package sun.security.tools.keytool;
import java.io.*;
import java.math.BigInteger;
import java.security.GeneralSecurityException;
import java.security.InvalidParameterException;
import java.security.KeyStore;
import java.security.KeyStoreException;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.security.Key;
import java.security.PublicKey;
import java.security.PrivateKey;
import java.security.Security;
import java.security.Signature;
import java.security.SignatureException;
import java.security.UnrecoverableEntryException;
import java.security.UnrecoverableKeyException;
import java.security.Principal;
import java.security.Provider;
import java.security.Identity;
import java.security.Signer;
import java.security.cert.Certificate;
import java.security.cert.CertificateFactory;
import java.security.cert.CertStoreException;
import java.security.cert.X509Certificate;
import java.security.cert.CertificateException;
import java.security.interfaces.DSAParams;
import java.security.interfaces.DSAPrivateKey;
import java.security.interfaces.DSAPublicKey;
import java.security.interfaces.RSAPrivateCrtKey;
import java.security.interfaces.RSAPrivateKey;
import java.security.interfaces.RSAPublicKey;
import java.text.Collator;
import java.text.MessageFormat;
import java.util.*;
import java.lang.reflect.Constructor;
import java.net.URL;
import java.net.URLClassLoader;
import sun.misc.BASE64Decoder;
import sun.misc.BASE64Encoder;
import sun.security.tools.KeyStoreUtil;
import sun.security.tools.PathList;
import sun.security.util.ObjectIdentifier;
import sun.security.pkcs10.PKCS10;
import sun.security.provider.IdentityDatabase;
import sun.security.provider.SystemSigner;
import sun.security.provider.SystemIdentity;
import sun.security.provider.X509Factory;
import sun.security.provider.certpath.CertStoreHelper;
import sun.security.util.DerOutputStream;
import sun.security.util.Password;
import sun.security.util.Resources;
import sun.security.util.SecurityProviderConstants;
import javax.crypto.KeyGenerator;
import javax.crypto.SecretKey;
import sun.security.x509.*;
import static java.security.KeyStore.*;
import static sun.security.tools.keytool.Main.Command.*;
import static sun.security.tools.keytool.Main.Option.*;
public final class Main {
private boolean debug = false;
private Command command = null;
private String sigAlgName = null;
private String keyAlgName = null;
private boolean verbose = false;
private int keysize = -1;
private boolean rfc = false;
private long validity = (long)90;
private String alias = null;
private String dname = null;
private String dest = null;
private String filename = null;
private String srcksfname = null;
private Set<Pair <String, String>> providers = null;
private String storetype = null;
private String srcProviderName = null;
private String providerName = null;
private String pathlist = null;
private char[] storePass = null;
private char[] storePassNew = null;
private char[] keyPass = null;
private char[] keyPassNew = null;
private char[] oldPass = null;
private char[] newPass = null;
private char[] destKeyPass = null;
private char[] srckeyPass = null;
private String ksfname = null;
private File ksfile = null;
private InputStream ksStream = null;
private KeyStore keyStore = null;
private boolean token = false;
private boolean nullStream = false;
private boolean kssave = false;
private boolean noprompt = false;
private boolean trustcacerts = false;
private boolean protectedPath = false;
private boolean srcprotectedPath = false;
private CertificateFactory cf = null;
private KeyStore caks = null;
private char[] srcstorePass = null;
private String srcstoretype = null;
private Set<char[]> passwords = new HashSet<char[]> ();
private String startDate = null;
enum Command {
CERTREQ("Generates.a.certificate.request",
ALIAS, SIGALG, FILEOUT, KEYPASS, KEYSTORE,
STOREPASS, STORETYPE, PROVIDERNAME, PROVIDERCLASS,
PROVIDERARG, PROVIDERPATH, V, PROTECTED),
CHANGEALIAS("Changes.an.entry.s.alias",
ALIAS, DESTALIAS, KEYPASS, KEYSTORE, STOREPASS,
STORETYPE, PROVIDERNAME, PROVIDERCLASS, PROVIDERARG,
PROVIDERPATH, V, PROTECTED),
DELETE("Deletes.an.entry",
ALIAS, KEYSTORE, STOREPASS, STORETYPE,
PROVIDERNAME, PROVIDERCLASS, PROVIDERARG,
PROVIDERPATH, V, PROTECTED),
EXPORTCERT("Exports.certificate",
RFC, ALIAS, FILEOUT, KEYSTORE, STOREPASS,
STORETYPE, PROVIDERNAME, PROVIDERCLASS, PROVIDERARG,
PROVIDERPATH, V, PROTECTED),
GENKEYPAIR("Generates.a.key.pair",
ALIAS, KEYALG, KEYSIZE, SIGALG, DNAME,
VALIDITY, KEYPASS, KEYSTORE,
STOREPASS, STORETYPE, PROVIDERNAME, PROVIDERCLASS,
PROVIDERARG, PROVIDERPATH, V, PROTECTED),
GENSECKEY("Generates.a.secret.key",
ALIAS, KEYPASS, KEYALG, KEYSIZE, KEYSTORE,
STOREPASS, STORETYPE, PROVIDERNAME, PROVIDERCLASS,
PROVIDERARG, PROVIDERPATH, V, PROTECTED),
IMPORTCERT("Imports.a.certificate.or.a.certificate.chain",
NOPROMPT, TRUSTCACERTS, PROTECTED, ALIAS, FILEIN,
KEYPASS, KEYSTORE, STOREPASS, STORETYPE,
PROVIDERNAME, PROVIDERCLASS, PROVIDERARG,
PROVIDERPATH, V),
IMPORTKEYSTORE("Imports.one.or.all.entries.from.another.keystore",
SRCKEYSTORE, DESTKEYSTORE, SRCSTORETYPE,
DESTSTORETYPE, SRCSTOREPASS, DESTSTOREPASS,
SRCPROTECTED, SRCPROVIDERNAME, DESTPROVIDERNAME,
SRCALIAS, DESTALIAS, SRCKEYPASS, DESTKEYPASS,
NOPROMPT, PROVIDERCLASS, PROVIDERARG, PROVIDERPATH,
V),
KEYPASSWD("Changes.the.key.password.of.an.entry",
ALIAS, KEYPASS, NEW, KEYSTORE, STOREPASS,
STORETYPE, PROVIDERNAME, PROVIDERCLASS, PROVIDERARG,
PROVIDERPATH, V),
LIST("Lists.entries.in.a.keystore",
RFC, ALIAS, KEYSTORE, STOREPASS, STORETYPE,
PROVIDERNAME, PROVIDERCLASS, PROVIDERARG,
PROVIDERPATH, V, PROTECTED),
PRINTCERT("Prints.the.content.of.a.certificate",
FILEIN, V),
STOREPASSWD("Changes.the.store.password.of.a.keystore",
NEW, KEYSTORE, STOREPASS, STORETYPE, PROVIDERNAME,
PROVIDERCLASS, PROVIDERARG, PROVIDERPATH, V),
KEYCLONE("Clones.a.key.entry",
ALIAS, DESTALIAS, KEYPASS, NEW, STORETYPE,
KEYSTORE, STOREPASS, PROVIDERNAME, PROVIDERCLASS,
PROVIDERARG, PROVIDERPATH, V),
SELFCERT("Generates.a.self.signed.certificate",
ALIAS, SIGALG, DNAME, STARTDATE, VALIDITY, KEYPASS,
STORETYPE, KEYSTORE, STOREPASS, PROVIDERNAME,
PROVIDERCLASS, PROVIDERARG, PROVIDERPATH, V),
IDENTITYDB("Imports.entries.from.a.JDK.1.1.x.style.identity.database",
FILEIN, STORETYPE, KEYSTORE, STOREPASS, PROVIDERNAME,
PROVIDERCLASS, PROVIDERARG, PROVIDERPATH, V);
final String description;
final Option[] options;
Command(String d, Option... o) {
description = d;
options = o;
}
@Override
public String toString() {
return "-" + name().toLowerCase(Locale.ENGLISH);
}
};
enum Option {
ALIAS("alias", "<alias>", "alias.name.of.the.entry.to.process"),
DESTALIAS("destalias", "<destalias>", "destination.alias"),
DESTKEYPASS("destkeypass", "<arg>", "destination.key.password"),
DESTKEYSTORE("destkeystore", "<destkeystore>", "destination.keystore.name"),
DESTPROTECTED("destprotected", null, "destination.keystore.password.protected"),
DESTPROVIDERNAME("destprovidername", "<destprovidername>", "destination.keystore.provider.name"),
DESTSTOREPASS("deststorepass", "<arg>", "destination.keystore.password"),
DESTSTORETYPE("deststoretype", "<deststoretype>", "destination.keystore.type"),
DNAME("dname", "<dname>", "distinguished.name"),
FILEOUT("file", "<filename>", "output.file.name"),
FILEIN("file", "<filename>", "input.file.name"),
KEYALG("keyalg", "<keyalg>", "key.algorithm.name"),
KEYPASS("keypass", "<arg>", "key.password"),
KEYSIZE("keysize", "<keysize>", "key.bit.size"),
KEYSTORE("keystore", "<keystore>", "keystore.name"),
NEW("new", "<arg>", "new.password"),
NOPROMPT("noprompt", null, "do.not.prompt"),
PROTECTED("protected", null, "password.through.protected.mechanism"),
PROVIDERARG("providerarg", "<arg>", "provider.argument"),
PROVIDERCLASS("providerclass", "<providerclass>", "provider.class.name"),
PROVIDERNAME("providername", "<providername>", "provider.name"),
PROVIDERPATH("providerpath", "<pathlist>", "provider.classpath"),
RFC("rfc", null, "output.in.RFC.style"),
SIGALG("sigalg", "<sigalg>", "signature.algorithm.name"),
SRCALIAS("srcalias", "<srcalias>", "source.alias"),
SRCKEYPASS("srckeypass", "<arg>", "source.key.password"),
SRCKEYSTORE("srckeystore", "<srckeystore>", "source.keystore.name"),
SRCPROTECTED("srcprotected", null, "source.keystore.password.protected"),
SRCPROVIDERNAME("srcprovidername", "<srcprovidername>", "source.keystore.provider.name"),
SRCSTOREPASS("srcstorepass", "<arg>", "source.keystore.password"),
SRCSTORETYPE("srcstoretype", "<srcstoretype>", "source.keystore.type"),
STARTDATE("startdate", "<startdate>", "certificate.validity.start.date.time"),
STOREPASS("storepass", "<arg>", "keystore.password"),
STORETYPE("storetype", "<storetype>", "keystore.type"),
TRUSTCACERTS("trustcacerts", null, "trust.certificates.from.cacerts"),
V("v", null, "verbose.output"),
VALIDITY("validity", "<valDays>", "validity.number.of.days");
final String name, arg, description;
Option(String name, String arg, String description) {
this.name = name;
this.arg = arg;
this.description = description;
}
@Override
public String toString() {
return "-" + name;
}
};
private static final Class[] PARAM_STRING = { String.class };
