Added CLIs to inspect PKCS #12 file.

The pki pkcs12-cert-find and pki pkcs12-key-find commands have
been added to list the certificates and keys in a PKCS #12 file.

https://fedorahosted.org/pki/ticket/1742

8 files changed, 599 insertions, 1 deletions

diff --git a/base/java-tools/bin/pki b/base/java-tools/bin/pki
index 152bf3f62..5e7a7a438 100644
--- a/base/java-tools/bin/pki
+++ b/base/java-tools/bin/pki
@@ -27,10 +27,16 @@ def run_java_cli(args):
 
     # read RESTEasy library path
     value = subprocess.check_output(
-        '. /etc/pki/pki.conf && echo $RESTEASY_LIB',
+        '. /usr/share/pki/etc/pki.conf && . /etc/pki/pki.conf && echo $RESTEASY_LIB',
         shell=True)
     resteasy_lib = str(value).strip()
 
+    # read logging configuration path
+    value = subprocess.check_output(
+        '. /usr/share/pki/etc/pki.conf && . /etc/pki/pki.conf && echo $LOGGING_CONFIG',
+        shell=True)
+    logging_config = value.decode(sys.getfilesystemencoding()).strip()
+
     # construct classpath
     classpath = [
         '/usr/share/java/commons-cli.jar',
@@ -69,6 +75,7 @@ def run_java_cli(args):
         'java',
         '-cp',
         ':'.join(classpath),
+        '-Djava.util.logging.config.file=' + logging_config,
         'com.netscape.cmstools.cli.MainCLI'
     ]
 
diff --git a/base/java-tools/src/com/netscape/cmstools/cli/MainCLI.java b/base/java-tools/src/com/netscape/cmstools/cli/MainCLI.java
index 159e4ac5a..797f3cb03 100644
--- a/base/java-tools/src/com/netscape/cmstools/cli/MainCLI.java
+++ b/base/java-tools/src/com/netscape/cmstools/cli/MainCLI.java
@@ -49,6 +49,7 @@ import com.netscape.cmstools.cert.CertCLI;
 import com.netscape.cmstools.client.ClientCLI;
 import com.netscape.cmstools.group.GroupCLI;
 import com.netscape.cmstools.key.KeyCLI;
+import com.netscape.cmstools.pkcs12.PKCS12CLI;
 import com.netscape.cmstools.system.SecurityDomainCLI;
 import com.netscape.cmstools.user.UserCLI;
 
@@ -85,6 +86,8 @@ public class MainCLI extends CLI {
         addModule(new TKSCLI(this));
         addModule(new TPSCLI(this));
 
