateHolder);
    }

    // ----------------------- Helper Methods -----------------------

    // org.bouncycastle.asn1.x509.KeyUsage
    public enum KeyUsage {

        DIGITAL_SIGNATURE(org.bouncycastle.asn1.x509.KeyUsage.digitalSignature), //
        NON_REPUDIATION(org.bouncycastle.asn1.x509.KeyUsage.nonRepudiation), //
        KEY_ENCIPHERMENT(org.bouncycastle.asn1.x509.KeyUsage.keyEncipherment), //
        DATA_ENCIPHERMENT(org.bouncycastle.asn1.x509.KeyUsage.dataEncipherment), //
        KEY_AGREEMENT(org.bouncycastle.asn1.x509.KeyUsage.keyAgreement), //
        KEY_CERT_SIGN(org.bouncycastle.asn1.x509.KeyUsage.keyCertSign), //
        CRL_SIGN(org.bouncycastle.asn1.x509.KeyUsage.cRLSign);

        private final int value;

        KeyUsage(int value) {
            this.value = value;
        }

        public int getValue() {
            return value;
        }
    }

    protected byte[] generateSig(ContentSigner signer, ASN1Object tbsObj) throws IOException {
        OutputStream sOut = signer.getOutputStream();
        tbsObj.encodeTo(sOut, ASN1Encoding.DER);
        sOut.close();
        return signer.getSignature();
    }

    protected Certificate generateStructure(TBSCertificate tbsCert, AlgorithmIdentifier sigAlgId, byte[] signature) {
        ASN1EncodableVector v = new ASN1EncodableVector();
        v.add(tbsCert);
        v.add(sigAlgId);
        v.add(new DERBitString(signature));
        return Certificate.getInstance(new DERSequence(v));
    }

    // ----------------------- Get and Set Methods -----------------------

}

And certificate profile builder.


package se.magnuskkarlsson.example.bouncycastle;

import java.io.IOException;
import java.math.BigInteger;
import java.security.KeyPair;
import java.security.NoSuchAlgorithmException;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;

import org.bouncycastle.asn1.x500.X500Name;
import org.bouncycastle.asn1.x509.KeyPurposeId;
import org.bouncycastle.operator.OperatorCreationException;

import se.magnuskkarlsson.example.bouncycastle.X509CertificateBuilder.KeyUsage;

public class X509CertificateProfile {

    // ----------------------- Logic Methods -----------------------

    public X509Certificate createCA(KeyPair caKeyPair, X500Name subjectDN, String cdpUri)
            throws OperatorCreationException, CertificateException, NoSuchAlgorithmException, IOException {

        return new X509CertificateBuilder() //
                // mandatory fields
                .setSerialNumber(getSerialNumber()) //
                .setIssuerDN(subjectDN) //
                .setValidity(10) //
                .setSubjectDN(subjectDN) //
                .setSubjectPublicKeyInfo(caKeyPair.getPublic()) //
                // certificate extensions
                .setBasicContraints(true, true) //
                .setAuthorityKeyIdentifier(caKeyPair.getPublic(), false) //
                .setSubjectKeyIdentifier(caKeyPair.getPublic(), false) //
                .setCRLDistributionPoints(cdpUri, false) //
                .setKeyUsage(KeyUsage.DIGITAL_SIGNATURE, KeyUsage.KEY_CERT_SIGN, KeyUsage.CRL_SIGN, true) //
                .build(caKeyPair.getPrivate(), CAKeyStore.SHA256_RSA_SIGNATURE);
    }

    public X509Certificate createServer(KeyPair caKeyPair, KeyPair keyPair, X500Name issuerDN, X500Name subjectDN,
            String ocspUri, String caIssuersUri, String cdpUri, String[] hostnames)
            throws OperatorCreationException, CertificateException, NoSuchAlgorithmException, IOException {

