Home | History | Annotate | Download | only in cert 
      1 /*
      2  * Copyright (c) 2014, Oracle and/or its affiliates. All rights reserved.
      3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
      4  *
      5  * This code is free software; you can redistribute it and/or modify it
      6  * under the terms of the GNU General Public License version 2 only, as
      7  * published by the Free Software Foundation.
      8  *
      9  * This code is distributed in the hope that it will be useful, but WITHOUT
     10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
     11  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
     12  * version 2 for more details (a copy is included in the LICENSE file that
     13  * accompanied this code).
     14  *
     15  * You should have received a copy of the GNU General Public License version
     16  * 2 along with this work; if not, write to the Free Software Foundation,
     17  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
     18  *
     19  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
     20  * or visit www.oracle.com if you need additional information or have any
     21  * questions.
     22  */
     23 
     24 /**
     25  * @test
     26  * @bug 8025708
     27  * @summary make sure a PKIX CertPathBuilder can build a path when an
     28  *     intermediate CA certificate contains an AKI extension with a key
     29  *     identifier and no serial number and the end-entity certificate contains
     30  *     an AKI extension with both a key identifier and a serial number.
     31  */
     32 // Android-changed: Adapted from
     33 // jdk/test/java/security/cert/CertPathBuilder/akiExt/AKISerialNumber.java
     34 // Android-changed: Added package & Test import
     35 package test.java.security.cert;
     36 import org.testng.annotations.Test;
     37 
     38 import java.io.ByteArrayInputStream;
     39 import java.security.cert.*;
     40 import java.util.ArrayList;
     41 import java.util.Base64;
     42 import java.util.Collections;
     43 
     44 public class AKISerialNumberTest {
     45 
     46     private static final String ROOT_CERT =
     47         "MIICfTCCAeagAwIBAgIBATANBgkqhkiG9w0BAQUFADB3MQ0wCwYDVQQDEwRSb290\n" +
     48         "MRYwFAYDVQQLEw1UZXN0IE9yZyBVbml0MREwDwYDVQQKEwhUZXN0IE9yZzEWMBQG\n" +
     49         "A1UEBxMNVGVzdCBMb2NhbGl0eTEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czELMAkG\n" +
     50         "A1UEBhMCVVMwHhcNMTQwMjAxMDUwMDAwWhcNMjQwMjAxMDUwMDAwWjB3MQ0wCwYD\n" +
     51         "VQQDEwRSb290MRYwFAYDVQQLEw1UZXN0IE9yZyBVbml0MREwDwYDVQQKEwhUZXN0\n" +
     52         "IE9yZzEWMBQGA1UEBxMNVGVzdCBMb2NhbGl0eTEWMBQGA1UECBMNTWFzc2FjaHVz\n" +
     53         "ZXR0czELMAkGA1UEBhMCVVMwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAJvL\n" +
     54         "cZu6Rzf9IrduEDjJxEFv5uBvUNMlIAph7NhfmFH9puPW3Ksci4a5yTCzxI9VeVf3\n" +
     55         "oYZ/UrZdF+mNZmS23RUh71X5tjMO+xew196M1xNpCRLbjcZ6i4tNdZYkdRIe8ejN\n" +
     56         "sbBoD7OAvPbQqTygeG4jYjK6ODofSrba3BndNoFxAgMBAAGjGTAXMBUGA1UdEwEB\n" +
     57         "/wQLMAkBAf8CBH////8wDQYJKoZIhvcNAQEFBQADgYEATvCqn69pNHv0zLiZAXk7\n" +
     58         "3AKwAoza0wa+1S2rVuZGfBWbV7CxmBHbgcDDbU7/I8pQVkCwOHNkVFnBgNpMuAvU\n" +
     59         "aDyrHSNS/av5d1yk5WAuGX2B9mSwZdhnAvtz2fsV1q9NptdF54EkIiKtQQmTGnr9\n" +
     60         "TID8CFEk/qje+AB272B1UJw=\n";
     61 
     62     /**
     63      * This certificate contains an AuthorityKeyIdentifier with only the
     64      * keyIdentifier field filled in.
     65      */
     66     private static final String INT_CERT_WITH_KEYID_AKI =
     67         "MIICqTCCAhKgAwIBAgIBAjANBgkqhkiG9w0BAQUFADB3MQ0wCwYDVQQDEwRSb290\n" +
     68         "MRYwFAYDVQQLEw1UZXN0IE9yZyBVbml0MREwDwYDVQQKEwhUZXN0IE9yZzEWMBQG\n" +
     69         "A1UEBxMNVGVzdCBMb2NhbGl0eTEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czELMAkG\n" +
     70         "A1UEBhMCVVMwHhcNMTQwMjAxMDUwMDAwWhcNMjQwMjAxMDUwMDAwWjCBhDEaMBgG\n" +
     71         "A1UEAxMRSW50ZXJtZWRpYXRlIENBIDIxFjAUBgNVBAsTDVRlc3QgT3JnIFVuaXQx\n" +
     72         "ETAPBgNVBAoTCFRlc3QgT3JnMRYwFAYDVQQHEw1UZXN0IExvY2FsaXR5MRYwFAYD\n" +
     73         "VQQIEw1NYXNzYWNodXNldHRzMQswCQYDVQQGEwJVUzCBnzANBgkqhkiG9w0BAQEF\n" +
     74         "AAOBjQAwgYkCgYEAwKTZekCqb9F9T54s2IXjkQbmLIjQamMpkUlZNrpjjNq9CpTT\n" +
     75         "POkfxv2UPwzTz3Ij4XFL/kJFBLm8NUOsS5xPJ62pGoZBPw9R0iMTsTce+Fpukqnr\n" +
     76         "I+8jTRaAvr0tR3pqrE6uHKg7dWYN2SsWesDia/LHhwEN38yyWtSuTTLo4hcCAwEA\n" +
     77         "AaM3MDUwHwYDVR0jBBgwFoAU6gZP1pO8v7+i8gsFf1gWTf/j3PkwEgYDVR0TAQH/\n" +
     78         "BAgwBgEB/wIBADANBgkqhkiG9w0BAQUFAAOBgQAQxeQruav4AqQM4gmEfrHr5hOq\n" +
     79         "mB2CNJ1ZqVfpDZ8GHijncKTpjNoXzzQtV23Ge+39JHOVBNWtk+aghB3iu6xGq7Qn\n" +
     80         "HlBhg9meqHFqd3igDDD/jhABL2/bEo/M9rv6saYWDFZ8nCIEE6iTLTpRRko4W2Xb\n" +
     81         "DyzMzMsO1kPNrJaxRg==\n";
     82 
     83     /**
     84      * This certificate contains an AuthorityKeyIdentifier with all 3 fields
     85      * (keyIdentifier, authorityCertIssuer, and authorityCertSerialNumber)
     86      * filled in.