private static final String NONE = "NONE";
private static final String P11KEYSTORE = "PKCS11";
private static final String P12KEYSTORE = "PKCS12";
private final String keyAlias = "mykey";
private static final java.util.ResourceBundle rb =
java.util.ResourceBundle.getBundle(
"sun.security.tools.keytool.Resources");
private static final Collator collator = Collator.getInstance();
static {
collator.setStrength(Collator.PRIMARY);
};
private Main() { }
public static void main(String[] args) throws Exception {
Main kt = new Main();
kt.run(args, System.out);
}
private void run(String[] args, PrintStream out) throws Exception {
try {
parseArgs(args);
if (command != null) {
doCommands(out);
}
} catch (Exception e) {
System.out.println(rb.getString("keytool.error.") + e);
if (verbose) {
e.printStackTrace(System.out);
}
if (!debug) {
System.exit(1);
} else {
throw e;
}
} finally {
for (char[] pass : passwords) {
if (pass != null) {
Arrays.fill(pass, ' ');
pass = null;
}
}
if (ksStream != null) {
ksStream.close();
}
}
}
void parseArgs(String[] args) {
int i=0;
boolean help = args.length == 0;
for (i=0; (i < args.length) && args[i].startsWith("-"); i++) {
String flags = args[i];
if (i == args.length - 1) {
for (Option option: Option.values()) {
if (collator.compare(flags, option.toString()) == 0) {
if (option.arg != null) errorNeedArgument(flags);
break;
}
}
}
boolean isCommand = false;
for (Command c: Command.values()) {
if (collator.compare(flags, c.toString()) == 0) {
command = c;
isCommand = true;
break;
}
}
if (isCommand) {
} else if (collator.compare(flags, "-export") == 0) {
command = EXPORTCERT;
} else if (collator.compare(flags, "-genkey") == 0) {
command = GENKEYPAIR;
} else if (collator.compare(flags, "-import") == 0) {
command = IMPORTCERT;
}
else if (collator.compare(flags, "-help") == 0) {
help = true;
}
else if (collator.compare(flags, "-keystore") == 0 ||
collator.compare(flags, "-destkeystore") == 0) {
ksfname = args[++i];
} else if (collator.compare(flags, "-storepass") == 0 ||
collator.compare(flags, "-deststorepass") == 0) {
storePass = args[++i].toCharArray();
passwords.add(storePass);
} else if (collator.compare(flags, "-storetype") == 0 ||
collator.compare(flags, "-deststoretype") == 0) {
storetype = args[++i];
} else if (collator.compare(flags, "-srcstorepass") == 0) {
srcstorePass = args[++i].toCharArray();
passwords.add(srcstorePass);
} else if (collator.compare(flags, "-srcstoretype") == 0) {
srcstoretype = args[++i];
} else if (collator.compare(flags, "-srckeypass") == 0) {
srckeyPass = args[++i].toCharArray();
passwords.add(srckeyPass);
} else if (collator.compare(flags, "-srcprovidername") == 0) {
srcProviderName = args[++i];
} else if (collator.compare(flags, "-providername") == 0 ||
collator.compare(flags, "-destprovidername") == 0) {
providerName = args[++i];
} else if (collator.compare(flags, "-providerpath") == 0) {
pathlist = args[++i];
} else if (collator.compare(flags, "-keypass") == 0) {
keyPass = args[++i].toCharArray();
passwords.add(keyPass);
} else if (collator.compare(flags, "-new") == 0) {
newPass = args[++i].toCharArray();
passwords.add(newPass);
} else if (collator.compare(flags, "-destkeypass") == 0) {
destKeyPass = args[++i].toCharArray();
passwords.add(destKeyPass);
} else if (collator.compare(flags, "-alias") == 0 ||
collator.compare(flags, "-srcalias") == 0) {
alias = args[++i];
} else if (collator.compare(flags, "-dest") == 0 ||
collator.compare(flags, "-destalias") == 0) {
dest = args[++i];
} else if (collator.compare(flags, "-dname") == 0) {
dname = args[++i];
} else if (collator.compare(flags, "-keysize") == 0) {
keysize = Integer.parseInt(args[++i]);
} else if (collator.compare(flags, "-keyalg") == 0) {
keyAlgName = args[++i];
} else if (collator.compare(flags, "-sigalg") == 0) {
sigAlgName = args[++i];
} else if (collator.compare(flags, "-startdate") == 0) {
startDate = args[++i];
} else if (collator.compare(flags, "-validity") == 0) {
validity = Long.parseLong(args[++i]);
} else if (collator.compare(flags, "-file") == 0) {
filename = args[++i];
} else if (collator.compare(flags, "-srckeystore") == 0) {
srcksfname = args[++i];
} else if ((collator.compare(flags, "-provider") == 0) ||
(collator.compare(flags, "-providerclass") == 0)) {
if (providers == null) {
providers = new HashSet<Pair <String, String>> (3);
}
String providerClass = args[++i];
String providerArg = null;
if (args.length > (i+1)) {
flags = args[i+1];
if (collator.compare(flags, "-providerarg") == 0) {
if (args.length == (i+2)) errorNeedArgument(flags);
providerArg = args[i+2];
i += 2;
}
}
providers.add(
new Pair<String, String>(providerClass, providerArg));
}
else if (collator.compare(flags, "-v") == 0) {
verbose = true;
} else if (collator.compare(flags, "-debug") == 0) {
debug = true;
} else if (collator.compare(flags, "-rfc") == 0) {
rfc = true;
} else if (collator.compare(flags, "-noprompt") == 0) {
noprompt = true;
} else if (collator.compare(flags, "-trustcacerts") == 0) {
trustcacerts = true;
} else if (collator.compare(flags, "-protected") == 0 ||
collator.compare(flags, "-destprotected") == 0) {
protectedPath = true;
} else if (collator.compare(flags, "-srcprotected") == 0) {
srcprotectedPath = true;
} else {
System.err.println(rb.getString("Illegal.option.") + flags);
tinyHelp();
}
}
if (i<args.length) {
System.err.println(rb.getString("Illegal.option.") + args[i]);
tinyHelp();
}
if (command == null) {
if (help) {
usage();
} else {
System.err.println(rb.getString("Usage.error.no.command.provided"));
tinyHelp();
}
} else if (help) {
usage();
command = null;
}
}
void doCommands(PrintStream out) throws Exception {
if (storetype == null) {
storetype = KeyStore.getDefaultType();
}
storetype = KeyStoreUtil.niceStoreTypeName(storetype);
if (srcstoretype == null) {
srcstoretype = KeyStore.getDefaultType();
}
srcstoretype = KeyStoreUtil.niceStoreTypeName(srcstoretype);
if (P11KEYSTORE.equalsIgnoreCase(storetype) ||
KeyStoreUtil.isWindowsKeyStore(storetype)) {
token = true;
if (ksfname == null) {
ksfname = NONE;
}
}
if (NONE.equals(ksfname)) {
nullStream = true;
}
if (token && !nullStream) {
System.err.println(MessageFormat.format(rb.getString
(".keystore.must.be.NONE.if.storetype.is.{0}"), storetype));
System.err.println();
tinyHelp();
}
if (token &&
(command == KEYPASSWD || command == STOREPASSWD)) {
throw new UnsupportedOperationException(MessageFormat.format(rb.getString
(".storepasswd.and.keypasswd.commands.not.supported.if.storetype.is.{0}"), storetype));
}
if (P12KEYSTORE.equalsIgnoreCase(storetype) && command == KEYPASSWD) {
throw new UnsupportedOperationException(rb.getString
(".keypasswd.commands.not.supported.if.storetype.is.PKCS12"));
}
if (token && (keyPass != null || newPass != null || destKeyPass != null)) {
throw new IllegalArgumentException(MessageFormat.format(rb.getString
(".keypass.and.new.can.not.be.specified.if.storetype.is.{0}"), storetype));
}
if (protectedPath) {
if (storePass != null || keyPass != null ||
newPass != null || destKeyPass != null) {
throw new IllegalArgumentException(rb.getString
("if.protected.is.specified.then.storepass.keypass.and.new.must.not.be.specified"));
}
}
if (srcprotectedPath) {
if (srcstorePass != null || srckeyPass != null) {
throw new IllegalArgumentException(rb.getString
("if.srcprotected.is.specified.then.srcstorepass.and.srckeypass.must.not.be.specified"));
}
}
if (KeyStoreUtil.isWindowsKeyStore(storetype)) {
if (storePass != null || keyPass != null ||
newPass != null || destKeyPass != null) {
throw new IllegalArgumentException(rb.getString
("if.keystore.is.not.password.protected.then.storepass.keypass.and.new.must.not.be.specified"));
}
}
if (KeyStoreUtil.isWindowsKeyStore(srcstoretype)) {
if (srcstorePass != null || srckeyPass != null) {
throw new IllegalArgumentException(rb.getString
("if.source.keystore.is.not.password.protected.then.srcstorepass.and.srckeypass.must.not.be.specified"));
}
}
if (validity <= (long)0) {
throw new Exception
(rb.getString("Validity.must.be.greater.than.zero"));
}
if (providers != null) {
ClassLoader cl = null;
if (pathlist != null) {
String path = null;
path = PathList.appendPath(
path, System.getProperty("java.class.path"));
path = PathList.appendPath(
path, System.getProperty("env.class.path"));
path = PathList.appendPath(path, pathlist);
URL[] urls = PathList.pathToURLs(path);
cl = new URLClassLoader(urls);
} else {
cl = ClassLoader.getSystemClassLoader();
}
for (Pair <String, String> provider: providers) {
String provName = provider.fst;
Class<?> provClass;
if (cl != null) {
provClass = cl.loadClass(provName);
} else {
provClass = Class.forName(provName);
}
String provArg = provider.snd;
Object obj;
if (provArg == null) {
obj = provClass.newInstance();
} else {
Constructor<?> c = provClass.getConstructor(PARAM_STRING);
obj = c.newInstance(provArg);
}
if (!(obj instanceof Provider)) {
MessageFormat form = new MessageFormat
(rb.getString("provName.not.a.provider"));
Object[] source = {provName};
throw new Exception(form.format(source));
}
Security.addProvider((Provider)obj);
}
}
if (command == LIST && verbose && rfc) {