        return new X509CertificateBuilder() //
                // mandatory fields
                .setSerialNumber(getSerialNumber()) //
                .setIssuerDN(issuerDN) //
                .setValidity(1) //
                .setSubjectDN(subjectDN) //
                .setSubjectPublicKeyInfo(keyPair.getPublic()) //
                // certificate extensions
                .setBasicContraints(false, true) //
                .setAuthorityKeyIdentifier(caKeyPair.getPublic(), false) //
                .setSubjectKeyIdentifier(keyPair.getPublic(), false) //
                .setAuthorityInformationAccess(ocspUri, caIssuersUri, false) //
                .setCRLDistributionPoints(cdpUri, false) //
                .setKeyUsage(KeyUsage.DIGITAL_SIGNATURE, KeyUsage.KEY_ENCIPHERMENT, false) //
                .setExtendedKeyUsage(new KeyPurposeId[] { KeyPurposeId.id_kp_serverAuth }, false)
                .setSubjectAlternativeNamesDNS(hostnames, false) //
                .build(caKeyPair.getPrivate(), CAKeyStore.SHA256_RSA_SIGNATURE);
    }

    public X509Certificate createClient(KeyPair caKeyPair, KeyPair keyPair, X500Name issuerDN, X500Name subjectDN,
            String ocspUri, String caIssuersUri, String cdpUri, String upn)
            throws OperatorCreationException, CertificateException, NoSuchAlgorithmException, IOException {

        return new X509CertificateBuilder() //
                // mandatory fields
                .setSerialNumber(getSerialNumber()) //
                .setIssuerDN(issuerDN) //
                .setValidity(1) //
                .setSubjectDN(subjectDN) //
                .setSubjectPublicKeyInfo(keyPair.getPublic()) //
                // certificate extensions
                .setBasicContraints(false, true) //
                .setAuthorityKeyIdentifier(caKeyPair.getPublic(), false) //
                .setSubjectKeyIdentifier(keyPair.getPublic(), false) //
                .setAuthorityInformationAccess(ocspUri, caIssuersUri, false) //
                .setCRLDistributionPoints(cdpUri, false) //
                .setKeyUsage(KeyUsage.DIGITAL_SIGNATURE, KeyUsage.NON_REPUDIATION, KeyUsage.KEY_ENCIPHERMENT, true) //
                .setExtendedKeyUsage(new KeyPurposeId[] { KeyPurposeId.id_kp_clientAuth }, false)
                .setSubjectAlternativeNamesUPN(upn, false) //
                .build(caKeyPair.getPrivate(), CAKeyStore.SHA256_RSA_SIGNATURE);
    }

    // ----------------------- Helper Methods -----------------------

    protected BigInteger getSerialNumber() {
        // RFC 5280 and X.690

        // Effective September 30, 2016, CAs SHALL generate non-sequential Certificate serial numbers greater than zero
        // (0) containing at least 64 bits of output from a CSPRNG.
        return BigInteger.valueOf(System.currentTimeMillis());
    }

    // ----------------------- Get and Set Methods -----------------------

}

And unit test.


package se.magnuskkarlsson.example.bouncycastle;

import java.io.File;
import java.security.KeyPair;
import java.security.Security;
import java.security.cert.X509Certificate;

import org.bouncycastle.asn1.x500.X500Name;
import org.bouncycastle.asn1.x500.X500NameBuilder;
import org.bouncycastle.asn1.x500.style.BCStyle;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
import org.junit.After;
import org.junit.AfterClass;
import org.junit.Before;
import org.junit.BeforeClass;
import org.junit.Test;

public class X509CertificateProfileTest {

    private static KeyPair caKeyPair;
    private static X500Name caSubjectDN;
    private String ocspUri = "http://ocsp.mkk.se/";
    private String caIssuersUri = "http://pki.mkk.se/ca.crt";
    private String cdpUri = "http://crl.mkk.se/ca.crl";

    @BeforeClass
    public static void oneTimeSetUp() throws Exception {
        Security.addProvider(new BouncyCastleProvider());
        caKeyPair = new CAKeyStore(new Configurations()).createKeyPair(CAKeyStore.RSA_ALGORITHM, 4096);
        caSubjectDN = new X500NameBuilder() //
                .addRDN(BCStyle.CN, "FOO CA") //
                .addRDN(BCStyle.O, "MKK") //
                .addRDN(BCStyle.C, "SE") //
                .build();
    }

