epp-rtk-java-commits Mailing List for Universal Registry/Registrar Toolkit (Page 6)

SourceForge Headquarters 225 Broadway Suite 1600 San Diego, CA 92101 +1 (858) 422-6466

Update of /cvsroot/epp-rtk/epp-rtk/java/ssl/old-ssl
In directory sc8-pr-cvs1:/tmp/cvs-serv18423/old-ssl

Added Files:
      Tag: epp-pre02
	CAStore CAcert.crt KeyStoreImport.class KeyStoreImport.java 
	README.TXT RTKsigned.cert ServerStore Servercert.crt Sign.java 
	keystoreimport.properties signedcert.crt ssl.properties 
Log Message:
'upgrading' the ssl directory from the old stuff to the new stuff
from epp0705

--- NEW FILE: CAStore ---
þíþí
+*
ÙºdsqßPX0n¼Ú3¹I}Ýý·Hrí¢ýØaKI1Øáìº-Qà*f¸&æòÞú¿ÁÙÎ·¼#ZÛ³Ûü©kg³b7cxtxx¨E3u
7×·Zr¿)¼Ð£hêL¿ü¼´úx@ôÐÞ(´ÁDÕWÔt÷òÏægÚ¯Z]Q¤içËLõÿìn4â\®396»q	{ÍÎ©Òx~¶jNÁÈpk=ÏJdÆ®w}ÔïmQT§RU;çþWóÔùØhÅW]ÚFAe,ù¢É÷1ïL³¨A{>$'ý§ïþ<ÛÀÙ{UdÅ$q5k<}ÔnnôX ú&ù¡`!êäXz¶±ýP½µc
tucows1
0Uoxrs10U	Tucows-CA0
010524050021Z
010822050021Z0e10	UCA10UOntario10UToronto10
U
tucows1
0Uoxrs10U	Tucows-CA0·0,*HÎ80
ëÞºçv ð=jjf ÷E²õH>t8õ=nÛK*ólüv/su=]éeÀ,m²\+T=°¬iðUÛG§ÆÑlíg¨Ôcn¶MZ0*HÎ8
--- NEW FILE: CAcert.crt ---
0ÿ0¼;e0*HÎ8
tucows1
0Uoxrs10U	Tucows-CA0
010524050021Z
010822050021Z0e10	UCA10UOntario10UToronto10
U
tucows1
0Uoxrs10U	Tucows-CA0·0,*HÎ80
ëÞºçv ð=jjf ÷E²õH>t8õ=nÛK*ólüv/su=]éeÀ,m²\+T=°¬iðUÛG§ÆÑlíg¨Ôcn¶MZ0*HÎ8
--- NEW FILE: KeyStoreImport.class ---
Êþº¾

SourceFile

,¶
¶

	¶
	¶
2¶
¶

--- NEW FILE: KeyStoreImport.java ---
import java.io.*;
import java.util.*;
import java.security.cert.*;
import java.security.*;
import java.math.*;
// import of some cdcProvider classes (mostly for RSAPrivCrtKey)
// available at http://www.informatik.tu-darmstadt.de/TI/Forschung/cdcProvider/overview.html
import cdc.standard.rsa.*;

class KeyStoreImport
{
    public static void main(String arg[])
    {
        try
        {

            Properties system_props = System.getProperties();
            String ssl_props_location = (String) system_props.getProperty("ssl.props.location");
            if ( ssl_props_location == null ||
                 ssl_props_location.length() == 0 )
            {
                throw new IOException("No ssl props location specified");
            }

            System.out.println("Loading ssl.properties...");

            Properties ssl_props = new Properties();
            ssl_props.load(new FileInputStream(ssl_props_location + "/ssl.properties"));

            System.out.println("Loading keystoreimport.properties...");

            Properties import_props = new Properties();
            import_props.load(new FileInputStream(ssl_props_location + "/keystoreimport.properties"));

            KeyStore ks = KeyStore.getInstance(((String)ssl_props.get("ssl.keystore.format")));

            System.out.println("Initializing the new keystore...");

            ks.load(null, null);

            char[] pwd = ((String)ssl_props.get("ssl.keystore.passphrase")).toCharArray();

            char[] kpwd = ((String)ssl_props.get("ssl.signedcert.passphrase")).toCharArray();

            CertificateFactory cf = CertificateFactory.getInstance(((String)import_props.get("cert.type")));

            System.out.println("Creating cert chain...");

            /*
             * This class assumes a two link cert chain... if your cert chain is long then 
             * make the cert array longer and load as many certs as required.
             */
            InputStream inStream = new FileInputStream(((String)import_props.get("cert1.filename")));
            java.security.cert.Certificate cert[] = new java.security.cert.Certificate[2];
            cert[0] = cf.generateCertificate( inStream );
            inStream.close();

