Google Git Google Git
Sign in
third-party-mirror/openjdk/jdk25u/HEAD/./src/java.base/share/classes/sun/security/tools/keytool/Main.java
blob: 89cad63dc6565550785b672d6d9728d60eb39954 [file]
/*
* Copyright (c) 1997, 2025, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation. Oracle designates this
* particular file as subject to the "Classpath" exception as provided
* by Oracle in the LICENSE file that accompanied this code.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
package sun.security.tools.keytool;
import java.io.*;
import java.nio.file.Files;
import java.nio.file.Path;
import java.security.*;
import java.security.cert.Certificate;
import java.security.cert.CertificateFactory;
import java.security.cert.CertPathValidatorException;
import java.security.cert.CertPathValidatorException.BasicReason;
import java.security.cert.CertStoreException;
import java.security.cert.CRL;
import java.security.cert.X509Certificate;
import java.security.cert.CertificateException;
import java.security.cert.TrustAnchor;
import java.security.cert.URICertStoreParameters;
import java.security.spec.ECParameterSpec;
import java.security.spec.NamedParameterSpec;
import java.text.Collator;
import java.text.MessageFormat;
import java.util.*;
import java.util.function.BiFunction;
import java.util.jar.JarEntry;
import java.util.jar.JarFile;
import java.math.BigInteger;
import java.net.URI;
import java.net.URL;
import java.net.URLClassLoader;
import java.security.cert.CertStore;
import java.security.cert.X509CRL;
import java.security.cert.X509CRLEntry;
import java.security.cert.X509CRLSelector;
import javax.security.auth.x500.X500Principal;
import java.util.Base64;
import sun.security.pkcs12.PKCS12KeyStore;
import sun.security.provider.certpath.CertPathConstraintsParameters;
import sun.security.util.*;
import sun.security.pkcs10.PKCS10;
import sun.security.pkcs10.PKCS10Attribute;
import sun.security.provider.X509Factory;
import sun.security.provider.certpath.ssl.SSLServerCertStore;
import javax.crypto.KeyGenerator;
import javax.crypto.SecretKey;
import javax.crypto.SecretKeyFactory;
import javax.crypto.spec.PBEKeySpec;
import sun.security.pkcs.PKCS9Attribute;
import sun.security.tools.KeyStoreUtil;
import sun.security.tools.PathList;
import sun.security.validator.Validator;
import sun.security.x509.*;
import static java.security.KeyStore.*;
import static sun.security.tools.keytool.Main.Command.*;
import static sun.security.tools.keytool.Main.Option.*;
/**
* This tool manages keystores.
*
* @author Jan Luehe
*
*
* @see java.security.KeyStore
* @see sun.security.provider.KeyProtector
* @see sun.security.provider.JavaKeyStore
*
* @since 1.2
*/
public final class Main {
private boolean debug = false;
private Command command = null;
private String sigAlgName = null;
private String keyAlgName = null;
private boolean verbose = false;
private int keysize = -1;
private String groupName = null;
private boolean rfc = false;
private long validity = 90;
private String alias = null;
private String dname = null;
private String dest = null;
private String filename = null;
private String infilename = null;
private String outfilename = null;
private String srcksfname = null;
// User-specified providers are added before any command is called.
// However, they are not removed before the end of the main() method.
// If you're calling KeyTool.main() directly in your own Java program,
// please programtically add any providers you need and do not specify
// them through the command line.
private Set<Pair <String, String>> providers = null;
private Set<Pair <String, String>> providerClasses = null;
private String storetype = null;
private String srcProviderName = null;
private String providerName = null;
private String pathlist = null;
private char[] storePass = null;
private char[] storePassNew = null;
private char[] keyPass = null;
private char[] keyPassNew = null;
private char[] newPass = null;
private char[] destKeyPass = null;
private char[] srckeyPass = null;
private String ksfname = null;
private File ksfile = null;
private InputStream ksStream = null; // keystore stream
private String sslserver = null;
private String jarfile = null;
private KeyStore keyStore = null;
private boolean token = false;
private boolean nullStream = false;
private boolean kssave = false;
private boolean noprompt = false;
private boolean trustcacerts = false;
private boolean protectedPath = false;
private boolean srcprotectedPath = false;
private boolean cacerts = false;
private boolean nowarn = false;
private KeyStore caks = null; // "cacerts" keystore
private char[] srcstorePass = null;
private String srcstoretype = null;
private String startDate = null;
private String signerAlias = null;
private char[] signerKeyPass = null;
private boolean tlsInfo = false;
private final Set<char[]> passwords = new HashSet<>();
private final List<String> ids = new ArrayList<>(); // used in GENCRL
private final List<String> v3ext = new ArrayList<>();
private static final byte[] CRLF = new byte[] {'\r', '\n'};
// In-place importkeystore is special.
// A backup is needed, and no need to prompt for deststorepass.
private boolean inplaceImport = false;
private String inplaceBackupName = null;
// Warnings on weak algorithms etc
private boolean isPasswordlessKeyStore = false;
private final List<String> weakWarnings = new ArrayList<>();
private final Set<X509Certificate> trustedCerts = new HashSet<>();
private static final DisabledAlgorithmConstraints DISABLED_CHECK =
new DisabledAlgorithmConstraints(
DisabledAlgorithmConstraints.PROPERTY_CERTPATH_DISABLED_ALGS);
private static final DisabledAlgorithmConstraints LEGACY_CHECK =
new DisabledAlgorithmConstraints(
DisabledAlgorithmConstraints.PROPERTY_SECURITY_LEGACY_ALGS);
private static final Set<CryptoPrimitive> SIG_PRIMITIVE_SET = Collections
.unmodifiableSet(EnumSet.of(CryptoPrimitive.SIGNATURE));
enum Command {
CERTREQ("Generates.a.certificate.request",
ALIAS, SIGALG, FILEOUT, KEYPASS, KEYSTORE, DNAME,
EXT, STOREPASS, STORETYPE, PROVIDERNAME, ADDPROVIDER,
PROVIDERCLASS, PROVIDERPATH, V, PROTECTED),
CHANGEALIAS("Changes.an.entry.s.alias",
ALIAS, DESTALIAS, KEYPASS, KEYSTORE, CACERTS, STOREPASS,
STORETYPE, PROVIDERNAME, ADDPROVIDER, PROVIDERCLASS,
PROVIDERPATH, V, PROTECTED),
DELETE("Deletes.an.entry",
ALIAS, KEYSTORE, CACERTS, STOREPASS, STORETYPE,
PROVIDERNAME, ADDPROVIDER, PROVIDERCLASS,
PROVIDERPATH, V, PROTECTED),
EXPORTCERT("Exports.certificate",
RFC, ALIAS, FILEOUT, KEYSTORE, CACERTS, STOREPASS,
STORETYPE, PROVIDERNAME, ADDPROVIDER, PROVIDERCLASS,
PROVIDERPATH, V, PROTECTED),
GENKEYPAIR("Generates.a.key.pair",
ALIAS, KEYALG, KEYSIZE, CURVENAME, SIGALG, DNAME,
STARTDATE, EXT, VALIDITY, KEYPASS, KEYSTORE,
SIGNER, SIGNERKEYPASS,
STOREPASS, STORETYPE, PROVIDERNAME, ADDPROVIDER,
PROVIDERCLASS, PROVIDERPATH, V, PROTECTED),
GENSECKEY("Generates.a.secret.key",
ALIAS, KEYPASS, KEYALG, KEYSIZE, KEYSTORE,
STOREPASS, STORETYPE, PROVIDERNAME, ADDPROVIDER,
PROVIDERCLASS, PROVIDERPATH, V, PROTECTED),
GENCERT("Generates.certificate.from.a.certificate.request",
RFC, INFILE, OUTFILE, ALIAS, SIGALG, DNAME,
STARTDATE, EXT, VALIDITY, KEYPASS, KEYSTORE,
STOREPASS, STORETYPE, PROVIDERNAME, ADDPROVIDER,
PROVIDERCLASS, PROVIDERPATH, V, PROTECTED),
IMPORTCERT("Imports.a.certificate.or.a.certificate.chain",
NOPROMPT, TRUSTCACERTS, PROTECTED, ALIAS, FILEIN,
KEYPASS, KEYSTORE, CACERTS, STOREPASS, STORETYPE,
PROVIDERNAME, ADDPROVIDER, PROVIDERCLASS,
PROVIDERPATH, V),
IMPORTPASS("Imports.a.password",
ALIAS, KEYPASS, KEYALG, KEYSIZE, KEYSTORE,
STOREPASS, STORETYPE, PROVIDERNAME, ADDPROVIDER,
PROVIDERCLASS, PROVIDERPATH, V, PROTECTED),
IMPORTKEYSTORE("Imports.one.or.all.entries.from.another.keystore",
SRCKEYSTORE, DESTKEYSTORE, SRCSTORETYPE,
DESTSTORETYPE, SRCSTOREPASS, DESTSTOREPASS,
SRCPROTECTED, DESTPROTECTED, SRCPROVIDERNAME, DESTPROVIDERNAME,
SRCALIAS, DESTALIAS, SRCKEYPASS, DESTKEYPASS,
NOPROMPT, ADDPROVIDER, PROVIDERCLASS, PROVIDERPATH,
V),
KEYPASSWD("Changes.the.key.password.of.an.entry",
ALIAS, KEYPASS, NEW, KEYSTORE, STOREPASS,
STORETYPE, PROVIDERNAME, ADDPROVIDER, PROVIDERCLASS,
PROVIDERPATH, V),
LIST("Lists.entries.in.a.keystore",
RFC, ALIAS, KEYSTORE, CACERTS, STOREPASS, STORETYPE,
PROVIDERNAME, ADDPROVIDER, PROVIDERCLASS,
PROVIDERPATH, V, PROTECTED),
PRINTCERT("Prints.the.content.of.a.certificate",
RFC, FILEIN, SSLSERVER, JARFILE,
KEYSTORE, STOREPASS, STORETYPE, TRUSTCACERTS,
PROVIDERNAME, ADDPROVIDER, PROVIDERCLASS,
PROVIDERPATH, V, PROTECTED),
PRINTCERTREQ("Prints.the.content.of.a.certificate.request",
FILEIN, V),
PRINTCRL("Prints.the.content.of.a.CRL.file",
FILEIN, KEYSTORE, STOREPASS, STORETYPE, TRUSTCACERTS,
PROVIDERNAME, ADDPROVIDER, PROVIDERCLASS, PROVIDERPATH,
V, PROTECTED),
STOREPASSWD("Changes.the.store.password.of.a.keystore",
NEW, KEYSTORE, CACERTS, STOREPASS, STORETYPE, PROVIDERNAME,
ADDPROVIDER, PROVIDERCLASS, PROVIDERPATH, V),
SHOWINFO("showinfo.command.help",
TLS, V),
VERSION("Prints.the.program.version"),
// Undocumented start here, KEYCLONE is used a marker in -help;
KEYCLONE("Clones.a.key.entry",
ALIAS, DESTALIAS, KEYPASS, NEW, STORETYPE,
KEYSTORE, STOREPASS, PROVIDERNAME, ADDPROVIDER,
PROVIDERCLASS, PROVIDERPATH, V),
SELFCERT("Generates.a.self.signed.certificate",
ALIAS, SIGALG, DNAME, STARTDATE, EXT, VALIDITY, KEYPASS,
STORETYPE, KEYSTORE, STOREPASS, PROVIDERNAME,
ADDPROVIDER, PROVIDERCLASS, PROVIDERPATH, V),
GENCRL("Generates.CRL",
RFC, FILEOUT, ID,
ALIAS, SIGALG, KEYPASS, KEYSTORE,
STOREPASS, STORETYPE, PROVIDERNAME, ADDPROVIDER,
PROVIDERCLASS, PROVIDERPATH, V, PROTECTED),
IDENTITYDB("Imports.entries.from.a.JDK.1.1.x.style.identity.database",
FILEIN, STORETYPE, KEYSTORE, STOREPASS, PROVIDERNAME,
ADDPROVIDER, PROVIDERCLASS, PROVIDERPATH, V);
final String description;
final Option[] options;
final String name;
String altName; // "genkey" is altName for "genkeypair"
Command(String d, Option... o) {
description = d;
options = o;
name = "-" + name().toLowerCase(Locale.ENGLISH);
}
@Override
public String toString() {
return name;
}
public String getAltName() {
return altName;
}
public void setAltName(String altName) {
this.altName = altName;
}
public static Command getCommand(String cmd) {
for (Command c: Command.values()) {
if (collator.compare(cmd, c.name) == 0
|| (c.altName != null
&& collator.compare(cmd, c.altName) == 0)) {
return c;
}
}
return null;
}
}
static {
Command.GENKEYPAIR.setAltName("-genkey");
Command.IMPORTCERT.setAltName("-import");
Command.EXPORTCERT.setAltName("-export");
Command.IMPORTPASS.setAltName("-importpassword");
}
// If an option is allowed multiple times, remember to record it
// in the optionsSet.contains() block in parseArgs().
enum Option {
ALIAS("alias", "<alias>", "alias.name.of.the.entry.to.process"),
CURVENAME("groupname", "<name>", "groupname.option.help"),
DESTALIAS("destalias", "<alias>", "destination.alias"),
DESTKEYPASS("destkeypass", "<arg>", "destination.key.password"),
DESTKEYSTORE("destkeystore", "<keystore>", "destination.keystore.name"),
DESTPROTECTED("destprotected", null, "destination.keystore.password.protected"),
DESTPROVIDERNAME("destprovidername", "<name>", "destination.keystore.provider.name"),
DESTSTOREPASS("deststorepass", "<arg>", "destination.keystore.password"),
DESTSTORETYPE("deststoretype", "<type>", "destination.keystore.type"),
DNAME("dname", "<name>", "distinguished.name"),
EXT("ext", "<value>", "X.509.extension"),
FILEOUT("file", "<file>", "output.file.name"),
FILEIN("file", "<file>", "input.file.name"),
ID("id", "<id:reason>", "Serial.ID.of.cert.to.revoke"),
INFILE("infile", "<file>", "input.file.name"),
KEYALG("keyalg", "<alg>", "key.algorithm.name"),
KEYPASS("keypass", "<arg>", "key.password"),
KEYSIZE("keysize", "<size>", "key.bit.size"),
KEYSTORE("keystore", "<keystore>", "keystore.name"),
CACERTS("cacerts", null, "access.the.cacerts.keystore"),
NEW("new", "<arg>", "new.password"),
NOPROMPT("noprompt", null, "do.not.prompt"),
OUTFILE("outfile", "<file>", "output.file.name"),
PROTECTED("protected", null, "password.through.protected.mechanism"),
PROVIDERCLASS("providerclass", "<class>\n[-providerarg <arg>]", "provider.class.option"),
ADDPROVIDER("addprovider", "<name>\n[-providerarg <arg>]", "addprovider.option"),
PROVIDERNAME("providername", "<name>", "provider.name"),
PROVIDERPATH("providerpath", "<list>", "provider.classpath"),
RFC("rfc", null, "output.in.RFC.style"),
SIGALG("sigalg", "<alg>", "signature.algorithm.name"),
SIGNER("signer", "<alias>", "signer.alias"),
SIGNERKEYPASS("signerkeypass", "<arg>", "signer.key.password"),
SRCALIAS("srcalias", "<alias>", "source.alias"),
SRCKEYPASS("srckeypass", "<arg>", "source.key.password"),
SRCKEYSTORE("srckeystore", "<keystore>", "source.keystore.name"),
SRCPROTECTED("srcprotected", null, "source.keystore.password.protected"),
SRCPROVIDERNAME("srcprovidername", "<name>", "source.keystore.provider.name"),
SRCSTOREPASS("srcstorepass", "<arg>", "source.keystore.password"),
SRCSTORETYPE("srcstoretype", "<type>", "source.keystore.type"),
SSLSERVER("sslserver", "<server[:port]>", "SSL.server.host.and.port"),
JARFILE("jarfile", "<file>", "signed.jar.file"),
STARTDATE("startdate", "<date>", "certificate.validity.start.date.time"),
STOREPASS("storepass", "<arg>", "keystore.password"),
STORETYPE("storetype", "<type>", "keystore.type"),
TLS("tls", null, "tls.option.help"),
TRUSTCACERTS("trustcacerts", null, "trust.certificates.from.cacerts"),
V("v", null, "verbose.output"),
VALIDITY("validity", "<days>", "validity.number.of.days");
final String name, arg, description;
Option(String name, String arg, String description) {
this.name = name;
this.arg = arg;
this.description = description;
}
@Override
public String toString() {
return "-" + name;
}
}
private static final String NONE = "NONE";
private static final String P11KEYSTORE = "PKCS11";
private static final String P12KEYSTORE = "PKCS12";
private static final String keyAlias = "mykey";
// for i18n
private static final java.util.ResourceBundle rb =
java.util.ResourceBundle.getBundle(
"sun.security.tools.keytool.resources.keytool");
private static final Collator collator = Collator.getInstance();
static {
// this is for case-insensitive string comparisons
collator.setStrength(Collator.PRIMARY);
}
public static void main(String[] args) throws Exception {
Main kt = new Main();
int exitCode = kt.run(args, System.out);
if (exitCode != 0) {
System.exit(exitCode);
}
}
private static class ExitException extends RuntimeException {
@java.io.Serial
static final long serialVersionUID = 0L;
private final int errorCode;
public ExitException(int errorCode) {
this.errorCode = errorCode;
}
}
public int run(String[] args, PrintStream out) throws Exception {
try {
parseArgs(args);
if (command != null) {
doCommands(out);
}
} catch (ExitException ee) {
return ee.errorCode;
} catch (Exception e) {
System.out.println(rb.getString("keytool.error.") + e);
if (verbose) {
e.printStackTrace(System.out);
}
if (!debug) {
return 1;
} else {
throw e;
}
} finally {
printWeakWarnings(false);
for (char[] pass : passwords) {
if (pass != null) {
Arrays.fill(pass, ' ');
pass = null;
}
}
if (ksStream != null) {
ksStream.close();
}
}
return 0;
}
/**
* Parse command line arguments.
*/
String[] parseArgs(String[] args) throws Exception {
int i;
boolean help = args.length == 0;
String confFile = null;
// Records all commands and options set. Used to check dups.
