diff options
author | Endi S. Dewata <edewata@redhat.com> | 2016-02-15 05:27:19 +0100 |
---|---|---|
committer | Endi S. Dewata <edewata@redhat.com> | 2016-02-19 15:30:07 +0100 |
commit | 67a0c95b8622b18c9803b2bfe0f708be8747f896 (patch) | |
tree | d6f7991a223ac5403bbeae2a1ef1d2cb330d4584 /base | |
parent | a96ecbae1bfa27223bbebc7a67f695b643c4aebe (diff) | |
download | pki-67a0c95b8622b18c9803b2bfe0f708be8747f896.tar.gz pki-67a0c95b8622b18c9803b2bfe0f708be8747f896.tar.xz pki-67a0c95b8622b18c9803b2bfe0f708be8747f896.zip |
Added CLI to manage certs in PKCS #12 file.
New CLIs have been added to add a certificate from NSS database and
to remove a certificate from the PKCS #12 file.
https://fedorahosted.org/pki/ticket/1742
Diffstat (limited to 'base')
6 files changed, 368 insertions, 10 deletions
diff --git a/base/java-tools/src/com/netscape/cmstools/PKCS12Export.java b/base/java-tools/src/com/netscape/cmstools/PKCS12Export.java index bcc4252ba..187ff7667 100644 --- a/base/java-tools/src/com/netscape/cmstools/PKCS12Export.java +++ b/base/java-tools/src/com/netscape/cmstools/PKCS12Export.java @@ -127,7 +127,8 @@ public class PKCS12Export { try { PKCS12Util util = new PKCS12Util(); - PKCS12 pkcs12 = util.loadFromNSS(); + PKCS12 pkcs12 = new PKCS12(); + util.loadFromNSS(pkcs12); util.storeIntoFile(pkcs12, pkcs12OutputFilename, password); } finally { diff --git a/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertAddCLI.java b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertAddCLI.java new file mode 100644 index 000000000..6c9d8032e --- /dev/null +++ b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertAddCLI.java @@ -0,0 +1,168 @@ +// --- BEGIN COPYRIGHT BLOCK --- +// This program is free software; you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation; version 2 of the License. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +// +// (C) 2016 Red Hat, Inc. +// All rights reserved. +// --- END COPYRIGHT BLOCK --- + +package com.netscape.cmstools.pkcs12; + +import java.io.BufferedReader; +import java.io.File; +import java.io.FileReader; +import java.util.logging.Level; +import java.util.logging.Logger; + +import org.apache.commons.cli.CommandLine; +import org.apache.commons.cli.Option; +import org.apache.commons.cli.ParseException; +import org.mozilla.jss.util.Password; + +import com.netscape.cmstools.cli.CLI; +import com.netscape.cmstools.cli.MainCLI; + +import netscape.security.pkcs.PKCS12; +import netscape.security.pkcs.PKCS12Util; + +/** + * @author Endi S. Dewata + */ +public class PKCS12CertAddCLI extends CLI { + + public PKCS12CertAddCLI(PKCS12CertCLI certCLI) { + super("add", "Add certificate into PKCS #12 file", certCLI); + + createOptions(); + } + + public void printHelp() { + formatter.printHelp(getFullName() + " <nickname> [OPTIONS...]", options); + } + + public void createOptions() { + Option option = new Option(null, "pkcs12", true, "PKCS #12 file"); + option.setArgName("path"); + options.addOption(option); + + option = new Option(null, "pkcs12-password", true, "PKCS #12 password"); + option.setArgName("password"); + options.addOption(option); + + option = new Option(null, "pkcs12-password-file", true, "PKCS #12 password file"); + option.setArgName("path"); + options.addOption(option); + + options.addOption(null, "no-trust-flags", false, "Do not include trust flags"); + options.addOption(null, "no-cert", false, "Do not include certificate itself"); + options.addOption(null, "no-key", false, "Do not include certificate key"); + options.addOption(null, "no-chain", false, "Do not include certificate chain"); + + options.addOption("v", "verbose", false, "Run in