+        addModule(new PKCS12CLI(this));
+
         createOptions();
     }
 
diff --git a/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CLI.java b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CLI.java
new file mode 100644
index 000000000..f69fcac53
--- /dev/null
+++ b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CLI.java
@@ -0,0 +1,45 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2016 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+
+package com.netscape.cmstools.pkcs12;
+
+import com.netscape.cmstools.cli.CLI;
+import com.netscape.cmstools.cli.MainCLI;
+
+/**
+ * @author Endi S. Dewata
+ */
+public class PKCS12CLI extends CLI {
+
+    public PKCS12CLI(CLI parent) {
+        super("pkcs12", "PKCS #12 utilities", parent);
+
+        addModule(new PKCS12CertCLI(this));
+        addModule(new PKCS12KeyCLI(this));
+    }
+
+    public String getFullName() {
+        if (parent instanceof MainCLI) {
+            // do not include MainCLI's name
+            return name;
+        } else {
+            return parent.getFullName() + "-" + name;
+        }
+    }
+
+}
diff --git a/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertCLI.java b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertCLI.java
new file mode 100644
index 000000000..2179c186c
--- /dev/null
+++ b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertCLI.java
@@ -0,0 +1,41 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2016 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+
+package com.netscape.cmstools.pkcs12;
+
+import com.netscape.cmstools.cli.CLI;
+
+import netscape.security.pkcs.PKCS12Util.PKCS12CertInfo;
+
+/**
+ * @author Endi S. Dewata
+ */
+public class PKCS12CertCLI extends CLI {
+
+    public PKCS12CertCLI(PKCS12CLI parent) {
+        super("cert", "PKCS #12 certificate management commands", parent);
+
+        addModule(new PKCS12CertFindCLI(this));
+    }
+
+    public static void printCertInfo(PKCS12CertInfo certInfo) throws Exception {
+        System.out.println("  Nickname: " + certInfo.nickname);
+        System.out.println("  Subject: " + certInfo.cert.getSubjectDN());
+        System.out.println("  Issuer: " + certInfo.cert.getIssuerDN());
+    }
+}
diff --git a/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertFindCLI.java b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertFindCLI.java
new file mode 100644
index 000000000..4cbfee518
--- /dev/null
+++ b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertFindCLI.java
@@ -0,0 +1,124 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2016 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+
+package com.netscape.cmstools.pkcs12;
+
+import java.util.List;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+
+import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.Option;
+import org.apache.commons.cli.ParseException;
+
+import com.netscape.cmstools.cli.CLI;
+import com.netscape.cmstools.cli.MainCLI;
+
+import netscape.security.pkcs.PKCS12Util;
+import netscape.security.pkcs.PKCS12Util.PKCS12CertInfo;
+
+/**
+ * @author Endi S. Dewata
+ */
+public class PKCS12CertFindCLI extends CLI {
+
+    public PKCS12CertFindCLI(PKCS12CertCLI certCLI) {
+        super("find", "Find certificates in PKCS #12 file", certCLI);
+
+        createOptions();
+    }
+
+    public void printHelp() {
+        formatter.printHelp(getFullName() + " [OPTIONS...]", options);
+    }
+
+    public void createOptions() {
+        Option option = new Option(null, "pkcs12", true, "PKCS #12 file");
+        option.setArgName("path");
+        options.addOption(option);
+
+        options.addOption("v", "verbose", false, "Run in verbose mode.");
+        options.addOption(null, "debug", false, "Run in debug mode.");
+        options.addOption(null, "help", false, "Show help message.");
+    }
+
+    public void execute(String[] args) throws Exception {
+
+        CommandLine cmd = null;
+
+        try {
+            cmd = parser.parse(options, args);
+        } catch (ParseException e) {
+            System.err.println("Error: " + e.getMessage());
+            printHelp();
+            System.exit(-1);
+        }
+
+        if (cmd.hasOption("help")) {
+            printHelp();
+            System.exit(0);
+        }
+
+        if (cmd.hasOption("verbose")) {
+            Logger.getLogger("org.dogtagpki").setLevel(Level.INFO);
+            Logger.getLogger("com.netscape").setLevel(Level.INFO);
+            Logger.getLogger("netscape").setLevel(Level.INFO);
+
+        } else if (cmd.hasOption("debug")) {
+            Logger.getLogger("org.dogtagpki").setLevel(Level.FINE);
+            Logger.getLogger("com.netscape").setLevel(Level.FINE);
+            Logger.getLogger("netscape").setLevel(Level.FINE);
+        }
+
+        String[] cmdArgs = cmd.getArgs();
+
+        if (cmdArgs.length != 0) {
+            System.err.println("Error: Too many arguments specified.");
+            printHelp();
+            System.exit(-1);
+        }
+
+        String filename = cmd.getOptionValue("pkcs12");
+
+        if (filename == null) {
+            System.err.println("Error: Missing PKCS #12 file.");
+            printHelp();
+            System.exit(-1);
+        }
+
+        PKCS12Util util = new PKCS12Util();
+        util.loadFromPKCS12(filename);
+
+        List<PKCS12CertInfo> certInfos = util.getCertInfos();
+
+        MainCLI.printMessage(certInfos.size() + " entries found");
+        if (certInfos.size() == 0) return;
+
+        boolean first = true;
+
+        for (PKCS12CertInfo certInfo : certInfos) {
+            if (first) {
+                first = false;
+            } else {
+                System.out.println();
+            }
+
+            PKCS12CertCLI.printCertInfo(certInfo);
+        }
+    }
+}
diff --git a/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12KeyCLI.java b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12KeyCLI.java
new file mode 100644
index 000000000..5297a50ad
