Added TPS certificate resource.

New TPS services and clients have been added for TPS certificates. The
certificate database is currently implemented as in-memory database with
some sample data. Later it will be converted into LDAP database.

Ticket #652

14 files changed, 1174 insertions, 0 deletions

diff --git a/base/common/src/com/netscape/certsrv/tps/TPSClient.java b/base/common/src/com/netscape/certsrv/tps/TPSClient.java
index 0726eb192..65a1997ba 100644
--- a/base/common/src/com/netscape/certsrv/tps/TPSClient.java
+++ b/base/common/src/com/netscape/certsrv/tps/TPSClient.java
@@ -24,6 +24,7 @@ import com.netscape.certsrv.client.SubsystemClient;
 import com.netscape.certsrv.group.GroupClient;
 import com.netscape.certsrv.logging.ActivityClient;
 import com.netscape.certsrv.token.TokenClient;
+import com.netscape.certsrv.tps.cert.TPSCertClient;
 import com.netscape.certsrv.user.UserClient;
 
 /**
@@ -40,6 +41,7 @@ public class TPSClient extends SubsystemClient {
         addClient(new ActivityClient(client, name));
         addClient(new GroupClient(client, name));
         addClient(new TokenClient(client, name));
+        addClient(new TPSCertClient(client, name));
         addClient(new UserClient(client, name));
     }
 }
diff --git a/base/common/src/com/netscape/certsrv/tps/cert/TPSCertClient.java b/base/common/src/com/netscape/certsrv/tps/cert/TPSCertClient.java
new file mode 100644
index 000000000..003ec7b9b
--- /dev/null
+++ b/base/common/src/com/netscape/certsrv/tps/cert/TPSCertClient.java
@@ -0,0 +1,52 @@
+//--- BEGIN COPYRIGHT BLOCK ---
+//This program is free software; you can redistribute it and/or modify
+//it under the terms of the GNU General Public License as published by
+//the Free Software Foundation; version 2 of the License.
+//
+//This program is distributed in the hope that it will be useful,
+//but WITHOUT ANY WARRANTY; without even the implied warranty of
+//MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//GNU General Public License for more details.
+//
+//You should have received a copy of the GNU General Public License along
+//with this program; if not, write to the Free Software Foundation, Inc.,
+//51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+//(C) 2013 Red Hat, Inc.
+//All rights reserved.
+//--- END COPYRIGHT BLOCK ---
+package com.netscape.certsrv.tps.cert;
+
+import java.net.URISyntaxException;
+
+import com.netscape.certsrv.client.Client;
+import com.netscape.certsrv.client.PKIClient;
+
+/**
+ * @author Endi S. Dewata
+ */
+public class TPSCertClient extends Client {
+
+    public TPSCertResource resource;
+
+    public TPSCertClient(PKIClient client) throws URISyntaxException {
+        this(client, client.getSubsystem());
+    }
+
+    public TPSCertClient(PKIClient client, String subsystem) throws URISyntaxException {
+        super(client, subsystem, "cert");
+        init();
+    }
+
+    public void init() throws URISyntaxException {
+        resource = createProxy(TPSCertResource.class);
+    }
+
+    public TPSCertCollection findCerts(Integer start, Integer size) {
+        return resource.findCerts(start, size);
+    }
+
+    public TPSCertData getCert(String tokenID) {
+        return resource.getCert(tokenID);
+    }
+}
diff --git a/base/common/src/com/netscape/certsrv/tps/cert/TPSCertCollection.java b/base/common/src/com/netscape/certsrv/tps/cert/TPSCertCollection.java
new file mode 100644
index 000000000..0f927fce5
--- /dev/null
+++ b/base/common/src/com/netscape/certsrv/tps/cert/TPSCertCollection.java
@@ -0,0 +1,38 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2013 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+
+package com.netscape.certsrv.tps.cert;
+
+import java.util.Collection;
+
+import javax.xml.bind.annotation.XmlElementRef;
+import javax.xml.bind.annotation.XmlRootElement;
+
+import com.netscape.certsrv.base.DataCollection;
+
+/**
+ * @author Endi S. Dewata
+ */
+@XmlRootElement(name="Activities")
+public class TPSCertCollection extends DataCollection<TPSCertData> {
+
+    @XmlElementRef
+    public Collection<TPSCertData> getEntries() {
+        return super.getEntries();
+    }
+}
diff --git a/base/common/src/com/netscape/certsrv/tps/cert/TPSCertData.java b/base/common/src/com/netscape/certsrv/tps/cert/TPSCertData.java
new file mode 100644
index 000000000..7cefc791d
--- /dev/null
+++ b/base/common/src/com/netscape/certsrv/tps/cert/TPSCertData.java
@@ -0,0 +1,272 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2013 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+
