summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--base/common/src/CMakeLists.txt7
-rw-r--r--base/common/src/com/netscape/cms/client/cert/CertCLI.java143
-rw-r--r--base/common/src/com/netscape/cms/client/cert/CertFindCLI.java66
-rw-r--r--base/common/src/com/netscape/cms/client/cert/CertHoldCLI.java118
-rw-r--r--base/common/src/com/netscape/cms/client/cert/CertReleaseHoldCLI.java109
-rw-r--r--base/common/src/com/netscape/cms/client/cert/CertRestClient.java74
-rw-r--r--base/common/src/com/netscape/cms/client/cert/CertRevokeCLI.java164
-rw-r--r--base/common/src/com/netscape/cms/client/cert/CertShowCLI.java92
-rw-r--r--base/common/src/com/netscape/cms/client/cli/MainCLI.java4
-rw-r--r--base/common/src/com/netscape/cms/client/group/GroupCLI.java1
-rw-r--r--base/common/src/com/netscape/cms/client/user/UserCLI.java1
-rw-r--r--base/common/src/com/netscape/cms/servlet/csadmin/CMSRestClient.java32
-rwxr-xr-xbase/setup/pki4
13 files changed, 812 insertions, 3 deletions
diff --git a/base/common/src/CMakeLists.txt b/base/common/src/CMakeLists.txt
index a3d0adcdd..eab5db24c 100644
--- a/base/common/src/CMakeLists.txt
+++ b/base/common/src/CMakeLists.txt
@@ -462,6 +462,13 @@ set(pki-certsrv_java_SRCS
set(pki-cms_java_SRCS
com/netscape/cms/client/cli/CLI.java
com/netscape/cms/client/cli/MainCLI.java
+ com/netscape/cms/client/cert/CertCLI.java
+ com/netscape/cms/client/cert/CertFindCLI.java
+ com/netscape/cms/client/cert/CertHoldCLI.java
+ com/netscape/cms/client/cert/CertReleaseHoldCLI.java
+ com/netscape/cms/client/cert/CertRestClient.java
+ com/netscape/cms/client/cert/CertRevokeCLI.java
+ com/netscape/cms/client/cert/CertShowCLI.java
com/netscape/cms/client/group/GroupAddCLI.java
com/netscape/cms/client/group/GroupAddMemberCLI.java
com/netscape/cms/client/group/GroupFindMemberCLI.java
diff --git a/base/common/src/com/netscape/cms/client/cert/CertCLI.java b/base/common/src/com/netscape/cms/client/cert/CertCLI.java
new file mode 100644
index 000000000..b0789ef6a
--- /dev/null
+++ b/base/common/src/com/netscape/cms/client/cert/CertCLI.java
@@ -0,0 +1,143 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2012 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+
+package com.netscape.cms.client.cert;
+
+import java.util.Arrays;
+
+import org.apache.commons.lang.StringUtils;
+import org.jboss.resteasy.plugins.providers.atom.Link;
+
+import com.netscape.cms.client.cli.CLI;
+import com.netscape.cms.client.cli.MainCLI;
+import com.netscape.cms.servlet.cert.model.CertDataInfo;
+import com.netscape.cms.servlet.cert.model.CertificateData;
+import com.netscape.cms.servlet.request.model.CertRequestInfo;
+
+/**
+ * @author Endi S. Dewata
+ */
+public class CertCLI extends CLI {
+
+ public MainCLI parent;
+ public CertRestClient client;
+
+ public CertCLI(MainCLI parent) {
+ super("cert", "Certificate management commands");
+ this.parent = parent;
+
+ addModule(new CertFindCLI(this));
+ addModule(new CertShowCLI(this));
+
+ addModule(new CertRevokeCLI(this));
+ addModule(new CertHoldCLI(this));
+ addModule(new CertReleaseHoldCLI(this));
+ }
+
+ public void printHelp() {
+
+ System.out.println("Commands:");
+
+ int leftPadding = 1;
+ int rightPadding = 25;
+
+ for (CLI module : modules.values()) {
+ String label = name + "-" + module.getName();
+
+ int padding = rightPadding - leftPadding - label.length();
+ if (padding < 1)
+ padding = 1;
+
+ System.out.print(StringUtils.repeat(" ", leftPadding));
+ System.out.print(label);
+ System.out.print(StringUtils.repeat(" ", padding));
+ System.out.println(module.getDescription());