    @Before
    public void setUp() throws Exception {
    }

    @After
    public void tearDown() {
    }

    @AfterClass
    public static void oneTimeTearDown() throws Exception {
    }

    // ----------------------- Test Methods -----------------------

    @Test
    public void createCA() throws Exception {
        X509Certificate caCert = new X509CertificateProfile().createCA(caKeyPair, caSubjectDN, cdpUri);

        System.out.println(caCert);
        EncryptionUtils.writePEM(caCert, File.createTempFile("caCert-", ".crt.pem"));
    }

    @Test
    public void createServer() throws Exception {
        KeyPair serverKeyPair = new CAKeyStore(new Configurations()).createKeyPair(CAKeyStore.RSA_ALGORITHM, 2048);
        X500Name serverSubjectDN = new X500NameBuilder() //
                .addRDN(BCStyle.CN, "FQDN") //
                .addRDN(BCStyle.OU, "mywebapp") //
                .addRDN(BCStyle.O, "MKK") //
                .addRDN(BCStyle.C, "SE") //
                .build();
        String[] hostnames = new String[] { "localhost", "127.0.0.1" };

        X509Certificate serverCert = new X509CertificateProfile().createServer(caKeyPair, serverKeyPair, caSubjectDN,
                serverSubjectDN, ocspUri, caIssuersUri, cdpUri, hostnames);

        System.out.println(serverCert);
        EncryptionUtils.writePEM(serverCert, File.createTempFile("serverCert-", ".crt.pem"));
    }

    @Test
    public void createClient() throws Exception {
        X509Certificate caCert = new X509CertificateProfile().createCA(caKeyPair, caSubjectDN, cdpUri);

        KeyPair clientKeyPair = new CAKeyStore(new Configurations()).createKeyPair(CAKeyStore.RSA_ALGORITHM, 2048);
        X500Name clientSubjectDN = new X500NameBuilder() //
                .addRDN(BCStyle.CN, "Magnus K Karlsson") //
                .addRDN(BCStyle.OU, "1000") //
                .addRDN(BCStyle.O, "MKK") //
                .addRDN(BCStyle.C, "SE") //
                .build();
        String upn = "1000@mkk.se";

        X509Certificate clientCert = new X509CertificateProfile().createClient(caKeyPair, clientKeyPair, caSubjectDN,
                clientSubjectDN, ocspUri, caIssuersUri, cdpUri, upn);

        System.out.println(clientCert);
        EncryptionUtils.writePEM(clientCert, File.createTempFile("clientCert-", ".cert.pem"));
        System.out.println(EncryptionUtils.getMSUPN(clientCert));
        EncryptionUtils.writeKeyStore("PKCS12", clientKeyPair.getPrivate(), "changeit",
                new X509Certificate[] { clientCert, caCert }, File.createTempFile("clientCert-", ".p12"));
    }

}

And when run.


[
[
  Version: V3
  Subject: C=SE, O=MKK, OU=1000, CN=Magnus K Karlsson
  Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11

  Key:  Sun RSA public key, 2048 bits
  params: null
  modulus: 25571568211886603124840374772893412632803008320276441343266420556001859527212495329059106511242070860135631150070936589994653782417968024014212169649126808218158560179639047989539457693799118359900429037050920421546627123472786524557783697159392478858239658746621633838155562268034256430543588459559201972100435495705680421356703692111342204230448132868538272476016901917159213800485636336183819543618065791989738031811366034365221624184676389882604646322575407826629234052470133086130458566129601941794090632783578168688778972919128563980379914647410944834699287955276441401709227130144873341655798718948150387040663
  public exponent: 65537
  Validity: [From: Mon Mar 02 20:35:28 CET 2020,
               To: Tue Mar 02 20:35:28 CET 2021]
  Issuer: C=SE, O=MKK, CN=FOO CA
  SerialNumber: [    01709cbf 0140]

Certificate Extensions: 8
[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=false
AuthorityInfoAccess [
  [
   accessMethod: ocsp
   accessLocation: URIName: http://ocsp.mkk.se/
, 
   accessMethod: caIssuers
   accessLocation: URIName: http://pki.mkk.se/ca.crt
]
]

