1 package org.eparapher.core.crypto.keystore;
2
3 import java.io.File;
4 import java.io.FileOutputStream;
5 import java.security.KeyStore;
6 import java.security.KeyStoreException;
7 import java.security.PrivateKey;
8 import java.security.cert.Certificate;
9 import java.security.cert.X509Certificate;
10
11 import org.apache.log4j.Logger;
12 import org.eparapher.core.EParapherManager;
13 import org.eparapher.core.crypto.EPKeystoreManager;
14 import org.eparapher.core.crypto.KeystoreEntry;
15 import org.eparapher.core.crypto.cert.X509Util;
16
17
18 public class EPKeystoreUtils {
19
20 private static Logger log = Logger.getLogger(EPKeystoreUtils.class);
21
22 public static KeyStore initNewKeystore( String ks_type, String password) {
23 KeyStore new_ks = null;
24 try {
25 new_ks = KeyStore.getInstance( ks_type );
26 char[] pwd = password.toCharArray();
27 new_ks.load(null, pwd);
28 return new_ks;
29 } catch (Exception e) {
30 log.error("" + e.getLocalizedMessage(), e);
31 }
32 return null;
33 }
34
35 public static boolean saveKeystore( KeyStore ks, String file, String password) {
36 if (ks != null) {
37 try {
38 char[] pwd = password.toCharArray();
39 ks.store(new FileOutputStream(file), pwd);
40 return true;
41 } catch (Exception e) {
42 log.error("" + e.getLocalizedMessage(), e);
43 }
44 }
45 return false;
46 }
47
48 public static boolean isCertificateTrusted(X509Certificate cert) {
49 String alias;
50 try {
51 alias = EPKeystoreManager.getInstance().getTrustStore().getKeystore().getCertificateAlias(cert);
52 } catch (KeyStoreException e) {
53 log.error("Truststore problem",e);
54 return false;
55 }
56 return (alias != null);
57 }
58
59 public static boolean exportUserKSPKAndCerts( String[] alias_array, KeyStore ks_dest, String password, boolean keepKSPassword) {
60
61 try {
62 char[] pwd = password.toCharArray();
63
64 IUserKeystore usr_ks = EPKeystoreManager.getInstance().getUserkeystore();
65 String current_alias = usr_ks.getDefaultAlias();
66
67
68 log.info("exporting aliases:");
69 for (int i = 0; i < alias_array.length; i++) {
70 String alias = alias_array[i];
71 usr_ks.setDefaultAlias(alias);
72
73
74 if(usr_ks.getKeystore().isKeyEntry(alias)) {
75 if (usr_ks.loadPrivateKey()) {
76 PrivateKey pk = usr_ks.getPrivateKey();
77 if (keepKSPassword && (usr_ks instanceof FileKeystore)) {
78 char[] old_pwd = ((FileKeystore) usr_ks).getKSPassword();
79 ks_dest.setKeyEntry(alias, pk, old_pwd, usr_ks.getX509CertificateChain());
80 log.info(" - \""+alias+"\" (key)");
81 } else {
82 String secret;
83 secret = EParapherManager.getInstance().getUI().askUserKeystoreSecret( true, true, usr_ks.getDefaultAlias() );
84 if (secret == null) {
85 log.warn("Skipping alias "+alias+" : New Private key passphrase definition has been cancelled");
86 } else {
87 ks_dest.setKeyEntry(alias, pk, secret.toCharArray(), usr_ks.getX509CertificateChain());
88 log.info(" - \""+alias+"\" (key)");
89 }
90 }
91 } else
92 log.warn(" - \""+alias+"\" : export cancelled : not loaded");
93 }
94
95 else if(usr_ks.getKeystore().isCertificateEntry(alias)) {
96 ks_dest.setCertificateEntry(alias, usr_ks.getKeystore().getCertificate(alias));
97 log.info(" - \""+alias+"\" (certificate)");
98 } else
99 log.info("unknwon type for alias \""+alias+"\"");
100 }
101 usr_ks.setDefaultAlias(current_alias);
102
103 return true;
104 } catch (Exception e) {
105 log.error(" exportUserKSPKAndCerts : " + e.getLocalizedMessage(), e);
106 }
107 return false;
108 }
109
110 public static boolean exportUserKSCerts( String[] alias_array, String directory ) {
111
112 try {
113
114 IUserKeystore usr_ks = EPKeystoreManager.getInstance().getUserkeystore();
115
116
117 log.info("exporting aliases :");
118 for (int i = 0; i < alias_array.length; i++) {
119 String alias = alias_array[i];
120
121
122 if(usr_ks.getKeystore().isKeyEntry(alias)) {
123 X509Certificate[] aliasCertChain = X509Util.convertCertChaintoX509( usr_ks.getKeystore().getCertificateChain(alias) );
124 if (aliasCertChain.length==0)
125 log.info(" - alias \""+alias+"\" does not contain X509 Certificate");
126 else
127 for (int j = 0; j < aliasCertChain.length; j++) {
128 if (aliasCertChain[j]!=null) {
129 X509Certificate certificate = aliasCertChain[j];
130 String filename = directory + File.separator + alias + "-" + j + ".crt";
131 X509Util.saveX509toFile( filename, certificate);
132 log.info(" - exporting certificate(s) alias \""+alias+"\" to '"+filename+"'");
133 } else
134 log.info(" - certificate n�"+j+" in alias \""+alias+"\" is not an X509 Certificate");
135 }
136 }
137
138
139 else if(usr_ks.getKeystore().isCertificateEntry(alias)) {
140 Certificate aliascert = usr_ks.getKeystore().getCertificate(alias);
141 if ( aliascert instanceof X509Certificate) {
142 X509Certificate x509Cert = (X509Certificate) aliascert;
143 String filename = directory + File.separator + alias + ".crt";
144 X509Util.saveX509toFile( filename, x509Cert);
145 log.info(" - exporting alias \""+alias+"\" to '"+filename+"'");
146 } else
147 log.info(" - exporting alias \""+alias+"\" failed : not a X509 Certificate");
148 } else
149 log.info("unknwon type for alias \""+alias+"\"");
150 }
151
152 return true;
153 } catch (Exception e) {
154 log.error(" exportUserKSCerts : " + e.getLocalizedMessage(), e);
155 }
156 return false;
157 }
158 }