System.err.println(rb.getString
("Must.not.specify.both.v.and.rfc.with.list.command"));
tinyHelp();
}
if (command == GENKEYPAIR && keyPass!=null && keyPass.length < 6) {
throw new Exception(rb.getString
("Key.password.must.be.at.least.6.characters"));
}
if (newPass != null && newPass.length < 6) {
throw new Exception(rb.getString
("New.password.must.be.at.least.6.characters"));
}
if (destKeyPass != null && destKeyPass.length < 6) {
throw new Exception(rb.getString
("New.password.must.be.at.least.6.characters"));
}
if (command != PRINTCERT) {
if (ksfname == null) {
ksfname = System.getProperty("user.home") + File.separator
+ ".keystore";
}
if (!nullStream) {
try {
ksfile = new File(ksfname);
if (ksfile.exists() && ksfile.length() == 0) {
throw new Exception(rb.getString
("Keystore.file.exists.but.is.empty.") + ksfname);
}
ksStream = new FileInputStream(ksfile);
} catch (FileNotFoundException e) {
if (command != GENKEYPAIR &&
command != GENSECKEY &&
command != IDENTITYDB &&
command != IMPORTCERT &&
command != IMPORTKEYSTORE) {
throw new Exception(rb.getString
("Keystore.file.does.not.exist.") + ksfname);
}
}
}
}
if ((command == KEYCLONE || command == CHANGEALIAS)
&& dest == null) {
dest = getAlias("destination");
if ("".equals(dest)) {
throw new Exception(rb.getString
("Must.specify.destination.alias"));
}
}
if (command == DELETE && alias == null) {
alias = getAlias(null);
if ("".equals(alias)) {
throw new Exception(rb.getString("Must.specify.alias"));
}
}
if (providerName == null) {
keyStore = KeyStore.getInstance(storetype);
} else {
keyStore = KeyStore.getInstance(storetype, providerName);
}
if (!nullStream) {
keyStore.load(ksStream, storePass);
if (ksStream != null) {
ksStream.close();
}
}
if (nullStream && storePass != null) {
keyStore.load(null, storePass);
} else if (!nullStream && storePass != null) {
if (ksStream == null && storePass.length < 6) {
throw new Exception(rb.getString
("Keystore.password.must.be.at.least.6.characters"));
}
} else if (storePass == null) {
if (!protectedPath && !KeyStoreUtil.isWindowsKeyStore(storetype) &&
(command == CERTREQ ||
command == DELETE ||
command == GENKEYPAIR ||
command == GENSECKEY ||
command == IMPORTCERT ||
command == IMPORTKEYSTORE ||
command == KEYCLONE ||
command == CHANGEALIAS ||
command == SELFCERT ||
command == STOREPASSWD ||
command == KEYPASSWD ||
command == IDENTITYDB)) {
int count = 0;
do {
if (command == IMPORTKEYSTORE) {
System.err.print
(rb.getString("Enter.destination.keystore.password."));
} else {
System.err.print
(rb.getString("Enter.keystore.password."));
}
System.err.flush();
storePass = Password.readPassword(System.in);
passwords.add(storePass);
if (!nullStream && (storePass == null || storePass.length < 6)) {
System.err.println(rb.getString
("Keystore.password.is.too.short.must.be.at.least.6.characters"));
storePass = null;
}
if (storePass != null && !nullStream && ksStream == null) {
System.err.print(rb.getString("Re.enter.new.password."));
char[] storePassAgain = Password.readPassword(System.in);
passwords.add(storePassAgain);
if (!Arrays.equals(storePass, storePassAgain)) {
System.err.println
(rb.getString("They.don.t.match.Try.again"));
storePass = null;
}
}
count++;
} while ((storePass == null) && count < 3);
if (storePass == null) {
System.err.println
(rb.getString("Too.many.failures.try.later"));
return;
}
} else if (!protectedPath
&& !KeyStoreUtil.isWindowsKeyStore(storetype)
&& !(command == PRINTCERT)) {
System.err.print(rb.getString("Enter.keystore.password."));
System.err.flush();
storePass = Password.readPassword(System.in);
passwords.add(storePass);
}
if (nullStream) {
keyStore.load(null, storePass);
} else if (ksStream != null) {
ksStream = new FileInputStream(ksfile);
keyStore.load(ksStream, storePass);
ksStream.close();
}
}
if (storePass != null && P12KEYSTORE.equalsIgnoreCase(storetype)) {
MessageFormat form = new MessageFormat(rb.getString(
"Warning.Different.store.and.key.passwords.not.supported.for.PKCS12.KeyStores.Ignoring.user.specified.command.value."));
if (keyPass != null && !Arrays.equals(storePass, keyPass)) {
Object[] source = {"-keypass"};
System.err.println(form.format(source));
keyPass = storePass;
}
if (newPass != null && !Arrays.equals(storePass, newPass)) {
Object[] source = {"-new"};
System.err.println(form.format(source));
newPass = storePass;
}
if (destKeyPass != null && !Arrays.equals(storePass, destKeyPass)) {
Object[] source = {"-destkeypass"};
System.err.println(form.format(source));
destKeyPass = storePass;
}
}
if (command == PRINTCERT || command == IMPORTCERT
|| command == IDENTITYDB) {
cf = CertificateFactory.getInstance("X509");
}
if (trustcacerts) {
caks = KeyStoreUtil.getCacertsKeyStore();
}
if (command == CERTREQ) {
PrintStream ps = null;
if (filename != null) {
ps = new PrintStream(new FileOutputStream
(filename));
out = ps;
}
try {
doCertReq(alias, sigAlgName, out);
} finally {
if (ps != null) {
ps.close();
}
}
if (verbose && filename != null) {
MessageFormat form = new MessageFormat(rb.getString
("Certification.request.stored.in.file.filename."));
Object[] source = {filename};
System.err.println(form.format(source));
System.err.println(rb.getString("Submit.this.to.your.CA"));
}
} else if (command == DELETE) {
doDeleteEntry(alias);
kssave = true;
} else if (command == EXPORTCERT) {
PrintStream ps = null;
if (filename != null) {
ps = new PrintStream(new FileOutputStream
(filename));
out = ps;
}
try {
doExportCert(alias, out);
} finally {
if (ps != null) {
ps.close();
}
}
if (filename != null) {
MessageFormat form = new MessageFormat(rb.getString
("Certificate.stored.in.file.filename."));
Object[] source = {filename};
System.err.println(form.format(source));
}
} else if (command == GENKEYPAIR) {
if (keyAlgName == null) {
keyAlgName = "DSA";
}
doGenKeyPair(alias, dname, keyAlgName, keysize, sigAlgName);
kssave = true;
} else if (command == GENSECKEY) {
if (keyAlgName == null) {
keyAlgName = "DES";
}
doGenSecretKey(alias, keyAlgName, keysize);
kssave = true;
} else if (command == IDENTITYDB) {
InputStream inStream = System.in;
if (filename != null) {
inStream = new FileInputStream(filename);
}
try {
doImportIdentityDatabase(inStream);
} finally {
if (inStream != System.in) {
inStream.close();
}
}
} else if (command == IMPORTCERT) {
InputStream inStream = System.in;
if (filename != null) {
inStream = new FileInputStream(filename);
}
try {
String importAlias = (alias!=null)?alias:keyAlias;
if (keyStore.entryInstanceOf(importAlias, KeyStore.PrivateKeyEntry.class)) {
kssave = installReply(importAlias, inStream);
if (kssave) {
System.err.println(rb.getString
("Certificate.reply.was.installed.in.keystore"));
} else {
System.err.println(rb.getString
("Certificate.reply.was.not.installed.in.keystore"));
}
} else if (!keyStore.containsAlias(importAlias) ||
keyStore.entryInstanceOf(importAlias,
KeyStore.TrustedCertificateEntry.class)) {
kssave = addTrustedCert(importAlias, inStream);
if (kssave) {
System.err.println(rb.getString
("Certificate.was.added.to.keystore"));
} else {
System.err.println(rb.getString
("Certificate.was.not.added.to.keystore"));
}
}
} finally {
if (inStream != System.in) {
inStream.close();
}
}
} else if (command == IMPORTKEYSTORE) {
doImportKeyStore();
kssave = true;
} else if (command == KEYCLONE) {
keyPassNew = newPass;
if (alias == null) {
alias = keyAlias;
}
if (keyStore.containsAlias(alias) == false) {
MessageFormat form = new MessageFormat
(rb.getString("Alias.alias.does.not.exist"));
Object[] source = {alias};
throw new Exception(form.format(source));
}
if (!keyStore.entryInstanceOf(alias, KeyStore.PrivateKeyEntry.class)) {
MessageFormat form = new MessageFormat(rb.getString(
"Alias.alias.references.an.entry.type.that.is.not.a.private.key.entry.The.keyclone.command.only.supports.cloning.of.private.key"));
Object[] source = {alias};
throw new Exception(form.format(source));
}
doCloneEntry(alias, dest, true);
kssave = true;
} else if (command == CHANGEALIAS) {
if (alias == null) {
alias = keyAlias;
}
doCloneEntry(alias, dest, false);
if (keyStore.containsAlias(alias)) {
doDeleteEntry(alias);
}
kssave = true;
} else if (command == KEYPASSWD) {
keyPassNew = newPass;
doChangeKeyPasswd(alias);
kssave = true;
} else if (command == LIST) {
if (alias != null) {
doPrintEntry(alias, out, true);
} else {
doPrintEntries(out);
}
} else if (command == PRINTCERT) {
InputStream inStream = System.in;
if (filename != null) {
inStream = new FileInputStream(filename);
}
try {
doPrintCert(inStream, out);
} finally {
if (inStream != System.in) {
inStream.close();
}
}
} else if (command == SELFCERT) {
doSelfCert(alias, dname, sigAlgName);
kssave = true;
} else if (command == STOREPASSWD) {
storePassNew = newPass;
if (storePassNew == null) {
storePassNew = getNewPasswd("keystore password", storePass);
}
kssave = true;
}
if (kssave) {
if (verbose) {
MessageFormat form = new MessageFormat
(rb.getString(".Storing.ksfname."));
Object[] source = {nullStream ? "keystore" : ksfname};
System.err.println(form.format(source));
}
if (token) {
keyStore.store(null, null);
} else {
FileOutputStream fout = null;
try {
fout = (nullStream ?