Set<String> optionsSet = new HashSet<>();
for (i=0; i < args.length; i++) {
String flags = args[i];
if (flags.startsWith("-")) {
String lowerFlags = flags.toLowerCase(Locale.ROOT);
if (optionsSet.contains(lowerFlags)) {
switch (lowerFlags) {
case "-ext":
case "-id":
case "-provider":
case "-addprovider":
case "-providerclass":
case "-providerarg":
// These options are allowed multiple times
break;
default:
weakWarnings.add(String.format(
rb.getString("option.1.set.twice"),
lowerFlags));
}
} else {
optionsSet.add(lowerFlags);
}
if (collator.compare(flags, "-conf") == 0) {
if (i == args.length - 1) {
errorNeedArgument(flags);
}
confFile = args[++i];
} else {
Command c = Command.getCommand(flags);
if (c != null) {
if (command == null) {
command = c;
} else {
throw new Exception(String.format(
rb.getString("multiple.commands.1.2"),
command.name, c.name));
}
}
}
}
}
if (confFile != null && command != null) {
args = KeyStoreUtil.expandArgs("keytool", confFile,
command.toString(),
command.getAltName(), args);
}
debug = Arrays.stream(args).anyMatch(
x -> collator.compare(x, "-debug") == 0);
if (debug) {
// No need to localize debug output
System.out.println("Command line args: " +
Arrays.toString(args));
}
for (i=0; (i < args.length) && args[i].startsWith("-"); i++) {
String flags = args[i];
// Check if the last option needs an arg
if (i == args.length - 1) {
for (Option option: Option.values()) {
// Only options with an arg need to be checked
if (collator.compare(flags, option.toString()) == 0) {
if (option.arg != null) errorNeedArgument(flags);
break;
}
}
}
/*
* Check modifiers
*/
String modifier = null;
int pos = flags.indexOf(':');
if (pos > 0) {
modifier = flags.substring(pos+1);
flags = flags.substring(0, pos);
}
/*
* command modes
*/
Command c = Command.getCommand(flags);
if (c != null) {
command = c;
} else if (collator.compare(flags, "--help") == 0 ||
collator.compare(flags, "-h") == 0 ||
collator.compare(flags, "-?") == 0 ||
// -help: legacy.
collator.compare(flags, "-help") == 0) {
help = true;
} else if (collator.compare(flags, "-conf") == 0) {
i++;
} else if (collator.compare(flags, "-nowarn") == 0) {
nowarn = true;
} else if (collator.compare(flags, "-keystore") == 0) {
ksfname = args[++i];
if (new File(ksfname).getCanonicalPath().equals(
new File(KeyStoreUtil.getCacerts()).getCanonicalPath())) {
System.err.println(rb.getString("warning.cacerts.option"));
}
} else if (collator.compare(flags, "-destkeystore") == 0) {
ksfname = args[++i];
} else if (collator.compare(flags, "-cacerts") == 0) {
cacerts = true;
} else if (collator.compare(flags, "-storepass") == 0 ||
collator.compare(flags, "-deststorepass") == 0) {
storePass = getPass(modifier, args[++i]);
passwords.add(storePass);
} else if (collator.compare(flags, "-storetype") == 0 ||
collator.compare(flags, "-deststoretype") == 0) {
storetype = KeyStoreUtil.niceStoreTypeName(args[++i]);
} else if (collator.compare(flags, "-srcstorepass") == 0) {
srcstorePass = getPass(modifier, args[++i]);
passwords.add(srcstorePass);
} else if (collator.compare(flags, "-srcstoretype") == 0) {
srcstoretype = KeyStoreUtil.niceStoreTypeName(args[++i]);
} else if (collator.compare(flags, "-srckeypass") == 0) {
srckeyPass = getPass(modifier, args[++i]);
passwords.add(srckeyPass);
} else if (collator.compare(flags, "-srcprovidername") == 0) {
srcProviderName = args[++i];
} else if (collator.compare(flags, "-providername") == 0 ||
collator.compare(flags, "-destprovidername") == 0) {
providerName = args[++i];
} else if (collator.compare(flags, "-providerpath") == 0) {
pathlist = args[++i];
} else if (collator.compare(flags, "-keypass") == 0) {
keyPass = getPass(modifier, args[++i]);
passwords.add(keyPass);
} else if (collator.compare(flags, "-new") == 0) {
newPass = getPass(modifier, args[++i]);
passwords.add(newPass);
} else if (collator.compare(flags, "-destkeypass") == 0) {
destKeyPass = getPass(modifier, args[++i]);
passwords.add(destKeyPass);
} else if (collator.compare(flags, "-alias") == 0 ||
collator.compare(flags, "-srcalias") == 0) {
alias = args[++i];
} else if (collator.compare(flags, "-dest") == 0 ||
collator.compare(flags, "-destalias") == 0) {
dest = args[++i];
} else if (collator.compare(flags, "-dname") == 0) {
dname = args[++i];
} else if (collator.compare(flags, "-keysize") == 0) {
keysize = Integer.parseInt(args[++i]);
} else if (collator.compare(flags, "-groupname") == 0) {
groupName = args[++i];
} else if (collator.compare(flags, "-keyalg") == 0) {
keyAlgName = args[++i];
} else if (collator.compare(flags, "-sigalg") == 0) {
sigAlgName = args[++i];
} else if (collator.compare(flags, "-signer") == 0) {
signerAlias = args[++i];
} else if (collator.compare(flags, "-signerkeypass") == 0) {
signerKeyPass = getPass(modifier, args[++i]);
passwords.add(signerKeyPass);
} else if (collator.compare(flags, "-startdate") == 0) {
startDate = args[++i];
} else if (collator.compare(flags, "-validity") == 0) {
validity = Long.parseLong(args[++i]);
} else if (collator.compare(flags, "-ext") == 0) {
v3ext.add(args[++i]);
} else if (collator.compare(flags, "-id") == 0) {
ids.add(args[++i]);
} else if (collator.compare(flags, "-file") == 0) {
filename = args[++i];
} else if (collator.compare(flags, "-infile") == 0) {
infilename = args[++i];
} else if (collator.compare(flags, "-outfile") == 0) {
outfilename = args[++i];
} else if (collator.compare(flags, "-sslserver") == 0) {
sslserver = args[++i];
} else if (collator.compare(flags, "-jarfile") == 0) {
jarfile = args[++i];
} else if (collator.compare(flags, "-srckeystore") == 0) {
srcksfname = args[++i];
} else if (collator.compare(flags, "-provider") == 0 ||
collator.compare(flags, "-providerclass") == 0) {
if (providerClasses == null) {
providerClasses = new HashSet<>(3);
}
String providerClass = args[++i];
String providerArg = null;
if (args.length > (i+1)) {
flags = args[i+1];
if (collator.compare(flags, "-providerarg") == 0) {
if (args.length == (i+2)) errorNeedArgument(flags);
providerArg = args[i+2];
i += 2;
}
}
providerClasses.add(
Pair.of(providerClass, providerArg));
} else if (collator.compare(flags, "-addprovider") == 0) {
if (providers == null) {
providers = new HashSet<>(3);
}
String provider = args[++i];
String providerArg = null;
if (args.length > (i+1)) {
flags = args[i+1];
if (collator.compare(flags, "-providerarg") == 0) {
if (args.length == (i+2)) errorNeedArgument(flags);
providerArg = args[i+2];
i += 2;
}
}
providers.add(
Pair.of(provider, providerArg));
}
/*
* options
*/
else if (collator.compare(flags, "-v") == 0) {
verbose = true;
} else if (collator.compare(flags, "-debug") == 0) {
// Already processed
} else if (collator.compare(flags, "-rfc") == 0) {
rfc = true;
} else if (collator.compare(flags, "-noprompt") == 0) {
noprompt = true;
} else if (collator.compare(flags, "-trustcacerts") == 0) {
trustcacerts = true;
} else if (collator.compare(flags, "-protected") == 0 ||
collator.compare(flags, "-destprotected") == 0) {
protectedPath = true;
} else if (collator.compare(flags, "-srcprotected") == 0) {
srcprotectedPath = true;
} else if (collator.compare(flags, "-tls") == 0) {
tlsInfo = true;
} else {
System.err.println(rb.getString("Illegal.option.") + flags);
tinyHelp();
}
}
if (i<args.length) {
System.err.println(rb.getString("Illegal.option.") + args[i]);
tinyHelp();
}
if (command == null) {
if (help) {
usage();
} else {
System.err.println(rb.getString("Usage.error.no.command.provided"));
tinyHelp();
}
} else if (help) {
usage();
command = null;
}
return args;
}
boolean isKeyStoreRelated(Command cmd) {
return cmd != PRINTCERTREQ && cmd != SHOWINFO && cmd != VERSION;
}
/**
* Execute the commands.
*/
void doCommands(PrintStream out) throws Exception {
if (cacerts) {
if (ksfname != null || storetype != null) {
throw new IllegalArgumentException(rb.getString
("the.keystore.or.storetype.option.cannot.be.used.with.the.cacerts.option"));
}
ksfname = KeyStoreUtil.getCacerts();
}
if (P11KEYSTORE.equalsIgnoreCase(storetype) ||
KeyStoreUtil.isWindowsKeyStore(storetype)) {
token = true;
if (ksfname == null) {
ksfname = NONE;
}
}
if (NONE.equals(ksfname)) {
nullStream = true;
}
if (token && !nullStream) {
System.err.println(MessageFormat.format(rb.getString
(".keystore.must.be.NONE.if.storetype.is.{0}"), storetype));
System.err.println();
tinyHelp();
}
if (token &&
(command == KEYPASSWD || command == STOREPASSWD)) {
throw new UnsupportedOperationException(MessageFormat.format(rb.getString
(".storepasswd.and.keypasswd.commands.not.supported.if.storetype.is.{0}"), storetype));
}
if (token && (keyPass != null || newPass != null || destKeyPass != null)) {
throw new IllegalArgumentException(MessageFormat.format(rb.getString
(".keypass.and.new.can.not.be.specified.if.storetype.is.{0}"), storetype));
}
if (protectedPath) {
if (storePass != null || keyPass != null ||
newPass != null || destKeyPass != null) {
throw new IllegalArgumentException(rb.getString
("if.protected.is.specified.then.storepass.keypass.and.new.must.not.be.specified"));
}
}
if (srcprotectedPath) {
if (srcstorePass != null || srckeyPass != null) {
throw new IllegalArgumentException(rb.getString
("if.srcprotected.is.specified.then.srcstorepass.and.srckeypass.must.not.be.specified"));
}
}
if (KeyStoreUtil.isWindowsKeyStore(storetype)) {
if (storePass != null || keyPass != null ||
newPass != null || destKeyPass != null) {
throw new IllegalArgumentException(rb.getString
("if.keystore.is.not.password.protected.then.storepass.keypass.and.new.must.not.be.specified"));
}
}
if (KeyStoreUtil.isWindowsKeyStore(srcstoretype)) {
if (srcstorePass != null || srckeyPass != null) {
throw new IllegalArgumentException(rb.getString
("if.source.keystore.is.not.password.protected.then.srcstorepass.and.srckeypass.must.not.be.specified"));
}
}
if (validity <= (long)0) {
throw new Exception
(rb.getString("Validity.must.be.greater.than.zero"));
}
// Try to load and install specified provider
if (providers != null) {
for (Pair<String, String> provider : providers) {
try {
KeyStoreUtil.loadProviderByName(
provider.fst, provider.snd);
if (debug) {
System.out.println("loadProviderByName: " + provider.fst);
}
} catch (IllegalArgumentException e) {
throw new Exception(String.format(rb.getString(
"provider.name.not.found"), provider.fst));
}
}
}
if (providerClasses != null) {
ClassLoader cl;
if (pathlist != null) {
String path = System.getProperty("java.class.path");
path = PathList.appendPath(
path, System.getProperty("env.class.path"));
path = PathList.appendPath(path, pathlist);
URL[] urls = PathList.pathToURLs(path);
cl = new URLClassLoader(urls);
} else {
cl = ClassLoader.getSystemClassLoader();
}
for (Pair<String, String> provider : providerClasses) {
try {
KeyStoreUtil.loadProviderByClass(
provider.fst, provider.snd, cl);
if (debug) {
System.out.println("loadProviderByClass: " + provider.fst);
}
} catch (ClassCastException cce) {
throw new Exception(String.format(rb.getString(
"provclass.not.a.provider"), provider.fst));
} catch (IllegalArgumentException e) {
throw new Exception(String.format(rb.getString(
"provider.class.not.found"), provider.fst), e.getCause());
}
}
}
if (command == LIST && verbose && rfc) {
System.err.println(rb.getString
("Must.not.specify.both.v.and.rfc.with.list.command"));
tinyHelp();
}
// Make sure provided passwords are at least 6 characters long
if (command == GENKEYPAIR && keyPass!=null && keyPass.length < 6) {
throw new Exception(rb.getString
("Key.password.must.be.at.least.6.characters"));
}
if (newPass != null && newPass.length < 6) {
throw new Exception(rb.getString
("New.password.must.be.at.least.6.characters"));
}
if (destKeyPass != null && destKeyPass.length < 6) {
throw new Exception(rb.getString
("New.password.must.be.at.least.6.characters"));
}
// Set this before inplaceImport check so we can compare name.
if (ksfname == null) {
ksfname = System.getProperty("user.home") + File.separator
+ ".keystore";
}
KeyStore srcKeyStore = null;
if (command == IMPORTKEYSTORE) {
inplaceImport = inplaceImportCheck();
if (inplaceImport) {
// We load srckeystore first so we have srcstorePass that
// can be assigned to storePass
srcKeyStore = loadSourceKeyStore();
if (storePass == null) {
storePass = srcstorePass;
}
}
}
// Check if keystore exists.
// If no keystore has been specified at the command line, try to use
// the default, which is located in $HOME/.keystore.
// No need to check if isKeyStoreRelated(command) is false.
// DO NOT open the existing keystore if this is an in-place import.
// The keystore should be created as brand new.
if (isKeyStoreRelated(command) && !nullStream && !inplaceImport) {
try {
ksfile = new File(ksfname);
// Check if keystore file is empty
if (ksfile.exists() && ksfile.length() == 0) {
throw new Exception(rb.getString
("Keystore.file.exists.but.is.empty.") + ksfname);
}
ksStream = new FileInputStream(ksfile);
} catch (FileNotFoundException e) {
// These commands do not need the keystore to be existing.
// Either it will create a new one or the keystore is
// optional (i.e. PRINTCRL and PRINTCERT).
if (command != GENKEYPAIR &&
command != GENSECKEY &&
command != IDENTITYDB &&
command != IMPORTCERT &&
command != IMPORTPASS &&
command != IMPORTKEYSTORE &&
command != PRINTCRL &&
command != PRINTCERT) {
throw new Exception(rb.getString
("Keystore.file.does.not.exist.") + ksfname);
}
}
}
if ((command == KEYCLONE || command == CHANGEALIAS)
&& dest == null) {
dest = getAlias("destination");
if ("".equals(dest)) {
throw new Exception(rb.getString
("Must.specify.destination.alias"));
}
}
if (command == DELETE && alias == null) {
alias = getAlias(null);
if ("".equals(alias)) {
throw new Exception(rb.getString("Must.specify.alias"));
}
}
if (ksfile != null && ksStream != null && providerName == null &&
!inplaceImport) {
// existing keystore
if (storetype == null) {
// Probe for keystore type when filename is available
keyStore = KeyStore.getInstance(ksfile, storePass);
storetype = keyStore.getType();
} else {
keyStore = KeyStore.getInstance(storetype);
// storePass might be null here, will probably prompt later
keyStore.load(ksStream, storePass);
}
if (storetype.equalsIgnoreCase("pkcs12")) {
try {
isPasswordlessKeyStore = PKCS12KeyStore.isPasswordless(ksfile);
} catch (IOException ioe) {
// This must be a JKS keystore that's opened as a PKCS12
}
}
} else {
// Create new keystore
if (storetype == null) {
storetype = KeyStore.getDefaultType();
}
if (providerName == null) {
keyStore = KeyStore.getInstance(storetype);
} else {
keyStore = KeyStore.getInstance(storetype, providerName);
}
// When creating a new pkcs12 file, Do not prompt for storepass
// if certProtectionAlgorithm and macAlgorithm are both NONE.
if (storetype.equalsIgnoreCase("pkcs12")) {
isPasswordlessKeyStore =
"NONE".equals(SecurityProperties.getOverridableProperty(
"keystore.pkcs12.certProtectionAlgorithm"))
&& "NONE".equals(SecurityProperties.getOverridableProperty(
"keystore.pkcs12.macAlgorithm"));
}
/*
* Load the keystore data.
*
* At this point, it's OK if no keystore password has been provided.
* We want to make sure that we can load the keystore data, i.e.,
* the keystore data has the right format. If we cannot load the
* keystore, why bother asking the user for his or her password?
* Only if we were able to load the keystore, and no keystore
* password has been provided, will we prompt the user for the
* keystore password to verify the keystore integrity.
* This means that the keystore is loaded twice: first load operation
* checks the keystore format, second load operation verifies the
* keystore integrity.
*
* If the keystore password has already been provided (at the
* command line), however, the keystore is loaded only once, and the
* keystore format and integrity are checked "at the same time".
*
* Null stream keystores are loaded later.
*/
if (!nullStream) {
if (inplaceImport) {
keyStore.load(null, storePass);
} else {
// both ksStream and storePass could be null
keyStore.load(ksStream, storePass);
}
}
}
if (P12KEYSTORE.equalsIgnoreCase(storetype) && command == KEYPASSWD) {
throw new UnsupportedOperationException(rb.getString
(".keypasswd.commands.not.supported.if.storetype.is.PKCS12"));
}
// All commands that create or modify the keystore require a keystore
// password.
if (nullStream && storePass != null) {
keyStore.load(null, storePass);
} else if (!nullStream && storePass != null) {
// If we are creating a new non nullStream-based keystore,
// insist that the password be at least 6 characters
if (ksStream == null && storePass.length < 6) {
throw new Exception(rb.getString
("Keystore.password.must.be.at.least.6.characters"));
}
} else {
if (!protectedPath && !KeyStoreUtil.isWindowsKeyStore(storetype)
&& isKeyStoreRelated(command)
&& !isPasswordlessKeyStore) {
if (command == CERTREQ ||
command == DELETE ||
command == GENKEYPAIR ||
command == GENSECKEY ||
command == IMPORTCERT ||
command == IMPORTPASS ||
command == IMPORTKEYSTORE ||
command == KEYCLONE ||
command == CHANGEALIAS ||
command == SELFCERT ||
command == STOREPASSWD ||
command == KEYPASSWD ||
command == IDENTITYDB) {
int count = 0;
do {
if (command == IMPORTKEYSTORE) {
System.err.print
(rb.getString("Enter.destination.keystore.password."));
} else {
System.err.print
(rb.getString("Enter.keystore.password."));
}
System.err.flush();
storePass = Password.readPassword(System.in);
passwords.add(storePass);
// If we are creating a new non nullStream-based keystore,
// insist that the password be at least 6 characters
if (!nullStream && (storePass == null || storePass.length < 6)) {
System.err.println(rb.getString
("Keystore.password.is.too.short.must.be.at.least.6.characters"));
storePass = null;
}
// If the keystore file does not exist and needs to be
// created, the storepass should be prompted twice.
if (storePass != null && !nullStream && ksStream == null) {
System.err.print(rb.getString("Re.enter.new.password."));
char[] storePassAgain = Password.readPassword(System.in);
passwords.add(storePassAgain);
if (!Arrays.equals(storePass, storePassAgain)) {
System.err.println
(rb.getString("They.don.t.match.Try.again"));
storePass = null;
}
}
count++;
} while ((storePass == null) && count < 3);
if (storePass == null) {
System.err.println
(rb.getString("Too.many.failures.try.later"));
return;
}
} else {
// here we have EXPORTCERT and LIST (info valid until STOREPASSWD)
if (command != PRINTCRL && command != PRINTCERT) {
System.err.print(rb.getString("Enter.keystore.password."));
System.err.flush();
storePass = Password.readPassword(System.in);
passwords.add(storePass);
}
}
}
// Now load a nullStream-based keystore,
// or verify the integrity of an input stream-based keystore
if (nullStream) {
keyStore.load(null, storePass);
} else if (ksStream != null) {
// Reload with user-provided password
try (FileInputStream fis = new FileInputStream(ksfile)) {
keyStore.load(fis, storePass);
}
}
}
if (storePass != null && P12KEYSTORE.equalsIgnoreCase(storetype)) {
MessageFormat form = new MessageFormat(rb.getString(
"Warning.Different.store.and.key.passwords.not.supported.for.PKCS12.KeyStores.Ignoring.user.specified.command.value."));
if (keyPass != null && !Arrays.equals(storePass, keyPass)) {
Object[] source = {"-keypass"};
System.err.println(form.format(source));
keyPass = storePass;
}
if (destKeyPass != null && !Arrays.equals(storePass, destKeyPass)) {
Object[] source = {"-destkeypass"};
System.err.println(form.format(source));
destKeyPass = storePass;
}
}
// -trustcacerts can be specified on -importcert, -printcert or -printcrl.