            /*
             * Insert more links in the cert chain here....
             * (if enough people need this util, then we'll make it read as many certs
             *  as are defined in the keystoreimport.properties file - dm)
             */

            /*
             * The cert chain should always end with the CA cert.
             */
            inStream = new FileInputStream(((String)import_props.get("cacert.filename")));
            cert[1] = cf.generateCertificate( inStream );
            inStream.close();

            System.out.println("Adding the CA cert to the keystore...");

            ks.setCertificateEntry(((String)ssl_props.get("ssl.cacert.alias")), cert[1]);

            System.out.println("Generating the RSA Private Key with the loaded parameters...");

            BigInteger modulus = new BigInteger( ((String)import_props.get("rsaprivkey.modulus")),
                                                 Integer.parseInt(((String)import_props.get("rsaprivkey.modulus.radix"))) );
            BigInteger publicExponent = new BigInteger(((String)import_props.get("rsaprivkey.publicExponent")),
                                                 Integer.parseInt(((String)import_props.get("rsaprivkey.publicExponent.radix"))) );
            BigInteger privateExponent = new BigInteger(((String)import_props.get("rsaprivkey.privateExponent")),
                                                 Integer.parseInt(((String)import_props.get("rsaprivkey.privateExponent.radix"))) );
            BigInteger prime1 = new BigInteger( ((String)import_props.get("rsaprivkey.prime1")),
                                                Integer.parseInt(((String)import_props.get("rsaprivkey.prime1.radix"))) );
            BigInteger prime2 = new BigInteger( ((String)import_props.get("rsaprivkey.prime2")),
                                                Integer.parseInt(((String)import_props.get("rsaprivkey.prime2.radix"))) );
            BigInteger exponent1 = new BigInteger( ((String)import_props.get("rsaprivkey.exponent1")),
                                                   Integer.parseInt(((String)import_props.get("rsaprivkey.exponent1.radix"))) );
            BigInteger exponent2 = new BigInteger( ((String)import_props.get("rsaprivkey.exponent2")),
                                                   Integer.parseInt(((String)import_props.get("rsaprivkey.exponent2.radix"))) );
            BigInteger coefficient = new BigInteger( ((String)import_props.get("rsaprivkey.coefficient")),
                                                     Integer.parseInt(((String)import_props.get("rsaprivkey.coefficient.radix"))) );

            RSAPrivCrtKey rpck = new RSAPrivCrtKey(modulus,
                                                   privateExponent,
                                                   publicExponent,
                                                   prime1,
                                                   prime2,
                                                   exponent1,
                                                   exponent2,
                                                   coefficient);

            System.out.println("Setting the key entry in the keystore with the cert chain...");

            ks.setKeyEntry(((String)ssl_props.get("ssl.signedcert.alias")), rpck, kpwd, cert);

            System.out.println("Saving the keystore to ["+((String)ssl_props.get("ssl.keystore.file"))+"]");

            FileOutputStream store = new FileOutputStream(((String)ssl_props.get("ssl.keystore.file")));
            ks.store(store, pwd);
            store.close();

            System.out.println("All done.");
        }
        catch (Exception e)
        {
            System.out.println("Exception: " + e);
            e.printStackTrace();
        }
    }
}

--- NEW FILE: README.TXT ---
This file contains a bunch of tips and tricks collected in the
SF epp-rtk community.... feel free to contribute to this list...

Creating a JSSE keystore with OpenSSL
=====================================
[ thanks to wessorh for this tip ]

To create a keystore, readable by the JSSE, that contains a registrar's
current certs used with NSI do the following on your favorite unix box
with openSSL 0.9.6a installed.

example% cat client-key.pem client-cert.pem ca-cert.pem | openssl pkcs12 \
 -export -out keystore.pkcs12 -noiter -nomaciter -name my_cert_name

the keystore.pkcs12 can be read by any java based keytool, dont forget
the -storetype pkcs12 option...

Creating a JSSE keystore with KeyStoreImport
============================================
[ tip provided by tubadanm ]

It's a bit more complicated than the OpenSSL-only tip above...

I've tested this procedure with an RSA private key, it's public cert and
it's CA cert.  The KeyStoreImport Java source is included in this directory.

You will need the CDC JCE provider installed for this to work.
You can get the CDC at 
http://www.informatik.tu-darmstadt.de/TI/Forschung/cdcProvider/overview.html
The code.jar and cdc_standard.jar files should be all that you need.