+package com.netscape.certsrv.tps.cert;
+
+import java.io.StringReader;
+import java.io.StringWriter;
+import java.util.Date;
+
+import javax.xml.bind.JAXBContext;
+import javax.xml.bind.Marshaller;
+import javax.xml.bind.Unmarshaller;
+import javax.xml.bind.annotation.XmlAttribute;
+import javax.xml.bind.annotation.XmlElement;
+import javax.xml.bind.annotation.XmlRootElement;
+
+import org.jboss.resteasy.plugins.providers.atom.Link;
+
+/**
+ * @author Endi S. Dewata
+ */
+@XmlRootElement(name="Certificate")
+public class TPSCertData {
+
+    public static Marshaller marshaller;
+    public static Unmarshaller unmarshaller;
+
+    static {
+        try {
+            marshaller = JAXBContext.newInstance(TPSCertData.class).createMarshaller();
+            marshaller.setProperty(Marshaller.JAXB_FORMATTED_OUTPUT, true);
+            unmarshaller = JAXBContext.newInstance(TPSCertData.class).createUnmarshaller();
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    String id;
+    String serialNumber;
+    String subject;
+    String tokenID;
+    String keyType;
+    String status;
+    String userID;
+    Date createTime;
+    Date modifyTime;
+
+    Link link;
+
+    @XmlAttribute(name="id")
+    public String getID() {
+        return id;
+    }
+
+    public void setID(String id) {
+        this.id = id;
+    }
+
+    @XmlElement(name="SerialNumber")
+    public String getSerialNumber() {
+        return serialNumber;
+    }
+
+    public void setSerialNumber(String serialNumber) {
+        this.serialNumber = serialNumber;
+    }
+
+    @XmlElement(name="Subject")
+    public String getSubject() {
+        return subject;
+    }
+
+    public void setSubject(String subject) {
+        this.subject = subject;
+    }
+
+    @XmlElement(name="TokenID")
+    public String getTokenID() {
+        return tokenID;
+    }
+
+    public void setTokenID(String tokenID) {
+        this.tokenID = tokenID;
+    }
+
+    @XmlElement(name="KeyType")
+    public String getKeyType() {
+        return keyType;
+    }
+
+    public void setKeyType(String keyType) {
+        this.keyType = keyType;
+    }
+
+    @XmlElement(name="Status")
+    public String getStatus() {
+        return status;
+    }
+
+    public void setStatus(String status) {
+        this.status = status;
+    }
+
+    @XmlElement(name="UserID")
+    public String getUserID() {
+        return userID;
+    }
+
+    public void setUserID(String userID) {
+        this.userID = userID;
+    }
+
+    @XmlElement(name="CreateTime")
+    public Date getCreateTime() {
+        return createTime;
+    }
+
+    public void setCreateTime(Date createTime) {
+        this.createTime = createTime;
+    }
+
+    @XmlElement(name="ModifyTime")
+    public Date getModifyTime() {
+        return modifyTime;
+    }
+
+    public void setModifyTime(Date modifyTime) {
+        this.modifyTime = modifyTime;
+    }
+
+    @XmlElement(name="Link")
+    public Link getLink() {
+        return link;
+    }
+
+    public void setLink(Link link) {
+        this.link = link;
+    }
+
+    @Override
+    public int hashCode() {
+        final int prime = 31;
+        int result = 1;
+        result = prime * result + ((createTime == null) ? 0 : createTime.hashCode());
+        result = prime * result + ((id == null) ? 0 : id.hashCode());
+        result = prime * result + ((keyType == null) ? 0 : keyType.hashCode());
+        result = prime * result + ((link == null) ? 0 : link.hashCode());
+        result = prime * result + ((modifyTime == null) ? 0 : modifyTime.hashCode());
+        result = prime * result + ((serialNumber == null) ? 0 : serialNumber.hashCode());
+        result = prime * result + ((status == null) ? 0 : status.hashCode());
+        result = prime * result + ((subject == null) ? 0 : subject.hashCode());
+        result = prime * result + ((tokenID == null) ? 0 : tokenID.hashCode());
+        result = prime * result + ((userID == null) ? 0 : userID.hashCode());
+        return result;
+    }
+
+    @Override
+    public boolean equals(Object obj) {
+        if (this == obj)
+            return true;
+        if (obj == null)
+            return false;
+        if (getClass() != obj.getClass())
+            return false;
+        TPSCertData other = (TPSCertData) obj;
+        if (createTime == null) {
+            if (other.createTime != null)
+                return false;
+        } else if (!createTime.equals(other.createTime))
+            return false;
+        if (id == null) {