[2]: ObjectId: 2.5.29.35 Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: 13 5B F4 D2 4E 05 F0 73   9D D0 60 C4 42 A3 80 95  .[..N..s..`.B...
0010: 37 7B 9A 1B                                        7...
]
]

[3]: ObjectId: 2.5.29.19 Criticality=true
BasicConstraints:[
  CA:false
  PathLen: undefined
]

[4]: ObjectId: 2.5.29.31 Criticality=false
CRLDistributionPoints [
  [DistributionPoint:
     [URIName: http://crl.mkk.se/ca.crl]
]]

[5]: ObjectId: 2.5.29.37 Criticality=false
ExtendedKeyUsages [
  clientAuth
]

[6]: ObjectId: 2.5.29.15 Criticality=true
KeyUsage [
  DigitalSignature
  Non_repudiation
  Key_Encipherment
]

[7]: ObjectId: 2.5.29.17 Criticality=false
SubjectAlternativeName [
  Other-Name: Unrecognized ObjectIdentifier: 1.3.6.1.4.1.311.20.2.3
]

[8]: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 63 31 5B A3 22 8C C0 4B   DF 2D 7B 39 4C 43 D2 DB  c1[."..K.-.9LC..
0010: 11 96 37 46                                        ..7F
]
]

]
  Algorithm: [SHA256withRSA]
  Signature:
0000: 85 9B 22 22 44 4E E0 59   44 31 12 53 39 D5 A4 78  ..""DN.YD1.S9..x
0010: DA 39 80 BC 53 47 94 D1   B3 B6 E3 2B 8F D4 39 92  .9..SG.....+..9.
0020: 7B 63 CE FA 48 53 33 BF   B6 4B E7 83 90 47 AA 2D  .c..HS3..K...G.-
0030: 32 B6 02 9F A9 1B EE 27   02 7C 68 B2 9F 50 D4 D2  2......'..h..P..
0040: 55 2C A4 B6 1C 09 F1 BF   AE 0A A6 39 60 DE 93 CA  U,.........9`...
0050: 74 32 54 8F 74 E0 5B F8   0D 32 FE 6E 02 6B 88 9D  t2T.t.[..2.n.k..
0060: 2F D7 0C 9D A7 DE 20 5B   10 0A 08 61 1A 76 B0 35  /..... [...a.v.5
0070: 80 E3 AF C6 4C A9 06 E0   38 2F 9F D8 48 E8 BE DC  ....L...8/..H...
0080: 89 C0 DF 64 E2 F3 72 3C   BC 51 A8 D9 F2 1E 18 4A  ...d..r<.Q.....J
0090: 1B 52 1D E1 2E D7 EA 23   37 4C CA 4C A6 8A E6 85  .R.....#7L.L....
00A0: 60 7D 29 63 4F A0 90 37   29 EE CF 0E 0E 05 0E 85  `.)cO..7).......
00B0: 93 47 63 BC 7C CF CE 58   58 71 72 56 76 45 63 0A  .Gc....XXqrVvEc.
00C0: D6 33 BD EF 53 9A 8C F1   19 EE E7 AE 8E 8E 76 A0  .3..S.........v.
00D0: 37 7B BE 45 B5 C8 7B 72   FD 29 8B 80 0B 74 5E 24  7..E...r.)...t^$
00E0: 71 66 3D C9 39 A0 6B 24   B2 91 09 57 9C B7 2D 2E  qf=.9.k$...W..-.
00F0: 82 B8 D7 CA 7A 71 CF 05   2C 97 89 76 DC 3D 2A B8  ....zq..,..v.=*.
0100: 10 A0 8C 27 8D 49 2A 23   C9 8E FB D1 2B 55 00 6D  ...'.I*#....+U.m
0110: 76 CE 2D 86 8A E1 4D B4   1C 9E 8C 47 15 BC 7F DF  v.-...M....G....
0120: 20 23 D1 09 27 A3 DB 9B   7F AC D9 AE D7 72 D3 A3   #..'........r..
0130: E0 20 63 91 1A 49 A6 77   3E B2 EE F0 B1 57 8D 77  . c..I.w>....W.w
0140: 62 11 3C E2 17 28 6F CB   BE 44 14 A3 06 23 89 74  b.<..(o..D...#.t
0150: DE 05 75 DC CB D7 2A 86   3D 9A FA 29 94 00 82 09  ..u...*.=..)....
0160: 3D B1 DE A9 12 F1 48 30   F2 5C 52 10 0D 81 CA 5A  =.....H0.\R....Z
0170: 69 8A 9B F5 3B 7A F4 CB   8A D7 51 AE 5A CD A1 51  i...;z....Q.Z..Q
0180: FA F8 66 AF FC 02 68 2D   E9 CC D7 AF C1 FA 21 84  ..f...h-......!.
0190: 0C 1B 7A 0F DE B9 3D 9A   8A 1A 61 BC 46 01 3A FD  ..z...=...a.F.:.
01A0: 62 E3 79 35 07 66 64 A7   17 83 5E 82 E9 93 A2 FA  b.y5.fd...^.....
01B0: 6F D7 83 38 99 5F 44 69   6C AA F3 32 E4 B4 48 59  o..8._Dil..2..HY
01C0: 50 EC 64 14 72 51 9A E9   95 BC 4E CE EA 98 B3 BD  P.d.rQ....N.....
01D0: 7C F4 BD D2 60 D3 07 7C   71 26 24 55 94 E5 AA D5  ....`...q&$U....
01E0: 44 A1 8D AC 30 AE 47 CA   FF 96 FD CA 9E 03 25 EC  D...0.G.......%.
01F0: 55 5B 97 5B 27 24 A3 23   8F 0D CD 9A DC 52 29 BA  U[.['$.#.....R).