// Reset it so that warnings on CA cert will remain for other command.
if (command != IMPORTCERT && command != PRINTCERT
&& command != PRINTCRL) {
trustcacerts = false;
}
if (trustcacerts) {
KeyStore cakstore = buildTrustedCerts();
if (cakstore != null) {
caks = cakstore;
} else {
// try to load cacerts again, and let exception propagate
// if it cannot be loaded
caks = KeyStoreUtil.getCacertsKeyStore();
}
}
// Perform the specified command
if (command == CERTREQ) {
if (filename != null) {
try (PrintStream ps = new PrintStream(new FileOutputStream
(filename))) {
doCertReq(alias, sigAlgName, ps);
}
} else {
doCertReq(alias, sigAlgName, out);
}
if (verbose && filename != null) {
MessageFormat form = new MessageFormat(rb.getString
("Certification.request.stored.in.file.filename."));
Object[] source = {filename};
System.err.println(form.format(source));
System.err.println(rb.getString("Submit.this.to.your.CA"));
}
} else if (command == DELETE) {
doDeleteEntry(alias);
kssave = true;
} else if (command == EXPORTCERT) {
if (filename != null) {
try (PrintStream ps = new PrintStream(new FileOutputStream
(filename))) {
doExportCert(alias, ps);
}
} else {
doExportCert(alias, out);
}
if (filename != null) {
MessageFormat form = new MessageFormat(rb.getString
("Certificate.stored.in.file.filename."));
Object[] source = {filename};
System.err.println(form.format(source));
}
} else if (command == GENKEYPAIR) {
if (keyAlgName == null) {
throw new Exception(rb.getString(
"keyalg.option.missing.error"));
}
doGenKeyPair(alias, dname, keyAlgName, keysize, groupName, sigAlgName,
signerAlias);
kssave = true;
} else if (command == GENSECKEY) {
if (keyAlgName == null) {
throw new Exception(rb.getString(
"keyalg.option.missing.error"));
}
doGenSecretKey(alias, keyAlgName, keysize);
kssave = true;
} else if (command == IMPORTPASS) {
if (keyAlgName == null) {
keyAlgName = "PBE";
}
// password is stored as a secret key
doGenSecretKey(alias, keyAlgName, keysize);
kssave = true;
} else if (command == IDENTITYDB) {
if (filename != null) {
try (InputStream inStream = new FileInputStream(filename)) {
doImportIdentityDatabase(inStream);
}
} else {
doImportIdentityDatabase(System.in);
}
} else if (command == IMPORTCERT) {
InputStream inStream = System.in;
if (filename != null) {
inStream = new FileInputStream(filename);
}
String importAlias = (alias!=null)?alias:keyAlias;
try {
if (keyStore.entryInstanceOf(
importAlias, KeyStore.PrivateKeyEntry.class)) {
kssave = installReply(importAlias, inStream);
if (kssave) {
System.err.println(rb.getString
("Certificate.reply.was.installed.in.keystore"));
} else {
System.err.println(rb.getString
("Certificate.reply.was.not.installed.in.keystore"));
}
} else if (!keyStore.containsAlias(importAlias) ||
keyStore.entryInstanceOf(importAlias,
KeyStore.TrustedCertificateEntry.class)) {
kssave = addTrustedCert(importAlias, inStream);
if (kssave) {
System.err.println(rb.getString
("Certificate.was.added.to.keystore"));
} else {
System.err.println(rb.getString
("Certificate.was.not.added.to.keystore"));
}
}
} finally {
if (inStream != System.in) {
inStream.close();
}
}
} else if (command == IMPORTKEYSTORE) {
// When not in-place import, srcKeyStore is not loaded yet.
if (srcKeyStore == null) {
srcKeyStore = loadSourceKeyStore();
}
doImportKeyStore(srcKeyStore);
kssave = true;
} else if (command == KEYCLONE) {
keyPassNew = newPass;
// added to make sure only key can go through
if (alias == null) {
alias = keyAlias;
}
if (!keyStore.containsAlias(alias)) {
MessageFormat form = new MessageFormat
(rb.getString("Alias.alias.does.not.exist"));
Object[] source = {alias};
throw new Exception(form.format(source));
}
if (!keyStore.entryInstanceOf(alias, KeyStore.PrivateKeyEntry.class)) {
MessageFormat form = new MessageFormat(rb.getString(
"Alias.alias.references.an.entry.type.that.is.not.a.private.key.entry.The.keyclone.command.only.supports.cloning.of.private.key"));
Object[] source = {alias};
throw new Exception(form.format(source));
}
doCloneEntry(alias, dest, true); // Now everything can be cloned
kssave = true;
} else if (command == CHANGEALIAS) {
if (alias == null) {
alias = keyAlias;
}
doCloneEntry(alias, dest, false);
// in PKCS11, clone a PrivateKeyEntry will delete the old one
if (keyStore.containsAlias(alias)) {
doDeleteEntry(alias);
}
kssave = true;
} else if (command == KEYPASSWD) {
keyPassNew = newPass;
doChangeKeyPasswd(alias);
kssave = true;
} else if (command == LIST) {
if (storePass == null
&& !protectedPath
&& !KeyStoreUtil.isWindowsKeyStore(storetype)
&& !isPasswordlessKeyStore) {
printNoIntegrityWarning();
}
if (alias != null) {
doPrintEntry(rb.getString("the.certificate"), alias, out);
} else {
doPrintEntries(out);
}
} else if (command == PRINTCERT) {
doPrintCert(out);
} else if (command == SELFCERT) {
doSelfCert(alias, dname, sigAlgName);
kssave = true;
} else if (command == STOREPASSWD) {
doChangeStorePasswd();
kssave = true;
} else if (command == GENCERT) {
if (alias == null) {
alias = keyAlias;
}
InputStream inStream = System.in;
if (infilename != null) {
inStream = new FileInputStream(infilename);
}
PrintStream ps = null;
if (outfilename != null) {
ps = new PrintStream(new FileOutputStream(outfilename));
out = ps;
}
try {
doGenCert(alias, sigAlgName, inStream, out);
} finally {
if (inStream != System.in) {
inStream.close();
}
if (ps != null) {
ps.close();
}
}
} else if (command == GENCRL) {
if (alias == null) {
alias = keyAlias;
}
if (filename != null) {
try (PrintStream ps =
new PrintStream(new FileOutputStream(filename))) {
doGenCRL(ps);
}
} else {
doGenCRL(out);
}
} else if (command == PRINTCERTREQ) {
if (filename != null) {
try (InputStream inStream = new FileInputStream(filename)) {
doPrintCertReq(inStream, out);
}
} else {
doPrintCertReq(System.in, out);
}
} else if (command == PRINTCRL) {
doPrintCRL(filename, out);
} else if (command == SHOWINFO) {
doShowInfo();
} else if (command == VERSION) {
doPrintVersion();
}
// If we need to save the keystore, do so.
if (kssave) {
if (verbose) {
MessageFormat form = new MessageFormat
(rb.getString(".Storing.ksfname."));
Object[] source = {nullStream ? "keystore" : ksfname};
System.err.println(form.format(source));
}
if (token) {
keyStore.store(null, null);
} else {
char[] pass = (storePassNew!=null) ? storePassNew : storePass;
if (nullStream) {
keyStore.store(null, pass);
} else {
ByteArrayOutputStream bout = new ByteArrayOutputStream();
keyStore.store(bout, pass);
try (FileOutputStream fout = new FileOutputStream(ksfname)) {
fout.write(bout.toByteArray());
}
}
}
}
if (isKeyStoreRelated(command)
&& !token && !nullStream && ksfname != null) {
// JKS storetype warning on the final result keystore
File f = new File(ksfname);
char[] pass = (storePassNew!=null) ? storePassNew : storePass;
if (f.exists()) {
// Probe for real type. A JKS can be loaded as PKCS12 because
// DualFormat support, vice versa.
String realType = storetype;
try {
keyStore = KeyStore.getInstance(f, pass);
realType = keyStore.getType();
if (realType.equalsIgnoreCase("JKS")
|| realType.equalsIgnoreCase("JCEKS")) {
boolean allCerts = true;
for (String a : Collections.list(keyStore.aliases())) {
if (!keyStore.entryInstanceOf(
a, TrustedCertificateEntry.class)) {
allCerts = false;
break;
}
}
// Don't warn for "cacerts" style keystore.
if (!allCerts) {
weakWarnings.add(String.format(
rb.getString("jks.storetype.warning"),
realType, ksfname));
}
}
} catch (KeyStoreException e) {
// Probing not supported, therefore cannot be JKS or JCEKS.
// Skip the legacy type warning at all.
}
if (inplaceImport) {
String realSourceStoreType = srcstoretype;
try {
realSourceStoreType = KeyStore.getInstance(
new File(inplaceBackupName), srcstorePass).getType();
} catch (KeyStoreException e) {
// Probing not supported. Assuming srcstoretype.
}
String format =
realType.equalsIgnoreCase(realSourceStoreType) ?
rb.getString("backup.keystore.warning") :
rb.getString("migrate.keystore.warning");
weakWarnings.add(
String.format(format,
srcksfname,
realSourceStoreType,
inplaceBackupName,
realType));
}
}
}
}
/**
* Generate a certificate: Read PKCS10 request from in, and print
* certificate to out. Use alias as CA, sigAlgName as the signature
* type.
*/
private void doGenCert(String alias, String sigAlgName, InputStream in, PrintStream out)
throws Exception {
if (!keyStore.containsAlias(alias)) {
MessageFormat form = new MessageFormat
(rb.getString("Alias.alias.does.not.exist"));
Object[] source = {alias};
throw new Exception(form.format(source));
}
Certificate signerCert = keyStore.getCertificate(alias);
byte[] encoded = signerCert.getEncoded();
X509CertImpl signerCertImpl = new X509CertImpl(encoded);
X509CertInfo signerCertInfo = signerCertImpl.getInfo();
X500Name issuer = signerCertInfo.getSubject();
Date firstDate = getStartDate(startDate);
Date lastDate = getLastDate(firstDate, validity);
CertificateValidity interval = new CertificateValidity(firstDate,
lastDate);
PrivateKey privateKey =
(PrivateKey)recoverKey(alias, storePass, keyPass).fst;
if (sigAlgName == null) {
sigAlgName = getCompatibleSigAlgName(privateKey);
}
X509CertInfo info = new X509CertInfo();
info.setValidity(interval);
info.setSerialNumber(CertificateSerialNumber.newRandom64bit(new SecureRandom()));
info.setVersion(new CertificateVersion(CertificateVersion.V3));
info.setIssuer(issuer);
BufferedReader reader = new BufferedReader(new InputStreamReader(in));
boolean canRead = false;
StringBuilder sb = new StringBuilder();
while (true) {
String s = reader.readLine();
if (s == null) break;
// OpenSSL does not use NEW
//if (s.startsWith("-----BEGIN NEW CERTIFICATE REQUEST-----")) {
if (s.startsWith("-----BEGIN") && s.contains("REQUEST")) {
canRead = true;
//} else if (s.startsWith("-----END NEW CERTIFICATE REQUEST-----")) {
} else if (s.startsWith("-----END") && s.contains("REQUEST")) {
break;
} else if (canRead) {
sb.append(s);
}
}
byte[] rawReq = Pem.decode(new String(sb));
PKCS10 req = new PKCS10(rawReq);
CertPathConstraintsParameters cpcp = new CertPathConstraintsParameters(
req.getSubjectPublicKeyInfo(), null, null, null);
checkWeakConstraint(rb.getString("the.certificate.request"), req, cpcp);
info.setKey(new CertificateX509Key(req.getSubjectPublicKeyInfo()));
info.setSubject(dname==null ? req.getSubjectName() : new X500Name(dname));
CertificateExtensions reqex = null;
for (PKCS10Attribute attr : req.getAttributes().getAttributes()) {
if (attr.getAttributeId().equals(PKCS9Attribute.EXTENSION_REQUEST_OID)) {
reqex = (CertificateExtensions)attr.getAttributeValue();
}
}
PublicKey subjectPubKey = req.getSubjectPublicKeyInfo();
PublicKey issuerPubKey = signerCert.getPublicKey();
KeyIdentifier signerSubjectKeyId;
if (Arrays.equals(subjectPubKey.getEncoded(), issuerPubKey.getEncoded())) {
// No AKID for self-signed cert
signerSubjectKeyId = null;
} else {
X509CertImpl certImpl;
if (signerCert instanceof X509CertImpl) {
certImpl = (X509CertImpl) signerCert;
} else {
certImpl = new X509CertImpl(signerCert.getEncoded());
}
// To enforce compliance with RFC 5280 section 4.2.1.1: "Where a key
// identifier has been previously established, the CA SHOULD use the
// previously established identifier."
// Use issuer's SKID to establish the AKID in createV3Extensions() method.
signerSubjectKeyId = certImpl.getSubjectKeyId();
if (signerSubjectKeyId == null) {
signerSubjectKeyId = new KeyIdentifier(issuerPubKey);
}
}
CertificateExtensions ext = createV3Extensions(
reqex,
null,
v3ext,
subjectPubKey,
signerSubjectKeyId);
info.setExtensions(ext);
X509CertImpl cert = X509CertImpl
.newSigned(info, privateKey, sigAlgName);
dumpCert(cert, out);
for (Certificate ca: keyStore.getCertificateChain(alias)) {
if (ca instanceof X509Certificate xca) {
if (!KeyStoreUtil.isSelfSigned(xca)) {
dumpCert(xca, out);
}
}
}
checkWeakConstraint(rb.getString("the.issuer"),
keyStore.getCertificateChain(alias));
cpcp = buildCertPathConstraint(cert, null);
checkWeakConstraint(rb.getString("the.generated.certificate"),
cert, cpcp);
}
private void doGenCRL(PrintStream out)
throws Exception {
if (ids == null) {
throw new Exception("Must provide -id when -gencrl");
}
Certificate signerCert = keyStore.getCertificate(alias);
byte[] encoded = signerCert.getEncoded();
X509CertImpl signerCertImpl = new X509CertImpl(encoded);
X509CertInfo signerCertInfo = signerCertImpl.getInfo();
X500Name owner = signerCertInfo.getSubject();
Date firstDate = getStartDate(startDate);
Date lastDate = getLastDate(firstDate, validity);
CertificateValidity interval = new CertificateValidity(firstDate,
lastDate);
PrivateKey privateKey =
(PrivateKey)recoverKey(alias, storePass, keyPass).fst;
if (sigAlgName == null) {
sigAlgName = getCompatibleSigAlgName(privateKey);
}
X509CRLEntry[] badCerts = new X509CRLEntry[ids.size()];
for (int i=0; i<ids.size(); i++) {
String id = ids.get(i);
int d = id.indexOf(':');
if (d >= 0) {
CRLExtensions ext = new CRLExtensions();
int code = Integer.parseInt(id.substring(d+1));
if (code <= 0) {
throw new Exception("Reason code must be positive");
}
ext.setExtension("Reason", new CRLReasonCodeExtension(code));
badCerts[i] = new X509CRLEntryImpl(new BigInteger(id.substring(0, d)),
firstDate, ext);
} else {
badCerts[i] = new X509CRLEntryImpl(new BigInteger(ids.get(i)), firstDate);
}
}
X509CRLImpl crl = X509CRLImpl.newSigned(
new X509CRLImpl.TBSCertList(owner, firstDate, lastDate, badCerts),
privateKey, sigAlgName);
if (rfc) {
out.print("-----BEGIN X509 CRL-----");
out.print("\r\n");
out.print(Base64.getMimeEncoder(64, CRLF).encodeToString(crl.getEncodedInternal()));
out.print("\r\n");
out.print("-----END X509 CRL-----");
out.print("\r\n");
} else {
out.write(crl.getEncodedInternal());
}
CertPathConstraintsParameters cpcp = new CertPathConstraintsParameters(
privateKey, null, null, null);
checkWeakConstraint(rb.getString("the.generated.crl"), crl, privateKey,
cpcp);
}
/**
* Creates a PKCS#10 cert signing request, corresponding to the
* keys (and name) associated with a given alias.
*/
private void doCertReq(String alias, String sigAlgName, PrintStream out)
throws Exception
{
if (alias == null) {
alias = keyAlias;
}
Pair<Key,char[]> objs = recoverKey(alias, storePass, keyPass);
PrivateKey privKey = (PrivateKey)objs.fst;
if (keyPass == null) {
keyPass = objs.snd;
}
Certificate cert = keyStore.getCertificate(alias);
if (cert == null) {
MessageFormat form = new MessageFormat
(rb.getString("alias.has.no.public.key.certificate."));
Object[] source = {alias};
throw new Exception(form.format(source));
}
PKCS10 request = new PKCS10(cert.getPublicKey());
CertificateExtensions ext = createV3Extensions(null, null, v3ext, cert.getPublicKey(), null);
// Attribute name is not significant
request.getAttributes().setAttribute(X509CertInfo.EXTENSIONS,
new PKCS10Attribute(PKCS9Attribute.EXTENSION_REQUEST_OID, ext));
// Construct a Signature object, so that we can sign the request
if (sigAlgName == null) {
sigAlgName = getCompatibleSigAlgName(privKey);
}
X500Name subject = dname == null?
new X500Name(((X509Certificate)cert).getSubjectX500Principal().getEncoded()):
new X500Name(dname);
// Sign the request and base-64 encode it
request.encodeAndSign(subject, privKey, sigAlgName);
request.print(out);
CertPathConstraintsParameters cpcp = new CertPathConstraintsParameters(
request.getSubjectPublicKeyInfo(), null, null, null);
checkWeakConstraint(rb.getString("the.generated.certificate.request"),
request, cpcp);
}
/**
* Deletes an entry from the keystore.
*/
private void doDeleteEntry(String alias) throws Exception {
if (!keyStore.containsAlias(alias)) {
MessageFormat form = new MessageFormat
(rb.getString("Alias.alias.does.not.exist"));
Object[] source = {alias};
throw new Exception(form.format(source));
}
keyStore.deleteEntry(alias);
}
/**
* Exports a certificate from the keystore.
*/
private void doExportCert(String alias, PrintStream out)
throws Exception
{
if (storePass == null
&& !protectedPath
&& !KeyStoreUtil.isWindowsKeyStore(storetype)
&& !isPasswordlessKeyStore) {
printNoIntegrityWarning();
}
if (alias == null) {
alias = keyAlias;
}
if (!keyStore.containsAlias(alias)) {
MessageFormat form = new MessageFormat
(rb.getString("Alias.alias.does.not.exist"));
Object[] source = {alias};
throw new Exception(form.format(source));
}
X509Certificate cert = (X509Certificate)keyStore.getCertificate(alias);
if (cert == null) {
MessageFormat form = new MessageFormat
(rb.getString("Alias.alias.has.no.certificate"));
Object[] source = {alias};
throw new Exception(form.format(source));
}
dumpCert(cert, out);
CertPathConstraintsParameters cpcp =
buildCertPathConstraint(cert, null);
checkWeakConstraint(rb.getString("the.certificate"), cert, cpcp);
}
/**
* Prompt the user for a keypass when generating a key entry.
* @param alias the entry we will set password for
* @param orig the original entry of doing a dup, null if generate new
* @param origPass the password to copy from if user press ENTER
*/
private char[] promptForKeyPass(String alias, String orig, char[] origPass) throws Exception{
if (origPass != null && P12KEYSTORE.equalsIgnoreCase(storetype)) {
return origPass;
} else if (!token && !protectedPath) {
// Prompt for key password
int count;
for (count = 0; count < 3; count++) {
MessageFormat form = new MessageFormat(rb.getString
("Enter.key.password.for.alias."));
Object[] source = {alias};
System.err.print(form.format(source));
if (origPass != null) {
System.err.println();
if (orig == null) {
System.err.print(rb.getString
(".RETURN.if.same.as.keystore.password."));
} else {
form = new MessageFormat(rb.getString
(".RETURN.if.same.as.for.otherAlias."));
Object[] src = {orig};
System.err.print(form.format(src));
}
}
System.err.flush();
char[] entered = Password.readPassword(System.in);
passwords.add(entered);
if (entered == null && origPass != null) {
return origPass;
} else if (entered != null && entered.length >= 6) {
System.err.print(rb.getString("Re.enter.new.password."));
char[] passAgain = Password.readPassword(System.in);
passwords.add(passAgain);
if (!Arrays.equals(entered, passAgain)) {
System.err.println
(rb.getString("They.don.t.match.Try.again"));
continue;
}
return entered;
} else {
System.err.println(rb.getString
("Key.password.is.too.short.must.be.at.least.6.characters"));
}
}
if (count == 3) {
if (command == KEYCLONE) {
throw new Exception(rb.getString
("Too.many.failures.Key.entry.not.cloned"));
} else {
throw new Exception(rb.getString
("Too.many.failures.key.not.added.to.keystore"));
}
}
}
return null; // PKCS11, MSCAPI, or -protected
}
/*
* Prompt the user for the password credential to be stored.
*/
private char[] promptForCredential() throws Exception {
// Handle password supplied via stdin
Console console = System.console();
if (console == null || !console.isTerminal()) {
char[] importPass = Password.readPassword(System.in);
passwords.add(importPass);
return importPass;
}
int count;
for (count = 0; count < 3; count++) {
System.err.print(
rb.getString("Enter.the.password.to.be.stored."));
System.err.flush();
char[] entered = Password.readPassword(System.in);
passwords.add(entered);
System.err.print(rb.getString("Re.enter.password."));
char[] passAgain = Password.readPassword(System.in);
passwords.add(passAgain);
if (!Arrays.equals(entered, passAgain)) {
System.err.println(rb.getString("They.don.t.match.Try.again"));
continue;
}
return entered;
}
if (count == 3) {
throw new Exception(rb.getString
("Too.many.failures.key.not.added.to.keystore"));
}
return null;
}
/**
* Creates a new secret key.
*/
private void doGenSecretKey(String alias, String keyAlgName,
int keysize)
throws Exception
{
if (alias == null) {
alias = keyAlias;
}
if (keyStore.containsAlias(alias)) {
MessageFormat form = new MessageFormat(rb.getString
("Secret.key.not.generated.alias.alias.already.exists"));
Object[] source = {alias};
throw new Exception(form.format(source));
}
// Use the keystore's default PBE algorithm for entry protection
boolean useDefaultPBEAlgorithm = true;
SecretKey secKey;
if (keyAlgName.toUpperCase(Locale.ENGLISH).startsWith("PBE")) {
SecretKeyFactory factory = SecretKeyFactory.getInstance("PBE");
// User is prompted for PBE credential
secKey =
factory.generateSecret(new PBEKeySpec(promptForCredential()));
// Check whether a specific PBE algorithm was specified
if (!"PBE".equalsIgnoreCase(keyAlgName)) {
useDefaultPBEAlgorithm = false;
}
SecretKeyConstraintsParameters skcp =
new SecretKeyConstraintsParameters(secKey);
checkWeakConstraint(rb.getString("the.generated.secretkey"),
keyAlgName, skcp);
if (verbose) {
MessageFormat form = new MessageFormat(rb.getString(
"Generated.keyAlgName.secret.key"));
Object[] source = { "PBE" };
System.err.println(form.format(source));
}
} else {
KeyGenerator keygen = KeyGenerator.getInstance(keyAlgName);
if (keysize == -1) {
if ("DES".equalsIgnoreCase(keyAlgName)) {
keysize = 56;
} else if ("DESede".equalsIgnoreCase(keyAlgName)) {
keysize = 168;
} else {
throw new Exception(rb.getString
("Please.provide.keysize.for.secret.key.generation"));
}
}
keygen.init(keysize);
secKey = keygen.generateKey();
MessageFormat form = new MessageFormat(rb.getString
("Generated.keysize.bit.keyAlgName.secret.key"));
Object[] source = {keysize,
secKey.getAlgorithm()};
System.err.println(form.format(source));
SecretKeyConstraintsParameters skcp =
new SecretKeyConstraintsParameters(secKey);
checkWeakConstraint(rb.getString("the.generated.secretkey"),
secKey, skcp);
}
if (keyPass == null) {
keyPass = promptForKeyPass(alias, null, storePass);
}
if (useDefaultPBEAlgorithm) {
keyStore.setKeyEntry(alias, secKey, keyPass, null);
} else {
keyStore.setEntry(alias, new KeyStore.SecretKeyEntry(secKey),
new KeyStore.PasswordProtection(keyPass, keyAlgName, null));
}
}
/**
* If no signature algorithm was specified at the command line,
* we choose one that is compatible with the selected private key
*/
private static String getCompatibleSigAlgName(PrivateKey key)
throws Exception {
String result = SignatureUtil.getDefaultSigAlgForKey(key);
if (result != null) {
return result;
} else {
throw new Exception(rb.getString
("Cannot.derive.signature.algorithm"));
}
}
/**
* Creates a new key pair and self-signed certificate.