Edit the ssl.properties to have the values you want.
Then edit the keystoreimport.properties file to contain the file names
of the cert and the cacert (can be either PEM or DER formats) and their type.
I haven't tested this with any other type than "x509".  Also the class is 
written to only load a two-cert chain.  You would have to edit the
KeyStoreImport.java code to load more and add the certs to the properties files.

The use OpenSSL rsa command (eg. openssl rsa -inform PEM|DER -in key_file -text )
to view the details of your RSA private key (use PEM or DER depending on the
file format).  The output of the command should show you, in HEX, the public
modulus, private and public exponents, primes 1 and 2, exponents 1 and 2 and
the coefficient of the RSA private key.  Take those numbers (be sure to strip
out the ':' out of the hex numbers) and put them into keystore.import.properties
with the appropriate property names.  Most of the radices should stay at 16.  
For my testing, the public exponent was shown in radix 10.  Be sure that each
long hex number has no spaces or line breaks in them.  (Yes, this step is a
PITA, but you should only have to do this once a year.)

Now, with this setup, run this command (this assumes that the JSSE and CDC JCE
jars are in $JAVA_HOME/jre/lib/ext, which automagically puts then in your
classpath):
java -Dssl.props.location=$RTK_HOME/java/ssl -classpath . KeyStoreImport
(or for Windows)
java -Dssl.props.location=%RTK_HOME%/java/ssl -classpath . KeyStoreImport

This should generate the keystore in the file specified in ssl.properties.

This has worked for me personally, but there are probably many variations of
certs, cert chains and keys out there so join epp-rtk-devel if you need help
or if you want to share your SSL horror stories and successes with us.

==========================

If none of these tip work for you, please join the epp-rtk-devel list
on Sourceforge and send your problem there.  Chances are that one of use
has seen the problem before.

--- NEW FILE: RTKsigned.cert ---
0þ0¼;g0*HÎ8
tucows1
0Uoxrs10U	Tucows-CA0
010524050439Z
010822050439Z0e10	UCA10UOntario10UToronto10
U
tucows1
0Uoxrs10U	developer0·0,*HÎ80
zÃÏêÚÊm~õù´0*HÎ8
--- NEW FILE: ServerStore ---
þíþí
tucows1
0Uoxrs10U	Tucows-CA0
010524050021Z
010822050021Z0e10	UCA10UOntario10UToronto10
U
tucows1
0Uoxrs10U	Tucows-CA0·0,*HÎ80
ëÞºçv ð=jjf ÷E²õH>t8õ=nÛK*ólüv/su=]éeÀ,m²\+T=°¬iðUÛG§ÆÑlíg¨Ôcn¶MZ0*HÎ8
+*
Áú×xÿòG54jJ Ç@8øô3+,ßÁÈ×ó©µÃý4ÆßùçÑÅUD$BÍüÈmê	\ÐnÈÙkvr´4	¼°"·}èÂ4ËÕhéþäÝ{°ô®8icÊáóQº¾P°¹B^ê÷²¡;Äø7$ð1ØãËÚ'ÛÜq»[Ï'ÐîB¿»?>Xat¼¹xäbNQgcp¾àjÞÅÂì¹ä®PgÅòò+.ÿ¼±iß,nL?OÚ
tucows1
0Uoxrs10U	Tucows-CA0
010524050439Z
010822050439Z0e10	UCA10UOntario10UToronto10
U
tucows1
0Uoxrs10U	developer0·0,*HÎ80
zÃÏêÚÊm~õù´0*HÎ8
tucows1
0Uoxrs10U	Tucows-CA0
010524050021Z
010822050021Z0e10	UCA10UOntario10UToronto10
U
tucows1
0Uoxrs10U	Tucows-CA0·0,*HÎ80
ëÞºçv ð=jjf ÷E²õH>t8õ=nÛK*ólüv/su=]éeÀ,m²\+T=°¬iðUÛG§ÆÑlíg¨Ôcn¶MZ0*HÎ8
--- NEW FILE: Servercert.crt ---
0þ0¼;g0*HÎ8
tucows1
0Uoxrs10U	developer0
010524050439Z
010822050439Z0e10	UCA10UOntario10UToronto10
U
tucows1
0Uoxrs10U	developer0·0,*HÎ80
zÃÏêÚÊm~õù´0*HÎ8
IUøj
--- NEW FILE: Sign.java ---
import java.io.*;
import java.security.*;
import sun.security.x509.*;
import sun.security.util.*;

class Sign
{
   public static void main(String arg[])
   {
      try
      {
         FileInputStream fisk = new FileInputStream("CAStore");
         KeyStore ks = KeyStore.getInstance("JKS", "SUN");
         String storepass = "CertAuth";
         char[] pwd = new char[storepass.length()];
         for (int i = 0; i < pwd.length; i++)
            pwd[i] = storepass.charAt(i);