]
Mar 02, 2020 8:35:28 PM se.magnuskkarlsson.example.bouncycastle.EncryptionUtils writePEM
INFO: Wrote /tmp/clientCert-9146518211353882041.cert.pem
Mar 02, 2020 8:35:28 PM se.magnuskkarlsson.example.bouncycastle.EncryptionUtils getMSUPN
INFO: Read X509 SAN [[0, [1.3.6.1.4.1.311.20.2.3, [0]1000@mkk.se]]]
1000@mkk.se
Mar 02, 2020 8:35:28 PM se.magnuskkarlsson.example.bouncycastle.EncryptionUtils writeKeyStore
INFO: Wrote /tmp/clientCert-14620146327205577598.p12
[
[
  Version: V3
  Subject: C=SE, O=MKK, OU=mywebapp, CN=FQDN
  Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11

  Key:  Sun RSA public key, 2048 bits
  params: null
  modulus: 23472554064383360225540326318244541407904103528288156342671235877676704006249990542080185400202587647452428079635384512450814661982177331214162132359638484764547017758245274776079283522876250682767182225000730754889702275736425322221042334223219623764657811814147865593555449798942802445890347917633973214547390327111222760190458870434688746315828193389701570278446761804026480172159526376218012304574882822703261195947214666386714673839238432567588108434506291951836819612851494156727230958145708637864415669786989760083242288799613934351495483902217961576331883073677917645326766725734237025938297058790630425487583
  public exponent: 65537
  Validity: [From: Mon Mar 02 20:35:28 CET 2020,
               To: Tue Mar 02 20:35:28 CET 2021]
  Issuer: C=SE, O=MKK, CN=FOO CA
  SerialNumber: [    01709cbf 02ae]

Certificate Extensions: 8
[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=false
AuthorityInfoAccess [
  [
   accessMethod: ocsp
   accessLocation: URIName: http://ocsp.mkk.se/
, 
   accessMethod: caIssuers
   accessLocation: URIName: http://pki.mkk.se/ca.crt
]
]

[2]: ObjectId: 2.5.29.35 Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: 13 5B F4 D2 4E 05 F0 73   9D D0 60 C4 42 A3 80 95  .[..N..s..`.B...
0010: 37 7B 9A 1B                                        7...
]
]

[3]: ObjectId: 2.5.29.19 Criticality=true
BasicConstraints:[
  CA:false
  PathLen: undefined
]

[4]: ObjectId: 2.5.29.31 Criticality=false
CRLDistributionPoints [
  [DistributionPoint:
     [URIName: http://crl.mkk.se/ca.crl]
]]

