From 0dadf421c327bc32d220405208031a9f7e1bb097 Mon Sep 17 00:00:00 2001 From: "Endi S. Dewata" Date: Thu, 25 Feb 2016 21:31:24 +0100 Subject: Added workaround for JSS limitation in pki pkcs12-import. Currently JSS is unable to import CA certificates while preserving their nicknames. As a workaround, the pki pkcs12-import has been modified such that it exports individual CA certificates from PKCS The remaining user certificates will continue to be imported using JSS. A new pki pkcs12-cert-export command has been added to export individual certificates from PKCS #12 file into PEM files. The pki pkcs12-import has been modified to take a list of nicknames of the certificates to be imported into NSS database. https://fedorahosted.org/pki/ticket/1742 --- .../netscape/cmstools/pkcs12/PKCS12CertCLI.java | 3 +- .../cmstools/pkcs12/PKCS12CertExportCLI.java | 173 +++++++++++++++++++++ .../netscape/cmstools/pkcs12/PKCS12ImportCLI.java | 16 +- 3 files changed, 189 insertions(+), 3 deletions(-) create mode 100644 base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertExportCLI.java (limited to 'base/java-tools/src/com/netscape/cmstools') diff --git a/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertCLI.java b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertCLI.java index 934b799dc..1ed88b1fa 100644 --- a/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertCLI.java +++ b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertCLI.java @@ -32,6 +32,7 @@ public class PKCS12CertCLI extends CLI { super("cert", "PKCS #12 certificate management commands", parent); addModule(new PKCS12CertAddCLI(this)); + addModule(new PKCS12CertExportCLI(this)); addModule(new PKCS12CertFindCLI(this)); addModule(new PKCS12CertRemoveCLI(this)); } @@ -47,7 +48,7 @@ public class PKCS12CertCLI extends CLI { } if (certInfo.getTrustFlags() != null) { - System.out.println(" Trust flags: " + certInfo.getTrustFlags()); + System.out.println(" Trust Flags: " + certInfo.getTrustFlags()); } } } diff --git a/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertExportCLI.java b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertExportCLI.java new file mode 100644 index 000000000..c8ceab757 --- /dev/null +++ b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertExportCLI.java @@ -0,0 +1,173 @@ +// --- BEGIN COPYRIGHT BLOCK --- +// This program is free software; you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation; version 2 of the License. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +// +// (C) 2016 Red Hat, Inc. +// All rights reserved. +// --- END COPYRIGHT BLOCK --- + +package com.netscape.cmstools.pkcs12; + +import java.io.BufferedReader; +import java.io.FileOutputStream; +import java.io.FileReader; +import java.io.PrintStream; +import java.util.logging.Level; +import java.util.logging.Logger; + +import org.apache.commons.cli.CommandLine; +import org.apache.commons.cli.Option; +import org.apache.commons.cli.ParseException; +import org.mozilla.jss.util.Password; + +import com.netscape.cmstools.cli.CLI; +import com.netscape.cmsutil.util.Utils; + +import netscape.security.pkcs.PKCS12; +import netscape.security.pkcs.PKCS12CertInfo; +import netscape.security.pkcs.PKCS12Util; +import netscape.security.x509.X509CertImpl; + +/** + * @author Endi S. Dewata + */ +public class PKCS12CertExportCLI extends CLI { + + public PKCS12CertExportCLI(PKCS12CertCLI certCLI) { + super("export", "Export certificate from PKCS #12 file", certCLI); + + createOptions(); + } + + public void printHelp() { + formatter.printHelp(getFullName() + " [OPTIONS...] ", options); + } + + public void createOptions() { + Option option = new Option(null, "pkcs12", true, "PKCS #12 file"); + option.setArgName("path"); + options.addOption(option); + + option = new Option(null, "pkcs12-password", true, "PKCS #12 password"); + option.setArgName("password"); + options.addOption(option); + + option = new Option(null, "pkcs12-password-file", true, "PKCS #12 password file"); + option.setArgName("path"); + options.addOption(option); + + option = new Option(null, "cert-file", true, "Certificate file"); + option.setArgName("path"); + options.addOption(option); + + options.addOption("v", "verbose", false, "Run in verbose mode."); + options.addOption(null, "debug", false, "Run in debug mode."); + options.addOption(null, "help", false, "Show help message."); + } + + public void execute(String[] args) throws Exception { + + CommandLine cmd = null; + + try { + cmd = parser.parse(options, args); + } catch (ParseException e) { + System.err.println("Error: " + e.getMessage()); + printHelp(); + System.exit(-1); + } + + if (cmd.hasOption("help")) { + printHelp(); + System.exit(0); + } + + if (cmd.hasOption("verbose")) { + Logger.getLogger("org.dogtagpki").setLevel(Level.INFO); + Logger.getLogger("com.netscape").setLevel(Level.INFO); + Logger.getLogger("netscape").setLevel(Level.INFO); + + } else if (cmd.hasOption("debug")) { + Logger.getLogger("org.dogtagpki").setLevel(Level.FINE); + Logger.getLogger("com.netscape").setLevel(Level.FINE); + Logger.getLogger("netscape").setLevel(Level.FINE); + } + + String[] cmdArgs = cmd.getArgs(); + + if (cmdArgs.length < 1) { + System.err.println("Error: Missing certificate nickname."); + printHelp(); + System.exit(-1); + } + + String nickname = cmdArgs[0]; + + String pkcs12File = cmd.getOptionValue("pkcs12"); + + if (pkcs12File == null) { + System.err.println("Error: Missing PKCS #12 file."); + printHelp(); + System.exit(-1); + } + + String passwordString = cmd.getOptionValue("pkcs12-password"); + + if (passwordString == null) { + + String passwordFile = cmd.getOptionValue("pkcs12-password-file"); + if (passwordFile != null) { + try (BufferedReader in = new BufferedReader(new FileReader(passwordFile))) { + passwordString = in.readLine(); + } + } + } + + if (passwordString == null) { + System.err.println("Error: Missing PKCS #12 password."); + printHelp(); + System.exit(-1); + } + + Password password = new Password(passwordString.toCharArray()); + + String certFile = cmd.getOptionValue("cert-file"); + + if (certFile == null) { + System.err.println("Error: Missing certificate file."); + printHelp(); + System.exit(-1); + } + + try { + PKCS12Util util = new PKCS12Util(); + PKCS12 pkcs12 = util.loadFromFile(pkcs12File, password); + + PKCS12CertInfo certInfo = pkcs12.getCertInfoByNickname(nickname); + if (certInfo == null) { + System.err.println("Error: Certificate not found."); + System.exit(-1); + } + + X509CertImpl cert = certInfo.getCert(); + try (PrintStream os = new PrintStream(new FileOutputStream(certFile))) { + os.println("-----BEGIN CERTIFICATE-----"); + os.print(Utils.base64encode(cert.getEncoded())); + os.println("-----END CERTIFICATE-----"); + } + + } finally { + password.clear(); + } + } +} diff --git a/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12ImportCLI.java b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12ImportCLI.java index 3e42efcbc..bdd8f52bc 100644 --- a/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12ImportCLI.java +++ b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12ImportCLI.java @@ -44,7 +44,7 @@ public class PKCS12ImportCLI extends CLI { } public void printHelp() { - formatter.printHelp(getFullName() + " [OPTIONS...]", options); + formatter.printHelp(getFullName() + " [OPTIONS...] [nicknames...]", options); } public void createOptions() { @@ -95,6 +95,7 @@ public class PKCS12ImportCLI extends CLI { Logger.getLogger("netscape").setLevel(Level.FINE); } + String[] nicknames = cmd.getArgs(); String filename = cmd.getOptionValue("pkcs12"); if (filename == null) { @@ -130,7 +131,18 @@ public class PKCS12ImportCLI extends CLI { util.setTrustFlagsEnabled(trustFlagsEnabled); PKCS12 pkcs12 = util.loadFromFile(filename, password); - util.storeIntoNSS(pkcs12, password); + + if (nicknames.length == 0) { + // store all certificates + util.storeIntoNSS(pkcs12); + + } else { + // load specified certificates + for (String nickname : nicknames) { + util.storeCertIntoNSS(pkcs12, nickname); + } + } + } finally { password.clear(); -- cgit