+ }
+ }
+
+ public void execute(String[] args) throws Exception {
+
+ client = new CertRestClient(parent.url + "/pki", parent.certNickname);
+ client.setVerbose(verbose);
+
+ String command = args[0];
+ String[] commandArgs = Arrays.copyOfRange(args, 1, args.length);
+
+ if (command == null) {
+ printHelp();
+ System.exit(1);
+ }
+
+ CLI module = getModule(command);
+ if (module != null) {
+ module.execute(commandArgs);
+
+ } else {
+ System.err.println("Error: Invalid command \"" + command + "\"");
+ printHelp();
+ System.exit(1);
+ }
+ }
+
+ public static void printCertInfo(CertDataInfo info) {
+ System.out.println(" Serial Number: "+info.getID().toHexString());
+ System.out.println(" Subject DN: "+info.getSubjectDN());
+ System.out.println(" Status: "+info.getStatus());
+
+ Link link = info.getLink();
+ if (verbose && link != null) {
+ System.out.println(" Link: " + link.getHref());
+ }
+ }
+
+ public static void printCertData(
+ CertificateData certData,
+ boolean showPrettyPrint,
+ boolean showEncoded) {
+
+ System.out.println(" Serial Number: " + certData.getSerialNumber().toHexString());
+ System.out.println(" Issuer: " + certData.getIssuerDN());
+ System.out.println(" Subject: " + certData.getSubjectDN());
+ System.out.println(" Status: " + certData.getStatus());
+ System.out.println(" Not Before: " + certData.getNotBefore());
+ System.out.println(" Not After: " + certData.getNotAfter());
+
+ Link link = certData.getLink();
+ if (verbose && link != null) {
+ System.out.println(" Link: " + link.getHref());
+ }
+
+ String prettyPrint = certData.getPrettyPrint();
+ if (showPrettyPrint && prettyPrint != null) {
+ System.out.println();
+ System.out.println(prettyPrint);
+ }
+
+ String encoded = certData.getEncoded();
+ if (showEncoded && encoded != null) {
+ System.out.println();
+ System.out.println(encoded);
+ }
+ }
+
+ public static void printCertRequestInfo(CertRequestInfo info) {
+ System.out.println(" Request ID: " + info.getRequestId());
+ System.out.println(" Status: " + info.getRequestStatus());
+ System.out.println(" Type: " + info.getRequestType());
+ }
+}
diff --git a/base/common/src/com/netscape/cms/client/cert/CertFindCLI.java b/base/common/src/com/netscape/cms/client/cert/CertFindCLI.java
new file mode 100644
index 000000000..32457d6df
--- /dev/null
+++ b/base/common/src/com/netscape/cms/client/cert/CertFindCLI.java
@@ -0,0 +1,66 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2012 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+
+package com.netscape.cms.client.cert;
+
+import com.netscape.cms.client.cli.CLI;
+import com.netscape.cms.client.cli.MainCLI;
+import com.netscape.cms.servlet.cert.model.CertDataInfo;
+import com.netscape.cms.servlet.cert.model.CertDataInfos;
+import com.netscape.cms.servlet.cert.model.CertSearchData;
+
+/**
+ * @author Endi S. Dewata
+ */
+public class CertFindCLI extends CLI {
+
+ public CertCLI parent;
+
+ public CertFindCLI(CertCLI parent) {
+ super("find", "Find certificates");
+ this.parent = parent;
+ }
+
+ public void printHelp() {
+ formatter.printHelp(parent.name + "-" + name + " [OPTIONS...]", options);
+ }
+
+ public void execute(String[] args) throws Exception {
+
+ CertSearchData searchData = new CertSearchData();
+ searchData.setSerialNumberRangeInUse(true);
+
+ CertDataInfos certs = parent.client.findCerts(searchData);
+
+ MainCLI.printMessage(certs.getCertInfos().size() + " certificate(s) matched");
+
+ boolean first = true;
+
+ for (CertDataInfo cert : certs.getCertInfos()) {
+ if (first) {
+ first = false;
+ } else {
+ System.out.println();