(FileOutputStream)null :
new FileOutputStream(ksfname));
keyStore.store
(fout,
(storePassNew!=null) ? storePassNew : storePass);
} finally {
if (fout != null) {
fout.close();
}
}
}
}
}
private void doCertReq(String alias, String sigAlgName, PrintStream out)
throws Exception
{
if (alias == null) {
alias = keyAlias;
}
Object[] objs = recoverKey(alias, storePass, keyPass);
PrivateKey privKey = (PrivateKey)objs[0];
if (keyPass == null) {
keyPass = (char[])objs[1];
}
Certificate cert = keyStore.getCertificate(alias);
if (cert == null) {
MessageFormat form = new MessageFormat
(rb.getString("alias.has.no.public.key.certificate."));
Object[] source = {alias};
throw new Exception(form.format(source));
}
PKCS10 request = new PKCS10(cert.getPublicKey());
if (sigAlgName == null) {
String keyAlgName = privKey.getAlgorithm();
if ("DSA".equalsIgnoreCase(keyAlgName)) {
sigAlgName = "SHA256WithDSA";
} else if ("DSS".equalsIgnoreCase(keyAlgName)) {
sigAlgName = "SHA1WithDSA";
} else if ("RSA".equalsIgnoreCase(keyAlgName)) {
sigAlgName = "SHA1WithRSA";
} else {
throw new Exception(rb.getString
("Cannot.derive.signature.algorithm"));
}
}
Signature signature = Signature.getInstance(sigAlgName);
signature.initSign(privKey);
X500Name subject =
new X500Name(((X509Certificate)cert).getSubjectDN().toString());
X500Signer signer = new X500Signer(signature, subject);
request.encodeAndSign(signer);
request.print(out);
}
private void doDeleteEntry(String alias) throws Exception {
if (keyStore.containsAlias(alias) == false) {
MessageFormat form = new MessageFormat
(rb.getString("Alias.alias.does.not.exist"));
Object[] source = {alias};
throw new Exception(form.format(source));
}
keyStore.deleteEntry(alias);
}
private void doExportCert(String alias, PrintStream out)
throws Exception
{
if (storePass == null
&& !KeyStoreUtil.isWindowsKeyStore(storetype)) {
printWarning();
}
if (alias == null) {
alias = keyAlias;
}
if (keyStore.containsAlias(alias) == false) {
MessageFormat form = new MessageFormat
(rb.getString("Alias.alias.does.not.exist"));
Object[] source = {alias};
throw new Exception(form.format(source));
}
X509Certificate cert = (X509Certificate)keyStore.getCertificate(alias);
if (cert == null) {
MessageFormat form = new MessageFormat
(rb.getString("Alias.alias.has.no.certificate"));
Object[] source = {alias};
throw new Exception(form.format(source));
}
dumpCert(cert, out);
}
private char[] promptForKeyPass(String alias, String orig, char[] origPass) throws Exception{
if (P12KEYSTORE.equalsIgnoreCase(storetype)) {
return origPass;
} else if (!token) {
int count;
for (count = 0; count < 3; count++) {
MessageFormat form = new MessageFormat(rb.getString
("Enter.key.password.for.alias."));
Object[] source = {alias};
System.err.println(form.format(source));
if (orig == null) {
System.err.print(rb.getString
(".RETURN.if.same.as.keystore.password."));
} else {
form = new MessageFormat(rb.getString
(".RETURN.if.same.as.for.otherAlias."));
Object[] src = {orig};
System.err.print(form.format(src));
}
System.err.flush();
char[] entered = Password.readPassword(System.in);
passwords.add(entered);
if (entered == null) {
return origPass;
} else if (entered.length >= 6) {
System.err.print(rb.getString("Re.enter.new.password."));
char[] passAgain = Password.readPassword(System.in);
passwords.add(passAgain);
if (!Arrays.equals(entered, passAgain)) {
System.err.println
(rb.getString("They.don.t.match.Try.again"));
continue;
}
return entered;
} else {
System.err.println(rb.getString
("Key.password.is.too.short.must.be.at.least.6.characters"));
}
}
if (count == 3) {
if (command == KEYCLONE) {
throw new Exception(rb.getString
("Too.many.failures.Key.entry.not.cloned"));
} else {
throw new Exception(rb.getString
("Too.many.failures.key.not.added.to.keystore"));
}
}
}
return null;
}
private void doGenSecretKey(String alias, String keyAlgName,
int keysize)
throws Exception
{
if (alias == null) {
alias = keyAlias;
}
if (keyStore.containsAlias(alias)) {
MessageFormat form = new MessageFormat(rb.getString
("Secret.key.not.generated.alias.alias.already.exists"));
Object[] source = {alias};
throw new Exception(form.format(source));
}
SecretKey secKey = null;
KeyGenerator keygen = KeyGenerator.getInstance(keyAlgName);
if (keysize != -1) {
keygen.init(keysize);
} else if ("DES".equalsIgnoreCase(keyAlgName)) {
keygen.init(56);
} else if ("DESede".equalsIgnoreCase(keyAlgName)) {
keygen.init(168);
} else {
throw new Exception(rb.getString
("Please.provide.keysize.for.secret.key.generation"));
}
secKey = keygen.generateKey();
if (keyPass == null) {
keyPass = promptForKeyPass(alias, null, storePass);
}
keyStore.setKeyEntry(alias, secKey, keyPass, null);
}
private void doGenKeyPair(String alias, String dname, String keyAlgName,
int keysize, String sigAlgName)
throws Exception
{
if (keysize == -1) {
if ("EC".equalsIgnoreCase(keyAlgName)) {
keysize = SecurityProviderConstants.DEF_EC_KEY_SIZE;
} else if ("RSA".equalsIgnoreCase(keyAlgName)) {
keysize = SecurityProviderConstants.DEF_RSA_KEY_SIZE;
} else if ("DSA".equalsIgnoreCase(keyAlgName)) {
keysize = SecurityProviderConstants.DEF_DSA_KEY_SIZE;
}
}
if (alias == null) {
alias = keyAlias;
}
if (keyStore.containsAlias(alias)) {
MessageFormat form = new MessageFormat(rb.getString
("Key.pair.not.generated.alias.alias.already.exists"));
Object[] source = {alias};
throw new Exception(form.format(source));
}
if (sigAlgName == null) {
if ("DSA".equalsIgnoreCase(keyAlgName)) {
sigAlgName = "SHA1WithDSA";
} else if ("RSA".equalsIgnoreCase(keyAlgName)) {
sigAlgName = "SHA256WithRSA";
} else if ("EC".equalsIgnoreCase(keyAlgName)) {
sigAlgName = "SHA256withECDSA";
} else {
throw new Exception(rb.getString
("Cannot.derive.signature.algorithm"));
}
}
CertAndKeyGen keypair =
new CertAndKeyGen(keyAlgName, sigAlgName, providerName);
X500Name x500Name;
if (dname == null) {
x500Name = getX500Name();
} else {
x500Name = new X500Name(dname);
}
keypair.generate(keysize);
PrivateKey privKey = keypair.getPrivateKey();
X509Certificate[] chain = new X509Certificate[1];
chain[0] = keypair.getSelfCertificate(
x500Name, getStartDate(startDate), validity*24L*60L*60L);
if (verbose) {
MessageFormat form = new MessageFormat(rb.getString
("Generating.keysize.bit.keyAlgName.key.pair.and.self.signed.certificate.sigAlgName.with.a.validity.of.validality.days.for"));
Object[] source = {new Integer(keysize),
privKey.getAlgorithm(),
chain[0].getSigAlgName(),
new Long(validity),
x500Name};
System.err.println(form.format(source));
}
if (keyPass == null) {
keyPass = promptForKeyPass(alias, null, storePass);
}
keyStore.setKeyEntry(alias, privKey, keyPass, chain);
}
private void doCloneEntry(String orig, String dest, boolean changePassword)
throws Exception
{
if (orig == null) {
orig = keyAlias;
}
if (keyStore.containsAlias(dest)) {
MessageFormat form = new MessageFormat
(rb.getString("Destination.alias.dest.already.exists"));
Object[] source = {dest};
throw new Exception(form.format(source));
}
Object[] objs = recoverEntry(keyStore, orig, storePass, keyPass);
Entry entry = (Entry)objs[0];
keyPass = (char[])objs[1];
PasswordProtection pp = null;
if (keyPass != null) {
if (!changePassword || P12KEYSTORE.equalsIgnoreCase(storetype)) {
keyPassNew = keyPass;
} else {
if (keyPassNew == null) {
keyPassNew = promptForKeyPass(dest, orig, keyPass);
}
}
pp = new PasswordProtection(keyPassNew);
}
keyStore.setEntry(dest, entry, pp);
}
private void doChangeKeyPasswd(String alias) throws Exception
{
if (alias == null) {
alias = keyAlias;
}
Object[] objs = recoverKey(alias, storePass, keyPass);
Key privKey = (Key)objs[0];
if (keyPass == null) {
keyPass = (char[])objs[1];
}
if (keyPassNew == null) {
MessageFormat form = new MessageFormat
(rb.getString("key.password.for.alias."));
Object[] source = {alias};
keyPassNew = getNewPasswd(form.format(source), keyPass);
}
keyStore.setKeyEntry(alias, privKey, keyPassNew,
keyStore.getCertificateChain(alias));
}
private void doImportIdentityDatabase(InputStream in)
throws Exception
{
byte[] encoded;
ByteArrayInputStream bais;
java.security.cert.X509Certificate newCert;
java.security.cert.Certificate[] chain = null;
PrivateKey privKey;
boolean modified = false;
IdentityDatabase idb = IdentityDatabase.fromStream(in);
for (Enumeration<Identity> enum_ = idb.identities();
enum_.hasMoreElements();) {
Identity id = enum_.nextElement();
newCert = null;
if ((id instanceof SystemSigner && ((SystemSigner)id).isTrusted())
|| (id instanceof SystemIdentity
&& ((SystemIdentity)id).isTrusted())) {
if (keyStore.containsAlias(id.getName())) {
MessageFormat form = new MessageFormat
(rb.getString("Keystore.entry.for.id.getName.already.exists"));
Object[] source = {id.getName()};
System.err.println(form.format(source));
continue;
}
java.security.Certificate[] certs = id.certificates();
if (certs!=null && certs.length>0) {
DerOutputStream dos = new DerOutputStream();
certs[0].encode(dos);
encoded = dos.toByteArray();