verbose mode."); + options.addOption(null, "debug", false, "Run in debug mode."); + options.addOption(null, "help", false, "Show help message."); + } + + public void execute(String[] args) throws Exception { + + CommandLine cmd = null; + + try { + cmd = parser.parse(options, args); + } catch (ParseException e) { + System.err.println("Error: " + e.getMessage()); + printHelp(); + System.exit(-1); + } + + if (cmd.hasOption("help")) { + printHelp(); + System.exit(0); + } + + if (cmd.hasOption("verbose")) { + Logger.getLogger("org.dogtagpki").setLevel(Level.INFO); + Logger.getLogger("com.netscape").setLevel(Level.INFO); + Logger.getLogger("netscape").setLevel(Level.INFO); + + } else if (cmd.hasOption("debug")) { + Logger.getLogger("org.dogtagpki").setLevel(Level.FINE); + Logger.getLogger("com.netscape").setLevel(Level.FINE); + Logger.getLogger("netscape").setLevel(Level.FINE); + } + + String[] cmdArgs = cmd.getArgs(); + + if (cmdArgs.length == 0) { + System.err.println("Error: Missing certificate nickname."); + printHelp(); + System.exit(-1); + } + + String nickname = cmdArgs[0]; + + String filename = cmd.getOptionValue("pkcs12"); + + if (filename == null) { + System.err.println("Error: Missing PKCS #12 file."); + printHelp(); + System.exit(-1); + } + + String passwordString = cmd.getOptionValue("pkcs12-password"); + + if (passwordString == null) { + + String passwordFile = cmd.getOptionValue("pkcs12-password-file"); + if (passwordFile != null) { + try (BufferedReader in = new BufferedReader(new FileReader(passwordFile))) { + passwordString = in.readLine(); + } + } + } + + if (passwordString == null) { + System.err.println("Error: Missing PKCS #12 password."); + printHelp(); + System.exit(-1); + } + + Password password = new Password(passwordString.toCharArray()); + + boolean includeTrustFlags = !cmd.hasOption("no-trust-flags"); + boolean includeCert = !cmd.hasOption("no-cert"); + boolean includeKey = !cmd.hasOption("no-key"); + boolean includeChain = !cmd.hasOption("no-chain"); + + try { + PKCS12Util util = new PKCS12Util(); + util.setTrustFlagsEnabled(includeTrustFlags); + + PKCS12 pkcs12; + + if (new File(filename).exists()) { + pkcs12 = util.loadFromFile(filename, password); + } else { + pkcs12 = new PKCS12(); + } + + util.loadFromNSS(pkcs12, nickname, includeCert, includeKey, includeChain); + util.storeIntoFile(pkcs12, filename, password); + + } finally { + password.clear(); + } + + MainCLI.printMessage("Added certificate \"" + nickname + "\""); + } +} diff --git a/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertCLI.java b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertCLI.java index 807404749..934b799dc 100644 --- a/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertCLI.java +++ b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertCLI.java @@ -31,7 +31,9 @@ public class PKCS12CertCLI extends CLI { public PKCS12CertCLI(PKCS12CLI parent) { super("cert", "PKCS #12 certificate management commands", parent); + addModule(new PKCS12CertAddCLI(this)); addModule(new PKCS12CertFindCLI(this)); + addModule(new PKCS12CertRemoveCLI(this)); } public static void printCertInfo(PKCS12CertInfo certInfo) throws Exception { diff --git a/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertRemoveCLI.java b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertRemoveCLI.java new file mode 100644 index 000000000..9dbf767ef --- /dev/null +++ b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertRemoveCLI.java @@ -0,0 +1,149 @@ +// --- BEGIN COPYRIGHT BLOCK --- +// This program is free software; you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation; version 2 of the License. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +// +// (C) 2016 Red Hat, Inc. +// All rights reserved. +// --- END COPYRIGHT BLOCK --- + +package com.netscape.cmstools.pkcs12; + +import java.io.BufferedReader; +import java.io.FileReader; +import java.util.logging.Level; +import java.util.logging.Logger; + +import org.apache.commons.cli.CommandLine; +import org.apache.commons.cli.Option; +import org.apache.commons.cli.ParseException; +import org.mozilla.jss.util.Password; + +import com.netscape.cmstools.cli.CLI; +import com.netscape.cmstools.cli.MainCLI; + +import netscape.security.pkcs.PKCS12; +import netscape.security.pkcs.PKCS12Util; + +/** + * @author Endi S. Dewata + */ +public class PKCS12CertRemoveCLI extends CLI { + + public PKCS12CertRemoveCLI(PKCS12CertCLI certCLI) { + super("del", "Remove certificate from PKCS #12 file", certCLI); + + createOptions(); + } + + public void printHelp() { + formatter.printHelp(getFullName() + " <nickname> [OPTIONS...]", options); + } + + public void createOptions() { + Option option = new Option(null, "pkcs12", true, "PKCS #12 file"); + option.setArgName("path"); + options.addOption(option); + + option = new Option(null, "pkcs12-password", true, "PKCS #12 password"); + option.setArgName("password"); + options.addOption(option); + + option = new Option(null, "pkcs12-password-file", true, "PKCS #12 password file"); + option.setArgName("path"); + options.addOption(option); + + options.addOption("v", "verbose", false, "Run in verbose mode."); + options.addOption(null, "debug", false, "Run in debug mode."); + options.addOption(null, "help", false, "Show help message."); + } + + public void execute(String[] args) throws Exception { + + CommandLine cmd = null; + + try { + cmd = parser.parse(options, args); + } catch (ParseException e) { + System.err.println("Error: " + e.getMessage()); + printHelp(); + System.exit(-1); + } + + if (cmd.hasOption("help")) { + printHelp(); + System.exit(0); + } + + if (cmd.hasOption("verbose")) { + Logger.getLogger("org.dogtagpki").setLevel(Level.INFO); + Logger.getLogger("com.netscape").setLevel(Level.INFO); + Logger.getLogger("netscape").setLevel(Level.INFO); + + } else if (cmd.hasOption("debug")) { + Logger.getLogger("org.dogtagpki").setLevel(Level.FINE); + Logger.getLogger("com.netscape").setLevel(Level.FINE); + Logger.getLogger("netscape").setLevel(Level.FINE); + } + + String[] cmdArgs = cmd.getArgs(); + + if (cmdArgs.length == 0) { + System.err.println("Error: Missing certificate nickname."); + printHelp(); + System.exit(-1); + } + + String nickname = cmdArgs[0]; + + String filename = cmd.getOptionValue("pkcs12"); + + if (filename == null) { + System.err.println("Error: Missing PKCS #12 file."); + printHelp(); + System.exit(-1); + } + + String passwordString = cmd.getOptionValue("pkcs12-password"); + + if (passwordString == null) { + + String passwordFile = cmd.getOptionValue("pkcs12-password-file"); + if (passwordFile != null) { + try (BufferedReader in = new BufferedReader(new FileReader(passwordFile))) { + passwordString = in.readLine(); + } + } + } + + if (passwordString == null) { + System.err.println("Error: Missing PKCS #12 password."); + printHelp(); + System.exit(-1); + } + + Password password = new Password(passwordString.toCharArray()); + + try { + PKCS12Util util = new PKCS12Util(); + + PKCS12 pkcs12 = util.loadFromFile(filename, password); + pkcs12.removeCertInfoByNickname(nickname); + util.storeIntoFile(pkcs12, filename, password); + + } finally { + password.clear(); + } + + MainCLI.printMessage("Deleted certificate \"" + nickname + "\""); + } +} diff --git a/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12ExportCLI.java