+ }
+
+ CertCLI.printCertInfo(cert);
+ }
+
+ MainCLI.printMessage("Number of entries returned " + certs.getCertInfos().size());
+ }
+}
diff --git a/base/common/src/com/netscape/cms/client/cert/CertHoldCLI.java b/base/common/src/com/netscape/cms/client/cert/CertHoldCLI.java
new file mode 100644
index 000000000..598c1e664
--- /dev/null
+++ b/base/common/src/com/netscape/cms/client/cert/CertHoldCLI.java
@@ -0,0 +1,118 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2012 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+
+package com.netscape.cms.client.cert;
+
+import java.io.BufferedReader;
+import java.io.InputStreamReader;
+
+import netscape.security.x509.RevocationReason;
+
+import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.Option;
+
+import com.netscape.certsrv.dbs.certdb.CertId;
+import com.netscape.certsrv.request.RequestStatus;
+import com.netscape.cms.client.cli.CLI;
+import com.netscape.cms.client.cli.MainCLI;
+import com.netscape.cms.servlet.cert.model.CertRevokeRequest;
+import com.netscape.cms.servlet.cert.model.CertificateData;
+import com.netscape.cms.servlet.request.model.CertRequestInfo;
+
+/**
+ * @author Endi S. Dewata
+ */
+public class CertHoldCLI extends CLI {
+
+ public CertCLI parent;
+
+ public CertHoldCLI(CertCLI parent) {
+ super("hold", "Place certificate on-hold");
+ this.parent = parent;
+ }
+
+ public void printHelp() {
+ formatter.printHelp(parent.name + "-" + name + " <Serial Number> [OPTIONS...]", options);
+ }
+
+ public void execute(String[] args) throws Exception {
+
+ Option option = new Option(null, "comments", true, "Comments");
+ option.setArgName("comments");
+ options.addOption(option);
+
+ options.addOption(null, "force", false, "Force");
+
+ CommandLine cmd = null;
+
+ try {
+ cmd = parser.parse(options, args);
+
+ } catch (Exception e) {
+ System.err.println("Error: " + e.getMessage());
+ printHelp();
+ System.exit(1);
+ }
+
+ String[] cmdArgs = cmd.getArgs();
+
+ if (cmdArgs.length != 1) {
+ printHelp();
+ System.exit(1);
+ }
+
+ CertId certID = new CertId(cmdArgs[0]);
+
+ if (!cmd.hasOption("force")) {
+
+ CertificateData certData = parent.client.getCert(certID);
+
+ System.out.println("Placing certificate on-hold:");
+
+ CertCLI.printCertData(certData, false, false);
+
+ System.out.print("Are you sure (Y/N)? ");
+ System.out.flush();
+
+ BufferedReader reader = new BufferedReader(new InputStreamReader(System.in));
+ String line = reader.readLine();
+ if (!line.equalsIgnoreCase("Y")) {
+ System.exit(1);
+ }
+ }
+
+ CertRevokeRequest request = new CertRevokeRequest();
+ request.setReason(RevocationReason.CERTIFICATE_HOLD);
+ request.setComments(cmd.getOptionValue("comments"));
+
+ CertRequestInfo certRequestInfo = parent.client.revokeCert(certID, request);
+
+ if (verbose) {
+ CertCLI.printCertRequestInfo(certRequestInfo);
+ }
+
+ if (certRequestInfo.getRequestStatus() == RequestStatus.COMPLETE) {
+ MainCLI.printMessage("Placed certificate \"" + certID.toHexString() + "\" on-hold");
+ CertificateData certData = parent.client.getCert(certID);
+ CertCLI.printCertData(certData, false, false);
+
+ } else {
+ MainCLI.printMessage("Request \"" + certRequestInfo.getRequestId() + "\": " + certRequestInfo.getRequestStatus());
+ }
+ }
+}
diff --git a/base/common/src/com/netscape/cms/client/cert/CertReleaseHoldCLI.java b/base/common/src/com/netscape/cms/client/cert/CertReleaseHoldCLI.java
new file mode 100644
index 000000000..0d39aff88
--- /dev/null
+++ b/base/common/src/com/netscape/cms/client/cert/CertReleaseHoldCLI.java