+            if (other.id != null)
+                return false;
+        } else if (!id.equals(other.id))
+            return false;
+        if (keyType == null) {
+            if (other.keyType != null)
+                return false;
+        } else if (!keyType.equals(other.keyType))
+            return false;
+        if (link == null) {
+            if (other.link != null)
+                return false;
+        } else if (!link.equals(other.link))
+            return false;
+        if (modifyTime == null) {
+            if (other.modifyTime != null)
+                return false;
+        } else if (!modifyTime.equals(other.modifyTime))
+            return false;
+        if (serialNumber == null) {
+            if (other.serialNumber != null)
+                return false;
+        } else if (!serialNumber.equals(other.serialNumber))
+            return false;
+        if (status == null) {
+            if (other.status != null)
+                return false;
+        } else if (!status.equals(other.status))
+            return false;
+        if (subject == null) {
+            if (other.subject != null)
+                return false;
+        } else if (!subject.equals(other.subject))
+            return false;
+        if (tokenID == null) {
+            if (other.tokenID != null)
+                return false;
+        } else if (!tokenID.equals(other.tokenID))
+            return false;
+        if (userID == null) {
+            if (other.userID != null)
+                return false;
+        } else if (!userID.equals(other.userID))
+            return false;
+        return true;
+    }
+
+    public String toString() {
+        try {
+            StringWriter sw = new StringWriter();
+            marshaller.marshal(this, sw);
+            return sw.toString();
+
+        } catch (Exception e) {
+            return super.toString();
+        }
+    }
+
+    public static TPSCertData valueOf(String string) throws Exception {
+        try {
+            return (TPSCertData)unmarshaller.unmarshal(new StringReader(string));
+        } catch (Exception e) {
+            return null;
+        }
+    }
+
+    public static void main(String args[]) throws Exception {
+
+        TPSCertData before = new TPSCertData();
+        before.setID("cert1");
+        before.setSerialNumber("16");
+        before.setSubject("cn=someone");
+        before.setTokenID("TOKEN1234");
+        before.setKeyType("something");
+        before.setStatus("active");
+        before.setUserID("user1");
+        before.setCreateTime(new Date());
+        before.setModifyTime(new Date());
+
+        String string = before.toString();
+        System.out.println(string);
+
+        TPSCertData after = TPSCertData.valueOf(string);
+        System.out.println(before.equals(after));
+    }
+}
diff --git a/base/common/src/com/netscape/certsrv/tps/cert/TPSCertResource.java b/base/common/src/com/netscape/certsrv/tps/cert/TPSCertResource.java
new file mode 100644
index 000000000..d56cd4669
--- /dev/null
+++ b/base/common/src/com/netscape/certsrv/tps/cert/TPSCertResource.java
@@ -0,0 +1,44 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2013 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+package com.netscape.certsrv.tps.cert;
+
+import javax.ws.rs.GET;
+import javax.ws.rs.Path;
+import javax.ws.rs.PathParam;
+import javax.ws.rs.Produces;
+import javax.ws.rs.QueryParam;
+import javax.ws.rs.core.MediaType;
+
+
+/**
+ * @author Endi S. Dewata
+ */
+@Path("certs")
+public interface TPSCertResource {
+
+    @GET
+    @Produces({ MediaType.APPLICATION_XML, MediaType.APPLICATION_JSON })
+    public TPSCertCollection findCerts(
+            @QueryParam("start") Integer start,
+            @QueryParam("size") Integer size);
+
+    @GET
+    @Path("{certID}")
+    @Produces({ MediaType.APPLICATION_XML, MediaType.APPLICATION_JSON })
+    public TPSCertData getCert(@PathParam("certID") String certID);
+}
diff --git a/base/java-tools/src/com/netscape/cmstools/cli/TPSCLI.java b/base/java-tools/src/com/netscape/cmstools/cli/TPSCLI.java
index 00f0131cb..8f740662c 100644
--- a/base/java-tools/src/com/netscape/cmstools/cli/TPSCLI.java
+++ b/base/java-tools/src/com/netscape/cmstools/cli/TPSCLI.java
@@ -23,6 +23,7 @@ import com.netscape.certsrv.tps.TPSClient;
 import com.netscape.cmstools.group.GroupCLI;
 import com.netscape.cmstools.logging.ActivityCLI;
 import com.netscape.cmstools.token.TokenCLI;
+import com.netscape.cmstools.tps.cert.TPSCertCLI;
 import com.netscape.cmstools.user.UserCLI;
 
