Obter dados REAIS X.509 de RFC1421 formatado certificado
-
12-09-2019 - |
Pergunta
Nós temos uma aplicação Java que armazena RSA chaves públicas e permite que um usuário para criptografar uma pequena corrente de informações com qualquer uma das teclas. O aplicativo também permite ao usuário importar um novo certificado de chave no armazenamento de chaves. Quando carregar o certificado de um arquivo, nós queremos usar o nome comum (CN) como o alias. Aqui está o problema:
CertificateFactory x509CertFact = CertificateFactory.getInstance("X.509");
X509Certificate cert = x509CertFact.generateCertificate(certificateInputStream);
String alias = cert.getSubjectX500Principal().getName();
assert alias.equals("CN=CommonName, OU=TestCo..."); // FAILS
assert alais.equals("cn=commonname, ou=testco..."); // PASSES
Nós sabemos para um fato que o nome do assunto no arquivo tem caixa mista e precisamos preservar essa caixa. Alguém sabe como obter suporte X.509 mais flexível do JCE em Java6?
Nós pensamos em usar a API leve BouncyCastle, mas a documentação é quase inexistente.
EDIT: Usando JDK 6u11 Aqui está a lista de provedores de segurança de java.security:
security.provider.1=sun.security.provider.Sun
security.provider.2=sun.security.rsa.SunRsaSign
security.provider.3=com.sun.net.ssl.internal.ssl.Provider
security.provider.4=com.sun.crypto.provider.SunJCE
security.provider.5=sun.security.jgss.SunProvider
security.provider.6=com.sun.security.sasl.Provider
security.provider.7=org.jcp.xml.dsig.internal.dom.XMLDSigRI
security.provider.8=sun.security.smartcardio.SunPCSC
security.provider.9=sun.security.mscapi.SunMSCAPI
security.provider.10=org.bouncycastle.jce.provider.BouncyCastleProvider
O certificado:
-----BEGIN CERTIFICATE----- MIIDHjCCAtugAwIBAgIESnr4OzALBgcqhkjOOAQDBQAwcjELMAkGA1UEBhMCVVMxFTATBgNVBAoT DEdlbWFsdG8gSW5jLjEnMCUGA1UECxMeU29sdXRpb25zIGFuZCBTcGVjaWFsIFByb2plY3RzMSMw IQYDVQQDExpGUkJCTHVuYUNyeXB0b1NlcnZlci0xLjAuMDAeFw0wOTA4MDYxNTM1MjNaFw0wOTEx MDQxNTM1MjNaMHIxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxHZW1hbHRvIEluYy4xJzAlBgNVBAsT HlNvbHV0aW9ucyBhbmQgU3BlY2lhbCBQcm9qZWN0czEjMCEGA1UEAxMaRlJCQkx1bmFDcnlwdG9T ZXJ2ZXItMS4wLjAwggG3MIIBLAYHKoZIzjgEATCCAR8CgYEA/X9TgR11EilS30qcLuzk5/YRt1I8 70QAwx4/gLZRJmlFXUAiUftZPY1Y+r/F9bow9subVWzXgTuAHTRv8mZgt2uZUKWkn5/oBHsQIsJP u6nX/rfGG/g7V+fGqKYVDwT7g/bTxR7DAjVUE1oWkTL2dfOuK2HXKu/yIgMZndFIAccCFQCXYFCP FSMLzLKSuYKi64QL8Fgc9QKBgQD34aCF1ps93su8q1w2uFe5eZSvu/o66oL5V0wLPQeCZ1FZV466 1FlP5nEHEIGAtEkWcSPoTCgWE7fPCTKMyKbhPBZ6i1R8jSjgo64eK7OmdZFuo38L+iE1YvH7YnoB JDvMpPG+qFGQiaiD3+Fa5Z8GkotmXoB7VSVkAUw7/s9JKgOBhAACgYBHBBVNzuoXgpPFPkSN71rI MKkSIUAVE7iLagFCklCEvHlh1UxyRhCWNh/UazaJzHRZofWlVPRGmgtl+J6BJRJIDorPqt8FfifY fpbAbCQctMToFF5QqggumOlJozXyfV9eyYyNn+Y4yZDr8JKq70WX/S2M+Oo1+SBJsXMTeDdfkDAL BgcqhkjOOAQDBQADMAAwLQIUA+VcqEYMHwXdKY4XC+oO/zF/pRkCFQCDKAS5HpSMazbZgToEEYft QFJSvw== -----END CERTIFICATE-----
Solução
If you mean that you are literally using the identity operator (==
) to test, then the assertion should always fail. Use alias.equals("CN=CommonName, OU=...") instead.
However, assuming that's not the problem, can add:
System.out.println(x509CertFact.getProvider());
System.out.println(alias);
at the appropriate points in the code and post the results? It might turn up more leads. Posting the certificate you are loading (in text-friendly PEM format) would be helpful too, if it isn't disclosing any personally-identifying information.
Outras dicas
Try using X500Principal#getName(String) to get the DN in the format of your choice. Then you can parse the common name out of that.
Alternatively, if you're mapping an alias to an actual certificate you could store the "alias" in all caps (and query it in all caps) but you would still have the original casing from the mapped certificate
Can't reproduce the error. What JCE do you use? We use the Sun's JCE from Java 5 and 6 and we always get the DN in original case.