@@ -0,0 +1,109 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2012 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+
+package com.netscape.cms.client.cert;
+
+import java.io.BufferedReader;
+import java.io.InputStreamReader;
+
+import org.apache.commons.cli.CommandLine;
+
+import com.netscape.certsrv.dbs.certdb.CertId;
+import com.netscape.certsrv.request.RequestStatus;
+import com.netscape.cms.client.cli.CLI;
+import com.netscape.cms.client.cli.MainCLI;
+import com.netscape.cms.servlet.cert.model.CertUnrevokeRequest;
+import com.netscape.cms.servlet.cert.model.CertificateData;
+import com.netscape.cms.servlet.request.model.CertRequestInfo;
+
+/**
+ * @author Endi S. Dewata
+ */
+public class CertReleaseHoldCLI extends CLI {
+
+ public CertCLI parent;
+
+ public CertReleaseHoldCLI(CertCLI parent) {
+ super("release-hold", "Place certificate off-hold");
+ this.parent = parent;
+ }
+
+ public void printHelp() {
+ formatter.printHelp(parent.name + "-" + name + " <Serial Number> [OPTIONS...]", options);
+ }
+
+ public void execute(String[] args) throws Exception {
+
+ options.addOption(null, "force", false, "Force");
+
+ CommandLine cmd = null;
+
+ try {
+ cmd = parser.parse(options, args);
+
+ } catch (Exception e) {
+ System.err.println("Error: " + e.getMessage());
+ printHelp();
+ System.exit(1);
+ }
+
+ String[] cmdArgs = cmd.getArgs();
+
+ if (cmdArgs.length != 1) {
+ printHelp();
+ System.exit(1);
+ }
+
+ CertId certID = new CertId(cmdArgs[0]);
+
+ if (!cmd.hasOption("force")) {
+
+ CertificateData certData = parent.client.getCert(certID);
+
+ System.out.println("Placing certificate off-hold:");
+
+ CertCLI.printCertData(certData, false, false);
+
+ System.out.print("Are you sure (Y/N)? ");
+ System.out.flush();
+
+ BufferedReader reader = new BufferedReader(new InputStreamReader(System.in));
+ String line = reader.readLine();
+ if (!line.equalsIgnoreCase("Y")) {
+ System.exit(1);
+ }
+ }
+
+ CertUnrevokeRequest request = new CertUnrevokeRequest();
+
+ CertRequestInfo certRequestInfo = parent.client.unrevokeCert(certID, request);
+
+ if (verbose) {
+ CertCLI.printCertRequestInfo(certRequestInfo);
+ }
+
+ if (certRequestInfo.getRequestStatus() == RequestStatus.COMPLETE) {
+ MainCLI.printMessage("Placed certificate \"" + certID.toHexString() + "\" off-hold");
+ CertificateData certData = parent.client.getCert(certID);
+ CertCLI.printCertData(certData, false, false);
+
+ } else {
+ MainCLI.printMessage("Request \"" + certRequestInfo.getRequestId() + "\": " + certRequestInfo.getRequestStatus());
+ }
+ }
+}
diff --git a/base/common/src/com/netscape/cms/client/cert/CertRestClient.java b/base/common/src/com/netscape/cms/client/cert/CertRestClient.java
new file mode 100644
index 000000000..689cb8f57
--- /dev/null
+++ b/base/common/src/com/netscape/cms/client/cert/CertRestClient.java
@@ -0,0 +1,74 @@
+//--- BEGIN COPYRIGHT BLOCK ---
+//This program is free software; you can redistribute it and/or modify
+//it under the terms of the GNU General Public License as published by
+//the Free Software Foundation; version 2 of the License.
+//
+//This program is distributed in the hope that it will be useful,
+//but WITHOUT ANY WARRANTY; without even the implied warranty of
+//MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+//GNU General Public License for more details.
+//
+//You should have received a copy of the GNU General Public License along
+//with this program; if not, write to the Free Software Foundation, Inc.,
+//51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+//(C) 2012 Red Hat, Inc.
+//All rights reserved.