         String keypass = "openxrs";
         char[] kpwd = new char[keypass.length()];
         for (int i = 0; i < kpwd.length; i++)
            kpwd[i] = keypass.charAt(i);

         ks.load(fisk, pwd);
         PrivateKey priv = (PrivateKey)ks.getKey("CAKey", kpwd);
         X509Cert certs = new X509Cert();
         certs.decode(new FileInputStream("CAcert.crt"));
         AlgorithmId SHAalg = new AlgorithmId(AlgorithmId.DSA_oid);
         X500Signer CA = certs.getSigner(SHAalg, priv);

         FileInputStream bis = new FileInputStream("Servercert.crt");
         X509Cert srvrCert = new X509Cert();
         srvrCert.decode(bis);                        

         BigInt i = srvrCert.getSerialNumber();
         byte[] signedcert = srvrCert.encodeAndSign(i, CA);                        

         FileOutputStream certfos = new FileOutputStream("signedcert.crt");
         certfos.write(signedcert);
         certfos.close();
      }
      catch (Exception e)
      {
         System.out.println("Exception: " + e);
      }
   }
}

--- NEW FILE: keystoreimport.properties ---
cert.type=x509
cert1.filename=cert1filename

# Fill in as many certs as is required for the full cert chain
# then edit the KeyStoreImport.java file (and recompile) to load these certs
#cert2.filename=cert2filename
#cert3.filename=cert3filename
cacert.filename=cacertfilename

# Get these numeric values from openssl -rsa -inform PEM|DER -in rsaprivekeyfile -text

rsaprivkey.modulus=**big-hex-number**
rsaprivkey.modulus.radix=16

rsaprivkey.publicExponent=**medium-sized-number**
rsaprivkey.publicExponent.radix=10

rsaprivkey.privateExponent=**big-hex-number**
rsaprivkey.privateExponent.radix=16

rsaprivkey.prime1=**big-hex-number**
rsaprivkey.prime1.radix=16

rsaprivkey.prime2=**big-hex-number**
rsaprivkey.prime2.radix=16

rsaprivkey.exponent1=**big-hex-number**
rsaprivkey.exponent1.radix=16

rsaprivkey.exponent2=**big-hex-number**
rsaprivkey.exponent2.radix=16

rsaprivkey.coefficient=**big-hex-number**
rsaprivkey.coefficient.radix=16

--- NEW FILE: signedcert.crt ---
0þ0¼;g0*HÎ8
tucows1
0Uoxrs10U	Tucows-CA0
010524050439Z
010822050439Z0e10	UCA10UOntario10UToronto10
U
tucows1
0Uoxrs10U	developer0·0,*HÎ80
zÃÏêÚÊm~õù´0*HÎ8
--- NEW FILE: ssl.properties ---
ssl.protocol=TLS
ssl.keymanagerfactory.format=SunX509
ssl.keystore.format=JKS
ssl.keystore.file=ServerStore
ssl.keystore.passphrase=Server
ssl.cacert.alias=cacert
ssl.signedcert.alias=signedcert
ssl.signedcert.passphrase=openxrs

2002	Jan	Feb (1)	Mar (74)	Apr (4)	May (14)	Jun	Jul (4)	Aug (9)	Sep	Oct (3)	Nov	Dec
2003	Jan	Feb	Mar (186)	Apr (26)	May (4)	Jun (2)	Jul (1)	Aug	Sep (64)	Oct	Nov	Dec (11)
2004	Jan (8)	Feb (1)	Mar	Apr	May	Jun	Jul (1)	Aug	Sep	Oct	Nov	Dec (25)
2005	Jan (2)	Feb	Mar (1)	Apr	May	Jun	Jul	Aug	Sep	Oct (4)	Nov	Dec
2006	Jan	Feb	Mar	Apr (12)	May	Jun	Jul	Aug	Sep	Oct	Nov	Dec
2007	Jan	Feb (1)	Mar (4)	Apr	May (4)	Jun	Jul (2)	Aug (1)	Sep	Oct	Nov (6)	Dec
2009	Jan	Feb	Mar	Apr	May	Jun	Jul	Aug (2)	Sep	Oct	Nov	Dec
2010	Jan	Feb	Mar	Apr	May	Jun	Jul	Aug (1)	Sep	Oct	Nov	Dec

epp-rtk-java-commits Mailing List for Universal Registry/Registrar Toolkit (Page 6)

epp-rtk-java-commits — commit notifications for java rtk work