*/
private void doGenKeyPair(String alias, String dname, String keyAlgName,
int keysize, String groupName, String sigAlgName,
String signerAlias)
throws Exception
{
if (groupName != null) {
if (keysize != -1) {
throw new Exception(rb.getString("groupname.keysize.coexist"));
}
} else {
if (keysize == -1) {
if ("EC".equalsIgnoreCase(keyAlgName)) {
keysize = SecurityProviderConstants.DEF_EC_KEY_SIZE;
} else if ("RSA".equalsIgnoreCase(keyAlgName)) {
keysize = SecurityProviderConstants.DEF_RSA_KEY_SIZE;
} else if ("RSASSA-PSS".equalsIgnoreCase(keyAlgName)) {
keysize = SecurityProviderConstants.DEF_RSASSA_PSS_KEY_SIZE;
} else if ("DSA".equalsIgnoreCase(keyAlgName)) {
keysize = SecurityProviderConstants.DEF_DSA_KEY_SIZE;
} else if ("EdDSA".equalsIgnoreCase(keyAlgName)) {
keysize = SecurityProviderConstants.DEF_ED_KEY_SIZE;
} else if ("Ed25519".equalsIgnoreCase(keyAlgName)) {
keysize = 255;
} else if ("Ed448".equalsIgnoreCase(keyAlgName)) {
keysize = 448;
} else if ("XDH".equalsIgnoreCase(keyAlgName)) {
keysize = SecurityProviderConstants.DEF_XEC_KEY_SIZE;
} else if ("X25519".equalsIgnoreCase(keyAlgName)) {
keysize = 255;
} else if ("X448".equalsIgnoreCase(keyAlgName)) {
keysize = 448;
} else if ("DH".equalsIgnoreCase(keyAlgName)) {
keysize = SecurityProviderConstants.DEF_DH_KEY_SIZE;
}
} else {
if ("EC".equalsIgnoreCase(keyAlgName)) {
weakWarnings.add(String.format(
rb.getString("deprecate.keysize.for.ec"),
ecGroupNameForSize(keysize)));
}
}
}
if (alias == null) {
alias = keyAlias;
}
if (keyStore.containsAlias(alias)) {
MessageFormat form = new MessageFormat(rb.getString
("Key.pair.not.generated.alias.alias.already.exists"));
Object[] source = {alias};
throw new Exception(form.format(source));
}
CertAndKeyGen keypair;
KeyIdentifier signerSubjectKeyId = null;
if (signerAlias != null) {
PrivateKey signerPrivateKey =
(PrivateKey)recoverKey(signerAlias, storePass, signerKeyPass).fst;
Certificate signerCert = keyStore.getCertificate(signerAlias);
X509CertImpl signerCertImpl;
if (signerCert instanceof X509CertImpl) {
signerCertImpl = (X509CertImpl) signerCert;
} else {
signerCertImpl = new X509CertImpl(signerCert.getEncoded());
}
X509CertInfo signerCertInfo = signerCertImpl.getInfo();
X500Name signerSubjectName = signerCertInfo.getSubject();
keypair = new CertAndKeyGen(keyAlgName, sigAlgName, providerName,
signerPrivateKey, signerSubjectName);
signerSubjectKeyId = signerCertImpl.getSubjectKeyId();
if (signerSubjectKeyId == null) {
signerSubjectKeyId = new KeyIdentifier(signerCert.getPublicKey());
}
} else {
keypair = new CertAndKeyGen(keyAlgName, sigAlgName, providerName);
}
// If DN is provided, parse it. Otherwise, prompt the user for it.
X500Name x500Name;
if (dname == null) {
printWeakWarnings(true);
x500Name = getX500Name();
} else {
x500Name = new X500Name(dname);
}
if (groupName != null) {
keypair.generate(groupName);
} else {
// This covers keysize both specified and unspecified
keypair.generate(keysize);
}
CertificateExtensions ext = createV3Extensions(
null,
null,
v3ext,
keypair.getPublicKeyAnyway(),
signerSubjectKeyId);
PrivateKey privKey = keypair.getPrivateKey();
X509Certificate newCert = keypair.getSelfCertificate(
x500Name, getStartDate(startDate), validity*24L*60L*60L, ext);
MessageFormat form;
Object[] source;
if (signerAlias != null) {
form = new MessageFormat(rb.getString
("Generating.full.keyAlgName.key.pair.and.a.certificate.sigAlgName.issued.by.signerAlias.with.a.validity.of.days.for"));
source = new Object[]{
fullDisplayKeyName(privKey),
newCert.getSigAlgName(),
signerAlias,
validity,
x500Name};
} else {
form = new MessageFormat(rb.getString
("Generating.full.keyAlgName.key.pair.and.self.signed.certificate.sigAlgName.with.a.validity.of.days.for"));
source = new Object[]{
fullDisplayKeyName(privKey),
newCert.getSigAlgName(),
validity,
x500Name};
}
System.err.println(form.format(source));
if (keyPass == null) {
keyPass = promptForKeyPass(alias, null, storePass);
}
Certificate[] finalChain;
if (signerAlias != null) {
Certificate[] signerChain = keyStore.getCertificateChain(signerAlias);
finalChain = new X509Certificate[signerChain.length + 1];
finalChain[0] = newCert;
System.arraycopy(signerChain, 0, finalChain, 1, signerChain.length);
} else {
finalChain = new Certificate[] { newCert };
}
checkWeakConstraint(rb.getString("the.generated.certificate"),
finalChain);
keyStore.setKeyEntry(alias, privKey, keyPass, finalChain);
}
/**
* Returns the full display name of the given key object. Could be
* - "X25519", if its getParams() is NamedParameterSpec
* - "EC (secp256r1)", if it's an EC key
* - "1024-bit RSA", other known keys
* - plain algorithm name, otherwise
*
* Note: the same method appears in keytool and jarsigner which uses
* same resource string defined in their own properties file.
*
* @param key the key object, cannot be null
* @return the full name
*/
private static String fullDisplayKeyName(Key key) {
var alg = key.getAlgorithm();
if (key instanceof AsymmetricKey ak) {
var params = ak.getParams();
if (params instanceof NamedParameterSpec nps) {
return nps.getName(); // directly return
} else if (params instanceof ECParameterSpec eps) {
var nc = CurveDB.lookup(eps);
if (nc != null) {
alg += " (" + nc.getNameAndAliases()[0] + ")"; // append name
}
}
}
var size = KeyUtil.getKeySize(key);
return size >= 0
? String.format(rb.getString("size.bit.alg"), size, alg)
: alg;
}
private String ecGroupNameForSize(int size) throws Exception {
AlgorithmParameters ap = AlgorithmParameters.getInstance("EC");
ap.init(new ECKeySizeParameterSpec(size));
// The following line assumes the toString value is "name (oid)"
return ap.toString().split(" ")[0];
}
/**
* Clones an entry
* @param orig original alias
* @param dest destination alias
* @param changePassword if the password can be changed
*/
private void doCloneEntry(String orig, String dest, boolean changePassword)
throws Exception
{
if (orig == null) {
orig = keyAlias;
}
if (keyStore.containsAlias(dest)) {
MessageFormat form = new MessageFormat
(rb.getString("Destination.alias.dest.already.exists"));
Object[] source = {dest};
throw new Exception(form.format(source));
}
Pair<Entry,char[]> objs = recoverEntry(keyStore, orig, storePass, keyPass);
Entry entry = objs.fst;
keyPass = objs.snd;
PasswordProtection pp = null;
if (keyPass != null) { // protected
if (!changePassword || P12KEYSTORE.equalsIgnoreCase(storetype)) {
keyPassNew = keyPass;
} else {
if (keyPassNew == null) {
keyPassNew = promptForKeyPass(dest, orig, keyPass);
}
}
pp = new PasswordProtection(keyPassNew);
}
keyStore.setEntry(dest, entry, pp);
}
/**
* Changes a key password.
*/
private void doChangeKeyPasswd(String alias) throws Exception
{
if (alias == null) {
alias = keyAlias;
}
Pair<Key,char[]> objs = recoverKey(alias, storePass, keyPass);
Key privKey = objs.fst;
if (keyPass == null) {
keyPass = objs.snd;
}
if (keyPassNew == null) {
MessageFormat form = new MessageFormat
(rb.getString("key.password.for.alias."));
Object[] source = {alias};
keyPassNew = getNewPasswd(form.format(source), keyPass);
}
keyStore.setKeyEntry(alias, privKey, keyPassNew,
keyStore.getCertificateChain(alias));
}
/**
* Imports a JDK 1.1-style identity database. We can only store one
* certificate per identity, because we use the identity's name as the
* alias (which references a keystore entry), and aliases must be unique.
*/
private void doImportIdentityDatabase(InputStream in) {
System.err.println(rb.getString
("No.entries.from.identity.database.added"));
}
/**
* Prints a single keystore entry.
*/
private void doPrintEntry(String label, String alias, PrintStream out)
throws Exception
{
CertPathConstraintsParameters cpcp;
if (!keyStore.containsAlias(alias)) {
MessageFormat form = new MessageFormat
(rb.getString("Alias.alias.does.not.exist"));
Object[] source = {alias};
throw new Exception(form.format(source));
}
if (verbose || rfc || debug) {
MessageFormat form = new MessageFormat
(rb.getString("Alias.name.alias"));
Object[] source = {alias};
out.println(form.format(source));
if (!token) {
form = new MessageFormat(rb.getString
("Creation.date.keyStore.getCreationDate.alias."));
Object[] src = {keyStore.getCreationDate(alias)};
out.println(form.format(src));
}
} else {
MessageFormat form;
Object[] source;
if (!token) {
form = new MessageFormat
(rb.getString("alias.keyStore.getCreationDate.alias."));
source = new Object[]{alias, keyStore.getCreationDate(alias)};
} else {
form = new MessageFormat
(rb.getString("alias."));
source = new Object[]{alias};
}
out.print(form.format(source));
}
if (keyStore.entryInstanceOf(alias, KeyStore.SecretKeyEntry.class)) {
if (verbose || rfc || debug) {
Object[] source = {"SecretKeyEntry"};
out.println(new MessageFormat(
rb.getString("Entry.type.type.")).format(source));
} else {
out.println("SecretKeyEntry, ");
}
try {
SecretKey secKey = (SecretKey) keyStore.getKey(alias, storePass);
SecretKeyConstraintsParameters skcp =
new SecretKeyConstraintsParameters(secKey);
checkWeakConstraint(label, secKey, skcp);
} catch (UnrecoverableKeyException e) {
/*
* UnrecoverableKeyException will be thrown for any secret key
* entries that are protected by a different password than
* storePass, and we will not be able to check the constraints
* because we do not have the keyPass for this operation.
* This may occur for keystores such as JCEKS. Note that this
* is not really a new issue as details about secret key entries
* other than the fact they exist as entries are not listed.
*/
}
} else if (keyStore.entryInstanceOf(alias, KeyStore.PrivateKeyEntry.class)) {
if (verbose || rfc || debug) {
Object[] source = {"PrivateKeyEntry"};
out.println(new MessageFormat(
rb.getString("Entry.type.type.")).format(source));
} else {
out.println("PrivateKeyEntry, ");
}
// Get the chain
Certificate[] chain = keyStore.getCertificateChain(alias);
if (chain != null) {
if (verbose || rfc || debug) {
out.println(rb.getString
("Certificate.chain.length.") + chain.length);
X509Certificate[] xcerts = convertCerts(chain);
List<X509Certificate> certs = Arrays.asList(xcerts);
TrustAnchor anchor = findTrustAnchor(certs);
for (int i = 0; i < chain.length; i ++) {
MessageFormat form = new MessageFormat
(rb.getString("Certificate.i.1."));
Object[] source = {(i + 1)};
out.println(form.format(source));
if (verbose && (chain[i] instanceof X509Certificate)) {
printX509Cert((X509Certificate)(chain[i]), out);
} else if (debug) {
out.println(chain[i].toString());
} else {
dumpCert(chain[i], out);
}
if (i == 0 &&
((X509Certificate)chain[0]).
getBasicConstraints() == -1) {
// this is an EE
cpcp = buildCertPathConstraint((X509Certificate) chain[i], anchor);
} else {
cpcp = new CertPathConstraintsParameters(
(X509Certificate)chain[i], null, anchor,
null);
}
checkWeakConstraint(label, chain[i], cpcp);
}
} else {
// Print the digest of the user cert only
out.println
(rb.getString("Certificate.fingerprint.SHA.256.") +
getCertFingerPrint("SHA-256", chain[0]));
checkWeakConstraint(label, chain);
}
} else {
out.println(rb.getString
("Certificate.chain.length.") + 0);
}
} else if (keyStore.entryInstanceOf(alias,
KeyStore.TrustedCertificateEntry.class)) {
// We have a trusted certificate entry
Certificate cert = keyStore.getCertificate(alias);
Object[] source = {"trustedCertEntry"};
String mf = new MessageFormat(
rb.getString("Entry.type.type.")).format(source) + "\n";
if (verbose && (cert instanceof X509Certificate)) {
out.println(mf);
printX509Cert((X509Certificate)cert, out);
} else if (rfc) {
out.println(mf);
dumpCert(cert, out);
} else if (debug) {
for (var attr : keyStore.getEntry(alias, null).getAttributes()) {
System.out.println("Attribute " + attr.getName() + ": " + attr.getValue());
}
out.println(cert.toString());
} else {
out.println("trustedCertEntry, ");
out.println(rb.getString("Certificate.fingerprint.SHA.256.")
+ getCertFingerPrint("SHA-256", cert));
}
cpcp = buildCertPathConstraint((X509Certificate)cert, null);
checkWeakConstraint(label, cert, cpcp);
} else {
out.println(rb.getString("Unknown.Entry.Type"));
}
}
boolean inplaceImportCheck() throws Exception {
if (P11KEYSTORE.equalsIgnoreCase(srcstoretype) ||
KeyStoreUtil.isWindowsKeyStore(srcstoretype)) {
return false;
}
if (srcksfname != null) {
File srcksfile = new File(srcksfname);
if (srcksfile.exists() && srcksfile.length() == 0) {
throw new Exception(rb.getString
("Source.keystore.file.exists.but.is.empty.") +
srcksfname);
}
if (srcksfile.getCanonicalFile()
.equals(new File(ksfname).getCanonicalFile())) {
return true;
} else {
// Informational, especially if destkeystore is not
// provided, which default to ~/.keystore.
System.err.println(String.format(rb.getString(
"importing.keystore.status"), srcksfname, ksfname));
return false;
}
} else {
throw new Exception(rb.getString
("Please.specify.srckeystore"));
}
}
/**
* Load the srckeystore from a stream, used in -importkeystore
* @return the src KeyStore
*/
KeyStore loadSourceKeyStore() throws Exception {
InputStream is = null;
File srcksfile = null;
boolean srcIsPasswordless = false;
if (P11KEYSTORE.equalsIgnoreCase(srcstoretype) ||
KeyStoreUtil.isWindowsKeyStore(srcstoretype)) {
if (!NONE.equals(srcksfname)) {
System.err.println(MessageFormat.format(rb.getString
(".keystore.must.be.NONE.if.storetype.is.{0}"), srcstoretype));
System.err.println();
tinyHelp();
}
} else {
srcksfile = new File(srcksfname);
is = new FileInputStream(srcksfile);
}
KeyStore store;
try {
// Probe for keystore type when filename is available
if (srcksfile != null && srcProviderName == null && srcstoretype == null) {
store = KeyStore.getInstance(srcksfile, srcstorePass);
srcstoretype = store.getType();
if (srcstoretype.equalsIgnoreCase("pkcs12")) {
srcIsPasswordless = PKCS12KeyStore.isPasswordless(srcksfile);
}
} else {
if (srcstoretype == null) {
srcstoretype = KeyStore.getDefaultType();
}
if (srcProviderName == null) {
store = KeyStore.getInstance(srcstoretype);
} else {
store = KeyStore.getInstance(srcstoretype, srcProviderName);
}
}
if (srcstorePass == null
&& !srcprotectedPath
&& !KeyStoreUtil.isWindowsKeyStore(srcstoretype)
&& !srcIsPasswordless) {
System.err.print(rb.getString("Enter.source.keystore.password."));
System.err.flush();
srcstorePass = Password.readPassword(System.in);
passwords.add(srcstorePass);
}
// always let keypass be storepass when using pkcs12
if (P12KEYSTORE.equalsIgnoreCase(srcstoretype)) {
if (srckeyPass != null && srcstorePass != null &&
!Arrays.equals(srcstorePass, srckeyPass)) {
MessageFormat form = new MessageFormat(rb.getString(
"Warning.Different.store.and.key.passwords.not.supported.for.PKCS12.KeyStores.Ignoring.user.specified.command.value."));
Object[] source = {"-srckeypass"};
System.err.println(form.format(source));
srckeyPass = srcstorePass;
}
}
store.load(is, srcstorePass); // "is" already null in PKCS11
} finally {
if (is != null) {
is.close();
}
}
if (srcstorePass == null
&& !srcIsPasswordless
&& !KeyStoreUtil.isWindowsKeyStore(srcstoretype)) {
// anti refactoring, copied from printNoIntegrityWarning(),
// but change 2 lines
System.err.println();
System.err.println(rb.getString
(".WARNING.WARNING.WARNING."));
System.err.println(rb.getString
(".The.integrity.of.the.information.stored.in.the.srckeystore."));
System.err.println(rb.getString
(".WARNING.WARNING.WARNING."));
System.err.println();
}
return store;
}
/**
* import all keys and certs from importkeystore.
* keep alias unchanged if no name conflict, otherwise, prompt.
* keep keypass unchanged for keys
*/
private void doImportKeyStore(KeyStore srcKS) throws Exception {
if (alias != null) {
doImportKeyStoreSingle(srcKS, alias);
} else {
if (dest != null || srckeyPass != null) {
throw new Exception(rb.getString(
"if.alias.not.specified.destalias.and.srckeypass.must.not.be.specified"));
}
doImportKeyStoreAll(srcKS);
}
if (inplaceImport) {
// Backup to file.old or file.old2...
// The keystore is not rewritten yet now.
for (int n = 1; /* forever */; n++) {
inplaceBackupName = srcksfname + ".old" + (n == 1 ? "" : n);
File bkFile = new File(inplaceBackupName);
if (!bkFile.exists()) {
Files.copy(Path.of(srcksfname), bkFile.toPath());
break;
}
}
}
/*
* Information display rule of -importkeystore
* 1. inside single, shows failure
* 2. inside all, shows success
* 3. inside all where there is a failure, prompt for continue
* 4. at the final of all, shows summary
*/
}
/**
* Import a single entry named alias from srckeystore
* @return 1 if the import action succeed
* 0 if user choose to ignore an alias-dumplicated entry
* 2 if setEntry throws Exception
*/
private int doImportKeyStoreSingle(KeyStore srckeystore, String alias)
throws Exception {
String newAlias = (dest==null) ? alias : dest;
if (keyStore.containsAlias(newAlias)) {
Object[] source = {alias};
if (noprompt) {
System.err.println(new MessageFormat(rb.getString(
"Warning.Overwriting.existing.alias.alias.in.destination.keystore")).format(source));
} else {
String reply = getYesNoReply(new MessageFormat(rb.getString(
"Existing.entry.alias.alias.exists.overwrite.no.")).format(source));
if ("NO".equals(reply)) {
newAlias = inputStringFromStdin(rb.getString
("Enter.new.alias.name.RETURN.to.cancel.import.for.this.entry."));
if ("".equals(newAlias)) {
System.err.println(new MessageFormat(rb.getString(
"Entry.for.alias.alias.not.imported.")).format(
source));
return 0;
}
}
}
}
Pair<Entry,char[]> objs = recoverEntry(srckeystore, alias, srcstorePass, srckeyPass);
Entry entry = objs.fst;
PasswordProtection pp = null;
// According to keytool.html, "The destination entry will be protected
// using destkeypass. If destkeypass is not provided, the destination
// entry will be protected with the source entry password."
// so always try to protect with destKeyPass.
char[] newPass = null;
if (destKeyPass != null) {
newPass = destKeyPass;
pp = new PasswordProtection(destKeyPass);
} else if (objs.snd != null) {
if (P12KEYSTORE.equalsIgnoreCase(storetype)) {
if (isPasswordlessKeyStore) {
newPass = objs.snd;
} else {
newPass = storePass;
}
} else {
newPass = objs.snd;
}
pp = new PasswordProtection(newPass);
}
try {
keyStore.setEntry(newAlias, entry, pp);
Certificate c = srckeystore.getCertificate(alias);
if (c != null) {
CertPathConstraintsParameters cpcp =
buildCertPathConstraint((X509Certificate)c, null);
checkWeakConstraint("<" + newAlias + ">", c, cpcp);
} else {
try {
Key key = keyStore.getKey(newAlias, newPass);
SecretKeyConstraintsParameters skcp =
new SecretKeyConstraintsParameters(key);
checkWeakConstraint("<" + newAlias + ">", (SecretKey)key, skcp);
} catch (UnrecoverableKeyException e) {
// skip
}
}
// Place the check so that only successful imports are blocked.
