Spring/spring-credhub
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add keyUsage and extendedKeyUsage fields to generate certificate requests.

Browse Source 
Fixes #36
This commit is contained in:
Scott Frederick
2018-10-16 14:12:14 -05:00
parent 1bc8a63efa
commit 4d2e8aa56c
4 changed files with 154 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

54
spring-credhub-core/src/main/java/org/springframework/credhub/support/certificate/CertificateParameters.java
View File

@@ -37,6 +37,8 @@ public class CertificateParameters extends KeyParameters {
private Boolean certificateAuthority;
private Boolean selfSign;
private Integer duration;
private KeyUsage[] keyUsage;
private ExtendedKeyUsage[] extendedKeyUsage;
/**
* Create a {@link CertificateParameters} using defaults for all parameter values. Intended for internal use.
@@ -53,6 +55,8 @@ public class CertificateParameters extends KeyParameters {
this.certificateAuthorityCredential = null;
this.certificateAuthority = null;
this.selfSign = null;
this.keyUsage = null;
this.extendedKeyUsage = null;
}
/**
@@ -61,7 +65,8 @@ public class CertificateParameters extends KeyParameters {
private CertificateParameters(KeyLength keyLength, String commonName, String[] alternativeNames, String organization,
String organizationUnit, String locality, String state, String country,
Integer duration, String certificateAuthorityCredential,
Boolean certificateAuthority, Boolean selfSign) {
Boolean certificateAuthority, Boolean selfSign,
KeyUsage[] keyUsage, ExtendedKeyUsage[] extendedKeyUsage) {
super(keyLength);
this.commonName = commonName;
this.alternativeNames = alternativeNames;
@@ -74,6 +79,8 @@ public class CertificateParameters extends KeyParameters {
this.certificateAuthorityCredential = certificateAuthorityCredential;
this.certificateAuthority = certificateAuthority;
this.selfSign = selfSign;
this.keyUsage = keyUsage;
this.extendedKeyUsage = extendedKeyUsage;
}
/**
@@ -175,6 +182,24 @@ public class CertificateParameters extends KeyParameters {
return duration;
}
/**
* Get the value of the key usage extensions that will be used when generating the certificate.
*
* @return the value of the parameter; will be {@literal null} if not explicitly set
*/
public KeyUsage[] getKeyUsage() {
return keyUsage;
}
/**
* Get the value of the extended key usage extensions that will be used when generating the certificate.
*
* @return the value of the parameter; will be {@literal null} if not explicitly set
*/
public ExtendedKeyUsage[] getExtendedKeyUsage() {
return extendedKeyUsage;
}
/**
* Create a builder that provides a fluent API for providing the values required
* to construct a {@link CertificateParameters}.
@@ -201,6 +226,8 @@ public class CertificateParameters extends KeyParameters {
private String certificateAuthorityCredential;
private Boolean certificateAuthority;
private Boolean selfSign;
private KeyUsage[] keyUsage;
private ExtendedKeyUsage[] extendedKeyUsage;
/**
* Set the length of the key for the generated certificate.
@@ -345,6 +372,28 @@ public class CertificateParameters extends KeyParameters {
return this;
}
/**
* Set the value of the key usage extensions for the generated certificate.
*
* @param keyUsage one or more parameter values
* @return the builder
*/
public CertificateParametersBuilder keyUsage(KeyUsage... keyUsage) {
this.keyUsage = keyUsage;
return this;
}
/**
* Set the value of the extended key usage extensions for the generated certificate.
*
* @param extendedKeyUsage one or more parameter values
* @return the builder
*/
public CertificateParametersBuilder extendedKeyUsage(ExtendedKeyUsage... extendedKeyUsage) {
this.extendedKeyUsage = extendedKeyUsage;
return this;
}
/**
* Create a {@link CertificateParameters} from the provided values.
*
@@ -357,7 +406,8 @@ public class CertificateParameters extends KeyParameters {
Assert.isTrue(certificateAuthorityCredential != null || certificateAuthority != null || selfSign != null,
"at least one signing parameter must be specified");
return new CertificateParameters(keyLength, commonName, alternativeNames, organization, organizationUnit,
locality, state, country, duration, certificateAuthorityCredential, certificateAuthority, selfSign);
locality, state, country, duration, certificateAuthorityCredential, certificateAuthority, selfSign,
keyUsage, extendedKeyUsage);
}
}
}

37
spring-credhub-core/src/main/java/org/springframework/credhub/support/certificate/ExtendedKeyUsage.java Normal file
View File

@@ -0,0 +1,37 @@
package org.springframework.credhub.support.certificate;
/**
* The types of extended key usage extensions that can be assigned to a generated
* certificate.
*
* @author Scott Frederick
*/
public enum ExtendedKeyUsage {
CLIENT_AUTH("client_auth"),
SERVER_AUTH("server_auth"),
CODE_SIGNING("code_signing"),
EMAIL_PROTECTION("email_protection"),
TIMESTAMPING("timestamping");
private final String value;
ExtendedKeyUsage(String value) {
this.value = value;
}
/**
* Get the value as a {@code String}
*
* @return the mode value
*/
public String getValue() {
return value;
}
/**
* {@inheritDoc}
*/
public String toString() {
return value;
}
}

