diff --git a/spring-credhub-core/src/main/java/org/springframework/credhub/support/certificate/CertificateParameters.java b/spring-credhub-core/src/main/java/org/springframework/credhub/support/certificate/CertificateParameters.java index 2ed0b5e..c8bd63e 100644 --- a/spring-credhub-core/src/main/java/org/springframework/credhub/support/certificate/CertificateParameters.java +++ b/spring-credhub-core/src/main/java/org/springframework/credhub/support/certificate/CertificateParameters.java @@ -37,6 +37,8 @@ public class CertificateParameters extends KeyParameters { private Boolean certificateAuthority; private Boolean selfSign; private Integer duration; + private KeyUsage[] keyUsage; + private ExtendedKeyUsage[] extendedKeyUsage; /** * Create a {@link CertificateParameters} using defaults for all parameter values. Intended for internal use. @@ -53,6 +55,8 @@ public class CertificateParameters extends KeyParameters { this.certificateAuthorityCredential = null; this.certificateAuthority = null; this.selfSign = null; + this.keyUsage = null; + this.extendedKeyUsage = null; } /** @@ -61,7 +65,8 @@ public class CertificateParameters extends KeyParameters { private CertificateParameters(KeyLength keyLength, String commonName, String[] alternativeNames, String organization, String organizationUnit, String locality, String state, String country, Integer duration, String certificateAuthorityCredential, - Boolean certificateAuthority, Boolean selfSign) { + Boolean certificateAuthority, Boolean selfSign, + KeyUsage[] keyUsage, ExtendedKeyUsage[] extendedKeyUsage) { super(keyLength); this.commonName = commonName; this.alternativeNames = alternativeNames; @@ -74,6 +79,8 @@ public class CertificateParameters extends KeyParameters { this.certificateAuthorityCredential = certificateAuthorityCredential; this.certificateAuthority = certificateAuthority; this.selfSign = selfSign; + this.keyUsage = keyUsage; + this.extendedKeyUsage = extendedKeyUsage; } /** @@ -175,6 +182,24 @@ public class CertificateParameters extends KeyParameters { return duration; } + /** + * Get the value of the key usage extensions that will be used when generating the certificate. + * + * @return the value of the parameter; will be {@literal null} if not explicitly set + */ + public KeyUsage[] getKeyUsage() { + return keyUsage; + } + + /** + * Get the value of the extended key usage extensions that will be used when generating the certificate. + * + * @return the value of the parameter; will be {@literal null} if not explicitly set + */ + public ExtendedKeyUsage[] getExtendedKeyUsage() { + return extendedKeyUsage; + } + /** * Create a builder that provides a fluent API for providing the values required * to construct a {@link CertificateParameters}. @@ -201,6 +226,8 @@ public class CertificateParameters extends KeyParameters { private String certificateAuthorityCredential; private Boolean certificateAuthority; private Boolean selfSign; + private KeyUsage[] keyUsage; + private ExtendedKeyUsage[] extendedKeyUsage; /** * Set the length of the key for the generated certificate. @@ -345,6 +372,28 @@ public class CertificateParameters extends KeyParameters { return this; } + /** + * Set the value of the key usage extensions for the generated certificate. + * + * @param keyUsage one or more parameter values + * @return the builder + */ + public CertificateParametersBuilder keyUsage(KeyUsage... keyUsage) { + this.keyUsage = keyUsage; + return this; + } + + /** + * Set the value of the extended key usage extensions for the generated certificate. + * + * @param extendedKeyUsage one or more parameter values + * @return the builder + */ + public CertificateParametersBuilder extendedKeyUsage(ExtendedKeyUsage... extendedKeyUsage) { + this.extendedKeyUsage = extendedKeyUsage; + return this; + } + /** * Create a {@link CertificateParameters} from the provided values. * @@ -357,7 +406,8 @@ public class CertificateParameters extends KeyParameters { Assert.isTrue(certificateAuthorityCredential != null || certificateAuthority != null || selfSign != null, "at least one signing parameter must be specified"); return new CertificateParameters(keyLength, commonName, alternativeNames, organization, organizationUnit, - locality, state, country, duration, certificateAuthorityCredential, certificateAuthority, selfSign); + locality, state, country, duration, certificateAuthorityCredential, certificateAuthority, selfSign, + keyUsage, extendedKeyUsage); } } } diff --git a/spring-credhub-core/src/main/java/org/springframework/credhub/support/certificate/ExtendedKeyUsage.java b/spring-credhub-core/src/main/java/org/springframework/credhub/support/certificate/ExtendedKeyUsage.java new file mode 100644 index 0000000..c45e38b --- /dev/null +++ b/spring-credhub-core/src/main/java/org/springframework/credhub/support/certificate/ExtendedKeyUsage.java @@ -0,0 +1,37 @@ +package org.springframework.credhub.support.certificate; + +/** + * The types of extended key usage extensions that can be assigned to a generated + * certificate. + * + * @author Scott Frederick + */ +public enum ExtendedKeyUsage { + CLIENT_AUTH("client_auth"), + SERVER_AUTH("server_auth"), + CODE_SIGNING("code_signing"), + EMAIL_PROTECTION("email_protection"), + TIMESTAMPING("timestamping"); + + private final String value; + + ExtendedKeyUsage(String value) { + this.value = value; + } + + /** + * Get the value as a {@code String} + * + * @return the mode value + */ + public String getValue() { + return value; + } + + /** + * {@inheritDoc} + */ + public String toString() { + return value; + } +} diff --git a/spring-credhub-core/src/main/java/org/springframework/credhub/support/certificate/KeyUsage.java b/spring-credhub-core/src/main/java/org/springframework/credhub/support/certificate/KeyUsage.java new file mode 100644 index 0000000..73bd7b8 --- /dev/null +++ b/spring-credhub-core/src/main/java/org/springframework/credhub/support/certificate/KeyUsage.java @@ -0,0 +1,41 @@ +package org.springframework.credhub.support.certificate; + +/** + * The types of key usage extensions that can be assigned to a generated + * certificate. + * + * @author Scott Frederick + */ +public enum KeyUsage { + DIGITAL_SIGNATURE("digital_signature"), + NON_REPUDIATION("non_repudiation"), + KEY_ENCIPHERMENT("key_encipherment"), + DATA_ENCIPHERMENT("data_encipherment"), + KEY_AGREEMENT("key_agreement"), + KEY_CERT_SIGN("key_cert_sign"), + CRL_SIGN("crl_sign"), + ENCIPHER_ONLY("encipher_only"), + DECIPHER_ONLY("decipher_only"); + + private final String value; + + KeyUsage(String value) { + this.value = value; + } + + /** + * Get the value as a {@code String} + * + * @return the mode value + */ + public String getValue() { + return value; + } + + /** + * {@inheritDoc} + */ + public String toString() { + return value; + } +} diff --git a/spring-credhub-core/src/test/java/org/springframework/credhub/support/certificate/CertificateParametersRequestUnitTests.java b/spring-credhub-core/src/test/java/org/springframework/credhub/support/certificate/CertificateParametersRequestUnitTests.java index e60ae4b..dcf6148 100644 --- a/spring-credhub-core/src/test/java/org/springframework/credhub/support/certificate/CertificateParametersRequestUnitTests.java +++ b/spring-credhub-core/src/test/java/org/springframework/credhub/support/certificate/CertificateParametersRequestUnitTests.java @@ -57,6 +57,12 @@ public class CertificateParametersRequestUnitTests extends CredHubRequestUnitTes .certificateAuthorityCredential("credential") .certificateAuthority(true) .selfSign(false) + .keyUsage(KeyUsage.CRL_SIGN, KeyUsage.DATA_ENCIPHERMENT, KeyUsage.DECIPHER_ONLY, + KeyUsage.DIGITAL_SIGNATURE, KeyUsage.ENCIPHER_ONLY, KeyUsage.KEY_AGREEMENT, + KeyUsage.KEY_CERT_SIGN, KeyUsage.KEY_ENCIPHERMENT, KeyUsage.NON_REPUDIATION) + .extendedKeyUsage(ExtendedKeyUsage.CLIENT_AUTH, ExtendedKeyUsage.CODE_SIGNING, + ExtendedKeyUsage.EMAIL_PROTECTION, ExtendedKeyUsage.SERVER_AUTH, + ExtendedKeyUsage.TIMESTAMPING) .build()); String jsonValue = serializeToJson(requestBuilder); @@ -75,7 +81,21 @@ public class CertificateParametersRequestUnitTests extends CredHubRequestUnitTes hasJsonPath("$.parameters.duration", equalTo(1234)), hasJsonPath("$.parameters.ca", equalTo("credential")), hasJsonPath("$.parameters.is_ca", equalTo(true)), - hasJsonPath("$.parameters.self_sign", equalTo(false)))); + hasJsonPath("$.parameters.self_sign", equalTo(false)), + hasJsonPath("$.parameters.key_usage[0]", equalTo(KeyUsage.CRL_SIGN.getValue())), + hasJsonPath("$.parameters.key_usage[1]", equalTo(KeyUsage.DATA_ENCIPHERMENT.getValue())), + hasJsonPath("$.parameters.key_usage[2]", equalTo(KeyUsage.DECIPHER_ONLY.getValue())), + hasJsonPath("$.parameters.key_usage[3]", equalTo(KeyUsage.DIGITAL_SIGNATURE.getValue())), + hasJsonPath("$.parameters.key_usage[4]", equalTo(KeyUsage.ENCIPHER_ONLY.getValue())), + hasJsonPath("$.parameters.key_usage[5]", equalTo(KeyUsage.KEY_AGREEMENT.getValue())), + hasJsonPath("$.parameters.key_usage[6]", equalTo(KeyUsage.KEY_CERT_SIGN.getValue())), + hasJsonPath("$.parameters.key_usage[7]", equalTo(KeyUsage.KEY_ENCIPHERMENT.getValue())), + hasJsonPath("$.parameters.key_usage[8]", equalTo(KeyUsage.NON_REPUDIATION.getValue())), + hasJsonPath("$.parameters.extended_key_usage[0]", equalTo(ExtendedKeyUsage.CLIENT_AUTH.getValue())), + hasJsonPath("$.parameters.extended_key_usage[1]", equalTo(ExtendedKeyUsage.CODE_SIGNING.getValue())), + hasJsonPath("$.parameters.extended_key_usage[2]", equalTo(ExtendedKeyUsage.EMAIL_PROTECTION.getValue())), + hasJsonPath("$.parameters.extended_key_usage[3]", equalTo(ExtendedKeyUsage.SERVER_AUTH.getValue())), + hasJsonPath("$.parameters.extended_key_usage[4]", equalTo(ExtendedKeyUsage.TIMESTAMPING.getValue())))); } @Test @@ -105,7 +125,9 @@ public class CertificateParametersRequestUnitTests extends CredHubRequestUnitTes hasNoJsonPath("$.parameters.country"), hasNoJsonPath("$.parameters.duration"), hasNoJsonPath("$.parameters.is_ca"), - hasNoJsonPath("$.parameters.self_sign"))); + hasNoJsonPath("$.parameters.self_sign"), + hasNoJsonPath("$.parameters.key_usage"), + hasNoJsonPath("$.parameters.extended_key_usage"))); } @Test