// For example, we don't block a failed SecretEntry import.
if (P12KEYSTORE.equalsIgnoreCase(storetype) && !isPasswordlessKeyStore) {
if (newPass != null && !Arrays.equals(newPass, storePass)) {
throw new Exception(rb.getString(
"The.destination.pkcs12.keystore.has.different.storepass.and.keypass.Please.retry.with.destkeypass.specified."));
}
}
return 1;
} catch (KeyStoreException kse) {
Object[] source2 = {alias, kse.toString()};
MessageFormat form = new MessageFormat(rb.getString(
"Problem.importing.entry.for.alias.alias.exception.Entry.for.alias.alias.not.imported."));
System.err.println(form.format(source2));
return 2;
}
}
private void doImportKeyStoreAll(KeyStore srckeystore) throws Exception {
int ok = 0;
int count = srckeystore.size();
for (Enumeration<String> e = srckeystore.aliases();
e.hasMoreElements(); ) {
String alias = e.nextElement();
int result = doImportKeyStoreSingle(srckeystore, alias);
if (result == 1) {
ok++;
Object[] source = {alias};
MessageFormat form = new MessageFormat(rb.getString("Entry.for.alias.alias.successfully.imported."));
System.err.println(form.format(source));
} else if (result == 2) {
if (!noprompt) {
String reply = getYesNoReply("Do you want to quit the import process? [no]: ");
if ("YES".equals(reply)) {
break;
}
}
}
}
Object[] source = {ok, count-ok};
MessageFormat form = new MessageFormat(rb.getString(
"Import.command.completed.ok.entries.successfully.imported.fail.entries.failed.or.cancelled"));
System.err.println(form.format(source));
}
/**
* Prints all keystore entries.
*/
private void doPrintEntries(PrintStream out)
throws Exception
{
out.println(rb.getString("Keystore.type.") + keyStore.getType());
out.println(rb.getString("Keystore.provider.") +
keyStore.getProvider().getName());
out.println();
MessageFormat form;
form = (keyStore.size() == 1) ?
new MessageFormat(rb.getString
("Your.keystore.contains.keyStore.size.entry")) :
new MessageFormat(rb.getString
("Your.keystore.contains.keyStore.size.entries"));
Object[] source = {keyStore.size()};
out.println(form.format(source));
out.println();
List<String> aliases = Collections.list(keyStore.aliases());
aliases.sort(String::compareTo);
for (String alias : aliases) {
doPrintEntry("<" + alias + ">", alias, out);
if (verbose || rfc) {
out.println(rb.getString("NEWLINE"));
out.println(rb.getString
("STAR"));
out.println(rb.getString
("STARNN"));
}
}
}
/**
* Loads CRLs from a source. This method is also called in JarSigner.
* @param src the source, which means System.in if null, or a URI,
* or a bare file path name
*/
public static Collection<? extends CRL> loadCRLs(String src) throws Exception {
InputStream in = null;
URI uri = null;
if (src == null) {
in = System.in;
} else {
try {
uri = new URI(src);
if (uri.getScheme().equals("ldap")) {
// No input stream for LDAP
} else {
in = uri.toURL().openStream();
}
} catch (Exception e) {
try {
in = new FileInputStream(src);
} catch (Exception e2) {
if (uri == null || uri.getScheme() == null) {
throw e2; // More likely a bare file path
} else {
throw e; // More likely a protocol or network problem
}
}
}
}
if (in != null) {
try {
// Read the full stream before feeding to X509Factory,
// otherwise, keytool -gencrl | keytool -printcrl
// might not work properly, since -gencrl is slow
// and there's no data in the pipe at the beginning.
byte[] bytes = in.readAllBytes();
return CertificateFactory.getInstance("X509").generateCRLs(
new ByteArrayInputStream(bytes));
} finally {
if (in != System.in) {
in.close();
}
}
} else { // must be LDAP, and uri is not null
URICertStoreParameters params =
new URICertStoreParameters(uri);
CertStore s = CertStore.getInstance("LDAP", params);
return s.getCRLs(new X509CRLSelector());
}
}
/**
* Returns CRLs described in a X509Certificate's CRLDistributionPoints
* Extension. Only those containing a general name of type URI are read.
*/
public static List<CRL> readCRLsFromCert(X509Certificate cert)
throws Exception {
List<CRL> crls = new ArrayList<>();
CRLDistributionPointsExtension ext =
X509CertImpl.toImpl(cert).getCRLDistributionPointsExtension();
if (ext == null) return crls;
List<DistributionPoint> distPoints = ext.getDistributionPoints();
for (DistributionPoint o: distPoints) {
GeneralNames names = o.getFullName();
if (names != null) {
for (GeneralName name: names.names()) {
if (name.getType() == GeneralNameInterface.NAME_URI) {
URIName uriName = (URIName)name.getName();
for (CRL crl: loadCRLs(uriName.getName())) {
if (crl instanceof X509CRL) {
crls.add(crl);
}
}
break; // Different name should point to same CRL
}
}
}
}
return crls;
}
private static String verifyCRL(KeyStore ks, CRL crl)
throws Exception {
X509CRL xcrl = (X509CRL)crl;
X500Principal issuer = xcrl.getIssuerX500Principal();
for (String s: Collections.list(ks.aliases())) {
Certificate cert = ks.getCertificate(s);
if (cert instanceof X509Certificate xcert) {
if (xcert.getSubjectX500Principal().equals(issuer)) {
try {
((X509CRL)crl).verify(cert.getPublicKey());
return s;
} catch (Exception e) {
}
}
}
}
return null;
}
private void doPrintCRL(String src, PrintStream out)
throws Exception {
for (CRL crl: loadCRLs(src)) {
printCRL(crl, out);
String issuer = null;
Certificate signer = null;
if (caks != null) {
issuer = verifyCRL(caks, crl);
if (issuer != null) {
signer = caks.getCertificate(issuer);
CertPathConstraintsParameters cpcp =
buildCertPathConstraint((X509Certificate)signer,
null);
out.printf(rb.getString(
"verified.by.s.in.s.weak"),
issuer,
"cacerts",
withWeakConstraint(signer.getPublicKey(), cpcp));
out.println();
}
}
if (issuer == null && keyStore != null) {
issuer = verifyCRL(keyStore, crl);
if (issuer != null) {
signer = keyStore.getCertificate(issuer);
CertPathConstraintsParameters cpcp =
buildCertPathConstraint((X509Certificate)signer,
null);
out.printf(rb.getString(
"verified.by.s.in.s.weak"),
issuer,
"keystore",
withWeakConstraint(signer.getPublicKey(), cpcp));
out.println();
}
}
if (issuer == null) {
out.println(rb.getString
("STAR"));
if (trustcacerts) {
out.println(rb.getString
("warning.not.verified.make.sure.keystore.is.correct"));
} else {
out.println(rb.getString
("warning.not.verified.make.sure.keystore.is.correct.or.specify.trustcacerts"));
}
out.println(rb.getString
("STARNN"));
}
if (signer != null) {
CertPathConstraintsParameters cpcp =
buildCertPathConstraint((X509Certificate)signer, null);
checkWeakConstraint(rb.getString("the.crl"), crl,
signer.getPublicKey(), cpcp);
} else {
checkWeak(rb.getString("the.crl"), crl, null);
}
}
}
private void printCRL(CRL crl, PrintStream out)
throws Exception {
X509CRL xcrl = (X509CRL)crl;
if (rfc) {
out.print("-----BEGIN X509 CRL-----");
out.print("\r\n");
out.print(Base64.getMimeEncoder(64, CRLF).encodeToString(xcrl.getEncoded()));
out.print("\r\n");
out.print("-----END X509 CRL-----");
out.print("\r\n");
} else {
String s;
if (crl instanceof X509CRLImpl x509crl) {
s = x509crl.toStringWithAlgName(withWeak("" + x509crl.getSigAlgId()));
} else {
s = crl.toString();
}
out.println(s);
}
}
private void doPrintCertReq(InputStream in, PrintStream out)
throws Exception {
BufferedReader reader = new BufferedReader(new InputStreamReader(in));
StringBuilder sb = new StringBuilder();
boolean started = false;
while (true) {
String s = reader.readLine();
if (s == null) break;
if (!started) {
if (s.startsWith("-----")) {
started = true;
}
} else {
if (s.startsWith("-----")) {
break;
}
sb.append(s);
}
}
PKCS10 req = new PKCS10(Pem.decode(new String(sb)));
PublicKey pkey = req.getSubjectPublicKeyInfo();
CertPathConstraintsParameters cpcp =
new CertPathConstraintsParameters(pkey, null, null, null);
out.printf(rb.getString("PKCS.10.with.weak"),
req.getSubjectName(),
pkey.getFormat(),
withWeakConstraint(pkey, cpcp),
withWeak(req.getSigAlg()));
for (PKCS10Attribute attr: req.getAttributes().getAttributes()) {
ObjectIdentifier oid = attr.getAttributeId();
if (oid.equals(PKCS9Attribute.EXTENSION_REQUEST_OID)) {
CertificateExtensions exts = (CertificateExtensions)attr.getAttributeValue();
if (exts != null) {
printExtensions(rb.getString("Extension.Request."), exts, out);
}
} else {
out.println("Attribute: " + attr.getAttributeId());
PKCS9Attribute pkcs9Attr =
new PKCS9Attribute(attr.getAttributeId(),
attr.getAttributeValue());
out.print(pkcs9Attr.getName() + ": ");
Object attrVal = attr.getAttributeValue();
out.println(attrVal instanceof String[] ?
Arrays.toString((String[]) attrVal) :
attrVal);
}
}
if (debug) {
out.println(req); // Just to see more, say, public key length...
}
CertPathConstraintsParameters cpcp1 =
new CertPathConstraintsParameters(
req.getSubjectPublicKeyInfo(), null, null, null);
checkWeakConstraint(rb.getString("the.certificate.request"), req,
cpcp1);
}
/**
* Reads a certificate (or certificate chain) and prints its contents in
* a human-readable format.
*/
private void printCertFromStream(InputStream in, PrintStream out)
throws Exception
{
Collection<? extends Certificate> c;
try {
c = generateCertificates(in);
} catch (CertificateException ce) {
throw new Exception(rb.getString("Failed.to.parse.input"), ce);
}
if (c.isEmpty()) {
throw new Exception(rb.getString("Empty.input"));
}
Certificate[] certs = c.toArray(new Certificate[0]);
X509Certificate[] xcerts = convertCerts(certs);
List<X509Certificate> chain = Arrays.asList(xcerts);
TrustAnchor anchor = findTrustAnchor(chain);
for (int i=0; i<certs.length; i++) {
X509Certificate x509Cert;
try {
x509Cert = (X509Certificate)certs[i];
} catch (ClassCastException cce) {
throw new Exception(rb.getString("Not.X.509.certificate"));
}
if (certs.length > 1) {
MessageFormat form = new MessageFormat
(rb.getString("Certificate.i.1."));
Object[] source = {i + 1};
out.println(form.format(source));
}
if (rfc)
dumpCert(x509Cert, out);
else
printX509Cert(x509Cert, out);
if (i < (certs.length-1)) {
out.println();
}
CertPathConstraintsParameters cpcp;
if (i == 0 &&
x509Cert.getBasicConstraints() == -1) {
// this is an EE
cpcp = buildCertPathConstraint(x509Cert, anchor);
} else {
cpcp = new CertPathConstraintsParameters(x509Cert,
null, anchor, null);
}
checkWeakConstraint(oneInMany(rb.getString("the.certificate"),
i, certs.length), x509Cert, cpcp);
}
}
private void doShowInfo() throws Exception {
if (tlsInfo) {
ShowInfo.tls(verbose);
} else {
System.out.println(rb.getString("showinfo.no.option"));
}
}
private void doPrintVersion() {
System.out.println("keytool " + System.getProperty("java.version"));
}
private Collection<? extends Certificate> generateCertificates(InputStream in)
throws CertificateException, IOException {
byte[] data = in.readAllBytes();
try {
return CertificateFactory.getInstance("X.509")
.generateCertificates(new ByteArrayInputStream(data));
} catch (CertificateException e) {
if (providerName != null) {
try {
return CertificateFactory.getInstance("X.509", providerName)
.generateCertificates(new ByteArrayInputStream(data));
} catch (Exception e2) {
e.addSuppressed(e2);
}
}
throw e;
}
}
private Certificate generateCertificate(InputStream in)
throws CertificateException, IOException {
byte[] data = in.readAllBytes();
try {
return CertificateFactory.getInstance("X.509")
.generateCertificate(new ByteArrayInputStream(data));
} catch (CertificateException e) {
if (providerName != null) {
try {
return CertificateFactory.getInstance("X.509", providerName)
.generateCertificate(new ByteArrayInputStream(data));
} catch (Exception e2) {
e.addSuppressed(e2);
}
}
throw e;
}
}
private static String oneInMany(String label, int i, int num) {
if (num == 1) {
return label;
} else {
return String.format(rb.getString("one.in.many"), label, i+1, num);
}
}
private static String oneInManys(String label, int certNo, int certCnt, int signerNo,
int signerCnt) {
if (certCnt == 1 && signerCnt == 1) {
return label;
}
if (certCnt > 1 && signerCnt == 1) {
return String.format(rb.getString("one.in.many1"), label, certNo);
}
if (certCnt == 1 && signerCnt > 1) {
return String.format(rb.getString("one.in.many2"), label, signerNo);
}
if (certCnt > 1 && signerCnt > 1) {
return String.format(rb.getString("one.in.many3"), label, certNo, signerNo);
}
return label;
}
private void doPrintCert(final PrintStream out) throws Exception {
if (jarfile != null) {
// reset "jdk.certpath.disabledAlgorithms" security property
// to be able to read jars which were signed with weak algorithms
Security.setProperty(DisabledAlgorithmConstraints.PROPERTY_JAR_DISABLED_ALGS, "");
JarFile jf = new JarFile(jarfile, true);
Enumeration<JarEntry> entries = jf.entries();
LinkedHashSet<CodeSigner> ss = new LinkedHashSet<>();
byte[] buffer = new byte[8192];
int pos = 0;
while (entries.hasMoreElements()) {
JarEntry je = entries.nextElement();
try (InputStream is = jf.getInputStream(je)) {
while (is.read(buffer) != -1) {
// we just read. this will throw a SecurityException
// if a signature/digest check fails. This also
// populate the signers
}
}
CodeSigner[] signers = je.getCodeSigners();
if (signers != null) {
for (CodeSigner signer: signers) {
ss.add(signer);
}
}
}
for (CodeSigner signer: ss) {
out.printf(rb.getString("Signer.d."), ++pos);
out.println();
out.println();
List<? extends Certificate> certs
= signer.getSignerCertPath().getCertificates();
@SuppressWarnings("unchecked")
List<X509Certificate> chain =
(List<X509Certificate>)certs;
TrustAnchor anchor = findTrustAnchor(chain);
CertPathConstraintsParameters cpcp;
int cc = 0;
for (Certificate cert: certs) {
out.printf(rb.getString("Certificate.d."), ++cc);
out.println();
X509Certificate x = (X509Certificate)cert;
if (rfc) {
out.println(rb.getString("Certificate.owner.") + x.getSubjectX500Principal() + "\n");
dumpCert(x, out);
} else {
printX509Cert(x, out);
}
out.println();
if (cc == 0 && x.getBasicConstraints() == -1) {
// this is an EE
cpcp = buildCertPathConstraint(x, anchor);
} else {
cpcp = new CertPathConstraintsParameters(
x, null, anchor, null);
}
checkWeakConstraint(oneInManys(rb.getString(
"the.certificate"), cc,
certs.size(), pos,
ss.size()), x, cpcp);
}
Timestamp ts = signer.getTimestamp();
if (ts != null) {
out.println(rb.getString("Timestamp."));
out.println();
certs = ts.getSignerCertPath().getCertificates();
@SuppressWarnings("unchecked")
List<X509Certificate> tschain =
(List<X509Certificate>)certs;
anchor = findTrustAnchor(tschain);
cc = 0;
for (Certificate cert: certs) {
out.printf(rb.getString("Certificate.d."), ++cc);
out.println();
X509Certificate x = (X509Certificate)cert;
if (rfc) {
out.println(rb.getString("Certificate.owner.") + x.getSubjectX500Principal() + "\n");
dumpCert(x, out);
} else {
printX509Cert(x, out);
}
out.println();
if (cc == 0 &&
x.getBasicConstraints() == -1) {
// this is an EE
cpcp = buildCertPathConstraint(x, anchor);
} else {
cpcp = new CertPathConstraintsParameters(
x, null, anchor, null);
}
checkWeakConstraint(oneInManys(rb.getString(
"the.tsa.certificate"), cc,
certs.size(), pos,
ss.size()), x, cpcp);
}
}
}
jf.close();
if (ss.isEmpty()) {
out.println(rb.getString("Not.a.signed.jar.file"));
}
} else if (sslserver != null) {
CertStore cs = SSLServerCertStore.getInstance(new URI("https://" + sslserver));
Collection<? extends Certificate> chain;
try {
chain = cs.getCertificates(null);
if (chain.isEmpty()) {
// If the certs are not retrieved, we consider it an error
// even if the URL connection is successful.
throw new Exception(rb.getString(
"No.certificate.from.the.SSL.server"));
}
} catch (CertStoreException cse) {
if (cse.getCause() instanceof IOException) {
throw new Exception(rb.getString(
"No.certificate.from.the.SSL.server"),
cse.getCause());
} else {
throw cse;
}
}
int i = 0;
@SuppressWarnings("unchecked")
List<X509Certificate> xcerts = (List<X509Certificate>)chain;
TrustAnchor anchor = findTrustAnchor(xcerts);
for (Certificate cert : chain) {
try {
if (rfc) {
dumpCert(cert, out);
} else {
out.println("Certificate #" + i);
out.println("====================================");
printX509Cert((X509Certificate)cert, out);
out.println();
}
X509Certificate x = (X509Certificate)cert;
CertPathConstraintsParameters cpcp;
if (i == 0 && x.getBasicConstraints() == -1) {
// this is an EE
cpcp = buildCertPathConstraint(x, anchor);
} else {
cpcp = new CertPathConstraintsParameters(
x, null, anchor, null);
}
checkWeakConstraint(oneInMany(rb.getString(
"the.certificate"), i++, chain.size()), x, cpcp);
} catch (Exception e) {
if (debug) {
e.printStackTrace();
}
}
}
} else {
if (filename != null) {
try (FileInputStream inStream = new FileInputStream(filename)) {
printCertFromStream(inStream, out);
}
} else {
printCertFromStream(System.in, out);
}
}
}
private void doChangeStorePasswd() throws Exception {
storePassNew = newPass;
if (storePassNew == null) {
storePassNew = getNewPasswd("keystore password", storePass);
}
if (P12KEYSTORE.equalsIgnoreCase(storetype)) {
// When storetype is PKCS12, we need to change all keypass as well
for (String alias : Collections.list(keyStore.aliases())) {
if (!keyStore.isCertificateEntry(alias)) {
// keyPass should be either null or same with storePass,
// but keep it in case one day we want to "normalize"
// a PKCS12 keystore having different passwords.
Pair<Entry, char[]> objs
= recoverEntry(keyStore, alias, storePass, keyPass);
keyStore.setEntry(alias, objs.fst,
new PasswordProtection(storePassNew));
}
}
}
}
/**
* Creates a self-signed certificate, and stores it as a single-element
* certificate chain.