+//--- END COPYRIGHT BLOCK ---
+package com.netscape.cms.client.cert;
+
+import java.net.URISyntaxException;
+
+import com.netscape.certsrv.dbs.certdb.CertId;
+import com.netscape.cms.servlet.cert.CertResource;
+import com.netscape.cms.servlet.cert.CertsResource;
+import com.netscape.cms.servlet.cert.model.CertDataInfos;
+import com.netscape.cms.servlet.cert.model.CertRevokeRequest;
+import com.netscape.cms.servlet.cert.model.CertSearchData;
+import com.netscape.cms.servlet.cert.model.CertUnrevokeRequest;
+import com.netscape.cms.servlet.cert.model.CertificateData;
+import com.netscape.cms.servlet.csadmin.CMSRestClient;
+import com.netscape.cms.servlet.request.model.CertRequestInfo;
+
+/**
+ * @author Endi S. Dewata
+ */
+public class CertRestClient extends CMSRestClient {
+
+ public CertResource certClient;
+ public CertsResource certsClient;
+
+ public CertRestClient(String baseUri) throws URISyntaxException {
+ this(baseUri, null);
+ }
+
+ public CertRestClient(String baseUri, String nickname) throws URISyntaxException {
+ super(baseUri);
+
+ certClient = createProxy(CertResource.class);
+ certsClient = createProxy(CertsResource.class);
+ }
+
+ public CertificateData getCert(CertId id) {
+ return certClient.getCert(id);
+ }
+
+ public CertDataInfos findCerts(CertSearchData searchData) {
+ return certsClient.searchCerts(
+ searchData,
+ CertsResource.DEFAULT_MAXRESULTS,
+ CertsResource.DEFAULT_MAXTIME);
+ }
+
+ public CertRequestInfo revokeCert(CertId id, CertRevokeRequest request) {
+ return certClient.revokeCert(id, request);
+ }
+
+ public CertRequestInfo revokeCACert(CertId id, CertRevokeRequest request) {
+ return certClient.revokeCACert(id, request);
+ }
+
+ public CertRequestInfo unrevokeCert(CertId id, CertUnrevokeRequest request) {
+ return certClient.unrevokeCert(id, request);
+ }
+}
diff --git a/base/common/src/com/netscape/cms/client/cert/CertRevokeCLI.java b/base/common/src/com/netscape/cms/client/cert/CertRevokeCLI.java
new file mode 100644
index 000000000..ad3276c52
--- /dev/null
+++ b/base/common/src/com/netscape/cms/client/cert/CertRevokeCLI.java
@@ -0,0 +1,164 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2012 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+
+package com.netscape.cms.client.cert;
+
+import java.io.BufferedReader;
+import java.io.InputStreamReader;
+
+import netscape.security.x509.RevocationReason;
+
+import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.Option;
+
+import com.netscape.certsrv.dbs.certdb.CertId;
+import com.netscape.certsrv.request.RequestStatus;
+import com.netscape.cms.client.cli.CLI;
+import com.netscape.cms.client.cli.MainCLI;
+import com.netscape.cms.servlet.cert.model.CertRevokeRequest;
+import com.netscape.cms.servlet.cert.model.CertificateData;
+import com.netscape.cms.servlet.request.model.CertRequestInfo;
+
+/**
+ * @author Endi S. Dewata
+ */
+public class CertRevokeCLI extends CLI {
+
+ public CertCLI parent;
+
+ public CertRevokeCLI(CertCLI parent) {
+ super("revoke", "Revoke certificate");
+ this.parent = parent;
+ }
+
+ public void printHelp() {
+ formatter.printHelp(parent.name + "-" + name + " <Serial Number> [OPTIONS...]", options);
+ }
+
+ public void execute(String[] args) throws Exception {
+
+ StringBuilder sb = new StringBuilder();
+
+ for (RevocationReason reason : RevocationReason.INSTANCES) {
+ if (sb.length() > 0) {
+ sb.append(", ");
+ }
+ sb.append(reason);
+ if (reason == RevocationReason.UNSPECIFIED) {
+ sb.append(" (default)");