[5]: ObjectId: 2.5.29.37 Criticality=false
ExtendedKeyUsages [
  serverAuth
]

[6]: ObjectId: 2.5.29.15 Criticality=false
KeyUsage [
  DigitalSignature
  Key_Encipherment
]

[7]: ObjectId: 2.5.29.17 Criticality=false
SubjectAlternativeName [
  DNSName: localhost
  DNSName: 127.0.0.1
]

[8]: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: C4 54 8A E7 43 33 30 53   AD B5 7F 07 81 57 17 3F  .T..C30S.....W.?
0010: 74 B2 6A 97                                        t.j.
]
]

]
  Algorithm: [SHA256withRSA]
  Signature:
0000: 5D C5 A5 AC 37 CA F7 AE   A8 34 80 C7 17 DF 27 01  ]...7....4....'.
0010: 12 C1 CB 8A 8D 85 77 98   01 EB FD 44 21 63 1F 98  ......w....D!c..
0020: 51 69 67 E8 96 16 AA CF   9C 2A 6A 10 8B 3B F4 60  Qig......*j..;.`
0030: 8D 5C 66 46 6C E4 C4 A8   A0 60 A6 3E 43 35 40 FC  .\fFl....`.>C5@.
0040: 77 5C 9A DA 13 D8 F9 F1   63 35 FD 0F 4B 6C A4 11  w\......c5..Kl..
0050: 5D 67 CF DA 73 9B E0 A0   35 05 6E 37 7A D9 E2 AF  ]g..s...5.n7z...
0060: 10 80 A1 CA F5 5F D4 01   A7 6B 76 92 99 2F 74 25  ....._...kv../t%
0070: A6 27 D2 67 05 07 D9 E6   27 58 E6 90 D1 C0 2D B1  .'.g....'X....-.
0080: 7A 1B F9 5B 91 6E BE DD   AB A8 AA EB B4 BB AE 96  z..[.n..........
0090: 9E 26 A8 CB 31 CE 4B 02   BE EA D4 6A AC B5 E5 FA  .&..1.K....j....
00A0: 43 76 E4 8E C9 16 BF 55   34 E6 D0 A8 FA 1C 6D 48  Cv.....U4.....mH
00B0: C9 54 65 37 84 89 F6 13   C4 FD 0C 62 41 FF 57 5B  .Te7.......bA.W[
00C0: 88 28 35 AF 83 1C D1 A3   8C A4 1F 7F CD E0 F4 F9  .(5.............
00D0: DA 64 C2 C3 51 D7 C5 56   2C 3D 6C A3 C0 B1 40 1B  .d..Q..V,=l...@.
00E0: 2E 42 B5 6F FF 86 2F DB   F2 1F E6 E0 24 A1 CD 7C  .B.o../.....$...
00F0: A6 94 20 95 B8 95 74 05   0B 0E CE 08 43 2E CF FA  .. ...t.....C...
0100: 43 EE 30 3B 40 2C 3E 10   4F BD B2 BC 48 55 07 23  C.0;@,>.O...HU.#
0110: 2B 06 FB F0 E5 76 A2 15   1D E1 8A 33 E6 76 A2 30  +....v.....3.v.0
0120: 6C 07 4C 2A B4 57 C3 62   51 DE 58 1A 5D 82 11 84  l.L*.W.bQ.X.]...
0130: 3F AF EE 17 EC 8B C9 8F   EA F8 6F E4 C1 6A 1F C8  ?.........o..j..
0140: 41 2A 15 62 4C DC 99 37   49 9E 58 1D 95 E1 A6 2E  A*.bL..7I.X.....
0150: AC F4 D3 4F 7F 44 87 B8   18 CD 34 D0 C5 85 9B A6  ...O.D....4.....
0160: C1 46 CD 68 80 84 BE F0   1D F0 E2 B2 2F 0E D3 A6  .F.h......../...
0170: DB 68 89 FD 4A F8 A5 35   AA CB 6A CC FA 45 9E 20  .h..J..5..j..E. 
0180: 9D AA 1D 04 2F 14 8D D0   A4 2B 78 09 9A 23 DA 44  ..../....+x..#.D
0190: 65 76 54 CF D3 7B 7F 37   78 46 18 45 60 98 0D 63  evT....7xF.E`..c
01A0: 2A 7D F8 0D A6 0C 0B 1A   81 61 B8 2B 1F A3 92 E9  *........a.+....
01B0: F2 9C 5B 26 E9 81 50 6F   D9 79 8B 03 54 64 6C EB  ..[&..Po.y..Tdl.
01C0: AA 4A A1 B6 B3 6F 82 C8   20 9D D1 33 D5 D3 87 DA  .J...o.. ..3....
01D0: 5A 3E 93 2A 22 FA BE 0A   A8 1F B6 A4 5C AA E0 73  Z>.*".......\..s
01E0: 17 76 73 33 61 B0 7E ED   09 5E FD DB 4F B7 5A B4  .vs3a....^..O.Z.
01F0: 76 21 1B FA 43 F0 52 AE   78 DC 3B 09 06 66 45 B2  v!..C.R.x.;..fE.