*/
private void doSelfCert(String alias, String dname, String sigAlgName)
throws Exception
{
if (alias == null) {
alias = keyAlias;
}
Pair<Key,char[]> objs = recoverKey(alias, storePass, keyPass);
PrivateKey privKey = (PrivateKey)objs.fst;
if (keyPass == null)
keyPass = objs.snd;
// Determine the signature algorithm
if (sigAlgName == null) {
sigAlgName = getCompatibleSigAlgName(privKey);
}
// Get the old certificate
Certificate oldCert = keyStore.getCertificate(alias);
if (oldCert == null) {
MessageFormat form = new MessageFormat
(rb.getString("alias.has.no.public.key"));
Object[] source = {alias};
throw new Exception(form.format(source));
}
if (!(oldCert instanceof X509Certificate)) {
MessageFormat form = new MessageFormat
(rb.getString("alias.has.no.X.509.certificate"));
Object[] source = {alias};
throw new Exception(form.format(source));
}
// convert to X509CertImpl, so that we can modify selected fields
// (no public APIs available yet)
byte[] encoded = oldCert.getEncoded();
X509CertImpl certImpl = new X509CertImpl(encoded);
X509CertInfo certInfo = certImpl.getInfo();
// Extend its validity
Date firstDate = getStartDate(startDate);
Date lastDate = getLastDate(firstDate, validity);
CertificateValidity interval = new CertificateValidity(firstDate,
lastDate);
certInfo.setValidity(interval);
// Make new serial number
certInfo.setSerialNumber(
CertificateSerialNumber.newRandom64bit(new SecureRandom()));
// Set owner and issuer fields
X500Name owner;
if (dname == null) {
// Get the owner name from the certificate
owner = certInfo.getSubject();
} else {
// Use the owner name specified at the command line
owner = new X500Name(dname);
certInfo.setSubject(owner);
}
// Make issuer same as owner (self-signed!)
certInfo.setIssuer(owner);
certInfo.setVersion(new CertificateVersion(CertificateVersion.V3));
CertificateExtensions ext = createV3Extensions(
null,
certInfo.getExtensions(),
v3ext,
oldCert.getPublicKey(),
null);
certInfo.setExtensions(ext);
// Sign the new certificate
X509CertImpl newCert = X509CertImpl.newSigned(
certInfo, privKey, sigAlgName);
// Store the new certificate as a single-element certificate chain
keyStore.setKeyEntry(alias, privKey,
(keyPass != null) ? keyPass : storePass,
new Certificate[] { newCert } );
if (verbose) {
System.err.println(rb.getString("New.certificate.self.signed."));
System.err.print(newCert.toString());
System.err.println();
}
}
/**
* Processes a certificate reply from a certificate authority.
*
* <p>Builds a certificate chain on top of the certificate reply,
* using trusted certificates from the keystore. The chain is complete
* after a self-signed certificate has been encountered. The self-signed
* certificate is considered a root certificate authority, and is stored
* at the end of the chain.
*
* <p>The newly generated chain replaces the old chain associated with the
* key entry.
*
* @return true if the certificate reply was installed, otherwise false.
*/
private boolean installReply(String alias, InputStream in)
throws Exception
{
if (alias == null) {
alias = keyAlias;
}
Pair<Key,char[]> objs = recoverKey(alias, storePass, keyPass);
PrivateKey privKey = (PrivateKey)objs.fst;
if (keyPass == null) {
keyPass = objs.snd;
}
Certificate userCert = keyStore.getCertificate(alias);
if (userCert == null) {
MessageFormat form = new MessageFormat
(rb.getString("alias.has.no.public.key.certificate."));
Object[] source = {alias};
throw new Exception(form.format(source));
}
// Read the certificates in the reply
Collection<? extends Certificate> c = generateCertificates(in);
if (c.isEmpty()) {
throw new Exception(rb.getString("Reply.has.no.certificates"));
}
Certificate[] replyCerts = c.toArray(new Certificate[0]);
Certificate[] newChain;
if (replyCerts.length == 1) {
// single-cert reply
newChain = establishCertChain(userCert, replyCerts[0]);
} else {
// cert-chain reply (e.g., PKCS#7)
newChain = validateReply(alias, userCert, replyCerts);
}
// Now store the newly established chain in the keystore. The new
// chain replaces the old one. The chain can be null if user chooses no.
if (newChain != null) {
keyStore.setKeyEntry(alias, privKey,
(keyPass != null) ? keyPass : storePass,
newChain);
return true;
} else {
return false;
}
}
/**
* Imports a certificate and adds it to the list of trusted certificates.
*
* @return true if the certificate was added, otherwise false.
*/
private boolean addTrustedCert(String alias, InputStream in)
throws Exception
{
if (alias == null) {
throw new Exception(rb.getString("Must.specify.alias"));
}
if (keyStore.containsAlias(alias)) {
MessageFormat form = new MessageFormat(rb.getString
("Certificate.not.imported.alias.alias.already.exists"));
Object[] source = {alias};
throw new Exception(form.format(source));
}
// Read the certificate
X509Certificate cert;
try {
cert = (X509Certificate)generateCertificate(in);
} catch (ClassCastException | CertificateException ce) {
throw new Exception(rb.getString("Input.not.an.X.509.certificate"));
}
CertPathConstraintsParameters cpcp =
buildCertPathConstraint(cert, null);
if (noprompt) {
checkWeakConstraint(rb.getString("the.input"), cert, cpcp);
keyStore.setCertificateEntry(alias, cert);
return true;
}
// if certificate is self-signed, make sure it verifies
boolean selfSigned = false;
if (KeyStoreUtil.isSelfSigned(cert)) {
cert.verify(cert.getPublicKey());
selfSigned = true;
}
// check if cert already exists in keystore
String reply = null;
String trustalias = keyStore.getCertificateAlias(cert);
if (trustalias != null) {
MessageFormat form = new MessageFormat(rb.getString
("Certificate.already.exists.in.keystore.under.alias.trustalias."));
Object[] source = {trustalias};
System.err.println(form.format(source));
checkWeakConstraint(rb.getString("the.input"), cert, cpcp);
printWeakWarnings(true);
reply = getYesNoReply
(rb.getString("Do.you.still.want.to.add.it.no."));
} else if (selfSigned) {
if (trustcacerts && (caks != null) &&
((trustalias=caks.getCertificateAlias(cert)) != null)) {
MessageFormat form = new MessageFormat(rb.getString
("Certificate.already.exists.in.system.wide.CA.keystore.under.alias.trustalias."));
Object[] source = {trustalias};
System.err.println(form.format(source));
checkWeakConstraint(rb.getString("the.input"), cert, cpcp);
printWeakWarnings(true);
reply = getYesNoReply
(rb.getString("Do.you.still.want.to.add.it.to.your.own.keystore.no."));
}
if (trustalias == null) {
// Print the cert and ask user if they really want to add
// it to their keystore
printX509Cert(cert, System.out);
checkWeakConstraint(rb.getString("the.input"), cert, cpcp);
printWeakWarnings(true);
reply = getYesNoReply
(rb.getString("Trust.this.certificate.no."));
}
}
if (reply != null) {
if ("YES".equals(reply)) {
keyStore.setCertificateEntry(alias, cert);
return true;
} else {
return false;
}
}
// Not found in this keystore and not self-signed
// Try to establish trust chain
try {
Certificate[] chain = establishCertChain(null, cert);
if (chain != null) {
keyStore.setCertificateEntry(alias, cert);
return true;
}
} catch (Exception e) {
// Print the cert and ask user if they really want to add it to
// their keystore
printX509Cert(cert, System.out);
checkWeakConstraint(rb.getString("the.input"), cert, cpcp);
printWeakWarnings(true);
reply = getYesNoReply
(rb.getString("Trust.this.certificate.no."));
if ("YES".equals(reply)) {
keyStore.setCertificateEntry(alias, cert);
return true;
} else {
return false;
}
}
return false;
}
/**
* Prompts user for new password. New password must be different from
* old one.
*
* @param prompt the message that gets prompted on the screen
* @param oldPasswd the current (i.e., old) password
*/
private char[] getNewPasswd(String prompt, char[] oldPasswd)
throws Exception
{
char[] entered;
char[] reentered = null;
for (int count = 0; count < 3; count++) {
MessageFormat form = new MessageFormat
(rb.getString("New.prompt."));
Object[] source = {prompt};
System.err.print(form.format(source));
entered = Password.readPassword(System.in);
passwords.add(entered);
if (entered == null || entered.length < 6) {
System.err.println(rb.getString
("Password.is.too.short.must.be.at.least.6.characters"));
} else if (Arrays.equals(entered, oldPasswd)) {
System.err.println(rb.getString("Passwords.must.differ"));
} else {
form = new MessageFormat
(rb.getString("Re.enter.new.prompt."));
Object[] src = {prompt};
System.err.print(form.format(src));
reentered = Password.readPassword(System.in);
passwords.add(reentered);
if (!Arrays.equals(entered, reentered)) {
System.err.println
(rb.getString("They.don.t.match.Try.again"));
} else {
Arrays.fill(reentered, ' ');
return entered;
}
}
if (entered != null) {
Arrays.fill(entered, ' ');
entered = null;
}
if (reentered != null) {
Arrays.fill(reentered, ' ');
reentered = null;
}
}
throw new Exception(rb.getString("Too.many.failures.try.later"));
}
/**
* Prompts user for alias name.
* @param prompt the {0} of "Enter {0} alias name: " in prompt line
* @return the string entered by the user, without the \n at the end
*/
private String getAlias(String prompt) throws Exception {
if (prompt != null) {
MessageFormat form = new MessageFormat
(rb.getString("Enter.prompt.alias.name."));
Object[] source = {prompt};
System.err.print(form.format(source));
} else {
System.err.print(rb.getString("Enter.alias.name."));
}
return (new BufferedReader(new InputStreamReader(
System.in))).readLine();
}
/**
* Prompts user for an input string from the command line (System.in)
* @param prompt the prompt string printed
* @return the string entered by the user, without the \n at the end
*/
private String inputStringFromStdin(String prompt) throws Exception {
System.err.print(prompt);
return (new BufferedReader(new InputStreamReader(
System.in))).readLine();
}
/**
* Prompts user for key password. User may select to choose the same
* password (<code>otherKeyPass</code>) as for <code>otherAlias</code>.
*/
private char[] getKeyPasswd(String alias, String otherAlias,
char[] otherKeyPass)
throws Exception
{
int count = 0;
char[] keyPass;
do {
MessageFormat form = new MessageFormat(rb.getString
("Enter.key.password.for.alias."));
Object[] source = {alias};
if (otherKeyPass != null) {
System.err.println(form.format(source));
form = new MessageFormat(rb.getString
(".RETURN.if.same.as.for.otherAlias."));
Object[] src = {otherAlias};
System.err.print(form.format(src));
} else {
System.err.print(form.format(source));
}
System.err.flush();
keyPass = Password.readPassword(System.in);
passwords.add(keyPass);
if (keyPass == null) {
keyPass = otherKeyPass;
}
count++;
} while ((keyPass == null) && count < 3);
if (keyPass == null) {
throw new Exception(rb.getString("Too.many.failures.try.later"));
}
return keyPass;
}
private String withWeakConstraint(String alg,
CertPathConstraintsParameters cpcp) {
try {
DISABLED_CHECK.permits(alg, cpcp, false);
} catch (CertPathValidatorException e) {
return String.format(rb.getString("with.disabled"), alg);
}
try {
LEGACY_CHECK.permits(alg, cpcp, false);
return alg;
} catch (CertPathValidatorException e) {
return String.format(rb.getString("with.weak"), alg);
}
}
private String withWeak(String alg) {
if (DISABLED_CHECK.permits(SIG_PRIMITIVE_SET, alg, null)) {
if (LEGACY_CHECK.permits(SIG_PRIMITIVE_SET, alg, null)) {
return alg;
} else {
return String.format(rb.getString("with.weak"), alg);
}
} else {
return String.format(rb.getString("with.disabled"), alg);
}
}
private String withWeakConstraint(Key key,
CertPathConstraintsParameters cpcp) {
String displayAlg = fullDisplayKeyName(key);
try {
DISABLED_CHECK.permits(key.getAlgorithm(), cpcp, true);
} catch (CertPathValidatorException e) {
return String.format(rb.getString("key.bit.disabled"), displayAlg);
}
try {
LEGACY_CHECK.permits(key.getAlgorithm(), cpcp, true);
return String.format(rb.getString("key.bit"), displayAlg);
} catch (CertPathValidatorException e) {
return String.format(rb.getString("key.bit.weak"), displayAlg);
}
}
/**
* Prints a certificate in a human-readable format.
*/
private void printX509Cert(X509Certificate cert, PrintStream out)
throws Exception
{
MessageFormat form = new MessageFormat
(rb.getString(".PATTERN.printX509Cert.with.weak"));
PublicKey pkey = cert.getPublicKey();
String sigName = cert.getSigAlgName();
CertPathConstraintsParameters cpcp =
buildCertPathConstraint(cert, null);
// No need to warn about sigalg of a trust anchor
if (!isTrustedCert(cert)) {
sigName = withWeakConstraint(sigName, cpcp);
}
Object[] source = {cert.getSubjectX500Principal().toString(),
cert.getIssuerX500Principal().toString(),
cert.getSerialNumber().toString(16),
cert.getNotBefore().toString(),
cert.getNotAfter().toString(),
getCertFingerPrint("SHA-1", cert),
getCertFingerPrint("SHA-256", cert),
sigName,
withWeakConstraint(pkey, cpcp),
cert.getVersion()
};
out.println(form.format(source));
if (cert instanceof X509CertImpl impl) {
X509CertInfo certInfo = impl.getInfo();
CertificateExtensions exts = certInfo.getExtensions();
if (exts != null) {
printExtensions(rb.getString("Extensions."), exts, out);
}
}
}
private static void printExtensions(String title, CertificateExtensions exts, PrintStream out)
throws Exception {
int extnum = 0;
Iterator<Extension> i1 = exts.getAllExtensions().iterator();
Iterator<Extension> i2 = exts.getUnparseableExtensions().values().iterator();
while (i1.hasNext() || i2.hasNext()) {
Extension ext = i1.hasNext()?i1.next():i2.next();
if (extnum == 0) {
out.println();
out.println(title);
out.println();
}
out.print("#"+(++extnum)+": "+ ext);
if (ext.getClass() == Extension.class) {
byte[] v = ext.getExtensionValue();
if (v.length == 0) {
out.println(rb.getString(".Empty.value."));
} else {
new sun.security.util.HexDumpEncoder().encodeBuffer(ext.getExtensionValue(), out);
out.println();
}
}
out.println();
}
}
/**
* Locates a signer for a given certificate from a given keystore and
* returns the signer's certificate.
* @param cert the certificate whose signer is searched, not null
* @param ks the keystore to search with, not null
* @return <code>cert</code> itself if it's already inside <code>ks</code>,
* or a certificate inside <code>ks</code> who signs <code>cert</code>,
* or null otherwise. A label is added.
*/
private static Pair<String,Certificate>
getSigner(Certificate cert, KeyStore ks) throws Exception {
if (ks.getCertificateAlias(cert) != null) {
return new Pair<>("", cert);
}
for (Enumeration<String> aliases = ks.aliases();
aliases.hasMoreElements(); ) {
String name = aliases.nextElement();
Certificate trustedCert = ks.getCertificate(name);
if (trustedCert != null) {
try {
cert.verify(trustedCert.getPublicKey());
return new Pair<>(name, trustedCert);
} catch (Exception e) {
// Not verified, skip to the next one
}
}
}
return null;
}
/**
* Gets an X.500 name suitable for inclusion in a certification request.
*/
private X500Name getX500Name() throws IOException {
BufferedReader in;
in = new BufferedReader(new InputStreamReader(System.in));
String commonName = "Unknown";
String organizationalUnit = "Unknown";
String organization = "Unknown";
String city = "Unknown";
String state = "Unknown";
String country = "Unknown";
X500Name name;
String userInput;
int maxRetry = 20;
boolean needRepeat;
do {
if (maxRetry-- < 0) {
throw new RuntimeException(rb.getString(
"Too.many.retries.program.terminated"));
}
System.err.println(rb.getString("enter.dname.components"));
commonName = inputString(in,
rb.getString("What.is.your.first.and.last.name."),
commonName);
organizationalUnit = inputString(in,
rb.getString
("What.is.the.name.of.your.organizational.unit."),
organizationalUnit);
organization = inputString(in,
rb.getString("What.is.the.name.of.your.organization."),
organization);
city = inputString(in,
rb.getString("What.is.the.name.of.your.City.or.Locality."),
city);
state = inputString(in,
rb.getString("What.is.the.name.of.your.State.or.Province."),
state);
country = inputString(in,
rb.getString
("What.is.the.two.letter.country.code.for.this.unit."),
country);
name = new X500Name(
dotToNull(commonName), dotToNull(organizationalUnit),
dotToNull(organization), dotToNull(city),
dotToNull(state), dotToNull(country));
if (name.isEmpty()) {
System.err.println(rb.getString("no.field.in.dname"));
needRepeat = true;
} else {
MessageFormat form = new MessageFormat
(rb.getString("Is.name.correct."));
Object[] source = {name};
userInput = inputString
(in, form.format(source), rb.getString("no"));
needRepeat = collator.compare(userInput, rb.getString("yes")) != 0 &&
collator.compare(userInput, rb.getString("y")) != 0;
}
} while (needRepeat);
System.err.println();
return name;
}
private static String dotToNull(String input) {
return ".".equals(input) ? null : input;
}
private String inputString(BufferedReader in, String prompt,
String defaultValue)
throws IOException
{
System.err.println(prompt);
MessageFormat form = new MessageFormat
(rb.getString(".defaultValue."));
Object[] source = { ".".equals(defaultValue) ? "" : defaultValue };
System.err.print(form.format(source));
System.err.flush();
String value = in.readLine();
if (value == null || collator.compare(value, "") == 0) {
value = defaultValue;
}
return value;
}
/**
* Writes an X.509 certificate in base64 or binary encoding to an output
* stream.
*/
private void dumpCert(Certificate cert, PrintStream out)
throws IOException, CertificateException
{
if (rfc) {
out.print(X509Factory.BEGIN_CERT);
out.print("\r\n");
out.print(Base64.getMimeEncoder(64, CRLF).encodeToString(cert.getEncoded()));
out.print("\r\n");
out.print(X509Factory.END_CERT);
out.print("\r\n");
} else {
out.write(cert.getEncoded()); // binary
}
}
/**
* Recovers (private) key associated with given alias.
*
* @return an array of objects, where the 1st element in the array is the
* recovered private key, and the 2nd element is the password used to
* recover it.
*/
private Pair<Key,char[]> recoverKey(String alias, char[] storePass,
char[] keyPass)
throws Exception
{
Key key;
if (KeyStoreUtil.isWindowsKeyStore(storetype)) {
key = keyStore.getKey(alias, null);
return Pair.of(key, null);
}
if (!keyStore.containsAlias(alias)) {
MessageFormat form = new MessageFormat
(rb.getString("Alias.alias.does.not.exist"));
Object[] source = {alias};
throw new Exception(form.format(source));
}
if (!keyStore.entryInstanceOf(alias, KeyStore.PrivateKeyEntry.class) &&
!keyStore.entryInstanceOf(alias, KeyStore.SecretKeyEntry.class)) {
MessageFormat form = new MessageFormat
(rb.getString("Alias.alias.has.no.key"));
Object[] source = {alias};
throw new Exception(form.format(source));
}
if (keyPass == null) {
// Try to recover the key using the keystore password
if (storePass != null) {
try {
key = keyStore.getKey(alias, storePass);
passwords.add(storePass);
return Pair.of(key, storePass);
} catch (UnrecoverableKeyException e) {
if (token) {
throw e;
}
}
}
// prompt user for key password
keyPass = getKeyPasswd(alias, null, null);
}
key = keyStore.getKey(alias, keyPass);
return Pair.of(key, keyPass);
}
/**
* Recovers entry associated with given alias.
*
* @return an array of objects, where the 1st element in the array is the
* recovered entry, and the 2nd element is the password used to
* recover it (null if no password).
*/
private Pair<Entry,char[]> recoverEntry(KeyStore ks,
String alias,
char[] pstore,
char[] pkey) throws Exception {
if (!ks.containsAlias(alias)) {
MessageFormat form = new MessageFormat(
rb.getString("Alias.alias.does.not.exist"));
Object[] source = {alias};
throw new Exception(form.format(source));
}
// Step 1: First attempt to access entry without key password
// (PKCS11 entry or trusted certificate entry, for example).
// If fail, go next.
try {
Entry entry = ks.getEntry(alias, null);
return Pair.of(entry, null);
} catch (UnrecoverableEntryException une) {
if(P11KEYSTORE.equalsIgnoreCase(ks.getType()) ||
KeyStoreUtil.isWindowsKeyStore(ks.getType())) {
// should not happen, but a possibility
throw une;
}
}
// entry is protected
// Step 2: try pkey if not null. If fail, fail.
if (pkey != null) {
PasswordProtection pp = new PasswordProtection(pkey);
Entry entry = ks.getEntry(alias, pp);
return Pair.of(entry, pkey);
}
// Step 3: try pstore if not null. If fail, go next.
if (pstore != null) {
try {
PasswordProtection pp = new PasswordProtection(pstore);
Entry entry = ks.getEntry(alias, pp);
return Pair.of(entry, pstore);
} catch (UnrecoverableEntryException une) {
if (P12KEYSTORE.equalsIgnoreCase(ks.getType())) {
// P12 keystore currently does not support separate
// store and entry passwords. We will not prompt for
// entry password.
throw une;
}
}
}
// Step 4: prompt for entry password
pkey = getKeyPasswd(alias, null, null);
PasswordProtection pp = new PasswordProtection(pkey);
Entry entry = ks.getEntry(alias, pp);
return Pair.of(entry, pkey);
}
/**
* Gets the requested fingerprint of the certificate.
*/
private String getCertFingerPrint(String mdAlg, Certificate cert)
throws Exception
{
byte[] encCertInfo = cert.getEncoded();
MessageDigest md = MessageDigest.getInstance(mdAlg);
byte[] digest = md.digest(encCertInfo);
return HexFormat.ofDelimiter(":").withUpperCase().formatHex(digest);
}
/**
* Prints warning about missing integrity check.