+ }
+ }
+
+ Option option = new Option(null, "reason", true, "Revocation reason: " + sb);
+ option.setArgName("reason");
+ options.addOption(option);
+
+ option = new Option(null, "comments", true, "Comments");
+ option.setArgName("comments");
+ options.addOption(option);
+
+ options.addOption(null, "ca", false, "CA signing certificate");
+ options.addOption(null, "force", false, "Force");
+
+ CommandLine cmd = null;
+
+ try {
+ cmd = parser.parse(options, args);
+
+ } catch (Exception e) {
+ System.err.println("Error: " + e.getMessage());
+ printHelp();
+ System.exit(1);
+ }
+
+ String[] cmdArgs = cmd.getArgs();
+
+ if (cmdArgs.length != 1) {
+ printHelp();
+ System.exit(1);
+ }
+
+ CertId certID = new CertId(cmdArgs[0]);
+
+ String string = cmd.getOptionValue("reason", RevocationReason.UNSPECIFIED.toString());
+ RevocationReason reason = RevocationReason.valueOf(string);
+
+ if (reason == null) {
+ System.err.println("Error: Invalid revocation reason: "+string);
+ printHelp();
+ System.exit(1);
+ return;
+ }
+
+ if (!cmd.hasOption("force")) {
+
+ CertificateData certData = parent.client.getCert(certID);
+
+ if (reason == RevocationReason.CERTIFICATE_HOLD) {
+ System.out.println("Placing certificate on-hold:");
+ } else if (reason == RevocationReason.REMOVE_FROM_CRL) {
+ System.out.println("Placing certificate off-hold:");
+ } else {
+ System.out.println("Revoking certificate:");
+ }
+
+ CertCLI.printCertData(certData, false, false);
+
+ System.out.print("Are you sure (Y/N)? ");
+ System.out.flush();
+
+ BufferedReader reader = new BufferedReader(new InputStreamReader(System.in));
+ String line = reader.readLine();
+ if (!line.equalsIgnoreCase("Y")) {
+ System.exit(1);
+ }
+ }
+
+ CertRevokeRequest request = new CertRevokeRequest();
+ request.setReason(reason);
+ request.setComments(cmd.getOptionValue("comments"));
+
+ CertRequestInfo certRequestInfo;
+
+ if (cmd.hasOption("ca")) {
+ certRequestInfo = parent.client.revokeCACert(certID, request);
+ } else {
+ certRequestInfo = parent.client.revokeCert(certID, request);
+ }
+
+ if (verbose) {
+ CertCLI.printCertRequestInfo(certRequestInfo);
+ }
+
+ if (certRequestInfo.getRequestStatus() == RequestStatus.COMPLETE) {
+ if (reason == RevocationReason.CERTIFICATE_HOLD) {
+ MainCLI.printMessage("Placed certificate \"" + certID.toHexString() + "\" on-hold");
+ } else if (reason == RevocationReason.REMOVE_FROM_CRL) {
+ MainCLI.printMessage("Placed certificate \"" + certID.toHexString() + "\" off-hold");
+ } else {
+ MainCLI.printMessage("Revoked certificate \"" + certID.toHexString() + "\"");
+ }
+
+ CertificateData certData = parent.client.getCert(certID);
+ CertCLI.printCertData(certData, false, false);
+
+ } else {
+ MainCLI.printMessage("Request \"" + certRequestInfo.getRequestId() + "\": " + certRequestInfo.getRequestStatus());
+ }
+ }
+}
diff --git a/base/common/src/com/netscape/cms/client/cert/CertShowCLI.java b/base/common/src/com/netscape/cms/client/cert/CertShowCLI.java
new file mode 100644
index 000000000..b050459c4
--- /dev/null
+++ b/base/common/src/com/netscape/cms/client/cert/CertShowCLI.java
@@ -0,0 +1,92 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2012 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+
+package com.netscape.cms.client.cert;
+
+import java.io.FileWriter;
+import java.io.PrintWriter;
+
+import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.Option;
+
+import com.netscape.certsrv.dbs.certdb.CertId;
+import com.netscape.cms.client.cli.CLI;