--- /dev/null
+++ b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12KeyCLI.java
@@ -0,0 +1,43 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2016 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+
+package com.netscape.cmstools.pkcs12;
+
+import com.netscape.cmstools.cli.CLI;
+
+import netscape.security.pkcs.PKCS12Util.PKCS12KeyInfo;
+
+/**
+ * @author Endi S. Dewata
+ */
+public class PKCS12KeyCLI extends CLI {
+
+    public PKCS12KeyCLI(PKCS12CLI parent) {
+        super("key", "PKCS #12 key management commands", parent);
+
+        addModule(new PKCS12KeyFindCLI(this));
+    }
+
+    public static void printKeyInfo(PKCS12KeyInfo keyInfo) throws Exception {
+        System.out.println("  Subject: " + keyInfo.subjectDN);
+
+        if (keyInfo.privateKeyInfo != null) {
+            System.out.println("  Algorithm: " + keyInfo.privateKeyInfo.getAlgorithm());
+        }
+    }
+}
diff --git a/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12KeyFindCLI.java b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12KeyFindCLI.java
new file mode 100644
index 000000000..d8c165cd6
--- /dev/null
+++ b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12KeyFindCLI.java
@@ -0,0 +1,159 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2016 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+
+package com.netscape.cmstools.pkcs12;
+
+import java.io.BufferedReader;
+import java.io.FileReader;
+import java.util.List;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+
+import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.Option;
+import org.apache.commons.cli.ParseException;
+import org.mozilla.jss.util.Password;
+
+import com.netscape.cmstools.cli.CLI;
+import com.netscape.cmstools.cli.MainCLI;
+
+import netscape.security.pkcs.PKCS12Util;
+import netscape.security.pkcs.PKCS12Util.PKCS12KeyInfo;
+
+/**
+ * @author Endi S. Dewata
+ */
+public class PKCS12KeyFindCLI extends CLI {
+
+    public PKCS12KeyFindCLI(PKCS12KeyCLI certCLI) {
+        super("find", "Find keys in PKCS #12 file", certCLI);
+
+        createOptions();
+    }
+
+    public void printHelp() {
+        formatter.printHelp(getFullName() + " [OPTIONS...]", options);
+    }
+
+    public void createOptions() {
+        Option option = new Option(null, "pkcs12", true, "PKCS #12 file");
+        option.setArgName("path");
+        options.addOption(option);
+
+        option = new Option(null, "pkcs12-password", true, "PKCS #12 password");
+        option.setArgName("password");
+        options.addOption(option);
+
+        option = new Option(null, "pkcs12-password-file", true, "PKCS #12 password file");
+        option.setArgName("path");
+        options.addOption(option);
+
+        options.addOption("v", "verbose", false, "Run in verbose mode.");
+        options.addOption(null, "debug", false, "Run in debug mode.");
+        options.addOption(null, "help", false, "Show help message.");
+    }
+
+    public void execute(String[] args) throws Exception {
+
+        CommandLine cmd = null;
+
+        try {
+            cmd = parser.parse(options, args);
+        } catch (ParseException e) {
+            System.err.println("Error: " + e.getMessage());
+            printHelp();
+            System.exit(-1);
+        }
+
+        if (cmd.hasOption("help")) {
+            printHelp();
+            System.exit(0);
+        }
+
+        if (cmd.hasOption("verbose")) {
+            Logger.getLogger("org.dogtagpki").setLevel(Level.INFO);
+            Logger.getLogger("com.netscape").setLevel(Level.INFO);
+            Logger.getLogger("netscape").setLevel(Level.INFO);
+
+        } else if (cmd.hasOption("debug")) {
+            Logger.getLogger("org.dogtagpki").setLevel(Level.FINE);
+            Logger.getLogger("com.netscape").setLevel(Level.FINE);
+            Logger.getLogger("netscape").setLevel(Level.FINE);
+        }
+
+        String[] cmdArgs = cmd.getArgs();
+
+        if (cmdArgs.length != 0) {
+            System.err.println("Error: Too many arguments specified.");
+            printHelp();
+            System.exit(-1);
+        }
+
+        String filename = cmd.getOptionValue("pkcs12");
+
+        if (filename == null) {
+            System.err.println("Error: Missing PKCS #12 file.");
+            printHelp();
+            System.exit(-1);
+        }
+
+        String passwordString = cmd.getOptionValue("pkcs12-password");
+
+        if (passwordString == null) {
+
+            String passwordFile = cmd.getOptionValue("pkcs12-password-file");
+            if (passwordFile != null) {
+                try (BufferedReader in = new BufferedReader(new FileReader(passwordFile))) {
+                    passwordString = in.readLine();
+                }
+            }
+        }
+
+        Password password = null;
+        if (passwordString != null) {
+            password = new Password(passwordString.toCharArray());
+        }
+
+        List<PKCS12KeyInfo> keyInfos;
+
+        try {
+            PKCS12Util util = new PKCS12Util();
+            util.loadFromPKCS12(filename);
+
+            keyInfos = util.getKeyInfos(password);
+
+        } finally {
+            if (password != null) password.clear();
+        }
+
+        MainCLI.printMessage(keyInfos.size() + " entries found");
+        if (keyInfos.size() == 0) return;
+
+        boolean first = true;
+
+        for (PKCS12KeyInfo keyInfo : keyInfos) {
+            if (first) {
+                first = false;
+            } else {
+                System.out.println();
+            }
+
+            PKCS12KeyCLI.printKeyInfo(keyInfo);
+        }
+    }
+}
diff --git a/base/util/src/netscape/security/pkcs/PKCS12Util.java b/base/util/src/netscape/security/pkcs/PKCS12Util.java
index 63051858e..9d66ac6fb 100644
--- a/base/util/src/netscape/security/pkcs/PKCS12Util.java
+++ b/base/util/src/netscape/security/pkcs/PKCS12Util.java
@@ -17,15 +17,23 @@
 // --- END COPYRIGHT BLOCK ---
 package netscape.security.pkcs;
 