bais = new ByteArrayInputStream(encoded);
newCert = (X509Certificate)cf.generateCertificate(bais);
bais.close();
if (isSelfSigned(newCert)) {
PublicKey pubKey = newCert.getPublicKey();
try {
newCert.verify(pubKey);
} catch (Exception e) {
continue;
}
}
if (id instanceof SystemSigner) {
MessageFormat form = new MessageFormat(rb.getString
("Creating.keystore.entry.for.id.getName."));
Object[] source = {id.getName()};
System.err.println(form.format(source));
if (chain==null) {
chain = new java.security.cert.Certificate[1];
}
chain[0] = newCert;
privKey = ((SystemSigner)id).getPrivateKey();
keyStore.setKeyEntry(id.getName(), privKey, storePass,
chain);
} else {
keyStore.setCertificateEntry(id.getName(), newCert);
}
kssave = true;
}
}
}
if (!kssave) {
System.err.println(rb.getString
("No.entries.from.identity.database.added"));
}
}
private void doPrintEntry(String alias, PrintStream out,
boolean printWarning)
throws Exception
{
if (storePass == null && printWarning
&& !KeyStoreUtil.isWindowsKeyStore(storetype)) {
printWarning();
}
if (keyStore.containsAlias(alias) == false) {
MessageFormat form = new MessageFormat
(rb.getString("Alias.alias.does.not.exist"));
Object[] source = {alias};
throw new Exception(form.format(source));
}
if (verbose || rfc || debug) {
MessageFormat form = new MessageFormat
(rb.getString("Alias.name.alias"));
Object[] source = {alias};
out.println(form.format(source));
if (!token) {
form = new MessageFormat(rb.getString
("Creation.date.keyStore.getCreationDate.alias."));
Object[] src = {keyStore.getCreationDate(alias)};
out.println(form.format(src));
}
} else {
if (!token) {
MessageFormat form = new MessageFormat
(rb.getString("alias.keyStore.getCreationDate.alias."));
Object[] source = {alias, keyStore.getCreationDate(alias)};
out.print(form.format(source));
} else {
MessageFormat form = new MessageFormat
(rb.getString("alias."));
Object[] source = {alias};
out.print(form.format(source));
}
}
if (keyStore.entryInstanceOf(alias, KeyStore.SecretKeyEntry.class)) {
if (verbose || rfc || debug) {
Object[] source = {"SecretKeyEntry"};
out.println(new MessageFormat(
rb.getString("Entry.type.type.")).format(source));
} else {
out.println("SecretKeyEntry, ");
}
} else if (keyStore.entryInstanceOf(alias, KeyStore.PrivateKeyEntry.class)) {
if (verbose || rfc || debug) {
Object[] source = {"PrivateKeyEntry"};
out.println(new MessageFormat(
rb.getString("Entry.type.type.")).format(source));
} else {
out.println("PrivateKeyEntry, ");
}
Certificate[] chain = keyStore.getCertificateChain(alias);
if (chain != null) {
if (verbose || rfc || debug) {
out.println(rb.getString
("Certificate.chain.length.") + chain.length);
for (int i = 0; i < chain.length; i ++) {
MessageFormat form = new MessageFormat
(rb.getString("Certificate.i.1."));
Object[] source = {new Integer((i + 1))};
out.println(form.format(source));
if (verbose && (chain[i] instanceof X509Certificate)) {
printX509Cert((X509Certificate)(chain[i]), out);
} else if (debug) {
out.println(chain[i].toString());
} else {
dumpCert(chain[i], out);
}
}
} else {
out.println
(rb.getString("Certificate.fingerprint.SHA1.") +
getCertFingerPrint("SHA1", chain[0]));
}
}
} else if (keyStore.entryInstanceOf(alias,
KeyStore.TrustedCertificateEntry.class)) {
Certificate cert = keyStore.getCertificate(alias);
Object[] source = {"trustedCertEntry"};
String mf = new MessageFormat(
rb.getString("Entry.type.type.")).format(source) + "\n";
if (verbose && (cert instanceof X509Certificate)) {
out.println(mf);
printX509Cert((X509Certificate)cert, out);
} else if (rfc) {
out.println(mf);
dumpCert(cert, out);
} else if (debug) {
out.println(cert.toString());
} else {
out.println("trustedCertEntry, ");
out.println(rb.getString("Certificate.fingerprint.SHA1.")
+ getCertFingerPrint("SHA1", cert));
}
} else {
out.println(rb.getString("Unknown.Entry.Type"));
}
}
KeyStore loadSourceKeyStore() throws Exception {
boolean isPkcs11 = false;
InputStream is = null;
if (P11KEYSTORE.equalsIgnoreCase(srcstoretype) ||
KeyStoreUtil.isWindowsKeyStore(srcstoretype)) {
if (!NONE.equals(srcksfname)) {
System.err.println(MessageFormat.format(rb.getString
(".keystore.must.be.NONE.if.storetype.is.{0}"), srcstoretype));
System.err.println();
tinyHelp();
}
isPkcs11 = true;
} else {
if (srcksfname != null) {
File srcksfile = new File(srcksfname);
if (srcksfile.exists() && srcksfile.length() == 0) {
throw new Exception(rb.getString
("Source.keystore.file.exists.but.is.empty.") +
srcksfname);
}
is = new FileInputStream(srcksfile);
} else {
throw new Exception(rb.getString
("Please.specify.srckeystore"));
}
}
KeyStore store;
try {
if (srcProviderName == null) {
store = KeyStore.getInstance(srcstoretype);
} else {
store = KeyStore.getInstance(srcstoretype, srcProviderName);
}
if (srcstorePass == null
&& !srcprotectedPath
&& !KeyStoreUtil.isWindowsKeyStore(srcstoretype)) {
System.err.print(rb.getString("Enter.source.keystore.password."));
System.err.flush();
srcstorePass = Password.readPassword(System.in);
passwords.add(srcstorePass);
}
if (P12KEYSTORE.equalsIgnoreCase(srcstoretype)) {
if (srckeyPass != null && srcstorePass != null &&
!Arrays.equals(srcstorePass, srckeyPass)) {
MessageFormat form = new MessageFormat(rb.getString(
"Warning.Different.store.and.key.passwords.not.supported.for.PKCS12.KeyStores.Ignoring.user.specified.command.value."));
Object[] source = {"-srckeypass"};
System.err.println(form.format(source));
srckeyPass = srcstorePass;
}
}
store.load(is, srcstorePass);
} finally {
if (is != null) {
is.close();
}
}
if (srcstorePass == null
&& !KeyStoreUtil.isWindowsKeyStore(srcstoretype)) {
System.err.println();
System.err.println(rb.getString
(".WARNING.WARNING.WARNING."));
System.err.println(rb.getString
(".The.integrity.of.the.information.stored.in.the.srckeystore."));
System.err.println(rb.getString
(".WARNING.WARNING.WARNING."));
System.err.println();
}
return store;
}
private void doImportKeyStore() throws Exception {
if (alias != null) {
doImportKeyStoreSingle(loadSourceKeyStore(), alias);
} else {
if (dest != null || srckeyPass != null || destKeyPass != null) {
throw new Exception(rb.getString(
"if.alias.not.specified.destalias.srckeypass.and.destkeypass.must.not.be.specified"));
}
doImportKeyStoreAll(loadSourceKeyStore());
}
}
private int doImportKeyStoreSingle(KeyStore srckeystore, String alias)
throws Exception {
String newAlias = (dest==null) ? alias : dest;
if (keyStore.containsAlias(newAlias)) {
Object[] source = {alias};
if (noprompt) {
System.err.println(new MessageFormat(rb.getString(
"Warning.Overwriting.existing.alias.alias.in.destination.keystore")).format(source));
} else {
String reply = getYesNoReply(new MessageFormat(rb.getString(
"Existing.entry.alias.alias.exists.overwrite.no.")).format(source));
if ("NO".equals(reply)) {
newAlias = inputStringFromStdin(rb.getString
("Enter.new.alias.name.RETURN.to.cancel.import.for.this.entry."));
if ("".equals(newAlias)) {
System.err.println(new MessageFormat(rb.getString(
"Entry.for.alias.alias.not.imported.")).format(
source));
return 0;
}
}
}
}
Object[] objs = recoverEntry(srckeystore, alias, srcstorePass, srckeyPass);
Entry entry = (Entry)objs[0];
PasswordProtection pp = null;
if (destKeyPass != null) {
pp = new PasswordProtection(destKeyPass);
} else if (objs[1] != null) {
pp = new PasswordProtection((char[])objs[1]);
}
try {
keyStore.setEntry(newAlias, entry, pp);
return 1;
} catch (KeyStoreException kse) {
Object[] source2 = {alias, kse.toString()};
MessageFormat form = new MessageFormat(rb.getString(
"Problem.importing.entry.for.alias.alias.exception.Entry.for.alias.alias.not.imported."));
System.err.println(form.format(source2));
return 2;
}
}
private void doImportKeyStoreAll(KeyStore srckeystore) throws Exception {
int ok = 0;
int count = srckeystore.size();
for (Enumeration<String> e = srckeystore.aliases();
e.hasMoreElements(); ) {
String alias = e.nextElement();
int result = doImportKeyStoreSingle(srckeystore, alias);
if (result == 1) {
ok++;
Object[] source = {alias};
MessageFormat form = new MessageFormat(rb.getString("Entry.for.alias.alias.successfully.imported."));
System.err.println(form.format(source));
} else if (result == 2) {
if (!noprompt) {
String reply = getYesNoReply("Do you want to quit the import process? [no]: ");
if ("YES".equals(reply)) {
break;
}
}
}
}
Object[] source = {ok, count-ok};
MessageFormat form = new MessageFormat(rb.getString(
"Import.command.completed.ok.entries.successfully.imported.fail.entries.failed.or.cancelled"));
System.err.println(form.format(source));
}
private void doPrintEntries(PrintStream out)
throws Exception
{
if (storePass == null
&& !KeyStoreUtil.isWindowsKeyStore(storetype)) {
printWarning();
} else {
out.println();
}
out.println(rb.getString("Keystore.type.") + keyStore.getType());
out.println(rb.getString("Keystore.provider.") +
keyStore.getProvider().getName());
out.println();
MessageFormat form;
form = (keyStore.size() == 1) ?