]
Mar 02, 2020 8:35:28 PM se.magnuskkarlsson.example.bouncycastle.EncryptionUtils writePEM
INFO: Wrote /tmp/serverCert-12014046357869706442.crt.pem
[
[
  Version: V3
  Subject: C=SE, O=MKK, CN=FOO CA
  Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11

  Key:  Sun RSA public key, 4096 bits
  params: null
  modulus: 618097494562805236224635134817934912453172250162709722041733040687097334018651185958049454716082071938067246709420916424794899282956550425042006414596550620844500042869814998708415847406596390541333435551567170239109985394967160893875673187989640416587377196814478200867973805718141593244866119267189530684758333327813430426324393329942084968006256517216438373301377640102657162289647735616023682850661875444729876016663906609090034297679982852109216895370934293109110480164998867564217281544316832079056015576106175918287779836237538131308742105170670592053973122534872165219807886684564067083803402486128679568799840125501397600441124322949161232699891631680388114085515962034617420771247637630876469717153740862760325747621475058600558255078199328046206047780514609430807802825141363344880107809474319017977033492293123813011848757820259401796458615662171411629964165721128392643210117405003344910890867964280963490337780332547309122266515542815534797820516503892594199239179401978336582637760762233031975748737882775045900183794816021065220038962704464619646627020923143975929999810020514328195611426571022736233127780297192743641966846131645647190538362059522204380559481497214913394154203383211767929658852311603605904982991909
  public exponent: 65537
  Validity: [From: Mon Mar 02 20:35:28 CET 2020,
               To: Sat Mar 02 20:35:28 CET 2030]
  Issuer: C=SE, O=MKK, CN=FOO CA
  SerialNumber: [    01709cbf 02c1]

Certificate Extensions: 5
[1]: ObjectId: 2.5.29.35 Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: 13 5B F4 D2 4E 05 F0 73   9D D0 60 C4 42 A3 80 95  .[..N..s..`.B...
0010: 37 7B 9A 1B                                        7...
]
]

[2]: ObjectId: 2.5.29.19 Criticality=true
BasicConstraints:[
  CA:true
  PathLen:2147483647
]

[3]: ObjectId: 2.5.29.31 Criticality=false
CRLDistributionPoints [
  [DistributionPoint:
     [URIName: http://crl.mkk.se/ca.crl]
]]

[4]: ObjectId: 2.5.29.15 Criticality=true
KeyUsage [
  DigitalSignature
  Key_CertSign
  Crl_Sign
]

[5]: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 13 5B F4 D2 4E 05 F0 73   9D D0 60 C4 42 A3 80 95  .[..N..s..`.B...
0010: 37 7B 9A 1B                                        7...
]
]