 /**
@@ -38,6 +39,7 @@ public class TPSCLI extends SubsystemCLI {
         addModule(new ActivityCLI(this));
         addModule(new GroupCLI(this));
         addModule(new TokenCLI(this));
+        addModule(new TPSCertCLI(this));
         addModule(new UserCLI(this));
     }
 
diff --git a/base/java-tools/src/com/netscape/cmstools/tps/cert/TPSCertCLI.java b/base/java-tools/src/com/netscape/cmstools/tps/cert/TPSCertCLI.java
new file mode 100644
index 000000000..4bb44368d
--- /dev/null
+++ b/base/java-tools/src/com/netscape/cmstools/tps/cert/TPSCertCLI.java
@@ -0,0 +1,88 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2013 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+
+package com.netscape.cmstools.tps.cert;
+
+import java.util.Arrays;
+
+import org.jboss.resteasy.plugins.providers.atom.Link;
+
+import com.netscape.certsrv.tps.cert.TPSCertClient;
+import com.netscape.certsrv.tps.cert.TPSCertData;
+import com.netscape.cmstools.cli.CLI;
+
+/**
+ * @author Endi S. Dewata
+ */
+public class TPSCertCLI extends CLI {
+
+    public TPSCertClient certClient;
+
+    public TPSCertCLI(CLI parent) {
+        super("cert", "Certificate management commands", parent);
+
+        addModule(new TPSCertFindCLI(this));
+        addModule(new TPSCertShowCLI(this));
+    }
+
+    public void execute(String[] args) throws Exception {
+
+        client = parent.getClient();
+        certClient = (TPSCertClient)parent.getClient("cert");
+
+        if (args.length == 0) {
+            printHelp();
+            System.exit(1);
+        }
+
+        String command = args[0];
+        String[] commandArgs = Arrays.copyOfRange(args, 1, args.length);
+
+        if (command == null) {
+            printHelp();
+            System.exit(1);
+        }
+
+        CLI module = getModule(command);
+        if (module != null) {
+            module.execute(commandArgs);
+
+        } else {
+            System.err.println("Error: Invalid command \"" + command + "\"");
+            printHelp();
+            System.exit(1);
+        }
+    }
+
+    public static void printCert(TPSCertData cert) {
+        System.out.println("  Cert ID: " + cert.getID());
+        if (cert.getSerialNumber() != null) System.out.println("  Serial Number: " + cert.getSerialNumber());
+        if (cert.getSubject() != null) System.out.println("  Subject: " + cert.getSubject());
+        if (cert.getTokenID() != null) System.out.println("  Token ID: " + cert.getTokenID());
+        if (cert.getKeyType() != null) System.out.println("  Key Type: " + cert.getKeyType());
+        if (cert.getStatus() != null) System.out.println("  Status: " + cert.getStatus());
+        if (cert.getUserID() != null) System.out.println("  User ID: " + cert.getUserID());
+        if (cert.getCreateTime() != null) System.out.println("  Create Time: " + cert.getCreateTime());
+        if (cert.getModifyTime() != null) System.out.println("  Modify Time: " + cert.getModifyTime());
+
+        Link link = cert.getLink();
+        if (verbose && link != null) {
+            System.out.println("  Link: " + link.getHref());
+        }
+    }
+}
diff --git a/base/java-tools/src/com/netscape/cmstools/tps/cert/TPSCertFindCLI.java b/base/java-tools/src/com/netscape/cmstools/tps/cert/TPSCertFindCLI.java
new file mode 100644
index 000000000..4d0827cb3
--- /dev/null
+++ b/base/java-tools/src/com/netscape/cmstools/tps/cert/TPSCertFindCLI.java
@@ -0,0 +1,94 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2013 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+
+package com.netscape.cmstools.tps.cert;
+
+import java.util.Collection;
+
+import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.Option;
+
+import com.netscape.certsrv.tps.cert.TPSCertCollection;
+import com.netscape.certsrv.tps.cert.TPSCertData;
+import com.netscape.cmstools.cli.CLI;
+import com.netscape.cmstools.cli.MainCLI;
+
+/**
+ * @author Endi S. Dewata
+ */
+public class TPSCertFindCLI extends CLI {
+
+    public TPSCertCLI certCLI;
+
+    public TPSCertFindCLI(TPSCertCLI certCLI) {
+        super("find", "Find certificates", certCLI);
+        this.certCLI = certCLI;
+    }
+
+    public void printHelp() {
+        formatter.printHelp(getFullName() + " [OPTIONS...]", options);
+    }
+
+    public void execute(String[] args) throws Exception {
+
+        Option option = new Option(null, "start", true, "Page start");
+        option.setArgName("start");
+        options.addOption(option);
+
+        option = new Option(null, "size", true, "Page size");
+        option.setArgName("size");
+        options.addOption(option);
+
+        CommandLine cmd = null;
+
+        try {
+            cmd = parser.parse(options, args);
+
+        } catch (Exception e) {
+            System.err.println("Error: " + e.getMessage());
+            printHelp();
+            System.exit(1);
+        }
+
+        String s = cmd.getOptionValue("start");
+        Integer start = s == null ? null : Integer.valueOf(s);
+
+        s = cmd.getOptionValue("size");
+        Integer size = s == null ? null : Integer.valueOf(s);
+
+        TPSCertCollection result = certCLI.certClient.findCerts(start, size);
+        Collection<TPSCertData> certs = result.getEntries();
+
+        MainCLI.printMessage(certs.size() + " certificate(s) matched");
+
+        boolean first = true;
+
+        for (TPSCertData certData : certs) {
+
+            if (first) {
+                first = false;
+            } else {
+                System.out.println();
+            }
+
+            TPSCertCLI.printCert(certData);
+        }
+
+        MainCLI.printMessage("Number of entries returned " + certs.size());
+    }
+}