new MessageFormat(rb.getString
("Your.keystore.contains.keyStore.size.entry")) :
new MessageFormat(rb.getString
("Your.keystore.contains.keyStore.size.entries"));
Object[] source = {new Integer(keyStore.size())};
out.println(form.format(source));
out.println();
for (Enumeration<String> e = keyStore.aliases();
e.hasMoreElements(); ) {
String alias = e.nextElement();
doPrintEntry(alias, out, false);
if (verbose || rfc) {
out.println(rb.getString("NEWLINE"));
out.println(rb.getString
("STAR"));
out.println(rb.getString
("STARNN"));
}
}
}
private void doPrintCert(InputStream in, PrintStream out)
throws Exception
{
Collection<? extends Certificate> c = null;
try {
c = cf.generateCertificates(in);
} catch (CertificateException ce) {
throw new Exception(rb.getString("Failed.to.parse.input"), ce);
}
if (c.isEmpty()) {
throw new Exception(rb.getString("Empty.input"));
}
Certificate[] certs = c.toArray(new Certificate[c.size()]);
for (int i=0; i<certs.length; i++) {
X509Certificate x509Cert = null;
try {
x509Cert = (X509Certificate)certs[i];
} catch (ClassCastException cce) {
throw new Exception(rb.getString("Not.X.509.certificate"));
}
if (certs.length > 1) {
MessageFormat form = new MessageFormat
(rb.getString("Certificate.i.1."));
Object[] source = {new Integer(i + 1)};
out.println(form.format(source));
}
printX509Cert(x509Cert, out);
if (i < (certs.length-1)) {
out.println();
}
}
}
private void doSelfCert(String alias, String dname, String sigAlgName)
throws Exception
{
if (alias == null) {
alias = keyAlias;
}
Object[] objs = recoverKey(alias, storePass, keyPass);
PrivateKey privKey = (PrivateKey)objs[0];
if (keyPass == null)
keyPass = (char[])objs[1];
if (sigAlgName == null) {
String keyAlgName = privKey.getAlgorithm();
if ("DSA".equalsIgnoreCase(keyAlgName)
|| "DSS".equalsIgnoreCase(keyAlgName)) {
sigAlgName = "SHA1WithDSA";
} else if ("RSA".equalsIgnoreCase(keyAlgName)) {
sigAlgName = "SHA1WithRSA";
} else if ("EC".equalsIgnoreCase(keyAlgName)) {
sigAlgName = "SHA1withECDSA";
} else {
throw new Exception
(rb.getString("Cannot.derive.signature.algorithm"));
}
}
Certificate oldCert = keyStore.getCertificate(alias);
if (oldCert == null) {
MessageFormat form = new MessageFormat
(rb.getString("alias.has.no.public.key"));
Object[] source = {alias};
throw new Exception(form.format(source));
}
if (!(oldCert instanceof X509Certificate)) {
MessageFormat form = new MessageFormat
(rb.getString("alias.has.no.X.509.certificate"));
Object[] source = {alias};
throw new Exception(form.format(source));
}
byte[] encoded = oldCert.getEncoded();
X509CertImpl certImpl = new X509CertImpl(encoded);
X509CertInfo certInfo = (X509CertInfo)certImpl.get(X509CertImpl.NAME
+ "." +
X509CertImpl.INFO);
Date firstDate = getStartDate(startDate);
Date lastDate = new Date();
lastDate.setTime(firstDate.getTime() + validity*1000L*24L*60L*60L);
CertificateValidity interval = new CertificateValidity(firstDate,
lastDate);
certInfo.set(X509CertInfo.VALIDITY, interval);
certInfo.set(X509CertInfo.SERIAL_NUMBER, new CertificateSerialNumber
((int)(firstDate.getTime()/1000)));
X500Name owner;
if (dname == null) {
owner = (X500Name)certInfo.get(X509CertInfo.SUBJECT + "." +
CertificateSubjectName.DN_NAME);
} else {
owner = new X500Name(dname);
certInfo.set(X509CertInfo.SUBJECT + "." +
CertificateSubjectName.DN_NAME, owner);
}
certInfo.set(X509CertInfo.ISSUER + "." +
CertificateIssuerName.DN_NAME, owner);
X509CertImpl newCert = new X509CertImpl(certInfo);
newCert.sign(privKey, sigAlgName);
AlgorithmId sigAlgid = (AlgorithmId)newCert.get(X509CertImpl.SIG_ALG);
certInfo.set(CertificateAlgorithmId.NAME + "." +
CertificateAlgorithmId.ALGORITHM, sigAlgid);
certInfo.set(X509CertInfo.VERSION,
new CertificateVersion(CertificateVersion.V3));
newCert = new X509CertImpl(certInfo);
newCert.sign(privKey, sigAlgName);
keyStore.setKeyEntry(alias, privKey,
(keyPass != null) ? keyPass : storePass,
new Certificate[] { newCert } );
if (verbose) {
System.err.println(rb.getString("New.certificate.self.signed."));
System.err.print(newCert.toString());
System.err.println();
}
}
private boolean installReply(String alias, InputStream in)
throws Exception
{
if (alias == null) {
alias = keyAlias;
}
Object[] objs = recoverKey(alias, storePass, keyPass);
PrivateKey privKey = (PrivateKey)objs[0];
if (keyPass == null) {
keyPass = (char[])objs[1];
}
Certificate userCert = keyStore.getCertificate(alias);
if (userCert == null) {
MessageFormat form = new MessageFormat
(rb.getString("alias.has.no.public.key.certificate."));
Object[] source = {alias};
throw new Exception(form.format(source));
}
Collection<? extends Certificate> c = cf.generateCertificates(in);
if (c.isEmpty()) {
throw new Exception(rb.getString("Reply.has.no.certificates"));
}
Certificate[] replyCerts = c.toArray(new Certificate[c.size()]);
Certificate[] newChain;
if (replyCerts.length == 1) {
newChain = establishCertChain(userCert, replyCerts[0]);
} else {
newChain = validateReply(alias, userCert, replyCerts);
}
if (newChain != null) {
keyStore.setKeyEntry(alias, privKey,
(keyPass != null) ? keyPass : storePass,
newChain);
return true;
} else {
return false;
}
}
private boolean addTrustedCert(String alias, InputStream in)
throws Exception
{
if (alias == null) {
throw new Exception(rb.getString("Must.specify.alias"));
}
if (keyStore.containsAlias(alias)) {
MessageFormat form = new MessageFormat(rb.getString
("Certificate.not.imported.alias.alias.already.exists"));
Object[] source = {alias};
throw new Exception(form.format(source));
}
X509Certificate cert = null;
try {
cert = (X509Certificate)cf.generateCertificate(in);
} catch (ClassCastException cce) {
throw new Exception(rb.getString("Input.not.an.X.509.certificate"));
} catch (CertificateException ce) {
throw new Exception(rb.getString("Input.not.an.X.509.certificate"));
}
boolean selfSigned = false;
if (isSelfSigned(cert)) {
cert.verify(cert.getPublicKey());
selfSigned = true;
}
if (noprompt) {
keyStore.setCertificateEntry(alias, cert);
return true;
}
String reply = null;
String trustalias = keyStore.getCertificateAlias(cert);
if (trustalias != null) {
MessageFormat form = new MessageFormat(rb.getString
("Certificate.already.exists.in.keystore.under.alias.trustalias."));
Object[] source = {trustalias};
System.err.println(form.format(source));
reply = getYesNoReply
(rb.getString("Do.you.still.want.to.add.it.no."));
} else if (selfSigned) {
if (trustcacerts && (caks != null) &&
((trustalias=caks.getCertificateAlias(cert)) != null)) {
MessageFormat form = new MessageFormat(rb.getString
("Certificate.already.exists.in.system.wide.CA.keystore.under.alias.trustalias."));
Object[] source = {trustalias};
System.err.println(form.format(source));
reply = getYesNoReply
(rb.getString("Do.you.still.want.to.add.it.to.your.own.keystore.no."));
}
if (trustalias == null) {
printX509Cert(cert, System.out);
reply = getYesNoReply
(rb.getString("Trust.this.certificate.no."));
}
}
if (reply != null) {
if ("YES".equals(reply)) {
keyStore.setCertificateEntry(alias, cert);
return true;
} else {
return false;
}
}
try {
Certificate[] chain = establishCertChain(null, cert);
if (chain != null) {
keyStore.setCertificateEntry(alias, cert);
return true;
}
} catch (Exception e) {
printX509Cert(cert, System.out);
reply = getYesNoReply
(rb.getString("Trust.this.certificate.no."));
if ("YES".equals(reply)) {
keyStore.setCertificateEntry(alias, cert);
return true;
} else {
return false;
}
}
return false;
}
private char[] getNewPasswd(String prompt, char[] oldPasswd)
throws Exception
{
char[] entered = null;
char[] reentered = null;
for (int count = 0; count < 3; count++) {
MessageFormat form = new MessageFormat
(rb.getString("New.prompt."));
Object[] source = {prompt};
System.err.print(form.format(source));
entered = Password.readPassword(System.in);
passwords.add(entered);
if (entered == null || entered.length < 6) {
System.err.println(rb.getString
("Password.is.too.short.must.be.at.least.6.characters"));
} else if (Arrays.equals(entered, oldPasswd)) {
System.err.println(rb.getString("Passwords.must.differ"));
} else {
form = new MessageFormat
(rb.getString("Re.enter.new.prompt."));
Object[] src = {prompt};
System.err.print(form.format(src));
reentered = Password.readPassword(System.in);
passwords.add(reentered);
if (!Arrays.equals(entered, reentered)) {
System.err.println
(rb.getString("They.don.t.match.Try.again"));
} else {
Arrays.fill(reentered, ' ');
return entered;
}
}
if (entered != null) {
Arrays.fill(entered, ' ');
entered = null;
}
if (reentered != null) {
Arrays.fill(reentered, ' ');
reentered = null;
}
}
throw new Exception(rb.getString("Too.many.failures.try.later"));
}
private String getAlias(String prompt) throws Exception {
if (prompt != null) {
MessageFormat form = new MessageFormat
(rb.getString("Enter.prompt.alias.name."));
Object[] source = {prompt};
System.err.print(form.format(source));
} else {
System.err.print(rb.getString("Enter.alias.name."));
}
return (new BufferedReader(new InputStreamReader(
System.in))).readLine();