+import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.FileOutputStream;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
 import java.security.MessageDigest;
+import java.util.ArrayList;
+import java.util.List;
 import java.util.logging.Logger;
 
 import org.mozilla.jss.CryptoManager;
+import org.mozilla.jss.asn1.ANY;
 import org.mozilla.jss.asn1.ASN1Util;
 import org.mozilla.jss.asn1.ASN1Value;
 import org.mozilla.jss.asn1.BMPString;
+import org.mozilla.jss.asn1.OBJECT_IDENTIFIER;
 import org.mozilla.jss.asn1.OCTET_STRING;
 import org.mozilla.jss.asn1.SEQUENCE;
 import org.mozilla.jss.asn1.SET;
@@ -48,16 +56,30 @@ import org.mozilla.jss.pkcs12.CertBag;
 import org.mozilla.jss.pkcs12.PFX;
 import org.mozilla.jss.pkcs12.PasswordConverter;
 import org.mozilla.jss.pkcs12.SafeBag;
+import org.mozilla.jss.pkix.primitive.Attribute;
 import org.mozilla.jss.pkix.primitive.EncryptedPrivateKeyInfo;
 import org.mozilla.jss.pkix.primitive.PrivateKeyInfo;
 import org.mozilla.jss.util.Password;
 
+import netscape.security.x509.X509CertImpl;
+
 public class PKCS12Util {
 
     private static Logger logger = Logger.getLogger(PKCS12Util.class.getName());
 
     PFX pfx;
 
+    public static class PKCS12KeyInfo {
+        public EncryptedPrivateKeyInfo encPrivateKeyInfo;
+        public PrivateKeyInfo privateKeyInfo;
+        public String subjectDN;
+    }
+
+    public static class PKCS12CertInfo {
+        public X509CertImpl cert;
+        public String nickname;
+    }
+
     byte[] getEncodedKey(PrivateKey privateKey) throws Exception {
 