*/
private void printNoIntegrityWarning() {
System.err.println();
System.err.println(rb.getString
(".WARNING.WARNING.WARNING."));
System.err.println(rb.getString
(".The.integrity.of.the.information.stored.in.your.keystore."));
System.err.println(rb.getString
(".WARNING.WARNING.WARNING."));
System.err.println();
}
/**
* Validates chain in certification reply, and returns the ordered
* elements of the chain (with user certificate first, and root
* certificate last in the array).
*
* @param alias the alias name
* @param userCert the user certificate of the alias
* @param replyCerts the chain provided in the reply
*/
private Certificate[] validateReply(String alias,
Certificate userCert,
Certificate[] replyCerts)
throws Exception
{
checkWeakConstraint(rb.getString("reply"), replyCerts);
// order the certs in the reply (bottom-up).
// we know that all certs in the reply are of type X.509, because
// we parsed them using an X.509 certificate factory
int i;
PublicKey userPubKey = userCert.getPublicKey();
// Remove duplicated certificates.
HashSet<Certificate> nodup = new HashSet<>(Arrays.asList(replyCerts));
replyCerts = nodup.toArray(new Certificate[0]);
for (i=0; i<replyCerts.length; i++) {
if (userPubKey.equals(replyCerts[i].getPublicKey())) {
break;
}
}
if (i == replyCerts.length) {
MessageFormat form = new MessageFormat(rb.getString
("Certificate.reply.does.not.contain.public.key.for.alias."));
Object[] source = {alias};
throw new Exception(form.format(source));
}
Certificate tmpCert = replyCerts[0];
replyCerts[0] = replyCerts[i];
replyCerts[i] = tmpCert;
X509Certificate thisCert = (X509Certificate)replyCerts[0];
for (i=1; i < replyCerts.length-1; i++) {
// find a cert in the reply who signs thisCert
int j;
for (j=i; j<replyCerts.length; j++) {
if (KeyStoreUtil.signedBy(thisCert, (X509Certificate)replyCerts[j])) {
tmpCert = replyCerts[i];
replyCerts[i] = replyCerts[j];
replyCerts[j] = tmpCert;
thisCert = (X509Certificate)replyCerts[i];
break;
}
}
if (j == replyCerts.length) {
throw new Exception
(rb.getString("Incomplete.certificate.chain.in.reply"));
}
}
if (noprompt) {
return replyCerts;
}
// do we trust the cert at the top?
Certificate topCert = replyCerts[replyCerts.length-1];
boolean fromKeyStore = true;
Pair<String,Certificate> root = getSigner(topCert, keyStore);
if (root == null && trustcacerts && caks != null) {
root = getSigner(topCert, caks);
fromKeyStore = false;
}
if (root == null) {
System.err.println();
System.err.println
(rb.getString("Top.level.certificate.in.reply."));
printX509Cert((X509Certificate)topCert, System.out);
System.err.println();
System.err.print(rb.getString(".is.not.trusted."));
printWeakWarnings(true);
String reply = getYesNoReply
(rb.getString("Install.reply.anyway.no."));
if ("NO".equals(reply)) {
return null;
}
} else {
if (root.snd != topCert) {
// append the root CA cert to the chain
Certificate[] tmpCerts =
new Certificate[replyCerts.length+1];
System.arraycopy(replyCerts, 0, tmpCerts, 0,
replyCerts.length);
tmpCerts[tmpCerts.length-1] = root.snd;
replyCerts = tmpCerts;
CertPathConstraintsParameters cpcp =
buildCertPathConstraint((X509Certificate)root.snd,
null);
checkWeakConstraint(String.format(fromKeyStore
? rb.getString("alias.in.keystore")
: rb.getString("alias.in.cacerts"),
root.fst),
root.snd, cpcp);
}
}
return replyCerts;
}
/**
* Establishes a certificate chain (using trusted certificates in the
* keystore and cacerts), starting with the reply (certToVerify)
* and ending at a self-signed certificate found in the keystore.
*
* @param userCert optional existing certificate, mostly likely be the
* original self-signed cert created by -genkeypair.
* It must have the same public key as certToVerify
* but cannot be the same cert.
* @param certToVerify the starting certificate to build the chain
* @return the established chain, might be null if user decides not
*/
private Certificate[] establishCertChain(Certificate userCert,
Certificate certToVerify)
throws Exception
{
if (userCert != null) {
// Make sure that the public key of the certificate reply matches
// the original public key in the keystore
PublicKey origPubKey = userCert.getPublicKey();
PublicKey replyPubKey = certToVerify.getPublicKey();
if (!origPubKey.equals(replyPubKey)) {
throw new Exception(rb.getString
("Public.keys.in.reply.and.keystore.don.t.match"));
}
// If the two certs are identical, we're done: no need to import
// anything
if (certToVerify.equals(userCert)) {
throw new Exception(rb.getString
("Certificate.reply.and.certificate.in.keystore.are.identical"));
}
}
// Build a hash table of all certificates in the keystore.
// Use the subject distinguished name as the key into the hash table.
// All certificates associated with the same subject distinguished
// name are stored in the same hash table entry as a vector.
Hashtable<Principal, Vector<Pair<String,X509Certificate>>> certs = null;
if (keyStore.size() > 0) {
certs = new Hashtable<>(11);
keystorecerts2Hashtable(keyStore, certs);
}
if (trustcacerts) {
if (caks!=null && caks.size()>0) {
if (certs == null) {
certs = new Hashtable<>(11);
}
keystorecerts2Hashtable(caks, certs);
}
}
// start building chain
Vector<Pair<String,X509Certificate>> chain = new Vector<>(2);
if (buildChain(
new Pair<>(rb.getString("the.input"),
(X509Certificate) certToVerify),
chain, certs)) {
for (Pair<String,X509Certificate> p : chain) {
CertPathConstraintsParameters cpcp =
buildCertPathConstraint(p.snd, null);
checkWeakConstraint(p.fst, p.snd, cpcp);
}
Certificate[] newChain =
new Certificate[chain.size()];
// buildChain() returns chain with self-signed root-cert first and
// user-cert last, so we need to invert the chain before we store
// it
int j=0;
for (int i=chain.size()-1; i>=0; i--) {
newChain[j] = chain.elementAt(i).snd;
j++;
}
return newChain;
} else {
throw new Exception
(rb.getString("Failed.to.establish.chain.from.reply"));
}
}
/**
* Recursively tries to establish chain from pool of certs starting from
* certToVerify until a self-signed cert is found, and fill the certs found
* into chain. Each cert in the chain signs the next one.
*
* This method is able to recover from an error, say, if certToVerify
* is signed by certA but certA has no issuer in certs and itself is not
* self-signed, the method can try another certB that also signs
* certToVerify and look for signer of certB, etc., etc.
*
* Each cert in chain comes with a label showing its origin. The label is
* used in the warning message when the cert is considered a risk.
*
* @param certToVerify the cert that needs to be verified.
* @param chain the chain that's being built.
* @param certs the pool of trusted certs
*
* @return true if successful, false otherwise.
*/
private boolean buildChain(Pair<String,X509Certificate> certToVerify,
Vector<Pair<String,X509Certificate>> chain,
Hashtable<Principal, Vector<Pair<String,X509Certificate>>> certs) {
if (KeyStoreUtil.isSelfSigned(certToVerify.snd)) {
// reached self-signed root cert;
// no verification needed because it's trusted.
chain.addElement(certToVerify);
return true;
}
Principal issuer = certToVerify.snd.getIssuerX500Principal();
// Get the issuer's certificate(s)
Vector<Pair<String,X509Certificate>> vec = certs.get(issuer);
if (vec == null) {
return false;
}
// Try out each certificate in the vector, until we find one
// whose public key verifies the signature of the certificate
// in question.
for (Pair<String, X509Certificate> issuerCert : vec) {
PublicKey issuerPubKey = issuerCert.snd.getPublicKey();
try {
certToVerify.snd.verify(issuerPubKey);
} catch (Exception e) {
continue;
}
if (buildChain(issuerCert, chain, certs)) {
chain.addElement(certToVerify);
return true;
}
}
return false;
}
/**
* Prompts user for yes/no decision.
*
* @return the user's decision, can only be "YES" or "NO"
*/
private String getYesNoReply(String prompt)
throws IOException
{
String reply;
int maxRetry = 20;
do {
if (maxRetry-- < 0) {
throw new RuntimeException(rb.getString(
"Too.many.retries.program.terminated"));
}
System.err.print(prompt);
System.err.flush();
reply = (new BufferedReader(new InputStreamReader
(System.in))).readLine();
if (reply == null ||
collator.compare(reply, "") == 0 ||
collator.compare(reply, rb.getString("n")) == 0 ||
collator.compare(reply, rb.getString("no")) == 0) {
reply = "NO";
} else if (collator.compare(reply, rb.getString("y")) == 0 ||
collator.compare(reply, rb.getString("yes")) == 0) {
reply = "YES";
} else {
System.err.println(rb.getString("Wrong.answer.try.again"));
reply = null;
}
} while (reply == null);
return reply;
}
/**
* Stores the (leaf) certificates of a keystore in a hashtable.
* All certs belonging to the same CA are stored in a vector that
* in turn is stored in the hashtable, keyed by the CA's subject DN.
* Each cert comes with a string label that shows its origin and alias.
*/
private void keystorecerts2Hashtable(KeyStore ks,
Hashtable<Principal, Vector<Pair<String,X509Certificate>>> hash)
throws Exception {
for (Enumeration<String> aliases = ks.aliases();
aliases.hasMoreElements(); ) {
String alias = aliases.nextElement();
Certificate cert = ks.getCertificate(alias);
if (cert != null) {
Principal subjectDN = ((X509Certificate)cert).getSubjectX500Principal();
Pair<String,X509Certificate> pair = new Pair<>(
String.format(
rb.getString(ks == caks ?
"alias.in.cacerts" :
"alias.in.keystore"),
alias),
(X509Certificate)cert);
Vector<Pair<String,X509Certificate>> vec = hash.get(subjectDN);
if (vec == null) {
vec = new Vector<>();
vec.addElement(pair);
} else {
if (!vec.contains(pair)) {
vec.addElement(pair);
}
}
hash.put(subjectDN, vec);
}
}
}
/**
* Returns the issue time that's specified the -startdate option
* @param s the value of -startdate option
*/
private static Date getStartDate(String s) throws IOException {
Calendar c = new GregorianCalendar();
if (s != null) {
IOException ioe = new IOException(
rb.getString("Illegal.startdate.value"));
int len = s.length();
if (len == 0) {
throw ioe;
}
if (s.charAt(0) == '-' || s.charAt(0) == '+') {
// Form 1: ([+-]nnn[ymdHMS])+
int start = 0;
while (start < len) {
int sign;
switch (s.charAt(start)) {
case '+': sign = 1; break;
case '-': sign = -1; break;
default: throw ioe;
}
int i = start+1;
for (; i<len; i++) {
char ch = s.charAt(i);
if (ch < '0' || ch > '9') break;
}
if (i == start+1) throw ioe;
int number = Integer.parseInt(s.substring(start+1, i));
if (i >= len) throw ioe;
int unit;
switch (s.charAt(i)) {
case 'y': unit = Calendar.YEAR; break;
case 'm': unit = Calendar.MONTH; break;
case 'd': unit = Calendar.DATE; break;
case 'H': unit = Calendar.HOUR; break;
case 'M': unit = Calendar.MINUTE; break;
case 'S': unit = Calendar.SECOND; break;
default: throw ioe;
}
c.add(unit, sign * number);
start = i + 1;
}
} else {
// Form 2: [yyyy/mm/dd] [HH:MM:SS]
String date = null, time = null;
if (len == 19) {
date = s.substring(0, 10);
time = s.substring(11);
if (s.charAt(10) != ' ')
throw ioe;
} else if (len == 10) {
date = s;
} else if (len == 8) {
time = s;
} else {
throw ioe;
}
if (date != null) {
if (date.matches("\\d\\d\\d\\d/\\d\\d/\\d\\d")) {
c.set(Integer.parseInt(date.substring(0, 4)),
Integer.parseInt(date.substring(5, 7))-1,
Integer.parseInt(date.substring(8, 10)));
} else {
throw ioe;
}
}
if (time != null) {
if (time.matches("\\d\\d:\\d\\d:\\d\\d")) {
c.set(Calendar.HOUR_OF_DAY, Integer.parseInt(time.substring(0, 2)));
c.set(Calendar.MINUTE, Integer.parseInt(time.substring(3, 5)));
c.set(Calendar.SECOND, Integer.parseInt(time.substring(6, 8)));
c.set(Calendar.MILLISECOND, 0);
} else {
throw ioe;
}
}
}
}
return c.getTime();
}
/**
* Match a command with a command set. The match can be exact, or
* partial, or case-insensitive.
*
* @param s the command provided by user
* @param list the legal command set represented by KnownOIDs enums.
* @return the position of a single match, or -1 if none matched
* @throws Exception if s is ambiguous
*/
private static int oneOf(String s, KnownOIDs... list) throws Exception {
String[] convertedList = new String[list.length];
for (int i = 0; i < list.length; i++) {
convertedList[i] = list[i].stdName();
}
return oneOf(s, convertedList);
}
/**
* Match a command with a command set. The match can be exact, or
* partial, or case-insensitive.
*
* @param s the command provided by user
* @param list the legal command set. If there is a null, commands after it
* are regarded experimental, which means they are supported but their
* existence should not be revealed to user.
* @return the position of a single match, or -1 if none matched
* @throws Exception if s is ambiguous
*/
private static int oneOf(String s, String... list) throws Exception {
// First, if there is an exact match, returns it.
int res = oneOfMatch((a,b) -> a.equals(b), s, list);
if (res >= 0) {
return res;
}
// Second, if there is one single camelCase or prefix match, returns it.
// This regex substitution removes all lowercase letters not at the
// beginning, so "keyCertSign" becomes "kCS".
res = oneOfMatch((a,b) -> a.equals(b.replaceAll("(?<!^)[a-z]", ""))
|| b.startsWith(a), s, list);
if (res >= 0) {
return res;
}
// Finally, retry the 2nd step ignoring case
return oneOfMatch((a,b) -> a.equalsIgnoreCase(b.replaceAll("(?<!^)[a-z]", ""))
|| b.toUpperCase(Locale.ROOT).startsWith(a.toUpperCase(Locale.ROOT)),
s, list);
}
/**
* Match a command with a command set.
*
* @param matcher a BiFunction which returns {@code true} if the 1st
* argument (user input) matches the 2nd one (full command)
* @param s the command provided by user
* @param list the legal command set
* @return the position of a single match, or -1 if none matched
* @throws Exception if s is ambiguous
*/
private static int oneOfMatch(BiFunction<String,String,Boolean> matcher,
String s, String... list) throws Exception {
int[] match = new int[list.length];
int nmatch = 0;
int experiment = Integer.MAX_VALUE;
for (int i = 0; i<list.length; i++) {
String one = list[i];
if (one == null) {
experiment = i;
continue;
}
if (matcher.apply(s, one)) {
match[nmatch++] = i;
}
}
if (nmatch == 0) {
return -1;
} else if (nmatch == 1) {
return match[0];
} else {
// If multiple matches is in experimental commands, ignore them
if (match[1] > experiment) {
return match[0];
}
StringBuilder sb = new StringBuilder();
MessageFormat form = new MessageFormat(rb.getString
("command.{0}.is.ambiguous."));
Object[] source = {s};
sb.append(form.format(source));
sb.append("\n ");
for (int i=0; i<nmatch && match[i]<experiment; i++) {
sb.append(' ');
sb.append(list[match[i]]);
}
throw new Exception(sb.toString());
}
}
/**
* Create a GeneralName object from known types
* @param t one of 5 known types
* @param v value
* @param exttype X.509 extension type
* @return which one
*/
private GeneralName createGeneralName(String t, String v, int exttype)
throws Exception {
GeneralNameInterface gn;
int p = oneOf(t, "EMAIL", "URI", "DNS", "IP", "OID");
if (p < 0) {
throw new Exception(rb.getString(
"Unrecognized.GeneralName.type.") + t);
}
switch (p) {
case 0: gn = new RFC822Name(v); break;
case 1: gn = new URIName(v); break;
case 2:
if (exttype == 3) {
// Allow wildcard only for SAN extension
gn = new DNSName(v, true);
} else {
gn = new DNSName(v);
}
break;
case 3: gn = new IPAddressName(v); break;
default: gn = new OIDName(v); break; //4
}
return new GeneralName(gn);
}
private static final String[] extSupported = {
"BasicConstraints",
"KeyUsage",
"ExtendedKeyUsage",
"SubjectAlternativeName",
"IssuerAlternativeName",
"SubjectInfoAccess",
"AuthorityInfoAccess",
null,
"CRLDistributionPoints",
};
private ObjectIdentifier findOidForExtName(String type)
throws Exception {
switch (oneOf(type, extSupported)) {
case 0: return PKIXExtensions.BasicConstraints_Id;
case 1: return PKIXExtensions.KeyUsage_Id;
case 2: return PKIXExtensions.ExtendedKeyUsage_Id;
case 3: return PKIXExtensions.SubjectAlternativeName_Id;
case 4: return PKIXExtensions.IssuerAlternativeName_Id;
case 5: return PKIXExtensions.SubjectInfoAccess_Id;
case 6: return PKIXExtensions.AuthInfoAccess_Id;
case 8: return PKIXExtensions.CRLDistributionPoints_Id;
default: return ObjectIdentifier.of(type);
}
}
// Add an extension into a CertificateExtensions, always using OID as key
private static void setExt(CertificateExtensions result, Extension ex) {
result.setExtension(ex.getId(), ex);
}
/**
* Create X509v3 extensions from a string representation. Note that the
* SubjectKeyIdentifierExtension will always be created non-critical besides
* the extension requested in the <code>extstr</code> argument.
*
* @param requestedEx the requested extensions, can be null, used for -gencert
* @param existingEx the original extensions, can be null, used for -selfcert
* @param extstrs -ext values, Read keytool doc
* @param pkey the public key for the certificate
* @param aSubjectKeyId the subject key identifier for the authority (issuer)
* @return the created CertificateExtensions
*/
private CertificateExtensions createV3Extensions(
CertificateExtensions requestedEx,
CertificateExtensions existingEx,
List <String> extstrs,
PublicKey pkey,
KeyIdentifier aSubjectKeyId) throws Exception {
// By design, inside a CertificateExtensions object, all known
// extensions uses name (say, "BasicConstraints") as key and
// a child Extension type (say, "BasicConstraintsExtension")
// as value, unknown extensions uses OID as key and bare
// Extension object as value. This works fine inside JDK.
//
// However, in keytool, there is no way to prevent people
// using OID in -ext, either as a new extension, or in an
// honored value. Thus, here we (ab)use CertificateExtensions
// by always using OID as key and value can be of any type.
if (existingEx != null && requestedEx != null) {
// This should not happen
throw new Exception("One of request and original should be null.");
}
// A new extensions always using OID as key
CertificateExtensions result = new CertificateExtensions();
if (existingEx != null) {
for (Extension ex: existingEx.getAllExtensions()) {
setExt(result, ex);
}
}
try {
// always non-critical
setExt(result, new SubjectKeyIdentifierExtension(
new KeyIdentifier(pkey).getIdentifier()));
if (aSubjectKeyId != null) {
setExt(result, new AuthorityKeyIdentifierExtension(aSubjectKeyId,
null, null));
}
// name{:critical}{=value}
// Honoring requested extensions
if (requestedEx != null) {
// The existing requestedEx might use names as keys,
// translate to all-OID first.