]
  Algorithm: [SHA256withRSA]
  Signature:
0000: 6B 5A 8D 8E 93 F0 97 BC   6C 62 DD 1A 65 22 75 10  kZ......lb..e"u.
0010: D1 E3 95 AF BA B8 C1 93   45 C9 44 0A EB 36 93 A8  ........E.D..6..
0020: FD 3C 6F 62 28 FF 59 68   14 8E 7E 45 BB 8E C9 68  .<ob(.Yh...E...h
0030: 0C F3 ED 7F 6D E1 9B FC   D1 22 58 06 FB 6A EF ED  ....m...."X..j..
0040: DC 34 E9 BA CD 7C 69 A9   73 FB F7 C6 7C FD 7A 43  .4....i.s.....zC
0050: 86 68 8A B9 10 F7 36 BC   1E E5 98 99 C4 1A 9D 43  .h....6........C
0060: 31 00 3B 22 38 BB 7E 96   1C 32 E6 8C 67 F4 66 3A  1.;"8....2..g.f:
0070: 37 D9 58 24 18 74 30 40   9C 4B 0C 23 BE 11 4E B1  7.X$.t0@.K.#..N.
0080: 11 4F AD 1D F2 C0 94 1D   B3 B1 A5 CB FE C9 86 5B  .O.............[
0090: 39 80 C9 B1 86 5A 0F 76   C9 4A 54 04 CC 0D 3B E0  9....Z.v.JT...;.
00A0: 94 0F 51 86 8F D8 5E FE   81 21 20 B7 38 9E 91 C4  ..Q...^..! .8...
00B0: FE B3 78 67 80 BF 0E 95   4F C7 E8 48 59 DB CA 43  ..xg....O..HY..C
00C0: E7 69 48 52 C1 78 DA 89   E1 2E 98 63 5E 5A B5 E6  .iHR.x.....c^Z..
00D0: 7B C5 DB D6 B9 35 4E 8A   52 5E 6F 22 EA AD CE 8E  .....5N.R^o"....
00E0: 8C CF BF D3 41 0A 46 35   66 8A C1 E6 53 BE 1C 00  ....A.F5f...S...
00F0: EF 86 FE D7 C6 D9 62 EF   11 AC 44 49 6B 06 4E EC  ......b...DIk.N.
0100: 59 1F 5B 03 D1 CC 63 2F   05 49 1A B4 B0 66 01 55  Y.[...c/.I...f.U
0110: 93 FF 89 CB F1 DA 1E E5   3A 21 E1 81 A5 9D E1 A5  ........:!......
0120: A5 5F 3D AF CF 7C 88 B6   F9 03 EF C8 23 A5 04 3F  ._=.........#..?
0130: F6 CE EE 3A AB A0 A2 7F   0D 33 69 18 E3 A2 22 D8  ...:.....3i...".
0140: 7A 2E 09 1A B2 E5 7A 7C   EA 15 08 92 3D D5 D8 8A  z.....z.....=...
0150: 83 AE 6F CC 4D 30 73 CB   30 A1 0D D1 CC 47 B8 16  ..o.M0s.0....G..
0160: E3 2A 4B 06 32 79 99 4C   1E DD 92 5A 7D CD CB F3  .*K.2y.L...Z....
0170: 00 07 65 86 33 83 06 9C   F9 5C 45 2C F9 F2 E7 36  ..e.3....\E,...6
0180: BB 78 8C 47 32 B6 A6 8B   6F 11 91 73 CF 92 EF B7  .x.G2...o..s....
0190: 60 22 12 48 2F 01 1F 99   81 6C C0 0D 9B 6F 76 00  `".H/....l...ov.
01A0: D3 CD 1D F9 89 F8 F9 F0   83 7D 34 3E F2 6C 08 41  ..........4>.l.A
01B0: F9 EA 1B 8D BC CF 7A 41   7B A0 89 F4 55 8E 09 94  ......zA....U...
01C0: AC FC 50 4B 99 E6 BA 21   04 CF 33 BD B5 2F B7 B0  ..PK...!..3../..
01D0: 06 38 59 89 8C 04 E8 4D   C0 A4 D1 13 DD 47 25 4A  .8Y....M.....G%J
01E0: 02 CE AC CA BE 75 C3 4A   30 A7 9C 84 0A 7E 1D 59  .....u.J0......Y
01F0: BA 2A AA 6C 58 C7 0C 7B   BA 60 60 B3 77 E2 72 AE  .*.lX....``.w.r.

]
Mar 02, 2020 8:35:28 PM se.magnuskkarlsson.example.bouncycastle.EncryptionUtils writePEM
INFO: Wrote /tmp/caCert-12617038054227389688.crt.pem

No comments: