-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
AE-2325: Create KeyEntityTSPSource with self-signed certificate
- Loading branch information
1 parent
5d33ebc
commit f5826d0
Showing
2 changed files
with
147 additions
and
59 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
74 changes: 74 additions & 0 deletions
74
etp-core/etp-backend/src/main/clj/solita/etp/service/signing/dss_augmentation.clj
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,74 @@ | ||
| (ns solita.etp.service.signing.dss-augmentation | ||
| (:import (eu.europa.esig.dss.alert LogOnStatusAlert) | ||
| (eu.europa.esig.dss.enumerations SignatureLevel) | ||
| (eu.europa.esig.dss.model FileDocument) | ||
| (eu.europa.esig.dss.pades PAdESSignatureParameters) | ||
| (eu.europa.esig.dss.pades.signature PAdESService) | ||
| (eu.europa.esig.dss.service.ocsp OnlineOCSPSource) | ||
| (eu.europa.esig.dss.spi.validation CommonCertificateVerifier) | ||
| (eu.europa.esig.dss.spi.x509.tsp KeyEntityTSPSource) | ||
| (java.io File) | ||
| (java.security KeyPair KeyPairGenerator KeyStore PrivateKey SecureRandom Security) | ||
| (java.security.cert X509Certificate) | ||
| (java.util ArrayList Date List) | ||
| (org.bouncycastle.asn1.x500 X500Name) | ||
| (org.bouncycastle.cert X509v3CertificateBuilder) | ||
| (org.bouncycastle.cert.jcajce JcaX509CertificateConverter JcaX509v3CertificateBuilder) | ||
| (org.bouncycastle.jce.provider BouncyCastleProvider) | ||
| (org.bouncycastle.operator ContentSigner) | ||
| (org.bouncycastle.operator.jcajce JcaContentSignerBuilder))) | ||
|
|
||
| (def tsp-key-and-cert | ||
| (let [_ (Security/addProvider (BouncyCastleProvider.)) ;; TODO: Should this be done elsewhere? | ||
| ^KeyPairGenerator keyPairGenerator (doto (KeyPairGenerator/getInstance "RSA") | ||
| (.initialize 2048)) | ||
| ^KeyPair keyPair (-> keyPairGenerator .generateKeyPair) | ||
|
|
||
| subjectDN "CN=Self-Signed, O=Example, C=FI" | ||
| issuerDN subjectDN | ||
| serialNumber (BigInteger. 64 (SecureRandom.)) | ||
| ^Date notBefore (Date.) | ||
| ^Date notAfter (Date. ^long (+ (System/currentTimeMillis) (* 365 24 60 60 1000))) | ||
|
|
||
| ^X509v3CertificateBuilder certBuilder (JcaX509v3CertificateBuilder. | ||
| (X500Name. issuerDN) | ||
| serialNumber | ||
| notBefore | ||
| notAfter | ||
| (X500Name. subjectDN) | ||
| (-> keyPair .getPublic)) | ||
|
|
||
| ^ContentSigner signer (-> (JcaContentSignerBuilder. "SHA256withRSA") (.build (-> keyPair .getPrivate))) | ||
| ^X509Certificate certificate (-> (doto (JcaX509CertificateConverter.) (.setProvider "BC")) (.getCertificate (-> certBuilder (.build signer))))] | ||
| {:private-key (-> keyPair .getPrivate) | ||
| :public-key (-> keyPair .getPublic) | ||
| :certificate certificate})) | ||
|
|
||
| (defn create-longer-validation-document [pdf-file] | ||
| (let [parameters (PAdESSignatureParameters.) | ||
| _ (-> parameters (.setSignatureLevel SignatureLevel/PAdES_BASELINE_T)) | ||
|
|
||
| certificate-verifier (doto (CommonCertificateVerifier.) | ||
| (.setOcspSource (OnlineOCSPSource.)) | ||
| (.setAlertOnInvalidTimestamp (LogOnStatusAlert.))) | ||
|
|
||
| #_(-> certificate-verifier (.setTrustedCertSources "")) | ||
| key-store-file (File. "/tmp/test-key-store") | ||
| key-store-pw (char-array "kissa") | ||
| ^KeyStore key-store (doto (KeyStore/getInstance "PKCS12") | ||
| (.load nil key-store-pw)) | ||
| ;;key-entity-tsp-source (KeyEntityTSPSource. key-store "self-signed-tsa" key-store-pw) | ||
| key-entity-tsp-source (KeyEntityTSPSource. ^PrivateKey (:private-key tsp-key-and-cert) | ||
| ^X509Certificate (:certificate tsp-key-and-cert) | ||
| ^List (doto (ArrayList.) (.add (:certificate tsp-key-and-cert)))) | ||
| _ (-> key-entity-tsp-source (.setTsaPolicy "1.2.3.4")) | ||
|
|
||
| pades-service (doto (PAdESService. certificate-verifier) | ||
| (.setTspSource key-entity-tsp-source)) | ||
|
|
||
| ;;hopefully-document-with-ocsp (-> pades-service (.extendDocument pdf-file parameters)) | ||
| ])) | ||
|
|
||
| ;;TODO: Continue "Certificate must have an ExtendedKeyUsage extension." | ||
| (def pdf-file (FileDocument. "src/test/resources/energiatodistukset/signed-with-ocsp-information.pdf")) | ||
| ;;(create-longer-validation-document pdf-file) |