         CryptoManager cm = CryptoManager.getInstance();
@@ -211,4 +233,158 @@ public class PKCS12Util {
         loadFromNSS(password);
         storeIntoPKCS12(filename, password);
     }
+
+    public PKCS12KeyInfo getKeyInfo(SafeBag bag, Password password) throws Exception {
+
+        // get private key info
+        EncryptedPrivateKeyInfo encPrivateKeyInfo = (EncryptedPrivateKeyInfo) bag.getInterpretedBagContent();
+
+        PrivateKeyInfo privateKeyInfo = null;
+        if (password != null) {
+            privateKeyInfo = encPrivateKeyInfo.decrypt(password, new PasswordConverter());
+        }
+
+        // find private key's subject DN
+        SET bagAttrs = bag.getBagAttributes();
+        String subjectDN = null;
+
+        for (int i = 0; i < bagAttrs.size(); i++) {
+
+            Attribute attr = (Attribute) bagAttrs.elementAt(i);
+            OBJECT_IDENTIFIER oid = attr.getType();
+
+            if (!oid.equals(SafeBag.FRIENDLY_NAME)) continue;
+
+            SET values = attr.getValues();
+            ANY value = (ANY) values.elementAt(0);
+
+            ByteArrayInputStream bbis = new ByteArrayInputStream(value.getEncoded());
+            BMPString sss = (BMPString) new BMPString.Template().decode(bbis);
+            subjectDN = sss.toString();
+
+            break;
+        }
+
+        logger.fine("Found private key " + subjectDN);
+
+        PKCS12KeyInfo keyInfo = new PKCS12KeyInfo();
+        keyInfo.encPrivateKeyInfo = encPrivateKeyInfo;
+        keyInfo.privateKeyInfo = privateKeyInfo;
+        keyInfo.subjectDN = subjectDN;
+
+        return keyInfo;
+    }
+
+    public PKCS12KeyInfo getKeyInfo(SafeBag bag) throws Exception {
+        return getKeyInfo(bag, null);
+    }
+
+    public PKCS12CertInfo getCertInfo(SafeBag bag) throws Exception {
+
+        CertBag certBag = (CertBag) bag.getInterpretedBagContent();
+
+        OCTET_STRING str = (OCTET_STRING) certBag.getInterpretedCert();
+        byte[] x509cert = str.toByteArray();
+
+        // find cert's nickname
+        SET bagAttrs = bag.getBagAttributes();
+        String nickname = null;
+
+        if (bagAttrs != null) {
+
+            for (int k = 0; k < bagAttrs.size(); k++) {
+
+                Attribute attr = (Attribute) bagAttrs.elementAt(k);
+                OBJECT_IDENTIFIER oid = attr.getType();
+
+                if (!oid.equals(SafeBag.FRIENDLY_NAME)) continue;
+                SET values = attr.getValues();
+                ANY value = (ANY) values.elementAt(0);
+
+                ByteArrayInputStream bbis = new ByteArrayInputStream(value.getEncoded());
+                BMPString sss = (BMPString) (new BMPString.Template()).decode(bbis);
+                nickname = sss.toString();
+
+                break;
+            }
+        }
+
+        X509CertImpl certImpl = new X509CertImpl(x509cert);
+
+        logger.fine("Found certificate " + certImpl.getSubjectDN() + (nickname == null ? "" : " (" + nickname + ")"));
+
+        PKCS12CertInfo certInfo = new PKCS12CertInfo();
+        certInfo.cert = certImpl;
+        certInfo.nickname = nickname;
+
+        return certInfo;
+    }
+
+    public List<PKCS12KeyInfo> getKeyInfos(Password password) throws Exception {
+
+        logger.fine("Getting private keys");
+
+        List<PKCS12KeyInfo> keyInfos = new ArrayList<PKCS12KeyInfo>();
+        AuthenticatedSafes safes = pfx.getAuthSafes();
+
+        for (int i = 0; i < safes.getSize(); i++) {
+
+            SEQUENCE contents = safes.getSafeContentsAt(null, i);
+
+            for (int j = 0; j < contents.size(); j++) {
+
+                SafeBag bag = (SafeBag) contents.elementAt(j);
+                OBJECT_IDENTIFIER oid = bag.getBagType();
+
+                if (!oid.equals(SafeBag.PKCS8_SHROUDED_KEY_BAG)) continue;
+
+                PKCS12KeyInfo keyInfo = getKeyInfo(bag, password);
+                keyInfos.add(keyInfo);
+            }
+        }
+
+        return keyInfos;
+    }
+
+    public List<PKCS12KeyInfo> getKeyInfos() throws Exception {
+        return getKeyInfos(null);
+    }
+
+    public List<PKCS12CertInfo> getCertInfos() throws Exception {
+
+        logger.fine("Getting certificates");
+
+        List<PKCS12CertInfo> certInfos = new ArrayList<PKCS12CertInfo>();
+        AuthenticatedSafes safes = pfx.getAuthSafes();
+
+        for (int i = 0; i < safes.getSize(); i++) {
+
+            SEQUENCE contents = safes.getSafeContentsAt(null, i);
+
+            for (int j = 0; j < contents.size(); j++) {
+
+                SafeBag bag = (SafeBag) contents.elementAt(j);
+                OBJECT_IDENTIFIER oid = bag.getBagType();
+
+                if (!oid.equals(SafeBag.CERT_BAG)) continue;
+
+                PKCS12CertInfo certInfo = getCertInfo(bag);
+                certInfos.add(certInfo);
+            }
+        }
+
+        return certInfos;
+    }
+
+    public void loadFromPKCS12(String filename) throws Exception {
+
+        logger.info("Loading PKCS #12 file");
+
+        Path path = Paths.get(filename);
+        byte[] b = Files.readAllBytes(path);
+
+        ByteArrayInputStream bis = new ByteArrayInputStream(b);
+
+        pfx = (PFX) (new PFX.Template()).decode(bis);
+    }
 }