CertificateExtensions request2 = new CertificateExtensions();
for (sun.security.x509.Extension ex: requestedEx.getAllExtensions()) {
request2.setExtension(ex.getId(), ex);
}
for(String extstr: extstrs) {
if (extstr.toLowerCase(Locale.ENGLISH).startsWith("honored=")) {
List<String> list = Arrays.asList(
extstr.toLowerCase(Locale.ENGLISH).substring(8).split(","));
// First check existence of "all"
if (list.contains("all")) {
for (Extension ex: request2.getAllExtensions()) {
setExt(result, ex);
}
}
// one by one for others
for (String item: list) {
if (item.equals("all")) continue;
// add or remove
boolean add;
// -1, unchanged, 0 critical, 1 non-critical
int action = -1;
String type;
if (item.startsWith("-")) {
add = false;
type = item.substring(1);
} else {
add = true;
int colonpos = item.indexOf(':');
if (colonpos >= 0) {
type = item.substring(0, colonpos);
action = oneOf(item.substring(colonpos+1),
"critical", "non-critical");
if (action == -1) {
throw new Exception(rb.getString
("Illegal.value.") + item);
}
} else {
type = item;
}
}
String n = findOidForExtName(type).toString();
if (add) {
Extension e = request2.getExtension(n);
if (!e.isCritical() && action == 0
|| e.isCritical() && action == 1) {
e = Extension.newExtension(
e.getExtensionId(),
!e.isCritical(),
e.getExtensionValue());
}
setExt(result, e);
} else {
result.delete(n);
}
}
break;
}
}
}
for(String extstr: extstrs) {
String name, value;
boolean isCritical = false;
int eqpos = extstr.indexOf('=');
if (eqpos >= 0) {
name = extstr.substring(0, eqpos);
value = extstr.substring(eqpos+1);
} else {
name = extstr;
value = null;
}
int colonpos = name.indexOf(':');
if (colonpos >= 0) {
if (oneOf(name.substring(colonpos+1), "critical") == 0) {
isCritical = true;
}
name = name.substring(0, colonpos);
}
if (name.equalsIgnoreCase("honored")) {
continue;
}
int exttype = oneOf(name, extSupported);
if (exttype != -1 && value != null && value.isEmpty()) {
throw new Exception(rb.getString("Illegal.value.") + extstr);
}
switch (exttype) {
case 0: // BC
int pathLen = -1;
boolean isCA = false;
if (value == null) {
isCA = true;
} else {
try { // the abbr format
pathLen = Integer.parseInt(value);
isCA = true;
} catch (NumberFormatException ufe) {
// ca:true,pathlen:1
for (String part: value.split(",")) {
String[] nv = part.split(":");
if (nv.length != 2) {
throw new Exception(rb.getString
("Illegal.value.") + extstr);
} else {
if (nv[0].equalsIgnoreCase("ca")) {
isCA = Boolean.parseBoolean(nv[1]);
} else if (nv[0].equalsIgnoreCase("pathlen")) {
pathLen = Integer.parseInt(nv[1]);
} else {
throw new Exception(rb.getString
("Illegal.value.") + extstr);
}
}
}
}
}
setExt(result, new BasicConstraintsExtension(isCritical, isCA,
pathLen));
break;
case 1: // KU
if(value != null) {
boolean[] ok = new boolean[9];
for (String s: value.split(",")) {
int p = oneOf(s,
"digitalSignature", // (0),
"nonRepudiation", // (1)
"keyEncipherment", // (2),
"dataEncipherment", // (3),
"keyAgreement", // (4),
"keyCertSign", // (5),
"cRLSign", // (6),
"encipherOnly", // (7),
"decipherOnly", // (8)
"contentCommitment" // also (1)
);
if (p < 0) {
throw new Exception(rb.getString("Unknown.keyUsage.type.") + s);
}
if (p == 9) p = 1;
ok[p] = true;
}
KeyUsageExtension kue = new KeyUsageExtension(ok);
// The above KeyUsageExtension constructor does not
// allow isCritical value, so...
setExt(result, Extension.newExtension(
kue.getExtensionId(),
isCritical,
kue.getExtensionValue()));
} else {
throw new Exception(rb.getString
("Illegal.value.") + extstr);
}
break;
case 2: // EKU
if(value != null) {
Vector<ObjectIdentifier> v = new Vector<>();
KnownOIDs[] choices = {
KnownOIDs.anyExtendedKeyUsage,
KnownOIDs.serverAuth,
KnownOIDs.clientAuth,
KnownOIDs.codeSigning,
KnownOIDs.emailProtection,
KnownOIDs.KP_TimeStamping,
KnownOIDs.OCSPSigning
};
for (String s: value.split(",")) {
int p = oneOf(s, choices);
String o = s;
if (p >= 0) {
o = choices[p].value();
}
try {
v.add(ObjectIdentifier.of(o));
} catch (Exception e) {
throw new Exception(rb.getString(
"Unknown.extendedkeyUsage.type.") + s);
}
}
setExt(result, new ExtendedKeyUsageExtension(isCritical, v));
} else {
throw new Exception(rb.getString
("Illegal.value.") + extstr);
}
break;
case 3: // SAN
case 4: // IAN
if(value != null) {
String[] ps = value.split(",");
GeneralNames gnames = new GeneralNames();
for(String item: ps) {
colonpos = item.indexOf(':');
if (colonpos < 0) {
throw new Exception("Illegal item " + item + " in " + extstr);
}
String t = item.substring(0, colonpos);
String v = item.substring(colonpos+1);
gnames.add(createGeneralName(t, v, exttype));
}
if (exttype == 3) {
setExt(result, new SubjectAlternativeNameExtension(
isCritical, gnames));
} else {
setExt(result, new IssuerAlternativeNameExtension(
isCritical, gnames));
}
} else {
throw new Exception(rb.getString
("Illegal.value.") + extstr);
}
break;
case 5: // SIA, always non-critical
case 6: // AIA, always non-critical
if (isCritical) {
throw new Exception(rb.getString(
"This.extension.cannot.be.marked.as.critical.") + extstr);
}
if(value != null) {
List<AccessDescription> accessDescriptions =
new ArrayList<>();
String[] ps = value.split(",");
for(String item: ps) {
colonpos = item.indexOf(':');
int colonpos2 = item.indexOf(':', colonpos+1);
if (colonpos < 0 || colonpos2 < 0) {
throw new Exception(rb.getString
("Illegal.value.") + extstr);
}
String m = item.substring(0, colonpos);
String t = item.substring(colonpos+1, colonpos2);
String v = item.substring(colonpos2+1);
KnownOIDs[] choices = {
KnownOIDs.OCSP,
KnownOIDs.caIssuers,
KnownOIDs.AD_TimeStamping,
KnownOIDs.caRepository
};
int p = oneOf(m, choices);
ObjectIdentifier oid;
if (p >= 0) {
oid = ObjectIdentifier.of(choices[p]);
} else {
try {
oid = ObjectIdentifier.of(m);
} catch (Exception e) {
throw new Exception(rb.getString(
"Unknown.AccessDescription.type.") + m);
}
}
accessDescriptions.add(new AccessDescription(
oid, createGeneralName(t, v, exttype)));
}
if (exttype == 5) {
setExt(result, new SubjectInfoAccessExtension(accessDescriptions));
} else {
setExt(result, new AuthorityInfoAccessExtension(accessDescriptions));
}
} else {
throw new Exception(rb.getString
("Illegal.value.") + extstr);
}
break;
case 8: // CRL, experimental, only support 1 distributionpoint
if(value != null) {
String[] ps = value.split(",");
GeneralNames gnames = new GeneralNames();
for(String item: ps) {
colonpos = item.indexOf(':');
if (colonpos < 0) {
throw new Exception("Illegal item " + item + " in " + extstr);
}
String t = item.substring(0, colonpos);
String v = item.substring(colonpos+1);
gnames.add(createGeneralName(t, v, exttype));
}
setExt(result, new CRLDistributionPointsExtension(
isCritical, Collections.singletonList(
new DistributionPoint(gnames, null, null))));
} else {
throw new Exception(rb.getString
("Illegal.value.") + extstr);
}
break;
case -1:
ObjectIdentifier oid = ObjectIdentifier.of(name);
byte[] data;
if (value != null) {
data = new byte[value.length() / 2 + 1];
int pos = 0;
for (char c: value.toCharArray()) {
if (!HexFormat.isHexDigit(c)) {
continue;
}
int hex = HexFormat.fromHexDigit(c);
if (pos % 2 == 0) {
data[pos/2] = (byte)(hex << 4);
} else {
data[pos/2] += (byte)hex;
}
pos++;
}
if (pos % 2 != 0) {
throw new Exception(rb.getString(
"Odd.number.of.hex.digits.found.") + extstr);
}
data = Arrays.copyOf(data, pos/2);
} else {
data = new byte[0];
}
setExt(result, new Extension(oid, isCritical,
new DerValue(DerValue.tag_OctetString, data)
.toByteArray()));
break;
default:
throw new Exception(rb.getString(
"Unknown.extension.type.") + extstr);
}
}
} catch(IOException e) {
throw new RuntimeException(e);
}
return result;
}
private Date getLastDate(Date firstDate, long validity)
throws Exception {
Date lastDate = new Date();
lastDate.setTime(firstDate.getTime() + validity*1000L*24L*60L*60L);
Calendar c = new GregorianCalendar(TimeZone.getTimeZone("UTC"));
c.setTime(lastDate);
if (c.get(Calendar.YEAR) > 9999) {
throw new Exception("Validity period ends at calendar year " +
c.get(Calendar.YEAR) + " which is greater than 9999");
}
return lastDate;
}
private boolean isTrustedCert(Certificate cert) throws KeyStoreException {
if (caks != null && caks.getCertificateAlias(cert) != null) {
return true;
} else {
String inKS = keyStore.getCertificateAlias(cert);
return inKS != null && keyStore.isCertificateEntry(inKS);
}
}
private void checkWeakConstraint(String label, String sigAlg, Key key,
CertPathConstraintsParameters cpcp) throws Exception {
if (sigAlg != null) {
try {
DISABLED_CHECK.permits(sigAlg, cpcp, false);
try {
LEGACY_CHECK.permits(sigAlg, cpcp, false);
} catch (CertPathValidatorException e) {
weakWarnings.add(String.format(
rb.getString("whose.sigalg.weak"), label, sigAlg));
}
} catch (CertPathValidatorException e) {
String eMessage = e.getMessage();
if (eMessage.contains("denyAfter constraint check failed") &&
e.getReason() == BasicReason.ALGORITHM_CONSTRAINED) {
String startSeparator = "Constraint date: ";
int startSepPos = eMessage.indexOf(startSeparator);
String endSeparator = "; params date";
int endSepPos = eMessage.indexOf(endSeparator);
String denyAfterDate;
try {
denyAfterDate = eMessage.substring(startSepPos + startSeparator.length(),
endSepPos);
} catch (IndexOutOfBoundsException e1) {
throw new Exception(rb.getString(
"Unable.to.parse.denyAfter.string.in.exception.message"));
}
weakWarnings.add(String.format(
rb.getString("whose.sigalg.usagesignedjar"), label, sigAlg,
denyAfterDate));
} else {
weakWarnings.add(String.format(
rb.getString("whose.sigalg.disabled"), label, sigAlg));
}
if (debug) {
e.printStackTrace();
}
}
}
if (key != null) {
try {
DISABLED_CHECK.permits(key.getAlgorithm(), cpcp, true);
try {
LEGACY_CHECK.permits(key.getAlgorithm(), cpcp, true);
} catch (CertPathValidatorException e) {
weakWarnings.add(String.format(
rb.getString("whose.key.weak"), label,
String.format(rb.getString("key.bit"), fullDisplayKeyName(key))));
}
} catch (CertPathValidatorException e) {
weakWarnings.add(String.format(
rb.getString("whose.key.disabled"), label,
String.format(rb.getString("key.bit"), fullDisplayKeyName(key))));
}
}
}
private void checkWeak(String label, String sigAlg, Key key) {
if (sigAlg != null) {
if (!DISABLED_CHECK.permits(SIG_PRIMITIVE_SET, sigAlg, null)) {
weakWarnings.add(String.format(
rb.getString("whose.sigalg.disabled"), label, sigAlg));
} else if (!LEGACY_CHECK.permits(SIG_PRIMITIVE_SET, sigAlg, null)) {
weakWarnings.add(String.format(
rb.getString("whose.sigalg.weak"), label, sigAlg));
}
}
if (key != null) {
if (!DISABLED_CHECK.permits(SIG_PRIMITIVE_SET, key)) {
weakWarnings.add(String.format(
rb.getString("whose.key.disabled"), label,
String.format(rb.getString("key.bit"), fullDisplayKeyName(key))));
} else if (!LEGACY_CHECK.permits(SIG_PRIMITIVE_SET, key)) {
weakWarnings.add(String.format(
rb.getString("whose.key.weak"), label,
String.format(rb.getString("key.bit"), fullDisplayKeyName(key))));
}
}
}
private void checkWeakConstraint(String label, Certificate[] certs)
throws Exception {
X509Certificate[] xcerts = convertCerts(certs);
List<X509Certificate> chain = Arrays.asList(xcerts);
TrustAnchor anchor = findTrustAnchor(chain);
for (int i = 0; i < certs.length; i++) {
Certificate cert = certs[i];
if (cert instanceof X509Certificate xc) {
String fullLabel = label;
if (certs.length > 1) {
fullLabel = oneInMany(label, i, certs.length);
}
CertPathConstraintsParameters cpcp;
if (i == 0 && xc.getBasicConstraints() == -1) {
// this is an EE
cpcp = buildCertPathConstraint(xc, anchor);
} else {
cpcp = new CertPathConstraintsParameters(
xc, null, anchor, null);
}
checkWeakConstraint(fullLabel, xc, cpcp);
}
}
}
private void checkWeakConstraint(String label, Certificate cert,
CertPathConstraintsParameters cpcp)
throws Exception {
if (cert instanceof X509Certificate xc) {
// No need to check the sigalg of a trust anchor
String sigAlg = isTrustedCert(cert) ? null : xc.getSigAlgName();
checkWeakConstraint(label, sigAlg, xc.getPublicKey(), cpcp);
}
}
private void checkWeakConstraint(String label, SecretKey secKey,
SecretKeyConstraintsParameters skcp) {
// Do not check disabled algorithms for symmetric key based algorithms for now
String secKeyAlg = secKey.getAlgorithm();
/*
* Skipping a secret key entry if its algorithm starts with "PBE".
* This is because keytool can only see it as a PBE key and "PBE" is
* an alias of "PBEwithMD5andDES" inside the SunJCE security provider,
* and its getAlgorithm() always returns "PBEwithMD5andDES". Thus, keytool
* won't be able to determine whether this secret key entry is protected
* by a weak algorithm or not.
*/
if (secKeyAlg.startsWith("PBE"))
return;
try {
LEGACY_CHECK.permits(secKeyAlg, skcp, true);
} catch (CertPathValidatorException e) {
String eMessage = e.getMessage();
if (eMessage.contains("constraints check failed on keysize limits") &&
e.getReason() == BasicReason.ALGORITHM_CONSTRAINED) {
weakWarnings.add(String.format(
rb.getString("key.size.weak"), label,
String.format(rb.getString("key.bit"),
fullDisplayKeyName(secKey))));
} else {
weakWarnings.add(String.format(
rb.getString("key.algorithm.weak"), label, secKeyAlg));
}
}
}
private void checkWeakConstraint(String label, PKCS10 p10,
CertPathConstraintsParameters cpcp) throws Exception {
checkWeakConstraint(label, p10.getSigAlg(),
p10.getSubjectPublicKeyInfo(), cpcp);
}
private void checkWeakConstraint(String label, CRL crl, Key key,
CertPathConstraintsParameters cpcp) throws Exception {
if (crl instanceof X509CRLImpl impl) {
checkWeakConstraint(label, impl.getSigAlgName(), key, cpcp);
}
}
private void checkWeakConstraint(String label, String keyAlg,
SecretKeyConstraintsParameters skcp) {
try {
LEGACY_CHECK.permits(keyAlg, skcp, false);
} catch (CertPathValidatorException e) {
weakWarnings.add(String.format(
rb.getString("key.algorithm.weak"), label, keyAlg));
}
}
private void checkWeak(String label, CRL crl, Key key) {
if (crl instanceof X509CRLImpl impl) {
checkWeak(label, impl.getSigAlgName(), key);
}
}
private KeyStore buildTrustedCerts() {
KeyStore caks = null;
try {
caks = KeyStoreUtil.getCacertsKeyStore();
if (caks != null) {
Enumeration<String> aliases = caks.aliases();
while (aliases.hasMoreElements()) {
String a = aliases.nextElement();
try {
trustedCerts.add((X509Certificate)caks.getCertificate(a));
} catch (Exception e2) {
// ignore, if the keystore has not been loaded/initialized properly
}
}
}
} catch (Exception e) {
// Ignore, if cacerts cannot be loaded
}
return caks;
}
private TrustAnchor findTrustAnchor(List<X509Certificate> chain) {
if (chain.isEmpty()) {
return null;
}
X509Certificate last = chain.get(chain.size() - 1);
Optional<X509Certificate> trusted =
trustedCerts.stream()
.filter(c -> c.getSubjectX500Principal().equals(last.getIssuerX500Principal()))
.findFirst();
return trusted.isPresent() ? new TrustAnchor(trusted.get(), null) : null;
}
private X509Certificate[] convertCerts(Certificate[] certs) {
X509Certificate[] xcerts = new X509Certificate[certs.length];
for (int i = 0; i < certs.length; i++) {
if (certs[i] instanceof X509Certificate) {
xcerts[i] = (X509Certificate) certs[i];
}
}
return xcerts;
}
private CertPathConstraintsParameters buildCertPathConstraint(
X509Certificate xcert, TrustAnchor anchor) throws Exception{
List<String> eku = xcert.getExtendedKeyUsage();
if (eku == null) {
return new CertPathConstraintsParameters(xcert, null,
anchor, null);
}
if (eku.contains(KnownOIDs.codeSigning.value())) {
return new CertPathConstraintsParameters(xcert,
Validator.VAR_CODE_SIGNING, anchor, null);
} else if (eku.contains(KnownOIDs.clientAuth.value())) {
return new CertPathConstraintsParameters(xcert,
Validator.VAR_TLS_CLIENT, anchor, null);
} else if (eku.contains(KnownOIDs.serverAuth.value())) {
return new CertPathConstraintsParameters(xcert,
Validator.VAR_TLS_SERVER, anchor, null);
} else if (eku.contains(KnownOIDs.KP_TimeStamping.value())) {
return new CertPathConstraintsParameters(xcert,
Validator.VAR_TSA_SERVER, anchor, null);
}
return new CertPathConstraintsParameters(xcert, Validator.VAR_GENERIC,
anchor, null);
}
private void printWeakWarnings(boolean newLine) {
if (!weakWarnings.isEmpty() && !nowarn) {
System.err.println("\nWarning:");
for (String warning : weakWarnings) {
System.err.println(warning);
}
if (newLine) {
// When calling before a yes/no prompt, add a new line
System.err.println();
}
}
weakWarnings.clear();
}
/**
* Prints the usage of this tool.
*/
private void usage() {
if (command != null) {
System.err.println("keytool " + command +
rb.getString(".OPTION."));
System.err.println();
System.err.println(rb.getString(command.description));
System.err.println();
System.err.println(rb.getString("Options."));
System.err.println();
// Left and right sides of the options list. Both might
// contain "\n" and span multiple lines
String[] left = new String[command.options.length];
String[] right = new String[command.options.length];
// Length of left side of options list
int lenLeft = 0;
for (int j = 0; j < command.options.length; j++) {
Option opt = command.options[j];
left[j] = opt.toString();
if (opt.arg != null) {
left[j] += " " + opt.arg;
}
String[] lefts = left[j].split("\n");
for (String s : lefts) {
if (s.length() > lenLeft) {
lenLeft = s.length();
}
}
right[j] = rb.getString(opt.description);
}
for (int j = 0; j < left.length; j++) {
String[] lefts = left[j].split("\n");
String[] rights = right[j].split("\n");
for (int i = 0; i < lefts.length && i < rights.length; i++) {
String s1 = lefts[i];
String s2 = rights[i];
if (i == 0) {
System.err.printf(" %-" + lenLeft + "s %s\n", s1, s2);
} else {
System.err.printf(" %-" + lenLeft + "s %s\n", s1, s2);
}
}
}
System.err.println();
System.err.println(rb.getString(
"Use.keytool.help.for.all.available.commands"));
} else {
System.err.println(rb.getString(
"Key.and.Certificate.Management.Tool"));
System.err.println();
System.err.println(rb.getString("Commands."));
System.err.println();
for (Command c: Command.values()) {
if (c == KEYCLONE) break;
System.err.printf(" %-20s%s\n", c, rb.getString(c.description));
}
System.err.println();
System.err.println(rb.getString(
"Use.keytool.help.for.all.available.commands"));
System.err.println(rb.getString(
"Use.keytool.command.name.help.for.usage.of.command.name"));
}
}
private void tinyHelp() {
usage();
if (debug) {
throw new RuntimeException("NO BIG ERROR, SORRY");
} else {
throw new ExitException(1);
}
}
private void errorNeedArgument(String flag) {
Object[] source = {flag};
System.err.println(new MessageFormat(
rb.getString("Command.option.flag.needs.an.argument.")).format(source));
tinyHelp();
}
private char[] getPass(String modifier, String arg) {
char[] output =
KeyStoreUtil.getPassWithModifier(modifier, arg, rb, collator);
if (output != null) return output;
tinyHelp();
return null; // Useless, tinyHelp() already exits.
}
private static class SecretKeyConstraintsParameters implements ConstraintsParameters {
private final Key key;
private SecretKeyConstraintsParameters(Key key) {
this.key = key;
}
@Override
public boolean anchorIsJdkCA() {
return false;
}
@Override
public Set<Key> getKeys() {
return Set.of(key);
}
@Override
public Date getDate() {
return null;
}
@Override
public String getVariant() {
return null;
}
@Override
public String extendedExceptionMsg() {
return null;
}
}
}
// This class is exactly the same as com.sun.tools.javac.util.Pair,
// it's copied here since the original one is not included in JRE.
class Pair<A, B> {
public final A fst;
public final B snd;
public Pair(A fst, B snd) {
this.fst = fst;
this.snd = snd;
}
public String toString() {
return "Pair[" + fst + "," + snd + "]";
}
@Override
public boolean equals(Object obj) {
return
obj instanceof Pair<?, ?> other &&
Objects.equals(fst, other.fst) &&
Objects.equals(snd, other.snd);
}
@Override
public int hashCode() {
if (fst == null) return (snd == null) ? 0 : snd.hashCode() + 1;
else if (snd == null) return fst.hashCode() + 2;
else return fst.hashCode() * 17 + snd.hashCode();
}
public static <A,B> Pair<A,B> of(A a, B b) {
return new Pair<>(a,b);
}
}