b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12ExportCLI.java index 174748262..a5c9e2823 100644 --- a/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12ExportCLI.java +++ b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12ExportCLI.java @@ -18,6 +18,7 @@ package com.netscape.cmstools.pkcs12; import java.io.BufferedReader; +import java.io.File; import java.io.FileReader; import java.util.logging.Level; import java.util.logging.Logger; @@ -129,7 +130,15 @@ public class PKCS12ExportCLI extends CLI { PKCS12Util util = new PKCS12Util(); util.setTrustFlagsEnabled(trustFlagsEnabled); - PKCS12 pkcs12 = util.loadFromNSS(); + PKCS12 pkcs12; + + if (new File(filename).exists()) { + pkcs12 = util.loadFromFile(filename, password); + } else { + pkcs12 = new PKCS12(); + } + + util.loadFromNSS(pkcs12); util.storeIntoFile(pkcs12, filename, password); } finally { diff --git a/base/util/src/netscape/security/pkcs/PKCS12Util.java b/base/util/src/netscape/security/pkcs/PKCS12Util.java index c5173a208..8d189a9d7 100644 --- a/base/util/src/netscape/security/pkcs/PKCS12Util.java +++ b/base/util/src/netscape/security/pkcs/PKCS12Util.java @@ -232,24 +232,36 @@ public class PKCS12Util { return attrs; } - public PKCS12 loadFromNSS() throws Exception { + public void loadFromNSS(PKCS12 pkcs12) throws Exception { - logger.info("Loading data from NSS database"); + logger.info("Loading all certificate and keys from NSS database"); CryptoManager cm = CryptoManager.getInstance(); CryptoToken token = cm.getInternalKeyStorageToken(); CryptoStore store = token.getCryptoStore(); - PKCS12 pkcs12 = new PKCS12(); - + // load all certs for (X509Certificate cert : store.getCertificates()) { - loadCertAndKeyFromNSS(pkcs12, cert); + loadCertFromNSS(pkcs12, cert, true); // load cert with private key } + } - return pkcs12; + public void loadFromNSS(PKCS12 pkcs12, String nickname, boolean includeCert, boolean includeKey, boolean includeChain) throws Exception { + + CryptoManager cm = CryptoManager.getInstance(); + + X509Certificate cert = cm.findCertByNickname(nickname); + + if (includeCert) { + loadCertFromNSS(pkcs12, cert, includeKey); + } + + if (includeChain) { + loadCertChainFromNSS(pkcs12, cert); + } } - public void loadCertAndKeyFromNSS(PKCS12 pkcs12, X509Certificate cert) throws Exception { + public void loadCertFromNSS(PKCS12 pkcs12, X509Certificate cert, boolean includeKey) throws Exception { String nickname = cert.getNickname(); logger.info("Loading certificate \"" + nickname + "\" from NSS database"); @@ -265,9 +277,12 @@ public class PKCS12Util { certInfo.trustFlags = getTrustFlags(cert); pkcs12.addCertInfo(certInfo); + if (!includeKey) return; + + logger.info("Loading private key for certificate \"" + nickname + "\" from NSS database"); + try { PrivateKey privateKey = cm.findPrivKeyByCert(cert); - logger.fine("Certificate \"" + nickname + "\" has private key"); PKCS12KeyInfo keyInfo = new PKCS12KeyInfo(); @@ -285,6 +300,20 @@ public class PKCS12Util { } } + public void loadCertChainFromNSS(PKCS12 pkcs12, X509Certificate cert) throws Exception { + + logger.info("Loading certificate chain for \"" + cert.getNickname() + "\""); + + CryptoManager cm = CryptoManager.getInstance(); + X509Certificate[] certChain = cm.buildCertificateChain(cert); + + // load parent certificates only + for (int i = 1; i < certChain.length; i++) { + X509Certificate c = certChain[i]; + loadCertFromNSS(pkcs12, c, false); // do not include private key + } + } + public void storeIntoFile(PKCS12 pkcs12, String filename, Password password) throws Exception { logger.info("Storing data into PKCS #12 file"); |