41
spring-credhub-core/src/main/java/org/springframework/credhub/support/certificate/KeyUsage.java Normal file
View File

@@ -0,0 +1,41 @@
package org.springframework.credhub.support.certificate;
/**
* The types of key usage extensions that can be assigned to a generated
* certificate.
*
* @author Scott Frederick
*/
public enum KeyUsage {
DIGITAL_SIGNATURE("digital_signature"),
NON_REPUDIATION("non_repudiation"),
KEY_ENCIPHERMENT("key_encipherment"),
DATA_ENCIPHERMENT("data_encipherment"),
KEY_AGREEMENT("key_agreement"),
KEY_CERT_SIGN("key_cert_sign"),
CRL_SIGN("crl_sign"),
ENCIPHER_ONLY("encipher_only"),
DECIPHER_ONLY("decipher_only");
private final String value;
KeyUsage(String value) {
this.value = value;
}
/**
* Get the value as a {@code String}
*
* @return the mode value
*/
public String getValue() {
return value;
}
/**
* {@inheritDoc}
*/
public String toString() {
return value;
}
}

26
spring-credhub-core/src/test/java/org/springframework/credhub/support/certificate/CertificateParametersRequestUnitTests.java
View File

@@ -57,6 +57,12 @@ public class CertificateParametersRequestUnitTests extends CredHubRequestUnitTes
.certificateAuthorityCredential("credential")
.certificateAuthority(true)
.selfSign(false)
.keyUsage(KeyUsage.CRL_SIGN, KeyUsage.DATA_ENCIPHERMENT, KeyUsage.DECIPHER_ONLY,
KeyUsage.DIGITAL_SIGNATURE, KeyUsage.ENCIPHER_ONLY, KeyUsage.KEY_AGREEMENT,
KeyUsage.KEY_CERT_SIGN, KeyUsage.KEY_ENCIPHERMENT, KeyUsage.NON_REPUDIATION)
.extendedKeyUsage(ExtendedKeyUsage.CLIENT_AUTH, ExtendedKeyUsage.CODE_SIGNING,
ExtendedKeyUsage.EMAIL_PROTECTION, ExtendedKeyUsage.SERVER_AUTH,
ExtendedKeyUsage.TIMESTAMPING)
.build());
String jsonValue = serializeToJson(requestBuilder);
@@ -75,7 +81,21 @@ public class CertificateParametersRequestUnitTests extends CredHubRequestUnitTes
hasJsonPath("$.parameters.duration", equalTo(1234)),
hasJsonPath("$.parameters.ca", equalTo("credential")),
hasJsonPath("$.parameters.is_ca", equalTo(true)),
hasJsonPath("$.parameters.self_sign", equalTo(false))));
hasJsonPath("$.parameters.self_sign", equalTo(false)),
hasJsonPath("$.parameters.key_usage[0]", equalTo(KeyUsage.CRL_SIGN.getValue())),
hasJsonPath("$.parameters.key_usage[1]", equalTo(KeyUsage.DATA_ENCIPHERMENT.getValue())),
hasJsonPath("$.parameters.key_usage[2]", equalTo(KeyUsage.DECIPHER_ONLY.getValue())),
hasJsonPath("$.parameters.key_usage[3]", equalTo(KeyUsage.DIGITAL_SIGNATURE.getValue())),
hasJsonPath("$.parameters.key_usage[4]", equalTo(KeyUsage.ENCIPHER_ONLY.getValue())),
hasJsonPath("$.parameters.key_usage[5]", equalTo(KeyUsage.KEY_AGREEMENT.getValue())),
hasJsonPath("$.parameters.key_usage[6]", equalTo(KeyUsage.KEY_CERT_SIGN.getValue())),
hasJsonPath("$.parameters.key_usage[7]", equalTo(KeyUsage.KEY_ENCIPHERMENT.getValue())),
hasJsonPath("$.parameters.key_usage[8]", equalTo(KeyUsage.NON_REPUDIATION.getValue())),
hasJsonPath("$.parameters.extended_key_usage[0]", equalTo(ExtendedKeyUsage.CLIENT_AUTH.getValue())),
hasJsonPath("$.parameters.extended_key_usage[1]", equalTo(ExtendedKeyUsage.CODE_SIGNING.getValue())),
hasJsonPath("$.parameters.extended_key_usage[2]", equalTo(ExtendedKeyUsage.EMAIL_PROTECTION.getValue())),
hasJsonPath("$.parameters.extended_key_usage[3]", equalTo(ExtendedKeyUsage.SERVER_AUTH.getValue())),
hasJsonPath("$.parameters.extended_key_usage[4]", equalTo(ExtendedKeyUsage.TIMESTAMPING.getValue()))));
}
@Test
@@ -105,7 +125,9 @@ public class CertificateParametersRequestUnitTests extends CredHubRequestUnitTes
hasNoJsonPath("$.parameters.country"),
hasNoJsonPath("$.parameters.duration"),
hasNoJsonPath("$.parameters.is_ca"),
hasNoJsonPath("$.parameters.self_sign")));
hasNoJsonPath("$.parameters.self_sign"),
hasNoJsonPath("$.parameters.key_usage"),
hasNoJsonPath("$.parameters.extended_key_usage")));
}
@Test