     87      */
     88     private static final String EE_CERT_WITH_FULL_AKI =
     89         "MIIDLjCCApegAwIBAgIBAzANBgkqhkiG9w0BAQUFADCBhDEaMBgGA1UEAxMRSW50\n" +
     90         "ZXJtZWRpYXRlIENBIDIxFjAUBgNVBAsTDVRlc3QgT3JnIFVuaXQxETAPBgNVBAoT\n" +
     91         "CFRlc3QgT3JnMRYwFAYDVQQHEw1UZXN0IExvY2FsaXR5MRYwFAYDVQQIEw1NYXNz\n" +
     92         "YWNodXNldHRzMQswCQYDVQQGEwJVUzAeFw0xNDAyMDEwNTAwMDBaFw0yNDAyMDEw\n" +
     93         "NTAwMDBaMH0xEzARBgNVBAMTCkVuZCBFbnRpdHkxFjAUBgNVBAsTDVRlc3QgT3Jn\n" +
     94         "IFVuaXQxETAPBgNVBAoTCFRlc3QgT3JnMRYwFAYDVQQHEw1UZXN0IExvY2FsaXR5\n" +
     95         "MRYwFAYDVQQIEw1NYXNzYWNodXNldHRzMQswCQYDVQQGEwJVUzCBnzANBgkqhkiG\n" +
     96         "9w0BAQEFAAOBjQAwgYkCgYEAqady46PdwlKHVP1iaP11CxVyL6cDlPjpwhHCcIUv\n" +
     97         "nKHbzdamqmHebDcWVBNN/I0TLNCl3ga7n8KyygSN379fG7haU8SNjpy4IDAXM0/x\n" +
     98         "mwTWNTbKfJEkSoiqx1WUy2JTzRUMhgYPguQNECPxBXAdQrthZ7wQosv6Ro2ySP9O\n" +
     99         "YqsCAwEAAaOBtTCBsjCBoQYDVR0jBIGZMIGWgBQdeoKxTvlTgW2KgprD69vgHV4X\n" +
    100         "kKF7pHkwdzENMAsGA1UEAxMEUm9vdDEWMBQGA1UECxMNVGVzdCBPcmcgVW5pdDER\n" +
    101         "MA8GA1UEChMIVGVzdCBPcmcxFjAUBgNVBAcTDVRlc3QgTG9jYWxpdHkxFjAUBgNV\n" +
    102         "BAgTDU1hc3NhY2h1c2V0dHMxCzAJBgNVBAYTAlVTggECMAwGA1UdEwEB/wQCMAAw\n" +
    103         "DQYJKoZIhvcNAQEFBQADgYEAuG4mM1nLF7STQWwmceELZEl49ntapH/RVoekknmd\n" +
    104         "aNzcL4XQf6BTl8KFUXuThHaukQnGIzFbSZV0hrpSQ5fTN2cSZgD4Fji+HuNURmmd\n" +
    105         "+Kayl0piHyO1FSbrty0TFhlVNvzKXjmMp6Jdn42KyGOSCoROQcvUWN6xkV3Hvrei\n" +
    106         "0ZE=\n";
    107 
    108     private static Base64.Decoder b64Decoder = Base64.getMimeDecoder();
    109     private static CertificateFactory cf;
    110 
    111     // Android-changed: Removed args & added @Test
    112     @Test
    113     public static void main() throws Exception {
    114 
    115         cf = CertificateFactory.getInstance("X.509");
    116 
    117         X509Certificate rootCert = getCertFromMimeEncoding(ROOT_CERT);
    118         TrustAnchor anchor = new TrustAnchor(rootCert, null);
    119 
    120         X509Certificate eeCert = getCertFromMimeEncoding(EE_CERT_WITH_FULL_AKI);
    121         X509Certificate intCert = getCertFromMimeEncoding(INT_CERT_WITH_KEYID_AKI);
    122 
    123         X509CertSelector sel = new X509CertSelector();
    124         sel.setCertificate(eeCert);
    125         PKIXBuilderParameters params = new PKIXBuilderParameters
    126             (Collections.singleton(anchor), sel);
    127         params.setRevocationEnabled(false);
    128 
    129         ArrayList<X509Certificate> certs = new ArrayList<>();
    130         certs.add(intCert);
    131         certs.add(eeCert);
    132         CollectionCertStoreParameters ccsp =
    133             new CollectionCertStoreParameters(certs);
    134         CertStore cs = CertStore.getInstance("Collection", ccsp);
    135         params.addCertStore(cs);
    136 
    137         CertPathBuilder cpb = CertPathBuilder.getInstance("PKIX");
    138         CertPathBuilderResult res = cpb.build(params);
    139     }
    140 
    141     private static X509Certificate getCertFromMimeEncoding(String encoded)
    142         throws CertificateException
    143     {
    144         byte[] bytes = b64Decoder.decode(encoded);
    145         ByteArrayInputStream stream = new ByteArrayInputStream(bytes);
    146         return (X509Certificate)cf.generateCertificate(stream);
    147     }
    148 }