}
private String inputStringFromStdin(String prompt) throws Exception {
System.err.print(prompt);
return (new BufferedReader(new InputStreamReader(
System.in))).readLine();
}
private char[] getKeyPasswd(String alias, String otherAlias,
char[] otherKeyPass)
throws Exception
{
int count = 0;
char[] keyPass = null;
do {
if (otherKeyPass != null) {
MessageFormat form = new MessageFormat(rb.getString
("Enter.key.password.for.alias."));
Object[] source = {alias};
System.err.println(form.format(source));
form = new MessageFormat(rb.getString
(".RETURN.if.same.as.for.otherAlias."));
Object[] src = {otherAlias};
System.err.print(form.format(src));
} else {
MessageFormat form = new MessageFormat(rb.getString
("Enter.key.password.for.alias."));
Object[] source = {alias};
System.err.print(form.format(source));
}
System.err.flush();
keyPass = Password.readPassword(System.in);
passwords.add(keyPass);
if (keyPass == null) {
keyPass = otherKeyPass;
}
count++;
} while ((keyPass == null) && count < 3);
if (keyPass == null) {
throw new Exception(rb.getString("Too.many.failures.try.later"));
}
return keyPass;
}
private void printX509Cert(X509Certificate cert, PrintStream out)
throws Exception
{
MessageFormat form = new MessageFormat
(rb.getString(".PATTERN.printX509Cert"));
Object[] source = {cert.getSubjectDN().toString(),
cert.getIssuerDN().toString(),
cert.getSerialNumber().toString(16),
cert.getNotBefore().toString(),
cert.getNotAfter().toString(),
getCertFingerPrint("MD5", cert),
getCertFingerPrint("SHA1", cert),
getCertFingerPrint("SHA-256", cert),
cert.getSigAlgName(),
cert.getVersion()
};
out.println(form.format(source));
int extnum = 0;
if (cert instanceof X509CertImpl) {
X509CertImpl impl = (X509CertImpl)cert;
if (cert.getCriticalExtensionOIDs() != null) {
for (String extOID : cert.getCriticalExtensionOIDs()) {
if (extnum == 0) {
out.println();
out.println(rb.getString("Extensions."));
out.println();
}
out.println("#"+(++extnum)+": "+
impl.getExtension(new ObjectIdentifier(extOID)));
}
}
if (cert.getNonCriticalExtensionOIDs() != null) {
for (String extOID : cert.getNonCriticalExtensionOIDs()) {
if (extnum == 0) {
out.println();
out.println(rb.getString("Extensions."));
out.println();
}
Extension ext = impl.getExtension(new ObjectIdentifier(extOID));
if (ext != null) {
out.println("#"+(++extnum)+": "+ ext);
} else {
out.println("#"+(++extnum)+": "+
impl.getUnparseableExtension(new ObjectIdentifier(extOID)));
}
}
}
}
}
private boolean isSelfSigned(X509Certificate cert) {
return cert.getSubjectDN().equals(cert.getIssuerDN());
}
private boolean isTrusted(Certificate cert)
throws Exception
{
if (keyStore.getCertificateAlias(cert) != null) {
return true;
}
if (trustcacerts && (caks != null) &&
(caks.getCertificateAlias(cert) != null)) {
return true;
}
return false;
}
private X500Name getX500Name() throws IOException {
BufferedReader in;
in = new BufferedReader(new InputStreamReader(System.in));
String commonName = "Unknown";
String organizationalUnit = "Unknown";
String organization = "Unknown";
String city = "Unknown";
String state = "Unknown";
String country = "Unknown";
X500Name name;
String userInput = null;
int maxRetry = 20;
do {
if (maxRetry-- < 0) {
throw new RuntimeException(rb.getString(
"Too.many.retries.program.terminated"));
}
commonName = inputString(in,
rb.getString("What.is.your.first.and.last.name."),
commonName);
organizationalUnit = inputString(in,
rb.getString
("What.is.the.name.of.your.organizational.unit."),
organizationalUnit);
organization = inputString(in,
rb.getString("What.is.the.name.of.your.organization."),
organization);
city = inputString(in,
rb.getString("What.is.the.name.of.your.City.or.Locality."),
city);
state = inputString(in,
rb.getString("What.is.the.name.of.your.State.or.Province."),
state);
country = inputString(in,
rb.getString
("What.is.the.two.letter.country.code.for.this.unit."),
country);
name = new X500Name(commonName, organizationalUnit, organization,
city, state, country);
MessageFormat form = new MessageFormat
(rb.getString("Is.name.correct."));
Object[] source = {name};
userInput = inputString
(in, form.format(source), rb.getString("no"));
} while (collator.compare(userInput, rb.getString("yes")) != 0 &&
collator.compare(userInput, rb.getString("y")) != 0);
System.err.println();
return name;
}
private String inputString(BufferedReader in, String prompt,
String defaultValue)
throws IOException
{
System.err.println(prompt);
MessageFormat form = new MessageFormat
(rb.getString(".defaultValue."));
Object[] source = {defaultValue};
System.err.print(form.format(source));
System.err.flush();
String value = in.readLine();
if (value == null || collator.compare(value, "") == 0) {
value = defaultValue;
}
return value;
}
private void dumpCert(Certificate cert, PrintStream out)
throws IOException, CertificateException
{
if (rfc) {
BASE64Encoder encoder = new BASE64Encoder();
out.println(X509Factory.BEGIN_CERT);
encoder.encodeBuffer(cert.getEncoded(), out);
out.println(X509Factory.END_CERT);
} else {
out.write(cert.getEncoded());
}
}
private void byte2hex(byte b, StringBuffer buf) {
char[] hexChars = { '0', '1', '2', '3', '4', '5', '6', '7', '8',
'9', 'A', 'B', 'C', 'D', 'E', 'F' };
int high = ((b & 0xf0) >> 4);
int low = (b & 0x0f);
buf.append(hexChars[high]);
buf.append(hexChars[low]);
}
private String toHexString(byte[] block) {
StringBuffer buf = new StringBuffer();
int len = block.length;
for (int i = 0; i < len; i++) {
byte2hex(block[i], buf);
if (i < len-1) {
buf.append(":");
}
}
return buf.toString();
}
private Object[] recoverKey(String alias, char[] storePass,
char[] keyPass)
throws Exception
{
Key key = null;
if (keyStore.containsAlias(alias) == false) {
MessageFormat form = new MessageFormat
(rb.getString("Alias.alias.does.not.exist"));
Object[] source = {alias};
throw new Exception(form.format(source));
}
if (!keyStore.entryInstanceOf(alias, KeyStore.PrivateKeyEntry.class) &&
!keyStore.entryInstanceOf(alias, KeyStore.SecretKeyEntry.class)) {
MessageFormat form = new MessageFormat
(rb.getString("Alias.alias.has.no.key"));
Object[] source = {alias};
throw new Exception(form.format(source));
}
if (keyPass == null) {
try {
key = keyStore.getKey(alias, storePass);
keyPass = storePass;
passwords.add(keyPass);
} catch (UnrecoverableKeyException e) {
if (!token) {
keyPass = getKeyPasswd(alias, null, null);
key = keyStore.getKey(alias, keyPass);
} else {
throw e;
}
}
} else {
key = keyStore.getKey(alias, keyPass);
}
return new Object[] {key, keyPass};
}
private Object[] recoverEntry(KeyStore ks,
String alias,
char[] pstore,
char[] pkey) throws Exception {
if (ks.containsAlias(alias) == false) {
MessageFormat form = new MessageFormat
(rb.getString("Alias.alias.does.not.exist"));
Object[] source = {alias};
throw new Exception(form.format(source));
}
PasswordProtection pp = null;
Entry entry;
try {
entry = ks.getEntry(alias, pp);
pkey = null;
} catch (UnrecoverableEntryException une) {
if(P11KEYSTORE.equalsIgnoreCase(ks.getType()) ||
KeyStoreUtil.isWindowsKeyStore(ks.getType())) {
throw une;
}
if (pkey != null) {
pp = new PasswordProtection(pkey);
entry = ks.getEntry(alias, pp);
} else {
try {
pp = new PasswordProtection(pstore);
entry = ks.getEntry(alias, pp);
pkey = pstore;
} catch (UnrecoverableEntryException une2) {
if (P12KEYSTORE.equalsIgnoreCase(ks.getType())) {
throw une2;
} else {
pkey = getKeyPasswd(alias, null, null);
pp = new PasswordProtection(pkey);
entry = ks.getEntry(alias, pp);
}
}
}
}
return new Object[] {entry, pkey};
}
private String getCertFingerPrint(String mdAlg, Certificate cert)
throws Exception
{
byte[] encCertInfo = cert.getEncoded();
MessageDigest md = MessageDigest.getInstance(mdAlg);
byte[] digest = md.digest(encCertInfo);
return toHexString(digest);
}
private void printWarning() {
System.err.println();
System.err.println(rb.getString
(".WARNING.WARNING.WARNING."));
System.err.println(rb.getString
(".The.integrity.of.the.information.stored.in.your.keystore."));
System.err.println(rb.getString
(".WARNING.WARNING.WARNING."));
System.err.println();
}
private Certificate[] validateReply(String alias,
Certificate userCert,
Certificate[] replyCerts)
throws Exception
{
int i;
PublicKey userPubKey = userCert.getPublicKey();
for (i=0; i<replyCerts.length; i++) {
if (userPubKey.equals(replyCerts[i].getPublicKey())) {
break;
}
}
if (i == replyCerts.length) {
MessageFormat form = new MessageFormat(rb.getString
("Certificate.reply.does.not.contain.public.key.for.alias."));
Object[] source = {alias};
throw new Exception(form.format(source));
}
Certificate tmpCert = replyCerts[0];
replyCerts[0] = replyCerts[i];
replyCerts[i] = tmpCert;
Principal issuer = ((X509Certificate)replyCerts[0]).getIssuerDN();
for (i=1; i < replyCerts.length-1; i++) {
int j;
for (j=i; j<replyCerts.length; j++) {
Principal subject;
subject = ((X509Certificate)replyCerts[j]).getSubjectDN();
if (subject.equals(issuer)) {
tmpCert = replyCerts[i];
replyCerts[i] = replyCerts[j];
replyCerts[j] = tmpCert;
issuer = ((X509Certificate)replyCerts[i]).getIssuerDN();