+import com.netscape.cms.servlet.cert.model.CertificateData;
+
+/**
+ * @author Endi S. Dewata
+ */
+public class CertShowCLI extends CLI {
+
+ public CertCLI parent;
+
+ public CertShowCLI(CertCLI parent) {
+ super("show", "Show certificate");
+ this.parent = parent;
+ }
+
+ public void printHelp() {
+ formatter.printHelp(parent.name + "-" + name + " <Serial Number> [OPTIONS...]", options);
+ }
+
+ public void execute(String[] args) throws Exception {
+
+ Option option = new Option(null, "output", true, "Output file");
+ option.setArgName("file");
+ options.addOption(option);
+
+ options.addOption(null, "pretty", false, "Pretty print");
+ options.addOption(null, "encoded", false, "Base-64 encoded");
+
+ CommandLine cmd = null;
+
+ try {
+ cmd = parser.parse(options, args);
+
+ } catch (Exception e) {
+ System.err.println("Error: " + e.getMessage());
+ printHelp();
+ System.exit(1);
+ }
+
+ boolean showPrettyPrint = cmd.hasOption("pretty");
+ boolean showEncoded = cmd.hasOption("encoded");
+
+ String[] cmdArgs = cmd.getArgs();
+
+ if (cmdArgs.length != 1) {
+ printHelp();
+ System.exit(1);
+ }
+
+ CertId certID = new CertId(cmdArgs[0]);
+ String file = cmd.getOptionValue("output");
+
+ CertificateData certData = parent.client.getCert(certID);
+
+ String encoded = certData.getEncoded();
+ if (encoded != null && file != null) {
+ // store cert to file
+ PrintWriter out = new PrintWriter(new FileWriter(file));
+ out.print(encoded);
+ out.close();
+ }
+
+ CertCLI.printCertData(certData, showPrettyPrint, showEncoded);
+ }
+}
diff --git a/base/common/src/com/netscape/cms/client/cli/MainCLI.java b/base/common/src/com/netscape/cms/client/cli/MainCLI.java
index 4932fb183..55cac0b64 100644
--- a/base/common/src/com/netscape/cms/client/cli/MainCLI.java
+++ b/base/common/src/com/netscape/cms/client/cli/MainCLI.java
@@ -26,6 +26,7 @@ import org.mozilla.jss.crypto.AlreadyInitializedException;
import org.mozilla.jss.crypto.CryptoToken;
import org.mozilla.jss.util.Password;
+import com.netscape.cms.client.cert.CertCLI;
import com.netscape.cms.client.group.GroupCLI;
import com.netscape.cms.client.user.UserCLI;
@@ -48,8 +49,9 @@ public class MainCLI extends CLI {
public MainCLI() throws Exception {
super("pki", "PKI command-line interface");
- addModule(new UserCLI(this));
+ addModule(new CertCLI(this));
addModule(new GroupCLI(this));
+ addModule(new UserCLI(this));
}
public String getProtocol() {
diff --git a/base/common/src/com/netscape/cms/client/group/GroupCLI.java b/base/common/src/com/netscape/cms/client/group/GroupCLI.java
index 26e2c7123..7ea449426 100644
--- a/base/common/src/com/netscape/cms/client/group/GroupCLI.java
+++ b/base/common/src/com/netscape/cms/client/group/GroupCLI.java
@@ -75,6 +75,7 @@ public class GroupCLI extends CLI {
public void execute(String[] args) throws Exception {
client = new GroupRestClient(parent.url + "/pki", parent.certNickname);
+ client.setVerbose(verbose);
String command = args[0];
String[] commandArgs = Arrays.copyOfRange(args, 1, args.length);
diff --git a/base/common/src/com/netscape/cms/client/user/UserCLI.java b/base/common/src/com/netscape/cms/client/user/UserCLI.java
index e9c9acd67..0e18d0692 100644
--- a/base/common/src/com/netscape/cms/client/user/UserCLI.java
+++ b/base/common/src/com/netscape/cms/client/user/UserCLI.java
@@ -76,6 +76,7 @@ public class UserCLI extends CLI {
public void execute(String[] args) throws Exception {
client = new UserRestClient(parent.url + "/pki", parent.certNickname);