diff --git a/base/java-tools/src/com/netscape/cmstools/tps/cert/TPSCertShowCLI.java b/base/java-tools/src/com/netscape/cmstools/tps/cert/TPSCertShowCLI.java
new file mode 100644
index 000000000..b20e9a6cc
--- /dev/null
+++ b/base/java-tools/src/com/netscape/cmstools/tps/cert/TPSCertShowCLI.java
@@ -0,0 +1,56 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2013 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+
+package com.netscape.cmstools.tps.cert;
+
+import com.netscape.certsrv.tps.cert.TPSCertData;
+import com.netscape.cmstools.cli.CLI;
+import com.netscape.cmstools.cli.MainCLI;
+
+/**
+ * @author Endi S. Dewata
+ */
+public class TPSCertShowCLI extends CLI {
+
+    public TPSCertCLI certCLI;
+
+    public TPSCertShowCLI(TPSCertCLI certCLI) {
+        super("show", "Show certificate", certCLI);
+        this.certCLI = certCLI;
+    }
+
+    public void printHelp() {
+        formatter.printHelp(getFullName() + " <Certificate ID>", options);
+    }
+
+    public void execute(String[] args) throws Exception {
+
+        if (args.length != 1) {
+            printHelp();
+            System.exit(1);
+        }
+
+        String certID = args[0];
+
+        TPSCertData certData = certCLI.certClient.getCert(certID);
+
+        MainCLI.printMessage("Certificate \"" + certID + "\"");
+
+        TPSCertCLI.printCert(certData);
+    }
+}
diff --git a/base/tps-tomcat/src/org/dogtagpki/tps/cert/TPSCertDatabase.java b/base/tps-tomcat/src/org/dogtagpki/tps/cert/TPSCertDatabase.java
new file mode 100644
index 000000000..a575eb7cf
--- /dev/null
+++ b/base/tps-tomcat/src/org/dogtagpki/tps/cert/TPSCertDatabase.java
@@ -0,0 +1,76 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2013 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+
+package org.dogtagpki.tps.cert;
+
+import java.util.Date;
+
+import com.netscape.cmscore.dbs.Database;
+
+/**
+ * This class implements in-memory activity database. In the future this
+ * will be replaced with LDAP database.
+ *
+ * @author Endi S. Dewata
+ */
+public class TPSCertDatabase extends Database<TPSCertRecord> {
+
+    public TPSCertDatabase() {
+        super("Certificate");
+
+        // add sample records
+        try {
+            TPSCertRecord record1 = new TPSCertRecord();
+            record1.setID("cert1");
+            record1.setSerialNumber("16");
+            record1.setSubject("cn=someone");
+            record1.setTokenID("TOKEN0001");
+            record1.setKeyType("something");
+            record1.setStatus("active");
+            record1.setUserID("user1");
+            record1.setCreateTime(new Date());
+            record1.setModifyTime(new Date());
+            addRecord(record1);
+
+            TPSCertRecord record2 = new TPSCertRecord();
+            record2.setID("cert2");
+            record2.setSerialNumber("17");
+            record2.setSubject("cn=someone");
+            record2.setTokenID("TOKEN0002");
+            record2.setKeyType("something");
+            record2.setStatus("revoked");
+            record2.setUserID("user2");
+            record2.setCreateTime(new Date());
+            record2.setModifyTime(new Date());
+            addRecord(record2);
+
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    public void addRecord(TPSCertRecord certRecord) throws Exception {
+        certRecord.setCreateTime(new Date());
+
+        addRecord(certRecord.getID(), certRecord);
+    }
+
+    public void updateRecord(TPSCertRecord certRecord) throws Exception {
+        updateRecord(certRecord.getID(), certRecord);
+    }
+}
diff --git a/base/tps-tomcat/src/org/dogtagpki/tps/cert/TPSCertRecord.java b/base/tps-tomcat/src/org/dogtagpki/tps/cert/TPSCertRecord.java
new file mode 100644
index 000000000..c9303294f
--- /dev/null
+++ b/base/tps-tomcat/src/org/dogtagpki/tps/cert/TPSCertRecord.java
@@ -0,0 +1,288 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2013 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+
+package org.dogtagpki.tps.cert;
+
+import java.util.Date;
+
+/**
+ * @author Endi S. Dewata
+ */
+public class TPSCertRecord {
+
+    String id;
+    String serialNumber;
+    String subject;
+    String tokenID;
+    String keyType;
+    String status;
+    String userID;
+    String certificate;
+    String issuedBy;
+    String origin;
+    String type;
+    Date validNotBefore;
+    Date validNotAfter;
+    String extensions;
+    Date createTime;
+    Date modifyTime;
+
+    public String getID() {
+        return id;
+    }
+
+    public void setID(String id) {
+        this.id = id;
+    }
+
+    public String getSerialNumber() {
+        return serialNumber;
+    }
+
+    public void setSerialNumber(String serialNumber) {
+        this.serialNumber = serialNumber;
+    }
+
+    public String getSubject() {
+        return subject;
+    }
+
+    public void setSubject(String subject) {
+        this.subject = subject;
+    }
+
+    public String getTokenID() {
+        return tokenID;
+    }
+
+    public void setTokenID(String tokenID) {
+        this.tokenID = tokenID;
+    }
+
+    public String getKeyType() {
+        return keyType;
+    }
+
+    public void setKeyType(String keyType) {
+        this.keyType = keyType;
+    }
+
+    public String getStatus() {
+        return status;
+    }
+
+    public void setStatus(String status) {
+        this.status = status;
+    }
+
+    public String getUserID() {
+        return userID;
+    }
+
+    public void setUserID(String userID) {
+        this.userID = userID;
+    }
+
+
+    public String getCertificate() {
+        return certificate;
+    }
+
+    public void setCertificate(String certificate) {
+        this.certificate = certificate;
+    }
+
+    public String getIssuedBy() {
+        return issuedBy;
+    }
+
+    public void setIssuedBy(String issuedBy) {