break;
}
}
if (j == replyCerts.length) {
throw new Exception
(rb.getString("Incomplete.certificate.chain.in.reply"));
}
}
for (i=0; i<replyCerts.length-1; i++) {
PublicKey pubKey = replyCerts[i+1].getPublicKey();
try {
replyCerts[i].verify(pubKey);
} catch (Exception e) {
throw new Exception(rb.getString
("Certificate.chain.in.reply.does.not.verify.") +
e.getMessage());
}
}
if (noprompt) {
return replyCerts;
}
Certificate topCert = replyCerts[replyCerts.length-1];
if (!isTrusted(topCert)) {
boolean verified = false;
Certificate rootCert = null;
if (trustcacerts && (caks!= null)) {
for (Enumeration<String> aliases = caks.aliases();
aliases.hasMoreElements(); ) {
String name = aliases.nextElement();
rootCert = caks.getCertificate(name);
if (rootCert != null) {
try {
topCert.verify(rootCert.getPublicKey());
verified = true;
break;
} catch (Exception e) {
}
}
}
}
if (!verified) {
System.err.println();
System.err.println
(rb.getString("Top.level.certificate.in.reply."));
printX509Cert((X509Certificate)topCert, System.out);
System.err.println();
System.err.print(rb.getString(".is.not.trusted."));
String reply = getYesNoReply
(rb.getString("Install.reply.anyway.no."));
if ("NO".equals(reply)) {
return null;
}
} else {
if (!isSelfSigned((X509Certificate)topCert)) {
Certificate[] tmpCerts =
new Certificate[replyCerts.length+1];
System.arraycopy(replyCerts, 0, tmpCerts, 0,
replyCerts.length);
tmpCerts[tmpCerts.length-1] = rootCert;
replyCerts = tmpCerts;
}
}
}
return replyCerts;
}
private Certificate[] establishCertChain(Certificate userCert,
Certificate certToVerify)
throws Exception
{
if (userCert != null) {
PublicKey origPubKey = userCert.getPublicKey();
PublicKey replyPubKey = certToVerify.getPublicKey();
if (!origPubKey.equals(replyPubKey)) {
throw new Exception(rb.getString
("Public.keys.in.reply.and.keystore.don.t.match"));
}
if (certToVerify.equals(userCert)) {
throw new Exception(rb.getString
("Certificate.reply.and.certificate.in.keystore.are.identical"));
}
}
Hashtable<Principal, Vector<Certificate>> certs = null;
if (keyStore.size() > 0) {
certs = new Hashtable<Principal, Vector<Certificate>>(11);
keystorecerts2Hashtable(keyStore, certs);
}
if (trustcacerts) {
if (caks!=null && caks.size()>0) {
if (certs == null) {
certs = new Hashtable<Principal, Vector<Certificate>>(11);
}
keystorecerts2Hashtable(caks, certs);
}
}
Vector<Certificate> chain = new Vector<Certificate>(2);
if (buildChain((X509Certificate)certToVerify, chain, certs)) {
Certificate[] newChain = new Certificate[chain.size()];
int j=0;
for (int i=chain.size()-1; i>=0; i--) {
newChain[j] = chain.elementAt(i);
j++;
}
return newChain;
} else {
throw new Exception
(rb.getString("Failed.to.establish.chain.from.reply"));
}
}
private boolean buildChain(X509Certificate certToVerify,
Vector<Certificate> chain,
Hashtable<Principal, Vector<Certificate>> certs) {
Principal subject = certToVerify.getSubjectDN();
Principal issuer = certToVerify.getIssuerDN();
if (subject.equals(issuer)) {
chain.addElement(certToVerify);
return true;
}
Vector<Certificate> vec = certs.get(issuer);
if (vec == null) {
return false;
}
for (Enumeration<Certificate> issuerCerts = vec.elements();
issuerCerts.hasMoreElements(); ) {
X509Certificate issuerCert
= (X509Certificate)issuerCerts.nextElement();
PublicKey issuerPubKey = issuerCert.getPublicKey();
try {
certToVerify.verify(issuerPubKey);
} catch (Exception e) {
continue;
}
if (buildChain(issuerCert, chain, certs)) {
chain.addElement(certToVerify);
return true;
}
}
return false;
}
private String getYesNoReply(String prompt)
throws IOException
{
String reply = null;
int maxRetry = 20;
do {
if (maxRetry-- < 0) {
throw new RuntimeException(rb.getString(
"Too.many.retries.program.terminated"));
}
System.err.print(prompt);
System.err.flush();
reply = (new BufferedReader(new InputStreamReader
(System.in))).readLine();
if (collator.compare(reply, "") == 0 ||
collator.compare(reply, rb.getString("n")) == 0 ||
collator.compare(reply, rb.getString("no")) == 0) {
reply = "NO";
} else if (collator.compare(reply, rb.getString("y")) == 0 ||
collator.compare(reply, rb.getString("yes")) == 0) {
reply = "YES";
} else {
System.err.println(rb.getString("Wrong.answer.try.again"));
reply = null;
}
} while (reply == null);
return reply;
}
private void keystorecerts2Hashtable(KeyStore ks,
Hashtable<Principal, Vector<Certificate>> hash)
throws Exception {
for (Enumeration<String> aliases = ks.aliases();
aliases.hasMoreElements(); ) {
String alias = aliases.nextElement();
Certificate cert = ks.getCertificate(alias);
if (cert != null) {
Principal subjectDN = ((X509Certificate)cert).getSubjectDN();
Vector<Certificate> vec = hash.get(subjectDN);
if (vec == null) {
vec = new Vector<Certificate>();
vec.addElement(cert);
} else {
if (!vec.contains(cert)) {
vec.addElement(cert);
}
}
hash.put(subjectDN, vec);
}
}
}
private static Date getStartDate(String s) throws IOException {
Calendar c = new GregorianCalendar();
if (s != null) {
IOException ioe = new IOException(
rb.getString("Illegal.startdate.value"));
int len = s.length();
if (len == 0) {
throw ioe;
}
if (s.charAt(0) == '-' || s.charAt(0) == '+') {
int start = 0;
while (start < len) {
int sign = 0;
switch (s.charAt(start)) {
case '+': sign = 1; break;
case '-': sign = -1; break;
default: throw ioe;
}
int i = start+1;
for (; i<len; i++) {
char ch = s.charAt(i);
if (ch < '0' || ch > '9') break;
}
if (i == start+1) throw ioe;
int number = Integer.parseInt(s.substring(start+1, i));
if (i >= len) throw ioe;
int unit = 0;
switch (s.charAt(i)) {
case 'y': unit = Calendar.YEAR; break;
case 'm': unit = Calendar.MONTH; break;
case 'd': unit = Calendar.DATE; break;
case 'H': unit = Calendar.HOUR; break;
case 'M': unit = Calendar.MINUTE; break;
case 'S': unit = Calendar.SECOND; break;
default: throw ioe;
}
c.add(unit, sign * number);
start = i + 1;
}
} else {
String date = null, time = null;
if (len == 19) {
date = s.substring(0, 10);
time = s.substring(11);
if (s.charAt(10) != ' ')
throw ioe;
} else if (len == 10) {
date = s;
} else if (len == 8) {
time = s;
} else {
throw ioe;
}
if (date != null) {
if (date.matches("\\d\\d\\d\\d\\/\\d\\d\\/\\d\\d")) {
c.set(Integer.valueOf(date.substring(0, 4)),
Integer.valueOf(date.substring(5, 7))-1,
Integer.valueOf(date.substring(8, 10)));
} else {
throw ioe;
}
}
if (time != null) {
if (time.matches("\\d\\d:\\d\\d:\\d\\d")) {
c.set(Calendar.HOUR_OF_DAY, Integer.valueOf(time.substring(0, 2)));
c.set(Calendar.MINUTE, Integer.valueOf(time.substring(0, 2)));
c.set(Calendar.SECOND, Integer.valueOf(time.substring(0, 2)));
c.set(Calendar.MILLISECOND, 0);
} else {
throw ioe;
}
}
}
}
return c.getTime();
}
private void usage() {
if (command != null) {
System.err.println("keytool " + command +
rb.getString(".OPTION."));
System.err.println();
System.err.println(rb.getString(command.description));
System.err.println();
System.err.println(rb.getString("Options."));
System.err.println();
String[] left = new String[command.options.length];
String[] right = new String[command.options.length];
boolean found = false;
int lenLeft = 0;
for (int j=0; j<left.length; j++) {
Option opt = command.options[j];
left[j] = opt.toString();
if (opt.arg != null) left[j] += " " + opt.arg;
if (left[j].length() > lenLeft) {
lenLeft = left[j].length();
}
right[j] = rb.getString(opt.description);
}
for (int j=0; j<left.length; j++) {
System.err.printf(" %-" + lenLeft + "s %s\n",
left[j], right[j]);
}
System.err.println();
System.err.println(rb.getString(
"Use.keytool.help.for.all.available.commands"));
} else {
System.err.println(rb.getString(
"Key.and.Certificate.Management.Tool"));
System.err.println();
System.err.println(rb.getString("Commands."));
System.err.println();
for (Command c: Command.values()) {
if (c != IDENTITYDB
&& c != KEYCLONE
&& c != SELFCERT) {
System.err.printf(" %-20s%s\n", c, rb.getString(c.description));
}
}
System.err.println();
System.err.println(rb.getString(
"Use.keytool.command.name.help.for.usage.of.command.name"));
}
}
private void tinyHelp() {
usage();
if (debug) {
throw new RuntimeException("NO BIG ERROR, SORRY");
} else {
System.exit(1);
}
}
private void errorNeedArgument(String flag) {
Object[] source = {flag};
System.err.println(new MessageFormat(
rb.getString("Command.option.flag.needs.an.argument.")).format(source));
tinyHelp();
}
}
class Pair<A, B> {
public final A fst;
public final B snd;
public Pair(A fst, B snd) {
this.fst = fst;
this.snd = snd;
}
public String toString() {
return "Pair[" + fst + "," + snd + "]";
}
private static boolean equals(Object x, Object y) {
return (x == null && y == null) || (x != null && x.equals(y));
}
public boolean equals(Object other) {
return
other instanceof Pair &&
equals(fst, ((Pair)other).fst) &&
equals(snd, ((Pair)other).snd);
}
public int hashCode() {
if (fst == null) return (snd == null) ? 0 : snd.hashCode() + 1;
else if (snd == null) return fst.hashCode() + 2;
else return fst.hashCode() * 17 + snd.hashCode();
}
}
Main
debug: boolean
Command