+ client.setVerbose(verbose);
String command = args[0];
String[] commandArgs = Arrays.copyOfRange(args, 1, args.length);
diff --git a/base/common/src/com/netscape/cms/servlet/csadmin/CMSRestClient.java b/base/common/src/com/netscape/cms/servlet/csadmin/CMSRestClient.java
index 7f2c75007..ebc851be5 100644
--- a/base/common/src/com/netscape/cms/servlet/csadmin/CMSRestClient.java
+++ b/base/common/src/com/netscape/cms/servlet/csadmin/CMSRestClient.java
@@ -10,12 +10,17 @@ import java.net.UnknownHostException;
import java.util.Enumeration;
import org.apache.commons.httpclient.ConnectTimeoutException;
-import org.apache.http.client.HttpClient;
+import org.apache.http.HttpException;
+import org.apache.http.HttpRequest;
+import org.apache.http.HttpRequestInterceptor;
+import org.apache.http.HttpResponse;
+import org.apache.http.HttpResponseInterceptor;
import org.apache.http.conn.scheme.LayeredSchemeSocketFactory;
import org.apache.http.conn.scheme.Scheme;
import org.apache.http.conn.scheme.SchemeSocketFactory;
import org.apache.http.impl.client.DefaultHttpClient;
import org.apache.http.params.HttpParams;
+import org.apache.http.protocol.HttpContext;
import org.jboss.resteasy.client.ClientExecutor;
import org.jboss.resteasy.client.ClientResponse;
import org.jboss.resteasy.client.ClientResponseFailure;
@@ -29,6 +34,8 @@ import org.mozilla.jss.ssl.SSLSocket;
public abstract class CMSRestClient {
+ protected boolean verbose;
+
protected String clientCertNickname;
protected ResteasyProviderFactory providerFactory;
protected ClientErrorHandler errorHandler;
@@ -53,7 +60,20 @@ public abstract class CMSRestClient {
String protocol = uri.getScheme();
int port = uri.getPort();
- HttpClient httpclient = new DefaultHttpClient();
+ DefaultHttpClient httpclient = new DefaultHttpClient();
+
+ httpclient.addRequestInterceptor(new HttpRequestInterceptor() {
+ public void process(HttpRequest request, HttpContext context) throws HttpException, IOException {
+ if (verbose) System.out.println("HTTP Request: "+request.getRequestLine());
+ }
+ });
+
+ httpclient.addResponseInterceptor(new HttpResponseInterceptor() {
+ public void process(HttpResponse response, HttpContext context) throws HttpException, IOException {
+ if (verbose) System.out.println("HTTP Response: "+response.getStatusLine());
+ }
+ });
+
if (protocol != null && protocol.equals("https")) {
Scheme scheme = new Scheme("https", port, new JSSProtocolSocketFactory());
@@ -190,4 +210,12 @@ public abstract class CMSRestClient {
return response.getEntity();
}
+
+ public boolean isVerbose() {
+ return verbose;
+ }
+
+ public void setVerbose(boolean verbose) {
+ this.verbose = verbose;
+ }
}
diff --git a/base/setup/pki b/base/setup/pki
index f4ab1a4fc..a2d5a69d6 100755
--- a/base/setup/pki
+++ b/base/setup/pki
@@ -73,10 +73,14 @@ if( $ARCHITECTURE eq "i386" ) {
$ENV{CLASSPATH} = "/usr/share/java/${PRODUCT}/pki-certsrv.jar:"
. "/usr/share/java/${PRODUCT}/pki-cms.jar:"
+ . "/usr/share/java/${PRODUCT}/pki-nsutil.jar:"
. "/usr/share/java/apache-commons-cli.jar:"
. "/usr/share/java/apache-commons-lang.jar:"
+ . "/usr/share/java/apache-commons-logging.jar:"
. "/usr/share/java/commons-httpclient.jar:"
. "/usr/share/java/httpcomponents/httpclient.jar:"
+ . "/usr/share/java/httpcomponents/httpcore.jar:"
+ . "/usr/share/java/jaxb-api.jar:"
. "/usr/share/java/resteasy/jaxrs-api.jar:"
. "/usr/share/java/resteasy/resteasy-atom-provider.jar:"
. "/usr/share/java/resteasy/resteasy-jaxb-provider.jar:"