+        this.issuedBy = issuedBy;
+    }
+
+    public String getOrigin() {
+        return origin;
+    }
+
+    public void setOrigin(String origin) {
+        this.origin = origin;
+    }
+
+    public String getType() {
+        return type;
+    }
+
+    public void setType(String type) {
+        this.type = type;
+    }
+
+    public Date getValidNotBefore() {
+        return validNotBefore;
+    }
+
+    public void setValidNotBefore(Date validNotBefore) {
+        this.validNotBefore = validNotBefore;
+    }
+
+    public Date getValidNotAfter() {
+        return validNotAfter;
+    }
+
+    public void setValidNotAfter(Date validNotAfter) {
+        this.validNotAfter = validNotAfter;
+    }
+
+    public String getExtensions() {
+        return extensions;
+    }
+
+    public void setExtensions(String extensions) {
+        this.extensions = extensions;
+    }
+
+    public Date getCreateTime() {
+        return createTime;
+    }
+
+    public void setCreateTime(Date createTime) {
+        this.createTime = createTime;
+    }
+
+    public Date getModifyTime() {
+        return modifyTime;
+    }
+
+    public void setModifyTime(Date modifyTime) {
+        this.modifyTime = modifyTime;
+    }
+
+    @Override
+    public int hashCode() {
+        final int prime = 31;
+        int result = 1;
+        result = prime * result + ((certificate == null) ? 0 : certificate.hashCode());
+        result = prime * result + ((createTime == null) ? 0 : createTime.hashCode());
+        result = prime * result + ((extensions == null) ? 0 : extensions.hashCode());
+        result = prime * result + ((id == null) ? 0 : id.hashCode());
+        result = prime * result + ((issuedBy == null) ? 0 : issuedBy.hashCode());
+        result = prime * result + ((keyType == null) ? 0 : keyType.hashCode());
+        result = prime * result + ((modifyTime == null) ? 0 : modifyTime.hashCode());
+        result = prime * result + ((origin == null) ? 0 : origin.hashCode());
+        result = prime * result + ((serialNumber == null) ? 0 : serialNumber.hashCode());
+        result = prime * result + ((status == null) ? 0 : status.hashCode());
+        result = prime * result + ((subject == null) ? 0 : subject.hashCode());
+        result = prime * result + ((tokenID == null) ? 0 : tokenID.hashCode());
+        result = prime * result + ((type == null) ? 0 : type.hashCode());
+        result = prime * result + ((userID == null) ? 0 : userID.hashCode());
+        result = prime * result + ((validNotAfter == null) ? 0 : validNotAfter.hashCode());
+        result = prime * result + ((validNotBefore == null) ? 0 : validNotBefore.hashCode());
+        return result;
+    }
+
+    @Override
+    public boolean equals(Object obj) {
+        if (this == obj)
+            return true;
+        if (obj == null)
+            return false;
+        if (getClass() != obj.getClass())
+            return false;
+        TPSCertRecord other = (TPSCertRecord) obj;
+        if (certificate == null) {
+            if (other.certificate != null)
+                return false;
+        } else if (!certificate.equals(other.certificate))
+            return false;
+        if (createTime == null) {
+            if (other.createTime != null)
+                return false;
+        } else if (!createTime.equals(other.createTime))
+            return false;
+        if (extensions == null) {
+            if (other.extensions != null)
+                return false;
+        } else if (!extensions.equals(other.extensions))
+            return false;
+        if (id == null) {
+            if (other.id != null)
+                return false;
+        } else if (!id.equals(other.id))
+            return false;
+        if (issuedBy == null) {
+            if (other.issuedBy != null)
+                return false;
+        } else if (!issuedBy.equals(other.issuedBy))
+            return false;
+        if (keyType == null) {
+            if (other.keyType != null)
+                return false;
+        } else if (!keyType.equals(other.keyType))
+            return false;
+        if (modifyTime == null) {
+            if (other.modifyTime != null)
+                return false;
+        } else if (!modifyTime.equals(other.modifyTime))
+            return false;
+        if (origin == null) {
+            if (other.origin != null)
+                return false;
+        } else if (!origin.equals(other.origin))
+            return false;
+        if (serialNumber == null) {
+            if (other.serialNumber != null)
+                return false;
+        } else if (!serialNumber.equals(other.serialNumber))
+            return false;
+        if (status == null) {
+            if (other.status != null)
+                return false;
+        } else if (!status.equals(other.status))
+            return false;
+        if (subject == null) {
+            if (other.subject != null)
+                return false;
+        } else if (!subject.equals(other.subject))
+            return false;
+        if (tokenID == null) {
+            if (other.tokenID != null)
+                return false;
+        } else if (!tokenID.equals(other.tokenID))
+            return false;
+        if (type == null) {
+            if (other.type != null)
+                return false;
+        } else if (!type.equals(other.type))
+            return false;
+        if (userID == null) {
+            if (other.userID != null)
+                return false;
+        } else if (!userID.equals(other.userID))
+            return false;
+        if (validNotAfter == null) {
+            if (other.validNotAfter != null)
+                return false;
+        } else if (!validNotAfter.equals(other.validNotAfter))
+            return false;
+        if (validNotBefore == null) {
+            if (other.validNotBefore != null)
+                return false;
+        } else if (!validNotBefore.equals(other.validNotBefore))
+            return false;
+        return true;
+    }
+}
diff --git a/base/tps-tomcat/src/org/dogtagpki/tps/cert/TPSCertService.java b/base/tps-tomcat/src/org/dogtagpki/tps/cert/TPSCertService.java
new file mode 100644
index 000000000..d49e3b700
--- /dev/null
+++ b/base/tps-tomcat/src/org/dogtagpki/tps/cert/TPSCertService.java
@@ -0,0 +1,152 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2013 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+
+package org.dogtagpki.tps.cert;
+
+import java.io.UnsupportedEncodingException;
+import java.net.URI;
+import java.net.URLEncoder;
+import java.util.Iterator;
+
+import org.dogtagpki.tps.server.TPSSubsystem;
+import org.jboss.resteasy.plugins.providers.atom.Link;
+
+import com.netscape.certsrv.base.PKIException;
+import com.netscape.certsrv.tps.cert.TPSCertCollection;
+import com.netscape.certsrv.tps.cert.TPSCertData;
+import com.netscape.certsrv.tps.cert.TPSCertResource;
+import com.netscape.cms.servlet.base.PKIService;
+
+/**
+ * @author Endi S. Dewata
+ */
+public class TPSCertService extends PKIService implements TPSCertResource {
+
+    public final static int DEFAULT_SIZE = 20;
+
+    public TPSCertService() {
+        System.out.println("TPSCertService.<init>()");
+    }
+
+    public TPSCertData createCertData(TPSCertRecord certRecord) {
+
+        TPSCertData certData = new TPSCertData();
+        certData.setID(certRecord.getID());
+        certData.setSerialNumber(certRecord.getSerialNumber());
+        certData.setSubject(certRecord.getSubject());
+        certData.setTokenID(certRecord.getTokenID());
+        certData.setKeyType(certRecord.getKeyType());
+        certData.setStatus(certRecord.getStatus());
+        certData.setUserID(certRecord.getUserID());
+        certData.setCreateTime(certRecord.getCreateTime());
+        certData.setModifyTime(certRecord.getModifyTime());
+
+        String certID = certRecord.getID();
+        try {
+            certID = URLEncoder.encode(certID, "UTF-8");
+        } catch (UnsupportedEncodingException e) {
+            e.printStackTrace();
+            throw new PKIException(e.getMessage());
+        }
+
+        URI uri = uriInfo.getBaseUriBuilder().path(TPSCertResource.class).path("{certID}").build(certID);
+        certData.setLink(new Link("self", uri));
+
+        return certData;
+    }
+
+    public TPSCertRecord createCertRecord(TPSCertData certData) {
+
+        TPSCertRecord certRecord = new TPSCertRecord();
+        certRecord.setID(certData.getID());
+        certRecord.setSerialNumber(certData.getSerialNumber());
+        certRecord.setSubject(certData.getSubject());
+        certRecord.setTokenID(certData.getTokenID());
+        certRecord.setKeyType(certData.getKeyType());
+        certRecord.setStatus(certData.getStatus());
+        certRecord.setUserID(certData.getUserID());
+        certRecord.setCreateTime(certData.getCreateTime());
+        certRecord.setModifyTime(certData.getModifyTime());
+
+        return certRecord;
+    }
+
+    @Override
+    public TPSCertCollection findCerts(Integer start, Integer size) {
+
+        System.out.println("TPSCertService.findCerts()");
+
+        try {
+            start = start == null ? 0 : start;
+            size = size == null ? DEFAULT_SIZE : size;
+
+            TPSSubsystem subsystem = TPSSubsystem.getInstance();
+            TPSCertDatabase database = subsystem.getCertDatabase();
+
+            Iterator<TPSCertRecord> activities = database.getRecords().iterator();
+
+            TPSCertCollection response = new TPSCertCollection();
+
+            int i = 0;
+
+            // skip to the start of the page
+            for ( ; i<start && activities.hasNext(); i++) activities.next();
+
+            // return entries up to the page size
+            for ( ; i<start+size && activities.hasNext(); i++) {
+                response.addEntry(createCertData(activities.next()));
+            }
+
+            // count the total entries
+            for ( ; activities.hasNext(); i++) activities.next();
+
+            if (start > 0) {
+                URI uri = uriInfo.getRequestUriBuilder().replaceQueryParam("start", Math.max(start-size, 0)).build();
+                response.addLink(new Link("prev", uri));
+            }
+
+            if (start+size < i) {
+                URI uri = uriInfo.getRequestUriBuilder().replaceQueryParam("start", start+size).build();
+                response.addLink(new Link("next", uri));
+            }
+
+            return response;
+
+        } catch (Exception e) {
+            e.printStackTrace();
+            throw new PKIException(e.getMessage());
+        }
+    }
+
+    @Override
+    public TPSCertData getCert(String certID) {
+
+        System.out.println("TPSCertService.getCert(\"" + certID + "\")");
+
+        try {
+            TPSSubsystem subsystem = TPSSubsystem.getInstance();
+            TPSCertDatabase database = subsystem.getCertDatabase();
+
+            return createCertData(database.getRecord(certID));
+
+        } catch (Exception e) {
+            e.printStackTrace();
+            throw new PKIException(e.getMessage());
+        }
+    }
+}
diff --git a/base/tps-tomcat/src/org/dogtagpki/tps/server/TPSApplication.java b/base/tps-tomcat/src/org/dogtagpki/tps/server/TPSApplication.java
index 8f1a97db3..caf43a2f0 100644
--- a/base/tps-tomcat/src/org/dogtagpki/tps/server/TPSApplication.java
+++ b/base/tps-tomcat/src/org/dogtagpki/tps/server/TPSApplication.java
@@ -22,6 +22,7 @@ import java.util.Set;
 
 import javax.ws.rs.core.Application;
 
+import org.dogtagpki.tps.cert.TPSCertService;
 import org.dogtagpki.tps.logging.ActivityService;
 import org.dogtagpki.tps.token.TokenService;
 
@@ -66,6 +67,9 @@ public class TPSApplication extends Application {
         // activities
         classes.add(ActivityService.class);
 
+        // certificates
+        classes.add(TPSCertService.class);
+
         // tokens
         classes.add(TokenService.class);
 
diff --git a/base/tps-tomcat/src/org/dogtagpki/tps/server/TPSSubsystem.java b/base/tps-tomcat/src/org/dogtagpki/tps/server/TPSSubsystem.java
index 08afe0a09..96ba4a9ef 100644
--- a/base/tps-tomcat/src/org/dogtagpki/tps/server/TPSSubsystem.java
+++ b/base/tps-tomcat/src/org/dogtagpki/tps/server/TPSSubsystem.java
@@ -17,6 +17,7 @@
 // --- END COPYRIGHT BLOCK ---
 package org.dogtagpki.tps.server;
 
+import org.dogtagpki.tps.cert.TPSCertDatabase;
 import org.dogtagpki.tps.logging.ActivityDatabase;
 import org.dogtagpki.tps.token.TokenDatabase;
 import org.mozilla.jss.CryptoManager;
@@ -48,6 +49,7 @@ public class TPSSubsystem implements IAuthority, ISubsystem {
     public IConfigStore config;
 
     public ActivityDatabase activityDatabase = new ActivityDatabase();
+    public TPSCertDatabase certDatabase = new TPSCertDatabase();
     public TokenDatabase tokenDatabase = new TokenDatabase();
 
     public static TPSSubsystem getInstance() {
@@ -119,6 +121,10 @@ public class TPSSubsystem implements IAuthority, ISubsystem {
         return activityDatabase;
     }
 
+    public TPSCertDatabase getCertDatabase() {
+        return certDatabase;
+    }
+
     public TokenDatabase getTokenDatabase() {
         return tokenDatabase;
     }